OQS_AES128_ECB_load_schedule: 18| 120|void OQS_AES128_ECB_load_schedule(const uint8_t *key, void **schedule) { 19| 120| callbacks->AES128_ECB_load_schedule(key, schedule); 20| 120|} OQS_AES128_free_schedule: 34| 120|void OQS_AES128_free_schedule(void *schedule) { 35| 120| callbacks->AES128_free_schedule(schedule); 36| 120|} OQS_AES128_ECB_enc_sch: 62| 21.6k|void OQS_AES128_ECB_enc_sch(const uint8_t *plaintext, const size_t plaintext_len, const void *schedule, uint8_t *ciphertext) { 63| 21.6k| callbacks->AES128_ECB_enc_sch(plaintext, plaintext_len, schedule, ciphertext); 64| 21.6k|} oqs_aes128_load_schedule_ni: 51| 120|void oqs_aes128_load_schedule_ni(const uint8_t *key, void **_schedule) { 52| 120| *_schedule = OQS_MEM_malloc(sizeof(aes128ctx)); 53| 120| OQS_EXIT_IF_NULLPTR(*_schedule, "AES"); ------------------ | | 82| 120| do { \ | | 83| 120| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 120] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 120| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 120] | | ------------------ ------------------ 54| 120| assert(*_schedule != NULL); 55| 120| __m128i *schedule = ((aes128ctx *) *_schedule)->sk_exp; 56| 120| aes128ni_setkey_encrypt(key, schedule); 57| 120|} oqs_aes128_free_schedule_ni: 77| 120|void oqs_aes128_free_schedule_ni(void *schedule) { 78| 120| if (schedule != NULL) { ------------------ | Branch (78:6): [True: 120, False: 0] ------------------ 79| 120| OQS_MEM_secure_free(schedule, sizeof(aes128ctx)); 80| 120| } 81| 120|} oqs_aes128_enc_sch_block_ni: 135| 18.5M|void oqs_aes128_enc_sch_block_ni(const uint8_t *plaintext, const void *_schedule, uint8_t *ciphertext) { 136| 18.5M| const __m128i *schedule = ((const aes128ctx *) _schedule)->sk_exp; 137| 18.5M| aes128ni_encrypt(schedule, _mm_loadu_si128((const __m128i *)plaintext), ciphertext); 138| 18.5M|} oqs_aes128_ecb_enc_sch_ni: 140| 21.6k|void oqs_aes128_ecb_enc_sch_ni(const uint8_t *plaintext, const size_t plaintext_len, const void *schedule, uint8_t *ciphertext) { 141| 21.6k| assert(plaintext_len % 16 == 0); 142| 18.5M| for (size_t block = 0; block < plaintext_len / 16; block++) { ------------------ | Branch (142:25): [True: 18.5M, False: 21.6k] ------------------ 143| 18.5M| oqs_aes128_enc_sch_block_ni(plaintext + (16 * block), schedule, ciphertext + (16 * block)); 144| 18.5M| } 145| 21.6k|} aes128_ni.c:aes128ni_setkey_encrypt: 20| 120|static inline void aes128ni_setkey_encrypt(const unsigned char *key, __m128i rkeys[11]) { 21| 120| __m128i key0 = _mm_loadu_si128((const __m128i *)(key + 0)); 22| 120| __m128i temp0, temp1, temp4; 23| 120| int idx = 0; 24| | 25| 120| temp0 = key0; 26| | 27| | /* blockshift-based block by Cedric Bourrasset */ 28| 120|#define BLOCK1(IMM) \ 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ 30| 120| rkeys[idx++] = temp0; \ 31| 120| temp4 = _mm_slli_si128(temp0,4); \ 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ 33| 120| temp4 = _mm_slli_si128(temp0,8); \ 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ 36| 120| temp0 = _mm_xor_si128(temp0,temp1) 37| | 38| 120| BLOCK1(0x01); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 39| 120| BLOCK1(0x02); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 40| 120| BLOCK1(0x04); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 41| 120| BLOCK1(0x08); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 42| 120| BLOCK1(0x10); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 43| 120| BLOCK1(0x20); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 44| 120| BLOCK1(0x40); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 45| 120| BLOCK1(0x80); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 46| 120| BLOCK1(0x1b); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 47| | BLOCK1(0x36); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 48| 120| rkeys[idx++] = temp0; 49| 120|} aes128_ni.c:aes128ni_encrypt: 84| 18.5M|static inline void aes128ni_encrypt(const __m128i rkeys[11], __m128i nv, unsigned char *out) { 85| 18.5M| __m128i temp = _mm_xor_si128(nv, rkeys[0]); 86| 18.5M| temp = _mm_aesenc_si128(temp, rkeys[1]); 87| 18.5M| temp = _mm_aesenc_si128(temp, rkeys[2]); 88| 18.5M| temp = _mm_aesenc_si128(temp, rkeys[3]); 89| 18.5M| temp = _mm_aesenc_si128(temp, rkeys[4]); 90| 18.5M| temp = _mm_aesenc_si128(temp, rkeys[5]); 91| 18.5M| temp = _mm_aesenc_si128(temp, rkeys[6]); 92| 18.5M| temp = _mm_aesenc_si128(temp, rkeys[7]); 93| 18.5M| temp = _mm_aesenc_si128(temp, rkeys[8]); 94| 18.5M| temp = _mm_aesenc_si128(temp, rkeys[9]); 95| 18.5M| temp = _mm_aesenclast_si128(temp, rkeys[10]); 96| 18.5M| _mm_storeu_si128((__m128i *)(out), temp); 97| 18.5M|} aes_impl.c:AES128_ECB_load_schedule: 41| 120|static void AES128_ECB_load_schedule(const uint8_t *key, void **_schedule) { 42| 120| C_OR_NI_OR_ARM( ------------------ | | 14| 120| do { \ | | 15| 120| if (OQS_CPU_has_extension(OQS_CPU_EXT_AES)) { \ | | ------------------ | | | Branch (15:11): [True: 120, False: 0] | | ------------------ | | 16| 120| stmt_ni; \ | | 17| 120| } else { \ | | 18| 0| stmt_c; \ | | 19| 0| } \ | | 20| 120| } while(0) | | ------------------ | | | Branch (20:12): [Folded, False: 120] | | ------------------ ------------------ 43| 120| oqs_aes128_load_schedule_c(key, _schedule), 44| 120| oqs_aes128_load_schedule_ni(key, _schedule), 45| 120| oqs_aes128_load_schedule_no_bitslice(key, _schedule) 46| 120| ); 47| 120|} aes_impl.c:AES128_free_schedule: 69| 120|static void AES128_free_schedule(void *schedule) { 70| 120| C_OR_NI_OR_ARM( ------------------ | | 14| 120| do { \ | | 15| 120| if (OQS_CPU_has_extension(OQS_CPU_EXT_AES)) { \ | | ------------------ | | | Branch (15:11): [True: 120, False: 0] | | ------------------ | | 16| 120| stmt_ni; \ | | 17| 120| } else { \ | | 18| 0| stmt_c; \ | | 19| 0| } \ | | 20| 120| } while(0) | | ------------------ | | | Branch (20:12): [Folded, False: 120] | | ------------------ ------------------ 71| 120| oqs_aes128_free_schedule_c(schedule), 72| 120| oqs_aes128_free_schedule_ni(schedule), 73| 120| oqs_aes128_free_schedule_no_bitslice(schedule) 74| 120| ); 75| 120|} aes_impl.c:AES128_ECB_enc_sch: 122| 21.6k|static void AES128_ECB_enc_sch(const uint8_t *plaintext, const size_t plaintext_len, const void *schedule, uint8_t *ciphertext) { 123| 21.6k| C_OR_NI_OR_ARM( ------------------ | | 14| 21.6k| do { \ | | 15| 21.6k| if (OQS_CPU_has_extension(OQS_CPU_EXT_AES)) { \ | | ------------------ | | | Branch (15:11): [True: 21.6k, False: 0] | | ------------------ | | 16| 21.6k| stmt_ni; \ | | 17| 21.6k| } else { \ | | 18| 0| stmt_c; \ | | 19| 0| } \ | | 20| 21.6k| } while(0) | | ------------------ | | | Branch (20:12): [Folded, False: 21.6k] | | ------------------ ------------------ 124| 21.6k| oqs_aes128_ecb_enc_sch_c(plaintext, plaintext_len, schedule, ciphertext), 125| 21.6k| oqs_aes128_ecb_enc_sch_ni(plaintext, plaintext_len, schedule, ciphertext), 126| 21.6k| oqs_aes128_ecb_enc_sch_armv8(plaintext, plaintext_len, schedule, ciphertext) 127| 21.6k| ); 128| 21.6k|} OQS_CPU_has_extension: 219| 35.8k|OQS_API int OQS_CPU_has_extension(OQS_CPU_EXT ext) { 220| 35.8k|#if defined(OQS_DIST_BUILD) 221| 35.8k|#if defined(OQS_USE_PTHREADS) 222| 35.8k| pthread_once(&once_control, &set_available_cpu_extensions); 223| |#else 224| | if (0 == cpu_ext_data[OQS_CPU_EXT_INIT]) { 225| | set_available_cpu_extensions(); 226| | } 227| |#endif 228| 35.8k| if (0 < ext && ext < OQS_CPU_EXT_COUNT) { ------------------ | Branch (228:6): [True: 34.0k, False: 1.78k] | Branch (228:17): [True: 34.0k, False: 0] ------------------ 229| 34.0k| return (int)cpu_ext_data[ext]; 230| 34.0k| } 231| |#else 232| | (void)ext; 233| |#endif 234| 1.78k| return 0; 235| 35.8k|} OQS_init: 237| 1.78k|OQS_API void OQS_init(void) { 238| 1.78k|#if defined(OQS_DIST_BUILD) 239| 1.78k| OQS_CPU_has_extension(OQS_CPU_EXT_INIT); 240| 1.78k|#endif 241| 1.78k|} OQS_destroy: 253| 1.78k|OQS_API void OQS_destroy(void) { 254| 1.78k|#if defined(OQS_USE_OPENSSL) 255| 1.78k| oqs_ossl_destroy(); 256| 1.78k|#endif 257| 1.78k|} OQS_MEM_cleanse: 271| 59.6k|OQS_API void OQS_MEM_cleanse(void *ptr, size_t len) { 272| 59.6k| if (ptr == NULL) { ------------------ | Branch (272:6): [True: 0, False: 59.6k] ------------------ 273| 0| return; 274| 0| } 275| 59.6k|#if defined(OQS_USE_OPENSSL) 276| 59.6k| OSSL_FUNC(OPENSSL_cleanse)(ptr, len); ------------------ | | 66| 59.6k|#define OSSL_FUNC(name) name ------------------ 277| |#elif defined(_WIN32) 278| | SecureZeroMemory(ptr, len); 279| |#elif defined(OQS_HAVE_EXPLICIT_BZERO) 280| | explicit_bzero(ptr, len); 281| |#elif defined(OQS_HAVE_EXPLICIT_MEMSET) 282| | explicit_memset(ptr, 0, len); 283| |#elif defined(__STDC_LIB_EXT1__) || defined(OQS_HAVE_MEMSET_S) 284| | if (0U < len && memset_s(ptr, (rsize_t)len, 0, (rsize_t)len) != 0) { 285| | abort(); 286| | } 287| |#else 288| | typedef void *(*memset_t)(void *, int, size_t); 289| | static volatile memset_t memset_func = memset; 290| | memset_func(ptr, 0, len); 291| |#endif 292| 59.6k|} OQS_MEM_secure_free: 294| 5.48k|OQS_API void OQS_MEM_secure_free(void *ptr, size_t len) { 295| 5.48k| if (ptr != NULL) { ------------------ | Branch (295:6): [True: 5.48k, False: 0] ------------------ 296| 5.48k| OQS_MEM_cleanse(ptr, len); 297| 5.48k| OQS_MEM_insecure_free(ptr); 298| 5.48k| } 299| 5.48k|} OQS_MEM_insecure_free: 301| 10.8k|OQS_API void OQS_MEM_insecure_free(void *ptr) { 302| 10.8k|#if defined(OQS_USE_OPENSSL) && defined(OPENSSL_VERSION_NUMBER) 303| 10.8k| OSSL_FUNC(CRYPTO_free)(ptr, OPENSSL_FILE, OPENSSL_LINE); ------------------ | | 66| 10.8k|#define OSSL_FUNC(name) name ------------------ 304| |#else 305| | free(ptr); // IGNORE memory-check 306| |#endif 307| 10.8k|} OQS_MEM_aligned_alloc: 309| 47.2k|void *OQS_MEM_aligned_alloc(size_t alignment, size_t size) { 310| 47.2k|#if defined(OQS_USE_OPENSSL) 311| | // Use OpenSSL's memory allocation functions 312| 47.2k| if (!size) { ------------------ | Branch (312:6): [True: 0, False: 47.2k] ------------------ 313| 0| return NULL; 314| 0| } 315| | // Check alignment (power of 2, and >= sizeof(void*)) and size (multiple of alignment) 316| 47.2k| if (alignment & (alignment - 1) || size & (alignment - 1) || alignment < sizeof(void *)) { ------------------ | Branch (316:6): [True: 0, False: 47.2k] | Branch (316:37): [True: 0, False: 47.2k] | Branch (316:63): [True: 0, False: 47.2k] ------------------ 317| 0| errno = EINVAL; 318| 0| return NULL; 319| 0| } 320| 47.2k| const size_t offset = alignment - 1 + sizeof(uint8_t); 321| 47.2k| if (offset > SIZE_MAX - size) { ------------------ | Branch (321:6): [True: 0, False: 47.2k] ------------------ 322| 0| return NULL; 323| 0| } 324| 47.2k| uint8_t *buffer = OSSL_FUNC(CRYPTO_malloc)(size + offset, OPENSSL_FILE, OPENSSL_LINE); ------------------ | | 66| 47.2k|#define OSSL_FUNC(name) name ------------------ 325| 47.2k| if (!buffer) { ------------------ | Branch (325:6): [True: 0, False: 47.2k] ------------------ 326| 0| return NULL; 327| 0| } 328| 47.2k| uint8_t *ptr = (uint8_t *)(((uintptr_t)(buffer) + offset) & ~(alignment - 1)); 329| 47.2k| ptrdiff_t diff = ptr - buffer; 330| 47.2k| if (diff > UINT8_MAX) { ------------------ | Branch (330:6): [True: 0, False: 47.2k] ------------------ 331| | // Free and return NULL if alignment is too large 332| 0| OSSL_FUNC(CRYPTO_free)(buffer, OPENSSL_FILE, OPENSSL_LINE); ------------------ | | 66| 0|#define OSSL_FUNC(name) name ------------------ 333| 0| errno = EINVAL; 334| 0| return NULL; 335| 0| } 336| | // Store the difference so that the free function can use it 337| 47.2k| ptr[-1] = (uint8_t)diff; 338| 47.2k| return ptr; 339| |#elif defined(OQS_HAVE_ALIGNED_ALLOC) // glibc and other implementations providing aligned_alloc 340| | return aligned_alloc(alignment, size); 341| |#else 342| | // Check alignment (power of 2, and >= sizeof(void*)) and size (multiple of alignment) 343| | if (alignment & (alignment - 1) || size & (alignment - 1) || alignment < sizeof(void *)) { 344| | errno = EINVAL; 345| | return NULL; 346| | } 347| | 348| |#if defined(OQS_HAVE_POSIX_MEMALIGN) 349| | void *ptr = NULL; 350| | const int err = posix_memalign(&ptr, alignment, size); 351| | if (err) { 352| | errno = err; 353| | ptr = NULL; 354| | } 355| | return ptr; 356| |#elif defined(OQS_HAVE_MEMALIGN) 357| | return memalign(alignment, size); 358| |#elif defined(__MINGW32__) || defined(__MINGW64__) 359| | return __mingw_aligned_malloc(size, alignment); 360| |#elif defined(_MSC_VER) 361| | return _aligned_malloc(size, alignment); 362| |#else 363| | if (!size) { 364| | return NULL; 365| | } 366| | // Overallocate to be able to align the pointer (alignment -1) and to store 367| | // the difference between the pointer returned to the user (ptr) and the 368| | // pointer returned by malloc (buffer). The difference is caped to 255 and 369| | // can be made larger if necessary, but this should be enough for all users 370| | // in liboqs. 371| | // 372| | // buffer ptr 373| | // ↓ ↓ 374| | // ...........|................... 375| | // | 376| | // diff = ptr - buffer 377| | const size_t offset = alignment - 1 + sizeof(uint8_t); 378| | if (offset > SIZE_MAX - size) { 379| | return NULL; 380| | } 381| | uint8_t *buffer = malloc(size + offset); // IGNORE memory-check 382| | if (!buffer) { 383| | return NULL; 384| | } 385| | 386| | // Align the pointer returned to the user. 387| | uint8_t *ptr = (uint8_t *)(((uintptr_t)(buffer) + offset) & ~(alignment - 1)); 388| | ptrdiff_t diff = ptr - buffer; 389| | if (diff > UINT8_MAX) { 390| | // This should never happen in our code, but just to be safe 391| | free(buffer); // IGNORE memory-check 392| | errno = EINVAL; 393| | return NULL; 394| | } 395| | // Store the difference one byte ahead the returned poitner so that free 396| | // can reconstruct buffer. 397| | ptr[-1] = diff; 398| | return ptr; 399| |#endif 400| |#endif 401| 47.2k|} OQS_MEM_aligned_free: 403| 47.2k|void OQS_MEM_aligned_free(void *ptr) { 404| 47.2k| if (ptr == NULL) { ------------------ | Branch (404:6): [True: 0, False: 47.2k] ------------------ 405| 0| return; 406| 0| } 407| 47.2k|#if defined(OQS_USE_OPENSSL) 408| | // Use OpenSSL's free function 409| 47.2k| uint8_t *u8ptr = ptr; 410| 47.2k| OSSL_FUNC(CRYPTO_free)(u8ptr - u8ptr[-1], OPENSSL_FILE, OPENSSL_LINE); ------------------ | | 66| 47.2k|#define OSSL_FUNC(name) name ------------------ 411| |#elif defined(OQS_HAVE_ALIGNED_ALLOC) || defined(OQS_HAVE_POSIX_MEMALIGN) || defined(OQS_HAVE_MEMALIGN) 412| | free(ptr); // IGNORE memory-check 413| |#elif defined(__MINGW32__) || defined(__MINGW64__) 414| | __mingw_aligned_free(ptr); 415| |#elif defined(_MSC_VER) 416| | _aligned_free(ptr); 417| |#else 418| | // Reconstruct the pointer returned from malloc using the difference 419| | // stored one byte ahead of ptr. 420| | uint8_t *u8ptr = ptr; 421| | free(u8ptr - u8ptr[-1]); // IGNORE memory-check 422| |#endif 423| 47.2k|} OQS_MEM_aligned_secure_free: 425| 47.2k|void OQS_MEM_aligned_secure_free(void *ptr, size_t len) { 426| 47.2k| OQS_MEM_cleanse(ptr, len); 427| 47.2k| OQS_MEM_aligned_free(ptr); 428| 47.2k|} OQS_MEM_malloc: 430| 9.06k|OQS_API void *OQS_MEM_malloc(size_t size) { 431| 9.06k|#if defined(OQS_USE_OPENSSL) 432| 9.06k| return OSSL_FUNC(CRYPTO_malloc)(size, OPENSSL_FILE, OPENSSL_LINE); ------------------ | | 66| 9.06k|#define OSSL_FUNC(name) name ------------------ 433| |#else 434| | return malloc(size); // IGNORE memory-check 435| |#endif 436| 9.06k|} OQS_MEM_calloc: 438| 1.78k|OQS_API void *OQS_MEM_calloc(size_t num_elements, size_t element_size) { 439| 1.78k|#if defined(OQS_USE_OPENSSL) 440| 1.78k| if (element_size != 0 && num_elements > SIZE_MAX / element_size) { ------------------ | Branch (440:6): [True: 1.78k, False: 0] | Branch (440:27): [True: 0, False: 1.78k] ------------------ 441| 0| return NULL; 442| 0| } 443| 1.78k| return OSSL_FUNC(CRYPTO_zalloc)(num_elements * element_size, ------------------ | | 66| 1.78k|#define OSSL_FUNC(name) name ------------------ 444| 1.78k| OPENSSL_FILE, OPENSSL_LINE); 445| |#else 446| | return calloc(num_elements, element_size); // IGNORE memory-check 447| |#endif 448| 1.78k|} common.c:set_available_cpu_extensions: 47| 1|static void set_available_cpu_extensions(void) { 48| | /* mark that this function has been called */ 49| 1| cpu_ext_data[OQS_CPU_EXT_INIT] = 1; 50| | 51| 1| cpuid_out leaf_1; 52| 1| cpuid(&leaf_1, 1); 53| 1| if (leaf_1.eax == 0) { ------------------ | Branch (53:6): [True: 0, False: 1] ------------------ 54| 0| return; 55| 0| } 56| | 57| 1| cpuid_out leaf_7; 58| 1| cpuid(&leaf_7, 7); 59| | 60| 1| const unsigned int has_xsave = is_bit_set(leaf_1.ecx, 26); 61| 1| const unsigned int has_osxsave = is_bit_set(leaf_1.ecx, 27); 62| 1| const uint32_t xcr0_eax = (has_xsave && has_osxsave) ? xgetbv_eax(0) : 0; ------------------ | Branch (62:29): [True: 1, False: 0] | Branch (62:42): [True: 1, False: 0] ------------------ 63| | 64| 1| cpu_ext_data[OQS_CPU_EXT_AES] = is_bit_set(leaf_1.ecx, 25); 65| 1| if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM)) { ------------------ | | 14| 1|#define MASK_XMM 0x2 ------------------ if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM)) { ------------------ | | 15| 1|#define MASK_YMM 0x4 ------------------ | Branch (65:6): [True: 1, False: 0] ------------------ 66| 1| cpu_ext_data[OQS_CPU_EXT_AVX] = is_bit_set(leaf_1.ecx, 28); 67| 1| cpu_ext_data[OQS_CPU_EXT_AVX2] = is_bit_set(leaf_7.ebx, 5); 68| 1| } 69| 1| cpu_ext_data[OQS_CPU_EXT_PCLMULQDQ] = is_bit_set(leaf_1.ecx, 1); 70| 1| cpu_ext_data[OQS_CPU_EXT_POPCNT] = is_bit_set(leaf_1.ecx, 23); 71| 1| cpu_ext_data[OQS_CPU_EXT_BMI1] = is_bit_set(leaf_7.ebx, 3); 72| 1| cpu_ext_data[OQS_CPU_EXT_BMI2] = is_bit_set(leaf_7.ebx, 8); 73| 1| cpu_ext_data[OQS_CPU_EXT_ADX] = is_bit_set(leaf_7.ebx, 19); 74| | 75| 1| if (has_mask(xcr0_eax, MASK_XMM)) { ------------------ | | 14| 1|#define MASK_XMM 0x2 ------------------ | Branch (75:6): [True: 1, False: 0] ------------------ 76| 1| cpu_ext_data[OQS_CPU_EXT_SSE] = is_bit_set(leaf_1.edx, 25); 77| 1| cpu_ext_data[OQS_CPU_EXT_SSE2] = is_bit_set(leaf_1.edx, 26); 78| 1| cpu_ext_data[OQS_CPU_EXT_SSE3] = is_bit_set(leaf_1.ecx, 0); 79| 1| } 80| | 81| 1| if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM | MASK_MASKREG | MASK_ZMM0_15 | MASK_ZMM16_31)) { ------------------ | | 14| 1|#define MASK_XMM 0x2 ------------------ if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM | MASK_MASKREG | MASK_ZMM0_15 | MASK_ZMM16_31)) { ------------------ | | 15| 1|#define MASK_YMM 0x4 ------------------ if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM | MASK_MASKREG | MASK_ZMM0_15 | MASK_ZMM16_31)) { ------------------ | | 16| 1|#define MASK_MASKREG 0x20 ------------------ if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM | MASK_MASKREG | MASK_ZMM0_15 | MASK_ZMM16_31)) { ------------------ | | 17| 1|#define MASK_ZMM0_15 0x40 ------------------ if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM | MASK_MASKREG | MASK_ZMM0_15 | MASK_ZMM16_31)) { ------------------ | | 18| 1|#define MASK_ZMM16_31 0x80 ------------------ | Branch (81:6): [True: 0, False: 1] ------------------ 82| 0| unsigned int avx512f = is_bit_set(leaf_7.ebx, 16); 83| 0| unsigned int avx512bw = is_bit_set(leaf_7.ebx, 30); 84| 0| unsigned int avx512dq = is_bit_set(leaf_7.ebx, 17); 85| 0| if (avx512f && avx512bw && avx512dq) { ------------------ | Branch (85:7): [True: 0, False: 0] | Branch (85:18): [True: 0, False: 0] | Branch (85:30): [True: 0, False: 0] ------------------ 86| 0| cpu_ext_data[OQS_CPU_EXT_AVX512] = 1; 87| 0| } 88| 0| cpu_ext_data[OQS_CPU_EXT_VPCLMULQDQ] = is_bit_set(leaf_7.ecx, 10); 89| 0| } 90| 1|} oqs_ossl_destroy: 89| 1.78k|void oqs_ossl_destroy(void) { 90| 1.78k|#if OPENSSL_VERSION_NUMBER >= 0x30000000L 91| 1.78k|#if defined(OQS_USE_PTHREADS) 92| 1.78k| pthread_once(&free_once_control, free_ossl_objects); 93| |#else 94| | if (sha256_ptr || sha384_ptr || sha512_ptr || sha3_256_ptr || 95| | sha3_384_ptr || sha3_512_ptr || shake128_ptr || shake256_ptr || 96| | aes128_ecb_ptr || aes128_ctr_ptr || aes256_ecb_ptr || aes256_ctr_ptr) { 97| | free_ossl_objects(); 98| | } 99| |#endif 100| 1.78k|#endif 101| 1.78k|} oqs_sha512: 182| 90|const EVP_MD *oqs_sha512(void) { 183| 90|#if OPENSSL_VERSION_NUMBER >= 0x30000000L 184| 90|#if defined(OQS_USE_PTHREADS) 185| 90| if (pthread_once(&init_once_control, fetch_ossl_objects)) { ------------------ | Branch (185:6): [True: 0, False: 90] ------------------ 186| 0| return NULL; 187| 0| } 188| |#else 189| | if (!sha512_ptr) { 190| | fetch_ossl_objects(); 191| | } 192| |#endif 193| 90| return sha512_ptr; 194| |#else 195| | return OSSL_FUNC(EVP_sha512)(); 196| |#endif 197| 90|} ossl_helpers.c:free_ossl_objects: 73| 1|static void free_ossl_objects(void) { 74| 1| cleanup_evp_md(&sha256_ptr); 75| 1| cleanup_evp_md(&sha384_ptr); 76| 1| cleanup_evp_md(&sha512_ptr); 77| 1| cleanup_evp_md(&sha3_256_ptr); 78| 1| cleanup_evp_md(&sha3_384_ptr); 79| 1| cleanup_evp_md(&sha3_512_ptr); 80| 1| cleanup_evp_md(&shake128_ptr); 81| 1| cleanup_evp_md(&shake256_ptr); 82| 1| cleanup_evp_cipher(&aes128_ecb_ptr); 83| 1| cleanup_evp_cipher(&aes128_ctr_ptr); 84| 1| cleanup_evp_cipher(&aes256_ecb_ptr); 85| 1| cleanup_evp_cipher(&aes256_ctr_ptr); 86| 1|} ossl_helpers.c:cleanup_evp_md: 51| 8|static inline void cleanup_evp_md(EVP_MD **mdp) { 52| | /* Always check argument is non-NULL before calling EVP_MD_free 53| | * to avoid OpenSSL functions being used when they are 54| | * overridden with OQS_*_set_callbacks. 55| | */ 56| 8| if (*mdp) { ------------------ | Branch (56:6): [True: 0, False: 8] ------------------ 57| 0| OSSL_FUNC(EVP_MD_free)(*mdp); ------------------ | | 66| 0|#define OSSL_FUNC(name) name ------------------ 58| | *mdp = NULL; 59| 0| } 60| 8|} ossl_helpers.c:cleanup_evp_cipher: 62| 4|static inline void cleanup_evp_cipher(EVP_CIPHER **cipherp) { 63| | /* Always check argument is non-NULL before calling EVP_CIPHER_free 64| | * to avoid OpenSSL functions being used when they are 65| | * overridden with OQS_*_set_callbacks. 66| | */ 67| 4| if (*cipherp) { ------------------ | Branch (67:6): [True: 0, False: 4] ------------------ 68| 0| OSSL_FUNC(EVP_CIPHER_free)(*cipherp); ------------------ | | 66| 0|#define OSSL_FUNC(name) name ------------------ 69| | *cipherp = NULL; 70| 0| } 71| 4|} ossl_helpers.c:fetch_ossl_objects: 28| 1|static void fetch_ossl_objects(void) { 29| 1| sha256_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA256", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 30| 1| sha384_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA384", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 31| 1| sha512_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA512", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 32| | 33| 1| sha3_256_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA3-256", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 34| 1| sha3_384_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA3-384", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 35| 1| sha3_512_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA3-512", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 36| 1| shake128_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHAKE128", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 37| 1| shake256_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHAKE256", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 38| | 39| 1| aes128_ecb_ptr = OSSL_FUNC(EVP_CIPHER_fetch)(NULL, "AES-128-ECB", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 40| 1| aes128_ctr_ptr = OSSL_FUNC(EVP_CIPHER_fetch)(NULL, "AES-128-CTR", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 41| 1| aes256_ecb_ptr = OSSL_FUNC(EVP_CIPHER_fetch)(NULL, "AES-256-ECB", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 42| 1| aes256_ctr_ptr = OSSL_FUNC(EVP_CIPHER_fetch)(NULL, "AES-256-CTR", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 43| | 44| 1| if (!sha256_ptr || !sha384_ptr || !sha512_ptr || !sha3_256_ptr || ------------------ | Branch (44:6): [True: 0, False: 1] | Branch (44:21): [True: 0, False: 1] | Branch (44:36): [True: 0, False: 1] | Branch (44:51): [True: 0, False: 1] ------------------ 45| 1| !sha3_384_ptr || !sha3_512_ptr || !shake128_ptr || !shake256_ptr || ------------------ | Branch (45:10): [True: 0, False: 1] | Branch (45:27): [True: 0, False: 1] | Branch (45:44): [True: 0, False: 1] | Branch (45:61): [True: 0, False: 1] ------------------ 46| 1| !aes128_ecb_ptr || !aes128_ctr_ptr || !aes256_ecb_ptr || !aes256_ctr_ptr) { ------------------ | Branch (46:10): [True: 0, False: 1] | Branch (46:29): [True: 0, False: 1] | Branch (46:48): [True: 0, False: 1] | Branch (46:67): [True: 0, False: 1] ------------------ 47| | fprintf(stderr, "liboqs warning: OpenSSL initialization failure. Is provider for SHA, SHAKE, AES enabled?\n"); 48| 0| } 49| 1|} OQS_SHA3_shake128_absorb_once: 5| 462|void shake128_absorb_once(shake128incctx *state, const uint8_t *in, size_t inlen) { 6| 462| shake128_inc_ctx_reset(state); ------------------ | | 45| 462|#define shake128_inc_ctx_reset OQS_SHA3_shake128_inc_ctx_reset ------------------ 7| 462| shake128_inc_absorb(state, in, inlen); ------------------ | | 40| 462|#define shake128_inc_absorb OQS_SHA3_shake128_inc_absorb ------------------ 8| 462| shake128_inc_finalize(state); ------------------ | | 41| 462|#define shake128_inc_finalize OQS_SHA3_shake128_inc_finalize ------------------ 9| 462|} OQS_SHA3_shake128_x4_absorb_once: 5| 2.41k|void shake128x4_absorb_once(shake128x4incctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 6| 2.41k| shake128x4_inc_ctx_reset(state); ------------------ | | 25| 2.41k|#define shake128x4_inc_ctx_reset OQS_SHA3_shake128_x4_inc_ctx_reset ------------------ 7| 2.41k| shake128x4_inc_absorb(state, in0, in1, in2, in3, inlen); ------------------ | | 20| 2.41k|#define shake128x4_inc_absorb OQS_SHA3_shake128_x4_inc_absorb ------------------ 8| 2.41k| shake128x4_inc_finalize(state); ------------------ | | 21| 2.41k|#define shake128x4_inc_finalize OQS_SHA3_shake128_x4_inc_finalize ------------------ 9| 2.41k|} OQS_SHA3_shake256_x4_absorb_once: 11| 1.39k|void shake256x4_absorb_once(shake256x4incctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 12| 1.39k| shake256x4_inc_ctx_reset(state); ------------------ | | 34| 1.39k|#define shake256x4_inc_ctx_reset OQS_SHA3_shake256_x4_inc_ctx_reset ------------------ 13| 1.39k| shake256x4_inc_absorb(state, in0, in1, in2, in3, inlen); ------------------ | | 29| 1.39k|#define shake256x4_inc_absorb OQS_SHA3_shake256_x4_inc_absorb ------------------ 14| 1.39k| shake256x4_inc_finalize(state); ------------------ | | 30| 1.39k|#define shake256x4_inc_finalize OQS_SHA3_shake256_x4_inc_finalize ------------------ 15| 1.39k|} OQS_randombytes_custom_algorithm: 58| 1.78k|OQS_API void OQS_randombytes_custom_algorithm(void (*algorithm_ptr)(uint8_t *, size_t)) { 59| 1.78k| oqs_randombytes_algorithm = algorithm_ptr; 60| 1.78k|} OQS_randombytes: 62| 8.16k|OQS_API void OQS_randombytes(uint8_t *random_array, size_t bytes_to_read) { 63| 8.16k| oqs_randombytes_algorithm(random_array, bytes_to_read); 64| 8.16k|} OQS_SHA2_sha512: 85| 90|void OQS_SHA2_sha512(uint8_t *out, const uint8_t *in, size_t inlen) { 86| 90| callbacks->SHA2_sha512(out, in, inlen); 87| 90|} sha2_ossl.c:do_hash: 16| 90|static void do_hash(uint8_t *output, const uint8_t *input, size_t inplen, const EVP_MD *md) { 17| 90| EVP_MD_CTX *mdctx; 18| 90| unsigned int outlen; 19| 90| mdctx = OSSL_FUNC(EVP_MD_CTX_new)(); ------------------ | | 66| 90|#define OSSL_FUNC(name) name ------------------ 20| 90| OQS_EXIT_IF_NULLPTR(mdctx, "OpenSSL"); ------------------ | | 82| 90| do { \ | | 83| 90| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 90] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 90| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 90] | | ------------------ ------------------ 21| 90| OQS_OPENSSL_GUARD(OSSL_FUNC(EVP_DigestInit_ex)(mdctx, md, NULL)); ------------------ | | 113| 90| do { \ | | 114| 90| if (1 != (x)) { \ | | ------------------ | | | Branch (114:9): [True: 0, False: 90] | | ------------------ | | 115| 0| fprintf(stderr, "Error return value from OpenSSL API: %d. Exiting.\n", \ | | 116| 0| x); \ | | 117| 0| OSSL_FUNC(ERR_print_errors_fp)(stderr); \ | | ------------------ | | | | 66| 0|#define OSSL_FUNC(name) name | | ------------------ | | 118| 0| exit(EXIT_FAILURE); \ | | 119| 0| } \ | | 120| 90| } while (0) | | ------------------ | | | Branch (120:12): [Folded, False: 90] | | ------------------ ------------------ 22| 90| OQS_OPENSSL_GUARD(OSSL_FUNC(EVP_DigestUpdate)(mdctx, input, inplen)); ------------------ | | 113| 90| do { \ | | 114| 90| if (1 != (x)) { \ | | ------------------ | | | Branch (114:9): [True: 0, False: 90] | | ------------------ | | 115| 0| fprintf(stderr, "Error return value from OpenSSL API: %d. Exiting.\n", \ | | 116| 0| x); \ | | 117| 0| OSSL_FUNC(ERR_print_errors_fp)(stderr); \ | | ------------------ | | | | 66| 0|#define OSSL_FUNC(name) name | | ------------------ | | 118| 0| exit(EXIT_FAILURE); \ | | 119| 0| } \ | | 120| 90| } while (0) | | ------------------ | | | Branch (120:12): [Folded, False: 90] | | ------------------ ------------------ 23| 90| OQS_OPENSSL_GUARD(OSSL_FUNC(EVP_DigestFinal_ex)(mdctx, output, &outlen)); ------------------ | | 113| 90| do { \ | | 114| 90| if (1 != (x)) { \ | | ------------------ | | | Branch (114:9): [True: 0, False: 90] | | ------------------ | | 115| 0| fprintf(stderr, "Error return value from OpenSSL API: %d. Exiting.\n", \ | | 116| 0| x); \ | | 117| 0| OSSL_FUNC(ERR_print_errors_fp)(stderr); \ | | ------------------ | | | | 66| 0|#define OSSL_FUNC(name) name | | ------------------ | | 118| 0| exit(EXIT_FAILURE); \ | | 119| 0| } \ | | 120| 90| } while (0) | | ------------------ | | | Branch (120:12): [Folded, False: 90] | | ------------------ ------------------ 24| 90| OSSL_FUNC(EVP_MD_CTX_free)(mdctx); ------------------ | | 66| 90|#define OSSL_FUNC(name) name ------------------ 25| 90|} sha2_ossl.c:SHA2_sha512: 41| 90|static void SHA2_sha512(uint8_t *output, const uint8_t *input, size_t inplen) { 42| 90| const EVP_MD *md; 43| 90| md = oqs_sha512(); 44| 90| OQS_EXIT_IF_NULLPTR(md, "OpenSSL"); ------------------ | | 82| 90| do { \ | | 83| 90| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 90] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 90| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 90] | | ------------------ ------------------ 45| 90| do_hash(output, input, inplen, md); 46| 90|} OQS_SHA3_sha3_256: 15| 2.49k|void OQS_SHA3_sha3_256(uint8_t *output, const uint8_t *input, size_t inplen) { 16| 2.49k| callbacks->SHA3_sha3_256(output, input, inplen); 17| 2.49k|} OQS_SHA3_sha3_256_inc_init: 19| 2.85k|void OQS_SHA3_sha3_256_inc_init(OQS_SHA3_sha3_256_inc_ctx *state) { 20| 2.85k| callbacks->SHA3_sha3_256_inc_init(state); 21| 2.85k|} OQS_SHA3_sha3_256_inc_absorb: 23| 3.68k|void OQS_SHA3_sha3_256_inc_absorb(OQS_SHA3_sha3_256_inc_ctx *state, const uint8_t *input, size_t inlen) { 24| 3.68k| callbacks->SHA3_sha3_256_inc_absorb(state, input, inlen); 25| 3.68k|} OQS_SHA3_sha3_256_inc_finalize: 27| 2.85k|void OQS_SHA3_sha3_256_inc_finalize(uint8_t *output, OQS_SHA3_sha3_256_inc_ctx *state) { 28| 2.85k| callbacks->SHA3_sha3_256_inc_finalize(output, state); 29| 2.85k|} OQS_SHA3_sha3_256_inc_ctx_release: 31| 2.85k|void OQS_SHA3_sha3_256_inc_ctx_release(OQS_SHA3_sha3_256_inc_ctx *state) { 32| 2.85k| callbacks->SHA3_sha3_256_inc_ctx_release(state); 33| 2.85k|} OQS_SHA3_sha3_384: 43| 28|void OQS_SHA3_sha3_384(uint8_t *output, const uint8_t *input, size_t inplen) { 44| 28| callbacks->SHA3_sha3_384(output, input, inplen); 45| 28|} OQS_SHA3_sha3_384_inc_init: 47| 28|void OQS_SHA3_sha3_384_inc_init(OQS_SHA3_sha3_384_inc_ctx *state) { 48| 28| callbacks->SHA3_sha3_384_inc_init(state); 49| 28|} OQS_SHA3_sha3_384_inc_absorb: 51| 28|void OQS_SHA3_sha3_384_inc_absorb(OQS_SHA3_sha3_384_inc_ctx *state, const uint8_t *input, size_t inlen) { 52| 28| callbacks->SHA3_sha3_384_inc_absorb(state, input, inlen); 53| 28|} OQS_SHA3_sha3_384_inc_finalize: 55| 28|void OQS_SHA3_sha3_384_inc_finalize(uint8_t *output, OQS_SHA3_sha3_384_inc_ctx *state) { 56| 28| callbacks->SHA3_sha3_384_inc_finalize(output, state); 57| 28|} OQS_SHA3_sha3_384_inc_ctx_release: 59| 28|void OQS_SHA3_sha3_384_inc_ctx_release(OQS_SHA3_sha3_384_inc_ctx *state) { 60| 28| callbacks->SHA3_sha3_384_inc_ctx_release(state); 61| 28|} OQS_SHA3_sha3_512: 71| 1.02k|void OQS_SHA3_sha3_512(uint8_t *output, const uint8_t *input, size_t inplen) { 72| 1.02k| callbacks->SHA3_sha3_512(output, input, inplen); 73| 1.02k|} OQS_SHA3_sha3_512_inc_init: 75| 1.38k|void OQS_SHA3_sha3_512_inc_init(OQS_SHA3_sha3_512_inc_ctx *state) { 76| 1.38k| callbacks->SHA3_sha3_512_inc_init(state); 77| 1.38k|} OQS_SHA3_sha3_512_inc_absorb: 79| 2.21k|void OQS_SHA3_sha3_512_inc_absorb(OQS_SHA3_sha3_512_inc_ctx *state, const uint8_t *input, size_t inlen) { 80| 2.21k| callbacks->SHA3_sha3_512_inc_absorb(state, input, inlen); 81| 2.21k|} OQS_SHA3_sha3_512_inc_finalize: 83| 1.38k|void OQS_SHA3_sha3_512_inc_finalize(uint8_t *output, OQS_SHA3_sha3_512_inc_ctx *state) { 84| 1.38k| callbacks->SHA3_sha3_512_inc_finalize(output, state); 85| 1.38k|} OQS_SHA3_sha3_512_inc_ctx_release: 87| 1.38k|void OQS_SHA3_sha3_512_inc_ctx_release(OQS_SHA3_sha3_512_inc_ctx *state) { 88| 1.38k| callbacks->SHA3_sha3_512_inc_ctx_release(state); 89| 1.38k|} OQS_SHA3_shake128: 99| 120|void OQS_SHA3_shake128(uint8_t *output, size_t outlen, const uint8_t *input, size_t inplen) { 100| 120| callbacks->SHA3_shake128(output, outlen, input, inplen); 101| 120|} OQS_SHA3_shake128_inc_init: 103| 582|void OQS_SHA3_shake128_inc_init(OQS_SHA3_shake128_inc_ctx *state) { 104| 582| callbacks->SHA3_shake128_inc_init(state); 105| 582|} OQS_SHA3_shake128_inc_absorb: 107| 582|void OQS_SHA3_shake128_inc_absorb(OQS_SHA3_shake128_inc_ctx *state, const uint8_t *input, size_t inlen) { 108| 582| callbacks->SHA3_shake128_inc_absorb(state, input, inlen); 109| 582|} OQS_SHA3_shake128_inc_finalize: 111| 582|void OQS_SHA3_shake128_inc_finalize(OQS_SHA3_shake128_inc_ctx *state) { 112| 582| callbacks->SHA3_shake128_inc_finalize(state); 113| 582|} OQS_SHA3_shake128_inc_squeeze: 115| 645|void OQS_SHA3_shake128_inc_squeeze(uint8_t *output, size_t outlen, OQS_SHA3_shake128_inc_ctx *state) { 116| 645| callbacks->SHA3_shake128_inc_squeeze(output, outlen, state); 117| 645|} OQS_SHA3_shake128_inc_ctx_release: 119| 582|void OQS_SHA3_shake128_inc_ctx_release(OQS_SHA3_shake128_inc_ctx *state) { 120| 582| callbacks->SHA3_shake128_inc_ctx_release(state); 121| 582|} OQS_SHA3_shake128_inc_ctx_reset: 127| 462|void OQS_SHA3_shake128_inc_ctx_reset(OQS_SHA3_shake128_inc_ctx *state) { 128| 462| callbacks->SHA3_shake128_inc_ctx_reset(state); 129| 462|} OQS_SHA3_shake256: 131| 8.96k|void OQS_SHA3_shake256(uint8_t *output, size_t outlen, const uint8_t *input, size_t inplen) { 132| 8.96k| callbacks->SHA3_shake256(output, outlen, input, inplen); 133| 8.96k|} OQS_SHA3_shake256_inc_init: 135| 9.93k|void OQS_SHA3_shake256_inc_init(OQS_SHA3_shake256_inc_ctx *state) { 136| 9.93k| callbacks->SHA3_shake256_inc_init(state); 137| 9.93k|} OQS_SHA3_shake256_inc_absorb: 139| 10.8k|void OQS_SHA3_shake256_inc_absorb(OQS_SHA3_shake256_inc_ctx *state, const uint8_t *input, size_t inlen) { 140| 10.8k| callbacks->SHA3_shake256_inc_absorb(state, input, inlen); 141| 10.8k|} OQS_SHA3_shake256_inc_finalize: 143| 9.93k|void OQS_SHA3_shake256_inc_finalize(OQS_SHA3_shake256_inc_ctx *state) { 144| 9.93k| callbacks->SHA3_shake256_inc_finalize(state); 145| 9.93k|} OQS_SHA3_shake256_inc_squeeze: 147| 46.1k|void OQS_SHA3_shake256_inc_squeeze(uint8_t *output, size_t outlen, OQS_SHA3_shake256_inc_ctx *state) { 148| 46.1k| callbacks->SHA3_shake256_inc_squeeze(output, outlen, state); 149| 46.1k|} OQS_SHA3_shake256_inc_ctx_release: 151| 9.93k|void OQS_SHA3_shake256_inc_ctx_release(OQS_SHA3_shake256_inc_ctx *state) { 152| 9.93k| callbacks->SHA3_shake256_inc_ctx_release(state); 153| 9.93k|} OQS_SHA3_shake128_x4: 15| 29.3k|void OQS_SHA3_shake128_x4(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 16| 29.3k| callbacks->SHA3_shake128_x4(out0, out1, out2, out3, outlen, in0, in1, in2, in3, inlen); 17| 29.3k|} OQS_SHA3_shake128_x4_inc_init: 19| 30.6k|void OQS_SHA3_shake128_x4_inc_init(OQS_SHA3_shake128_x4_inc_ctx *state) { 20| 30.6k| callbacks->SHA3_shake128_x4_inc_init(state); 21| 30.6k|} OQS_SHA3_shake128_x4_inc_absorb: 23| 31.7k|void OQS_SHA3_shake128_x4_inc_absorb(OQS_SHA3_shake128_x4_inc_ctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 24| 31.7k| callbacks->SHA3_shake128_x4_inc_absorb(state, in0, in1, in2, in3, inlen); 25| 31.7k|} OQS_SHA3_shake128_x4_inc_finalize: 27| 31.7k|void OQS_SHA3_shake128_x4_inc_finalize(OQS_SHA3_shake128_x4_inc_ctx *state) { 28| 31.7k| callbacks->SHA3_shake128_x4_inc_finalize(state); 29| 31.7k|} OQS_SHA3_shake128_x4_inc_squeeze: 31| 32.7k|void OQS_SHA3_shake128_x4_inc_squeeze(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, OQS_SHA3_shake128_x4_inc_ctx *state) { 32| 32.7k| callbacks->SHA3_shake128_x4_inc_squeeze(out0, out1, out2, out3, outlen, state); 33| 32.7k|} OQS_SHA3_shake128_x4_inc_ctx_release: 35| 30.6k|void OQS_SHA3_shake128_x4_inc_ctx_release(OQS_SHA3_shake128_x4_inc_ctx *state) { 36| 30.6k| callbacks->SHA3_shake128_x4_inc_ctx_release(state); 37| 30.6k|} OQS_SHA3_shake128_x4_inc_ctx_reset: 43| 2.41k|void OQS_SHA3_shake128_x4_inc_ctx_reset(OQS_SHA3_shake128_x4_inc_ctx *state) { 44| 2.41k| callbacks->SHA3_shake128_x4_inc_ctx_reset(state); 45| 2.41k|} OQS_SHA3_shake256_x4: 47| 399|void OQS_SHA3_shake256_x4(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 48| 399| callbacks->SHA3_shake256_x4(out0, out1, out2, out3, outlen, in0, in1, in2, in3, inlen); 49| 399|} OQS_SHA3_shake256_x4_inc_init: 51| 1.79k|void OQS_SHA3_shake256_x4_inc_init(OQS_SHA3_shake256_x4_inc_ctx *state) { 52| 1.79k| callbacks->SHA3_shake256_x4_inc_init(state); 53| 1.79k|} OQS_SHA3_shake256_x4_inc_absorb: 55| 1.79k|void OQS_SHA3_shake256_x4_inc_absorb(OQS_SHA3_shake256_x4_inc_ctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 56| 1.79k| callbacks->SHA3_shake256_x4_inc_absorb(state, in0, in1, in2, in3, inlen); 57| 1.79k|} OQS_SHA3_shake256_x4_inc_finalize: 59| 1.79k|void OQS_SHA3_shake256_x4_inc_finalize(OQS_SHA3_shake256_x4_inc_ctx *state) { 60| 1.79k| callbacks->SHA3_shake256_x4_inc_finalize(state); 61| 1.79k|} OQS_SHA3_shake256_x4_inc_squeeze: 63| 1.79k|void OQS_SHA3_shake256_x4_inc_squeeze(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, OQS_SHA3_shake256_x4_inc_ctx *state) { 64| 1.79k| callbacks->SHA3_shake256_x4_inc_squeeze(out0, out1, out2, out3, outlen, state); 65| 1.79k|} OQS_SHA3_shake256_x4_inc_ctx_release: 67| 1.79k|void OQS_SHA3_shake256_x4_inc_ctx_release(OQS_SHA3_shake256_x4_inc_ctx *state) { 68| 1.79k| callbacks->SHA3_shake256_x4_inc_ctx_release(state); 69| 1.79k|} OQS_SHA3_shake256_x4_inc_ctx_reset: 75| 1.39k|void OQS_SHA3_shake256_x4_inc_ctx_reset(OQS_SHA3_shake256_x4_inc_ctx *state) { 76| 1.39k| callbacks->SHA3_shake256_x4_inc_ctx_reset(state); 77| 1.39k|} KeccakP1600times4_InitializeAll_avx2: 108| 36.2k|void KeccakP1600times4_InitializeAll(void *states) { 109| 36.2k| memset(states, 0, KeccakP1600times4_statesSizeInBytes_avx2); ------------------ | | 27| 36.2k|#define KeccakP1600times4_statesSizeInBytes_avx2 800 ------------------ 110| 36.2k|} KeccakP1600times4_AddByte_avx2: 112| 268k|void KeccakP1600times4_AddByte(void *states, unsigned int instanceIndex, unsigned char byte, unsigned int offset) { 113| 268k| ((unsigned char *)states)[instanceIndex * 8 + (offset / 8) * 4 * 8 + offset % 8] ^= byte; 114| 268k|} KeccakP1600times4_AddBytes_avx2: 116| 134k|void KeccakP1600times4_AddBytes(void *states, unsigned int instanceIndex, const unsigned char *data, unsigned int offset, unsigned int length) { 117| 134k| unsigned int sizeLeft = length; 118| 134k| unsigned int lanePosition = offset / SnP_laneLengthInBytes; ------------------ | | 91| 134k|#define SnP_laneLengthInBytes 8 ------------------ 119| 134k| unsigned int offsetInLane = offset % SnP_laneLengthInBytes; ------------------ | | 91| 134k|#define SnP_laneLengthInBytes 8 ------------------ 120| 134k| unsigned int bytesInLane; 121| 134k| const unsigned char *curData = data; 122| 134k| uint64_t *statesAsLanes = (uint64_t *)states; 123| 134k| uint64_t lane; 124| | 125| 134k| if ((sizeLeft > 0) && (offsetInLane != 0)) { ------------------ | Branch (125:6): [True: 134k, False: 0] | Branch (125:24): [True: 0, False: 134k] ------------------ 126| 0| bytesInLane = SnP_laneLengthInBytes - offsetInLane; ------------------ | | 91| 0|#define SnP_laneLengthInBytes 8 ------------------ 127| 0| if (bytesInLane > sizeLeft) { ------------------ | Branch (127:7): [True: 0, False: 0] ------------------ 128| 0| bytesInLane = sizeLeft; 129| 0| } 130| 0| lane = 0; 131| 0| memcpy((unsigned char *)&lane + offsetInLane, curData, bytesInLane); 132| 0| statesAsLanes[laneIndex(instanceIndex, lanePosition)] ^= lane; ------------------ | | 44| 0|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 133| 0| sizeLeft -= bytesInLane; 134| 0| lanePosition++; 135| 0| curData += bytesInLane; 136| 0| } 137| | 138| 436k| while (sizeLeft >= SnP_laneLengthInBytes) { ------------------ | | 91| 436k|#define SnP_laneLengthInBytes 8 ------------------ | Branch (138:9): [True: 302k, False: 134k] ------------------ 139| 302k| lane = load64(curData); 140| 302k| statesAsLanes[laneIndex(instanceIndex, lanePosition)] ^= lane; ------------------ | | 44| 302k|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 141| 302k| sizeLeft -= SnP_laneLengthInBytes; ------------------ | | 91| 302k|#define SnP_laneLengthInBytes 8 ------------------ 142| 302k| lanePosition++; 143| 302k| curData += SnP_laneLengthInBytes; ------------------ | | 91| 302k|#define SnP_laneLengthInBytes 8 ------------------ 144| 302k| } 145| | 146| 134k| if (sizeLeft > 0) { ------------------ | Branch (146:6): [True: 134k, False: 0] ------------------ 147| 134k| lane = 0; 148| 134k| memcpy(&lane, curData, sizeLeft); 149| 134k| statesAsLanes[laneIndex(instanceIndex, lanePosition)] ^= lane; ------------------ | | 44| 134k|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 150| 134k| } 151| 134k|} KeccakP1600times4_ExtractBytes_avx2: 296| 1.71M|void KeccakP1600times4_ExtractBytes(const void *states, unsigned int instanceIndex, unsigned char *data, unsigned int offset, unsigned int length) { 297| 1.71M| unsigned int sizeLeft = length; 298| 1.71M| unsigned int lanePosition = offset / SnP_laneLengthInBytes; ------------------ | | 91| 1.71M|#define SnP_laneLengthInBytes 8 ------------------ 299| 1.71M| unsigned int offsetInLane = offset % SnP_laneLengthInBytes; ------------------ | | 91| 1.71M|#define SnP_laneLengthInBytes 8 ------------------ 300| 1.71M| unsigned char *curData = data; 301| 1.71M| const uint64_t *statesAsLanes = (const uint64_t *)states; 302| | 303| 1.71M| if ((sizeLeft > 0) && (offsetInLane != 0)) { ------------------ | Branch (303:6): [True: 1.58M, False: 138k] | Branch (303:24): [True: 0, False: 1.58M] ------------------ 304| 0| unsigned int bytesInLane = SnP_laneLengthInBytes - offsetInLane; ------------------ | | 91| 0|#define SnP_laneLengthInBytes 8 ------------------ 305| 0| if (bytesInLane > sizeLeft) { ------------------ | Branch (305:7): [True: 0, False: 0] ------------------ 306| 0| bytesInLane = sizeLeft; 307| 0| } 308| 0| memcpy( curData, ((const unsigned char *)&statesAsLanes[laneIndex(instanceIndex, lanePosition)]) + offsetInLane, bytesInLane); ------------------ | | 44| 0|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 309| 0| sizeLeft -= bytesInLane; 310| 0| lanePosition++; 311| 0| curData += bytesInLane; 312| 0| } 313| | 314| 34.2M| while (sizeLeft >= SnP_laneLengthInBytes) { ------------------ | | 91| 34.2M|#define SnP_laneLengthInBytes 8 ------------------ | Branch (314:9): [True: 32.5M, False: 1.71M] ------------------ 315| 32.5M| store64(curData, statesAsLanes[laneIndex(instanceIndex, lanePosition)]); ------------------ | | 44| 32.5M|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 316| 32.5M| sizeLeft -= SnP_laneLengthInBytes; ------------------ | | 91| 32.5M|#define SnP_laneLengthInBytes 8 ------------------ 317| 32.5M| lanePosition++; 318| 32.5M| curData += SnP_laneLengthInBytes; ------------------ | | 91| 32.5M|#define SnP_laneLengthInBytes 8 ------------------ 319| 32.5M| } 320| | 321| 1.71M| if (sizeLeft > 0) { ------------------ | Branch (321:6): [True: 0, False: 1.71M] ------------------ 322| 0| memcpy( curData, &statesAsLanes[laneIndex(instanceIndex, lanePosition)], sizeLeft); ------------------ | | 44| 0|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 323| 0| } 324| 1.71M|} KeccakP1600times4_PermuteAll_24rounds_avx2: 833| 395k|void KeccakP1600times4_PermuteAll_24rounds(void *states) { 834| 395k| V256 *statesAsLanes = (V256 *)states; 835| 395k| declareABCDE ------------------ | | 479| 395k| V256 Aba, Abe, Abi, Abo, Abu; \ | | 480| 395k| V256 Aga, Age, Agi, Ago, Agu; \ | | 481| 395k| V256 Aka, Ake, Aki, Ako, Aku; \ | | 482| 395k| V256 Ama, Ame, Ami, Amo, Amu; \ | | 483| 395k| V256 Asa, Ase, Asi, Aso, Asu; \ | | 484| 395k| V256 Bba, Bbe, Bbi, Bbo, Bbu; \ | | 485| 395k| V256 Bga, Bge, Bgi, Bgo, Bgu; \ | | 486| 395k| V256 Bka, Bke, Bki, Bko, Bku; \ | | 487| 395k| V256 Bma, Bme, Bmi, Bmo, Bmu; \ | | 488| 395k| V256 Bsa, Bse, Bsi, Bso, Bsu; \ | | 489| 395k| V256 Ca, Ce, Ci, Co, Cu; \ | | 490| 395k| V256 Ca1, Ce1, Ci1, Co1, Cu1; \ | | 491| 395k| V256 Da, De, Di, Do, Du; \ | | 492| 395k| V256 Eba, Ebe, Ebi, Ebo, Ebu; \ | | 493| 395k| V256 Ega, Ege, Egi, Ego, Egu; \ | | 494| 395k| V256 Eka, Eke, Eki, Eko, Eku; \ | | 495| 395k| V256 Ema, Eme, Emi, Emo, Emu; \ | | 496| 395k| V256 Esa, Ese, Esi, Eso, Esu; \ ------------------ 836| | 837| 395k| copyFromState(A, statesAsLanes) ------------------ | | 750| 395k| X##ba = LOAD256(state[ 0]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 751| 395k| X##be = LOAD256(state[ 1]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 752| 395k| X##bi = LOAD256(state[ 2]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 753| 395k| X##bo = LOAD256(state[ 3]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 754| 395k| X##bu = LOAD256(state[ 4]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 755| 395k| X##ga = LOAD256(state[ 5]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 756| 395k| X##ge = LOAD256(state[ 6]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 757| 395k| X##gi = LOAD256(state[ 7]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 758| 395k| X##go = LOAD256(state[ 8]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 759| 395k| X##gu = LOAD256(state[ 9]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 760| 395k| X##ka = LOAD256(state[10]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 761| 395k| X##ke = LOAD256(state[11]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 762| 395k| X##ki = LOAD256(state[12]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 763| 395k| X##ko = LOAD256(state[13]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 764| 395k| X##ku = LOAD256(state[14]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 765| 395k| X##ma = LOAD256(state[15]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 766| 395k| X##me = LOAD256(state[16]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 767| 395k| X##mi = LOAD256(state[17]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 768| 395k| X##mo = LOAD256(state[18]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 769| 395k| X##mu = LOAD256(state[19]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 770| 395k| X##sa = LOAD256(state[20]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 771| 395k| X##se = LOAD256(state[21]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 772| 395k| X##si = LOAD256(state[22]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 773| 395k| X##so = LOAD256(state[23]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 774| 395k| X##su = LOAD256(state[24]); \ | | ------------------ | | | | 48| 395k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ ------------------ 838| 395k| rounds24 ------------------ | | 19| 395k| prepareTheta \ | | ------------------ | | | | 499| 395k| Ca = XOR256(Aba, XOR256(Aga, XOR256(Aka, XOR256(Ama, Asa)))); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 500| 395k| Ce = XOR256(Abe, XOR256(Age, XOR256(Ake, XOR256(Ame, Ase)))); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 501| 395k| Ci = XOR256(Abi, XOR256(Agi, XOR256(Aki, XOR256(Ami, Asi)))); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 502| 395k| Co = XOR256(Abo, XOR256(Ago, XOR256(Ako, XOR256(Amo, Aso)))); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 503| 395k| Cu = XOR256(Abu, XOR256(Agu, XOR256(Aku, XOR256(Amu, Asu)))); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 20| 395k| thetaRhoPiChiIotaPrepareTheta( 0, A, E) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 21| 395k| thetaRhoPiChiIotaPrepareTheta( 1, E, A) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 22| 395k| thetaRhoPiChiIotaPrepareTheta( 2, A, E) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 23| 395k| thetaRhoPiChiIotaPrepareTheta( 3, E, A) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 24| 395k| thetaRhoPiChiIotaPrepareTheta( 4, A, E) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 25| 395k| thetaRhoPiChiIotaPrepareTheta( 5, E, A) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 26| 395k| thetaRhoPiChiIotaPrepareTheta( 6, A, E) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 27| 395k| thetaRhoPiChiIotaPrepareTheta( 7, E, A) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 28| 395k| thetaRhoPiChiIotaPrepareTheta( 8, A, E) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 29| 395k| thetaRhoPiChiIotaPrepareTheta( 9, E, A) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 30| 395k| thetaRhoPiChiIotaPrepareTheta(10, A, E) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 31| 395k| thetaRhoPiChiIotaPrepareTheta(11, E, A) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 32| 395k| thetaRhoPiChiIotaPrepareTheta(12, A, E) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 33| 395k| thetaRhoPiChiIotaPrepareTheta(13, E, A) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 34| 395k| thetaRhoPiChiIotaPrepareTheta(14, A, E) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 35| 395k| thetaRhoPiChiIotaPrepareTheta(15, E, A) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 36| 395k| thetaRhoPiChiIotaPrepareTheta(16, A, E) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 37| 395k| thetaRhoPiChiIotaPrepareTheta(17, E, A) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 38| 395k| thetaRhoPiChiIotaPrepareTheta(18, A, E) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 39| 395k| thetaRhoPiChiIotaPrepareTheta(19, E, A) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 40| 395k| thetaRhoPiChiIotaPrepareTheta(20, A, E) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 41| 395k| thetaRhoPiChiIotaPrepareTheta(21, E, A) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 42| 395k| thetaRhoPiChiIotaPrepareTheta(22, A, E) \ | | ------------------ | | | | 508| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 395k|\ | | | | 519| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 395k| Bba = A##ba; \ | | | | 521| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 395k| Ca = E##ba; \ | | | | 528| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 395k| Ce = E##be; \ | | | | 532| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 395k| Ci = E##bi; \ | | | | 536| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 395k| Co = E##bo; \ | | | | 538| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 395k| Cu = E##bu; \ | | | | 540| 395k|\ | | | | 541| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 395k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 395k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 395k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 395k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 395k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 395k|\ | | | | 562| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 395k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 395k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 395k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 395k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 395k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 395k|\ | | | | 583| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 395k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 395k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 395k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 395k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 395k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 395k|\ | | | | 604| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 395k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 395k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 395k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 395k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 395k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 43| 395k| thetaRhoPiChiIota(23, E, A) \ | | ------------------ | | | | 629| 395k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 630| 395k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 631| 395k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 632| 395k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 633| 395k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 634| 395k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 635| 395k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 636| 395k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 637| 395k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 638| 395k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 639| 395k|\ | | | | 640| 395k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 641| 395k| Bba = A##ba; \ | | | | 642| 395k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 643| 395k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 644| 395k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 645| 395k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 646| 395k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 647| 395k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 648| 395k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 649| 395k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 650| 395k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 651| 395k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 652| 395k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 653| 395k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 654| 395k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 655| 395k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 656| 395k|\ | | | | 657| 395k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 658| 395k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 659| 395k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 660| 395k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 661| 395k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 662| 395k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 663| 395k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 664| 395k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 665| 395k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 666| 395k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 667| 395k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 668| 395k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 669| 395k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 670| 395k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 671| 395k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 672| 395k|\ | | | | 673| 395k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 674| 395k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 675| 395k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 676| 395k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 677| 395k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 678| 395k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 679| 395k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 680| 395k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 681| 395k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 395k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 682| 395k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 683| 395k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 684| 395k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 685| 395k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 686| 395k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 687| 395k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 688| 395k|\ | | | | 689| 395k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 690| 395k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 691| 395k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 692| 395k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 693| 395k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 694| 395k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 695| 395k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 696| 395k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 697| 395k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 698| 395k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 699| 395k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 700| 395k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 395k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 701| 395k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 702| 395k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 703| 395k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 704| 395k|\ | | | | 705| 395k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 706| 395k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 707| 395k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 708| 395k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 709| 395k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 710| 395k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 711| 395k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 712| 395k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 713| 395k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 714| 395k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 715| 395k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 395k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 716| 395k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 395k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 717| 395k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 718| 395k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 719| 395k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 395k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ ------------------ 839| 395k| copyToState(statesAsLanes, A) ------------------ | | 777| 395k| STORE256(state[ 0], X##ba); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 778| 395k| STORE256(state[ 1], X##be); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 779| 395k| STORE256(state[ 2], X##bi); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 780| 395k| STORE256(state[ 3], X##bo); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 781| 395k| STORE256(state[ 4], X##bu); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 782| 395k| STORE256(state[ 5], X##ga); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 783| 395k| STORE256(state[ 6], X##ge); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 784| 395k| STORE256(state[ 7], X##gi); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 785| 395k| STORE256(state[ 8], X##go); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 786| 395k| STORE256(state[ 9], X##gu); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 787| 395k| STORE256(state[10], X##ka); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 788| 395k| STORE256(state[11], X##ke); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 789| 395k| STORE256(state[12], X##ki); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 790| 395k| STORE256(state[13], X##ko); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 791| 395k| STORE256(state[14], X##ku); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 792| 395k| STORE256(state[15], X##ma); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 793| 395k| STORE256(state[16], X##me); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 794| 395k| STORE256(state[17], X##mi); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 795| 395k| STORE256(state[18], X##mo); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 796| 395k| STORE256(state[19], X##mu); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 797| 395k| STORE256(state[20], X##sa); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 798| 395k| STORE256(state[21], X##se); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 799| 395k| STORE256(state[22], X##si); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 800| 395k| STORE256(state[23], X##so); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 801| 395k| STORE256(state[24], X##su); \ | | ------------------ | | | | 62| 395k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ ------------------ 840| 395k|} KeccakP-1600-times4-SIMD256.c:load64: 93| 302k|static inline uint64_t load64(const unsigned char *x) { 94| 302k| return (uint64_t) x[0] \ 95| 302k| | (uint64_t) x[1] << 0x08 \ 96| 302k| | (uint64_t) x[2] << 0x10 \ 97| 302k| | (uint64_t) x[3] << 0x18 \ 98| 302k| | (uint64_t) x[4] << 0x20 \ 99| 302k| | (uint64_t) x[5] << 0x28 \ 100| 302k| | (uint64_t) x[6] << 0x30 \ 101| 302k| | (uint64_t) x[7] << 0x38; 102| 302k|} KeccakP-1600-times4-SIMD256.c:store64: 104| 32.5M|static void store64(unsigned char *out, uint64_t in) { 105| 32.5M| memcpy(out, &in, sizeof(uint64_t)); 106| 32.5M|} xkcp_sha3.c:SHA3_sha3_256: 202| 2.49k|static void SHA3_sha3_256(uint8_t *output, const uint8_t *input, size_t inlen) { 203| 2.49k| OQS_SHA3_sha3_256_inc_ctx s; 204| 2.49k| OQS_SHA3_sha3_256_inc_init(&s); 205| 2.49k| OQS_SHA3_sha3_256_inc_absorb(&s, input, inlen); 206| 2.49k| OQS_SHA3_sha3_256_inc_finalize(output, &s); 207| 2.49k| OQS_SHA3_sha3_256_inc_ctx_release(&s); 208| 2.49k|} xkcp_sha3.c:SHA3_sha3_256_inc_init: 210| 2.85k|static void SHA3_sha3_256_inc_init(OQS_SHA3_sha3_256_inc_ctx *state) { 211| 2.85k| state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 24| 2.85k|#define KECCAK_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 26| 2.85k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 2.85k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 2.85k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 2.85k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 2.85k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 2.85k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 212| | 213| 2.85k| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3"); ------------------ | | 82| 2.85k| do { \ | | 83| 2.85k| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 2.85k] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 2.85k| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 2.85k] | | ------------------ ------------------ 214| 2.85k| keccak_inc_reset((uint64_t *)state->ctx); 215| 2.85k|} xkcp_sha3.c:keccak_inc_reset: 96| 15.2k|static void keccak_inc_reset(uint64_t *s) { 97| 15.2k|#if OQS_USE_PTHREADS 98| 15.2k| pthread_once(&dispatch_once_control, Keccak_Dispatch); 99| |#else 100| | if (Keccak_Initialize_ptr == NULL) { 101| | Keccak_Dispatch(); 102| | } 103| |#endif 104| 15.2k| (*Keccak_Initialize_ptr)(s); 105| 15.2k| s[25] = 0; 106| 15.2k|} xkcp_sha3.c:Keccak_Dispatch: 42| 1|static void Keccak_Dispatch(void) { 43| |// TODO: Simplify this when we have a Windows-compatible AVX2 implementation of SHA3 44| 1|#if defined(OQS_DIST_X86_64_BUILD) 45| 1|#if defined(OQS_ENABLE_SHA3_xkcp_low_avx2) 46| 1|#if defined(OQS_USE_SHA3_AVX512VL) 47| 1| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX512)) { ------------------ | Branch (47:6): [True: 0, False: 1] ------------------ 48| 0| extern const struct OQS_SHA3_callbacks sha3_avx512vl_callbacks; 49| | 50| 0| sha3_default_callbacks = sha3_avx512vl_callbacks; 51| 0| } 52| 1|#endif 53| 1| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (53:6): [True: 1, False: 0] ------------------ 54| 1| Keccak_Initialize_ptr = &KeccakP1600_Initialize_avx2; 55| 1| Keccak_AddByte_ptr = &KeccakP1600_AddByte_avx2; 56| 1| Keccak_AddBytes_ptr = &KeccakP1600_AddBytes_avx2; 57| 1| Keccak_Permute_ptr = &KeccakP1600_Permute_24rounds_avx2; 58| 1| Keccak_ExtractBytes_ptr = &KeccakP1600_ExtractBytes_avx2; 59| 1| Keccak_FastLoopAbsorb_ptr = &KeccakF1600_FastLoop_Absorb_avx2; 60| 1| } else { 61| 0| Keccak_Initialize_ptr = &KeccakP1600_Initialize_plain64; 62| 0| Keccak_AddByte_ptr = &KeccakP1600_AddByte_plain64; 63| 0| Keccak_AddBytes_ptr = &KeccakP1600_AddBytes_plain64; 64| 0| Keccak_Permute_ptr = &KeccakP1600_Permute_24rounds_plain64; 65| 0| Keccak_ExtractBytes_ptr = &KeccakP1600_ExtractBytes_plain64; 66| 0| Keccak_FastLoopAbsorb_ptr = &KeccakF1600_FastLoop_Absorb_plain64; 67| 0| } 68| |#else // Windows 69| | Keccak_Initialize_ptr = &KeccakP1600_Initialize_plain64; 70| | Keccak_AddByte_ptr = &KeccakP1600_AddByte_plain64; 71| | Keccak_AddBytes_ptr = &KeccakP1600_AddBytes_plain64; 72| | Keccak_Permute_ptr = &KeccakP1600_Permute_24rounds_plain64; 73| | Keccak_ExtractBytes_ptr = &KeccakP1600_ExtractBytes_plain64; 74| | Keccak_FastLoopAbsorb_ptr = &KeccakF1600_FastLoop_Absorb_plain64; 75| |#endif 76| |#else 77| | Keccak_Initialize_ptr = &KeccakP1600_Initialize; 78| | Keccak_AddByte_ptr = &KeccakP1600_AddByte; 79| | Keccak_AddBytes_ptr = &KeccakP1600_AddBytes; 80| | Keccak_Permute_ptr = &KeccakP1600_Permute_24rounds; 81| | Keccak_ExtractBytes_ptr = &KeccakP1600_ExtractBytes; 82| | Keccak_FastLoopAbsorb_ptr = &KeccakF1600_FastLoop_Absorb; 83| |#endif 84| 1|} xkcp_sha3.c:SHA3_sha3_256_inc_absorb: 217| 3.68k|static void SHA3_sha3_256_inc_absorb(OQS_SHA3_sha3_256_inc_ctx *state, const uint8_t *input, size_t inlen) { 218| 3.68k| keccak_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHA3_256_RATE, input, inlen); ------------------ | | 30| 3.68k|#define OQS_SHA3_SHA3_256_RATE 136 ------------------ 219| 3.68k|} xkcp_sha3.c:keccak_inc_absorb: 123| 17.3k| size_t mlen) { 124| 17.3k| uint64_t c = r - s[25]; 125| | 126| 17.3k| if (s[25] && mlen >= c) { ------------------ | Branch (126:6): [True: 2.54k, False: 14.8k] | Branch (126:15): [True: 398, False: 2.14k] ------------------ 127| 398| (*Keccak_AddBytes_ptr)(s, m, (unsigned int)s[25], (unsigned int)c); 128| 398| (*Keccak_Permute_ptr)(s); 129| 398| mlen -= c; 130| 398| m += c; 131| 398| s[25] = 0; 132| 398| } 133| | 134| |#ifdef KeccakF1600_FastLoop_supported 135| | if (mlen >= r) { 136| | c = (*Keccak_FastLoop_Absorb_ptr)(s, r / 8, m, mlen); 137| | mlen -= c; 138| | m += c; 139| | } 140| |#else 141| 98.0k| while (mlen >= r) { ------------------ | Branch (141:9): [True: 80.6k, False: 17.3k] ------------------ 142| 80.6k| (*Keccak_AddBytes_ptr)(s, m, 0, r); 143| 80.6k| (*Keccak_Permute_ptr)(s); 144| 80.6k| mlen -= r; 145| 80.6k| m += r; 146| 80.6k| } 147| 17.3k|#endif 148| | 149| 17.3k| (*Keccak_AddBytes_ptr)(s, m, (unsigned int)s[25], (unsigned int)mlen); 150| 17.3k| s[25] += mlen; 151| 17.3k|} xkcp_sha3.c:SHA3_sha3_256_inc_finalize: 221| 2.85k|static void SHA3_sha3_256_inc_finalize(uint8_t *output, OQS_SHA3_sha3_256_inc_ctx *state) { 222| 2.85k| keccak_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHA3_256_RATE, 0x06); ------------------ | | 30| 2.85k|#define OQS_SHA3_SHA3_256_RATE 136 ------------------ 223| 2.85k| keccak_inc_squeeze(output, 32, (uint64_t *)state->ctx, OQS_SHA3_SHA3_256_RATE); ------------------ | | 30| 2.85k|#define OQS_SHA3_SHA3_256_RATE 136 ------------------ 224| 2.85k|} xkcp_sha3.c:keccak_inc_finalize: 166| 14.7k|static void keccak_inc_finalize(uint64_t *s, uint32_t r, uint8_t p) { 167| | /* After keccak_inc_absorb, we are guaranteed that s[25] < r, 168| | so we can always use one more byte for p in the current state. */ 169| 14.7k| (*Keccak_AddByte_ptr)(s, p, (unsigned int)s[25]); 170| 14.7k| (*Keccak_AddByte_ptr)(s, 0x80, (unsigned int)(r - 1)); 171| 14.7k| s[25] = 0; 172| 14.7k|} xkcp_sha3.c:keccak_inc_squeeze: 188| 51.1k| uint64_t *s, uint32_t r) { 189| 1.36M| while (outlen > s[25]) { ------------------ | Branch (189:9): [True: 1.31M, False: 51.1k] ------------------ 190| 1.31M| (*Keccak_ExtractBytes_ptr)(s, h, (unsigned int)(r - s[25]), (unsigned int)s[25]); 191| 1.31M| (*Keccak_Permute_ptr)(s); 192| 1.31M| h += s[25]; 193| 1.31M| outlen -= s[25]; 194| 1.31M| s[25] = r; 195| 1.31M| } 196| 51.1k| (*Keccak_ExtractBytes_ptr)(s, h, (unsigned int)(r - s[25]), (unsigned int)outlen); 197| 51.1k| s[25] -= outlen; 198| 51.1k|} xkcp_sha3.c:SHA3_sha3_256_inc_ctx_release: 226| 2.85k|static void SHA3_sha3_256_inc_ctx_release(OQS_SHA3_sha3_256_inc_ctx *state) { 227| 2.85k| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES); ------------------ | | 26| 2.85k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 2.85k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 2.85k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 2.85k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 2.85k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 2.85k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 228| 2.85k|} xkcp_sha3.c:SHA3_sha3_384: 240| 28|static void SHA3_sha3_384(uint8_t *output, const uint8_t *input, size_t inlen) { 241| 28| OQS_SHA3_sha3_384_inc_ctx s; 242| 28| OQS_SHA3_sha3_384_inc_init(&s); 243| 28| OQS_SHA3_sha3_384_inc_absorb(&s, input, inlen); 244| 28| OQS_SHA3_sha3_384_inc_finalize(output, &s); 245| 28| OQS_SHA3_sha3_384_inc_ctx_release(&s); 246| 28|} xkcp_sha3.c:SHA3_sha3_384_inc_init: 248| 28|static void SHA3_sha3_384_inc_init(OQS_SHA3_sha3_384_inc_ctx *state) { 249| 28| state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 26| 28|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 28| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 28|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 250| 28| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3"); ------------------ | | 82| 28| do { \ | | 83| 28| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 28] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 28| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 28] | | ------------------ ------------------ 251| 28| keccak_inc_reset((uint64_t *)state->ctx); 252| 28|} xkcp_sha3.c:SHA3_sha3_384_inc_absorb: 253| 28|static void SHA3_sha3_384_inc_absorb(OQS_SHA3_sha3_384_inc_ctx *state, const uint8_t *input, size_t inlen) { 254| 28| keccak_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHA3_384_RATE, input, inlen); ------------------ | | 99| 28|#define OQS_SHA3_SHA3_384_RATE 104 ------------------ 255| 28|} xkcp_sha3.c:SHA3_sha3_384_inc_finalize: 257| 28|static void SHA3_sha3_384_inc_finalize(uint8_t *output, OQS_SHA3_sha3_384_inc_ctx *state) { 258| 28| keccak_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHA3_384_RATE, 0x06); ------------------ | | 99| 28|#define OQS_SHA3_SHA3_384_RATE 104 ------------------ 259| 28| keccak_inc_squeeze(output, 48, (uint64_t *)state->ctx, OQS_SHA3_SHA3_384_RATE); ------------------ | | 99| 28|#define OQS_SHA3_SHA3_384_RATE 104 ------------------ 260| 28|} xkcp_sha3.c:SHA3_sha3_384_inc_ctx_release: 262| 28|static void SHA3_sha3_384_inc_ctx_release(OQS_SHA3_sha3_384_inc_ctx *state) { 263| 28| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES); ------------------ | | 26| 28|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 28| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 28|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 264| 28|} xkcp_sha3.c:SHA3_sha3_512: 276| 1.02k|static void SHA3_sha3_512(uint8_t *output, const uint8_t *input, size_t inlen) { 277| 1.02k| OQS_SHA3_sha3_512_inc_ctx s; 278| 1.02k| OQS_SHA3_sha3_512_inc_init(&s); 279| 1.02k| OQS_SHA3_sha3_512_inc_absorb(&s, input, inlen); 280| 1.02k| OQS_SHA3_sha3_512_inc_finalize(output, &s); 281| 1.02k| OQS_SHA3_sha3_512_inc_ctx_release(&s); 282| 1.02k|} xkcp_sha3.c:SHA3_sha3_512_inc_init: 284| 1.38k|static void SHA3_sha3_512_inc_init(OQS_SHA3_sha3_512_inc_ctx *state) { 285| 1.38k| state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 24| 1.38k|#define KECCAK_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 26| 1.38k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 1.38k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 1.38k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 1.38k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 1.38k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 1.38k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 286| 1.38k| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3"); ------------------ | | 82| 1.38k| do { \ | | 83| 1.38k| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 1.38k] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 1.38k| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 1.38k] | | ------------------ ------------------ 287| 1.38k| keccak_inc_reset((uint64_t *)state->ctx); 288| 1.38k|} xkcp_sha3.c:SHA3_sha3_512_inc_absorb: 290| 2.21k|static void SHA3_sha3_512_inc_absorb(OQS_SHA3_sha3_512_inc_ctx *state, const uint8_t *input, size_t inlen) { 291| 2.21k| keccak_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHA3_512_RATE, input, inlen); ------------------ | | 168| 2.21k|#define OQS_SHA3_SHA3_512_RATE 72 ------------------ 292| 2.21k|} xkcp_sha3.c:SHA3_sha3_512_inc_finalize: 294| 1.38k|static void SHA3_sha3_512_inc_finalize(uint8_t *output, OQS_SHA3_sha3_512_inc_ctx *state) { 295| 1.38k| keccak_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHA3_512_RATE, 0x06); ------------------ | | 168| 1.38k|#define OQS_SHA3_SHA3_512_RATE 72 ------------------ 296| 1.38k| keccak_inc_squeeze(output, 64, (uint64_t *)state->ctx, OQS_SHA3_SHA3_512_RATE); ------------------ | | 168| 1.38k|#define OQS_SHA3_SHA3_512_RATE 72 ------------------ 297| 1.38k|} xkcp_sha3.c:SHA3_sha3_512_inc_ctx_release: 299| 1.38k|static void SHA3_sha3_512_inc_ctx_release(OQS_SHA3_sha3_512_inc_ctx *state) { 300| 1.38k| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES); ------------------ | | 26| 1.38k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 1.38k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 1.38k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 1.38k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 1.38k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 1.38k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 301| 1.38k|} xkcp_sha3.c:SHA3_shake128: 313| 120|static void SHA3_shake128(uint8_t *output, size_t outlen, const uint8_t *input, size_t inlen) { 314| 120| OQS_SHA3_shake128_inc_ctx s; 315| 120| OQS_SHA3_shake128_inc_init(&s); 316| 120| OQS_SHA3_shake128_inc_absorb(&s, input, inlen); 317| 120| OQS_SHA3_shake128_inc_finalize(&s); 318| 120| OQS_SHA3_shake128_inc_squeeze(output, outlen, &s); 319| 120| OQS_SHA3_shake128_inc_ctx_release(&s); 320| 120|} xkcp_sha3.c:SHA3_shake128_inc_init: 324| 582|static void SHA3_shake128_inc_init(OQS_SHA3_shake128_inc_ctx *state) { 325| 582| state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 24| 582|#define KECCAK_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 26| 582|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 582|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 582| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 582|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 582|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 582|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 326| 582| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3"); ------------------ | | 82| 582| do { \ | | 83| 582| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 582] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 582| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 582] | | ------------------ ------------------ 327| 582| keccak_inc_reset((uint64_t *)state->ctx); 328| 582|} xkcp_sha3.c:SHA3_shake128_inc_absorb: 330| 582|static void SHA3_shake128_inc_absorb(OQS_SHA3_shake128_inc_ctx *state, const uint8_t *input, size_t inlen) { 331| 582| keccak_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE, input, inlen); ------------------ | | 239| 582|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 332| 582|} xkcp_sha3.c:SHA3_shake128_inc_finalize: 334| 582|static void SHA3_shake128_inc_finalize(OQS_SHA3_shake128_inc_ctx *state) { 335| 582| keccak_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE, 0x1F); ------------------ | | 239| 582|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 336| 582|} xkcp_sha3.c:SHA3_shake128_inc_squeeze: 338| 645|static void SHA3_shake128_inc_squeeze(uint8_t *output, size_t outlen, OQS_SHA3_shake128_inc_ctx *state) { 339| 645| keccak_inc_squeeze(output, outlen, (uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE); ------------------ | | 239| 645|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 340| 645|} xkcp_sha3.c:SHA3_shake128_inc_ctx_release: 346| 582|static void SHA3_shake128_inc_ctx_release(OQS_SHA3_shake128_inc_ctx *state) { 347| 582| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES); ------------------ | | 26| 582|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 582|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 582| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 582|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 582|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 582|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 348| 582|} xkcp_sha3.c:SHA3_shake128_inc_ctx_reset: 350| 462|static void SHA3_shake128_inc_ctx_reset(OQS_SHA3_shake128_inc_ctx *state) { 351| 462| keccak_inc_reset((uint64_t *)state->ctx); 352| 462|} xkcp_sha3.c:SHA3_shake256: 356| 8.96k|static void SHA3_shake256(uint8_t *output, size_t outlen, const uint8_t *input, size_t inlen) { 357| 8.96k| OQS_SHA3_shake256_inc_ctx s; 358| 8.96k| OQS_SHA3_shake256_inc_init(&s); 359| 8.96k| OQS_SHA3_shake256_inc_absorb(&s, input, inlen); 360| 8.96k| OQS_SHA3_shake256_inc_finalize(&s); 361| 8.96k| OQS_SHA3_shake256_inc_squeeze(output, outlen, &s); 362| 8.96k| OQS_SHA3_shake256_inc_ctx_release(&s); 363| 8.96k|} xkcp_sha3.c:SHA3_shake256_inc_init: 367| 9.93k|static void SHA3_shake256_inc_init(OQS_SHA3_shake256_inc_ctx *state) { 368| 9.93k| state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 24| 9.93k|#define KECCAK_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 26| 9.93k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 9.93k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 9.93k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 9.93k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 9.93k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 9.93k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 369| 9.93k| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3"); ------------------ | | 82| 9.93k| do { \ | | 83| 9.93k| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 9.93k] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 9.93k| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 9.93k] | | ------------------ ------------------ 370| 9.93k| keccak_inc_reset((uint64_t *)state->ctx); 371| 9.93k|} xkcp_sha3.c:SHA3_shake256_inc_absorb: 373| 10.8k|static void SHA3_shake256_inc_absorb(OQS_SHA3_shake256_inc_ctx *state, const uint8_t *input, size_t inlen) { 374| 10.8k| keccak_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHAKE256_RATE, input, inlen); ------------------ | | 320| 10.8k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 375| 10.8k|} xkcp_sha3.c:SHA3_shake256_inc_finalize: 377| 9.93k|static void SHA3_shake256_inc_finalize(OQS_SHA3_shake256_inc_ctx *state) { 378| 9.93k| keccak_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHAKE256_RATE, 0x1F); ------------------ | | 320| 9.93k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 379| 9.93k|} xkcp_sha3.c:SHA3_shake256_inc_squeeze: 381| 46.1k|static void SHA3_shake256_inc_squeeze(uint8_t *output, size_t outlen, OQS_SHA3_shake256_inc_ctx *state) { 382| 46.1k| keccak_inc_squeeze(output, outlen, state->ctx, OQS_SHA3_SHAKE256_RATE); ------------------ | | 320| 46.1k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 383| 46.1k|} xkcp_sha3.c:SHA3_shake256_inc_ctx_release: 385| 9.93k|static void SHA3_shake256_inc_ctx_release(OQS_SHA3_shake256_inc_ctx *state) { 386| 9.93k| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES); ------------------ | | 26| 9.93k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 9.93k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 9.93k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 9.93k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 9.93k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 9.93k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 387| 9.93k|} xkcp_sha3x4.c:SHA3_shake128_x4: 167| 29.3k|static void SHA3_shake128_x4(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 168| 29.3k| OQS_SHA3_shake128_x4_inc_ctx s; 169| 29.3k| OQS_SHA3_shake128_x4_inc_init(&s); 170| 29.3k| OQS_SHA3_shake128_x4_inc_absorb(&s, in0, in1, in2, in3, inlen); 171| 29.3k| OQS_SHA3_shake128_x4_inc_finalize(&s); 172| 29.3k| OQS_SHA3_shake128_x4_inc_squeeze(out0, out1, out2, out3, outlen, &s); 173| 29.3k| OQS_SHA3_shake128_x4_inc_ctx_release(&s); 174| 29.3k|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_init: 178| 30.6k|static void SHA3_shake128_x4_inc_init(OQS_SHA3_shake128_x4_inc_ctx *state) { 179| 30.6k| state->ctx = OQS_MEM_aligned_alloc(KECCAK_X4_CTX_ALIGNMENT, KECCAK_X4_CTX_BYTES); ------------------ | | 19| 30.6k|#define KECCAK_X4_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_X4_CTX_ALIGNMENT, KECCAK_X4_CTX_BYTES); ------------------ | | 21| 30.6k|#define KECCAK_X4_CTX_BYTES (KECCAK_X4_CTX_ALIGNMENT * \ | | ------------------ | | | | 19| 30.6k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | 22| 30.6k| ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 20| 30.6k|#define _KECCAK_X4_CTX_BYTES (800+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 30.6k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 30.6k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ ------------------ 180| 30.6k| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3x4"); ------------------ | | 82| 30.6k| do { \ | | 83| 30.6k| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 30.6k] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 30.6k| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 30.6k] | | ------------------ ------------------ 181| 30.6k| keccak_x4_inc_reset((uint64_t *)state->ctx); 182| 30.6k|} xkcp_sha3x4.c:keccak_x4_inc_reset: 76| 36.2k|static void keccak_x4_inc_reset(uint64_t *s) { 77| 36.2k|#if OQS_USE_PTHREADS 78| 36.2k| pthread_once(&dispatch_once_control, Keccak_X4_Dispatch); 79| |#else 80| | if (Keccak_X4_Initialize_ptr == NULL) { 81| | Keccak_X4_Dispatch(); 82| | } 83| |#endif 84| 36.2k| (*Keccak_X4_Initialize_ptr)(s); 85| 36.2k| s[100] = 0; 86| 36.2k|} xkcp_sha3x4.c:Keccak_X4_Dispatch: 36| 1|static void Keccak_X4_Dispatch(void) { 37| |// TODO: Simplify this when we have a Windows-compatible AVX2 implementation of SHA3 38| 1|#if defined(OQS_DIST_X86_64_BUILD) 39| 1|#if defined(OQS_ENABLE_SHA3_xkcp_low_avx2) 40| 1|#if defined(OQS_USE_SHA3_AVX512VL) 41| 1| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX512)) { ------------------ | Branch (41:6): [True: 0, False: 1] ------------------ 42| 0| extern const struct OQS_SHA3_x4_callbacks sha3_x4_avx512vl_callbacks; 43| | 44| 0| sha3_x4_default_callbacks = sha3_x4_avx512vl_callbacks; 45| 0| } 46| 1|#endif 47| 1| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (47:6): [True: 1, False: 0] ------------------ 48| 1| Keccak_X4_Initialize_ptr = &KeccakP1600times4_InitializeAll_avx2; 49| 1| Keccak_X4_AddByte_ptr = &KeccakP1600times4_AddByte_avx2; 50| 1| Keccak_X4_AddBytes_ptr = &KeccakP1600times4_AddBytes_avx2; 51| 1| Keccak_X4_Permute_ptr = &KeccakP1600times4_PermuteAll_24rounds_avx2; 52| 1| Keccak_X4_ExtractBytes_ptr = &KeccakP1600times4_ExtractBytes_avx2; 53| 1| } else { 54| 0| Keccak_X4_Initialize_ptr = &KeccakP1600times4_InitializeAll_serial; 55| 0| Keccak_X4_AddByte_ptr = &KeccakP1600times4_AddByte_serial; 56| 0| Keccak_X4_AddBytes_ptr = &KeccakP1600times4_AddBytes_serial; 57| 0| Keccak_X4_Permute_ptr = &KeccakP1600times4_PermuteAll_24rounds_serial; 58| 0| Keccak_X4_ExtractBytes_ptr = &KeccakP1600times4_ExtractBytes_serial; 59| 0| } 60| |#else // Windows 61| | Keccak_X4_Initialize_ptr = &KeccakP1600times4_InitializeAll_serial; 62| | Keccak_X4_AddByte_ptr = &KeccakP1600times4_AddByte_serial; 63| | Keccak_X4_AddBytes_ptr = &KeccakP1600times4_AddBytes_serial; 64| | Keccak_X4_Permute_ptr = &KeccakP1600times4_PermuteAll_24rounds_serial; 65| | Keccak_X4_ExtractBytes_ptr = &KeccakP1600times4_ExtractBytes_serial; 66| |#endif 67| |#else 68| | Keccak_X4_Initialize_ptr = &KeccakP1600times4_InitializeAll; 69| | Keccak_X4_AddByte_ptr = &KeccakP1600times4_AddByte; 70| | Keccak_X4_AddBytes_ptr = &KeccakP1600times4_AddBytes; 71| | Keccak_X4_Permute_ptr = &KeccakP1600times4_PermuteAll_24rounds; 72| | Keccak_X4_ExtractBytes_ptr = &KeccakP1600times4_ExtractBytes; 73| |#endif 74| 1|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_absorb: 183| 31.7k|static void SHA3_shake128_x4_inc_absorb(OQS_SHA3_shake128_x4_inc_ctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 184| 31.7k| keccak_x4_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE, in0, in1, in2, in3, inlen); ------------------ | | 239| 31.7k|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 185| 31.7k|} xkcp_sha3x4.c:keccak_x4_inc_absorb: 89| 33.5k| const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 90| 33.5k| uint64_t c = r - s[100]; 91| | 92| 33.5k| if (s[100] && inlen >= c) { ------------------ | Branch (92:6): [True: 0, False: 33.5k] | Branch (92:16): [True: 0, False: 0] ------------------ 93| 0| (*Keccak_X4_AddBytes_ptr)(s, 0, in0, (unsigned int)s[100], (unsigned int)c); 94| 0| (*Keccak_X4_AddBytes_ptr)(s, 1, in1, (unsigned int)s[100], (unsigned int)c); 95| 0| (*Keccak_X4_AddBytes_ptr)(s, 2, in2, (unsigned int)s[100], (unsigned int)c); 96| 0| (*Keccak_X4_AddBytes_ptr)(s, 3, in3, (unsigned int)s[100], (unsigned int)c); 97| 0| (*Keccak_X4_Permute_ptr)(s); 98| 0| inlen -= c; 99| 0| in0 += c; 100| 0| in1 += c; 101| 0| in2 += c; 102| 0| in3 += c; 103| 0| s[100] = 0; 104| 0| } 105| | 106| 33.5k| while (inlen >= r) { ------------------ | Branch (106:9): [True: 0, False: 33.5k] ------------------ 107| 0| (*Keccak_X4_AddBytes_ptr)(s, 0, in0, 0, (unsigned int)r); 108| 0| (*Keccak_X4_AddBytes_ptr)(s, 1, in1, 0, (unsigned int)r); 109| 0| (*Keccak_X4_AddBytes_ptr)(s, 2, in2, 0, (unsigned int)r); 110| 0| (*Keccak_X4_AddBytes_ptr)(s, 3, in3, 0, (unsigned int)r); 111| 0| (*Keccak_X4_Permute_ptr)(s); 112| 0| inlen -= r; 113| 0| in0 += r; 114| 0| in1 += r; 115| 0| in2 += r; 116| 0| in3 += r; 117| 0| } 118| | 119| 33.5k| (*Keccak_X4_AddBytes_ptr)(s, 0, in0, (unsigned int)s[100], (unsigned int)inlen); 120| 33.5k| (*Keccak_X4_AddBytes_ptr)(s, 1, in1, (unsigned int)s[100], (unsigned int)inlen); 121| 33.5k| (*Keccak_X4_AddBytes_ptr)(s, 2, in2, (unsigned int)s[100], (unsigned int)inlen); 122| 33.5k| (*Keccak_X4_AddBytes_ptr)(s, 3, in3, (unsigned int)s[100], (unsigned int)inlen); 123| 33.5k| s[100] += inlen; 124| 33.5k|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_finalize: 187| 31.7k|static void SHA3_shake128_x4_inc_finalize(OQS_SHA3_shake128_x4_inc_ctx *state) { 188| 31.7k| keccak_x4_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE, 0x1F); ------------------ | | 239| 31.7k|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 189| 31.7k|} xkcp_sha3x4.c:keccak_x4_inc_finalize: 126| 33.5k|static void keccak_x4_inc_finalize(uint64_t *s, uint32_t r, uint8_t p) { 127| 33.5k| (*Keccak_X4_AddByte_ptr)(s, 0, p, (unsigned int)s[100]); 128| 33.5k| (*Keccak_X4_AddByte_ptr)(s, 1, p, (unsigned int)s[100]); 129| 33.5k| (*Keccak_X4_AddByte_ptr)(s, 2, p, (unsigned int)s[100]); 130| 33.5k| (*Keccak_X4_AddByte_ptr)(s, 3, p, (unsigned int)s[100]); 131| | 132| 33.5k| (*Keccak_X4_AddByte_ptr)(s, 0, 0x80, (unsigned int)(r - 1)); 133| 33.5k| (*Keccak_X4_AddByte_ptr)(s, 1, 0x80, (unsigned int)(r - 1)); 134| 33.5k| (*Keccak_X4_AddByte_ptr)(s, 2, 0x80, (unsigned int)(r - 1)); 135| 33.5k| (*Keccak_X4_AddByte_ptr)(s, 3, 0x80, (unsigned int)(r - 1)); 136| | 137| 33.5k| s[100] = 0; 138| 33.5k|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_squeeze: 191| 32.7k|static void SHA3_shake128_x4_inc_squeeze(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, OQS_SHA3_shake128_x4_inc_ctx *state) { 192| 32.7k| keccak_x4_inc_squeeze(out0, out1, out2, out3, outlen, (uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE); ------------------ | | 239| 32.7k|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 193| 32.7k|} xkcp_sha3x4.c:keccak_x4_inc_squeeze: 141| 34.5k| size_t outlen, uint64_t *s, uint32_t r) { 142| | 143| 429k| while (outlen > s[100]) { ------------------ | Branch (143:9): [True: 395k, False: 34.5k] ------------------ 144| 395k| (*Keccak_X4_ExtractBytes_ptr)(s, 0, out0, (unsigned int)(r - s[100]), (unsigned int)s[100]); 145| 395k| (*Keccak_X4_ExtractBytes_ptr)(s, 1, out1, (unsigned int)(r - s[100]), (unsigned int)s[100]); 146| 395k| (*Keccak_X4_ExtractBytes_ptr)(s, 2, out2, (unsigned int)(r - s[100]), (unsigned int)s[100]); 147| 395k| (*Keccak_X4_ExtractBytes_ptr)(s, 3, out3, (unsigned int)(r - s[100]), (unsigned int)s[100]); 148| 395k| (*Keccak_X4_Permute_ptr)(s); 149| 395k| out0 += s[100]; 150| 395k| out1 += s[100]; 151| 395k| out2 += s[100]; 152| 395k| out3 += s[100]; 153| 395k| outlen -= s[100]; 154| 395k| s[100] = r; 155| 395k| } 156| | 157| 34.5k| (*Keccak_X4_ExtractBytes_ptr)(s, 0, out0, (unsigned int)(r - s[100]), (unsigned int)outlen); 158| 34.5k| (*Keccak_X4_ExtractBytes_ptr)(s, 1, out1, (unsigned int)(r - s[100]), (unsigned int)outlen); 159| 34.5k| (*Keccak_X4_ExtractBytes_ptr)(s, 2, out2, (unsigned int)(r - s[100]), (unsigned int)outlen); 160| 34.5k| (*Keccak_X4_ExtractBytes_ptr)(s, 3, out3, (unsigned int)(r - s[100]), (unsigned int)outlen); 161| | 162| 34.5k| s[100] -= outlen; 163| 34.5k|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_ctx_release: 199| 30.6k|static void SHA3_shake128_x4_inc_ctx_release(OQS_SHA3_shake128_x4_inc_ctx *state) { 200| 30.6k| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_X4_CTX_BYTES); ------------------ | | 21| 30.6k|#define KECCAK_X4_CTX_BYTES (KECCAK_X4_CTX_ALIGNMENT * \ | | ------------------ | | | | 19| 30.6k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | 22| 30.6k| ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 20| 30.6k|#define _KECCAK_X4_CTX_BYTES (800+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 30.6k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 30.6k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ ------------------ 201| 30.6k|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_ctx_reset: 203| 2.41k|static void SHA3_shake128_x4_inc_ctx_reset(OQS_SHA3_shake128_x4_inc_ctx *state) { 204| 2.41k| keccak_x4_inc_reset((uint64_t *)state->ctx); 205| 2.41k|} xkcp_sha3x4.c:SHA3_shake256_x4: 209| 399|static void SHA3_shake256_x4(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 210| 399| OQS_SHA3_shake256_x4_inc_ctx s; 211| 399| OQS_SHA3_shake256_x4_inc_init(&s); 212| 399| OQS_SHA3_shake256_x4_inc_absorb(&s, in0, in1, in2, in3, inlen); 213| 399| OQS_SHA3_shake256_x4_inc_finalize(&s); 214| 399| OQS_SHA3_shake256_x4_inc_squeeze(out0, out1, out2, out3, outlen, &s); 215| 399| OQS_SHA3_shake256_x4_inc_ctx_release(&s); 216| 399|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_init: 220| 1.79k|static void SHA3_shake256_x4_inc_init(OQS_SHA3_shake256_x4_inc_ctx *state) { 221| 1.79k| state->ctx = OQS_MEM_aligned_alloc(KECCAK_X4_CTX_ALIGNMENT, KECCAK_X4_CTX_BYTES); ------------------ | | 19| 1.79k|#define KECCAK_X4_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_X4_CTX_ALIGNMENT, KECCAK_X4_CTX_BYTES); ------------------ | | 21| 1.79k|#define KECCAK_X4_CTX_BYTES (KECCAK_X4_CTX_ALIGNMENT * \ | | ------------------ | | | | 19| 1.79k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | 22| 1.79k| ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 20| 1.79k|#define _KECCAK_X4_CTX_BYTES (800+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 1.79k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 1.79k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ ------------------ 222| 1.79k| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3x4"); ------------------ | | 82| 1.79k| do { \ | | 83| 1.79k| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 1.79k] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 1.79k| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 1.79k] | | ------------------ ------------------ 223| 1.79k| keccak_x4_inc_reset((uint64_t *)state->ctx); 224| 1.79k|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_absorb: 226| 1.79k|static void SHA3_shake256_x4_inc_absorb(OQS_SHA3_shake256_x4_inc_ctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 227| 1.79k| keccak_x4_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHAKE256_RATE, in0, in1, in2, in3, inlen); ------------------ | | 320| 1.79k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 228| 1.79k|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_finalize: 230| 1.79k|static void SHA3_shake256_x4_inc_finalize(OQS_SHA3_shake256_x4_inc_ctx *state) { 231| 1.79k| keccak_x4_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHAKE256_RATE, 0x1F); ------------------ | | 320| 1.79k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 232| 1.79k|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_squeeze: 234| 1.79k|static void SHA3_shake256_x4_inc_squeeze(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, OQS_SHA3_shake256_x4_inc_ctx *state) { 235| 1.79k| keccak_x4_inc_squeeze(out0, out1, out2, out3, outlen, (uint64_t *)state->ctx, OQS_SHA3_SHAKE256_RATE); ------------------ | | 320| 1.79k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 236| 1.79k|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_ctx_release: 242| 1.79k|static void SHA3_shake256_x4_inc_ctx_release(OQS_SHA3_shake256_x4_inc_ctx *state) { 243| 1.79k| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_X4_CTX_BYTES); ------------------ | | 21| 1.79k|#define KECCAK_X4_CTX_BYTES (KECCAK_X4_CTX_ALIGNMENT * \ | | ------------------ | | | | 19| 1.79k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | 22| 1.79k| ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 20| 1.79k|#define _KECCAK_X4_CTX_BYTES (800+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 1.79k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 1.79k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ ------------------ 244| 1.79k|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_ctx_reset: 246| 1.39k|static void SHA3_shake256_x4_inc_ctx_reset(OQS_SHA3_shake256_x4_inc_ctx *state) { 247| 1.39k| keccak_x4_inc_reset((uint64_t *)state->ctx); 248| 1.39k|} common.c:cpuid: 47| 2|static inline void cpuid(cpuid_out *out, const uint32_t eax_leaf) { 48| 2| const uint32_t ecx_leaf = 0; 49| | 50| 2|#if defined(__GNUC__) || defined(__clang__) 51| 2| uint32_t eax, ebx, ecx, edx; 52| 2| __asm__("cpuid" : "=a"(eax), "=b"(ebx), "=c"(ecx), "=d"(edx) : "a"(eax_leaf), "c"(ecx_leaf) : ); 53| 2| out->eax = eax; 54| 2| out->ebx = ebx; 55| 2| out->ecx = ecx; 56| 2| out->edx = edx; 57| |#elif defined(_MSC_VER) 58| | uint32_t output[4]; 59| | __cpuidex(output, eax_leaf, ecx_leaf); 60| | out->eax = output[0]; 61| | out->ebx = output[1]; 62| | out->ecx = output[2]; 63| | out->edx = output[3]; 64| |#else 65| |#error "Only GCC, Clang, and MSVC are supported." 66| |#endif 67| 2|} common.c:is_bit_set: 43| 13|static inline unsigned int is_bit_set(const uint32_t val, const unsigned int bit_pos) { 44| 13| return val & (1 << bit_pos) ? 1 : 0; ------------------ | Branch (44:9): [True: 13, False: 0] ------------------ 45| 13|} common.c:xgetbv_eax: 27| 1|static inline uint32_t xgetbv_eax(uint32_t xcr) { 28| 1|#if defined(__GNUC__) || defined(__clang__) 29| 1| uint32_t eax; 30| 1| __asm__ ( ".byte 0x0f, 0x01, 0xd0" : "=a"(eax) : "c"(xcr) : "edx"); 31| 1| return eax; 32| |#elif defined(_MSC_VER) 33| | return _xgetbv(xcr) & 0xFFFF; 34| |#else 35| |#error "Only GCC, Clang, and MSVC are supported." 36| |#endif 37| 1|} common.c:has_mask: 39| 3|static unsigned int has_mask(const uint32_t value, const uint32_t mask) { 40| 3| return (value & mask) == mask; 41| 3|} kem.c:sk_cleanup: 37| 14| { \ 38| 14| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 14|#define secure_clean OQS_MEM_cleanse ------------------ 39| 14| } kem.c:pad_r_cleanup: 37| 28| { \ 38| 28| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 28|#define secure_clean OQS_MEM_cleanse ------------------ 39| 28| } kem.c:seeds_cleanup: 66| 14|{ 67| 42| for(int i = 0; i < NUM_OF_SEEDS; i++) { ------------------ | | 76| 42|#define NUM_OF_SEEDS 2 ------------------ | Branch (67:18): [True: 28, False: 14] ------------------ 68| 28| seed_cleanup(&(o->seed[i])); 69| 28| } 70| 14|} kem.c:seed_cleanup: 37| 42| { \ 38| 42| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 42|#define secure_clean OQS_MEM_cleanse ------------------ 39| 42| } kem.c:m_cleanup: 37| 21| { \ 38| 21| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 21|#define secure_clean OQS_MEM_cleanse ------------------ 39| 21| } kem.c:ss_cleanup: 37| 14| { \ 38| 14| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 14|#define secure_clean OQS_MEM_cleanse ------------------ 39| 14| } kem.c:pad_e_cleanup: 37| 21| { \ 38| 21| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 21|#define secure_clean OQS_MEM_cleanse ------------------ 39| 21| } kem.c:func_k_cleanup: 37| 14| { \ 38| 14| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 14|#define secure_clean OQS_MEM_cleanse ------------------ 39| 14| } kem.c:e_cleanup: 37| 21| { \ 38| 21| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 21|#define secure_clean OQS_MEM_cleanse ------------------ 39| 21| } decode.c:pad_r_cleanup: 37| 217| { \ 38| 217| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 217|#define secure_clean OQS_MEM_cleanse ------------------ 39| 217| } decode.c:e_cleanup: 37| 14| { \ 38| 14| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 14|#define secure_clean OQS_MEM_cleanse ------------------ 39| 14| } decode.c:syndrome_cleanup: 37| 56| { \ 38| 56| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 56|#define secure_clean OQS_MEM_cleanse ------------------ 39| 56| } decode.c:upc_cleanup: 37| 49| { \ 38| 49| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 49|#define secure_clean OQS_MEM_cleanse ------------------ 39| 49| } gf2x_inv.c:pad_r_cleanup: 37| 21| { \ 38| 21| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 21|#define secure_clean OQS_MEM_cleanse ------------------ 39| 21| } gf2x_inv.c:dbl_pad_r_cleanup: 37| 7| { \ 38| 7| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 7|#define secure_clean OQS_MEM_cleanse ------------------ 39| 7| } gf2x_mul.c:dbl_pad_r_cleanup: 37| 236| { \ 38| 236| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 236|#define secure_clean OQS_MEM_cleanse ------------------ 39| 236| } sampling.c:OQS_KEM_bike_l1_is_avx512_enabled: 27| 15|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 15|#if defined(OQS_DIST_X86_64_BUILD) 30| 15| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 15|} sampling.c:OQS_KEM_bike_l1_is_avx2_enabled: 16| 15|{ 17| 15|#if defined(OQS_DIST_X86_64_BUILD) 18| 15| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 15|} sampling.c:OQS_KEM_bike_l3_is_avx512_enabled: 27| 3|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 3|#if defined(OQS_DIST_X86_64_BUILD) 30| 3| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 3|} sampling.c:OQS_KEM_bike_l3_is_avx2_enabled: 16| 3|{ 17| 3|#if defined(OQS_DIST_X86_64_BUILD) 18| 3| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 3|} sampling.c:OQS_KEM_bike_l5_is_avx512_enabled: 27| 3|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 3|#if defined(OQS_DIST_X86_64_BUILD) 30| 3| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 3|} sampling.c:OQS_KEM_bike_l5_is_avx2_enabled: 16| 3|{ 17| 3|#if defined(OQS_DIST_X86_64_BUILD) 18| 3| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 3|} decode.c:OQS_KEM_bike_l1_is_avx512_enabled: 27| 5|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 5|#if defined(OQS_DIST_X86_64_BUILD) 30| 5| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 5|} decode.c:OQS_KEM_bike_l1_is_avx2_enabled: 16| 5|{ 17| 5|#if defined(OQS_DIST_X86_64_BUILD) 18| 5| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 5|} gf2x_inv.c:OQS_KEM_bike_l1_is_avx512_enabled: 27| 5|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 5|#if defined(OQS_DIST_X86_64_BUILD) 30| 5| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 5|} gf2x_inv.c:OQS_KEM_bike_l1_is_avx2_enabled: 16| 5|{ 17| 5|#if defined(OQS_DIST_X86_64_BUILD) 18| 5| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 5|} gf2x_inv.c:OQS_KEM_bike_l1_is_pclmul_enabled: 39| 5|{ 40| 5|#if defined(OQS_DIST_X86_64_BUILD) 41| 5| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 5|} gf2x_mul.c:OQS_KEM_bike_l1_is_avx512_enabled: 27| 85|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 85|#if defined(OQS_DIST_X86_64_BUILD) 30| 85| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 85|} gf2x_mul.c:OQS_KEM_bike_l1_is_avx2_enabled: 16| 85|{ 17| 85|#if defined(OQS_DIST_X86_64_BUILD) 18| 85| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 85|} gf2x_mul.c:OQS_KEM_bike_l1_is_pclmul_enabled: 39| 85|{ 40| 85|#if defined(OQS_DIST_X86_64_BUILD) 41| 85| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 85|} decode.c:OQS_KEM_bike_l3_is_avx512_enabled: 27| 1|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 1|#if defined(OQS_DIST_X86_64_BUILD) 30| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 1|} decode.c:OQS_KEM_bike_l3_is_avx2_enabled: 16| 1|{ 17| 1|#if defined(OQS_DIST_X86_64_BUILD) 18| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 1|} gf2x_inv.c:OQS_KEM_bike_l3_is_avx512_enabled: 27| 1|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 1|#if defined(OQS_DIST_X86_64_BUILD) 30| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 1|} gf2x_inv.c:OQS_KEM_bike_l3_is_avx2_enabled: 16| 1|{ 17| 1|#if defined(OQS_DIST_X86_64_BUILD) 18| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 1|} gf2x_inv.c:OQS_KEM_bike_l3_is_pclmul_enabled: 39| 1|{ 40| 1|#if defined(OQS_DIST_X86_64_BUILD) 41| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 1|} gf2x_mul.c:OQS_KEM_bike_l3_is_avx512_enabled: 27| 17|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 17|#if defined(OQS_DIST_X86_64_BUILD) 30| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 17|} gf2x_mul.c:OQS_KEM_bike_l3_is_avx2_enabled: 16| 17|{ 17| 17|#if defined(OQS_DIST_X86_64_BUILD) 18| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 17|} gf2x_mul.c:OQS_KEM_bike_l3_is_pclmul_enabled: 39| 17|{ 40| 17|#if defined(OQS_DIST_X86_64_BUILD) 41| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 17|} decode.c:OQS_KEM_bike_l5_is_avx512_enabled: 27| 1|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 1|#if defined(OQS_DIST_X86_64_BUILD) 30| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 1|} decode.c:OQS_KEM_bike_l5_is_avx2_enabled: 16| 1|{ 17| 1|#if defined(OQS_DIST_X86_64_BUILD) 18| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 1|} gf2x_inv.c:OQS_KEM_bike_l5_is_avx512_enabled: 27| 1|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 1|#if defined(OQS_DIST_X86_64_BUILD) 30| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 1|} gf2x_inv.c:OQS_KEM_bike_l5_is_avx2_enabled: 16| 1|{ 17| 1|#if defined(OQS_DIST_X86_64_BUILD) 18| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 1|} gf2x_inv.c:OQS_KEM_bike_l5_is_pclmul_enabled: 39| 1|{ 40| 1|#if defined(OQS_DIST_X86_64_BUILD) 41| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 1|} gf2x_mul.c:OQS_KEM_bike_l5_is_avx512_enabled: 27| 17|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 17|#if defined(OQS_DIST_X86_64_BUILD) 30| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 17|} gf2x_mul.c:OQS_KEM_bike_l5_is_avx2_enabled: 16| 17|{ 17| 17|#if defined(OQS_DIST_X86_64_BUILD) 18| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 17|} gf2x_mul.c:OQS_KEM_bike_l5_is_pclmul_enabled: 39| 17|{ 40| 17|#if defined(OQS_DIST_X86_64_BUILD) 41| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 17|} OQS_KEM_bike_l1_compute_syndrome: 60| 40|{ 61| 40| DEFER_CLEANUP(pad_r_t pad_s, pad_r_cleanup); ------------------ | | 16| 40| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 62| | 63| 40| gf2x_mod_mul(&pad_s, c0, h0); ------------------ | | 60| 40|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 40|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 40|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 40|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 64| | 65| 40| bike_memcpy((uint8_t *)syndrome->qw, pad_s.val.raw, R_BYTES); ------------------ | | 81| 40|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 40|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 66| 40| ctx->dup(syndrome); 67| 40|} OQS_KEM_bike_l1_recompute_syndrome: 75| 35|{ 76| 35| DEFER_CLEANUP(pad_r_t tmp_c0, pad_r_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 77| 35| DEFER_CLEANUP(pad_r_t e0 = {0}, pad_r_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 78| 35| DEFER_CLEANUP(pad_r_t e1 = {0}, pad_r_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 79| | 80| 35| e0.val = e->val[0]; 81| 35| e1.val = e->val[1]; 82| | 83| | // tmp_c0 = pk * e1 + c0 + e0 84| 35| gf2x_mod_mul(&tmp_c0, &e1, pk); ------------------ | | 60| 35|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 35|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 35|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 35|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 35| gf2x_mod_add(&tmp_c0, &tmp_c0, c0); ------------------ | | 123| 35|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 35|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 35|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 35|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 35| gf2x_mod_add(&tmp_c0, &tmp_c0, &e0); ------------------ | | 123| 35|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 35|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 35|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 35|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 87| | 88| | // Recompute the syndrome using the updated ciphertext 89| 35| compute_syndrome(syndrome, &tmp_c0, h0, ctx); ------------------ | | 66| 35|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 35|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 35|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 35|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 90| 35|} OQS_KEM_bike_l1_decode: 237| 5|{ 238| | // Initialize the decode methods struct 239| 5| decode_ctx ctx; 240| 5| decode_ctx_init(&ctx); ------------------ | | 94| 5|#define decode_ctx_init RENAME_FUNC_NAME(decode_ctx_init) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| | 242| 5| DEFER_CLEANUP(e_t black_e = {0}, e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 243| 5| DEFER_CLEANUP(e_t gray_e = {0}, e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 244| | 245| 5| DEFER_CLEANUP(pad_r_t c0 = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 246| 5| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 247| 5| pad_r_t pk = {0}; 248| | 249| | // Pad ciphertext (c0), secret key (h0), and public key (h) 250| 5| c0.val = ct->c0; 251| 5| h0.val = sk->bin[0]; 252| 5| pk.val = sk->pk; 253| | 254| 5| DEFER_CLEANUP(syndrome_t s = {0}, syndrome_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 255| 5| DMSG(" Computing s.\n"); 256| 5| compute_syndrome(&s, &c0, &h0, &ctx); ------------------ | | 66| 5|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 257| 5| ctx.dup(&s); 258| | 259| | // Reset (init) the error because it is xored in the find_err functions. 260| 5| bike_memset(e, 0, sizeof(*e)); 261| | 262| 30| for(uint32_t iter = 0; iter < MAX_IT; iter++) { ------------------ | | 53| 30|# define MAX_IT 5 ------------------ | Branch (262:26): [True: 25, False: 5] ------------------ 263| 25| const uint8_t threshold = get_threshold(&s); ------------------ | | 141| 25|#define get_threshold RENAME_FUNC_NAME(get_threshold) | | ------------------ | | | | 44| 25|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 25|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 25|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 264| | 265| 25| DMSG(" Iteration: %d\n", iter); 266| 25| DMSG(" Weight of e: %lu\n", 267| 25| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 268| 25| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 269| | 270| 25| find_err1(e, &black_e, &gray_e, &s, sk->wlist, threshold, &ctx); 271| 25| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 25|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 25|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 25|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 25|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 272| 25|#if defined(BGF_DECODER) 273| 25| if(iter >= 1) { ------------------ | Branch (273:8): [True: 20, False: 5] ------------------ 274| 20| continue; 275| 20| } 276| 5|#endif 277| 5| DMSG(" Weight of e: %lu\n", 278| 5| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 279| 5| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 280| | 281| 5| find_err2(e, &black_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 24| 5|# define D 71 ------------------ 282| 5| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 5|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 283| | 284| 5| DMSG(" Weight of e: %lu\n", 285| 5| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 286| 5| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 287| | 288| 5| find_err2(e, &gray_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 24| 5|# define D 71 ------------------ 289| 5| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 5|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 5| } 291| 5|} decode.c:OQS_KEM_bike_l1_get_threshold: 103| 25|{ 104| 25| bike_static_assert(sizeof(*s) >= sizeof(r_t), syndrome_is_large_enough); ------------------ | | 33| 25| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 105| | 106| 25| const uint64_t syndrome_weight = r_bits_vector_weight((const r_t *)s->qw); ------------------ | | 78| 25|#define r_bits_vector_weight RENAME_FUNC_NAME(r_bits_vector_weight) | | ------------------ | | | | 44| 25|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 25|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 25|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 107| | 108| | // The threshold coefficients are defined in the spec as floating point values. 109| | // Since we want to avoid floating point operations for constant-timeness, 110| | // we use integer arithmetic to compute the threshold. 111| | // For example, in the case of Level-1 parameters, instead of having: 112| | // T0 = 13.530 and T1 = 0.0069722, 113| | // we multipy the values by 10^8 and work with integers: 114| | // T0' = 1353000000 and T1' = 697220. 115| | // Then, instead of computing the threshold by: 116| | // T0 + T1*S, 117| | // we compute: 118| | // (T0' + T1'*S)/10^8, 119| | // where S is the syndrome weight. Additionally, instead of dividing by 10^8, 120| | // we compute the result by a multiplication and a right shift (both 121| | // constant-time operations), as described in: 122| | // https://dl.acm.org/doi/pdf/10.1145/178243.178249 123| 25| uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 27| 25|# define THRESHOLD_COEFF0 1353000000ULL ------------------ uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 28| 25|# define THRESHOLD_COEFF1 697220ULL ------------------ 124| 25| MUL64HIGH(thr, thr, THRESHOLD_MUL_CONST); ------------------ | | 93| 25| do { \ | | 94| 25| uint64_t a_lo, a_hi, b_lo, b_hi; \ | | 95| 25| a_lo = a & 0xffffffff; \ | | 96| 25| b_lo = b & 0xffffffff; \ | | 97| 25| a_hi = a >> 32; \ | | 98| 25| b_hi = b >> 32; \ | | 99| 25| c = a_hi*b_hi + ((a_hi*b_lo + a_lo*b_hi) >> 32); \ | | 100| 25| } while(0) | | ------------------ | | | Branch (100:11): [Folded, False: 25] | | ------------------ ------------------ 125| 25| thr >>= THRESHOLD_SHR_CONST; ------------------ | | 30| 25|# define THRESHOLD_SHR_CONST 26 ------------------ 126| | 127| 25| const uint32_t mask = secure_l32_mask((uint32_t)thr, THRESHOLD_MIN); ------------------ | | 31| 25|# define THRESHOLD_MIN 36 ------------------ 128| 25| thr = (u32_barrier(mask) & thr) | (u32_barrier(~mask) & THRESHOLD_MIN); ------------------ | | 31| 25|# define THRESHOLD_MIN 36 ------------------ 129| | 130| 25| DMSG(" Threshold: %d\n", thr); 131| 25| return thr; 132| 25|} decode.c:find_err1: 144| 35|{ 145| | // This function uses the bit-slice-adder methodology of [5]: 146| 35| DEFER_CLEANUP(syndrome_t rotated_syndrome = {0}, syndrome_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 147| 35| DEFER_CLEANUP(upc_t upc, upc_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 148| | 149| 105| for(uint32_t i = 0; i < N0; i++) { ------------------ | | 15| 105|#define N0 2 ------------------ | Branch (149:23): [True: 70, False: 35] ------------------ 150| | // UPC must start from zero at every iteration 151| 70| bike_memset(&upc, 0, sizeof(upc)); 152| | 153| | // 1) Right-rotate the syndrome for every secret key set bit index 154| | // Then slice-add it to the UPC array. 155| 6.02k| for(size_t j = 0; j < D; j++) { ------------------ | | 24| 6.02k|# define D 71 ------------------ | Branch (155:23): [True: 5.95k, False: 70] ------------------ 156| 5.95k| ctx->rotate_right(&rotated_syndrome, syndrome, wlist[i].val[j]); ------------------ | | 77| 5.95k|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 5.95k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5.95k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5.95k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 5.95k| ctx->bit_sliced_adder(&upc, &rotated_syndrome, LOG2_MSB(j + 1)); ------------------ | | 77| 5.95k| ((v) == 0 \ | | ------------------ | | | Branch (77:4): [True: 0, False: 5.95k] | | ------------------ | | 78| 5.95k| ? 0 \ | | 79| 5.95k| : ((v) < 2 \ | | ------------------ | | | Branch (79:9): [True: 70, False: 5.88k] | | ------------------ | | 80| 5.95k| ? 1 \ | | 81| 5.95k| : ((v) < 4 \ | | ------------------ | | | Branch (81:14): [True: 140, False: 5.74k] | | ------------------ | | 82| 5.88k| ? 2 \ | | 83| 5.88k| : ((v) < 8 \ | | ------------------ | | | Branch (83:19): [True: 280, False: 5.46k] | | ------------------ | | 84| 5.74k| ? 3 \ | | 85| 5.74k| : ((v) < 16 \ | | ------------------ | | | Branch (85:24): [True: 560, False: 4.90k] | | ------------------ | | 86| 5.46k| ? 4 \ | | 87| 5.46k| : ((v) < 32 \ | | ------------------ | | | Branch (87:29): [True: 1.12k, False: 3.78k] | | ------------------ | | 88| 4.90k| ? 5 \ | | 89| 4.90k| : ((v) < 64 \ | | ------------------ | | | Branch (89:34): [True: 2.24k, False: 1.54k] | | ------------------ | | 90| 3.78k| ? 6 \ | | 91| 3.78k| : ((v) < 128 ? 7 \ | | ------------------ | | | Branch (91:39): [True: 1.44k, False: 100] | | ------------------ | | 92| 1.54k| : ((v) < 256 ? 8 : 9))))))))) | | ------------------ | | | Branch (92:52): [True: 100, False: 0] | | ------------------ ------------------ 158| 5.95k| } 159| | 160| | // 2) Subtract the threshold from the UPC counters 161| 70| ctx->bit_slice_full_subtract(&upc, threshold); 162| | 163| | // 3) Update the errors and the black errors vectors. 164| | // The last slice of the UPC array holds the MSB of the accumulated values 165| | // minus the threshold. Every zero bit indicates a potential error bit. 166| | // The errors values are stored in the black array and xored with the 167| | // errors Of the previous iteration. 168| 70| const r_t *last_slice = &(upc.slice[SLICES - 1].u.r.val); ------------------ | | 116| 70|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 70| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 70] | | | | ------------------ | | | | 78| 70| ? 0 \ | | | | 79| 70| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 70] | | | | ------------------ | | | | 80| 70| ? 1 \ | | | | 81| 70| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 70] | | | | ------------------ | | | | 82| 70| ? 2 \ | | | | 83| 70| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 70] | | | | ------------------ | | | | 84| 70| ? 3 \ | | | | 85| 70| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 70] | | | | ------------------ | | | | 86| 70| ? 4 \ | | | | 87| 70| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 70] | | | | ------------------ | | | | 88| 70| ? 5 \ | | | | 89| 70| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 70] | | | | ------------------ | | | | 90| 70| ? 6 \ | | | | 91| 70| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [True: 60, Folded] | | | | ------------------ | | | | 92| 70| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 10, Folded] | | | | ------------------ | | ------------------ ------------------ 169| 159k| for(size_t j = 0; j < R_BYTES; j++) { ------------------ | | 81| 159k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 159k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (169:23): [True: 159k, False: 70] ------------------ 170| 159k| const uint8_t sum_msb = (~last_slice->raw[j]); 171| 159k| black_e->val[i].raw[j] = sum_msb; 172| 159k| e->val[i].raw[j] ^= sum_msb; 173| 159k| } 174| | 175| | // Ensure that the padding bits (upper bits of the last byte) are zero so 176| | // they will not be included in the multiplication and in the hash function. 177| 70| e->val[i].raw[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 70|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 70|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ e->val[i].raw[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 70|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 70|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 70|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 178| | 179| | // 4) Calculate the gray error array by adding "DELTA" to the UPC array. 180| | // For that we reuse the rotated_syndrome variable setting it to all "1". 181| 280| for(size_t l = 0; l < DELTA; l++) { ------------------ | | 115| 280|#define DELTA 3 ------------------ | Branch (181:23): [True: 210, False: 70] ------------------ 182| 210| bike_memset((uint8_t *)rotated_syndrome.qw, 0xff, R_BYTES); ------------------ | | 81| 210|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 210|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 183| 210| ctx->bit_sliced_adder(&upc, &rotated_syndrome, SLICES); ------------------ | | 116| 210|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 210| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 210] | | | | ------------------ | | | | 78| 210| ? 0 \ | | | | 79| 210| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 210] | | | | ------------------ | | | | 80| 210| ? 1 \ | | | | 81| 210| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 210] | | | | ------------------ | | | | 82| 210| ? 2 \ | | | | 83| 210| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 210] | | | | ------------------ | | | | 84| 210| ? 3 \ | | | | 85| 210| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 210] | | | | ------------------ | | | | 86| 210| ? 4 \ | | | | 87| 210| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 210] | | | | ------------------ | | | | 88| 210| ? 5 \ | | | | 89| 210| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 210] | | | | ------------------ | | | | 90| 210| ? 6 \ | | | | 91| 210| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [True: 180, Folded] | | | | ------------------ | | | | 92| 210| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 30, Folded] | | | | ------------------ | | ------------------ ------------------ 184| 210| } 185| | 186| | // 5) Update the gray list with the relevant bits that are not 187| | // set in the black list. 188| 159k| for(size_t j = 0; j < R_BYTES; j++) { ------------------ | | 81| 159k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 159k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (188:23): [True: 159k, False: 70] ------------------ 189| 159k| const uint8_t sum_msb = (~last_slice->raw[j]); 190| 159k| gray_e->val[i].raw[j] = (~(black_e->val[i].raw[j])) & sum_msb; 191| 159k| } 192| 70| } 193| 35|} decode.c:find_err2: 203| 14|{ 204| 14| DEFER_CLEANUP(syndrome_t rotated_syndrome = {0}, syndrome_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 205| 14| DEFER_CLEANUP(upc_t upc, upc_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 206| | 207| 42| for(uint32_t i = 0; i < N0; i++) { ------------------ | | 15| 42|#define N0 2 ------------------ | Branch (207:23): [True: 28, False: 14] ------------------ 208| | // UPC must start from zero at every iteration 209| 28| bike_memset(&upc, 0, sizeof(upc)); 210| | 211| | // 1) Right-rotate the syndrome, for every index of a set bit in the secret 212| | // key. Then slice-add it to the UPC array. 213| 2.40k| for(size_t j = 0; j < D; j++) { ------------------ | | 24| 2.40k|# define D 71 ------------------ | Branch (213:23): [True: 2.38k, False: 28] ------------------ 214| 2.38k| ctx->rotate_right(&rotated_syndrome, syndrome, wlist[i].val[j]); ------------------ | | 77| 2.38k|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 2.38k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2.38k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2.38k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 215| 2.38k| ctx->bit_sliced_adder(&upc, &rotated_syndrome, LOG2_MSB(j + 1)); ------------------ | | 77| 2.38k| ((v) == 0 \ | | ------------------ | | | Branch (77:4): [True: 0, False: 2.38k] | | ------------------ | | 78| 2.38k| ? 0 \ | | 79| 2.38k| : ((v) < 2 \ | | ------------------ | | | Branch (79:9): [True: 28, False: 2.35k] | | ------------------ | | 80| 2.38k| ? 1 \ | | 81| 2.38k| : ((v) < 4 \ | | ------------------ | | | Branch (81:14): [True: 56, False: 2.29k] | | ------------------ | | 82| 2.35k| ? 2 \ | | 83| 2.35k| : ((v) < 8 \ | | ------------------ | | | Branch (83:19): [True: 112, False: 2.18k] | | ------------------ | | 84| 2.29k| ? 3 \ | | 85| 2.29k| : ((v) < 16 \ | | ------------------ | | | Branch (85:24): [True: 224, False: 1.96k] | | ------------------ | | 86| 2.18k| ? 4 \ | | 87| 2.18k| : ((v) < 32 \ | | ------------------ | | | Branch (87:29): [True: 448, False: 1.51k] | | ------------------ | | 88| 1.96k| ? 5 \ | | 89| 1.96k| : ((v) < 64 \ | | ------------------ | | | Branch (89:34): [True: 896, False: 616] | | ------------------ | | 90| 1.51k| ? 6 \ | | 91| 1.51k| : ((v) < 128 ? 7 \ | | ------------------ | | | Branch (91:39): [True: 576, False: 40] | | ------------------ | | 92| 616| : ((v) < 256 ? 8 : 9))))))))) | | ------------------ | | | Branch (92:52): [True: 40, False: 0] | | ------------------ ------------------ 216| 2.38k| } 217| | 218| | // 2) Subtract the threshold from the UPC counters 219| 28| ctx->bit_slice_full_subtract(&upc, threshold); 220| | 221| | // 3) Update the errors vector. 222| | // The last slice of the UPC array holds the MSB of the accumulated values 223| | // minus the threshold. Every zero bit indicates a potential error bit. 224| 28| const r_t *last_slice = &(upc.slice[SLICES - 1].u.r.val); ------------------ | | 116| 28|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 28| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 28] | | | | ------------------ | | | | 78| 28| ? 0 \ | | | | 79| 28| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 28] | | | | ------------------ | | | | 80| 28| ? 1 \ | | | | 81| 28| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 28] | | | | ------------------ | | | | 82| 28| ? 2 \ | | | | 83| 28| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 28] | | | | ------------------ | | | | 84| 28| ? 3 \ | | | | 85| 28| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 28] | | | | ------------------ | | | | 86| 28| ? 4 \ | | | | 87| 28| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 28] | | | | ------------------ | | | | 88| 28| ? 5 \ | | | | 89| 28| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 28] | | | | ------------------ | | | | 90| 28| ? 6 \ | | | | 91| 28| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [True: 24, Folded] | | | | ------------------ | | | | 92| 28| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 4, Folded] | | | | ------------------ | | ------------------ ------------------ 225| 63.6k| for(size_t j = 0; j < R_BYTES; j++) { ------------------ | | 81| 63.6k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 63.6k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (225:23): [True: 63.6k, False: 28] ------------------ 226| 63.6k| const uint8_t sum_msb = (~last_slice->raw[j]); 227| 63.6k| e->val[i].raw[j] ^= (pos_e->val[i].raw[j] & sum_msb); 228| 63.6k| } 229| | 230| | // Ensure that the padding bits (upper bits of the last byte) are zero, so 231| | // they are not included in the multiplication, and in the hash function. 232| 28| e->val[i].raw[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 28|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 28|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ e->val[i].raw[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 28|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 28|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 28|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 233| 28| } 234| 14|} OQS_KEM_bike_l3_compute_syndrome: 60| 8|{ 61| 8| DEFER_CLEANUP(pad_r_t pad_s, pad_r_cleanup); ------------------ | | 16| 8| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 62| | 63| 8| gf2x_mod_mul(&pad_s, c0, h0); ------------------ | | 60| 8|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 8|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 8|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 8|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 64| | 65| 8| bike_memcpy((uint8_t *)syndrome->qw, pad_s.val.raw, R_BYTES); ------------------ | | 81| 8|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 8|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 66| 8| ctx->dup(syndrome); 67| 8|} OQS_KEM_bike_l3_recompute_syndrome: 75| 7|{ 76| 7| DEFER_CLEANUP(pad_r_t tmp_c0, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 77| 7| DEFER_CLEANUP(pad_r_t e0 = {0}, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 78| 7| DEFER_CLEANUP(pad_r_t e1 = {0}, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 79| | 80| 7| e0.val = e->val[0]; 81| 7| e1.val = e->val[1]; 82| | 83| | // tmp_c0 = pk * e1 + c0 + e0 84| 7| gf2x_mod_mul(&tmp_c0, &e1, pk); ------------------ | | 60| 7|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 7| gf2x_mod_add(&tmp_c0, &tmp_c0, c0); ------------------ | | 123| 7|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 7| gf2x_mod_add(&tmp_c0, &tmp_c0, &e0); ------------------ | | 123| 7|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 87| | 88| | // Recompute the syndrome using the updated ciphertext 89| 7| compute_syndrome(syndrome, &tmp_c0, h0, ctx); ------------------ | | 66| 7|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 90| 7|} OQS_KEM_bike_l3_decode: 237| 1|{ 238| | // Initialize the decode methods struct 239| 1| decode_ctx ctx; 240| 1| decode_ctx_init(&ctx); ------------------ | | 94| 1|#define decode_ctx_init RENAME_FUNC_NAME(decode_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| | 242| 1| DEFER_CLEANUP(e_t black_e = {0}, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 243| 1| DEFER_CLEANUP(e_t gray_e = {0}, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 244| | 245| 1| DEFER_CLEANUP(pad_r_t c0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 246| 1| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 247| 1| pad_r_t pk = {0}; 248| | 249| | // Pad ciphertext (c0), secret key (h0), and public key (h) 250| 1| c0.val = ct->c0; 251| 1| h0.val = sk->bin[0]; 252| 1| pk.val = sk->pk; 253| | 254| 1| DEFER_CLEANUP(syndrome_t s = {0}, syndrome_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 255| 1| DMSG(" Computing s.\n"); 256| 1| compute_syndrome(&s, &c0, &h0, &ctx); ------------------ | | 66| 1|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 257| 1| ctx.dup(&s); 258| | 259| | // Reset (init) the error because it is xored in the find_err functions. 260| 1| bike_memset(e, 0, sizeof(*e)); 261| | 262| 6| for(uint32_t iter = 0; iter < MAX_IT; iter++) { ------------------ | | 53| 6|# define MAX_IT 5 ------------------ | Branch (262:26): [True: 5, False: 1] ------------------ 263| 5| const uint8_t threshold = get_threshold(&s); ------------------ | | 141| 5|#define get_threshold RENAME_FUNC_NAME(get_threshold) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 264| | 265| 5| DMSG(" Iteration: %d\n", iter); 266| 5| DMSG(" Weight of e: %lu\n", 267| 5| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 268| 5| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 269| | 270| 5| find_err1(e, &black_e, &gray_e, &s, sk->wlist, threshold, &ctx); 271| 5| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 5|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 272| 5|#if defined(BGF_DECODER) 273| 5| if(iter >= 1) { ------------------ | Branch (273:8): [True: 4, False: 1] ------------------ 274| 4| continue; 275| 4| } 276| 1|#endif 277| 1| DMSG(" Weight of e: %lu\n", 278| 1| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 279| 1| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 280| | 281| 1| find_err2(e, &black_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 44| 1|# define D 103 ------------------ 282| 1| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 1|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 283| | 284| 1| DMSG(" Weight of e: %lu\n", 285| 1| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 286| 1| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 287| | 288| 1| find_err2(e, &gray_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 44| 1|# define D 103 ------------------ 289| 1| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 1|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 1| } 291| 1|} decode.c:OQS_KEM_bike_l3_get_threshold: 103| 5|{ 104| 5| bike_static_assert(sizeof(*s) >= sizeof(r_t), syndrome_is_large_enough); ------------------ | | 33| 5| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 105| | 106| 5| const uint64_t syndrome_weight = r_bits_vector_weight((const r_t *)s->qw); ------------------ | | 78| 5|#define r_bits_vector_weight RENAME_FUNC_NAME(r_bits_vector_weight) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 107| | 108| | // The threshold coefficients are defined in the spec as floating point values. 109| | // Since we want to avoid floating point operations for constant-timeness, 110| | // we use integer arithmetic to compute the threshold. 111| | // For example, in the case of Level-1 parameters, instead of having: 112| | // T0 = 13.530 and T1 = 0.0069722, 113| | // we multipy the values by 10^8 and work with integers: 114| | // T0' = 1353000000 and T1' = 697220. 115| | // Then, instead of computing the threshold by: 116| | // T0 + T1*S, 117| | // we compute: 118| | // (T0' + T1'*S)/10^8, 119| | // where S is the syndrome weight. Additionally, instead of dividing by 10^8, 120| | // we compute the result by a multiplication and a right shift (both 121| | // constant-time operations), as described in: 122| | // https://dl.acm.org/doi/pdf/10.1145/178243.178249 123| 5| uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 47| 5|# define THRESHOLD_COEFF0 1525880000ULL ------------------ uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 48| 5|# define THRESHOLD_COEFF1 526500ULL ------------------ 124| 5| MUL64HIGH(thr, thr, THRESHOLD_MUL_CONST); ------------------ | | 93| 5| do { \ | | 94| 5| uint64_t a_lo, a_hi, b_lo, b_hi; \ | | 95| 5| a_lo = a & 0xffffffff; \ | | 96| 5| b_lo = b & 0xffffffff; \ | | 97| 5| a_hi = a >> 32; \ | | 98| 5| b_hi = b >> 32; \ | | 99| 5| c = a_hi*b_hi + ((a_hi*b_lo + a_lo*b_hi) >> 32); \ | | 100| 5| } while(0) | | ------------------ | | | Branch (100:11): [Folded, False: 5] | | ------------------ ------------------ 125| 5| thr >>= THRESHOLD_SHR_CONST; ------------------ | | 50| 5|# define THRESHOLD_SHR_CONST 26 ------------------ 126| | 127| 5| const uint32_t mask = secure_l32_mask((uint32_t)thr, THRESHOLD_MIN); ------------------ | | 51| 5|# define THRESHOLD_MIN 52 ------------------ 128| 5| thr = (u32_barrier(mask) & thr) | (u32_barrier(~mask) & THRESHOLD_MIN); ------------------ | | 51| 5|# define THRESHOLD_MIN 52 ------------------ 129| | 130| 5| DMSG(" Threshold: %d\n", thr); 131| 5| return thr; 132| 5|} OQS_KEM_bike_l5_compute_syndrome: 60| 8|{ 61| 8| DEFER_CLEANUP(pad_r_t pad_s, pad_r_cleanup); ------------------ | | 16| 8| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 62| | 63| 8| gf2x_mod_mul(&pad_s, c0, h0); ------------------ | | 60| 8|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 8|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 8|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 8|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 64| | 65| 8| bike_memcpy((uint8_t *)syndrome->qw, pad_s.val.raw, R_BYTES); ------------------ | | 81| 8|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 8|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 66| 8| ctx->dup(syndrome); 67| 8|} OQS_KEM_bike_l5_recompute_syndrome: 75| 7|{ 76| 7| DEFER_CLEANUP(pad_r_t tmp_c0, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 77| 7| DEFER_CLEANUP(pad_r_t e0 = {0}, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 78| 7| DEFER_CLEANUP(pad_r_t e1 = {0}, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 79| | 80| 7| e0.val = e->val[0]; 81| 7| e1.val = e->val[1]; 82| | 83| | // tmp_c0 = pk * e1 + c0 + e0 84| 7| gf2x_mod_mul(&tmp_c0, &e1, pk); ------------------ | | 60| 7|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 7| gf2x_mod_add(&tmp_c0, &tmp_c0, c0); ------------------ | | 123| 7|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 7| gf2x_mod_add(&tmp_c0, &tmp_c0, &e0); ------------------ | | 123| 7|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 87| | 88| | // Recompute the syndrome using the updated ciphertext 89| 7| compute_syndrome(syndrome, &tmp_c0, h0, ctx); ------------------ | | 66| 7|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 90| 7|} OQS_KEM_bike_l5_decode: 237| 1|{ 238| | // Initialize the decode methods struct 239| 1| decode_ctx ctx; 240| 1| decode_ctx_init(&ctx); ------------------ | | 94| 1|#define decode_ctx_init RENAME_FUNC_NAME(decode_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| | 242| 1| DEFER_CLEANUP(e_t black_e = {0}, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 243| 1| DEFER_CLEANUP(e_t gray_e = {0}, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 244| | 245| 1| DEFER_CLEANUP(pad_r_t c0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 246| 1| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 247| 1| pad_r_t pk = {0}; 248| | 249| | // Pad ciphertext (c0), secret key (h0), and public key (h) 250| 1| c0.val = ct->c0; 251| 1| h0.val = sk->bin[0]; 252| 1| pk.val = sk->pk; 253| | 254| 1| DEFER_CLEANUP(syndrome_t s = {0}, syndrome_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 255| 1| DMSG(" Computing s.\n"); 256| 1| compute_syndrome(&s, &c0, &h0, &ctx); ------------------ | | 66| 1|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 257| 1| ctx.dup(&s); 258| | 259| | // Reset (init) the error because it is xored in the find_err functions. 260| 1| bike_memset(e, 0, sizeof(*e)); 261| | 262| 6| for(uint32_t iter = 0; iter < MAX_IT; iter++) { ------------------ | | 53| 6|# define MAX_IT 5 ------------------ | Branch (262:26): [True: 5, False: 1] ------------------ 263| 5| const uint8_t threshold = get_threshold(&s); ------------------ | | 141| 5|#define get_threshold RENAME_FUNC_NAME(get_threshold) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 264| | 265| 5| DMSG(" Iteration: %d\n", iter); 266| 5| DMSG(" Weight of e: %lu\n", 267| 5| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 268| 5| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 269| | 270| 5| find_err1(e, &black_e, &gray_e, &s, sk->wlist, threshold, &ctx); 271| 5| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 5|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 272| 5|#if defined(BGF_DECODER) 273| 5| if(iter >= 1) { ------------------ | Branch (273:8): [True: 4, False: 1] ------------------ 274| 4| continue; 275| 4| } 276| 1|#endif 277| 1| DMSG(" Weight of e: %lu\n", 278| 1| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 279| 1| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 280| | 281| 1| find_err2(e, &black_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 60| 1|# define D 137 ------------------ 282| 1| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 1|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 283| | 284| 1| DMSG(" Weight of e: %lu\n", 285| 1| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 286| 1| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 287| | 288| 1| find_err2(e, &gray_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 60| 1|# define D 137 ------------------ 289| 1| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 1|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 1| } 291| 1|} decode.c:OQS_KEM_bike_l5_get_threshold: 103| 5|{ 104| 5| bike_static_assert(sizeof(*s) >= sizeof(r_t), syndrome_is_large_enough); ------------------ | | 33| 5| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 105| | 106| 5| const uint64_t syndrome_weight = r_bits_vector_weight((const r_t *)s->qw); ------------------ | | 78| 5|#define r_bits_vector_weight RENAME_FUNC_NAME(r_bits_vector_weight) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 107| | 108| | // The threshold coefficients are defined in the spec as floating point values. 109| | // Since we want to avoid floating point operations for constant-timeness, 110| | // we use integer arithmetic to compute the threshold. 111| | // For example, in the case of Level-1 parameters, instead of having: 112| | // T0 = 13.530 and T1 = 0.0069722, 113| | // we multipy the values by 10^8 and work with integers: 114| | // T0' = 1353000000 and T1' = 697220. 115| | // Then, instead of computing the threshold by: 116| | // T0 + T1*S, 117| | // we compute: 118| | // (T0' + T1'*S)/10^8, 119| | // where S is the syndrome weight. Additionally, instead of dividing by 10^8, 120| | // we compute the result by a multiplication and a right shift (both 121| | // constant-time operations), as described in: 122| | // https://dl.acm.org/doi/pdf/10.1145/178243.178249 123| 5| uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 63| 5|# define THRESHOLD_COEFF0 1787850000ULL ------------------ uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 64| 5|# define THRESHOLD_COEFF1 402312ULL ------------------ 124| 5| MUL64HIGH(thr, thr, THRESHOLD_MUL_CONST); ------------------ | | 93| 5| do { \ | | 94| 5| uint64_t a_lo, a_hi, b_lo, b_hi; \ | | 95| 5| a_lo = a & 0xffffffff; \ | | 96| 5| b_lo = b & 0xffffffff; \ | | 97| 5| a_hi = a >> 32; \ | | 98| 5| b_hi = b >> 32; \ | | 99| 5| c = a_hi*b_hi + ((a_hi*b_lo + a_lo*b_hi) >> 32); \ | | 100| 5| } while(0) | | ------------------ | | | Branch (100:11): [Folded, False: 5] | | ------------------ ------------------ 125| 5| thr >>= THRESHOLD_SHR_CONST; ------------------ | | 66| 5|# define THRESHOLD_SHR_CONST 26 ------------------ 126| | 127| 5| const uint32_t mask = secure_l32_mask((uint32_t)thr, THRESHOLD_MIN); ------------------ | | 67| 5|# define THRESHOLD_MIN 69 ------------------ 128| 5| thr = (u32_barrier(mask) & thr) | (u32_barrier(~mask) & THRESHOLD_MIN); ------------------ | | 67| 5|# define THRESHOLD_MIN 69 ------------------ 129| | 130| 5| DMSG(" Threshold: %d\n", thr); 131| 5| return thr; 132| 5|} OQS_KEM_bike_l1_rotate_right_avx2: 99| 4.97k|{ 100| | // 1) Rotate in granularity of 256 bits blocks, using YMMs 101| 4.97k| rotate256_big(out, in, (bitscount / BITS_IN_YMM)); ------------------ | | 51| 4.97k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 4.97k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 102| | // 2) Rotate in smaller granularity (less than 256 bits), using YMMs 103| 4.97k| rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 79| 4.97k|#define rotate256_small RENAME_FUNC_NAME(rotate256_small) | | ------------------ | | | | 44| 4.97k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 4.97k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 4.97k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 51| 4.97k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 4.97k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 104| 4.97k|} OQS_KEM_bike_l1_dup_avx2: 112| 45|{ 113| 45| s->qw[R_QWORDS - 1] = ------------------ | | 82| 45|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 45|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 114| 45| (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 92| 45|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 23| 45|# define R_BITS 12323 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 45|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 45|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 82| 45|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 45|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 94| 45|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 45|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 45|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 115| | 116| 17.3k| for(size_t i = 0; i < (2 * R_QWORDS) - 1; i++) { ------------------ | | 82| 17.3k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 17.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (116:21): [True: 17.3k, False: 45] ------------------ 117| 17.3k| s->qw[R_QWORDS + i] = ------------------ | | 82| 17.3k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 17.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 118| 17.3k| (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 93| 17.3k|#define LAST_R_QWORD_TRAIL (64 - LAST_R_QWORD_LEAD) | | ------------------ | | | | 92| 17.3k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 23| 17.3k|# define R_BITS 12323 | | | | ------------------ | | | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 43| 17.3k|#define MASK(len) (BIT(len) - 1) | | | | | | ------------------ | | | | | | | | 42| 17.3k|#define BIT(len) (1ULL << (len)) | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 92| 17.3k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 23| 17.3k|# define R_BITS 12323 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 17.3k|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 17.3k|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 119| 17.3k| } 120| 45|} OQS_KEM_bike_l1_bit_sliced_adder_avx2: 126| 5.12k|{ 127| | // From cache-memory perspective this loop should be the outside loop 128| 32.7k| for(size_t j = 0; j < num_of_slices; j++) { ------------------ | Branch (128:21): [True: 27.5k, False: 5.12k] ------------------ 129| 5.35M| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 5.35M|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 5.35M|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (129:23): [True: 5.32M, False: 27.5k] ------------------ 130| 5.32M| const uint64_t carry = (upc->slice[j].u.qw[i] & rotated_syndrome->qw[i]); 131| 5.32M| upc->slice[j].u.qw[i] ^= rotated_syndrome->qw[i]; 132| 5.32M| rotated_syndrome->qw[i] = carry; 133| 5.32M| } 134| 27.5k| } 135| 5.12k|} OQS_KEM_bike_l1_bit_slice_full_subtract_avx2: 138| 70|{ 139| | // Borrow 140| 70| uint64_t br[R_QWORDS] = {0}; 141| | 142| 630| for(size_t j = 0; j < SLICES; j++) { ------------------ | | 116| 630|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 630| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 630] | | | | ------------------ | | | | 78| 630| ? 0 \ | | | | 79| 630| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 630] | | | | ------------------ | | | | 80| 630| ? 1 \ | | | | 81| 630| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 630] | | | | ------------------ | | | | 82| 630| ? 2 \ | | | | 83| 630| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 630] | | | | ------------------ | | | | 84| 630| ? 3 \ | | | | 85| 630| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 630] | | | | ------------------ | | | | 86| 630| ? 4 \ | | | | 87| 630| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 630] | | | | ------------------ | | | | 88| 630| ? 5 \ | | | | 89| 630| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 630] | | | | ------------------ | | | | 90| 630| ? 6 \ | | | | 91| 630| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [True: 630, Folded] | | | | ------------------ | | | | 92| 630| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 0, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (142:21): [True: 560, False: 70] ------------------ 143| | 144| 560| const uint64_t lsb_mask = 0 - (val & 0x1); 145| 560| val >>= 1; 146| | 147| | // Perform a - b with c as the input/output carry 148| | // br = 0 0 0 0 1 1 1 1 149| | // a = 0 0 1 1 0 0 1 1 150| | // b = 0 1 0 1 0 1 0 1 151| | // ------------------- 152| | // o = 0 1 1 0 0 1 1 1 153| | // c = 0 1 0 0 1 1 0 1 154| | // 155| | // o = a^b^c 156| | // _ __ _ _ _ _ _ 157| | // br = abc + abc + abc + abc = abc + ((a+b))c 158| | 159| 108k| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 108k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 108k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (159:23): [True: 108k, False: 560] ------------------ 160| 108k| const uint64_t a = upc->slice[j].u.qw[i]; 161| 108k| const uint64_t b = lsb_mask; 162| 108k| const uint64_t tmp = ((~a) & b & (~br[i])) | ((((~a) | b) & br[i])); 163| 108k| upc->slice[j].u.qw[i] = a ^ b ^ br[i]; 164| 108k| br[i] = tmp; 165| 108k| } 166| 560| } 167| 70|} decode_avx2.c:rotate256_big: 32| 8.33k|{ 33| | // For preventing overflows (comparison in bytes) 34| 8.33k| bike_static_assert(sizeof(*out) > ------------------ | | 33| 8.33k| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 35| 8.33k| (BYTES_IN_YMM * (R_YMM + (2 * R_YMM_HALF_LOG2))), 36| 8.33k| rotr_big_err); 37| | 38| 8.33k| *out = *in; 39| | 40| 63.5k| for(uint32_t idx = R_YMM_HALF_LOG2; idx >= 1; idx >>= 1) { ------------------ | | 28| 8.33k|#define R_YMM_HALF_LOG2 UPTOPOW2(R_YMM / 2) | | ------------------ | | | | 73| 8.33k|#define UPTOPOW2(v) (UPTOPOW2_5(v) + 1) | | | | ------------------ | | | | | | 71| 8.33k|#define UPTOPOW2_5(v) (UPTOPOW2_4(v) | (UPTOPOW2_4(v) >> 16)) | | | | | | ------------------ | | | | | | | | 70| 8.33k|#define UPTOPOW2_4(v) (UPTOPOW2_3(v) | (UPTOPOW2_3(v) >> 8)) | | | | | | | | ------------------ | | | | | | | | | | 69| 8.33k|#define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | | | #define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | | | #define UPTOPOW2_4(v) (UPTOPOW2_3(v) | (UPTOPOW2_3(v) >> 8)) | | | | | | | | ------------------ | | | | | | | | | | 69| 8.33k|#define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | | | #define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | ------------------ | | | | | | #define UPTOPOW2_5(v) (UPTOPOW2_4(v) | (UPTOPOW2_4(v) >> 16)) | | | | | | ------------------ | | | | | | | | 70| 8.33k|#define UPTOPOW2_4(v) (UPTOPOW2_3(v) | (UPTOPOW2_3(v) >> 8)) | | | | | | | | ------------------ | | | | | | | | | | 69| 8.33k|#define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | | | #define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | | | #define UPTOPOW2_4(v) (UPTOPOW2_3(v) | (UPTOPOW2_3(v) >> 8)) | | | | | | | | ------------------ | | | | | | | | | | 69| 8.33k|#define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | | | #define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (40:39): [True: 55.2k, False: 8.33k] ------------------ 41| 55.2k| const uint8_t mask = secure_l32_mask(ymm_num, idx); 42| 55.2k| const __m256i blend_mask = SET1_I8(mask); ------------------ | | 68| 55.2k|# define SET1_I8(a) _mm256_set1_epi8(a) ------------------ 43| 55.2k| ymm_num = ymm_num - (idx & mask); 44| | 45| 5.95M| for(size_t i = 0; i < (R_YMM + idx); i++) { ------------------ | | 84| 5.95M|#define R_YMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_YMM) | | ------------------ | | | | 37| 5.95M|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (45:23): [True: 5.89M, False: 55.2k] ------------------ 46| 5.89M| __m256i a = LOAD(&out->qw[4 * (i + idx)]); ------------------ | | 28| 5.89M|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 47| 5.89M| __m256i b = LOAD(&out->qw[4 * i]); ------------------ | | 28| 5.89M|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 48| 5.89M| b = BLENDV_I8(b, a, blend_mask); ------------------ | | 92| 5.89M|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 49| 5.89M| STORE(&out->qw[4 * i], b); ------------------ | | 29| 5.89M|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 50| 5.89M| } 51| 55.2k| } 52| 8.33k|} decode_avx2.c:OQS_KEM_bike_l1_rotate256_small: 56| 4.97k|{ 57| 4.97k| __m256i carry_in = SET_ZERO; ------------------ | | 72| 4.97k|# define SET_ZERO _mm256_setzero_si256() ------------------ 58| 4.97k| const int count64 = (int)count & 0x3f; 59| 4.97k| const uint64_t count_mask = (count >> 5) & 0xe; 60| | 61| 4.97k| __m256i idx = SET_I32(7, 6, 5, 4, 3, 2, 1, 0); ------------------ | | 66| 4.97k|# define SET_I32(...) _mm256_set_epi32(__VA_ARGS__) ------------------ 62| 4.97k| const __m256i zero_mask = SET_I64(-1, -1, -1, 0); ------------------ | | 67| 4.97k|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 63| 4.97k| const __m256i count_vet = SET1_I8(count_mask); ------------------ | | 68| 4.97k|# define SET1_I8(a) _mm256_set1_epi8(a) ------------------ 64| | 65| 4.97k| ALIGN(ALIGN_BYTES) ------------------ | | 18| 4.97k|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 66| 4.97k| const uint8_t zero_mask2_buf[] = { 67| 4.97k| 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x84, 0x84, 0x84, 68| 4.97k| 0x84, 0x84, 0x84, 0x84, 0x84, 0x82, 0x82, 0x82, 0x82, 0x82, 0x82, 69| 4.97k| 0x82, 0x82, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80}; 70| 4.97k| __m256i zero_mask2 = LOAD(zero_mask2_buf); ------------------ | | 28| 4.97k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| | 72| 4.97k| zero_mask2 = SUB_I8(zero_mask2, count_vet); ------------------ | | 75| 4.97k|# define SUB_I8(a, b) _mm256_sub_epi8(a, b) ------------------ 73| 4.97k| idx = ADD_I8(idx, count_vet); ------------------ | | 74| 4.97k|# define ADD_I8(a, b) _mm256_add_epi8(a, b) ------------------ 74| | 75| 253k| for(int i = R_YMM; i >= 0; i--) { ------------------ | | 84| 4.97k|#define R_YMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_YMM) | | ------------------ | | | | 37| 4.97k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (75:22): [True: 248k, False: 4.97k] ------------------ 76| | // Load the next 256 bits 77| 248k| __m256i in256 = LOAD(&in->qw[4 * i]); ------------------ | | 28| 248k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 78| | 79| | // Rotate the current and previous 256 registers so that their quadwords 80| | // would be in the right positions. 81| 248k| __m256i carry_out = PERMVAR_I32(in256, idx); ------------------ | | 93| 248k|# define PERMVAR_I32(a, idx) _mm256_permutevar8x32_epi32(a, idx) ------------------ 82| 248k| in256 = BLENDV_I8(carry_in, carry_out, zero_mask2); ------------------ | | 92| 248k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 83| | 84| | // Shift less than 64 (quadwords internal) 85| 248k| __m256i inner_carry = BLENDV_I8(carry_in, in256, zero_mask); ------------------ | | 92| 248k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 86| 248k| inner_carry = PERM_I64(inner_carry, 0x39); ------------------ | | 94| 248k|# define PERM_I64(a, imm) _mm256_permute4x64_epi64(a, imm) ------------------ 87| 248k| const __m256i out256 = 88| 248k| SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 32| 248k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 31| 248k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 89| | 90| | // Store the rotated value 91| 248k| STORE(&out->qw[4 * i], out256); ------------------ | | 29| 248k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 92| 248k| carry_in = carry_out; 93| 248k| } 94| 4.97k|} OQS_KEM_bike_l3_rotate_right_avx2: 99| 1.44k|{ 100| | // 1) Rotate in granularity of 256 bits blocks, using YMMs 101| 1.44k| rotate256_big(out, in, (bitscount / BITS_IN_YMM)); ------------------ | | 51| 1.44k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 1.44k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 102| | // 2) Rotate in smaller granularity (less than 256 bits), using YMMs 103| 1.44k| rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 79| 1.44k|#define rotate256_small RENAME_FUNC_NAME(rotate256_small) | | ------------------ | | | | 44| 1.44k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1.44k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1.44k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 51| 1.44k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 1.44k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 104| 1.44k|} OQS_KEM_bike_l3_dup_avx2: 112| 9|{ 113| 9| s->qw[R_QWORDS - 1] = ------------------ | | 82| 9|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 9|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 114| 9| (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 92| 9|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 9|# define R_BITS 24659 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 9|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 9|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 82| 9|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 9|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 94| 9|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 9|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 9|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 115| | 116| 6.94k| for(size_t i = 0; i < (2 * R_QWORDS) - 1; i++) { ------------------ | | 82| 6.94k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 6.94k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (116:21): [True: 6.93k, False: 9] ------------------ 117| 6.93k| s->qw[R_QWORDS + i] = ------------------ | | 82| 6.93k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 6.93k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 118| 6.93k| (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 93| 6.93k|#define LAST_R_QWORD_TRAIL (64 - LAST_R_QWORD_LEAD) | | ------------------ | | | | 92| 6.93k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 43| 6.93k|# define R_BITS 24659 | | | | ------------------ | | | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 43| 6.93k|#define MASK(len) (BIT(len) - 1) | | | | | | ------------------ | | | | | | | | 42| 6.93k|#define BIT(len) (1ULL << (len)) | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 92| 6.93k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 6.93k|# define R_BITS 24659 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 6.93k|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 6.93k|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 119| 6.93k| } 120| 9|} OQS_KEM_bike_l3_bit_sliced_adder_avx2: 126| 1.47k|{ 127| | // From cache-memory perspective this loop should be the outside loop 128| 10.1k| for(size_t j = 0; j < num_of_slices; j++) { ------------------ | Branch (128:21): [True: 8.65k, False: 1.47k] ------------------ 129| 3.34M| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 3.34M|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 3.34M|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (129:23): [True: 3.34M, False: 8.65k] ------------------ 130| 3.34M| const uint64_t carry = (upc->slice[j].u.qw[i] & rotated_syndrome->qw[i]); 131| 3.34M| upc->slice[j].u.qw[i] ^= rotated_syndrome->qw[i]; 132| 3.34M| rotated_syndrome->qw[i] = carry; 133| 3.34M| } 134| 8.65k| } 135| 1.47k|} OQS_KEM_bike_l3_bit_slice_full_subtract_avx2: 138| 14|{ 139| | // Borrow 140| 14| uint64_t br[R_QWORDS] = {0}; 141| | 142| 126| for(size_t j = 0; j < SLICES; j++) { ------------------ | | 116| 126|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 126| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 126] | | | | ------------------ | | | | 78| 126| ? 0 \ | | | | 79| 126| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 126] | | | | ------------------ | | | | 80| 126| ? 1 \ | | | | 81| 126| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 126] | | | | ------------------ | | | | 82| 126| ? 2 \ | | | | 83| 126| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 126] | | | | ------------------ | | | | 84| 126| ? 3 \ | | | | 85| 126| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 126] | | | | ------------------ | | | | 86| 126| ? 4 \ | | | | 87| 126| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 126] | | | | ------------------ | | | | 88| 126| ? 5 \ | | | | 89| 126| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 126] | | | | ------------------ | | | | 90| 126| ? 6 \ | | | | 91| 126| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [True: 126, Folded] | | | | ------------------ | | | | 92| 126| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 0, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (142:21): [True: 112, False: 14] ------------------ 143| | 144| 112| const uint64_t lsb_mask = 0 - (val & 0x1); 145| 112| val >>= 1; 146| | 147| | // Perform a - b with c as the input/output carry 148| | // br = 0 0 0 0 1 1 1 1 149| | // a = 0 0 1 1 0 0 1 1 150| | // b = 0 1 0 1 0 1 0 1 151| | // ------------------- 152| | // o = 0 1 1 0 0 1 1 1 153| | // c = 0 1 0 0 1 1 0 1 154| | // 155| | // o = a^b^c 156| | // _ __ _ _ _ _ _ 157| | // br = abc + abc + abc + abc = abc + ((a+b))c 158| | 159| 43.3k| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 43.3k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 43.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (159:23): [True: 43.2k, False: 112] ------------------ 160| 43.2k| const uint64_t a = upc->slice[j].u.qw[i]; 161| 43.2k| const uint64_t b = lsb_mask; 162| 43.2k| const uint64_t tmp = ((~a) & b & (~br[i])) | ((((~a) | b) & br[i])); 163| 43.2k| upc->slice[j].u.qw[i] = a ^ b ^ br[i]; 164| 43.2k| br[i] = tmp; 165| 43.2k| } 166| 112| } 167| 14|} decode_avx2.c:OQS_KEM_bike_l3_rotate256_small: 56| 1.44k|{ 57| 1.44k| __m256i carry_in = SET_ZERO; ------------------ | | 72| 1.44k|# define SET_ZERO _mm256_setzero_si256() ------------------ 58| 1.44k| const int count64 = (int)count & 0x3f; 59| 1.44k| const uint64_t count_mask = (count >> 5) & 0xe; 60| | 61| 1.44k| __m256i idx = SET_I32(7, 6, 5, 4, 3, 2, 1, 0); ------------------ | | 66| 1.44k|# define SET_I32(...) _mm256_set_epi32(__VA_ARGS__) ------------------ 62| 1.44k| const __m256i zero_mask = SET_I64(-1, -1, -1, 0); ------------------ | | 67| 1.44k|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 63| 1.44k| const __m256i count_vet = SET1_I8(count_mask); ------------------ | | 68| 1.44k|# define SET1_I8(a) _mm256_set1_epi8(a) ------------------ 64| | 65| 1.44k| ALIGN(ALIGN_BYTES) ------------------ | | 18| 1.44k|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 66| 1.44k| const uint8_t zero_mask2_buf[] = { 67| 1.44k| 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x84, 0x84, 0x84, 68| 1.44k| 0x84, 0x84, 0x84, 0x84, 0x84, 0x82, 0x82, 0x82, 0x82, 0x82, 0x82, 69| 1.44k| 0x82, 0x82, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80}; 70| 1.44k| __m256i zero_mask2 = LOAD(zero_mask2_buf); ------------------ | | 28| 1.44k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| | 72| 1.44k| zero_mask2 = SUB_I8(zero_mask2, count_vet); ------------------ | | 75| 1.44k|# define SUB_I8(a, b) _mm256_sub_epi8(a, b) ------------------ 73| 1.44k| idx = ADD_I8(idx, count_vet); ------------------ | | 74| 1.44k|# define ADD_I8(a, b) _mm256_add_epi8(a, b) ------------------ 74| | 75| 142k| for(int i = R_YMM; i >= 0; i--) { ------------------ | | 84| 1.44k|#define R_YMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_YMM) | | ------------------ | | | | 37| 1.44k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (75:22): [True: 141k, False: 1.44k] ------------------ 76| | // Load the next 256 bits 77| 141k| __m256i in256 = LOAD(&in->qw[4 * i]); ------------------ | | 28| 141k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 78| | 79| | // Rotate the current and previous 256 registers so that their quadwords 80| | // would be in the right positions. 81| 141k| __m256i carry_out = PERMVAR_I32(in256, idx); ------------------ | | 93| 141k|# define PERMVAR_I32(a, idx) _mm256_permutevar8x32_epi32(a, idx) ------------------ 82| 141k| in256 = BLENDV_I8(carry_in, carry_out, zero_mask2); ------------------ | | 92| 141k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 83| | 84| | // Shift less than 64 (quadwords internal) 85| 141k| __m256i inner_carry = BLENDV_I8(carry_in, in256, zero_mask); ------------------ | | 92| 141k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 86| 141k| inner_carry = PERM_I64(inner_carry, 0x39); ------------------ | | 94| 141k|# define PERM_I64(a, imm) _mm256_permute4x64_epi64(a, imm) ------------------ 87| 141k| const __m256i out256 = 88| 141k| SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 32| 141k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 31| 141k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 89| | 90| | // Store the rotated value 91| 141k| STORE(&out->qw[4 * i], out256); ------------------ | | 29| 141k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 92| 141k| carry_in = carry_out; 93| 141k| } 94| 1.44k|} OQS_KEM_bike_l5_rotate_right_avx2: 99| 1.91k|{ 100| | // 1) Rotate in granularity of 256 bits blocks, using YMMs 101| 1.91k| rotate256_big(out, in, (bitscount / BITS_IN_YMM)); ------------------ | | 51| 1.91k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 1.91k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 102| | // 2) Rotate in smaller granularity (less than 256 bits), using YMMs 103| 1.91k| rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 79| 1.91k|#define rotate256_small RENAME_FUNC_NAME(rotate256_small) | | ------------------ | | | | 44| 1.91k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1.91k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1.91k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 51| 1.91k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 1.91k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 104| 1.91k|} OQS_KEM_bike_l5_dup_avx2: 112| 9|{ 113| 9| s->qw[R_QWORDS - 1] = ------------------ | | 82| 9|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 9|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 114| 9| (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 92| 9|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 59| 9|# define R_BITS 40973 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 9|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 9|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 82| 9|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 9|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 94| 9|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 9|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 9|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 115| | 116| 11.5k| for(size_t i = 0; i < (2 * R_QWORDS) - 1; i++) { ------------------ | | 82| 11.5k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 11.5k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (116:21): [True: 11.5k, False: 9] ------------------ 117| 11.5k| s->qw[R_QWORDS + i] = ------------------ | | 82| 11.5k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 11.5k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 118| 11.5k| (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 93| 11.5k|#define LAST_R_QWORD_TRAIL (64 - LAST_R_QWORD_LEAD) | | ------------------ | | | | 92| 11.5k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 59| 11.5k|# define R_BITS 40973 | | | | ------------------ | | | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 43| 11.5k|#define MASK(len) (BIT(len) - 1) | | | | | | ------------------ | | | | | | | | 42| 11.5k|#define BIT(len) (1ULL << (len)) | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 92| 11.5k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 59| 11.5k|# define R_BITS 40973 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 11.5k|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 11.5k|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 119| 11.5k| } 120| 9|} OQS_KEM_bike_l5_bit_sliced_adder_avx2: 126| 1.94k|{ 127| | // From cache-memory perspective this loop should be the outside loop 128| 14.1k| for(size_t j = 0; j < num_of_slices; j++) { ------------------ | Branch (128:21): [True: 12.1k, False: 1.94k] ------------------ 129| 7.80M| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 7.80M|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 7.80M|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (129:23): [True: 7.79M, False: 12.1k] ------------------ 130| 7.79M| const uint64_t carry = (upc->slice[j].u.qw[i] & rotated_syndrome->qw[i]); 131| 7.79M| upc->slice[j].u.qw[i] ^= rotated_syndrome->qw[i]; 132| 7.79M| rotated_syndrome->qw[i] = carry; 133| 7.79M| } 134| 12.1k| } 135| 1.94k|} OQS_KEM_bike_l5_bit_slice_full_subtract_avx2: 138| 14|{ 139| | // Borrow 140| 14| uint64_t br[R_QWORDS] = {0}; 141| | 142| 140| for(size_t j = 0; j < SLICES; j++) { ------------------ | | 116| 140|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 140| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 140] | | | | ------------------ | | | | 78| 140| ? 0 \ | | | | 79| 140| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 140] | | | | ------------------ | | | | 80| 140| ? 1 \ | | | | 81| 140| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 140] | | | | ------------------ | | | | 82| 140| ? 2 \ | | | | 83| 140| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 140] | | | | ------------------ | | | | 84| 140| ? 3 \ | | | | 85| 140| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 140] | | | | ------------------ | | | | 86| 140| ? 4 \ | | | | 87| 140| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 140] | | | | ------------------ | | | | 88| 140| ? 5 \ | | | | 89| 140| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 140] | | | | ------------------ | | | | 90| 140| ? 6 \ | | | | 91| 140| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [Folded, False: 140] | | | | ------------------ | | | | 92| 140| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 140, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (142:21): [True: 126, False: 14] ------------------ 143| | 144| 126| const uint64_t lsb_mask = 0 - (val & 0x1); 145| 126| val >>= 1; 146| | 147| | // Perform a - b with c as the input/output carry 148| | // br = 0 0 0 0 1 1 1 1 149| | // a = 0 0 1 1 0 0 1 1 150| | // b = 0 1 0 1 0 1 0 1 151| | // ------------------- 152| | // o = 0 1 1 0 0 1 1 1 153| | // c = 0 1 0 0 1 1 0 1 154| | // 155| | // o = a^b^c 156| | // _ __ _ _ _ _ _ 157| | // br = abc + abc + abc + abc = abc + ((a+b))c 158| | 159| 80.8k| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 80.8k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 80.8k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (159:23): [True: 80.7k, False: 126] ------------------ 160| 80.7k| const uint64_t a = upc->slice[j].u.qw[i]; 161| 80.7k| const uint64_t b = lsb_mask; 162| 80.7k| const uint64_t tmp = ((~a) & b & (~br[i])) | ((((~a) | b) & br[i])); 163| 80.7k| upc->slice[j].u.qw[i] = a ^ b ^ br[i]; 164| 80.7k| br[i] = tmp; 165| 80.7k| } 166| 126| } 167| 14|} decode_avx2.c:OQS_KEM_bike_l5_rotate256_small: 56| 1.91k|{ 57| 1.91k| __m256i carry_in = SET_ZERO; ------------------ | | 72| 1.91k|# define SET_ZERO _mm256_setzero_si256() ------------------ 58| 1.91k| const int count64 = (int)count & 0x3f; 59| 1.91k| const uint64_t count_mask = (count >> 5) & 0xe; 60| | 61| 1.91k| __m256i idx = SET_I32(7, 6, 5, 4, 3, 2, 1, 0); ------------------ | | 66| 1.91k|# define SET_I32(...) _mm256_set_epi32(__VA_ARGS__) ------------------ 62| 1.91k| const __m256i zero_mask = SET_I64(-1, -1, -1, 0); ------------------ | | 67| 1.91k|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 63| 1.91k| const __m256i count_vet = SET1_I8(count_mask); ------------------ | | 68| 1.91k|# define SET1_I8(a) _mm256_set1_epi8(a) ------------------ 64| | 65| 1.91k| ALIGN(ALIGN_BYTES) ------------------ | | 18| 1.91k|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 66| 1.91k| const uint8_t zero_mask2_buf[] = { 67| 1.91k| 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x84, 0x84, 0x84, 68| 1.91k| 0x84, 0x84, 0x84, 0x84, 0x84, 0x82, 0x82, 0x82, 0x82, 0x82, 0x82, 69| 1.91k| 0x82, 0x82, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80}; 70| 1.91k| __m256i zero_mask2 = LOAD(zero_mask2_buf); ------------------ | | 28| 1.91k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| | 72| 1.91k| zero_mask2 = SUB_I8(zero_mask2, count_vet); ------------------ | | 75| 1.91k|# define SUB_I8(a, b) _mm256_sub_epi8(a, b) ------------------ 73| 1.91k| idx = ADD_I8(idx, count_vet); ------------------ | | 74| 1.91k|# define ADD_I8(a, b) _mm256_add_epi8(a, b) ------------------ 74| | 75| 312k| for(int i = R_YMM; i >= 0; i--) { ------------------ | | 84| 1.91k|#define R_YMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_YMM) | | ------------------ | | | | 37| 1.91k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (75:22): [True: 310k, False: 1.91k] ------------------ 76| | // Load the next 256 bits 77| 310k| __m256i in256 = LOAD(&in->qw[4 * i]); ------------------ | | 28| 310k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 78| | 79| | // Rotate the current and previous 256 registers so that their quadwords 80| | // would be in the right positions. 81| 310k| __m256i carry_out = PERMVAR_I32(in256, idx); ------------------ | | 93| 310k|# define PERMVAR_I32(a, idx) _mm256_permutevar8x32_epi32(a, idx) ------------------ 82| 310k| in256 = BLENDV_I8(carry_in, carry_out, zero_mask2); ------------------ | | 92| 310k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 83| | 84| | // Shift less than 64 (quadwords internal) 85| 310k| __m256i inner_carry = BLENDV_I8(carry_in, in256, zero_mask); ------------------ | | 92| 310k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 86| 310k| inner_carry = PERM_I64(inner_carry, 0x39); ------------------ | | 94| 310k|# define PERM_I64(a, imm) _mm256_permute4x64_epi64(a, imm) ------------------ 87| 310k| const __m256i out256 = 88| 310k| SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 32| 310k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 31| 310k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 89| | 90| | // Store the rotated value 91| 310k| STORE(&out->qw[4 * i], out256); ------------------ | | 29| 310k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 92| 310k| carry_in = carry_out; 93| 310k| } 94| 1.91k|} decode.c:OQS_KEM_bike_l1_decode_ctx_init: 62| 5|{ 63| 5|#if defined(X86_64) 64| 5|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 65| 5| if(is_avx512_enabled()) { ------------------ | | 98| 5|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (65:6): [True: 0, False: 5] ------------------ 66| 0| ctx->rotate_right = rotate_right_avx512; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx512; ------------------ | | 87| 0|#define rotate_right_avx512 RENAME_FUNC_NAME(rotate_right_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 67| 0| ctx->dup = dup_avx512; ------------------ | | 89| 0|#define dup_avx512 RENAME_FUNC_NAME(dup_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 0| ctx->bit_sliced_adder = bit_sliced_adder_avx512; ------------------ | | 91| 0|#define bit_sliced_adder_avx512 RENAME_FUNC_NAME(bit_sliced_adder_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 69| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx512; ------------------ | | 93| 0|#define bit_slice_full_subtract_avx512 RENAME_FUNC_NAME(bit_slice_full_subtract_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 70| 0| } else 71| 5|#endif 72| 5|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 73| 5| if(is_avx2_enabled()) { ------------------ | | 97| 5|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (73:6): [True: 5, False: 0] ------------------ 74| 5| ctx->rotate_right = rotate_right_avx2; ------------------ | | 77| 5|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx2; ------------------ | | 86| 5|#define rotate_right_avx2 RENAME_FUNC_NAME(rotate_right_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 75| 5| ctx->dup = dup_avx2; ------------------ | | 88| 5|#define dup_avx2 RENAME_FUNC_NAME(dup_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 76| 5| ctx->bit_sliced_adder = bit_sliced_adder_avx2; ------------------ | | 90| 5|#define bit_sliced_adder_avx2 RENAME_FUNC_NAME(bit_sliced_adder_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 77| 5| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx2; ------------------ | | 92| 5|#define bit_slice_full_subtract_avx2 RENAME_FUNC_NAME(bit_slice_full_subtract_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 78| 5| } else 79| 0|#endif 80| 0|#endif 81| 0| { 82| 0| ctx->rotate_right = rotate_right_port; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_port; ------------------ | | 82| 0|#define rotate_right_port RENAME_FUNC_NAME(rotate_right_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 0| ctx->dup = dup_port; ------------------ | | 83| 0|#define dup_port RENAME_FUNC_NAME(dup_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 0| ctx->bit_sliced_adder = bit_sliced_adder_port; ------------------ | | 84| 0|#define bit_sliced_adder_port RENAME_FUNC_NAME(bit_sliced_adder_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_port; ------------------ | | 85| 0|#define bit_slice_full_subtract_port RENAME_FUNC_NAME(bit_slice_full_subtract_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 0| } 87| 5|} decode.c:OQS_KEM_bike_l3_decode_ctx_init: 62| 1|{ 63| 1|#if defined(X86_64) 64| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 65| 1| if(is_avx512_enabled()) { ------------------ | | 98| 1|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (65:6): [True: 0, False: 1] ------------------ 66| 0| ctx->rotate_right = rotate_right_avx512; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx512; ------------------ | | 87| 0|#define rotate_right_avx512 RENAME_FUNC_NAME(rotate_right_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 67| 0| ctx->dup = dup_avx512; ------------------ | | 89| 0|#define dup_avx512 RENAME_FUNC_NAME(dup_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 0| ctx->bit_sliced_adder = bit_sliced_adder_avx512; ------------------ | | 91| 0|#define bit_sliced_adder_avx512 RENAME_FUNC_NAME(bit_sliced_adder_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 69| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx512; ------------------ | | 93| 0|#define bit_slice_full_subtract_avx512 RENAME_FUNC_NAME(bit_slice_full_subtract_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 70| 0| } else 71| 1|#endif 72| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 73| 1| if(is_avx2_enabled()) { ------------------ | | 97| 1|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (73:6): [True: 1, False: 0] ------------------ 74| 1| ctx->rotate_right = rotate_right_avx2; ------------------ | | 77| 1|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx2; ------------------ | | 86| 1|#define rotate_right_avx2 RENAME_FUNC_NAME(rotate_right_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 75| 1| ctx->dup = dup_avx2; ------------------ | | 88| 1|#define dup_avx2 RENAME_FUNC_NAME(dup_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 76| 1| ctx->bit_sliced_adder = bit_sliced_adder_avx2; ------------------ | | 90| 1|#define bit_sliced_adder_avx2 RENAME_FUNC_NAME(bit_sliced_adder_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 77| 1| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx2; ------------------ | | 92| 1|#define bit_slice_full_subtract_avx2 RENAME_FUNC_NAME(bit_slice_full_subtract_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 78| 1| } else 79| 0|#endif 80| 0|#endif 81| 0| { 82| 0| ctx->rotate_right = rotate_right_port; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_port; ------------------ | | 82| 0|#define rotate_right_port RENAME_FUNC_NAME(rotate_right_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 0| ctx->dup = dup_port; ------------------ | | 83| 0|#define dup_port RENAME_FUNC_NAME(dup_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 0| ctx->bit_sliced_adder = bit_sliced_adder_port; ------------------ | | 84| 0|#define bit_sliced_adder_port RENAME_FUNC_NAME(bit_sliced_adder_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_port; ------------------ | | 85| 0|#define bit_slice_full_subtract_port RENAME_FUNC_NAME(bit_slice_full_subtract_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 0| } 87| 1|} decode.c:OQS_KEM_bike_l5_decode_ctx_init: 62| 1|{ 63| 1|#if defined(X86_64) 64| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 65| 1| if(is_avx512_enabled()) { ------------------ | | 98| 1|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (65:6): [True: 0, False: 1] ------------------ 66| 0| ctx->rotate_right = rotate_right_avx512; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx512; ------------------ | | 87| 0|#define rotate_right_avx512 RENAME_FUNC_NAME(rotate_right_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 67| 0| ctx->dup = dup_avx512; ------------------ | | 89| 0|#define dup_avx512 RENAME_FUNC_NAME(dup_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 0| ctx->bit_sliced_adder = bit_sliced_adder_avx512; ------------------ | | 91| 0|#define bit_sliced_adder_avx512 RENAME_FUNC_NAME(bit_sliced_adder_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 69| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx512; ------------------ | | 93| 0|#define bit_slice_full_subtract_avx512 RENAME_FUNC_NAME(bit_slice_full_subtract_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 70| 0| } else 71| 1|#endif 72| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 73| 1| if(is_avx2_enabled()) { ------------------ | | 97| 1|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (73:6): [True: 1, False: 0] ------------------ 74| 1| ctx->rotate_right = rotate_right_avx2; ------------------ | | 77| 1|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx2; ------------------ | | 86| 1|#define rotate_right_avx2 RENAME_FUNC_NAME(rotate_right_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 75| 1| ctx->dup = dup_avx2; ------------------ | | 88| 1|#define dup_avx2 RENAME_FUNC_NAME(dup_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 76| 1| ctx->bit_sliced_adder = bit_sliced_adder_avx2; ------------------ | | 90| 1|#define bit_sliced_adder_avx2 RENAME_FUNC_NAME(bit_sliced_adder_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 77| 1| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx2; ------------------ | | 92| 1|#define bit_slice_full_subtract_avx2 RENAME_FUNC_NAME(bit_slice_full_subtract_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 78| 1| } else 79| 0|#endif 80| 0|#endif 81| 0| { 82| 0| ctx->rotate_right = rotate_right_port; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_port; ------------------ | | 82| 0|#define rotate_right_port RENAME_FUNC_NAME(rotate_right_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 0| ctx->dup = dup_port; ------------------ | | 83| 0|#define dup_port RENAME_FUNC_NAME(dup_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 0| ctx->bit_sliced_adder = bit_sliced_adder_port; ------------------ | | 84| 0|#define bit_sliced_adder_port RENAME_FUNC_NAME(bit_sliced_adder_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_port; ------------------ | | 85| 0|#define bit_slice_full_subtract_port RENAME_FUNC_NAME(bit_slice_full_subtract_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 0| } 87| 1|} kem.c:OQS_KEM_bike_l1_gf2x_mod_add: 15| 5|{ 16| 5| const uint64_t *a_qwords = (const uint64_t *)a; 17| 5| const uint64_t *b_qwords = (const uint64_t *)b; 18| 5| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 1.28k| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 1.28k|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 1.28k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 1.28k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 1.28k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 1.28k|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 1.28k, False: 5] ------------------ 21| 1.28k| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 1.28k| } 23| 5|} kem.c:OQS_KEM_bike_l3_gf2x_mod_add: 15| 1|{ 16| 1| const uint64_t *a_qwords = (const uint64_t *)a; 17| 1| const uint64_t *b_qwords = (const uint64_t *)b; 18| 1| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 513| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 513|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 513|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 513|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 513|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 513|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 512, False: 1] ------------------ 21| 512| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 512| } 23| 1|} kem.c:OQS_KEM_bike_l5_gf2x_mod_add: 15| 1|{ 16| 1| const uint64_t *a_qwords = (const uint64_t *)a; 17| 1| const uint64_t *b_qwords = (const uint64_t *)b; 18| 1| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 1.02k| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 1.02k|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 1.02k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 1.02k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 1.02k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 1.02k|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 1.02k, False: 1] ------------------ 21| 1.02k| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 1.02k| } 23| 1|} decode.c:OQS_KEM_bike_l1_gf2x_mod_add: 15| 70|{ 16| 70| const uint64_t *a_qwords = (const uint64_t *)a; 17| 70| const uint64_t *b_qwords = (const uint64_t *)b; 18| 70| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 17.9k| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 17.9k|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 17.9k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 17.9k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 17.9k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 17.9k|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 17.9k, False: 70] ------------------ 21| 17.9k| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 17.9k| } 23| 70|} decode.c:OQS_KEM_bike_l3_gf2x_mod_add: 15| 14|{ 16| 14| const uint64_t *a_qwords = (const uint64_t *)a; 17| 14| const uint64_t *b_qwords = (const uint64_t *)b; 18| 14| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 7.18k| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 7.18k|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 7.18k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 7.18k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 7.18k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 7.18k|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 7.16k, False: 14] ------------------ 21| 7.16k| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 7.16k| } 23| 14|} decode.c:OQS_KEM_bike_l5_gf2x_mod_add: 15| 14|{ 16| 14| const uint64_t *a_qwords = (const uint64_t *)a; 17| 14| const uint64_t *b_qwords = (const uint64_t *)b; 18| 14| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 14.3k| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 14.3k|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 14.3k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 14.3k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 14.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 14.3k|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 14.3k, False: 14] ------------------ 21| 14.3k| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 14.3k| } 23| 14|} gf2x_inv.c:OQS_KEM_bike_l1_gf2x_ctx_init: 132| 5|{ 133| 5|#if defined(X86_64) 134| 5|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 5| if(is_avx512_enabled()) { ------------------ | | 98| 5|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 5] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 5|#endif 143| 5|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 5| if(is_avx2_enabled()) { ------------------ | | 97| 5|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 5, False: 0] ------------------ 145| 5| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 5|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 5|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 5| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 5|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 5|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 5| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 5|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 5| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 5|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 5| ctx->red = gf2x_red_avx2; ------------------ | | 75| 5|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 5|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 5| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 5|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 5|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 5| if(is_pclmul_enabled()) { ------------------ | | 99| 5|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 5, False: 0] ------------------ 171| 5| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 5|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 5| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 5|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 5| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 5|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 5| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 5|} gf2x_mul.c:OQS_KEM_bike_l1_gf2x_ctx_init: 132| 85|{ 133| 85|#if defined(X86_64) 134| 85|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 85| if(is_avx512_enabled()) { ------------------ | | 98| 85|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 85] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 85|#endif 143| 85|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 85| if(is_avx2_enabled()) { ------------------ | | 97| 85|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 85, False: 0] ------------------ 145| 85| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 85|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 85|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 85| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 85|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 85|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 85| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 85|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 85| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 85|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 85| ctx->red = gf2x_red_avx2; ------------------ | | 75| 85|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 85|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 85| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 85|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 85|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 85| if(is_pclmul_enabled()) { ------------------ | | 99| 85|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 85, False: 0] ------------------ 171| 85| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 85|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 85| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 85|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 85| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 85|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 85| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 85|} gf2x_inv.c:OQS_KEM_bike_l3_gf2x_ctx_init: 132| 1|{ 133| 1|#if defined(X86_64) 134| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 1| if(is_avx512_enabled()) { ------------------ | | 98| 1|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 1] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 1|#endif 143| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 1| if(is_avx2_enabled()) { ------------------ | | 97| 1|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 1, False: 0] ------------------ 145| 1| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 1|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 1|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 1| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 1|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 1|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 1| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 1|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 1| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 1|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 1| ctx->red = gf2x_red_avx2; ------------------ | | 75| 1|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 1|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 1| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 1|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 1| if(is_pclmul_enabled()) { ------------------ | | 99| 1|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 1, False: 0] ------------------ 171| 1| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 1|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 1| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 1|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 1| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 1|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 1| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 1|} gf2x_mul.c:OQS_KEM_bike_l3_gf2x_ctx_init: 132| 17|{ 133| 17|#if defined(X86_64) 134| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 17| if(is_avx512_enabled()) { ------------------ | | 98| 17|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 17] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 17|#endif 143| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 17| if(is_avx2_enabled()) { ------------------ | | 97| 17|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 17, False: 0] ------------------ 145| 17| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 17|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 17|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 17| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 17|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 17|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 17| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 17|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 17| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 17|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 17| ctx->red = gf2x_red_avx2; ------------------ | | 75| 17|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 17|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 17| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 17|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 17| if(is_pclmul_enabled()) { ------------------ | | 99| 17|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 17, False: 0] ------------------ 171| 17| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 17|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 17| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 17|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 17| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 17|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 17| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 17|} gf2x_inv.c:OQS_KEM_bike_l5_gf2x_ctx_init: 132| 1|{ 133| 1|#if defined(X86_64) 134| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 1| if(is_avx512_enabled()) { ------------------ | | 98| 1|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 1] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 1|#endif 143| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 1| if(is_avx2_enabled()) { ------------------ | | 97| 1|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 1, False: 0] ------------------ 145| 1| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 1|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 1|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 1| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 1|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 1|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 1| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 1|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 1| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 1|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 1| ctx->red = gf2x_red_avx2; ------------------ | | 75| 1|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 1|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 1| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 1|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 1| if(is_pclmul_enabled()) { ------------------ | | 99| 1|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 1, False: 0] ------------------ 171| 1| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 1|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 1| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 1|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 1| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 1|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 1| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 1|} gf2x_mul.c:OQS_KEM_bike_l5_gf2x_ctx_init: 132| 17|{ 133| 17|#if defined(X86_64) 134| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 17| if(is_avx512_enabled()) { ------------------ | | 98| 17|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 17] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 17|#endif 143| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 17| if(is_avx2_enabled()) { ------------------ | | 97| 17|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 17, False: 0] ------------------ 145| 17| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 17|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 17|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 17| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 17|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 17|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 17| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 17|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 17| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 17|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 17| ctx->red = gf2x_red_avx2; ------------------ | | 75| 17|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 17|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 17| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 17|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 17| if(is_pclmul_enabled()) { ------------------ | | 99| 17|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 17, False: 0] ------------------ 171| 17| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 17|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 17| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 17|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 17| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 17|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 17| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 17|} OQS_KEM_bike_l1_gf2x_mod_inv: 119| 5|{ 120| | // Initialize gf2x methods struct 121| 5| gf2x_ctx ctx; 122| 5| gf2x_ctx_init(&ctx); ------------------ | | 126| 5|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Note that exp0/1_k/l are predefined constants that depend only on the value 125| | // of R. This value is public. Therefore, branches in this function, which 126| | // depends on R, are also "public". Code that releases these branches 127| | // (taken/not-taken) does not leak secret information. 128| 5| const size_t exp0_k[MAX_I] = {EXP0_K_VALS}; ------------------ | | 80| 5| 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096, 8192 ------------------ 129| 5| const size_t exp0_l[MAX_I] = {EXP0_L_VALS}; ------------------ | | 82| 5| 6162, 3081, 3851, 5632, 22, 484, 119, 1838, 1742, 3106, 10650, 1608, 10157, 8816 ------------------ 130| 5| const size_t exp1_k[MAX_I] = {EXP1_K_VALS}; ------------------ | | 83| 5|# define EXP1_K_VALS 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 33, 4129 ------------------ 131| 5| const size_t exp1_l[MAX_I] = {EXP1_L_VALS}; ------------------ | | 84| 5|# define EXP1_L_VALS 0, 0, 0, 0, 0, 6162, 0, 0, 0, 0, 0, 0, 242, 5717 ------------------ 132| | 133| 5| DEFER_CLEANUP(pad_r_t f = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 134| 5| DEFER_CLEANUP(pad_r_t g = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| 5| DEFER_CLEANUP(pad_r_t t = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 136| 5| DEFER_CLEANUP(dbl_pad_r_t sec_buf = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 137| | 138| | // Steps 2 and 3 in [1](Algorithm 2) 139| 5| f.val = a->val; 140| 5| t.val = a->val; 141| | 142| 70| for(size_t i = 1; i < MAX_I; i++) { ------------------ | | 78| 70|# define MAX_I (14) ------------------ | Branch (142:21): [True: 65, False: 5] ------------------ 143| | // Step 5 in [1](Algorithm 2), exponentiation 0: g = f^2^2^(i-1) 144| 65| if(exp0_k[i - 1] <= K_SQR_THR) { ------------------ | | 51| 65|#define K_SQR_THR (64) ------------------ | Branch (144:8): [True: 35, False: 30] ------------------ 145| 35| repeated_squaring(&g, &f, exp0_k[i - 1], &sec_buf, &ctx); 146| 35| } else { 147| 30| ctx.k_sqr(&g, &f, exp0_l[i - 1]); 148| 30| } 149| | 150| | // Step 6, [1](Algorithm 2): f = f*g 151| 65| gf2x_mod_mul_with_ctx(&f, &g, &f, &ctx); ------------------ | | 125| 65|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 65|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 65|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 65|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 152| | 153| 65| if(exp1_k[i] != 0) { ------------------ | Branch (153:8): [True: 15, False: 50] ------------------ 154| | // Step 8, [1](Algorithm 2), exponentiation 1: g = f^2^((r-2) % 2^i) 155| 15| if(exp1_k[i] <= K_SQR_THR) { ------------------ | | 51| 15|#define K_SQR_THR (64) ------------------ | Branch (155:10): [True: 10, False: 5] ------------------ 156| 10| repeated_squaring(&g, &f, exp1_k[i], &sec_buf, &ctx); 157| 10| } else { 158| 5| ctx.k_sqr(&g, &f, exp1_l[i]); 159| 5| } 160| | 161| | // Step 9, [1](Algorithm 2): t = t*g; 162| 15| gf2x_mod_mul_with_ctx(&t, &g, &t, &ctx); ------------------ | | 125| 15|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 163| 15| } 164| 65| } 165| | 166| | // Step 10, [1](Algorithm 2): c = t^2 167| 5| gf2x_mod_sqr_in_place(&t, &sec_buf, &ctx); 168| 5| c->val = t.val; 169| 5|} gf2x_inv.c:repeated_squaring: 32| 64|{ 33| 64| c->val = a->val; 34| | 35| 1.15k| for(size_t i = 0; i < num_sqrs; i++) { ------------------ | Branch (35:21): [True: 1.09k, False: 64] ------------------ 36| 1.09k| gf2x_mod_sqr_in_place(c, sec_buf, ctx); 37| 1.09k| } 38| 64|} gf2x_inv.c:gf2x_mod_sqr_in_place: 21| 1.09k|{ 22| 1.09k| ctx->sqr(secure_buffer, a); 23| 1.09k| ctx->red(a, secure_buffer); ------------------ | | 75| 1.09k|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 1.09k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1.09k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1.09k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 24| 1.09k|} OQS_KEM_bike_l3_gf2x_mod_inv: 119| 1|{ 120| | // Initialize gf2x methods struct 121| 1| gf2x_ctx ctx; 122| 1| gf2x_ctx_init(&ctx); ------------------ | | 126| 1|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Note that exp0/1_k/l are predefined constants that depend only on the value 125| | // of R. This value is public. Therefore, branches in this function, which 126| | // depends on R, are also "public". Code that releases these branches 127| | // (taken/not-taken) does not leak secret information. 128| 1| const size_t exp0_k[MAX_I] = {EXP0_K_VALS}; ------------------ | | 93| 1| 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096, 8192, 16384 ------------------ 129| 1| const size_t exp0_l[MAX_I] = {EXP0_L_VALS}; ------------------ | | 95| 1| 12330, 6165, 7706, 3564, 2711, 1139, 15053, 1258, 4388, 20524, 9538, 6393, \ | | 96| 1| 10486, 1715, 6804 ------------------ 130| 1| const size_t exp1_k[MAX_I] = {EXP1_K_VALS}; ------------------ | | 97| 1|# define EXP1_K_VALS 0, 0, 0, 0, 1, 0, 17, 0, 0, 0, 0, 0, 0, 81, 8273 ------------------ 131| 1| const size_t exp1_l[MAX_I] = {EXP1_L_VALS}; ------------------ | | 98| 1|# define EXP1_L_VALS 0, 0, 0, 0, 12330, 0, 13685, 0, 0, 0, 0, 0, 0, 23678, 19056 ------------------ 132| | 133| 1| DEFER_CLEANUP(pad_r_t f = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 134| 1| DEFER_CLEANUP(pad_r_t g = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| 1| DEFER_CLEANUP(pad_r_t t = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 136| 1| DEFER_CLEANUP(dbl_pad_r_t sec_buf = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 137| | 138| | // Steps 2 and 3 in [1](Algorithm 2) 139| 1| f.val = a->val; 140| 1| t.val = a->val; 141| | 142| 15| for(size_t i = 1; i < MAX_I; i++) { ------------------ | | 91| 15|# define MAX_I (15) ------------------ | Branch (142:21): [True: 14, False: 1] ------------------ 143| | // Step 5 in [1](Algorithm 2), exponentiation 0: g = f^2^2^(i-1) 144| 14| if(exp0_k[i - 1] <= K_SQR_THR) { ------------------ | | 51| 14|#define K_SQR_THR (64) ------------------ | Branch (144:8): [True: 7, False: 7] ------------------ 145| 7| repeated_squaring(&g, &f, exp0_k[i - 1], &sec_buf, &ctx); 146| 7| } else { 147| 7| ctx.k_sqr(&g, &f, exp0_l[i - 1]); 148| 7| } 149| | 150| | // Step 6, [1](Algorithm 2): f = f*g 151| 14| gf2x_mod_mul_with_ctx(&f, &g, &f, &ctx); ------------------ | | 125| 14|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 14|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 14|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 14|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 152| | 153| 14| if(exp1_k[i] != 0) { ------------------ | Branch (153:8): [True: 4, False: 10] ------------------ 154| | // Step 8, [1](Algorithm 2), exponentiation 1: g = f^2^((r-2) % 2^i) 155| 4| if(exp1_k[i] <= K_SQR_THR) { ------------------ | | 51| 4|#define K_SQR_THR (64) ------------------ | Branch (155:10): [True: 2, False: 2] ------------------ 156| 2| repeated_squaring(&g, &f, exp1_k[i], &sec_buf, &ctx); 157| 2| } else { 158| 2| ctx.k_sqr(&g, &f, exp1_l[i]); 159| 2| } 160| | 161| | // Step 9, [1](Algorithm 2): t = t*g; 162| 4| gf2x_mod_mul_with_ctx(&t, &g, &t, &ctx); ------------------ | | 125| 4|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 4|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 4|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 4|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 163| 4| } 164| 14| } 165| | 166| | // Step 10, [1](Algorithm 2): c = t^2 167| 1| gf2x_mod_sqr_in_place(&t, &sec_buf, &ctx); 168| 1| c->val = t.val; 169| 1|} OQS_KEM_bike_l5_gf2x_mod_inv: 119| 1|{ 120| | // Initialize gf2x methods struct 121| 1| gf2x_ctx ctx; 122| 1| gf2x_ctx_init(&ctx); ------------------ | | 126| 1|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Note that exp0/1_k/l are predefined constants that depend only on the value 125| | // of R. This value is public. Therefore, branches in this function, which 126| | // depends on R, are also "public". Code that releases these branches 127| | // (taken/not-taken) does not leak secret information. 128| 1| const size_t exp0_k[MAX_I] = {EXP0_K_VALS}; ------------------ | | 107| 1| 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096, 8192, 16384, 32768 ------------------ 129| 1| const size_t exp0_l[MAX_I] = {EXP0_L_VALS}; ------------------ | | 109| 1| 20487, 30730, 28169, 9443, 13001, 12376, 8302, 6618, 38760, 21582, 1660, \ | | 110| 1| 10409, 14669, 30338, 17745, 7520 ------------------ 130| 1| const size_t exp1_k[MAX_I] = {EXP1_K_VALS}; ------------------ | | 111| 1|# define EXP1_K_VALS 0, 1, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 11, 0, 8203 ------------------ 131| 1| const size_t exp1_l[MAX_I] = {EXP1_L_VALS}; ------------------ | | 112| 1|# define EXP1_L_VALS 0, 20487, 0, 15365, 0, 0, 0, 0, 0, 0, 0, 0, 0, 6302, 0, 10058 ------------------ 132| | 133| 1| DEFER_CLEANUP(pad_r_t f = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 134| 1| DEFER_CLEANUP(pad_r_t g = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| 1| DEFER_CLEANUP(pad_r_t t = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 136| 1| DEFER_CLEANUP(dbl_pad_r_t sec_buf = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 137| | 138| | // Steps 2 and 3 in [1](Algorithm 2) 139| 1| f.val = a->val; 140| 1| t.val = a->val; 141| | 142| 16| for(size_t i = 1; i < MAX_I; i++) { ------------------ | | 105| 16|# define MAX_I (16) ------------------ | Branch (142:21): [True: 15, False: 1] ------------------ 143| | // Step 5 in [1](Algorithm 2), exponentiation 0: g = f^2^2^(i-1) 144| 15| if(exp0_k[i - 1] <= K_SQR_THR) { ------------------ | | 51| 15|#define K_SQR_THR (64) ------------------ | Branch (144:8): [True: 7, False: 8] ------------------ 145| 7| repeated_squaring(&g, &f, exp0_k[i - 1], &sec_buf, &ctx); 146| 8| } else { 147| 8| ctx.k_sqr(&g, &f, exp0_l[i - 1]); 148| 8| } 149| | 150| | // Step 6, [1](Algorithm 2): f = f*g 151| 15| gf2x_mod_mul_with_ctx(&f, &g, &f, &ctx); ------------------ | | 125| 15|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 152| | 153| 15| if(exp1_k[i] != 0) { ------------------ | Branch (153:8): [True: 4, False: 11] ------------------ 154| | // Step 8, [1](Algorithm 2), exponentiation 1: g = f^2^((r-2) % 2^i) 155| 4| if(exp1_k[i] <= K_SQR_THR) { ------------------ | | 51| 4|#define K_SQR_THR (64) ------------------ | Branch (155:10): [True: 3, False: 1] ------------------ 156| 3| repeated_squaring(&g, &f, exp1_k[i], &sec_buf, &ctx); 157| 3| } else { 158| 1| ctx.k_sqr(&g, &f, exp1_l[i]); 159| 1| } 160| | 161| | // Step 9, [1](Algorithm 2): t = t*g; 162| 4| gf2x_mod_mul_with_ctx(&t, &g, &t, &ctx); ------------------ | | 125| 4|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 4|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 4|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 4|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 163| 4| } 164| 15| } 165| | 166| | // Step 10, [1](Algorithm 2): c = t^2 167| 1| gf2x_mod_sqr_in_place(&t, &sec_buf, &ctx); 168| 1| c->val = t.val; 169| 1|} OQS_KEM_bike_l1_k_sqr_avx2: 191| 35|{ 192| 35| ALIGN(ALIGN_BYTES) map_word_t map[R_PADDED]; ------------------ | | 18| 35|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 193| 35| ALIGN(ALIGN_BYTES) uint8_t a_bytes[R_PADDED]; ------------------ | | 18| 35|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 194| 35| ALIGN(ALIGN_BYTES) uint8_t c_bytes[R_PADDED] = {0}; ------------------ | | 18| 35|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 195| | 196| | // Generate the permutation map defined by pi1 and l_param. 197| 35| generate_map(map, l_param); 198| | 199| 35| bin_to_bytes(a_bytes, a); 200| | 201| | // Permute "a" using the generated permutation map. 202| 431k| for(size_t i = 0; i < R_BITS; i++) { ------------------ | | 23| 431k|# define R_BITS 12323 ------------------ | Branch (202:21): [True: 431k, False: 35] ------------------ 203| 431k| c_bytes[i] = a_bytes[map[i]]; 204| 431k| } 205| | 206| 35| bytes_to_bin(c, c_bytes); 207| | 208| 35| secure_clean(a_bytes, sizeof(a_bytes)); ------------------ | | 33| 35|#define secure_clean OQS_MEM_cleanse ------------------ 209| 35| secure_clean(c_bytes, sizeof(c_bytes)); ------------------ | | 33| 35|#define secure_clean OQS_MEM_cleanse ------------------ 210| 35|} gf2x_ksqr_avx2.c:generate_map: 51| 53|{ 52| 53| __m256i vmap[NUM_YMMS], vtmp[NUM_YMMS], vr, inc, zero; 53| | 54| | // The permutation map is generated in the following way: 55| | // 1. for i = 0 to map size: 56| | // 2. map[i] = (i * l_param) % r 57| | // However, to avoid the expensive multiplication and modulo operations 58| | // we modify the algorithm to: 59| | // 1. map[0] = l_param 60| | // 2. for i = 1 to map size: 61| | // 3. map[i] = map[i - 1] + l_param 62| | // 4. if map[i] >= r: 63| | // 5. map[i] = map[i] - r 64| | // This algorithm is parallelized with vector instructions by processing 65| | // certain number of values (NUM_OF_VALS) in parallel. Therefore, 66| | // in the beginning we need to initialize the first NUM_OF_VALS elements. 67| 1.60k| for(size_t i = 0; i < NUM_OF_VALS; i++) { ------------------ | | 48| 1.60k|#define NUM_OF_VALS (NUM_YMMS * MAP_WORDS_IN_YMM) | | ------------------ | | | | 47| 1.60k|#define NUM_YMMS (2) | | ------------------ | | #define NUM_OF_VALS (NUM_YMMS * MAP_WORDS_IN_YMM) | | ------------------ | | | | 27| 1.60k|# define MAP_WORDS_IN_YMM WORDS_IN_YMM | | | | ------------------ | | | | | | 54| 1.60k|#define WORDS_IN_YMM (BYTES_IN_YMM / sizeof(uint16_t)) | | | | | | ------------------ | | | | | | | | 48| 1.60k|#define BYTES_IN_YMM 0x20 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (67:21): [True: 1.55k, False: 53] ------------------ 68| 1.55k| map[i] = (i * l_param) % R_BITS; ------------------ | | 23| 1.55k|# define R_BITS 12323 ------------------ 69| 1.55k| } 70| | 71| 53| vr = SET1(R_BITS); ------------------ | | 30| 53|# define SET1(x) SET1_I16(x) | | ------------------ | | | | 69| 53|# define SET1_I16(a) _mm256_set1_epi16(a) | | ------------------ ------------------ 72| 53| zero = SET_ZERO; ------------------ | | 72| 53|# define SET_ZERO _mm256_setzero_si256() ------------------ 73| | 74| | // Set the increment vector such that adding it to vmap vectors 75| | // gives the next NUM_OF_VALS elements of the map. AVX2 does not 76| | // support comparison of vectors where vector elements are considered 77| | // as unsigned integers. This is a problem when r > 2^14 because 78| | // sum of two values can be greater than 2^15 which would make the it 79| | // a negative number when considered as a signed 16-bit integer, 80| | // and therefore, the condition in step 4 of the algorithm would be 81| | // evaluated incorrectly. So, we use the following trick: 82| | // we subtract R from the increment and modify the algorithm: 83| | // 1. map[0] = l_param 84| | // 2. for i = 1 to map size: 85| | // 3. map[i] = map[i - 1] + (l_param - r) 86| | // 4. if map[i] < 0: 87| | // 5. map[i] = map[i] + r 88| 53| inc = SET1((l_param * NUM_OF_VALS) % R_BITS); ------------------ | | 30| 53|# define SET1(x) SET1_I16(x) | | ------------------ | | | | 69| 53|# define SET1_I16(a) _mm256_set1_epi16(a) | | ------------------ ------------------ 89| 53| inc = SUB(inc, vr); ------------------ | | 31| 53|# define SUB(x, y) SUB_I16(x, y) | | ------------------ | | | | 78| 53|# define SUB_I16(a, b) _mm256_sub_epi16(a, b) | | ------------------ ------------------ 90| | 91| | // Load the first NUM_OF_VALS elements in the vmap vectors 92| 159| for(size_t i = 0; i < NUM_YMMS; i++) { ------------------ | | 47| 159|#define NUM_YMMS (2) ------------------ | Branch (92:21): [True: 106, False: 53] ------------------ 93| 106| vmap[i] = LOAD(&map[i * MAP_WORDS_IN_YMM]); ------------------ | | 28| 106|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 94| 106| } 95| | 96| 64.0k| for(size_t i = NUM_YMMS; i < (R_PADDED / MAP_WORDS_IN_YMM); i += NUM_YMMS) { ------------------ | | 47| 53|#define NUM_YMMS (2) ------------------ for(size_t i = NUM_YMMS; i < (R_PADDED / MAP_WORDS_IN_YMM); i += NUM_YMMS) { ------------------ | | 88| 64.0k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | ------------------ | | | | 87| 64.0k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | ------------------ | | | | | | 37| 64.0k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | ------------------ | | ------------------ | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | ------------------ | | | | 40| 64.0k|# define BLOCK_BITS 16384 | | ------------------ ------------------ for(size_t i = NUM_YMMS; i < (R_PADDED / MAP_WORDS_IN_YMM); i += NUM_YMMS) { ------------------ | | 27| 64.0k|# define MAP_WORDS_IN_YMM WORDS_IN_YMM | | ------------------ | | | | 54| 64.0k|#define WORDS_IN_YMM (BYTES_IN_YMM / sizeof(uint16_t)) | | | | ------------------ | | | | | | 48| 64.0k|#define BYTES_IN_YMM 0x20 | | | | ------------------ | | ------------------ ------------------ for(size_t i = NUM_YMMS; i < (R_PADDED / MAP_WORDS_IN_YMM); i += NUM_YMMS) { ------------------ | | 47| 63.9k|#define NUM_YMMS (2) ------------------ | Branch (96:28): [True: 63.9k, False: 53] ------------------ 97| 191k| for(size_t j = 0; j < NUM_YMMS; j++) { ------------------ | | 47| 191k|#define NUM_YMMS (2) ------------------ | Branch (97:23): [True: 127k, False: 63.9k] ------------------ 98| 127k| vmap[j] = ADD(vmap[j], inc); ------------------ | | 32| 127k|# define ADD(x, y) ADD_I16(x, y) | | ------------------ | | | | 76| 127k|# define ADD_I16(a, b) _mm256_add_epi16(a, b) | | ------------------ ------------------ 99| 127k| vtmp[j] = CMPGT(zero, vmap[j]); ------------------ | | 33| 127k|# define CMPGT(x, y) CMPGT_I16(x, y) | | ------------------ | | | | 85| 127k|# define CMPGT_I16(a, b) _mm256_cmpgt_epi16(a, b) | | ------------------ ------------------ 100| 127k| vmap[j] = ADD(vmap[j], vtmp[j] & vr); ------------------ | | 32| 127k|# define ADD(x, y) ADD_I16(x, y) | | ------------------ | | | | 76| 127k|# define ADD_I16(a, b) _mm256_add_epi16(a, b) | | ------------------ ------------------ 101| | 102| 127k| STORE(&map[(i + j) * MAP_WORDS_IN_YMM], vmap[j]); ------------------ | | 29| 127k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 103| 127k| } 104| 63.9k| } 105| 53|} gf2x_ksqr_avx2.c:bin_to_bytes: 124| 53|{ 125| | // The algorithm works by taking every 32 bits of the input and converting 126| | // them to 32 bytes where each byte holds one of the bits. The first step is 127| | // to broadcast a 32-bit value (call it a) to all elements of vector t. 128| | // Then t contains bytes of a in the following order: 129| | // t = [ a3 a2 a1 a0 ... a3 a2 a1 a0 ] 130| | // where a0 contains the first 8 bits of a, a1 the second 8 bits, etc. 131| | // Let the output vector be [ out31 out30 ... out0 ]. We want to store 132| | // bit 0 of a in out0 byte, bit 1 of a in out1 byte, ect. (note that 133| | // we want to store the bit in the most significant position of a byte 134| | // because this is required by MOVEMASK instruction used in bytes_to_bin.) 135| | // 136| | // Ideally, we would shuffle the bytes of t such that the byte in 137| | // i-th position contains i-th bit of val, shift t appropriately and obtain 138| | // the result. However, AVX2 doesn't support shift operation on bytes, only 139| | // shifts of individual QWORDS (64 bit) and DWORDS (32 bit) are allowed. 140| | // Consider the two least significant DWORDS of t: 141| | // t = [ ... | a3 a2 a1 a0 | a3 a2 a1 a0 ] 142| | // and shift them by 6 and 4 to the left, respectively, to obtain: 143| | // t = [ ... | t7 t6 t5 t4 | t3 t2 t1 t0 ] 144| | // where t3 = a3 << 6, t2 = a2 << 6, t1 = a1 << 6, t0 = a0 << 6, 145| | // and t7 = a3 << 4, t6 = a2 << 4, t5 = a1 << 4, t4 = a0 << 4. 146| | // Now we shuffle vector t to obtain vector p such that: 147| | // p = [ ... | t12 t12 t8 t8 | t4 t4 t0 t0 ] 148| | // Note that in every even position of the vector p we have the right byte 149| | // of the input shifted by the required shift. The values in the odd 150| | // positions contain the right bytes of the input but they need to be shifted 151| | // one more time to the left by 1. By shifting each DWORD of p by 1 we get: 152| | // q = [ ... | p7 p6 p5 p4 | p3 p2 p1 p0 ] 153| | // where p1 = t0 << 1 = a0 << 7, p3 = t4 << 1 = 5, etc. Therefore, by 154| | // blending p and q (taking even positions from p and odd positions from q) 155| | // we obtain the desired result. 156| | 157| 53| __m256i t, p, q; 158| | 159| 53| const __m256i shift_mask = SET_I32(0, 2, 4, 6, 0, 2, 4, 6); ------------------ | | 66| 53|# define SET_I32(...) _mm256_set_epi32(__VA_ARGS__) ------------------ 160| | 161| 53| const __m256i shuffle_mask = 162| 53| SET_I8(15, 15, 11, 11, 7, 7, 3, 3, 14, 14, 10, 10, 6, 6, 2, 2, 13, 13, 9, 9, ------------------ | | 65| 53|# define SET_I8(...) _mm256_set_epi8(__VA_ARGS__) ------------------ 163| 53| 5, 5, 1, 1, 12, 12, 8, 8, 4, 4, 0, 0); 164| | 165| 53| const __m256i blend_mask = SET1_I16(0x00ff); ------------------ | | 69| 53|# define SET1_I16(a) _mm256_set1_epi16(a) ------------------ 166| | 167| 53| const uint32_t *bin32 = (const uint32_t *)bin_buf; 168| | 169| 32.0k| for(size_t i = 0; i < R_QWORDS * 2; i++) { ------------------ | | 82| 32.0k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 32.0k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (169:21): [True: 31.9k, False: 53] ------------------ 170| 31.9k| t = SET1_I32(bin32[i]); ------------------ | | 70| 31.9k|# define SET1_I32(a) _mm256_set1_epi32(a) ------------------ 171| 31.9k| t = SLLV_I32(t, shift_mask); ------------------ | | 83| 31.9k|# define SLLV_I32(a, b) _mm256_sllv_epi32(a, b) ------------------ 172| | 173| 31.9k| p = SHUF_I8(t, shuffle_mask); ------------------ | | 91| 31.9k|# define SHUF_I8(a, b) _mm256_shuffle_epi8(a, b) ------------------ 174| 31.9k| q = SLLI_I32(p, 1); ------------------ | | 82| 31.9k|# define SLLI_I32(a, imm) _mm256_slli_epi32(a, imm) ------------------ 175| | 176| 31.9k| STORE(&bytes_buf[i * 32], BLENDV_I8(p, q, blend_mask)); ------------------ | | 29| 31.9k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 177| 31.9k| } 178| 53|} gf2x_ksqr_avx2.c:bytes_to_bin: 111| 53|{ 112| 53| uint32_t *bin32 = (uint32_t *)bin_buf; 113| | 114| 32.0k| for(size_t i = 0; i < R_QWORDS * 2; i++) { ------------------ | | 82| 32.0k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 32.0k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (114:21): [True: 31.9k, False: 53] ------------------ 115| 31.9k| __m256i t = LOAD(&bytes_buf[i * BYTES_IN_YMM]); ------------------ | | 28| 31.9k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 116| 31.9k| bin32[i] = MOVEMASK(t); ------------------ | | 96| 31.9k|# define MOVEMASK(a) _mm256_movemask_epi8(a) ------------------ 117| 31.9k| } 118| 53|} OQS_KEM_bike_l3_k_sqr_avx2: 191| 9|{ 192| 9| ALIGN(ALIGN_BYTES) map_word_t map[R_PADDED]; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 193| 9| ALIGN(ALIGN_BYTES) uint8_t a_bytes[R_PADDED]; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 194| 9| ALIGN(ALIGN_BYTES) uint8_t c_bytes[R_PADDED] = {0}; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 195| | 196| | // Generate the permutation map defined by pi1 and l_param. 197| 9| generate_map(map, l_param); 198| | 199| 9| bin_to_bytes(a_bytes, a); 200| | 201| | // Permute "a" using the generated permutation map. 202| 221k| for(size_t i = 0; i < R_BITS; i++) { ------------------ | | 43| 221k|# define R_BITS 24659 ------------------ | Branch (202:21): [True: 221k, False: 9] ------------------ 203| 221k| c_bytes[i] = a_bytes[map[i]]; 204| 221k| } 205| | 206| 9| bytes_to_bin(c, c_bytes); 207| | 208| 9| secure_clean(a_bytes, sizeof(a_bytes)); ------------------ | | 33| 9|#define secure_clean OQS_MEM_cleanse ------------------ 209| 9| secure_clean(c_bytes, sizeof(c_bytes)); ------------------ | | 33| 9|#define secure_clean OQS_MEM_cleanse ------------------ 210| 9|} OQS_KEM_bike_l5_k_sqr_avx2: 191| 9|{ 192| 9| ALIGN(ALIGN_BYTES) map_word_t map[R_PADDED]; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 193| 9| ALIGN(ALIGN_BYTES) uint8_t a_bytes[R_PADDED]; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 194| 9| ALIGN(ALIGN_BYTES) uint8_t c_bytes[R_PADDED] = {0}; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 195| | 196| | // Generate the permutation map defined by pi1 and l_param. 197| 9| generate_map(map, l_param); 198| | 199| 9| bin_to_bytes(a_bytes, a); 200| | 201| | // Permute "a" using the generated permutation map. 202| 368k| for(size_t i = 0; i < R_BITS; i++) { ------------------ | | 59| 368k|# define R_BITS 40973 ------------------ | Branch (202:21): [True: 368k, False: 9] ------------------ 203| 368k| c_bytes[i] = a_bytes[map[i]]; 204| 368k| } 205| | 206| 9| bytes_to_bin(c, c_bytes); 207| | 208| 9| secure_clean(a_bytes, sizeof(a_bytes)); ------------------ | | 33| 9|#define secure_clean OQS_MEM_cleanse ------------------ 209| 9| secure_clean(c_bytes, sizeof(c_bytes)); ------------------ | | 33| 9|#define secure_clean OQS_MEM_cleanse ------------------ 210| 9|} OQS_KEM_bike_l1_gf2x_mod_mul_with_ctx: 90| 165|{ 91| 165| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 165|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 92| | 93| 165| DEFER_CLEANUP(dbl_pad_r_t t = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 165| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 94| 165| ALIGN(ALIGN_BYTES) uint64_t secure_buffer[SECURE_BUFFER_QWORDS]; ------------------ | | 18| 165|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 95| | 96| 165| karatzuba((uint64_t *)&t, (const uint64_t *)a, (const uint64_t *)b, R_QWORDS, ------------------ | | 82| 165|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 165|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 97| 165| R_PADDED_QWORDS, secure_buffer, ctx); ------------------ | | 90| 165|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 165|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 165|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 165|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 165|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ 98| | 99| 165| ctx->red(c, &t); ------------------ | | 75| 165|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 165|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 165|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 165|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 100| | 101| 165| secure_clean((uint8_t *)secure_buffer, sizeof(secure_buffer)); ------------------ | | 33| 165|#define secure_clean OQS_MEM_cleanse ------------------ 102| 165|} OQS_KEM_bike_l1_gf2x_mod_mul: 105| 85|{ 106| 85| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 85|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 107| | 108| | // Initialize gf2x methods struct 109| 85| gf2x_ctx ctx; 110| 85| gf2x_ctx_init(&ctx); ------------------ | | 126| 85|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 111| | 112| 85| gf2x_mod_mul_with_ctx(c, a, b, &ctx); ------------------ | | 125| 85|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| 85|} gf2x_mul.c:karatzuba: 32| 179k|{ 33| 179k| if(qwords_len <= ctx->mul_base_qwords) { ------------------ | Branch (33:6): [True: 119k, False: 59.7k] ------------------ 34| 119k| ctx->mul_base(c, a, b); 35| 119k| return; 36| 119k| } 37| | 38| 59.7k| const size_t half_qw_len = qwords_len_pad >> 1; 39| | 40| | // Split a and b into low and high parts of size n_padded/2 41| 59.7k| const uint64_t *a_lo = a; 42| 59.7k| const uint64_t *b_lo = b; 43| 59.7k| const uint64_t *a_hi = &a[half_qw_len]; 44| 59.7k| const uint64_t *b_hi = &b[half_qw_len]; 45| | 46| | // Split c into 4 parts of size n_padded/2 (the last ptr is not needed) 47| 59.7k| uint64_t *c0 = c; 48| 59.7k| uint64_t *c1 = &c[half_qw_len]; 49| 59.7k| uint64_t *c2 = &c[half_qw_len * 2]; 50| | 51| | // Allocate 3 ptrs of size n_padded/2 on sec_buf 52| 59.7k| uint64_t *alah = sec_buf; 53| 59.7k| uint64_t *blbh = &sec_buf[half_qw_len]; 54| 59.7k| uint64_t *tmp = &sec_buf[half_qw_len * 2]; 55| | 56| | // Move sec_buf ptr to the first free location for the next recursion call 57| 59.7k| sec_buf = &sec_buf[half_qw_len * 3]; 58| | 59| | // Compute a_lo*b_lo and store the result in (c1|c0) 60| 59.7k| karatzuba(c0, a_lo, b_lo, half_qw_len, half_qw_len, sec_buf, ctx); 61| | 62| | // If the real number of digits n is less or equal to n_padded/2 then: 63| | // a_hi = 0 and b_hi = 0 64| | // and 65| | // (a_hi|a_lo)*(b_hi|b_lo) = a_lo*b_lo 66| | // so we can skip the remaining two multiplications 67| 59.7k| if(qwords_len > half_qw_len) { ------------------ | Branch (67:6): [True: 59.7k, False: 36] ------------------ 68| | // Compute a_hi*b_hi and store the result in (c3|c2) 69| 59.7k| karatzuba(c2, a_hi, b_hi, qwords_len - half_qw_len, half_qw_len, sec_buf, 70| 59.7k| ctx); 71| | 72| | // Compute alah = (a_lo + a_hi) and blbh = (b_lo + b_hi) 73| 59.7k| ctx->karatzuba_add1(alah, blbh, a, b, half_qw_len); ------------------ | | 71| 59.7k|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 59.7k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 59.7k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 59.7k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 74| | 75| | // Compute (c1 + c2) and store the result in tmp 76| 59.7k| ctx->karatzuba_add2(tmp, c1, c2, half_qw_len); ------------------ | | 72| 59.7k|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 59.7k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 59.7k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 59.7k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 77| | 78| | // Compute alah*blbh and store the result in (c2|c1) 79| 59.7k| karatzuba(c1, alah, blbh, half_qw_len, half_qw_len, sec_buf, ctx); 80| | 81| | // Add (tmp|tmp) and (c3|c0) to (c2|c1) 82| 59.7k| ctx->karatzuba_add3(c0, tmp, half_qw_len); 83| 59.7k| } 84| 59.7k|} OQS_KEM_bike_l3_gf2x_mod_mul_with_ctx: 90| 35|{ 91| 35| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 35|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 92| | 93| 35| DEFER_CLEANUP(dbl_pad_r_t t = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 94| 35| ALIGN(ALIGN_BYTES) uint64_t secure_buffer[SECURE_BUFFER_QWORDS]; ------------------ | | 18| 35|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 95| | 96| 35| karatzuba((uint64_t *)&t, (const uint64_t *)a, (const uint64_t *)b, R_QWORDS, ------------------ | | 82| 35|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 35|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 97| 35| R_PADDED_QWORDS, secure_buffer, ctx); ------------------ | | 90| 35|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 35|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 35|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 35|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 35|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ 98| | 99| 35| ctx->red(c, &t); ------------------ | | 75| 35|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 35|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 35|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 35|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 100| | 101| 35| secure_clean((uint8_t *)secure_buffer, sizeof(secure_buffer)); ------------------ | | 33| 35|#define secure_clean OQS_MEM_cleanse ------------------ 102| 35|} OQS_KEM_bike_l3_gf2x_mod_mul: 105| 17|{ 106| 17| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 17|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 107| | 108| | // Initialize gf2x methods struct 109| 17| gf2x_ctx ctx; 110| 17| gf2x_ctx_init(&ctx); ------------------ | | 126| 17|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 111| | 112| 17| gf2x_mod_mul_with_ctx(c, a, b, &ctx); ------------------ | | 125| 17|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| 17|} OQS_KEM_bike_l5_gf2x_mod_mul_with_ctx: 90| 36|{ 91| 36| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 36|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 92| | 93| 36| DEFER_CLEANUP(dbl_pad_r_t t = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 36| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 94| 36| ALIGN(ALIGN_BYTES) uint64_t secure_buffer[SECURE_BUFFER_QWORDS]; ------------------ | | 18| 36|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 95| | 96| 36| karatzuba((uint64_t *)&t, (const uint64_t *)a, (const uint64_t *)b, R_QWORDS, ------------------ | | 82| 36|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 36|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 97| 36| R_PADDED_QWORDS, secure_buffer, ctx); ------------------ | | 90| 36|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 36|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 36|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 36|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 36|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ 98| | 99| 36| ctx->red(c, &t); ------------------ | | 75| 36|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 36|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 36|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 36|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 100| | 101| 36| secure_clean((uint8_t *)secure_buffer, sizeof(secure_buffer)); ------------------ | | 33| 36|#define secure_clean OQS_MEM_cleanse ------------------ 102| 36|} OQS_KEM_bike_l5_gf2x_mod_mul: 105| 17|{ 106| 17| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 17|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 107| | 108| | // Initialize gf2x methods struct 109| 17| gf2x_ctx ctx; 110| 17| gf2x_ctx_init(&ctx); ------------------ | | 126| 17|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 111| | 112| 17| gf2x_mod_mul_with_ctx(c, a, b, &ctx); ------------------ | | 125| 17|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| 17|} OQS_KEM_bike_l1_karatzuba_add1_avx2: 21| 17.8k|{ 22| 17.8k| assert(qwords_len % REG_QWORDS == 0); 23| | 24| 17.8k| REG_T va0, va1, vb0, vb1; ------------------ | | 26| 17.8k|# define REG_T __m256i ------------------ 25| | 26| 81.1k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 63.3k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (26:21): [True: 63.3k, False: 17.8k] ------------------ 27| 63.3k| va0 = LOAD(&a[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 28| 63.3k| va1 = LOAD(&a[i + qwords_len]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 29| 63.3k| vb0 = LOAD(&b[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 30| 63.3k| vb1 = LOAD(&b[i + qwords_len]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 31| | 32| 63.3k| STORE(&alah[i], va0 ^ va1); ------------------ | | 29| 63.3k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 33| 63.3k| STORE(&blbh[i], vb0 ^ vb1); ------------------ | | 29| 63.3k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 34| 63.3k| } 35| 17.8k|} OQS_KEM_bike_l1_karatzuba_add2_avx2: 41| 17.8k|{ 42| 17.8k| assert(qwords_len % REG_QWORDS == 0); 43| | 44| 17.8k| REG_T vx, vy; ------------------ | | 26| 17.8k|# define REG_T __m256i ------------------ 45| | 46| 81.1k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 63.3k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (46:21): [True: 63.3k, False: 17.8k] ------------------ 47| 63.3k| vx = LOAD(&x[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 48| 63.3k| vy = LOAD(&y[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 49| | 50| 63.3k| STORE(&z[i], vx ^ vy); ------------------ | | 29| 63.3k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 51| 63.3k| } 52| 17.8k|} OQS_KEM_bike_l1_karatzuba_add3_avx2: 57| 17.8k|{ 58| 17.8k| assert(qwords_len % REG_QWORDS == 0); 59| | 60| 17.8k| REG_T vr0, vr1, vr2, vr3, vt; ------------------ | | 26| 17.8k|# define REG_T __m256i ------------------ 61| | 62| 17.8k| uint64_t *c0 = c; 63| 17.8k| uint64_t *c1 = &c[qwords_len]; 64| 17.8k| uint64_t *c2 = &c[2 * qwords_len]; 65| 17.8k| uint64_t *c3 = &c[3 * qwords_len]; 66| | 67| 81.1k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 63.3k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (67:21): [True: 63.3k, False: 17.8k] ------------------ 68| 63.3k| vr0 = LOAD(&c0[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 69| 63.3k| vr1 = LOAD(&c1[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 70| 63.3k| vr2 = LOAD(&c2[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| 63.3k| vr3 = LOAD(&c3[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 72| 63.3k| vt = LOAD(&mid[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 73| | 74| 63.3k| STORE(&c1[i], vt ^ vr0 ^ vr1); ------------------ | | 29| 63.3k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 75| 63.3k| STORE(&c2[i], vt ^ vr2 ^ vr3); ------------------ | | 29| 63.3k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 76| 63.3k| } 77| 17.8k|} OQS_KEM_bike_l1_gf2x_red_avx2: 81| 975|{ 82| 975| const uint64_t *a64 = (const uint64_t *)a; 83| 975| uint64_t * c64 = (uint64_t *)c; 84| | 85| 48.7k| for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 82| 48.7k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 48.7k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 58| 47.7k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (85:21): [True: 47.7k, False: 975] ------------------ 86| 47.7k| REG_T vt0 = LOAD(&a64[i]); ------------------ | | 26| 47.7k|# define REG_T __m256i ------------------ REG_T vt0 = LOAD(&a64[i]); ------------------ | | 28| 47.7k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 87| 47.7k| REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 26| 47.7k|# define REG_T __m256i ------------------ REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 28| 47.7k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 88| 47.7k| REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 26| 47.7k|# define REG_T __m256i ------------------ REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 28| 47.7k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 89| | 90| 47.7k| vt1 = SLLI_I64(vt1, LAST_R_QWORD_TRAIL); ------------------ | | 31| 47.7k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 91| 47.7k| vt2 = SRLI_I64(vt2, LAST_R_QWORD_LEAD); ------------------ | | 32| 47.7k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ 92| | 93| 47.7k| vt0 ^= (vt1 | vt2); 94| | 95| 47.7k| STORE(&c64[i], vt0); ------------------ | | 29| 47.7k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 96| 47.7k| } 97| | 98| 975| c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 82| 975|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 975|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 94| 975|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 975|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 975|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 99| | 100| | // Clean the secrets from the upper part of c 101| 975| secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 33| 975|#define secure_clean OQS_MEM_cleanse ------------------ secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 82| 975|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 975|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 102| 975| (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 90| 975|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 975|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 975|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 975|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 975|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 82| 975|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 975|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 103| 975|} OQS_KEM_bike_l3_karatzuba_add1_avx2: 21| 11.3k|{ 22| 11.3k| assert(qwords_len % REG_QWORDS == 0); 23| | 24| 11.3k| REG_T va0, va1, vb0, vb1; ------------------ | | 26| 11.3k|# define REG_T __m256i ------------------ 25| | 26| 53.3k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 42.0k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (26:21): [True: 42.0k, False: 11.3k] ------------------ 27| 42.0k| va0 = LOAD(&a[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 28| 42.0k| va1 = LOAD(&a[i + qwords_len]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 29| 42.0k| vb0 = LOAD(&b[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 30| 42.0k| vb1 = LOAD(&b[i + qwords_len]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 31| | 32| 42.0k| STORE(&alah[i], va0 ^ va1); ------------------ | | 29| 42.0k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 33| 42.0k| STORE(&blbh[i], vb0 ^ vb1); ------------------ | | 29| 42.0k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 34| 42.0k| } 35| 11.3k|} OQS_KEM_bike_l3_karatzuba_add2_avx2: 41| 11.3k|{ 42| 11.3k| assert(qwords_len % REG_QWORDS == 0); 43| | 44| 11.3k| REG_T vx, vy; ------------------ | | 26| 11.3k|# define REG_T __m256i ------------------ 45| | 46| 53.3k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 42.0k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (46:21): [True: 42.0k, False: 11.3k] ------------------ 47| 42.0k| vx = LOAD(&x[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 48| 42.0k| vy = LOAD(&y[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 49| | 50| 42.0k| STORE(&z[i], vx ^ vy); ------------------ | | 29| 42.0k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 51| 42.0k| } 52| 11.3k|} OQS_KEM_bike_l3_karatzuba_add3_avx2: 57| 11.3k|{ 58| 11.3k| assert(qwords_len % REG_QWORDS == 0); 59| | 60| 11.3k| REG_T vr0, vr1, vr2, vr3, vt; ------------------ | | 26| 11.3k|# define REG_T __m256i ------------------ 61| | 62| 11.3k| uint64_t *c0 = c; 63| 11.3k| uint64_t *c1 = &c[qwords_len]; 64| 11.3k| uint64_t *c2 = &c[2 * qwords_len]; 65| 11.3k| uint64_t *c3 = &c[3 * qwords_len]; 66| | 67| 53.3k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 42.0k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (67:21): [True: 42.0k, False: 11.3k] ------------------ 68| 42.0k| vr0 = LOAD(&c0[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 69| 42.0k| vr1 = LOAD(&c1[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 70| 42.0k| vr2 = LOAD(&c2[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| 42.0k| vr3 = LOAD(&c3[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 72| 42.0k| vt = LOAD(&mid[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 73| | 74| 42.0k| STORE(&c1[i], vt ^ vr0 ^ vr1); ------------------ | | 29| 42.0k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 75| 42.0k| STORE(&c2[i], vt ^ vr2 ^ vr3); ------------------ | | 29| 42.0k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 76| 42.0k| } 77| 11.3k|} OQS_KEM_bike_l3_gf2x_red_avx2: 81| 181|{ 82| 181| const uint64_t *a64 = (const uint64_t *)a; 83| 181| uint64_t * c64 = (uint64_t *)c; 84| | 85| 17.7k| for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 82| 17.7k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 17.7k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 58| 17.5k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (85:21): [True: 17.5k, False: 181] ------------------ 86| 17.5k| REG_T vt0 = LOAD(&a64[i]); ------------------ | | 26| 17.5k|# define REG_T __m256i ------------------ REG_T vt0 = LOAD(&a64[i]); ------------------ | | 28| 17.5k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 87| 17.5k| REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 26| 17.5k|# define REG_T __m256i ------------------ REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 28| 17.5k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 88| 17.5k| REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 26| 17.5k|# define REG_T __m256i ------------------ REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 28| 17.5k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 89| | 90| 17.5k| vt1 = SLLI_I64(vt1, LAST_R_QWORD_TRAIL); ------------------ | | 31| 17.5k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 91| 17.5k| vt2 = SRLI_I64(vt2, LAST_R_QWORD_LEAD); ------------------ | | 32| 17.5k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ 92| | 93| 17.5k| vt0 ^= (vt1 | vt2); 94| | 95| 17.5k| STORE(&c64[i], vt0); ------------------ | | 29| 17.5k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 96| 17.5k| } 97| | 98| 181| c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 82| 181|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 181|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 94| 181|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 181|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 181|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 99| | 100| | // Clean the secrets from the upper part of c 101| 181| secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 33| 181|#define secure_clean OQS_MEM_cleanse ------------------ secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 82| 181|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 181|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 102| 181| (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 90| 181|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 181|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 181|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 181|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 181|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 82| 181|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 181|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 103| 181|} OQS_KEM_bike_l5_karatzuba_add1_avx2: 21| 30.6k|{ 22| 30.6k| assert(qwords_len % REG_QWORDS == 0); 23| | 24| 30.6k| REG_T va0, va1, vb0, vb1; ------------------ | | 26| 30.6k|# define REG_T __m256i ------------------ 25| | 26| 146k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 115k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (26:21): [True: 115k, False: 30.6k] ------------------ 27| 115k| va0 = LOAD(&a[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 28| 115k| va1 = LOAD(&a[i + qwords_len]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 29| 115k| vb0 = LOAD(&b[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 30| 115k| vb1 = LOAD(&b[i + qwords_len]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 31| | 32| 115k| STORE(&alah[i], va0 ^ va1); ------------------ | | 29| 115k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 33| 115k| STORE(&blbh[i], vb0 ^ vb1); ------------------ | | 29| 115k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 34| 115k| } 35| 30.6k|} OQS_KEM_bike_l5_karatzuba_add2_avx2: 41| 30.6k|{ 42| 30.6k| assert(qwords_len % REG_QWORDS == 0); 43| | 44| 30.6k| REG_T vx, vy; ------------------ | | 26| 30.6k|# define REG_T __m256i ------------------ 45| | 46| 146k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 115k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (46:21): [True: 115k, False: 30.6k] ------------------ 47| 115k| vx = LOAD(&x[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 48| 115k| vy = LOAD(&y[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 49| | 50| 115k| STORE(&z[i], vx ^ vy); ------------------ | | 29| 115k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 51| 115k| } 52| 30.6k|} OQS_KEM_bike_l5_karatzuba_add3_avx2: 57| 30.6k|{ 58| 30.6k| assert(qwords_len % REG_QWORDS == 0); 59| | 60| 30.6k| REG_T vr0, vr1, vr2, vr3, vt; ------------------ | | 26| 30.6k|# define REG_T __m256i ------------------ 61| | 62| 30.6k| uint64_t *c0 = c; 63| 30.6k| uint64_t *c1 = &c[qwords_len]; 64| 30.6k| uint64_t *c2 = &c[2 * qwords_len]; 65| 30.6k| uint64_t *c3 = &c[3 * qwords_len]; 66| | 67| 146k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 115k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (67:21): [True: 115k, False: 30.6k] ------------------ 68| 115k| vr0 = LOAD(&c0[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 69| 115k| vr1 = LOAD(&c1[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 70| 115k| vr2 = LOAD(&c2[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| 115k| vr3 = LOAD(&c3[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 72| 115k| vt = LOAD(&mid[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 73| | 74| 115k| STORE(&c1[i], vt ^ vr0 ^ vr1); ------------------ | | 29| 115k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 75| 115k| STORE(&c2[i], vt ^ vr2 ^ vr3); ------------------ | | 29| 115k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 76| 115k| } 77| 30.6k|} OQS_KEM_bike_l5_gf2x_red_avx2: 81| 179|{ 82| 179| const uint64_t *a64 = (const uint64_t *)a; 83| 179| uint64_t * c64 = (uint64_t *)c; 84| | 85| 28.9k| for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 82| 28.9k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 28.9k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 58| 28.8k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (85:21): [True: 28.8k, False: 179] ------------------ 86| 28.8k| REG_T vt0 = LOAD(&a64[i]); ------------------ | | 26| 28.8k|# define REG_T __m256i ------------------ REG_T vt0 = LOAD(&a64[i]); ------------------ | | 28| 28.8k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 87| 28.8k| REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 26| 28.8k|# define REG_T __m256i ------------------ REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 28| 28.8k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 88| 28.8k| REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 26| 28.8k|# define REG_T __m256i ------------------ REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 28| 28.8k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 89| | 90| 28.8k| vt1 = SLLI_I64(vt1, LAST_R_QWORD_TRAIL); ------------------ | | 31| 28.8k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 91| 28.8k| vt2 = SRLI_I64(vt2, LAST_R_QWORD_LEAD); ------------------ | | 32| 28.8k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ 92| | 93| 28.8k| vt0 ^= (vt1 | vt2); 94| | 95| 28.8k| STORE(&c64[i], vt0); ------------------ | | 29| 28.8k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 96| 28.8k| } 97| | 98| 179| c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 82| 179|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 179|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 94| 179|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 179|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 179|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 99| | 100| | // Clean the secrets from the upper part of c 101| 179| secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 33| 179|#define secure_clean OQS_MEM_cleanse ------------------ secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 82| 179|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 179|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 102| 179| (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 90| 179|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 179|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 179|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 179|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 179|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 82| 179|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 179|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 103| 179|} OQS_KEM_bike_l1_gf2x_mul_base_pclmul: 94| 35.8k|{ 95| 35.8k| __m128i va[4], vb[4]; 96| 35.8k| __m128i aa[2], bb[2]; 97| 35.8k| __m128i lo[4], hi[4], mi[4], m[2]; 98| | 99| 179k| for(size_t i = 0; i < 4; i++) { ------------------ | Branch (99:21): [True: 143k, False: 35.8k] ------------------ 100| 143k| va[i] = LOAD128(&a[QWORDS_IN_XMM * i]); ------------------ | | 12| 143k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 101| 143k| vb[i] = LOAD128(&b[QWORDS_IN_XMM * i]); ------------------ | | 12| 143k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 102| 143k| } 103| | 104| | // Multiply the low and the high halves of a and b 105| | // lo <-- a_lo * b_lo 106| | // hi <-- a_hi * b_hi 107| 35.8k| gf2x_mul4_int(lo, va[0], va[1], vb[0], vb[1]); 108| 35.8k| gf2x_mul4_int(hi, va[2], va[3], vb[2], vb[3]); 109| | 110| | // Compute the middle multiplication 111| | // aa <-- a_lo + a_hi 112| | // bb <-- b_lo + b_hi 113| | // mi <-- aa * bb 114| 35.8k| aa[0] = va[0] ^ va[2]; 115| 35.8k| aa[1] = va[1] ^ va[3]; 116| 35.8k| bb[0] = vb[0] ^ vb[2]; 117| 35.8k| bb[1] = vb[1] ^ vb[3]; 118| 35.8k| gf2x_mul4_int(mi, aa[0], aa[1], bb[0], bb[1]); 119| | 120| 35.8k| m[0] = lo[2] ^ hi[0]; 121| 35.8k| m[1] = lo[3] ^ hi[1]; 122| | 123| 35.8k| STORE128(&c[0 * QWORDS_IN_XMM], lo[0]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 124| 35.8k| STORE128(&c[1 * QWORDS_IN_XMM], lo[1]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 125| 35.8k| STORE128(&c[2 * QWORDS_IN_XMM], mi[0] ^ lo[0] ^ m[0]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 126| 35.8k| STORE128(&c[3 * QWORDS_IN_XMM], mi[1] ^ lo[1] ^ m[1]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 127| 35.8k| STORE128(&c[4 * QWORDS_IN_XMM], mi[2] ^ hi[2] ^ m[0]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 128| 35.8k| STORE128(&c[5 * QWORDS_IN_XMM], mi[3] ^ hi[3] ^ m[1]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 129| 35.8k| STORE128(&c[6 * QWORDS_IN_XMM], hi[2]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 130| 35.8k| STORE128(&c[7 * QWORDS_IN_XMM], hi[3]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 131| 35.8k|} OQS_KEM_bike_l1_gf2x_sqr_pclmul: 134| 810|{ 135| 810| __m128i va, vr0, vr1; 136| | 137| 810| const uint64_t *a64 = (const uint64_t *)a; 138| 810| uint64_t * c64 = (uint64_t *)c; 139| | 140| 79.3k| for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 83| 79.3k|#define R_XMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_XMM) | | ------------------ | | | | 37| 79.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 79.3k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 79.3k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 78.5k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 78.5k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ | Branch (140:21): [True: 78.5k, False: 810] ------------------ 141| 78.5k| va = LOAD128(&a64[i]); ------------------ | | 12| 78.5k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 142| | 143| 78.5k| vr0 = CLMUL(va, va, 0x00); ------------------ | | 16| 78.5k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 144| 78.5k| vr1 = CLMUL(va, va, 0x11); ------------------ | | 16| 78.5k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 145| | 146| 78.5k| STORE128(&c64[i * 2], vr0); ------------------ | | 13| 78.5k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 147| 78.5k| STORE128(&c64[i * 2 + QWORDS_IN_XMM], vr1); ------------------ | | 13| 78.5k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 148| 78.5k| } 149| 810|} gf2x_mul_base_pclmul.c:gf2x_mul4_int: 26| 359k|{ 27| | // a_lo = [a1 | a0]; a_hi = [a3 | a2]; 28| | // b_lo = [b1 | b0]; b_hi = [b3 | b2]; 29| | // 4x4 Karatsuba requires three 2x2 multiplications: 30| | // (1) a_lo * b_lo 31| | // (2) a_hi * b_hi 32| | // (3) aa * bb = (a_lo + a_hi) * (b_lo + b_hi) 33| | // Each of the three 2x2 multiplications requires three 1x1 multiplications: 34| | // (1) is computed by a0*b0, a1*b1, (a0+a1)*(b0+b1) 35| | // (2) is computed by a2*b2, a3*b3, (a2+a3)*(b2+b3) 36| | // (3) is computed by aa0*bb0, aa1*bb1, (aa0+aa1)*(bb0+bb1) 37| | // All the required additions are performed in the end. 38| | 39| 359k| __m128i aa, bb; 40| 359k| __m128i xx, yy, uu, vv, m; 41| 359k| __m128i lo[2], hi[2], mi[2]; 42| 359k| __m128i t[9]; 43| | 44| 359k| aa = a_lo ^ a_hi; 45| 359k| bb = b_lo ^ b_hi; 46| | 47| | // xx <-- [(a2+a3) | (a0+a1)] 48| | // yy <-- [(b2+b3) | (b0+b1)] 49| 359k| xx = UNPACKLO(a_lo, a_hi); ------------------ | | 14| 359k|#define UNPACKLO(x, y) _mm_unpacklo_epi64((x), (y)) ------------------ 50| 359k| yy = UNPACKLO(b_lo, b_hi); ------------------ | | 14| 359k|#define UNPACKLO(x, y) _mm_unpacklo_epi64((x), (y)) ------------------ 51| 359k| xx = xx ^ UNPACKHI(a_lo, a_hi); ------------------ | | 15| 359k|#define UNPACKHI(x, y) _mm_unpackhi_epi64((x), (y)) ------------------ 52| 359k| yy = yy ^ UNPACKHI(b_lo, b_hi); ------------------ | | 15| 359k|#define UNPACKHI(x, y) _mm_unpackhi_epi64((x), (y)) ------------------ 53| | 54| | // uu <-- [ 0 | (aa0+aa1)] 55| | // vv <-- [ 0 | (bb0+bb1)] 56| 359k| uu = aa ^ BSRLI(aa, 8); ------------------ | | 17| 359k|#define BSRLI(x, imm) _mm_bsrli_si128((x), (imm)) ------------------ 57| 359k| vv = bb ^ BSRLI(bb, 8); ------------------ | | 17| 359k|#define BSRLI(x, imm) _mm_bsrli_si128((x), (imm)) ------------------ 58| | 59| | // 9 multiplications 60| 359k| t[0] = CLMUL(a_lo, b_lo, 0x00); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 61| 359k| t[1] = CLMUL(a_lo, b_lo, 0x11); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 62| 359k| t[2] = CLMUL(a_hi, b_hi, 0x00); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 63| 359k| t[3] = CLMUL(a_hi, b_hi, 0x11); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 64| 359k| t[4] = CLMUL(xx, yy, 0x00); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 65| 359k| t[5] = CLMUL(xx, yy, 0x11); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 66| 359k| t[6] = CLMUL(aa, bb, 0x00); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 67| 359k| t[7] = CLMUL(aa, bb, 0x11); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 68| 359k| t[8] = CLMUL(uu, vv, 0x00); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 69| | 70| 359k| t[4] ^= (t[0] ^ t[1]); 71| 359k| t[5] ^= (t[2] ^ t[3]); 72| 359k| t[8] ^= (t[6] ^ t[7]); 73| | 74| 359k| lo[0] = t[0] ^ BSLLI(t[4], 8); ------------------ | | 18| 359k|#define BSLLI(x, imm) _mm_bslli_si128((x), (imm)) ------------------ 75| 359k| lo[1] = t[1] ^ BSRLI(t[4], 8); ------------------ | | 17| 359k|#define BSRLI(x, imm) _mm_bsrli_si128((x), (imm)) ------------------ 76| 359k| hi[0] = t[2] ^ BSLLI(t[5], 8); ------------------ | | 18| 359k|#define BSLLI(x, imm) _mm_bslli_si128((x), (imm)) ------------------ 77| 359k| hi[1] = t[3] ^ BSRLI(t[5], 8); ------------------ | | 17| 359k|#define BSRLI(x, imm) _mm_bsrli_si128((x), (imm)) ------------------ 78| 359k| mi[0] = t[6] ^ BSLLI(t[8], 8); ------------------ | | 18| 359k|#define BSLLI(x, imm) _mm_bslli_si128((x), (imm)) ------------------ 79| 359k| mi[1] = t[7] ^ BSRLI(t[8], 8); ------------------ | | 17| 359k|#define BSRLI(x, imm) _mm_bsrli_si128((x), (imm)) ------------------ 80| | 81| 359k| m = lo[1] ^ hi[0]; 82| | 83| 359k| c[0] = lo[0]; 84| 359k| c[1] = lo[0] ^ mi[0] ^ m; 85| 359k| c[2] = hi[1] ^ mi[1] ^ m; 86| 359k| c[3] = hi[1]; 87| 359k|} OQS_KEM_bike_l3_gf2x_mul_base_pclmul: 94| 22.7k|{ 95| 22.7k| __m128i va[4], vb[4]; 96| 22.7k| __m128i aa[2], bb[2]; 97| 22.7k| __m128i lo[4], hi[4], mi[4], m[2]; 98| | 99| 113k| for(size_t i = 0; i < 4; i++) { ------------------ | Branch (99:21): [True: 90.8k, False: 22.7k] ------------------ 100| 90.8k| va[i] = LOAD128(&a[QWORDS_IN_XMM * i]); ------------------ | | 12| 90.8k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 101| 90.8k| vb[i] = LOAD128(&b[QWORDS_IN_XMM * i]); ------------------ | | 12| 90.8k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 102| 90.8k| } 103| | 104| | // Multiply the low and the high halves of a and b 105| | // lo <-- a_lo * b_lo 106| | // hi <-- a_hi * b_hi 107| 22.7k| gf2x_mul4_int(lo, va[0], va[1], vb[0], vb[1]); 108| 22.7k| gf2x_mul4_int(hi, va[2], va[3], vb[2], vb[3]); 109| | 110| | // Compute the middle multiplication 111| | // aa <-- a_lo + a_hi 112| | // bb <-- b_lo + b_hi 113| | // mi <-- aa * bb 114| 22.7k| aa[0] = va[0] ^ va[2]; 115| 22.7k| aa[1] = va[1] ^ va[3]; 116| 22.7k| bb[0] = vb[0] ^ vb[2]; 117| 22.7k| bb[1] = vb[1] ^ vb[3]; 118| 22.7k| gf2x_mul4_int(mi, aa[0], aa[1], bb[0], bb[1]); 119| | 120| 22.7k| m[0] = lo[2] ^ hi[0]; 121| 22.7k| m[1] = lo[3] ^ hi[1]; 122| | 123| 22.7k| STORE128(&c[0 * QWORDS_IN_XMM], lo[0]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 124| 22.7k| STORE128(&c[1 * QWORDS_IN_XMM], lo[1]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 125| 22.7k| STORE128(&c[2 * QWORDS_IN_XMM], mi[0] ^ lo[0] ^ m[0]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 126| 22.7k| STORE128(&c[3 * QWORDS_IN_XMM], mi[1] ^ lo[1] ^ m[1]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 127| 22.7k| STORE128(&c[4 * QWORDS_IN_XMM], mi[2] ^ hi[2] ^ m[0]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 128| 22.7k| STORE128(&c[5 * QWORDS_IN_XMM], mi[3] ^ hi[3] ^ m[1]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 129| 22.7k| STORE128(&c[6 * QWORDS_IN_XMM], hi[2]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 130| 22.7k| STORE128(&c[7 * QWORDS_IN_XMM], hi[3]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 131| 22.7k|} OQS_KEM_bike_l3_gf2x_sqr_pclmul: 134| 146|{ 135| 146| __m128i va, vr0, vr1; 136| | 137| 146| const uint64_t *a64 = (const uint64_t *)a; 138| 146| uint64_t * c64 = (uint64_t *)c; 139| | 140| 28.3k| for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 83| 28.3k|#define R_XMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_XMM) | | ------------------ | | | | 37| 28.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 28.3k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 28.3k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 28.1k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 28.1k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ | Branch (140:21): [True: 28.1k, False: 146] ------------------ 141| 28.1k| va = LOAD128(&a64[i]); ------------------ | | 12| 28.1k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 142| | 143| 28.1k| vr0 = CLMUL(va, va, 0x00); ------------------ | | 16| 28.1k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 144| 28.1k| vr1 = CLMUL(va, va, 0x11); ------------------ | | 16| 28.1k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 145| | 146| 28.1k| STORE128(&c64[i * 2], vr0); ------------------ | | 13| 28.1k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 147| 28.1k| STORE128(&c64[i * 2 + QWORDS_IN_XMM], vr1); ------------------ | | 13| 28.1k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 148| 28.1k| } 149| 146|} OQS_KEM_bike_l5_gf2x_mul_base_pclmul: 94| 61.2k|{ 95| 61.2k| __m128i va[4], vb[4]; 96| 61.2k| __m128i aa[2], bb[2]; 97| 61.2k| __m128i lo[4], hi[4], mi[4], m[2]; 98| | 99| 306k| for(size_t i = 0; i < 4; i++) { ------------------ | Branch (99:21): [True: 244k, False: 61.2k] ------------------ 100| 244k| va[i] = LOAD128(&a[QWORDS_IN_XMM * i]); ------------------ | | 12| 244k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 101| 244k| vb[i] = LOAD128(&b[QWORDS_IN_XMM * i]); ------------------ | | 12| 244k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 102| 244k| } 103| | 104| | // Multiply the low and the high halves of a and b 105| | // lo <-- a_lo * b_lo 106| | // hi <-- a_hi * b_hi 107| 61.2k| gf2x_mul4_int(lo, va[0], va[1], vb[0], vb[1]); 108| 61.2k| gf2x_mul4_int(hi, va[2], va[3], vb[2], vb[3]); 109| | 110| | // Compute the middle multiplication 111| | // aa <-- a_lo + a_hi 112| | // bb <-- b_lo + b_hi 113| | // mi <-- aa * bb 114| 61.2k| aa[0] = va[0] ^ va[2]; 115| 61.2k| aa[1] = va[1] ^ va[3]; 116| 61.2k| bb[0] = vb[0] ^ vb[2]; 117| 61.2k| bb[1] = vb[1] ^ vb[3]; 118| 61.2k| gf2x_mul4_int(mi, aa[0], aa[1], bb[0], bb[1]); 119| | 120| 61.2k| m[0] = lo[2] ^ hi[0]; 121| 61.2k| m[1] = lo[3] ^ hi[1]; 122| | 123| 61.2k| STORE128(&c[0 * QWORDS_IN_XMM], lo[0]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 124| 61.2k| STORE128(&c[1 * QWORDS_IN_XMM], lo[1]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 125| 61.2k| STORE128(&c[2 * QWORDS_IN_XMM], mi[0] ^ lo[0] ^ m[0]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 126| 61.2k| STORE128(&c[3 * QWORDS_IN_XMM], mi[1] ^ lo[1] ^ m[1]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 127| 61.2k| STORE128(&c[4 * QWORDS_IN_XMM], mi[2] ^ hi[2] ^ m[0]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 128| 61.2k| STORE128(&c[5 * QWORDS_IN_XMM], mi[3] ^ hi[3] ^ m[1]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 129| 61.2k| STORE128(&c[6 * QWORDS_IN_XMM], hi[2]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 130| 61.2k| STORE128(&c[7 * QWORDS_IN_XMM], hi[3]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 131| 61.2k|} OQS_KEM_bike_l5_gf2x_sqr_pclmul: 134| 143|{ 135| 143| __m128i va, vr0, vr1; 136| | 137| 143| const uint64_t *a64 = (const uint64_t *)a; 138| 143| uint64_t * c64 = (uint64_t *)c; 139| | 140| 46.0k| for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 83| 46.0k|#define R_XMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_XMM) | | ------------------ | | | | 37| 46.0k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 46.0k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 46.0k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 45.9k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 45.9k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ | Branch (140:21): [True: 45.9k, False: 143] ------------------ 141| 45.9k| va = LOAD128(&a64[i]); ------------------ | | 12| 45.9k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 142| | 143| 45.9k| vr0 = CLMUL(va, va, 0x00); ------------------ | | 16| 45.9k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 144| 45.9k| vr1 = CLMUL(va, va, 0x11); ------------------ | | 16| 45.9k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 145| | 146| 45.9k| STORE128(&c64[i * 2], vr0); ------------------ | | 13| 45.9k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 147| 45.9k| STORE128(&c64[i * 2 + QWORDS_IN_XMM], vr1); ------------------ | | 13| 45.9k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 148| 45.9k| } 149| 143|} OQS_KEM_bike_l1_keypair: 133| 5|{ 134| 5| DEFER_CLEANUP(aligned_sk_t l_sk = {0}, sk_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| | 136| | // The secret key is (h0, h1), 137| | // and the public key h=(h0^-1 * h1). 138| | // Padded structures are used internally, and are required by the 139| | // decoder and the gf2x multiplication. 140| 5| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 141| 5| DEFER_CLEANUP(pad_r_t h1 = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 142| 5| DEFER_CLEANUP(pad_r_t h0inv = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 143| 5| DEFER_CLEANUP(pad_r_t h = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 144| | 145| | // The randomness of the key generation 146| 5| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 147| | 148| 5| get_seeds(&seeds); ------------------ | | 128| 5|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 5| GUARD(generate_secret_key(&h0, &h1, ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 150| 5| l_sk.wlist[0].val, l_sk.wlist[1].val, 151| 5| &seeds.seed[0])); 152| | 153| | // Generate sigma 154| 5| convert_seed_to_m_type(&l_sk.sigma, &seeds.seed[1]); 155| | 156| | // Calculate the public key 157| 5| gf2x_mod_inv(&h0inv, &h0); ------------------ | | 124| 5|#define gf2x_mod_inv RENAME_FUNC_NAME(gf2x_mod_inv) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 5| gf2x_mod_mul(&h, &h1, &h0inv); ------------------ | | 60| 5|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| | 160| | // Fill the secret key data structure with contents - cancel the padding 161| 5| l_sk.bin[0] = h0.val; 162| 5| l_sk.bin[1] = h1.val; 163| 5| l_sk.pk = h.val; 164| | 165| | // Copy the data to the output buffers 166| 5| bike_memcpy(sk, &l_sk, sizeof(l_sk)); 167| 5| bike_memcpy(pk, &l_sk.pk, sizeof(l_sk.pk)); 168| | 169| 5| print("h: ", (uint64_t *)&l_sk.pk, R_BITS); 170| 5| print("h0: ", (uint64_t *)&l_sk.bin[0], R_BITS); 171| 5| print("h1: ", (uint64_t *)&l_sk.bin[1], R_BITS); 172| 5| print("h0 wlist:", (uint64_t *)&l_sk.wlist[0], SIZEOF_BITS(compressed_idx_d_t)); 173| 5| print("h1 wlist:", (uint64_t *)&l_sk.wlist[1], SIZEOF_BITS(compressed_idx_d_t)); 174| 5| print("sigma: ", (uint64_t *)l_sk.sigma.raw, M_BITS); 175| | 176| 5| return SUCCESS; ------------------ | | 12| 5|#define SUCCESS OQS_SUCCESS ------------------ 177| 5|} OQS_KEM_bike_l1_encaps: 185| 5|{ 186| | // Public values (they do not require cleanup on exit). 187| 5| pk_t l_pk; 188| 5| ct_t l_ct; 189| | 190| 5| DEFER_CLEANUP(m_t m, m_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 191| 5| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 192| 5| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 193| 5| DEFER_CLEANUP(pad_e_t e, pad_e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 194| | 195| | // Copy the data from the input buffer. This is required in order to avoid 196| | // alignment issues on non x86_64 processors. 197| 5| bike_memcpy(&l_pk, pk, sizeof(l_pk)); 198| | 199| 5| get_seeds(&seeds); ------------------ | | 128| 5|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 200| | 201| | // e = H(m) = H(seed[0]) 202| 5| convert_seed_to_m_type(&m, &seeds.seed[0]); 203| 5| GUARD(function_h(&e, &m, &l_pk)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 204| | 205| | // Calculate the ciphertext 206| 5| GUARD(encrypt(&l_ct, &e, &l_pk, &m)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 207| | 208| | // Generate the shared secret 209| 5| GUARD(function_k(&l_ss, &m, &l_ct)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 210| | 211| 5| print("ss: ", (uint64_t *)l_ss.raw, SIZEOF_BITS(l_ss)); 212| | 213| | // Copy the data to the output buffers 214| 5| bike_memcpy(ct, &l_ct, sizeof(l_ct)); 215| 5| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 216| | 217| 5| return SUCCESS; ------------------ | | 12| 5|#define SUCCESS OQS_SUCCESS ------------------ 218| 5|} OQS_KEM_bike_l1_decaps: 226| 5|{ 227| | // Public values, does not require a cleanup on exit 228| 5| ct_t l_ct; 229| | 230| 5| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 231| 5| DEFER_CLEANUP(aligned_sk_t l_sk, sk_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 232| 5| DEFER_CLEANUP(e_t e, e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 233| 5| DEFER_CLEANUP(m_t m_prime, m_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 234| 5| DEFER_CLEANUP(pad_e_t e_tmp, pad_e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 235| 5| DEFER_CLEANUP(pad_e_t e_prime = {0}, pad_e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 236| | 237| | // Copy the data from the input buffers. This is required in order to avoid 238| | // alignment issues on non x86_64 processors. 239| 5| bike_memcpy(&l_ct, ct, sizeof(l_ct)); 240| 5| bike_memcpy(&l_sk, sk, sizeof(l_sk)); 241| | 242| | // Decode. 243| 5| decode(&e, &l_ct, &l_sk); ------------------ | | 57| 5|#define decode RENAME_FUNC_NAME(decode) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| | 245| | // Copy the error vector in the padded struct. 246| 5| e_prime.val[0].val = e.val[0]; 247| 5| e_prime.val[1].val = e.val[1]; 248| | 249| 5| GUARD(reencrypt(&m_prime, &e_prime, &l_ct)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 250| | 251| | // Check if H(m') is equal to (e0', e1') 252| | // (in constant-time) 253| 5| GUARD(function_h(&e_tmp, &m_prime, &l_sk.pk)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 254| 5| uint32_t success_cond; 255| 5| success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 5|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 5|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 5|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 5|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 256| 5| success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 5|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 5|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 5|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 5|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 257| | 258| | // Compute either K(m', C) or K(sigma, C) based on the success condition 259| 5| uint32_t mask = secure_l32_mask(0, success_cond); 260| 165| for(size_t i = 0; i < M_BYTES; i++) { ------------------ | | 104| 165|#define M_BYTES (M_BITS / 8) | | ------------------ | | | | 103| 165|#define M_BITS 256 | | ------------------ ------------------ | Branch (260:21): [True: 160, False: 5] ------------------ 261| 160| m_prime.raw[i] &= u8_barrier(~mask); 262| 160| m_prime.raw[i] |= (u8_barrier(mask) & l_sk.sigma.raw[i]); 263| 160| } 264| | 265| | // Generate the shared secret 266| 5| GUARD(function_k(&l_ss, &m_prime, &l_ct)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 267| | 268| | // Copy the data into the output buffer 269| 5| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 270| | 271| 5| return SUCCESS; ------------------ | | 12| 5|#define SUCCESS OQS_SUCCESS ------------------ 272| 5|} kem.c:convert_seed_to_m_type: 18| 14|{ 19| 14| bike_static_assert(sizeof(*m) == sizeof(*seed), m_size_eq_seed_size); ------------------ | | 33| 14| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 20| 14| bike_memcpy(m->raw, seed->raw, sizeof(*m)); 21| 14|} kem.c:OQS_KEM_bike_l1_function_h: 31| 10|{ 32| 10| DEFER_CLEANUP(seed_t seed = {0}, seed_cleanup); ------------------ | | 16| 10| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 33| | // pk is unused parameter in this case so we do this to avoid 34| | // clang sanitizers complaining. 35| 10| (void)pk; 36| | 37| 10| convert_m_to_seed_type(&seed, m); 38| | 39| 10| return generate_error_vector(e, &seed); ------------------ | | 132| 10|#define generate_error_vector RENAME_FUNC_NAME(generate_error_vector) | | ------------------ | | | | 44| 10|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 10|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 10|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 40| 10|} kem.c:convert_m_to_seed_type: 24| 14|{ 25| 14| bike_static_assert(sizeof(*m) == sizeof(*seed), m_size_eq_seed_size); ------------------ | | 33| 14| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 26| 14| bike_memcpy(seed->raw, m->raw, sizeof(*seed)); 27| 14|} kem.c:encrypt: 86| 7|{ 87| | // Pad the public key and the ciphertext 88| 7| pad_r_t p_ct = {0}; 89| 7| pad_r_t p_pk = {0}; 90| 7| p_pk.val = *pk; 91| | 92| | // Generate the ciphertext 93| | // ct = pk * e1 + e0 94| 7| gf2x_mod_mul(&p_ct, &e->val[1], &p_pk); ------------------ | | 60| 7|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 95| 7| gf2x_mod_add(&p_ct, &p_ct, &e->val[0]); ------------------ | | 123| 7|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 96| | 97| 7| ct->c0 = p_ct.val; 98| | 99| | // c1 = L(e0, e1) 100| 7| GUARD(function_l(&ct->c1, e)); ------------------ | | 17| 7| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 7|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 7] | | ------------------ ------------------ 101| | 102| | // m xor L(e0, e1) 103| 231| for(size_t i = 0; i < sizeof(*m); i++) { ------------------ | Branch (103:21): [True: 224, False: 7] ------------------ 104| 224| ct->c1.raw[i] ^= m->raw[i]; 105| 224| } 106| | 107| 7| print("e0: ", (const uint64_t *)PE0_RAW(e), R_BITS); 108| 7| print("e1: ", (const uint64_t *)PE1_RAW(e), R_BITS); 109| 7| print("c0: ", (uint64_t *)ct->c0.raw, R_BITS); 110| 7| print("c1: ", (uint64_t *)ct->c1.raw, M_BITS); 111| | 112| 7| return SUCCESS; ------------------ | | 12| 7|#define SUCCESS OQS_SUCCESS ------------------ 113| 7|} kem.c:function_l: 44| 14|{ 45| 14| DEFER_CLEANUP(sha_dgst_t dgst = {0}, sha_dgst_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 46| 14| DEFER_CLEANUP(e_t tmp, e_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 47| | 48| | // Take the padding away 49| 14| tmp.val[0] = e->val[0].val; 50| 14| tmp.val[1] = e->val[1].val; 51| | 52| 14| GUARD(sha(&dgst, sizeof(tmp), (uint8_t *)&tmp)); ------------------ | | 17| 14| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 14|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 14] | | ------------------ ------------------ 53| | 54| | // Truncate the SHA384 digest to a 256-bits m_t 55| 14| bike_static_assert(sizeof(dgst) >= sizeof(*out), dgst_size_lt_m_size); ------------------ | | 33| 14| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 56| 14| bike_memcpy(out->raw, dgst.u.raw, sizeof(*out)); 57| | 58| 14| return SUCCESS; ------------------ | | 12| 14|#define SUCCESS OQS_SUCCESS ------------------ 59| 14|} kem.c:function_k: 63| 14|{ 64| 14| DEFER_CLEANUP(func_k_t tmp, func_k_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 65| 14| DEFER_CLEANUP(sha_dgst_t dgst = {0}, sha_dgst_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 66| | 67| | // Copy every element, padded to the nearest byte 68| 14| tmp.m = *m; 69| 14| tmp.c0 = ct->c0; 70| 14| tmp.c1 = ct->c1; 71| | 72| 14| GUARD(sha(&dgst, sizeof(tmp), (uint8_t *)&tmp)); ------------------ | | 17| 14| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 14|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 14] | | ------------------ ------------------ 73| | 74| | // Truncate the SHA384 digest to a 256-bits value 75| | // to subsequently use it as a seed. 76| 14| bike_static_assert(sizeof(dgst) >= sizeof(*out), dgst_size_lt_out_size); ------------------ | | 33| 14| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 77| 14| bike_memcpy(out->raw, dgst.u.raw, sizeof(*out)); 78| | 79| 14| return SUCCESS; ------------------ | | 12| 14|#define SUCCESS OQS_SUCCESS ------------------ 80| 14|} kem.c:reencrypt: 116| 7|{ 117| 7| DEFER_CLEANUP(m_t tmp, m_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 118| | 119| 7| GUARD(function_l(&tmp, e)); ------------------ | | 17| 7| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 7|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 7] | | ------------------ ------------------ 120| | 121| | // m' = c1 ^ L(e') 122| 231| for(size_t i = 0; i < sizeof(*m); i++) { ------------------ | Branch (122:21): [True: 224, False: 7] ------------------ 123| 224| m->raw[i] = tmp.raw[i] ^ l_ct->c1.raw[i]; 124| 224| } 125| | 126| 7| return SUCCESS; ------------------ | | 12| 7|#define SUCCESS OQS_SUCCESS ------------------ 127| 7|} OQS_KEM_bike_l3_keypair: 133| 1|{ 134| 1| DEFER_CLEANUP(aligned_sk_t l_sk = {0}, sk_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| | 136| | // The secret key is (h0, h1), 137| | // and the public key h=(h0^-1 * h1). 138| | // Padded structures are used internally, and are required by the 139| | // decoder and the gf2x multiplication. 140| 1| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 141| 1| DEFER_CLEANUP(pad_r_t h1 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 142| 1| DEFER_CLEANUP(pad_r_t h0inv = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 143| 1| DEFER_CLEANUP(pad_r_t h = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 144| | 145| | // The randomness of the key generation 146| 1| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 147| | 148| 1| get_seeds(&seeds); ------------------ | | 128| 1|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 1| GUARD(generate_secret_key(&h0, &h1, ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 150| 1| l_sk.wlist[0].val, l_sk.wlist[1].val, 151| 1| &seeds.seed[0])); 152| | 153| | // Generate sigma 154| 1| convert_seed_to_m_type(&l_sk.sigma, &seeds.seed[1]); 155| | 156| | // Calculate the public key 157| 1| gf2x_mod_inv(&h0inv, &h0); ------------------ | | 124| 1|#define gf2x_mod_inv RENAME_FUNC_NAME(gf2x_mod_inv) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 1| gf2x_mod_mul(&h, &h1, &h0inv); ------------------ | | 60| 1|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| | 160| | // Fill the secret key data structure with contents - cancel the padding 161| 1| l_sk.bin[0] = h0.val; 162| 1| l_sk.bin[1] = h1.val; 163| 1| l_sk.pk = h.val; 164| | 165| | // Copy the data to the output buffers 166| 1| bike_memcpy(sk, &l_sk, sizeof(l_sk)); 167| 1| bike_memcpy(pk, &l_sk.pk, sizeof(l_sk.pk)); 168| | 169| 1| print("h: ", (uint64_t *)&l_sk.pk, R_BITS); 170| 1| print("h0: ", (uint64_t *)&l_sk.bin[0], R_BITS); 171| 1| print("h1: ", (uint64_t *)&l_sk.bin[1], R_BITS); 172| 1| print("h0 wlist:", (uint64_t *)&l_sk.wlist[0], SIZEOF_BITS(compressed_idx_d_t)); 173| 1| print("h1 wlist:", (uint64_t *)&l_sk.wlist[1], SIZEOF_BITS(compressed_idx_d_t)); 174| 1| print("sigma: ", (uint64_t *)l_sk.sigma.raw, M_BITS); 175| | 176| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 177| 1|} OQS_KEM_bike_l3_encaps: 185| 1|{ 186| | // Public values (they do not require cleanup on exit). 187| 1| pk_t l_pk; 188| 1| ct_t l_ct; 189| | 190| 1| DEFER_CLEANUP(m_t m, m_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 191| 1| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 192| 1| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 193| 1| DEFER_CLEANUP(pad_e_t e, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 194| | 195| | // Copy the data from the input buffer. This is required in order to avoid 196| | // alignment issues on non x86_64 processors. 197| 1| bike_memcpy(&l_pk, pk, sizeof(l_pk)); 198| | 199| 1| get_seeds(&seeds); ------------------ | | 128| 1|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 200| | 201| | // e = H(m) = H(seed[0]) 202| 1| convert_seed_to_m_type(&m, &seeds.seed[0]); 203| 1| GUARD(function_h(&e, &m, &l_pk)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 204| | 205| | // Calculate the ciphertext 206| 1| GUARD(encrypt(&l_ct, &e, &l_pk, &m)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 207| | 208| | // Generate the shared secret 209| 1| GUARD(function_k(&l_ss, &m, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 210| | 211| 1| print("ss: ", (uint64_t *)l_ss.raw, SIZEOF_BITS(l_ss)); 212| | 213| | // Copy the data to the output buffers 214| 1| bike_memcpy(ct, &l_ct, sizeof(l_ct)); 215| 1| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 216| | 217| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 218| 1|} OQS_KEM_bike_l3_decaps: 226| 1|{ 227| | // Public values, does not require a cleanup on exit 228| 1| ct_t l_ct; 229| | 230| 1| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 231| 1| DEFER_CLEANUP(aligned_sk_t l_sk, sk_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 232| 1| DEFER_CLEANUP(e_t e, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 233| 1| DEFER_CLEANUP(m_t m_prime, m_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 234| 1| DEFER_CLEANUP(pad_e_t e_tmp, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 235| 1| DEFER_CLEANUP(pad_e_t e_prime = {0}, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 236| | 237| | // Copy the data from the input buffers. This is required in order to avoid 238| | // alignment issues on non x86_64 processors. 239| 1| bike_memcpy(&l_ct, ct, sizeof(l_ct)); 240| 1| bike_memcpy(&l_sk, sk, sizeof(l_sk)); 241| | 242| | // Decode. 243| 1| decode(&e, &l_ct, &l_sk); ------------------ | | 57| 1|#define decode RENAME_FUNC_NAME(decode) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| | 245| | // Copy the error vector in the padded struct. 246| 1| e_prime.val[0].val = e.val[0]; 247| 1| e_prime.val[1].val = e.val[1]; 248| | 249| 1| GUARD(reencrypt(&m_prime, &e_prime, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 250| | 251| | // Check if H(m') is equal to (e0', e1') 252| | // (in constant-time) 253| 1| GUARD(function_h(&e_tmp, &m_prime, &l_sk.pk)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 254| 1| uint32_t success_cond; 255| 1| success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 1|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 1|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 1|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 1|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 256| 1| success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 1|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 1|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 1|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 1|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 257| | 258| | // Compute either K(m', C) or K(sigma, C) based on the success condition 259| 1| uint32_t mask = secure_l32_mask(0, success_cond); 260| 33| for(size_t i = 0; i < M_BYTES; i++) { ------------------ | | 104| 33|#define M_BYTES (M_BITS / 8) | | ------------------ | | | | 103| 33|#define M_BITS 256 | | ------------------ ------------------ | Branch (260:21): [True: 32, False: 1] ------------------ 261| 32| m_prime.raw[i] &= u8_barrier(~mask); 262| 32| m_prime.raw[i] |= (u8_barrier(mask) & l_sk.sigma.raw[i]); 263| 32| } 264| | 265| | // Generate the shared secret 266| 1| GUARD(function_k(&l_ss, &m_prime, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 267| | 268| | // Copy the data into the output buffer 269| 1| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 270| | 271| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 272| 1|} kem.c:OQS_KEM_bike_l3_function_h: 31| 2|{ 32| 2| DEFER_CLEANUP(seed_t seed = {0}, seed_cleanup); ------------------ | | 16| 2| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 33| | // pk is unused parameter in this case so we do this to avoid 34| | // clang sanitizers complaining. 35| 2| (void)pk; 36| | 37| 2| convert_m_to_seed_type(&seed, m); 38| | 39| 2| return generate_error_vector(e, &seed); ------------------ | | 132| 2|#define generate_error_vector RENAME_FUNC_NAME(generate_error_vector) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 40| 2|} OQS_KEM_bike_l5_keypair: 133| 1|{ 134| 1| DEFER_CLEANUP(aligned_sk_t l_sk = {0}, sk_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| | 136| | // The secret key is (h0, h1), 137| | // and the public key h=(h0^-1 * h1). 138| | // Padded structures are used internally, and are required by the 139| | // decoder and the gf2x multiplication. 140| 1| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 141| 1| DEFER_CLEANUP(pad_r_t h1 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 142| 1| DEFER_CLEANUP(pad_r_t h0inv = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 143| 1| DEFER_CLEANUP(pad_r_t h = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 144| | 145| | // The randomness of the key generation 146| 1| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 147| | 148| 1| get_seeds(&seeds); ------------------ | | 128| 1|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 1| GUARD(generate_secret_key(&h0, &h1, ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 150| 1| l_sk.wlist[0].val, l_sk.wlist[1].val, 151| 1| &seeds.seed[0])); 152| | 153| | // Generate sigma 154| 1| convert_seed_to_m_type(&l_sk.sigma, &seeds.seed[1]); 155| | 156| | // Calculate the public key 157| 1| gf2x_mod_inv(&h0inv, &h0); ------------------ | | 124| 1|#define gf2x_mod_inv RENAME_FUNC_NAME(gf2x_mod_inv) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 1| gf2x_mod_mul(&h, &h1, &h0inv); ------------------ | | 60| 1|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| | 160| | // Fill the secret key data structure with contents - cancel the padding 161| 1| l_sk.bin[0] = h0.val; 162| 1| l_sk.bin[1] = h1.val; 163| 1| l_sk.pk = h.val; 164| | 165| | // Copy the data to the output buffers 166| 1| bike_memcpy(sk, &l_sk, sizeof(l_sk)); 167| 1| bike_memcpy(pk, &l_sk.pk, sizeof(l_sk.pk)); 168| | 169| 1| print("h: ", (uint64_t *)&l_sk.pk, R_BITS); 170| 1| print("h0: ", (uint64_t *)&l_sk.bin[0], R_BITS); 171| 1| print("h1: ", (uint64_t *)&l_sk.bin[1], R_BITS); 172| 1| print("h0 wlist:", (uint64_t *)&l_sk.wlist[0], SIZEOF_BITS(compressed_idx_d_t)); 173| 1| print("h1 wlist:", (uint64_t *)&l_sk.wlist[1], SIZEOF_BITS(compressed_idx_d_t)); 174| 1| print("sigma: ", (uint64_t *)l_sk.sigma.raw, M_BITS); 175| | 176| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 177| 1|} OQS_KEM_bike_l5_encaps: 185| 1|{ 186| | // Public values (they do not require cleanup on exit). 187| 1| pk_t l_pk; 188| 1| ct_t l_ct; 189| | 190| 1| DEFER_CLEANUP(m_t m, m_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 191| 1| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 192| 1| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 193| 1| DEFER_CLEANUP(pad_e_t e, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 194| | 195| | // Copy the data from the input buffer. This is required in order to avoid 196| | // alignment issues on non x86_64 processors. 197| 1| bike_memcpy(&l_pk, pk, sizeof(l_pk)); 198| | 199| 1| get_seeds(&seeds); ------------------ | | 128| 1|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 200| | 201| | // e = H(m) = H(seed[0]) 202| 1| convert_seed_to_m_type(&m, &seeds.seed[0]); 203| 1| GUARD(function_h(&e, &m, &l_pk)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 204| | 205| | // Calculate the ciphertext 206| 1| GUARD(encrypt(&l_ct, &e, &l_pk, &m)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 207| | 208| | // Generate the shared secret 209| 1| GUARD(function_k(&l_ss, &m, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 210| | 211| 1| print("ss: ", (uint64_t *)l_ss.raw, SIZEOF_BITS(l_ss)); 212| | 213| | // Copy the data to the output buffers 214| 1| bike_memcpy(ct, &l_ct, sizeof(l_ct)); 215| 1| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 216| | 217| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 218| 1|} OQS_KEM_bike_l5_decaps: 226| 1|{ 227| | // Public values, does not require a cleanup on exit 228| 1| ct_t l_ct; 229| | 230| 1| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 231| 1| DEFER_CLEANUP(aligned_sk_t l_sk, sk_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 232| 1| DEFER_CLEANUP(e_t e, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 233| 1| DEFER_CLEANUP(m_t m_prime, m_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 234| 1| DEFER_CLEANUP(pad_e_t e_tmp, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 235| 1| DEFER_CLEANUP(pad_e_t e_prime = {0}, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 236| | 237| | // Copy the data from the input buffers. This is required in order to avoid 238| | // alignment issues on non x86_64 processors. 239| 1| bike_memcpy(&l_ct, ct, sizeof(l_ct)); 240| 1| bike_memcpy(&l_sk, sk, sizeof(l_sk)); 241| | 242| | // Decode. 243| 1| decode(&e, &l_ct, &l_sk); ------------------ | | 57| 1|#define decode RENAME_FUNC_NAME(decode) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| | 245| | // Copy the error vector in the padded struct. 246| 1| e_prime.val[0].val = e.val[0]; 247| 1| e_prime.val[1].val = e.val[1]; 248| | 249| 1| GUARD(reencrypt(&m_prime, &e_prime, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 250| | 251| | // Check if H(m') is equal to (e0', e1') 252| | // (in constant-time) 253| 1| GUARD(function_h(&e_tmp, &m_prime, &l_sk.pk)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 254| 1| uint32_t success_cond; 255| 1| success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 1|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 1|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 1|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 1|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 256| 1| success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 1|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 1|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 1|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 1|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 257| | 258| | // Compute either K(m', C) or K(sigma, C) based on the success condition 259| 1| uint32_t mask = secure_l32_mask(0, success_cond); 260| 33| for(size_t i = 0; i < M_BYTES; i++) { ------------------ | | 104| 33|#define M_BYTES (M_BITS / 8) | | ------------------ | | | | 103| 33|#define M_BITS 256 | | ------------------ ------------------ | Branch (260:21): [True: 32, False: 1] ------------------ 261| 32| m_prime.raw[i] &= u8_barrier(~mask); 262| 32| m_prime.raw[i] |= (u8_barrier(mask) & l_sk.sigma.raw[i]); 263| 32| } 264| | 265| | // Generate the shared secret 266| 1| GUARD(function_k(&l_ss, &m_prime, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 267| | 268| | // Copy the data into the output buffer 269| 1| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 270| | 271| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 272| 1|} kem.c:OQS_KEM_bike_l5_function_h: 31| 2|{ 32| 2| DEFER_CLEANUP(seed_t seed = {0}, seed_cleanup); ------------------ | | 16| 2| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 33| | // pk is unused parameter in this case so we do this to avoid 34| | // clang sanitizers complaining. 35| 2| (void)pk; 36| | 37| 2| convert_m_to_seed_type(&seed, m); 38| | 39| 2| return generate_error_vector(e, &seed); ------------------ | | 132| 2|#define generate_error_vector RENAME_FUNC_NAME(generate_error_vector) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 40| 2|} OQS_KEM_bike_l1_get_seeds: 17| 10|{ 18| 10| OQS_randombytes((uint8_t *)seeds, NUM_OF_SEEDS * sizeof(seed_t)); ------------------ | | 76| 10|#define NUM_OF_SEEDS 2 ------------------ 19| | 20| 30| for(uint32_t i = 0; i < NUM_OF_SEEDS; ++i) { ------------------ | | 76| 30|#define NUM_OF_SEEDS 2 ------------------ | Branch (20:23): [True: 20, False: 10] ------------------ 21| 20| print("s: ", (uint64_t *)&seeds->seed[i], SIZEOF_BITS(seed_t)); 22| 20| } 23| 10|} OQS_KEM_bike_l1_sample_indices_fisher_yates: 60| 20| IN OUT prf_state_t *prf_state) { 61| | 62| 2.07k| for (size_t i = num_indices; i-- > 0;) { ------------------ | Branch (62:34): [True: 2.05k, False: 20] ------------------ 63| 2.05k|#define CWW_RAND_BYTES 4 64| 2.05k| uint64_t rand = 0ULL; 65| 2.05k| GUARD(get_prf_output((uint8_t *)&rand, prf_state, CWW_RAND_BYTES)); ------------------ | | 17| 2.05k| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2.05k|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2.05k] | | ------------------ ------------------ 66| 2.05k| rand *= (max_idx_val - i); 67| | 68| | // new index l is such that i <= l < max_idx_val 69| 2.05k| uint32_t l = i + (uint32_t)(rand >> (CWW_RAND_BYTES * 8)); ------------------ | | 63| 2.05k|#define CWW_RAND_BYTES 4 ------------------ 70| | 71| | // Loop over (the end of) the output array to determine if l is a duplicate 72| 2.05k| uint32_t is_dup = 0; 73| 116k| for (size_t j = i + 1; j < num_indices; ++j) { ------------------ | Branch (73:32): [True: 113k, False: 2.05k] ------------------ 74| 113k| is_dup |= secure_cmp32(l, out[j]); 75| 113k| } 76| | 77| | // if l is a duplicate out[i] gets i else out[i] gets l 78| | // mask is all 1 if l is a duplicate, all 0 else 79| 2.05k| uint32_t mask = -is_dup; 80| 2.05k| out[i] = (mask & i) ^ (~mask & l); 81| 2.05k| } 82| | 83| 20| return SUCCESS; ------------------ | | 12| 20|#define SUCCESS OQS_SUCCESS ------------------ 84| 20|} OQS_KEM_bike_l1_generate_secret_key: 105| 5|{ 106| | // Initialize the sampling context. 107| 5| sampling_ctx ctx = {0}; 108| 5| sampling_ctx_init(&ctx); ------------------ | | 138| 5|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 109| | 110| 5| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 111| | 112| 5| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 113| | 114| 5| GUARD(generate_sparse_rep_for_sk(h0, h0_wlist, &prf_state, &ctx)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 115| 5| GUARD(generate_sparse_rep_for_sk(h1, h1_wlist, &prf_state, &ctx)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 116| | 117| 5| return SUCCESS; ------------------ | | 12| 5|#define SUCCESS OQS_SUCCESS ------------------ 118| 5|} OQS_KEM_bike_l1_generate_error_vector: 121| 10|{ 122| | // Initialize the sampling context. 123| 10| sampling_ctx ctx; 124| 10| sampling_ctx_init(&ctx); ------------------ | | 138| 10|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 10|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 10|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 10|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 10| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 10| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 127| | 128| 10| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 10| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 10|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 10] | | ------------------ ------------------ 129| | 130| 10| idx_t wlist[T]; 131| 10| GUARD(sample_indices_fisher_yates(wlist, T, N_BITS, &prf_state)); ------------------ | | 17| 10| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 10|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 10] | | ------------------ ------------------ 132| | 133| | // (e0, e1) hold bits 0..R_BITS-1 and R_BITS..2*R_BITS-1 of the error, resp. 134| 10| ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 61| 10|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 10|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 10|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 10|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 25| 10|# define T 134 ------------------ 135| 10| ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 61| 10|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 10|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 10|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 10|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 23| 10|# define R_BITS 12323 ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 25| 10|# define T 134 ------------------ 136| | 137| | // Clean the padding of the elements. 138| 10| PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 95| 10|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 10|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 10|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 10|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 139| 10| PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 96| 10|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 10|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 10|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 10|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 140| 10| bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 95| 10|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 10|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 10|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 10|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 10|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 141| 10| bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 96| 10|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 10|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 10|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 10|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 10|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 142| | 143| 10| secure_clean((uint8_t *)wlist, sizeof(wlist)); ------------------ | | 33| 10|#define secure_clean OQS_MEM_cleanse ------------------ 144| | 145| 10| return SUCCESS; ------------------ | | 12| 10|#define SUCCESS OQS_SUCCESS ------------------ 146| 10|} sampling.c:OQS_KEM_bike_l1_generate_sparse_rep_for_sk: 90| 10|{ 91| 10| idx_t wlist_temp[D] = {0}; 92| | 93| 10| GUARD(sample_indices_fisher_yates(wlist_temp, D, R_BITS, prf_state)); ------------------ | | 17| 10| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 10|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 10] | | ------------------ ------------------ 94| | 95| 10| bike_memcpy(wlist, wlist_temp, D * sizeof(idx_t)); ------------------ | | 24| 10|# define D 71 ------------------ 96| 10| ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 61| 10|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 10|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 10|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 10|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 24| 10|# define D 71 ------------------ 97| | 98| 10| secure_clean((uint8_t *)wlist_temp, sizeof(wlist_temp)); ------------------ | | 33| 10|#define secure_clean OQS_MEM_cleanse ------------------ 99| 10| return SUCCESS; ------------------ | | 12| 10|#define SUCCESS OQS_SUCCESS ------------------ 100| 10|} OQS_KEM_bike_l3_get_seeds: 17| 2|{ 18| 2| OQS_randombytes((uint8_t *)seeds, NUM_OF_SEEDS * sizeof(seed_t)); ------------------ | | 76| 2|#define NUM_OF_SEEDS 2 ------------------ 19| | 20| 6| for(uint32_t i = 0; i < NUM_OF_SEEDS; ++i) { ------------------ | | 76| 6|#define NUM_OF_SEEDS 2 ------------------ | Branch (20:23): [True: 4, False: 2] ------------------ 21| 4| print("s: ", (uint64_t *)&seeds->seed[i], SIZEOF_BITS(seed_t)); 22| 4| } 23| 2|} OQS_KEM_bike_l3_sample_indices_fisher_yates: 60| 4| IN OUT prf_state_t *prf_state) { 61| | 62| 608| for (size_t i = num_indices; i-- > 0;) { ------------------ | Branch (62:34): [True: 604, False: 4] ------------------ 63| 604|#define CWW_RAND_BYTES 4 64| 604| uint64_t rand = 0ULL; 65| 604| GUARD(get_prf_output((uint8_t *)&rand, prf_state, CWW_RAND_BYTES)); ------------------ | | 17| 604| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 604|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 604] | | ------------------ ------------------ 66| 604| rand *= (max_idx_val - i); 67| | 68| | // new index l is such that i <= l < max_idx_val 69| 604| uint32_t l = i + (uint32_t)(rand >> (CWW_RAND_BYTES * 8)); ------------------ | | 63| 604|#define CWW_RAND_BYTES 4 ------------------ 70| | 71| | // Loop over (the end of) the output array to determine if l is a duplicate 72| 604| uint32_t is_dup = 0; 73| 50.5k| for (size_t j = i + 1; j < num_indices; ++j) { ------------------ | Branch (73:32): [True: 49.9k, False: 604] ------------------ 74| 49.9k| is_dup |= secure_cmp32(l, out[j]); 75| 49.9k| } 76| | 77| | // if l is a duplicate out[i] gets i else out[i] gets l 78| | // mask is all 1 if l is a duplicate, all 0 else 79| 604| uint32_t mask = -is_dup; 80| 604| out[i] = (mask & i) ^ (~mask & l); 81| 604| } 82| | 83| 4| return SUCCESS; ------------------ | | 12| 4|#define SUCCESS OQS_SUCCESS ------------------ 84| 4|} OQS_KEM_bike_l3_generate_secret_key: 105| 1|{ 106| | // Initialize the sampling context. 107| 1| sampling_ctx ctx = {0}; 108| 1| sampling_ctx_init(&ctx); ------------------ | | 138| 1|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 109| | 110| 1| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 111| | 112| 1| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 113| | 114| 1| GUARD(generate_sparse_rep_for_sk(h0, h0_wlist, &prf_state, &ctx)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 115| 1| GUARD(generate_sparse_rep_for_sk(h1, h1_wlist, &prf_state, &ctx)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 116| | 117| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 118| 1|} OQS_KEM_bike_l3_generate_error_vector: 121| 2|{ 122| | // Initialize the sampling context. 123| 2| sampling_ctx ctx; 124| 2| sampling_ctx_init(&ctx); ------------------ | | 138| 2|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 2| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 2| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 127| | 128| 2| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 129| | 130| 2| idx_t wlist[T]; 131| 2| GUARD(sample_indices_fisher_yates(wlist, T, N_BITS, &prf_state)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 132| | 133| | // (e0, e1) hold bits 0..R_BITS-1 and R_BITS..2*R_BITS-1 of the error, resp. 134| 2| ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 45| 2|# define T 199 ------------------ 135| 2| ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 43| 2|# define R_BITS 24659 ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 45| 2|# define T 199 ------------------ 136| | 137| | // Clean the padding of the elements. 138| 2| PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 95| 2|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 2|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 2|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 2|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 139| 2| PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 96| 2|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 2|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 2|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 2|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 140| 2| bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 95| 2|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 2|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 2|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 2|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 2|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 141| 2| bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 96| 2|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 2|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 2|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 2|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 2|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 142| | 143| 2| secure_clean((uint8_t *)wlist, sizeof(wlist)); ------------------ | | 33| 2|#define secure_clean OQS_MEM_cleanse ------------------ 144| | 145| 2| return SUCCESS; ------------------ | | 12| 2|#define SUCCESS OQS_SUCCESS ------------------ 146| 2|} sampling.c:OQS_KEM_bike_l3_generate_sparse_rep_for_sk: 90| 2|{ 91| 2| idx_t wlist_temp[D] = {0}; 92| | 93| 2| GUARD(sample_indices_fisher_yates(wlist_temp, D, R_BITS, prf_state)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 94| | 95| 2| bike_memcpy(wlist, wlist_temp, D * sizeof(idx_t)); ------------------ | | 44| 2|# define D 103 ------------------ 96| 2| ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 44| 2|# define D 103 ------------------ 97| | 98| 2| secure_clean((uint8_t *)wlist_temp, sizeof(wlist_temp)); ------------------ | | 33| 2|#define secure_clean OQS_MEM_cleanse ------------------ 99| 2| return SUCCESS; ------------------ | | 12| 2|#define SUCCESS OQS_SUCCESS ------------------ 100| 2|} OQS_KEM_bike_l5_get_seeds: 17| 2|{ 18| 2| OQS_randombytes((uint8_t *)seeds, NUM_OF_SEEDS * sizeof(seed_t)); ------------------ | | 76| 2|#define NUM_OF_SEEDS 2 ------------------ 19| | 20| 6| for(uint32_t i = 0; i < NUM_OF_SEEDS; ++i) { ------------------ | | 76| 6|#define NUM_OF_SEEDS 2 ------------------ | Branch (20:23): [True: 4, False: 2] ------------------ 21| 4| print("s: ", (uint64_t *)&seeds->seed[i], SIZEOF_BITS(seed_t)); 22| 4| } 23| 2|} OQS_KEM_bike_l5_sample_indices_fisher_yates: 60| 4| IN OUT prf_state_t *prf_state) { 61| | 62| 806| for (size_t i = num_indices; i-- > 0;) { ------------------ | Branch (62:34): [True: 802, False: 4] ------------------ 63| 802|#define CWW_RAND_BYTES 4 64| 802| uint64_t rand = 0ULL; 65| 802| GUARD(get_prf_output((uint8_t *)&rand, prf_state, CWW_RAND_BYTES)); ------------------ | | 17| 802| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 802|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 802] | | ------------------ ------------------ 66| 802| rand *= (max_idx_val - i); 67| | 68| | // new index l is such that i <= l < max_idx_val 69| 802| uint32_t l = i + (uint32_t)(rand >> (CWW_RAND_BYTES * 8)); ------------------ | | 63| 802|#define CWW_RAND_BYTES 4 ------------------ 70| | 71| | // Loop over (the end of) the output array to determine if l is a duplicate 72| 802| uint32_t is_dup = 0; 73| 88.8k| for (size_t j = i + 1; j < num_indices; ++j) { ------------------ | Branch (73:32): [True: 88.0k, False: 802] ------------------ 74| 88.0k| is_dup |= secure_cmp32(l, out[j]); 75| 88.0k| } 76| | 77| | // if l is a duplicate out[i] gets i else out[i] gets l 78| | // mask is all 1 if l is a duplicate, all 0 else 79| 802| uint32_t mask = -is_dup; 80| 802| out[i] = (mask & i) ^ (~mask & l); 81| 802| } 82| | 83| 4| return SUCCESS; ------------------ | | 12| 4|#define SUCCESS OQS_SUCCESS ------------------ 84| 4|} OQS_KEM_bike_l5_generate_secret_key: 105| 1|{ 106| | // Initialize the sampling context. 107| 1| sampling_ctx ctx = {0}; 108| 1| sampling_ctx_init(&ctx); ------------------ | | 138| 1|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 109| | 110| 1| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 111| | 112| 1| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 113| | 114| 1| GUARD(generate_sparse_rep_for_sk(h0, h0_wlist, &prf_state, &ctx)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 115| 1| GUARD(generate_sparse_rep_for_sk(h1, h1_wlist, &prf_state, &ctx)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 116| | 117| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 118| 1|} OQS_KEM_bike_l5_generate_error_vector: 121| 2|{ 122| | // Initialize the sampling context. 123| 2| sampling_ctx ctx; 124| 2| sampling_ctx_init(&ctx); ------------------ | | 138| 2|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 2| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 2| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 127| | 128| 2| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 129| | 130| 2| idx_t wlist[T]; 131| 2| GUARD(sample_indices_fisher_yates(wlist, T, N_BITS, &prf_state)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 132| | 133| | // (e0, e1) hold bits 0..R_BITS-1 and R_BITS..2*R_BITS-1 of the error, resp. 134| 2| ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 61| 2|# define T 264 ------------------ 135| 2| ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 59| 2|# define R_BITS 40973 ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 61| 2|# define T 264 ------------------ 136| | 137| | // Clean the padding of the elements. 138| 2| PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 95| 2|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 2|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 2|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 2|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 139| 2| PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 96| 2|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 2|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 2|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 2|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 140| 2| bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 95| 2|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 2|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 2|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 2|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 2|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 141| 2| bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 96| 2|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 2|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 2|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 2|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 2|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 142| | 143| 2| secure_clean((uint8_t *)wlist, sizeof(wlist)); ------------------ | | 33| 2|#define secure_clean OQS_MEM_cleanse ------------------ 144| | 145| 2| return SUCCESS; ------------------ | | 12| 2|#define SUCCESS OQS_SUCCESS ------------------ 146| 2|} sampling.c:OQS_KEM_bike_l5_generate_sparse_rep_for_sk: 90| 2|{ 91| 2| idx_t wlist_temp[D] = {0}; 92| | 93| 2| GUARD(sample_indices_fisher_yates(wlist_temp, D, R_BITS, prf_state)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 94| | 95| 2| bike_memcpy(wlist, wlist_temp, D * sizeof(idx_t)); ------------------ | | 60| 2|# define D 137 ------------------ 96| 2| ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 60| 2|# define D 137 ------------------ 97| | 98| 2| secure_clean((uint8_t *)wlist_temp, sizeof(wlist_temp)); ------------------ | | 33| 2|#define secure_clean OQS_MEM_cleanse ------------------ 99| 2| return SUCCESS; ------------------ | | 12| 2|#define SUCCESS OQS_SUCCESS ------------------ 100| 2|} OQS_KEM_bike_l1_secure_set_bits_avx2: 23| 30|{ 24| | // The function assumes that the size of r is a multiple 25| | // of the cumulative size of used YMM registers. 26| 30| assert((sizeof(*r) / sizeof(uint64_t)) % YMMS_QWORDS == 0); 27| | 28| | // va vectors hold the bits of the output array "r" 29| | // va_pos_qw vectors hold the qw position indices of "r" 30| | // The algorithm works as follows: 31| | // 1. Initialize va_pos_qw with starting positions of qw's of "r" 32| | // va_pos_qw = (3, 2, 1, 0); 33| | // 2. While the size of "r" is not exceeded: 34| | // 3. For each w in wlist: 35| | // 4. Compare the pos_qw of w with positions in va_pos_qw 36| | // and for the position which is equal set the appropriate 37| | // bit in va vector. 38| | // 5. Set va_pos_qw to the next qw positions of "r" 39| 30| __m256i va[NUM_YMMS], va_pos_qw[NUM_YMMS], va_mask; 40| 30| __m256i w_pos_qw, w_pos_bit; 41| 30| __m256i one, inc; 42| | 43| 30| uint64_t *r64 = (uint64_t *)r; 44| | 45| 30| one = SET1_I64(1); ------------------ | | 71| 30|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 46| 30| inc = SET1_I64(QWORDS_IN_YMM); ------------------ | | 71| 30|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 47| | 48| | // 1. Initialize 49| 30| va_pos_qw[0] = SET_I64(3, 2, 1, 0); ------------------ | | 67| 30|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 50| 120| for(size_t i = 1; i < NUM_YMMS; i++) { ------------------ | | 16| 120|#define NUM_YMMS (4) ------------------ | Branch (50:21): [True: 90, False: 30] ------------------ 51| 90| va_pos_qw[i] = ADD_I64(va_pos_qw[i - 1], inc); ------------------ | | 80| 90|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 52| 90| } 53| | 54| | // va_pos_qw vectors hold qw positions 0 .. (NUM_YMMS * QWORDS_IN_YMM - 1) 55| | // Therefore, we set the increment vector inc such that by adding it to 56| | // va_pos_qw vectors, they hold the next YMM_QWORDS qw positions. 57| 30| inc = SET1_I64(YMMS_QWORDS); ------------------ | | 71| 30|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 58| | 59| 510| for(size_t i = 0; i < (sizeof(*r) / sizeof(uint64_t)); i += YMMS_QWORDS) { ------------------ | | 17| 480|#define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 61| 480|#define QWORDS_IN_YMM (BYTES_IN_YMM / sizeof(uint64_t)) | | | | ------------------ | | | | | | 48| 480|#define BYTES_IN_YMM 0x20 | | | | ------------------ | | ------------------ | | #define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 16| 480|#define NUM_YMMS (4) | | ------------------ ------------------ | Branch (59:21): [True: 480, False: 30] ------------------ 60| 2.40k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 2.40k|#define NUM_YMMS (4) ------------------ | Branch (60:29): [True: 1.92k, False: 480] ------------------ 61| 1.92k| va[va_iter] = SET_ZERO; ------------------ | | 72| 1.92k|# define SET_ZERO _mm256_setzero_si256() ------------------ 62| 1.92k| } 63| | 64| 54.7k| for(size_t w_iter = 0; w_iter < w_size; w_iter++) { ------------------ | Branch (64:28): [True: 54.2k, False: 480] ------------------ 65| 54.2k| int32_t w = wlist[w_iter] - first_pos; 66| 54.2k| w_pos_qw = SET1_I64(w >> 6); ------------------ | | 71| 54.2k|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 67| 54.2k| w_pos_bit = SLLI_I64(one, w & MASK(6)); ------------------ | | 31| 54.2k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 68| | 69| | // 4. Compare the positions in va_pos_qw with w_pos_qw 70| | // and set the appropriate bit in va 71| 271k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 271k|#define NUM_YMMS (4) ------------------ | Branch (71:31): [True: 216k, False: 54.2k] ------------------ 72| 216k| va_mask = CMPEQ_I64(va_pos_qw[va_iter], w_pos_qw); ------------------ | | 89| 216k|# define CMPEQ_I64(a, b) _mm256_cmpeq_epi64(a, b) ------------------ 73| 216k| va[va_iter] |= (va_mask & w_pos_bit); 74| 216k| } 75| 54.2k| } 76| | 77| | // 5. Set the va_pos_qw to the next qw positions of r 78| | // and store the previously computed data in r 79| 2.40k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 2.40k|#define NUM_YMMS (4) ------------------ | Branch (79:29): [True: 1.92k, False: 480] ------------------ 80| 1.92k| STORE(&r64[i + (va_iter * QWORDS_IN_YMM)], va[va_iter]); ------------------ | | 29| 1.92k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 81| 1.92k| va_pos_qw[va_iter] = ADD_I64(va_pos_qw[va_iter], inc); ------------------ | | 80| 1.92k|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 82| 1.92k| } 83| 480| } 84| 30|} OQS_KEM_bike_l3_secure_set_bits_avx2: 23| 6|{ 24| | // The function assumes that the size of r is a multiple 25| | // of the cumulative size of used YMM registers. 26| 6| assert((sizeof(*r) / sizeof(uint64_t)) % YMMS_QWORDS == 0); 27| | 28| | // va vectors hold the bits of the output array "r" 29| | // va_pos_qw vectors hold the qw position indices of "r" 30| | // The algorithm works as follows: 31| | // 1. Initialize va_pos_qw with starting positions of qw's of "r" 32| | // va_pos_qw = (3, 2, 1, 0); 33| | // 2. While the size of "r" is not exceeded: 34| | // 3. For each w in wlist: 35| | // 4. Compare the pos_qw of w with positions in va_pos_qw 36| | // and for the position which is equal set the appropriate 37| | // bit in va vector. 38| | // 5. Set va_pos_qw to the next qw positions of "r" 39| 6| __m256i va[NUM_YMMS], va_pos_qw[NUM_YMMS], va_mask; 40| 6| __m256i w_pos_qw, w_pos_bit; 41| 6| __m256i one, inc; 42| | 43| 6| uint64_t *r64 = (uint64_t *)r; 44| | 45| 6| one = SET1_I64(1); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 46| 6| inc = SET1_I64(QWORDS_IN_YMM); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 47| | 48| | // 1. Initialize 49| 6| va_pos_qw[0] = SET_I64(3, 2, 1, 0); ------------------ | | 67| 6|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 50| 24| for(size_t i = 1; i < NUM_YMMS; i++) { ------------------ | | 16| 24|#define NUM_YMMS (4) ------------------ | Branch (50:21): [True: 18, False: 6] ------------------ 51| 18| va_pos_qw[i] = ADD_I64(va_pos_qw[i - 1], inc); ------------------ | | 80| 18|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 52| 18| } 53| | 54| | // va_pos_qw vectors hold qw positions 0 .. (NUM_YMMS * QWORDS_IN_YMM - 1) 55| | // Therefore, we set the increment vector inc such that by adding it to 56| | // va_pos_qw vectors, they hold the next YMM_QWORDS qw positions. 57| 6| inc = SET1_I64(YMMS_QWORDS); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 58| | 59| 198| for(size_t i = 0; i < (sizeof(*r) / sizeof(uint64_t)); i += YMMS_QWORDS) { ------------------ | | 17| 192|#define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 61| 192|#define QWORDS_IN_YMM (BYTES_IN_YMM / sizeof(uint64_t)) | | | | ------------------ | | | | | | 48| 192|#define BYTES_IN_YMM 0x20 | | | | ------------------ | | ------------------ | | #define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 16| 192|#define NUM_YMMS (4) | | ------------------ ------------------ | Branch (59:21): [True: 192, False: 6] ------------------ 60| 960| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 960|#define NUM_YMMS (4) ------------------ | Branch (60:29): [True: 768, False: 192] ------------------ 61| 768| va[va_iter] = SET_ZERO; ------------------ | | 72| 768|# define SET_ZERO _mm256_setzero_si256() ------------------ 62| 768| } 63| | 64| 32.2k| for(size_t w_iter = 0; w_iter < w_size; w_iter++) { ------------------ | Branch (64:28): [True: 32.0k, False: 192] ------------------ 65| 32.0k| int32_t w = wlist[w_iter] - first_pos; 66| 32.0k| w_pos_qw = SET1_I64(w >> 6); ------------------ | | 71| 32.0k|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 67| 32.0k| w_pos_bit = SLLI_I64(one, w & MASK(6)); ------------------ | | 31| 32.0k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 68| | 69| | // 4. Compare the positions in va_pos_qw with w_pos_qw 70| | // and set the appropriate bit in va 71| 160k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 160k|#define NUM_YMMS (4) ------------------ | Branch (71:31): [True: 128k, False: 32.0k] ------------------ 72| 128k| va_mask = CMPEQ_I64(va_pos_qw[va_iter], w_pos_qw); ------------------ | | 89| 128k|# define CMPEQ_I64(a, b) _mm256_cmpeq_epi64(a, b) ------------------ 73| 128k| va[va_iter] |= (va_mask & w_pos_bit); 74| 128k| } 75| 32.0k| } 76| | 77| | // 5. Set the va_pos_qw to the next qw positions of r 78| | // and store the previously computed data in r 79| 960| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 960|#define NUM_YMMS (4) ------------------ | Branch (79:29): [True: 768, False: 192] ------------------ 80| 768| STORE(&r64[i + (va_iter * QWORDS_IN_YMM)], va[va_iter]); ------------------ | | 29| 768|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 81| 768| va_pos_qw[va_iter] = ADD_I64(va_pos_qw[va_iter], inc); ------------------ | | 80| 768|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 82| 768| } 83| 192| } 84| 6|} OQS_KEM_bike_l5_secure_set_bits_avx2: 23| 6|{ 24| | // The function assumes that the size of r is a multiple 25| | // of the cumulative size of used YMM registers. 26| 6| assert((sizeof(*r) / sizeof(uint64_t)) % YMMS_QWORDS == 0); 27| | 28| | // va vectors hold the bits of the output array "r" 29| | // va_pos_qw vectors hold the qw position indices of "r" 30| | // The algorithm works as follows: 31| | // 1. Initialize va_pos_qw with starting positions of qw's of "r" 32| | // va_pos_qw = (3, 2, 1, 0); 33| | // 2. While the size of "r" is not exceeded: 34| | // 3. For each w in wlist: 35| | // 4. Compare the pos_qw of w with positions in va_pos_qw 36| | // and for the position which is equal set the appropriate 37| | // bit in va vector. 38| | // 5. Set va_pos_qw to the next qw positions of "r" 39| 6| __m256i va[NUM_YMMS], va_pos_qw[NUM_YMMS], va_mask; 40| 6| __m256i w_pos_qw, w_pos_bit; 41| 6| __m256i one, inc; 42| | 43| 6| uint64_t *r64 = (uint64_t *)r; 44| | 45| 6| one = SET1_I64(1); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 46| 6| inc = SET1_I64(QWORDS_IN_YMM); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 47| | 48| | // 1. Initialize 49| 6| va_pos_qw[0] = SET_I64(3, 2, 1, 0); ------------------ | | 67| 6|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 50| 24| for(size_t i = 1; i < NUM_YMMS; i++) { ------------------ | | 16| 24|#define NUM_YMMS (4) ------------------ | Branch (50:21): [True: 18, False: 6] ------------------ 51| 18| va_pos_qw[i] = ADD_I64(va_pos_qw[i - 1], inc); ------------------ | | 80| 18|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 52| 18| } 53| | 54| | // va_pos_qw vectors hold qw positions 0 .. (NUM_YMMS * QWORDS_IN_YMM - 1) 55| | // Therefore, we set the increment vector inc such that by adding it to 56| | // va_pos_qw vectors, they hold the next YMM_QWORDS qw positions. 57| 6| inc = SET1_I64(YMMS_QWORDS); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 58| | 59| 390| for(size_t i = 0; i < (sizeof(*r) / sizeof(uint64_t)); i += YMMS_QWORDS) { ------------------ | | 17| 384|#define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 61| 384|#define QWORDS_IN_YMM (BYTES_IN_YMM / sizeof(uint64_t)) | | | | ------------------ | | | | | | 48| 384|#define BYTES_IN_YMM 0x20 | | | | ------------------ | | ------------------ | | #define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 16| 384|#define NUM_YMMS (4) | | ------------------ ------------------ | Branch (59:21): [True: 384, False: 6] ------------------ 60| 1.92k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 1.92k|#define NUM_YMMS (4) ------------------ | Branch (60:29): [True: 1.53k, False: 384] ------------------ 61| 1.53k| va[va_iter] = SET_ZERO; ------------------ | | 72| 1.53k|# define SET_ZERO _mm256_setzero_si256() ------------------ 62| 1.53k| } 63| | 64| 85.5k| for(size_t w_iter = 0; w_iter < w_size; w_iter++) { ------------------ | Branch (64:28): [True: 85.1k, False: 384] ------------------ 65| 85.1k| int32_t w = wlist[w_iter] - first_pos; 66| 85.1k| w_pos_qw = SET1_I64(w >> 6); ------------------ | | 71| 85.1k|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 67| 85.1k| w_pos_bit = SLLI_I64(one, w & MASK(6)); ------------------ | | 31| 85.1k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 68| | 69| | // 4. Compare the positions in va_pos_qw with w_pos_qw 70| | // and set the appropriate bit in va 71| 425k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 425k|#define NUM_YMMS (4) ------------------ | Branch (71:31): [True: 340k, False: 85.1k] ------------------ 72| 340k| va_mask = CMPEQ_I64(va_pos_qw[va_iter], w_pos_qw); ------------------ | | 89| 340k|# define CMPEQ_I64(a, b) _mm256_cmpeq_epi64(a, b) ------------------ 73| 340k| va[va_iter] |= (va_mask & w_pos_bit); 74| 340k| } 75| 85.1k| } 76| | 77| | // 5. Set the va_pos_qw to the next qw positions of r 78| | // and store the previously computed data in r 79| 1.92k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 1.92k|#define NUM_YMMS (4) ------------------ | Branch (79:29): [True: 1.53k, False: 384] ------------------ 80| 1.53k| STORE(&r64[i + (va_iter * QWORDS_IN_YMM)], va[va_iter]); ------------------ | | 29| 1.53k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 81| 1.53k| va_pos_qw[va_iter] = ADD_I64(va_pos_qw[va_iter], inc); ------------------ | | 80| 1.53k|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 82| 1.53k| } 83| 384| } 84| 6|} sampling.c:OQS_KEM_bike_l1_sampling_ctx_init: 39| 15|{ 40| 15|#if defined(X86_64) 41| 15|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 42| 15| if(is_avx512_enabled()) { ------------------ | | 98| 15|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (42:6): [True: 0, False: 15] ------------------ 43| 0| ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 137| 0|#define secure_set_bits_avx512 RENAME_FUNC_NAME(secure_set_bits_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| 0| } else 45| 15|#endif 46| 15|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 47| 15| if(is_avx2_enabled()) { ------------------ | | 97| 15|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (47:6): [True: 15, False: 0] ------------------ 48| 15| ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 61| 15|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 136| 15|#define secure_set_bits_avx2 RENAME_FUNC_NAME(secure_set_bits_avx2) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 49| 15| } else 50| 0|#endif 51| 0|#endif 52| 0| { 53| 0| ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 135| 0|#define secure_set_bits_port RENAME_FUNC_NAME(secure_set_bits_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 0| } 55| 15|} sampling.c:OQS_KEM_bike_l3_sampling_ctx_init: 39| 3|{ 40| 3|#if defined(X86_64) 41| 3|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 42| 3| if(is_avx512_enabled()) { ------------------ | | 98| 3|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (42:6): [True: 0, False: 3] ------------------ 43| 0| ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 137| 0|#define secure_set_bits_avx512 RENAME_FUNC_NAME(secure_set_bits_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| 0| } else 45| 3|#endif 46| 3|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 47| 3| if(is_avx2_enabled()) { ------------------ | | 97| 3|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (47:6): [True: 3, False: 0] ------------------ 48| 3| ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 61| 3|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 136| 3|#define secure_set_bits_avx2 RENAME_FUNC_NAME(secure_set_bits_avx2) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 49| 3| } else 50| 0|#endif 51| 0|#endif 52| 0| { 53| 0| ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 135| 0|#define secure_set_bits_port RENAME_FUNC_NAME(secure_set_bits_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 0| } 55| 3|} sampling.c:OQS_KEM_bike_l5_sampling_ctx_init: 39| 3|{ 40| 3|#if defined(X86_64) 41| 3|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 42| 3| if(is_avx512_enabled()) { ------------------ | | 98| 3|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (42:6): [True: 0, False: 3] ------------------ 43| 0| ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 137| 0|#define secure_set_bits_avx512 RENAME_FUNC_NAME(secure_set_bits_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| 0| } else 45| 3|#endif 46| 3|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 47| 3| if(is_avx2_enabled()) { ------------------ | | 97| 3|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (47:6): [True: 3, False: 0] ------------------ 48| 3| ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 61| 3|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 136| 3|#define secure_set_bits_avx2 RENAME_FUNC_NAME(secure_set_bits_avx2) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 49| 3| } else 50| 0|#endif 51| 0|#endif 52| 0| { 53| 0| ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 135| 0|#define secure_set_bits_port RENAME_FUNC_NAME(secure_set_bits_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 0| } 55| 3|} kem.c:sha_dgst_cleanup: 27| 28|sha_dgst_cleanup(IN OUT sha_dgst_t *o) { 28| 28| secure_clean(o->u.raw, sizeof(*o)); ------------------ | | 33| 28|#define secure_clean OQS_MEM_cleanse ------------------ 29| 28|} kem.c:OQS_KEM_bike_l1_sha: 32| 20|sha(OUT sha_dgst_t *hash_out, IN const uint32_t byte_len, IN const uint8_t *msg) { 33| 20| OQS_SHA3_sha3_384(hash_out->u.raw, msg, byte_len); 34| 20| return SUCCESS; ------------------ | | 12| 20|#define SUCCESS OQS_SUCCESS ------------------ 35| 20|} kem.c:OQS_KEM_bike_l3_sha: 32| 4|sha(OUT sha_dgst_t *hash_out, IN const uint32_t byte_len, IN const uint8_t *msg) { 33| 4| OQS_SHA3_sha3_384(hash_out->u.raw, msg, byte_len); 34| 4| return SUCCESS; ------------------ | | 12| 4|#define SUCCESS OQS_SUCCESS ------------------ 35| 4|} kem.c:OQS_KEM_bike_l5_sha: 32| 4|sha(OUT sha_dgst_t *hash_out, IN const uint32_t byte_len, IN const uint8_t *msg) { 33| 4| OQS_SHA3_sha3_384(hash_out->u.raw, msg, byte_len); 34| 4| return SUCCESS; ------------------ | | 12| 4|#define SUCCESS OQS_SUCCESS ------------------ 35| 4|} OQS_KEM_bike_l1_init_prf_state: 14| 15|{ 15| 15| if(0 == max_num_invocations) { ------------------ | Branch (15:6): [True: 0, False: 15] ------------------ 16| 0| BIKE_ERROR(E_SHAKE_PRF_INIT_FAIL); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 17| 0| } 18| | 19| 15| OQS_SHA3_shake256_inc_init(&s->s); 20| | 21| | // Initialize the SHAKE state with the given seed. 22| 15| OQS_SHA3_shake256_inc_absorb(&s->s, seed->raw, sizeof(*seed)); 23| | 24| 15| OQS_SHA3_shake256_inc_finalize(&s->s); 25| | 26| | // Initialize the PRF parameters. 27| 15| s->curr_pos_in_buffer = OQS_SHA3_SHAKE256_RATE; ------------------ | | 320| 15|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 28| 15| s->rem_invocations = max_num_invocations; 29| | 30| 15| return SUCCESS; ------------------ | | 12| 15|#define SUCCESS OQS_SUCCESS ------------------ 31| 15|} OQS_KEM_bike_l1_get_prf_output: 35| 2.05k|{ 36| | // Check if the maximum number of SHAKE invocations is reached. 37| 2.05k| if (s->rem_invocations == 0) ------------------ | Branch (37:7): [True: 0, False: 2.05k] ------------------ 38| 0| { 39| 0| BIKE_ERROR(E_SHAKE_OVER_USED); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 40| 0| } 41| | 42| | // When |len| is smaller then use what's left in the buffer, 43| | // there is no need for additional SHAKE256 invocations. 44| 2.05k| if((len + s->curr_pos_in_buffer) <= OQS_SHA3_SHAKE256_RATE) { ------------------ | | 320| 2.05k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ | Branch (44:6): [True: 1.98k, False: 65] ------------------ 45| 1.98k| bike_memcpy(out, &s->buffer[s->curr_pos_in_buffer], len); 46| 1.98k| s->curr_pos_in_buffer += len; 47| | 48| 1.98k| return SUCCESS; ------------------ | | 12| 1.98k|#define SUCCESS OQS_SUCCESS ------------------ 49| 1.98k| } 50| | 51| | // Generate one block (SHAKE256_RATE bytes) of random data with SHAKE256. 52| 65| OQS_SHA3_shake256_inc_squeeze(s->buffer, OQS_SHA3_SHAKE256_RATE, &s->s); ------------------ | | 320| 65|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 53| | 54| | // Copy |len| bytes to the output, set the new buffer position indicator, 55| | // and update the remaining allowable number of SHAKE invocations. 56| 65| bike_memcpy(out, s->buffer, len); 57| 65| s->curr_pos_in_buffer = len; 58| 65| s->rem_invocations -= 1; 59| | 60| 65| return SUCCESS; ------------------ | | 12| 65|#define SUCCESS OQS_SUCCESS ------------------ 61| 2.05k|} OQS_KEM_bike_l1_clean_prf_state: 64| 15|{ 65| 15| OQS_SHA3_shake256_inc_ctx_release(&s->s); 66| 15| secure_clean((uint8_t*)s, sizeof(*s)); ------------------ | | 33| 15|#define secure_clean OQS_MEM_cleanse ------------------ 67| 15|} OQS_KEM_bike_l3_init_prf_state: 14| 3|{ 15| 3| if(0 == max_num_invocations) { ------------------ | Branch (15:6): [True: 0, False: 3] ------------------ 16| 0| BIKE_ERROR(E_SHAKE_PRF_INIT_FAIL); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 17| 0| } 18| | 19| 3| OQS_SHA3_shake256_inc_init(&s->s); 20| | 21| | // Initialize the SHAKE state with the given seed. 22| 3| OQS_SHA3_shake256_inc_absorb(&s->s, seed->raw, sizeof(*seed)); 23| | 24| 3| OQS_SHA3_shake256_inc_finalize(&s->s); 25| | 26| | // Initialize the PRF parameters. 27| 3| s->curr_pos_in_buffer = OQS_SHA3_SHAKE256_RATE; ------------------ | | 320| 3|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 28| 3| s->rem_invocations = max_num_invocations; 29| | 30| 3| return SUCCESS; ------------------ | | 12| 3|#define SUCCESS OQS_SUCCESS ------------------ 31| 3|} OQS_KEM_bike_l3_get_prf_output: 35| 604|{ 36| | // Check if the maximum number of SHAKE invocations is reached. 37| 604| if (s->rem_invocations == 0) ------------------ | Branch (37:7): [True: 0, False: 604] ------------------ 38| 0| { 39| 0| BIKE_ERROR(E_SHAKE_OVER_USED); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 40| 0| } 41| | 42| | // When |len| is smaller then use what's left in the buffer, 43| | // there is no need for additional SHAKE256 invocations. 44| 604| if((len + s->curr_pos_in_buffer) <= OQS_SHA3_SHAKE256_RATE) { ------------------ | | 320| 604|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ | Branch (44:6): [True: 585, False: 19] ------------------ 45| 585| bike_memcpy(out, &s->buffer[s->curr_pos_in_buffer], len); 46| 585| s->curr_pos_in_buffer += len; 47| | 48| 585| return SUCCESS; ------------------ | | 12| 585|#define SUCCESS OQS_SUCCESS ------------------ 49| 585| } 50| | 51| | // Generate one block (SHAKE256_RATE bytes) of random data with SHAKE256. 52| 19| OQS_SHA3_shake256_inc_squeeze(s->buffer, OQS_SHA3_SHAKE256_RATE, &s->s); ------------------ | | 320| 19|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 53| | 54| | // Copy |len| bytes to the output, set the new buffer position indicator, 55| | // and update the remaining allowable number of SHAKE invocations. 56| 19| bike_memcpy(out, s->buffer, len); 57| 19| s->curr_pos_in_buffer = len; 58| 19| s->rem_invocations -= 1; 59| | 60| 19| return SUCCESS; ------------------ | | 12| 19|#define SUCCESS OQS_SUCCESS ------------------ 61| 604|} OQS_KEM_bike_l3_clean_prf_state: 64| 3|{ 65| 3| OQS_SHA3_shake256_inc_ctx_release(&s->s); 66| 3| secure_clean((uint8_t*)s, sizeof(*s)); ------------------ | | 33| 3|#define secure_clean OQS_MEM_cleanse ------------------ 67| 3|} OQS_KEM_bike_l5_init_prf_state: 14| 3|{ 15| 3| if(0 == max_num_invocations) { ------------------ | Branch (15:6): [True: 0, False: 3] ------------------ 16| 0| BIKE_ERROR(E_SHAKE_PRF_INIT_FAIL); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 17| 0| } 18| | 19| 3| OQS_SHA3_shake256_inc_init(&s->s); 20| | 21| | // Initialize the SHAKE state with the given seed. 22| 3| OQS_SHA3_shake256_inc_absorb(&s->s, seed->raw, sizeof(*seed)); 23| | 24| 3| OQS_SHA3_shake256_inc_finalize(&s->s); 25| | 26| | // Initialize the PRF parameters. 27| 3| s->curr_pos_in_buffer = OQS_SHA3_SHAKE256_RATE; ------------------ | | 320| 3|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 28| 3| s->rem_invocations = max_num_invocations; 29| | 30| 3| return SUCCESS; ------------------ | | 12| 3|#define SUCCESS OQS_SUCCESS ------------------ 31| 3|} OQS_KEM_bike_l5_get_prf_output: 35| 802|{ 36| | // Check if the maximum number of SHAKE invocations is reached. 37| 802| if (s->rem_invocations == 0) ------------------ | Branch (37:7): [True: 0, False: 802] ------------------ 38| 0| { 39| 0| BIKE_ERROR(E_SHAKE_OVER_USED); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 40| 0| } 41| | 42| | // When |len| is smaller then use what's left in the buffer, 43| | // there is no need for additional SHAKE256 invocations. 44| 802| if((len + s->curr_pos_in_buffer) <= OQS_SHA3_SHAKE256_RATE) { ------------------ | | 320| 802|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ | Branch (44:6): [True: 777, False: 25] ------------------ 45| 777| bike_memcpy(out, &s->buffer[s->curr_pos_in_buffer], len); 46| 777| s->curr_pos_in_buffer += len; 47| | 48| 777| return SUCCESS; ------------------ | | 12| 777|#define SUCCESS OQS_SUCCESS ------------------ 49| 777| } 50| | 51| | // Generate one block (SHAKE256_RATE bytes) of random data with SHAKE256. 52| 25| OQS_SHA3_shake256_inc_squeeze(s->buffer, OQS_SHA3_SHAKE256_RATE, &s->s); ------------------ | | 320| 25|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 53| | 54| | // Copy |len| bytes to the output, set the new buffer position indicator, 55| | // and update the remaining allowable number of SHAKE invocations. 56| 25| bike_memcpy(out, s->buffer, len); 57| 25| s->curr_pos_in_buffer = len; 58| 25| s->rem_invocations -= 1; 59| | 60| 25| return SUCCESS; ------------------ | | 12| 25|#define SUCCESS OQS_SUCCESS ------------------ 61| 802|} OQS_KEM_bike_l5_clean_prf_state: 64| 3|{ 65| 3| OQS_SHA3_shake256_inc_ctx_release(&s->s); 66| 3| secure_clean((uint8_t*)s, sizeof(*s)); ------------------ | | 33| 3|#define secure_clean OQS_MEM_cleanse ------------------ 67| 3|} OQS_KEM_bike_l1_r_bits_vector_weight: 16| 25|{ 17| 25| uint64_t acc = 0; 18| 38.5k| for(size_t i = 0; i < (R_BYTES - 1); i++) { ------------------ | | 81| 38.5k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 38.5k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (18:21): [True: 38.5k, False: 25] ------------------ 19| 38.5k| acc += __builtin_popcount(in->raw[i]); 20| 38.5k| } 21| | 22| 25| acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 81| 25|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 25|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 98| 25|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 25|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 25|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 23| 25| return acc; 24| 25|} OQS_KEM_bike_l3_r_bits_vector_weight: 16| 5|{ 17| 5| uint64_t acc = 0; 18| 15.4k| for(size_t i = 0; i < (R_BYTES - 1); i++) { ------------------ | | 81| 15.4k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 15.4k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (18:21): [True: 15.4k, False: 5] ------------------ 19| 15.4k| acc += __builtin_popcount(in->raw[i]); 20| 15.4k| } 21| | 22| 5| acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 81| 5|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 5|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 98| 5|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 5|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 5|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 23| 5| return acc; 24| 5|} OQS_KEM_bike_l5_r_bits_vector_weight: 16| 5|{ 17| 5| uint64_t acc = 0; 18| 25.6k| for(size_t i = 0; i < (R_BYTES - 1); i++) { ------------------ | | 81| 25.6k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 25.6k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (18:21): [True: 25.6k, False: 5] ------------------ 19| 25.6k| acc += __builtin_popcount(in->raw[i]); 20| 25.6k| } 21| | 22| 5| acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 81| 5|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 5|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 98| 5|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 5|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 5|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 23| 5| return acc; 24| 5|} kem.c:bike_memcpy: 148| 112|{ 149| 112| if(byte_len == 0) { ------------------ | Branch (149:6): [True: 0, False: 112] ------------------ 150| 0| return dst; 151| 0| } 152| | 153| 112| return memcpy(dst, src, byte_len); 154| 112|} kem.c:secure_cmp: 65| 14|{ 66| 14| volatile uint8_t res = 0; 67| | 68| 31.8k| for(uint32_t i = 0; i < size; ++i) { ------------------ | Branch (68:23): [True: 31.8k, False: 14] ------------------ 69| 31.8k| res |= (a[i] ^ b[i]); 70| 31.8k| } 71| | 72| 14| return (0 == res); 73| 14|} kem.c:secure_l32_mask: 111| 7|{ 112| |#if defined(__aarch64__) 113| | uint32_t res; 114| | __asm__ __volatile__("cmp %w[V2], %w[V1]; \n " 115| | "cset %w[RES], HI; \n" 116| | : [RES] "=r"(res) 117| | : [V1] "r"(v1), [V2] "r"(v2) 118| | : "cc" /*The condition code flag*/); 119| | return (res - 1); 120| |#elif defined(__x86_64__) || defined(__i386__) 121| | uint32_t res; 122| 7| __asm__ __volatile__("xor %%edx, %%edx; \n" 123| 7| "cmp %1, %2; \n " 124| 7| "setl %%dl; \n" 125| 7| "dec %%edx; \n" 126| 7| "mov %%edx, %0; \n" 127| | 128| 7| : "=r"(res) 129| 7| : "r"(v2), "r"(v1) 130| 7| : "rdx"); 131| | 132| 7| return res; 133| |#else 134| | // If v1 >= v2 then the subtraction result is 0^32||(v1-v2). 135| | // else it is 1^32||(v2-v1+1). Subsequently, negating the upper 136| | // 32 bits gives 0 if v1 < v2 and otherwise (-1). 137| | return ~((uint32_t)(((uint64_t)v1 - (uint64_t)v2) >> 32)); 138| |#endif 139| 7|} kem.c:u8_barrier: 48| 448| { \ 49| 448| __asm__("" : "+r"(a) : /* no inputs */); \ 50| 448| return a; \ 51| 448| } sampling.c:secure_cmp32: 77| 251k|{ 78| |#if defined(__aarch64__) 79| | uint32_t res; 80| | __asm__ __volatile__("cmp %w[V1], %w[V2]; \n " 81| | "cset %w[RES], EQ; \n" 82| | : [RES] "=r"(res) 83| | : [V1] "r"(v1), [V2] "r"(v2) 84| | : "cc" /*The condition code flag*/); 85| | return res; 86| |#elif defined(__x86_64__) || defined(__i386__) 87| | uint32_t res; 88| 251k| __asm__ __volatile__("xor %%edx, %%edx; \n" 89| 251k| "cmp %1, %2; \n " 90| 251k| "sete %%dl; \n" 91| 251k| "mov %%edx, %0; \n" 92| 251k| : "=r"(res) 93| 251k| : "r"(v1), "r"(v2) 94| 251k| : "rdx"); 95| 251k| return res; 96| |#else 97| | // Insecure comparison: The main purpose of secure_cmp32 is to avoid 98| | // branches to prevent potential side channel leaks. To do that, 99| | // we normally leverage some special CPU instructions such as "sete" 100| | // (for __x86_64__) and "cset" (for __aarch64__). When dealing with general 101| | // CPU architectures, the interpretation of the line below is left for the 102| | // compiler. It could lead to an "insecure" branch. This case needs to be 103| | // checked individually on such platforms 104| | // (e.g., by checking the compiler-generated assembly). 105| | return (v1 == v2 ? 1 : 0); 106| |#endif 107| 251k|} sampling.c:bike_memcpy: 148| 14|{ 149| 14| if(byte_len == 0) { ------------------ | Branch (149:6): [True: 0, False: 14] ------------------ 150| 0| return dst; 151| 0| } 152| | 153| 14| return memcpy(dst, src, byte_len); 154| 14|} sampling.c:bike_memset: 158| 28|{ 159| 28| if(byte_len == 0) { ------------------ | Branch (159:6): [True: 0, False: 28] ------------------ 160| 0| return dst; 161| 0| } 162| | 163| 28| return memset(dst, ch, byte_len); 164| 28|} decode.c:bike_memcpy: 148| 56|{ 149| 56| if(byte_len == 0) { ------------------ | Branch (149:6): [True: 0, False: 56] ------------------ 150| 0| return dst; 151| 0| } 152| | 153| 56| return memcpy(dst, src, byte_len); 154| 56|} decode.c:bike_memset: 158| 315|{ 159| 315| if(byte_len == 0) { ------------------ | Branch (159:6): [True: 0, False: 315] ------------------ 160| 0| return dst; 161| 0| } 162| | 163| 315| return memset(dst, ch, byte_len); 164| 315|} decode.c:secure_l32_mask: 111| 35|{ 112| |#if defined(__aarch64__) 113| | uint32_t res; 114| | __asm__ __volatile__("cmp %w[V2], %w[V1]; \n " 115| | "cset %w[RES], HI; \n" 116| | : [RES] "=r"(res) 117| | : [V1] "r"(v1), [V2] "r"(v2) 118| | : "cc" /*The condition code flag*/); 119| | return (res - 1); 120| |#elif defined(__x86_64__) || defined(__i386__) 121| | uint32_t res; 122| 35| __asm__ __volatile__("xor %%edx, %%edx; \n" 123| 35| "cmp %1, %2; \n " 124| 35| "setl %%dl; \n" 125| 35| "dec %%edx; \n" 126| 35| "mov %%edx, %0; \n" 127| | 128| 35| : "=r"(res) 129| 35| : "r"(v2), "r"(v1) 130| 35| : "rdx"); 131| | 132| 35| return res; 133| |#else 134| | // If v1 >= v2 then the subtraction result is 0^32||(v1-v2). 135| | // else it is 1^32||(v2-v1+1). Subsequently, negating the upper 136| | // 32 bits gives 0 if v1 < v2 and otherwise (-1). 137| | return ~((uint32_t)(((uint64_t)v1 - (uint64_t)v2) >> 32)); 138| |#endif 139| 35|} decode.c:u32_barrier: 48| 70| { \ 49| 70| __asm__("" : "+r"(a) : /* no inputs */); \ 50| 70| return a; \ 51| 70| } shake_prf.c:bike_memcpy: 148| 3.45k|{ 149| 3.45k| if(byte_len == 0) { ------------------ | Branch (149:6): [True: 0, False: 3.45k] ------------------ 150| 0| return dst; 151| 0| } 152| | 153| 3.45k| return memcpy(dst, src, byte_len); 154| 3.45k|} decode_avx2.c:secure_l32_mask: 111| 55.2k|{ 112| |#if defined(__aarch64__) 113| | uint32_t res; 114| | __asm__ __volatile__("cmp %w[V2], %w[V1]; \n " 115| | "cset %w[RES], HI; \n" 116| | : [RES] "=r"(res) 117| | : [V1] "r"(v1), [V2] "r"(v2) 118| | : "cc" /*The condition code flag*/); 119| | return (res - 1); 120| |#elif defined(__x86_64__) || defined(__i386__) 121| | uint32_t res; 122| 55.2k| __asm__ __volatile__("xor %%edx, %%edx; \n" 123| 55.2k| "cmp %1, %2; \n " 124| 55.2k| "setl %%dl; \n" 125| 55.2k| "dec %%edx; \n" 126| 55.2k| "mov %%edx, %0; \n" 127| | 128| 55.2k| : "=r"(res) 129| 55.2k| : "r"(v2), "r"(v1) 130| 55.2k| : "rdx"); 131| | 132| 55.2k| return res; 133| |#else 134| | // If v1 >= v2 then the subtraction result is 0^32||(v1-v2). 135| | // else it is 1^32||(v2-v1+1). Subsequently, negating the upper 136| | // 32 bits gives 0 if v1 < v2 and otherwise (-1). 137| | return ~((uint32_t)(((uint64_t)v1 - (uint64_t)v2) >> 32)); 138| |#endif 139| 55.2k|} OQS_KEM_bike_l1_new: 8| 5|OQS_KEM *OQS_KEM_bike_l1_new(void) { 9| 5| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 10| 5| if (kem == NULL) { ------------------ | Branch (10:6): [True: 0, False: 5] ------------------ 11| 0| return NULL; 12| 0| } 13| 5| kem->method_name = OQS_KEM_alg_bike_l1; ------------------ | | 35| 5|#define OQS_KEM_alg_bike_l1 "BIKE-L1" ------------------ 14| 5| kem->alg_version = "Additional - 01/27/2023"; 15| | 16| 5| kem->claimed_nist_level = 1; 17| 5| kem->ind_cca = false; 18| | 19| 5| kem->length_public_key = OQS_KEM_bike_l1_length_public_key; ------------------ | | 11| 5|#define OQS_KEM_bike_l1_length_public_key 1541 ------------------ 20| 5| kem->length_secret_key = OQS_KEM_bike_l1_length_secret_key; ------------------ | | 10| 5|#define OQS_KEM_bike_l1_length_secret_key 5223 ------------------ 21| 5| kem->length_ciphertext = OQS_KEM_bike_l1_length_ciphertext; ------------------ | | 12| 5|#define OQS_KEM_bike_l1_length_ciphertext 1573 ------------------ 22| 5| kem->length_shared_secret = OQS_KEM_bike_l1_length_shared_secret; ------------------ | | 13| 5|#define OQS_KEM_bike_l1_length_shared_secret 32 ------------------ 23| 5| kem->length_keypair_seed = OQS_KEM_bike_l1_length_keypair_seed; ------------------ | | 14| 5|#define OQS_KEM_bike_l1_length_keypair_seed 0 ------------------ 24| 5| kem->length_encaps_seed = OQS_KEM_bike_l1_length_encaps_seed; ------------------ | | 15| 5|#define OQS_KEM_bike_l1_length_encaps_seed 0 ------------------ 25| | 26| 5| kem->keypair = OQS_KEM_bike_l1_keypair; 27| 5| kem->keypair_derand = OQS_KEM_bike_l1_keypair_derand; 28| 5| kem->encaps = OQS_KEM_bike_l1_encaps; 29| 5| kem->encaps_derand = OQS_KEM_bike_l1_encaps_derand; 30| 5| kem->decaps = OQS_KEM_bike_l1_decaps; 31| | 32| 5| return kem; 33| 5|} OQS_KEM_bike_l3_new: 37| 1|OQS_KEM *OQS_KEM_bike_l3_new(void) { 38| 1| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 39| 1| if (kem == NULL) { ------------------ | Branch (39:6): [True: 0, False: 1] ------------------ 40| 0| return NULL; 41| 0| } 42| 1| kem->method_name = OQS_KEM_alg_bike_l3; ------------------ | | 37| 1|#define OQS_KEM_alg_bike_l3 "BIKE-L3" ------------------ 43| 1| kem->alg_version = "Additional - 01/27/2023"; 44| | 45| 1| kem->claimed_nist_level = 3; 46| 1| kem->ind_cca = false; 47| | 48| 1| kem->length_public_key = OQS_KEM_bike_l3_length_public_key; ------------------ | | 26| 1|#define OQS_KEM_bike_l3_length_public_key 3083 ------------------ 49| 1| kem->length_secret_key = OQS_KEM_bike_l3_length_secret_key; ------------------ | | 25| 1|#define OQS_KEM_bike_l3_length_secret_key 10105 ------------------ 50| 1| kem->length_ciphertext = OQS_KEM_bike_l3_length_ciphertext; ------------------ | | 27| 1|#define OQS_KEM_bike_l3_length_ciphertext 3115 ------------------ 51| 1| kem->length_shared_secret = OQS_KEM_bike_l3_length_shared_secret; ------------------ | | 28| 1|#define OQS_KEM_bike_l3_length_shared_secret 32 ------------------ 52| 1| kem->length_keypair_seed = OQS_KEM_bike_l3_length_keypair_seed; ------------------ | | 29| 1|#define OQS_KEM_bike_l3_length_keypair_seed 0 ------------------ 53| 1| kem->length_encaps_seed = OQS_KEM_bike_l3_length_encaps_seed; ------------------ | | 30| 1|#define OQS_KEM_bike_l3_length_encaps_seed 0 ------------------ 54| | 55| 1| kem->keypair = OQS_KEM_bike_l3_keypair; 56| 1| kem->keypair_derand = OQS_KEM_bike_l3_keypair_derand; 57| 1| kem->encaps = OQS_KEM_bike_l3_encaps; 58| 1| kem->encaps_derand = OQS_KEM_bike_l3_encaps_derand; 59| 1| kem->decaps = OQS_KEM_bike_l3_decaps; 60| | 61| 1| return kem; 62| 1|} OQS_KEM_bike_l5_new: 66| 1|OQS_KEM *OQS_KEM_bike_l5_new(void) { 67| 1| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 68| 1| if (kem == NULL) { ------------------ | Branch (68:6): [True: 0, False: 1] ------------------ 69| 0| return NULL; 70| 0| } 71| 1| kem->method_name = OQS_KEM_alg_bike_l5; ------------------ | | 39| 1|#define OQS_KEM_alg_bike_l5 "BIKE-L5" ------------------ 72| 1| kem->alg_version = "Additional - 01/07/2023"; 73| | 74| 1| kem->claimed_nist_level = 5; 75| 1| kem->ind_cca = false; 76| | 77| 1| kem->length_public_key = OQS_KEM_bike_l5_length_public_key; ------------------ | | 41| 1|#define OQS_KEM_bike_l5_length_public_key 5122 ------------------ 78| 1| kem->length_secret_key = OQS_KEM_bike_l5_length_secret_key; ------------------ | | 40| 1|#define OQS_KEM_bike_l5_length_secret_key 16494 ------------------ 79| 1| kem->length_ciphertext = OQS_KEM_bike_l5_length_ciphertext; ------------------ | | 42| 1|#define OQS_KEM_bike_l5_length_ciphertext 5154 ------------------ 80| 1| kem->length_shared_secret = OQS_KEM_bike_l5_length_shared_secret; ------------------ | | 43| 1|#define OQS_KEM_bike_l5_length_shared_secret 32 ------------------ 81| 1| kem->length_keypair_seed = OQS_KEM_bike_l5_length_keypair_seed; ------------------ | | 44| 1|#define OQS_KEM_bike_l5_length_keypair_seed 0 ------------------ 82| 1| kem->length_encaps_seed = OQS_KEM_bike_l5_length_encaps_seed; ------------------ | | 45| 1|#define OQS_KEM_bike_l5_length_encaps_seed 0 ------------------ 83| | 84| 1| kem->keypair = OQS_KEM_bike_l5_keypair; 85| 1| kem->keypair_derand = OQS_KEM_bike_l5_keypair_derand; 86| 1| kem->encaps = OQS_KEM_bike_l5_encaps; 87| 1| kem->encaps_derand = OQS_KEM_bike_l5_encaps_derand; 88| 1| kem->decaps = OQS_KEM_bike_l5_decaps; 89| | 90| 1| return kem; 91| 1|} OQS_KEM_classic_mceliece_348864_new: 9| 103|OQS_KEM *OQS_KEM_classic_mceliece_348864_new(void) { 10| | 11| 103| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 103| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 103] ------------------ 13| 0| return NULL; 14| 0| } 15| 103| kem->method_name = OQS_KEM_alg_classic_mceliece_348864; ------------------ | | 42| 103|#define OQS_KEM_alg_classic_mceliece_348864 "Classic-McEliece-348864" ------------------ 16| 103| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 103| kem->claimed_nist_level = 1; 19| 103| kem->ind_cca = true; 20| | 21| 103| kem->length_public_key = OQS_KEM_classic_mceliece_348864_length_public_key; ------------------ | | 9| 103|#define OQS_KEM_classic_mceliece_348864_length_public_key 261120 ------------------ 22| 103| kem->length_secret_key = OQS_KEM_classic_mceliece_348864_length_secret_key; ------------------ | | 10| 103|#define OQS_KEM_classic_mceliece_348864_length_secret_key 6492 ------------------ 23| 103| kem->length_ciphertext = OQS_KEM_classic_mceliece_348864_length_ciphertext; ------------------ | | 11| 103|#define OQS_KEM_classic_mceliece_348864_length_ciphertext 96 ------------------ 24| 103| kem->length_shared_secret = OQS_KEM_classic_mceliece_348864_length_shared_secret; ------------------ | | 12| 103|#define OQS_KEM_classic_mceliece_348864_length_shared_secret 32 ------------------ 25| 103| kem->length_keypair_seed = OQS_KEM_classic_mceliece_348864_length_keypair_seed; ------------------ | | 13| 103|#define OQS_KEM_classic_mceliece_348864_length_keypair_seed 0 ------------------ 26| 103| kem->length_encaps_seed = OQS_KEM_classic_mceliece_348864_length_encaps_seed; ------------------ | | 14| 103|#define OQS_KEM_classic_mceliece_348864_length_encaps_seed 0 ------------------ 27| | 28| 103| kem->keypair = OQS_KEM_classic_mceliece_348864_keypair; 29| 103| kem->keypair_derand = OQS_KEM_classic_mceliece_348864_keypair_derand; 30| 103| kem->encaps = OQS_KEM_classic_mceliece_348864_encaps; 31| 103| kem->encaps_derand = OQS_KEM_classic_mceliece_348864_encaps_derand; 32| 103| kem->decaps = OQS_KEM_classic_mceliece_348864_decaps; 33| | 34| 103| return kem; 35| 103|} OQS_KEM_classic_mceliece_348864_keypair: 54| 103|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 103|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864_avx2) 56| 103|#if defined(OQS_DIST_BUILD) 57| 103| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (57:6): [True: 103, False: 0] | Branch (57:49): [True: 103, False: 0] ------------------ 58| 103|#endif /* OQS_DIST_BUILD */ 59| 103| return (OQS_STATUS) PQCLEAN_MCELIECE348864_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 103|#if defined(OQS_DIST_BUILD) 61| 103| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 103|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 103|} OQS_KEM_classic_mceliece_348864_encaps: 78| 103|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 103|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864_avx2) 80| 103|#if defined(OQS_DIST_BUILD) 81| 103| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (81:6): [True: 103, False: 0] | Branch (81:49): [True: 103, False: 0] ------------------ 82| 103|#endif /* OQS_DIST_BUILD */ 83| 103| return (OQS_STATUS) PQCLEAN_MCELIECE348864_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 103|#if defined(OQS_DIST_BUILD) 85| 103| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 103|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 103|} OQS_KEM_classic_mceliece_348864_decaps: 94| 103|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 103|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864_avx2) 96| 103|#if defined(OQS_DIST_BUILD) 97| 103| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 103, False: 0] | Branch (97:49): [True: 103, False: 0] ------------------ 98| 103|#endif /* OQS_DIST_BUILD */ 99| 103| return (OQS_STATUS) PQCLEAN_MCELIECE348864_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 103|#if defined(OQS_DIST_BUILD) 101| 103| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 103|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 103|} OQS_KEM_classic_mceliece_348864f_new: 9| 80|OQS_KEM *OQS_KEM_classic_mceliece_348864f_new(void) { 10| | 11| 80| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 80| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 80] ------------------ 13| 0| return NULL; 14| 0| } 15| 80| kem->method_name = OQS_KEM_alg_classic_mceliece_348864f; ------------------ | | 44| 80|#define OQS_KEM_alg_classic_mceliece_348864f "Classic-McEliece-348864f" ------------------ 16| 80| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 80| kem->claimed_nist_level = 1; 19| 80| kem->ind_cca = true; 20| | 21| 80| kem->length_public_key = OQS_KEM_classic_mceliece_348864f_length_public_key; ------------------ | | 24| 80|#define OQS_KEM_classic_mceliece_348864f_length_public_key 261120 ------------------ 22| 80| kem->length_secret_key = OQS_KEM_classic_mceliece_348864f_length_secret_key; ------------------ | | 25| 80|#define OQS_KEM_classic_mceliece_348864f_length_secret_key 6492 ------------------ 23| 80| kem->length_ciphertext = OQS_KEM_classic_mceliece_348864f_length_ciphertext; ------------------ | | 26| 80|#define OQS_KEM_classic_mceliece_348864f_length_ciphertext 96 ------------------ 24| 80| kem->length_shared_secret = OQS_KEM_classic_mceliece_348864f_length_shared_secret; ------------------ | | 27| 80|#define OQS_KEM_classic_mceliece_348864f_length_shared_secret 32 ------------------ 25| 80| kem->length_keypair_seed = OQS_KEM_classic_mceliece_348864f_length_keypair_seed; ------------------ | | 28| 80|#define OQS_KEM_classic_mceliece_348864f_length_keypair_seed 0 ------------------ 26| 80| kem->length_encaps_seed = OQS_KEM_classic_mceliece_348864f_length_encaps_seed; ------------------ | | 29| 80|#define OQS_KEM_classic_mceliece_348864f_length_encaps_seed 0 ------------------ 27| | 28| 80| kem->keypair = OQS_KEM_classic_mceliece_348864f_keypair; 29| 80| kem->keypair_derand = OQS_KEM_classic_mceliece_348864f_keypair_derand; 30| 80| kem->encaps = OQS_KEM_classic_mceliece_348864f_encaps; 31| 80| kem->encaps_derand = OQS_KEM_classic_mceliece_348864f_encaps_derand; 32| 80| kem->decaps = OQS_KEM_classic_mceliece_348864f_decaps; 33| | 34| 80| return kem; 35| 80|} OQS_KEM_classic_mceliece_348864f_keypair: 54| 80|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864f_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 80|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864f_avx2) 56| 80|#if defined(OQS_DIST_BUILD) 57| 80| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (57:6): [True: 80, False: 0] | Branch (57:49): [True: 80, False: 0] | Branch (57:94): [True: 80, False: 0] ------------------ 58| 80|#endif /* OQS_DIST_BUILD */ 59| 80| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 80|#if defined(OQS_DIST_BUILD) 61| 80| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 80|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 80|} OQS_KEM_classic_mceliece_348864f_encaps: 78| 80|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864f_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 80|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864f_avx2) 80| 80|#if defined(OQS_DIST_BUILD) 81| 80| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (81:6): [True: 80, False: 0] | Branch (81:49): [True: 80, False: 0] | Branch (81:94): [True: 80, False: 0] ------------------ 82| 80|#endif /* OQS_DIST_BUILD */ 83| 80| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 80|#if defined(OQS_DIST_BUILD) 85| 80| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 80|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 80|} OQS_KEM_classic_mceliece_348864f_decaps: 94| 80|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864f_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 80|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864f_avx2) 96| 80|#if defined(OQS_DIST_BUILD) 97| 80| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (97:6): [True: 80, False: 0] | Branch (97:49): [True: 80, False: 0] | Branch (97:94): [True: 80, False: 0] ------------------ 98| 80|#endif /* OQS_DIST_BUILD */ 99| 80| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 80|#if defined(OQS_DIST_BUILD) 101| 80| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 80|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 80|} OQS_KEM_classic_mceliece_460896_new: 9| 110|OQS_KEM *OQS_KEM_classic_mceliece_460896_new(void) { 10| | 11| 110| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 110| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 110] ------------------ 13| 0| return NULL; 14| 0| } 15| 110| kem->method_name = OQS_KEM_alg_classic_mceliece_460896; ------------------ | | 46| 110|#define OQS_KEM_alg_classic_mceliece_460896 "Classic-McEliece-460896" ------------------ 16| 110| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 110| kem->claimed_nist_level = 3; 19| 110| kem->ind_cca = true; 20| | 21| 110| kem->length_public_key = OQS_KEM_classic_mceliece_460896_length_public_key; ------------------ | | 39| 110|#define OQS_KEM_classic_mceliece_460896_length_public_key 524160 ------------------ 22| 110| kem->length_secret_key = OQS_KEM_classic_mceliece_460896_length_secret_key; ------------------ | | 40| 110|#define OQS_KEM_classic_mceliece_460896_length_secret_key 13608 ------------------ 23| 110| kem->length_ciphertext = OQS_KEM_classic_mceliece_460896_length_ciphertext; ------------------ | | 41| 110|#define OQS_KEM_classic_mceliece_460896_length_ciphertext 156 ------------------ 24| 110| kem->length_shared_secret = OQS_KEM_classic_mceliece_460896_length_shared_secret; ------------------ | | 42| 110|#define OQS_KEM_classic_mceliece_460896_length_shared_secret 32 ------------------ 25| 110| kem->length_keypair_seed = OQS_KEM_classic_mceliece_460896_length_keypair_seed; ------------------ | | 43| 110|#define OQS_KEM_classic_mceliece_460896_length_keypair_seed 0 ------------------ 26| 110| kem->length_encaps_seed = OQS_KEM_classic_mceliece_460896_length_encaps_seed; ------------------ | | 44| 110|#define OQS_KEM_classic_mceliece_460896_length_encaps_seed 0 ------------------ 27| | 28| 110| kem->keypair = OQS_KEM_classic_mceliece_460896_keypair; 29| 110| kem->keypair_derand = OQS_KEM_classic_mceliece_460896_keypair_derand; 30| 110| kem->encaps = OQS_KEM_classic_mceliece_460896_encaps; 31| 110| kem->encaps_derand = OQS_KEM_classic_mceliece_460896_encaps_derand; 32| 110| kem->decaps = OQS_KEM_classic_mceliece_460896_decaps; 33| | 34| 110| return kem; 35| 110|} OQS_KEM_classic_mceliece_460896_keypair: 54| 110|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 110|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896_avx2) 56| 110|#if defined(OQS_DIST_BUILD) 57| 110| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (57:6): [True: 110, False: 0] | Branch (57:49): [True: 110, False: 0] ------------------ 58| 110|#endif /* OQS_DIST_BUILD */ 59| 110| return (OQS_STATUS) PQCLEAN_MCELIECE460896_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 110|#if defined(OQS_DIST_BUILD) 61| 110| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 110|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 110|} OQS_KEM_classic_mceliece_460896_encaps: 78| 110|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 110|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896_avx2) 80| 110|#if defined(OQS_DIST_BUILD) 81| 110| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (81:6): [True: 110, False: 0] | Branch (81:49): [True: 110, False: 0] ------------------ 82| 110|#endif /* OQS_DIST_BUILD */ 83| 110| return (OQS_STATUS) PQCLEAN_MCELIECE460896_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 110|#if defined(OQS_DIST_BUILD) 85| 110| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 110|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 110|} OQS_KEM_classic_mceliece_460896_decaps: 94| 110|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 110|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896_avx2) 96| 110|#if defined(OQS_DIST_BUILD) 97| 110| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 110, False: 0] | Branch (97:49): [True: 110, False: 0] ------------------ 98| 110|#endif /* OQS_DIST_BUILD */ 99| 110| return (OQS_STATUS) PQCLEAN_MCELIECE460896_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 110|#if defined(OQS_DIST_BUILD) 101| 110| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 110|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 110|} OQS_KEM_classic_mceliece_460896f_new: 9| 85|OQS_KEM *OQS_KEM_classic_mceliece_460896f_new(void) { 10| | 11| 85| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 85| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 85] ------------------ 13| 0| return NULL; 14| 0| } 15| 85| kem->method_name = OQS_KEM_alg_classic_mceliece_460896f; ------------------ | | 48| 85|#define OQS_KEM_alg_classic_mceliece_460896f "Classic-McEliece-460896f" ------------------ 16| 85| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 85| kem->claimed_nist_level = 3; 19| 85| kem->ind_cca = true; 20| | 21| 85| kem->length_public_key = OQS_KEM_classic_mceliece_460896f_length_public_key; ------------------ | | 54| 85|#define OQS_KEM_classic_mceliece_460896f_length_public_key 524160 ------------------ 22| 85| kem->length_secret_key = OQS_KEM_classic_mceliece_460896f_length_secret_key; ------------------ | | 55| 85|#define OQS_KEM_classic_mceliece_460896f_length_secret_key 13608 ------------------ 23| 85| kem->length_ciphertext = OQS_KEM_classic_mceliece_460896f_length_ciphertext; ------------------ | | 56| 85|#define OQS_KEM_classic_mceliece_460896f_length_ciphertext 156 ------------------ 24| 85| kem->length_shared_secret = OQS_KEM_classic_mceliece_460896f_length_shared_secret; ------------------ | | 57| 85|#define OQS_KEM_classic_mceliece_460896f_length_shared_secret 32 ------------------ 25| 85| kem->length_keypair_seed = OQS_KEM_classic_mceliece_460896f_length_keypair_seed; ------------------ | | 58| 85|#define OQS_KEM_classic_mceliece_460896f_length_keypair_seed 0 ------------------ 26| 85| kem->length_encaps_seed = OQS_KEM_classic_mceliece_460896f_length_encaps_seed; ------------------ | | 59| 85|#define OQS_KEM_classic_mceliece_460896f_length_encaps_seed 0 ------------------ 27| | 28| 85| kem->keypair = OQS_KEM_classic_mceliece_460896f_keypair; 29| 85| kem->keypair_derand = OQS_KEM_classic_mceliece_460896f_keypair_derand; 30| 85| kem->encaps = OQS_KEM_classic_mceliece_460896f_encaps; 31| 85| kem->encaps_derand = OQS_KEM_classic_mceliece_460896f_encaps_derand; 32| 85| kem->decaps = OQS_KEM_classic_mceliece_460896f_decaps; 33| | 34| 85| return kem; 35| 85|} OQS_KEM_classic_mceliece_460896f_keypair: 54| 85|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896f_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 85|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896f_avx2) 56| 85|#if defined(OQS_DIST_BUILD) 57| 85| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (57:6): [True: 85, False: 0] | Branch (57:49): [True: 85, False: 0] | Branch (57:94): [True: 85, False: 0] ------------------ 58| 85|#endif /* OQS_DIST_BUILD */ 59| 85| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 85|#if defined(OQS_DIST_BUILD) 61| 85| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 85|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 85|} OQS_KEM_classic_mceliece_460896f_encaps: 78| 85|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896f_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 85|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896f_avx2) 80| 85|#if defined(OQS_DIST_BUILD) 81| 85| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (81:6): [True: 85, False: 0] | Branch (81:49): [True: 85, False: 0] | Branch (81:94): [True: 85, False: 0] ------------------ 82| 85|#endif /* OQS_DIST_BUILD */ 83| 85| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 85|#if defined(OQS_DIST_BUILD) 85| 85| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 85|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 85|} OQS_KEM_classic_mceliece_460896f_decaps: 94| 85|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896f_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 85|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896f_avx2) 96| 85|#if defined(OQS_DIST_BUILD) 97| 85| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (97:6): [True: 85, False: 0] | Branch (97:49): [True: 85, False: 0] | Branch (97:94): [True: 85, False: 0] ------------------ 98| 85|#endif /* OQS_DIST_BUILD */ 99| 85| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 85|#if defined(OQS_DIST_BUILD) 101| 85| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 85|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 85|} OQS_KEM_classic_mceliece_6688128_new: 9| 99|OQS_KEM *OQS_KEM_classic_mceliece_6688128_new(void) { 10| | 11| 99| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 99| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 99] ------------------ 13| 0| return NULL; 14| 0| } 15| 99| kem->method_name = OQS_KEM_alg_classic_mceliece_6688128; ------------------ | | 50| 99|#define OQS_KEM_alg_classic_mceliece_6688128 "Classic-McEliece-6688128" ------------------ 16| 99| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 99| kem->claimed_nist_level = 5; 19| 99| kem->ind_cca = true; 20| | 21| 99| kem->length_public_key = OQS_KEM_classic_mceliece_6688128_length_public_key; ------------------ | | 69| 99|#define OQS_KEM_classic_mceliece_6688128_length_public_key 1044992 ------------------ 22| 99| kem->length_secret_key = OQS_KEM_classic_mceliece_6688128_length_secret_key; ------------------ | | 70| 99|#define OQS_KEM_classic_mceliece_6688128_length_secret_key 13932 ------------------ 23| 99| kem->length_ciphertext = OQS_KEM_classic_mceliece_6688128_length_ciphertext; ------------------ | | 71| 99|#define OQS_KEM_classic_mceliece_6688128_length_ciphertext 208 ------------------ 24| 99| kem->length_shared_secret = OQS_KEM_classic_mceliece_6688128_length_shared_secret; ------------------ | | 72| 99|#define OQS_KEM_classic_mceliece_6688128_length_shared_secret 32 ------------------ 25| 99| kem->length_keypair_seed = OQS_KEM_classic_mceliece_6688128_length_keypair_seed; ------------------ | | 73| 99|#define OQS_KEM_classic_mceliece_6688128_length_keypair_seed 0 ------------------ 26| 99| kem->length_encaps_seed = OQS_KEM_classic_mceliece_6688128_length_encaps_seed; ------------------ | | 74| 99|#define OQS_KEM_classic_mceliece_6688128_length_encaps_seed 0 ------------------ 27| | 28| 99| kem->keypair = OQS_KEM_classic_mceliece_6688128_keypair; 29| 99| kem->keypair_derand = OQS_KEM_classic_mceliece_6688128_keypair_derand; 30| 99| kem->encaps = OQS_KEM_classic_mceliece_6688128_encaps; 31| 99| kem->encaps_derand = OQS_KEM_classic_mceliece_6688128_encaps_derand; 32| 99| kem->decaps = OQS_KEM_classic_mceliece_6688128_decaps; 33| | 34| 99| return kem; 35| 99|} OQS_KEM_classic_mceliece_6688128_keypair: 54| 99|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 99|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128_avx2) 56| 99|#if defined(OQS_DIST_BUILD) 57| 99| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (57:6): [True: 99, False: 0] | Branch (57:49): [True: 99, False: 0] ------------------ 58| 99|#endif /* OQS_DIST_BUILD */ 59| 99| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 99|#if defined(OQS_DIST_BUILD) 61| 99| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 99|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 99|} OQS_KEM_classic_mceliece_6688128_encaps: 78| 99|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 99|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128_avx2) 80| 99|#if defined(OQS_DIST_BUILD) 81| 99| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (81:6): [True: 99, False: 0] | Branch (81:49): [True: 99, False: 0] ------------------ 82| 99|#endif /* OQS_DIST_BUILD */ 83| 99| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 99|#if defined(OQS_DIST_BUILD) 85| 99| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 99|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 99|} OQS_KEM_classic_mceliece_6688128_decaps: 94| 99|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 99|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128_avx2) 96| 99|#if defined(OQS_DIST_BUILD) 97| 99| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 99, False: 0] | Branch (97:49): [True: 99, False: 0] ------------------ 98| 99|#endif /* OQS_DIST_BUILD */ 99| 99| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 99|#if defined(OQS_DIST_BUILD) 101| 99| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 99|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 99|} OQS_KEM_classic_mceliece_6688128f_new: 9| 91|OQS_KEM *OQS_KEM_classic_mceliece_6688128f_new(void) { 10| | 11| 91| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 91| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 91] ------------------ 13| 0| return NULL; 14| 0| } 15| 91| kem->method_name = OQS_KEM_alg_classic_mceliece_6688128f; ------------------ | | 52| 91|#define OQS_KEM_alg_classic_mceliece_6688128f "Classic-McEliece-6688128f" ------------------ 16| 91| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 91| kem->claimed_nist_level = 5; 19| 91| kem->ind_cca = true; 20| | 21| 91| kem->length_public_key = OQS_KEM_classic_mceliece_6688128f_length_public_key; ------------------ | | 84| 91|#define OQS_KEM_classic_mceliece_6688128f_length_public_key 1044992 ------------------ 22| 91| kem->length_secret_key = OQS_KEM_classic_mceliece_6688128f_length_secret_key; ------------------ | | 85| 91|#define OQS_KEM_classic_mceliece_6688128f_length_secret_key 13932 ------------------ 23| 91| kem->length_ciphertext = OQS_KEM_classic_mceliece_6688128f_length_ciphertext; ------------------ | | 86| 91|#define OQS_KEM_classic_mceliece_6688128f_length_ciphertext 208 ------------------ 24| 91| kem->length_shared_secret = OQS_KEM_classic_mceliece_6688128f_length_shared_secret; ------------------ | | 87| 91|#define OQS_KEM_classic_mceliece_6688128f_length_shared_secret 32 ------------------ 25| 91| kem->length_keypair_seed = OQS_KEM_classic_mceliece_6688128f_length_keypair_seed; ------------------ | | 88| 91|#define OQS_KEM_classic_mceliece_6688128f_length_keypair_seed 0 ------------------ 26| 91| kem->length_encaps_seed = OQS_KEM_classic_mceliece_6688128f_length_encaps_seed; ------------------ | | 89| 91|#define OQS_KEM_classic_mceliece_6688128f_length_encaps_seed 0 ------------------ 27| | 28| 91| kem->keypair = OQS_KEM_classic_mceliece_6688128f_keypair; 29| 91| kem->keypair_derand = OQS_KEM_classic_mceliece_6688128f_keypair_derand; 30| 91| kem->encaps = OQS_KEM_classic_mceliece_6688128f_encaps; 31| 91| kem->encaps_derand = OQS_KEM_classic_mceliece_6688128f_encaps_derand; 32| 91| kem->decaps = OQS_KEM_classic_mceliece_6688128f_decaps; 33| | 34| 91| return kem; 35| 91|} OQS_KEM_classic_mceliece_6688128f_keypair: 54| 91|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128f_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 91|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128f_avx2) 56| 91|#if defined(OQS_DIST_BUILD) 57| 91| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (57:6): [True: 91, False: 0] | Branch (57:49): [True: 91, False: 0] | Branch (57:94): [True: 91, False: 0] ------------------ 58| 91|#endif /* OQS_DIST_BUILD */ 59| 91| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 91|#if defined(OQS_DIST_BUILD) 61| 91| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 91|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 91|} OQS_KEM_classic_mceliece_6688128f_encaps: 78| 91|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128f_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 91|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128f_avx2) 80| 91|#if defined(OQS_DIST_BUILD) 81| 91| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (81:6): [True: 91, False: 0] | Branch (81:49): [True: 91, False: 0] | Branch (81:94): [True: 91, False: 0] ------------------ 82| 91|#endif /* OQS_DIST_BUILD */ 83| 91| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 91|#if defined(OQS_DIST_BUILD) 85| 91| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 91|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 91|} OQS_KEM_classic_mceliece_6688128f_decaps: 94| 91|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128f_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 91|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128f_avx2) 96| 91|#if defined(OQS_DIST_BUILD) 97| 91| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (97:6): [True: 91, False: 0] | Branch (97:49): [True: 91, False: 0] | Branch (97:94): [True: 91, False: 0] ------------------ 98| 91|#endif /* OQS_DIST_BUILD */ 99| 91| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 91|#if defined(OQS_DIST_BUILD) 101| 91| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 91|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 91|} OQS_KEM_classic_mceliece_6960119_new: 9| 109|OQS_KEM *OQS_KEM_classic_mceliece_6960119_new(void) { 10| | 11| 109| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 109| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 109] ------------------ 13| 0| return NULL; 14| 0| } 15| 109| kem->method_name = OQS_KEM_alg_classic_mceliece_6960119; ------------------ | | 54| 109|#define OQS_KEM_alg_classic_mceliece_6960119 "Classic-McEliece-6960119" ------------------ 16| 109| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 109| kem->claimed_nist_level = 5; 19| 109| kem->ind_cca = true; 20| | 21| 109| kem->length_public_key = OQS_KEM_classic_mceliece_6960119_length_public_key; ------------------ | | 99| 109|#define OQS_KEM_classic_mceliece_6960119_length_public_key 1047319 ------------------ 22| 109| kem->length_secret_key = OQS_KEM_classic_mceliece_6960119_length_secret_key; ------------------ | | 100| 109|#define OQS_KEM_classic_mceliece_6960119_length_secret_key 13948 ------------------ 23| 109| kem->length_ciphertext = OQS_KEM_classic_mceliece_6960119_length_ciphertext; ------------------ | | 101| 109|#define OQS_KEM_classic_mceliece_6960119_length_ciphertext 194 ------------------ 24| 109| kem->length_shared_secret = OQS_KEM_classic_mceliece_6960119_length_shared_secret; ------------------ | | 102| 109|#define OQS_KEM_classic_mceliece_6960119_length_shared_secret 32 ------------------ 25| 109| kem->length_keypair_seed = OQS_KEM_classic_mceliece_6960119_length_keypair_seed; ------------------ | | 103| 109|#define OQS_KEM_classic_mceliece_6960119_length_keypair_seed 0 ------------------ 26| 109| kem->length_encaps_seed = OQS_KEM_classic_mceliece_6960119_length_encaps_seed; ------------------ | | 104| 109|#define OQS_KEM_classic_mceliece_6960119_length_encaps_seed 0 ------------------ 27| | 28| 109| kem->keypair = OQS_KEM_classic_mceliece_6960119_keypair; 29| 109| kem->keypair_derand = OQS_KEM_classic_mceliece_6960119_keypair_derand; 30| 109| kem->encaps = OQS_KEM_classic_mceliece_6960119_encaps; 31| 109| kem->encaps_derand = OQS_KEM_classic_mceliece_6960119_encaps_derand; 32| 109| kem->decaps = OQS_KEM_classic_mceliece_6960119_decaps; 33| | 34| 109| return kem; 35| 109|} OQS_KEM_classic_mceliece_6960119_keypair: 54| 109|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 109|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119_avx2) 56| 109|#if defined(OQS_DIST_BUILD) 57| 109| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (57:6): [True: 109, False: 0] | Branch (57:49): [True: 109, False: 0] ------------------ 58| 109|#endif /* OQS_DIST_BUILD */ 59| 109| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 109|#if defined(OQS_DIST_BUILD) 61| 109| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 109|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 109|} OQS_KEM_classic_mceliece_6960119_encaps: 78| 109|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 109|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119_avx2) 80| 109|#if defined(OQS_DIST_BUILD) 81| 109| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (81:6): [True: 109, False: 0] | Branch (81:49): [True: 109, False: 0] ------------------ 82| 109|#endif /* OQS_DIST_BUILD */ 83| 109| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 109|#if defined(OQS_DIST_BUILD) 85| 109| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 109|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 109|} OQS_KEM_classic_mceliece_6960119_decaps: 94| 109|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 109|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119_avx2) 96| 109|#if defined(OQS_DIST_BUILD) 97| 109| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 109, False: 0] | Branch (97:49): [True: 109, False: 0] ------------------ 98| 109|#endif /* OQS_DIST_BUILD */ 99| 109| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 109|#if defined(OQS_DIST_BUILD) 101| 109| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 109|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 109|} OQS_KEM_classic_mceliece_6960119f_new: 9| 90|OQS_KEM *OQS_KEM_classic_mceliece_6960119f_new(void) { 10| | 11| 90| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 90| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 90] ------------------ 13| 0| return NULL; 14| 0| } 15| 90| kem->method_name = OQS_KEM_alg_classic_mceliece_6960119f; ------------------ | | 56| 90|#define OQS_KEM_alg_classic_mceliece_6960119f "Classic-McEliece-6960119f" ------------------ 16| 90| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 90| kem->claimed_nist_level = 5; 19| 90| kem->ind_cca = true; 20| | 21| 90| kem->length_public_key = OQS_KEM_classic_mceliece_6960119f_length_public_key; ------------------ | | 114| 90|#define OQS_KEM_classic_mceliece_6960119f_length_public_key 1047319 ------------------ 22| 90| kem->length_secret_key = OQS_KEM_classic_mceliece_6960119f_length_secret_key; ------------------ | | 115| 90|#define OQS_KEM_classic_mceliece_6960119f_length_secret_key 13948 ------------------ 23| 90| kem->length_ciphertext = OQS_KEM_classic_mceliece_6960119f_length_ciphertext; ------------------ | | 116| 90|#define OQS_KEM_classic_mceliece_6960119f_length_ciphertext 194 ------------------ 24| 90| kem->length_shared_secret = OQS_KEM_classic_mceliece_6960119f_length_shared_secret; ------------------ | | 117| 90|#define OQS_KEM_classic_mceliece_6960119f_length_shared_secret 32 ------------------ 25| 90| kem->length_keypair_seed = OQS_KEM_classic_mceliece_6960119f_length_keypair_seed; ------------------ | | 118| 90|#define OQS_KEM_classic_mceliece_6960119f_length_keypair_seed 0 ------------------ 26| 90| kem->length_encaps_seed = OQS_KEM_classic_mceliece_6960119f_length_encaps_seed; ------------------ | | 119| 90|#define OQS_KEM_classic_mceliece_6960119f_length_encaps_seed 0 ------------------ 27| | 28| 90| kem->keypair = OQS_KEM_classic_mceliece_6960119f_keypair; 29| 90| kem->keypair_derand = OQS_KEM_classic_mceliece_6960119f_keypair_derand; 30| 90| kem->encaps = OQS_KEM_classic_mceliece_6960119f_encaps; 31| 90| kem->encaps_derand = OQS_KEM_classic_mceliece_6960119f_encaps_derand; 32| 90| kem->decaps = OQS_KEM_classic_mceliece_6960119f_decaps; 33| | 34| 90| return kem; 35| 90|} OQS_KEM_classic_mceliece_6960119f_keypair: 54| 90|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119f_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 90|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119f_avx2) 56| 90|#if defined(OQS_DIST_BUILD) 57| 90| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (57:6): [True: 90, False: 0] | Branch (57:49): [True: 90, False: 0] | Branch (57:94): [True: 90, False: 0] ------------------ 58| 90|#endif /* OQS_DIST_BUILD */ 59| 90| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 90|#if defined(OQS_DIST_BUILD) 61| 90| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 90|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 90|} OQS_KEM_classic_mceliece_6960119f_encaps: 78| 90|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119f_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 90|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119f_avx2) 80| 90|#if defined(OQS_DIST_BUILD) 81| 90| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (81:6): [True: 90, False: 0] | Branch (81:49): [True: 90, False: 0] | Branch (81:94): [True: 90, False: 0] ------------------ 82| 90|#endif /* OQS_DIST_BUILD */ 83| 90| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 90|#if defined(OQS_DIST_BUILD) 85| 90| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 90|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 90|} OQS_KEM_classic_mceliece_6960119f_decaps: 94| 90|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119f_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 90|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119f_avx2) 96| 90|#if defined(OQS_DIST_BUILD) 97| 90| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (97:6): [True: 90, False: 0] | Branch (97:49): [True: 90, False: 0] | Branch (97:94): [True: 90, False: 0] ------------------ 98| 90|#endif /* OQS_DIST_BUILD */ 99| 90| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 90|#if defined(OQS_DIST_BUILD) 101| 90| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 90|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 90|} OQS_KEM_classic_mceliece_8192128_new: 9| 85|OQS_KEM *OQS_KEM_classic_mceliece_8192128_new(void) { 10| | 11| 85| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 85| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 85] ------------------ 13| 0| return NULL; 14| 0| } 15| 85| kem->method_name = OQS_KEM_alg_classic_mceliece_8192128; ------------------ | | 58| 85|#define OQS_KEM_alg_classic_mceliece_8192128 "Classic-McEliece-8192128" ------------------ 16| 85| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 85| kem->claimed_nist_level = 5; 19| 85| kem->ind_cca = true; 20| | 21| 85| kem->length_public_key = OQS_KEM_classic_mceliece_8192128_length_public_key; ------------------ | | 129| 85|#define OQS_KEM_classic_mceliece_8192128_length_public_key 1357824 ------------------ 22| 85| kem->length_secret_key = OQS_KEM_classic_mceliece_8192128_length_secret_key; ------------------ | | 130| 85|#define OQS_KEM_classic_mceliece_8192128_length_secret_key 14120 ------------------ 23| 85| kem->length_ciphertext = OQS_KEM_classic_mceliece_8192128_length_ciphertext; ------------------ | | 131| 85|#define OQS_KEM_classic_mceliece_8192128_length_ciphertext 208 ------------------ 24| 85| kem->length_shared_secret = OQS_KEM_classic_mceliece_8192128_length_shared_secret; ------------------ | | 132| 85|#define OQS_KEM_classic_mceliece_8192128_length_shared_secret 32 ------------------ 25| 85| kem->length_keypair_seed = OQS_KEM_classic_mceliece_8192128_length_keypair_seed; ------------------ | | 133| 85|#define OQS_KEM_classic_mceliece_8192128_length_keypair_seed 0 ------------------ 26| 85| kem->length_encaps_seed = OQS_KEM_classic_mceliece_8192128_length_encaps_seed; ------------------ | | 134| 85|#define OQS_KEM_classic_mceliece_8192128_length_encaps_seed 0 ------------------ 27| | 28| 85| kem->keypair = OQS_KEM_classic_mceliece_8192128_keypair; 29| 85| kem->keypair_derand = OQS_KEM_classic_mceliece_8192128_keypair_derand; 30| 85| kem->encaps = OQS_KEM_classic_mceliece_8192128_encaps; 31| 85| kem->encaps_derand = OQS_KEM_classic_mceliece_8192128_encaps_derand; 32| 85| kem->decaps = OQS_KEM_classic_mceliece_8192128_decaps; 33| | 34| 85| return kem; 35| 85|} OQS_KEM_classic_mceliece_8192128_keypair: 54| 85|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 85|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128_avx2) 56| 85|#if defined(OQS_DIST_BUILD) 57| 85| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (57:6): [True: 85, False: 0] | Branch (57:49): [True: 85, False: 0] ------------------ 58| 85|#endif /* OQS_DIST_BUILD */ 59| 85| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 85|#if defined(OQS_DIST_BUILD) 61| 85| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 85|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 85|} OQS_KEM_classic_mceliece_8192128_encaps: 78| 85|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 85|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128_avx2) 80| 85|#if defined(OQS_DIST_BUILD) 81| 85| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (81:6): [True: 85, False: 0] | Branch (81:49): [True: 85, False: 0] ------------------ 82| 85|#endif /* OQS_DIST_BUILD */ 83| 85| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 85|#if defined(OQS_DIST_BUILD) 85| 85| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 85|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 85|} OQS_KEM_classic_mceliece_8192128_decaps: 94| 85|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 85|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128_avx2) 96| 85|#if defined(OQS_DIST_BUILD) 97| 85| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 85, False: 0] | Branch (97:49): [True: 85, False: 0] ------------------ 98| 85|#endif /* OQS_DIST_BUILD */ 99| 85| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 85|#if defined(OQS_DIST_BUILD) 101| 85| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 85|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 85|} OQS_KEM_classic_mceliece_8192128f_new: 9| 66|OQS_KEM *OQS_KEM_classic_mceliece_8192128f_new(void) { 10| | 11| 66| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 66| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 66] ------------------ 13| 0| return NULL; 14| 0| } 15| 66| kem->method_name = OQS_KEM_alg_classic_mceliece_8192128f; ------------------ | | 60| 66|#define OQS_KEM_alg_classic_mceliece_8192128f "Classic-McEliece-8192128f" ------------------ 16| 66| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 66| kem->claimed_nist_level = 5; 19| 66| kem->ind_cca = true; 20| | 21| 66| kem->length_public_key = OQS_KEM_classic_mceliece_8192128f_length_public_key; ------------------ | | 144| 66|#define OQS_KEM_classic_mceliece_8192128f_length_public_key 1357824 ------------------ 22| 66| kem->length_secret_key = OQS_KEM_classic_mceliece_8192128f_length_secret_key; ------------------ | | 145| 66|#define OQS_KEM_classic_mceliece_8192128f_length_secret_key 14120 ------------------ 23| 66| kem->length_ciphertext = OQS_KEM_classic_mceliece_8192128f_length_ciphertext; ------------------ | | 146| 66|#define OQS_KEM_classic_mceliece_8192128f_length_ciphertext 208 ------------------ 24| 66| kem->length_shared_secret = OQS_KEM_classic_mceliece_8192128f_length_shared_secret; ------------------ | | 147| 66|#define OQS_KEM_classic_mceliece_8192128f_length_shared_secret 32 ------------------ 25| 66| kem->length_keypair_seed = OQS_KEM_classic_mceliece_8192128f_length_keypair_seed; ------------------ | | 148| 66|#define OQS_KEM_classic_mceliece_8192128f_length_keypair_seed 0 ------------------ 26| 66| kem->length_encaps_seed = OQS_KEM_classic_mceliece_8192128f_length_encaps_seed; ------------------ | | 149| 66|#define OQS_KEM_classic_mceliece_8192128f_length_encaps_seed 0 ------------------ 27| | 28| 66| kem->keypair = OQS_KEM_classic_mceliece_8192128f_keypair; 29| 66| kem->keypair_derand = OQS_KEM_classic_mceliece_8192128f_keypair_derand; 30| 66| kem->encaps = OQS_KEM_classic_mceliece_8192128f_encaps; 31| 66| kem->encaps_derand = OQS_KEM_classic_mceliece_8192128f_encaps_derand; 32| 66| kem->decaps = OQS_KEM_classic_mceliece_8192128f_decaps; 33| | 34| 66| return kem; 35| 66|} OQS_KEM_classic_mceliece_8192128f_keypair: 54| 66|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128f_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 66|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128f_avx2) 56| 66|#if defined(OQS_DIST_BUILD) 57| 66| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (57:6): [True: 66, False: 0] | Branch (57:49): [True: 66, False: 0] | Branch (57:94): [True: 66, False: 0] ------------------ 58| 66|#endif /* OQS_DIST_BUILD */ 59| 66| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 66|#if defined(OQS_DIST_BUILD) 61| 66| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 66|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 66|} OQS_KEM_classic_mceliece_8192128f_encaps: 78| 66|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128f_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 66|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128f_avx2) 80| 66|#if defined(OQS_DIST_BUILD) 81| 66| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (81:6): [True: 66, False: 0] | Branch (81:49): [True: 66, False: 0] | Branch (81:94): [True: 66, False: 0] ------------------ 82| 66|#endif /* OQS_DIST_BUILD */ 83| 66| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 66|#if defined(OQS_DIST_BUILD) 85| 66| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 66|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 66|} OQS_KEM_classic_mceliece_8192128f_decaps: 94| 66|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128f_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 66|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128f_avx2) 96| 66|#if defined(OQS_DIST_BUILD) 97| 66| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (97:6): [True: 66, False: 0] | Branch (97:49): [True: 66, False: 0] | Branch (97:94): [True: 66, False: 0] ------------------ 98| 66|#endif /* OQS_DIST_BUILD */ 99| 66| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 66|#if defined(OQS_DIST_BUILD) 101| 66| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 66|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 66|} PQCLEAN_MCELIECE348864_AVX2_load_bits: 168| 103|void load_bits(uint64_t out[][32], const unsigned char *bits) { 169| 103| int i, low, block = 0; 170| | 171| 103| uint64_t cond[64]; 172| | 173| | // 174| | 175| 721| for (low = 0; low <= 5; low++) { ------------------ | Branch (175:19): [True: 618, False: 103] ------------------ 176| 40.1k| for (i = 0; i < 64; i++) { ------------------ | Branch (176:21): [True: 39.5k, False: 618] ------------------ 177| 39.5k| cond[i] = load4(bits + block * 256 + i * 4); 178| 39.5k| } 179| 618| transpose_64x64(cond); 180| | 181| 20.3k| for (i = 0; i < 32; i++) { ------------------ | Branch (181:21): [True: 19.7k, False: 618] ------------------ 182| 19.7k| out[ block ][i] = cond[i]; 183| 19.7k| } 184| 618| block++; 185| 618| } 186| | 187| 721| for (low = 0; low <= 5; low++) { ------------------ | Branch (187:19): [True: 618, False: 103] ------------------ 188| 20.3k| for (i = 0; i < 32; i++) { ------------------ | Branch (188:21): [True: 19.7k, False: 618] ------------------ 189| 19.7k| out[ block ][i] = load8(bits + block * 256 + i * 8); 190| 19.7k| } 191| 618| block++; 192| 618| } 193| | 194| 618| for (low = 4; low >= 0; low--) { ------------------ | Branch (194:19): [True: 515, False: 103] ------------------ 195| 16.9k| for (i = 0; i < 32; i++) { ------------------ | Branch (195:21): [True: 16.4k, False: 515] ------------------ 196| 16.4k| out[ block ][i] = load8(bits + block * 256 + i * 8); 197| 16.4k| } 198| 515| block++; 199| 515| } 200| | 201| 721| for (low = 5; low >= 0; low--) { ------------------ | Branch (201:19): [True: 618, False: 103] ------------------ 202| 40.1k| for (i = 0; i < 64; i++) { ------------------ | Branch (202:21): [True: 39.5k, False: 618] ------------------ 203| 39.5k| cond[i] = load4(bits + block * 256 + i * 4); 204| 39.5k| } 205| 618| transpose_64x64(cond); 206| | 207| 20.3k| for (i = 0; i < 32; i++) { ------------------ | Branch (207:21): [True: 19.7k, False: 618] ------------------ 208| 19.7k| out[ block ][i] = cond[i]; 209| 19.7k| } 210| 618| block++; 211| 618| } 212| 103|} PQCLEAN_MCELIECE348864_AVX2_benes: 218| 206|void benes(uint64_t *r, uint64_t cond[][32], int rev) { 219| 206| int block, inc; 220| | 221| 206| uint64_t *bs = r; 222| | 223| | // 224| | 225| 206| if (rev == 0) { ------------------ | Branch (225:9): [True: 103, False: 103] ------------------ 226| 103| block = 0; 227| 103| inc = 1; 228| 103| } else { 229| 103| block = 22; 230| 103| inc = -1; 231| 103| } 232| | 233| 206| transpose_64x64(bs); 234| | 235| 206| layer_0(bs, cond[ block ]); 236| 206| block += inc; 237| 206| layer_1(bs, cond[ block ]); 238| 206| block += inc; 239| 206| layer_2(bs, cond[ block ]); 240| 206| block += inc; 241| 206| layer_3(bs, cond[ block ]); 242| 206| block += inc; 243| 206| layer_4(bs, cond[ block ]); 244| 206| block += inc; 245| 206| layer_5(bs, cond[ block ]); 246| 206| block += inc; 247| | 248| 206| transpose_64x64(bs); 249| | 250| 206| layer_0(bs, cond[ block ]); 251| 206| block += inc; 252| 206| layer_1(bs, cond[ block ]); 253| 206| block += inc; 254| 206| layer_2(bs, cond[ block ]); 255| 206| block += inc; 256| 206| layer_3(bs, cond[ block ]); 257| 206| block += inc; 258| 206| layer_4(bs, cond[ block ]); 259| 206| block += inc; 260| 206| layer_5(bs, cond[ block ]); 261| 206| block += inc; 262| 206| layer_4(bs, cond[ block ]); 263| 206| block += inc; 264| 206| layer_3(bs, cond[ block ]); 265| 206| block += inc; 266| 206| layer_2(bs, cond[ block ]); 267| 206| block += inc; 268| 206| layer_1(bs, cond[ block ]); 269| 206| block += inc; 270| 206| layer_0(bs, cond[ block ]); 271| 206| block += inc; 272| | 273| 206| transpose_64x64(bs); 274| | 275| 206| layer_5(bs, cond[ block ]); 276| 206| block += inc; 277| 206| layer_4(bs, cond[ block ]); 278| 206| block += inc; 279| 206| layer_3(bs, cond[ block ]); 280| 206| block += inc; 281| 206| layer_2(bs, cond[ block ]); 282| 206| block += inc; 283| 206| layer_1(bs, cond[ block ]); 284| 206| block += inc; 285| 206| layer_0(bs, cond[ block ]); 286| | 287| 206| transpose_64x64(bs); 288| 206|} benes.c:layer_0: 13| 7.34k|static void layer_0(uint64_t *bs, uint64_t *cond) { 14| 7.34k| int x; 15| 7.34k| uint64_t diff; 16| | 17| 242k| for (x = 0; x < (1 << 6); x += 2) { ------------------ | Branch (17:17): [True: 235k, False: 7.34k] ------------------ 18| 235k| diff = bs[ x ] ^ bs[ x + 1 ]; 19| 235k| diff &= *cond++; 20| 235k| bs[ x ] ^= diff; 21| 235k| bs[ x + 1 ] ^= diff; 22| 235k| } 23| 7.34k|} benes.c:layer_1: 25| 7.34k|static void layer_1(uint64_t *bs, const uint64_t *cond) { 26| 7.34k| int x; 27| 7.34k| uint64_t diff; 28| | 29| 124k| for (x = 0; x < (1 << 6); x += 4) { ------------------ | Branch (29:17): [True: 117k, False: 7.34k] ------------------ 30| 117k| diff = bs[ x + 0 ] ^ bs[ x + 2 ]; 31| 117k| diff &= cond[0]; 32| 117k| bs[ x + 0 ] ^= diff; 33| 117k| bs[ x + 2 ] ^= diff; 34| | 35| 117k| diff = bs[ x + 1 ] ^ bs[ x + 3 ]; 36| 117k| diff &= cond[1]; 37| 117k| bs[ x + 1 ] ^= diff; 38| 117k| bs[ x + 3 ] ^= diff; 39| | 40| 117k| cond += 2; 41| 117k| } 42| 7.34k|} benes.c:layer_2: 44| 7.34k|static void layer_2(uint64_t *bs, const uint64_t *cond) { 45| 7.34k| int x; 46| 7.34k| uint64_t diff; 47| | 48| 66.0k| for (x = 0; x < (1 << 6); x += 8) { ------------------ | Branch (48:17): [True: 58.7k, False: 7.34k] ------------------ 49| 58.7k| diff = bs[ x + 0 ] ^ bs[ x + 4 ]; 50| 58.7k| diff &= cond[0]; 51| 58.7k| bs[ x + 0 ] ^= diff; 52| 58.7k| bs[ x + 4 ] ^= diff; 53| | 54| 58.7k| diff = bs[ x + 1 ] ^ bs[ x + 5 ]; 55| 58.7k| diff &= cond[1]; 56| 58.7k| bs[ x + 1 ] ^= diff; 57| 58.7k| bs[ x + 5 ] ^= diff; 58| | 59| 58.7k| diff = bs[ x + 2 ] ^ bs[ x + 6 ]; 60| 58.7k| diff &= cond[2]; 61| 58.7k| bs[ x + 2 ] ^= diff; 62| 58.7k| bs[ x + 6 ] ^= diff; 63| | 64| 58.7k| diff = bs[ x + 3 ] ^ bs[ x + 7 ]; 65| 58.7k| diff &= cond[3]; 66| 58.7k| bs[ x + 3 ] ^= diff; 67| 58.7k| bs[ x + 7 ] ^= diff; 68| | 69| 58.7k| cond += 4; 70| 58.7k| } 71| 7.34k|} benes.c:layer_3: 73| 7.34k|static void layer_3(uint64_t *bs, const uint64_t *cond) { 74| 7.34k| int x, s; 75| 7.34k| uint64_t diff; 76| | 77| 36.7k| for (x = 0; x < (1 << 6); x += 16) { ------------------ | Branch (77:17): [True: 29.3k, False: 7.34k] ------------------ 78| 88.1k| for (s = x; s < x + 8; s += 4) { ------------------ | Branch (78:21): [True: 58.7k, False: 29.3k] ------------------ 79| 58.7k| diff = bs[ s + 0 ] ^ bs[ s + 8 ]; 80| 58.7k| diff &= cond[0]; 81| 58.7k| bs[ s + 0 ] ^= diff; 82| 58.7k| bs[ s + 8 ] ^= diff; 83| | 84| 58.7k| diff = bs[ s + 1 ] ^ bs[ s + 9 ]; 85| 58.7k| diff &= cond[1]; 86| 58.7k| bs[ s + 1 ] ^= diff; 87| 58.7k| bs[ s + 9 ] ^= diff; 88| | 89| 58.7k| diff = bs[ s + 2 ] ^ bs[ s + 10 ]; 90| 58.7k| diff &= cond[2]; 91| 58.7k| bs[ s + 2 ] ^= diff; 92| 58.7k| bs[ s + 10 ] ^= diff; 93| | 94| 58.7k| diff = bs[ s + 3 ] ^ bs[ s + 11 ]; 95| 58.7k| diff &= cond[3]; 96| 58.7k| bs[ s + 3 ] ^= diff; 97| 58.7k| bs[ s + 11 ] ^= diff; 98| | 99| 58.7k| cond += 4; 100| 58.7k| } 101| 29.3k| } 102| 7.34k|} benes.c:layer_4: 104| 7.34k|static void layer_4(uint64_t *bs, const uint64_t *cond) { 105| 7.34k| int x, s; 106| 7.34k| uint64_t diff; 107| | 108| 22.0k| for (x = 0; x < (1 << 6); x += 32) { ------------------ | Branch (108:17): [True: 14.6k, False: 7.34k] ------------------ 109| 73.4k| for (s = x; s < x + 16; s += 4) { ------------------ | Branch (109:21): [True: 58.7k, False: 14.6k] ------------------ 110| 58.7k| diff = bs[ s + 0 ] ^ bs[ s + 16 ]; 111| 58.7k| diff &= cond[0]; 112| 58.7k| bs[ s + 0 ] ^= diff; 113| 58.7k| bs[ s + 16 ] ^= diff; 114| | 115| 58.7k| diff = bs[ s + 1 ] ^ bs[ s + 17 ]; 116| 58.7k| diff &= cond[1]; 117| 58.7k| bs[ s + 1 ] ^= diff; 118| 58.7k| bs[ s + 17 ] ^= diff; 119| | 120| 58.7k| diff = bs[ s + 2 ] ^ bs[ s + 18 ]; 121| 58.7k| diff &= cond[2]; 122| 58.7k| bs[ s + 2 ] ^= diff; 123| 58.7k| bs[ s + 18 ] ^= diff; 124| | 125| 58.7k| diff = bs[ s + 3 ] ^ bs[ s + 19 ]; 126| 58.7k| diff &= cond[3]; 127| 58.7k| bs[ s + 3 ] ^= diff; 128| 58.7k| bs[ s + 19 ] ^= diff; 129| | 130| 58.7k| cond += 4; 131| 58.7k| } 132| 14.6k| } 133| 7.34k|} benes.c:layer_5: 135| 5.50k|static void layer_5(uint64_t *bs, const uint64_t *cond) { 136| 5.50k| int x, s; 137| 5.50k| uint64_t diff; 138| | 139| 11.0k| for (x = 0; x < (1 << 6); x += 64) { ------------------ | Branch (139:17): [True: 5.50k, False: 5.50k] ------------------ 140| 49.5k| for (s = x; s < x + 32; s += 4) { ------------------ | Branch (140:21): [True: 44.0k, False: 5.50k] ------------------ 141| 44.0k| diff = bs[ s + 0 ] ^ bs[ s + 32 ]; 142| 44.0k| diff &= cond[0]; 143| 44.0k| bs[ s + 0 ] ^= diff; 144| 44.0k| bs[ s + 32 ] ^= diff; 145| | 146| 44.0k| diff = bs[ s + 1 ] ^ bs[ s + 33 ]; 147| 44.0k| diff &= cond[1]; 148| 44.0k| bs[ s + 1 ] ^= diff; 149| 44.0k| bs[ s + 33 ] ^= diff; 150| | 151| 44.0k| diff = bs[ s + 2 ] ^ bs[ s + 34 ]; 152| 44.0k| diff &= cond[2]; 153| 44.0k| bs[ s + 2 ] ^= diff; 154| 44.0k| bs[ s + 34 ] ^= diff; 155| | 156| 44.0k| diff = bs[ s + 3 ] ^ bs[ s + 35 ]; 157| 44.0k| diff &= cond[3]; 158| 44.0k| bs[ s + 3 ] ^= diff; 159| 44.0k| bs[ s + 35 ] ^= diff; 160| | 161| 44.0k| cond += 4; 162| 44.0k| } 163| 5.50k| } 164| 5.50k|} PQCLEAN_MCELIECE348864_AVX2_bm: 140| 103|void bm(uint64_t out[ GFBITS ], vec128 in[ GFBITS ]) { 141| 103| uint16_t i; 142| 103| uint16_t N, L; 143| | 144| 103| uint64_t prod[ GFBITS ]; 145| 103| uint64_t in_tmp[ GFBITS ]; 146| | 147| 103| uint64_t db[ GFBITS ][ 2 ]; 148| 103| uint64_t BC_tmp[ GFBITS ][ 2 ]; 149| 103| uint64_t BC[ GFBITS ][ 2 ]; 150| | 151| 103| uint64_t mask, t; 152| | 153| 103| gf d, b, c0 = 1; 154| | 155| 103| gf coefs[SYS_T * 2]; 156| | 157| | // init 158| | 159| 103| BC[0][1] = 0; 160| 103| BC[0][0] = 1; 161| 103| BC[0][0] <<= 63; 162| | 163| 1.23k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.23k|#define GFBITS 12 ------------------ | Branch (163:17): [True: 1.13k, False: 103] ------------------ 164| 1.13k| BC[i][0] = BC[i][1] = 0; 165| 1.13k| } 166| | 167| 103| b = 1; 168| 103| L = 0; 169| | 170| | // 171| | 172| 103| get_coefs(coefs, in); 173| | 174| 1.33k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.33k|#define GFBITS 12 ------------------ | Branch (174:17): [True: 1.23k, False: 103] ------------------ 175| 1.23k| in_tmp[i] = 0; 176| 1.23k| } 177| | 178| 13.2k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 13.2k|#define SYS_T 64 ------------------ | Branch (178:17): [True: 13.1k, False: 103] ------------------ 179| | // computing d 180| | 181| 13.1k| vec_mul_sp(prod, in_tmp, &BC[0][0]); 182| | 183| 13.1k| update_asm(in_tmp, coefs[N], 8); ------------------ | | 1| 13.1k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 13.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 184| | 185| 13.1k| d = vec_reduce_asm(prod); ------------------ | | 3| 13.1k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 13.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 13.1k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 13.1k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 13.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 188| | 189| 13.1k| d ^= t & 0xFFFFFFFF; 190| | 191| | // 3 cases 192| | 193| 13.1k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 194| | 195| 171k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 171k|#define GFBITS 12 ------------------ | Branch (195:21): [True: 158k, False: 13.1k] ------------------ 196| 158k| db[i][0] = (d >> i) & 1; 197| 158k| db[i][0] = -db[i][0]; 198| 158k| db[i][1] = (b >> i) & 1; 199| 158k| db[i][1] = -db[i][1]; 200| 158k| } 201| | 202| 13.1k| vec128_mul((vec128 *) BC_tmp, (vec128 *) db, (vec128 *) BC); 203| | 204| 13.1k| vec_cmov(BC, mask); 205| | 206| 13.1k| update_asm(BC, mask & c0, 16); ------------------ | | 1| 13.1k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 13.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 207| | 208| 171k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 171k|#define GFBITS 12 ------------------ | Branch (208:21): [True: 158k, False: 13.1k] ------------------ 209| 158k| BC[i][1] = BC_tmp[i][0] ^ BC_tmp[i][1]; 210| 158k| } 211| | 212| 13.1k| c0 = t >> 32; 213| 13.1k| b = (d & mask) | (b & ~mask); 214| 13.1k| L = ((N + 1 - L) & mask) | (L & ~mask); 215| | 216| 13.1k| } 217| | 218| 103| c0 = gf_inv(c0); ------------------ | | 11| 103|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 103|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 1.33k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.33k|#define GFBITS 12 ------------------ | Branch (220:17): [True: 1.23k, False: 103] ------------------ 221| 1.23k| out[i] = (c0 >> i) & 1; 222| 1.23k| out[i] = -out[i]; 223| 1.23k| } 224| | 225| 103| vec_mul_sp(out, out, &BC[0][0]); 226| 103|} bm.c:get_coefs: 72| 918|static inline void get_coefs(gf *out, vec128 *in) { 73| 918| int i, k; 74| | 75| 918| vec128 mask[4][2]; 76| 918| vec128 buf[16]; 77| | 78| 12.6k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 12.6k|#define GFBITS 12 ------------------ | Branch (78:18): [True: 11.7k, False: 918] ------------------ 79| 11.7k| buf[i] = in[i]; 80| 11.7k| } 81| 3.85k| for (i = GFBITS; i < 16; i++) { ------------------ | | 6| 918|#define GFBITS 12 ------------------ | Branch (81:22): [True: 2.93k, False: 918] ------------------ 82| 2.93k| buf[i] = vec128_setzero(); 83| 2.93k| } 84| | 85| 918| mask[0][0] = vec128_set1_16b(0x5555); 86| 918| mask[0][1] = vec128_set1_16b(0xAAAA); 87| 918| mask[1][0] = vec128_set1_16b(0x3333); 88| 918| mask[1][1] = vec128_set1_16b(0xCCCC); 89| 918| mask[2][0] = vec128_set1_16b(0x0F0F); 90| 918| mask[2][1] = vec128_set1_16b(0xF0F0); 91| 918| mask[3][0] = vec128_set1_16b(0x00FF); 92| 918| mask[3][1] = vec128_set1_16b(0xFF00); 93| | 94| 918| interleave(buf, 0, 8, mask[3], 3); 95| 918| interleave(buf, 1, 9, mask[3], 3); 96| 918| interleave(buf, 2, 10, mask[3], 3); 97| 918| interleave(buf, 3, 11, mask[3], 3); 98| 918| interleave(buf, 4, 12, mask[3], 3); 99| 918| interleave(buf, 5, 13, mask[3], 3); 100| 918| interleave(buf, 6, 14, mask[3], 3); 101| 918| interleave(buf, 7, 15, mask[3], 3); 102| | 103| 918| interleave(buf, 0, 4, mask[2], 2); 104| 918| interleave(buf, 1, 5, mask[2], 2); 105| 918| interleave(buf, 2, 6, mask[2], 2); 106| 918| interleave(buf, 3, 7, mask[2], 2); 107| 918| interleave(buf, 8, 12, mask[2], 2); 108| 918| interleave(buf, 9, 13, mask[2], 2); 109| 918| interleave(buf, 10, 14, mask[2], 2); 110| 918| interleave(buf, 11, 15, mask[2], 2); 111| | 112| 918| interleave(buf, 0, 2, mask[1], 1); 113| 918| interleave(buf, 1, 3, mask[1], 1); 114| 918| interleave(buf, 4, 6, mask[1], 1); 115| 918| interleave(buf, 5, 7, mask[1], 1); 116| 918| interleave(buf, 8, 10, mask[1], 1); 117| 918| interleave(buf, 9, 11, mask[1], 1); 118| 918| interleave(buf, 12, 14, mask[1], 1); 119| 918| interleave(buf, 13, 15, mask[1], 1); 120| | 121| 918| interleave(buf, 0, 1, mask[0], 0); 122| 918| interleave(buf, 2, 3, mask[0], 0); 123| 918| interleave(buf, 4, 5, mask[0], 0); 124| 918| interleave(buf, 6, 7, mask[0], 0); 125| 918| interleave(buf, 8, 9, mask[0], 0); 126| 918| interleave(buf, 10, 11, mask[0], 0); 127| 918| interleave(buf, 12, 13, mask[0], 0); 128| 918| interleave(buf, 14, 15, mask[0], 0); 129| | 130| 15.6k| for (i = 0; i < 16; i++) { ------------------ | Branch (130:17): [True: 14.6k, False: 918] ------------------ 131| 73.4k| for (k = 0; k < 4; k++) { ------------------ | Branch (131:21): [True: 58.7k, False: 14.6k] ------------------ 132| 58.7k| out[ (4 * 0 + k) * 16 + i ] = (vec128_extract(buf[i], 0) >> (k * 16)) & GFMASK; ------------------ | | 28| 58.7k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ out[ (4 * 0 + k) * 16 + i ] = (vec128_extract(buf[i], 0) >> (k * 16)) & GFMASK; ------------------ | | 19| 58.7k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 58.7k|#define GFBITS 12 | | ------------------ ------------------ 133| 58.7k| out[ (4 * 1 + k) * 16 + i ] = (vec128_extract(buf[i], 1) >> (k * 16)) & GFMASK; ------------------ | | 28| 58.7k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ out[ (4 * 1 + k) * 16 + i ] = (vec128_extract(buf[i], 1) >> (k * 16)) & GFMASK; ------------------ | | 19| 58.7k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 58.7k|#define GFBITS 12 | | ------------------ ------------------ 134| 58.7k| } 135| 14.6k| } 136| 918|} bm.c:interleave: 55| 29.3k|static inline void interleave(vec128 *in, int idx0, int idx1, vec128 *mask, int b) { 56| 29.3k| int s = 1 << b; 57| | 58| 29.3k| vec128 x, y; 59| | 60| 29.3k| x = vec128_or(vec128_and(in[idx0], mask[0]), 61| 29.3k| vec128_sll_2x(vec128_and(in[idx1], mask[0]), s)); ------------------ | | 46| 29.3k|#define vec128_sll_2x(a, s) ((vec128) _mm_slli_epi64((vec128) (a), (s))) ------------------ 62| | 63| 29.3k| y = vec128_or(vec128_srl_2x(vec128_and(in[idx0], mask[1]), s), ------------------ | | 47| 29.3k|#define vec128_srl_2x(a, s) ((vec128) _mm_srli_epi64((vec128) (a), (s))) ------------------ 64| 29.3k| vec128_and(in[idx1], mask[1])); 65| | 66| 29.3k| in[idx0] = x; 67| 29.3k| in[idx1] = y; 68| 29.3k|} bm.c:mask_nonzero: 26| 195k|static inline uint64_t mask_nonzero(gf a) { 27| 195k| uint64_t ret = a; 28| | 29| 195k| ret -= 1; 30| 195k| ret >>= 63; 31| 195k| ret -= 1; 32| | 33| 195k| return ret; 34| 195k|} bm.c:mask_leq: 36| 195k|static inline uint64_t mask_leq(uint16_t a, uint16_t b) { 37| 195k| uint64_t a_tmp = a; 38| 195k| uint64_t b_tmp = b; 39| 195k| uint64_t ret = b_tmp - a_tmp; 40| | 41| 195k| ret >>= 63; 42| 195k| ret -= 1; 43| | 44| 195k| return ret; 45| 195k|} bm.c:vec_cmov: 47| 23.4k|static inline void vec_cmov(uint64_t out[][2], uint64_t mask) { 48| 23.4k| int i; 49| | 50| 304k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 304k|#define GFBITS 12 ------------------ | Branch (50:17): [True: 281k, False: 23.4k] ------------------ 51| 281k| out[i][0] = (out[i][0] & ~mask) | (out[i][1] & mask); 52| 281k| } 53| 23.4k|} PQCLEAN_MCELIECE348864_AVX2_controlbitsfrompermutation: 205| 103|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 103| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 103|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 103| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 103|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 103| int16 diff; 209| 103| int i; 210| 103| unsigned char *ptr; 211| | 212| 103| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 103| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 103| while (1) { ------------------ | Branch (215:12): [True: 103, Folded] ------------------ 216| 103| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 103| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 421k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 421k, False: 103] ------------------ 222| 421k| pi_test[i] = (int16)i; 223| 421k| } 224| | 225| 103| ptr = out; 226| 1.33k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.23k, False: 103] ------------------ 227| 1.23k| layer(pi_test, ptr, i, (int32)n); 228| 1.23k| ptr += n >> 4; 229| 1.23k| } 230| | 231| 1.23k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.13k, False: 103] ------------------ 232| 1.13k| layer(pi_test, ptr, i, (int32)n); 233| 1.13k| ptr += n >> 4; 234| 1.13k| } 235| | 236| 103| diff = 0; 237| 421k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 421k, False: 103] ------------------ 238| 421k| diff |= pi[i] ^ pi_test[i]; 239| 421k| } 240| | 241| 103| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 103|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 103|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 242| 103| crypto_declassify(&diff, sizeof diff); 243| 103| if (diff == 0) { ------------------ | Branch (243:13): [True: 103, False: 0] ------------------ 244| 103| break; 245| 103| } 246| 103| } 247| 103|} PQCLEAN_MCELIECE348864_AVX2_crypto_int16_negative_mask: 3| 206|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 206| return crypto_int16_x >> 15; 5| 206|} PQCLEAN_MCELIECE348864_AVX2_crypto_int16_nonzero_mask: 7| 103|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 103| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 103|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 103|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 103|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 103|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 9| 103|} PQCLEAN_MCELIECE348864_AVX2_crypto_int32_negative_mask: 3| 27.8M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 27.8M| return crypto_int32_x >> 31; 5| 27.8M|} PQCLEAN_MCELIECE348864_AVX2_crypto_int32_min: 37| 27.8M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 27.8M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 27.8M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 27.8M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 27.8M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 27.8M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 27.8M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 42| 27.8M| crypto_int32_z &= crypto_int32_xy; 43| 27.8M| return crypto_int32_x ^ crypto_int32_z; 44| 27.8M|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint16_signed_negative_mask: 3| 153k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 153k| return crypto_uint16_signed_x >> 15; 5| 153k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint16_nonzero_mask: 7| 64.9k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 64.9k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 64.9k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 64.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 64.9k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 64.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 9| 64.9k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint16_zero_mask: 11| 64.9k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 64.9k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 64.9k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 64.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 13| 64.9k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint16_smaller_mask: 24| 23.5k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 23.5k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 23.5k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 23.5k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 23.5k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 23.5k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 23.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 29| 23.5k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint32_signed_negative_mask: 3| 39.6k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 39.6k| return crypto_uint32_signed_x >> 31; 5| 39.6k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint32_nonzero_mask: 7| 19.8k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 19.8k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 19.8k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 19.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 19.8k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 19.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 9| 19.8k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint32_unequal_mask: 15| 19.8k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 19.8k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 19.8k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 19.8k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 19.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 18| 19.8k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint32_equal_mask: 20| 19.8k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 19.8k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 19.8k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 19.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 22| 19.8k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint64_signed_negative_mask: 3| 9.69M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 9.69M| return crypto_uint64_signed_x >> 63; 5| 9.69M|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint64_nonzero_mask: 7| 4.84M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 4.84M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 4.84M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 4.84M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 4.84M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 4.84M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 9| 4.84M|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint64_zero_mask: 11| 757k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 757k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 757k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 757k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 13| 757k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint64_unequal_mask: 15| 4.09M|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 4.09M| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 4.09M| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 4.09M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 4.09M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 18| 4.09M|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint64_equal_mask: 20| 4.09M|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 4.09M| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 4.09M|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 4.09M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 22| 4.09M|} PQCLEAN_MCELIECE348864_AVX2_decrypt: 171| 103|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 103| int i; 173| | 174| 103| uint16_t check_synd; 175| 103| uint16_t check_weight; 176| | 177| 103| vec256 inv[ 16 ][ GFBITS ]; 178| 103| vec256 scaled[ 16 ][ GFBITS ]; 179| 103| vec256 eval[16][ GFBITS ]; 180| | 181| 103| vec128 error128[ 32 ]; 182| 103| vec256 error256[ 16 ]; 183| | 184| 103| vec128 s_priv[ GFBITS ]; 185| 103| vec128 s_priv_cmp[ GFBITS ]; 186| 103| uint64_t locator[ GFBITS ]; 187| | 188| 103| vec128 recv128[ 32 ]; 189| 103| vec256 recv256[ 16 ]; 190| 103| vec256 allone; 191| | 192| 103| uint64_t bits_int[23][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 103| preprocess(recv128, s); 197| | 198| 103| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 103|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 103|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 103|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 103|#define SYS_T 64 | | ------------------ ------------------ 199| 103| benes((uint64_t *) recv128, bits_int, 1); ------------------ | | 9| 103|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 103|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 103| reformat_128to256(recv256, recv128); 202| | 203| 103| scaling(scaled, inv, sk, recv256); 204| 103| fft_tr(s_priv, scaled); ------------------ | | 9| 103|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 103|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 205| 103| bm(locator, s_priv); ------------------ | | 10| 103|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 103|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 103| fft(eval, locator); ------------------ | | 10| 103|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 103|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 103| allone = vec256_set1_16b(0xFFFF); 212| | 213| 1.75k| for (i = 0; i < 16; i++) { ------------------ | Branch (213:17): [True: 1.64k, False: 103] ------------------ 214| 1.64k| error256[i] = vec256_or_reduce(eval[i]); 215| 1.64k| error256[i] = vec256_xor(error256[i], allone); 216| 1.64k| } 217| | 218| 103| scaling_inv(scaled, inv, error256); 219| 103| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 103|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 103|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 103| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 103| reformat_256to128(error128, error256); 226| 103| benes((uint64_t *) error128, bits_int, 0); ------------------ | | 9| 103|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 103|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 103| postprocess(e, error128); 229| | 230| 103| check_weight = weight_check(e, error128); 231| | 232| 103| return 1 - (check_synd & check_weight); 233| 103|} decrypt.c:preprocess: 57| 767|static void preprocess(vec128 *recv, const unsigned char *s) { 58| 767| int i; 59| 767| unsigned char r[ 512 ]; 60| | 61| 126k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 126k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 126k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 126k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 126k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (61:17): [True: 126k, False: 767] ------------------ 62| 126k| r[i] = s[i]; 63| 126k| } 64| | 65| 566k| for (i = SYND_BYTES; i < 512; i++) { ------------------ | | 17| 767|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 767|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 767|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 767|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (65:26): [True: 565k, False: 767] ------------------ 66| 565k| r[i] = 0; 67| 565k| } 68| | 69| 43.9k| for (i = 0; i < 32; i++) { ------------------ | Branch (69:17): [True: 43.2k, False: 767] ------------------ 70| 43.2k| recv[i] = load16(r + i * 16); 71| 43.2k| } 72| 767|} decrypt.c:reformat_128to256: 137| 918|static void reformat_128to256(vec256 *out, vec128 *in) { 138| 918| int i; 139| 918| uint64_t v[4]; 140| | 141| 27.3k| for (i = 0; i < 16; i++) { ------------------ | Branch (141:17): [True: 26.4k, False: 918] ------------------ 142| 26.4k| v[0] = vec128_extract(in[2 * i + 0], 0); ------------------ | | 28| 26.4k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 143| 26.4k| v[1] = vec128_extract(in[2 * i + 0], 1); ------------------ | | 28| 26.4k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 144| 26.4k| v[2] = vec128_extract(in[2 * i + 1], 0); ------------------ | | 28| 26.4k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 145| 26.4k| v[3] = vec128_extract(in[2 * i + 1], 1); ------------------ | | 28| 26.4k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 146| | 147| 26.4k| out[i] = vec256_set4x(v[0], v[1], v[2], v[3]); 148| 26.4k| } 149| 918|} decrypt.c:scaling: 16| 918|static void scaling(vec256 out[][GFBITS], vec256 inv[][GFBITS], const unsigned char *sk, vec256 *recv) { 17| 918| int i, j; 18| | 19| 918| uint64_t sk_int[ GFBITS ]; 20| 918| vec256 eval[16][ GFBITS ]; 21| 918| vec256 tmp[ GFBITS ]; 22| | 23| | // computing inverses 24| | 25| 918| irr_load(sk_int, sk); 26| | 27| 918| fft(eval, sk_int); ------------------ | | 10| 918|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 918|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 28| | 29| 27.3k| for (i = 0; i < 16; i++) { ------------------ | Branch (29:17): [True: 26.4k, False: 918] ------------------ 30| 26.4k| vec256_sq(eval[i], eval[i]); ------------------ | | 14| 26.4k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 26.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 31| 26.4k| } 32| | 33| 918| vec256_copy(inv[0], eval[0]); 34| | 35| 26.4k| for (i = 1; i < 16; i++) { ------------------ | Branch (35:17): [True: 25.5k, False: 918] ------------------ 36| 25.5k| vec256_mul(inv[i], inv[i - 1], eval[i]); 37| 25.5k| } 38| | 39| 918| vec256_inv(tmp, inv[15]); ------------------ | | 11| 918|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 918|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 40| | 41| 26.4k| for (i = 14; i >= 0; i--) { ------------------ | Branch (41:18): [True: 25.5k, False: 918] ------------------ 42| 25.5k| vec256_mul(inv[i + 1], tmp, inv[i]); 43| 25.5k| vec256_mul(tmp, tmp, eval[i + 1]); 44| 25.5k| } 45| | 46| 918| vec256_copy(inv[0], tmp); 47| | 48| | // 49| | 50| 27.3k| for (i = 0; i < 16; i++) { ------------------ | Branch (50:17): [True: 26.4k, False: 918] ------------------ 51| 367k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 367k|#define GFBITS 12 ------------------ | Branch (51:21): [True: 340k, False: 26.4k] ------------------ 52| 340k| out[i][j] = vec256_and(inv[i][j], recv[i]); 53| 340k| } 54| 26.4k| } 55| 918|} decrypt.c:scaling_inv: 92| 918|static void scaling_inv(vec256 out[][GFBITS], vec256 inv[][GFBITS], vec256 *recv) { 93| 918| int i, j; 94| | 95| 27.3k| for (i = 0; i < 16; i++) { ------------------ | Branch (95:17): [True: 26.4k, False: 918] ------------------ 96| 367k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 367k|#define GFBITS 12 ------------------ | Branch (96:21): [True: 340k, False: 26.4k] ------------------ 97| 340k| out[i][j] = vec256_and(inv[i][j], recv[i]); 98| 340k| } 99| 26.4k| } 100| 918|} decrypt.c:synd_cmp: 124| 918|static uint64_t synd_cmp(vec128 *s0, vec128 *s1) { 125| 918| int i; 126| 918| vec128 diff; 127| | 128| 918| diff = vec128_xor(s0[0], s1[0]); 129| | 130| 11.7k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 11.7k|#define GFBITS 12 ------------------ | Branch (130:17): [True: 10.8k, False: 918] ------------------ 131| 10.8k| diff = vec128_or(diff, vec128_xor(s0[i], s1[i])); 132| 10.8k| } 133| | 134| 918| return vec128_testz(diff); 135| 918|} decrypt.c:reformat_256to128: 151| 918|static void reformat_256to128(vec128 *out, vec256 *in) { 152| 918| int i; 153| 918| uint64_t v[4]; 154| | 155| 27.3k| for (i = 0; i < 16; i++) { ------------------ | Branch (155:17): [True: 26.4k, False: 918] ------------------ 156| 26.4k| v[0] = vec256_extract(in[i], 0); ------------------ | | 39| 26.4k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 157| 26.4k| v[1] = vec256_extract(in[i], 1); ------------------ | | 39| 26.4k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 158| 26.4k| v[2] = vec256_extract(in[i], 2); ------------------ | | 39| 26.4k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 159| 26.4k| v[3] = vec256_extract(in[i], 3); ------------------ | | 39| 26.4k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 160| | 161| 26.4k| out[2 * i + 0] = vec128_set2x(v[0], v[1]); 162| 26.4k| out[2 * i + 1] = vec128_set2x(v[2], v[3]); 163| 26.4k| } 164| 918|} decrypt.c:postprocess: 74| 767|static void postprocess(unsigned char *e, vec128 *err) { 75| 767| int i; 76| 767| unsigned char error8[ (1 << GFBITS) / 8 ]; 77| 767| uint64_t v[2]; 78| | 79| 43.9k| for (i = 0; i < 32; i++) { ------------------ | Branch (79:17): [True: 43.2k, False: 767] ------------------ 80| 43.2k| v[0] = vec128_extract(err[i], 0); ------------------ | | 28| 43.2k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 81| 43.2k| v[1] = vec128_extract(err[i], 1); ------------------ | | 28| 43.2k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 82| | 83| 43.2k| store8(error8 + i * 16 + 0, v[0]); 84| 43.2k| store8(error8 + i * 16 + 8, v[1]); 85| 43.2k| } 86| | 87| 524k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 524k|#define SYS_N 3488 ------------------ | Branch (87:17): [True: 524k, False: 767] ------------------ 88| 524k| e[i] = error8[i]; 89| 524k| } 90| 767|} decrypt.c:weight_check: 102| 767|static int weight_check(unsigned char *e, vec128 *error) { 103| 767| int i; 104| 767| uint16_t w0 = 0; 105| 767| uint16_t w1 = 0; 106| 767| uint16_t check; 107| | 108| 43.9k| for (i = 0; i < 32; i++) { ------------------ | Branch (108:17): [True: 43.2k, False: 767] ------------------ 109| 43.2k| w0 += __builtin_popcountll( vec128_extract(error[i], 0) ); ------------------ | | 28| 43.2k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 110| 43.2k| w0 += __builtin_popcountll( vec128_extract(error[i], 1) ); ------------------ | | 28| 43.2k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 111| 43.2k| } 112| | 113| 524k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 524k|#define SYS_N 3488 ------------------ | Branch (113:17): [True: 524k, False: 767] ------------------ 114| 524k| w1 += __builtin_popcountll( e[i] ); 115| 524k| } 116| | 117| 767| check = (w0 ^ SYS_T) | (w1 ^ SYS_T); ------------------ | | 8| 767|#define SYS_T 64 ------------------ check = (w0 ^ SYS_T) | (w1 ^ SYS_T); ------------------ | | 8| 767|#define SYS_T 64 ------------------ 118| 767| check -= 1; 119| 767| check >>= 15; 120| | 121| 767| return check; 122| 767|} PQCLEAN_MCELIECE348864_AVX2_encrypt: 114| 103|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 115| 103| gen_e(e); 116| | 117| 103| syndrome_asm(s, pk, e); ------------------ | | 1| 103|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 103|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 118| 103|} PQCLEAN_MCELIECE348864_AVX2_fft: 171| 1.22k|void fft(vec256 out[][ GFBITS ], uint64_t *in) { 172| 1.22k| radix_conversions(in); 173| 1.22k| butterflies(out, in); 174| 1.22k|} fft.c:radix_conversions: 15| 1.48k|static void radix_conversions(uint64_t *in) { 16| 1.48k| int i, j, k; 17| | 18| 1.48k| const uint64_t mask[5][2] = { 19| 1.48k| {0x8888888888888888, 0x4444444444444444}, 20| 1.48k| {0xC0C0C0C0C0C0C0C0, 0x3030303030303030}, 21| 1.48k| {0xF000F000F000F000, 0x0F000F000F000F00}, 22| 1.48k| {0xFF000000FF000000, 0x00FF000000FF0000}, 23| 1.48k| {0xFFFF000000000000, 0x0000FFFF00000000} 24| 1.48k| }; 25| | 26| 1.48k| const uint64_t s[5][GFBITS] = { 27| 1.48k|#include "scalars.data" ------------------ | | 1| 1.48k|{ | | 2| 1.48k| 0XF3CFC030FC30F003, | | 3| 1.48k| 0X3FCF0F003C00C00C, | | 4| 1.48k| 0X30033CC300C0C03C, | | 5| 1.48k| 0XCCFF0F3C0F30F0C0, | | 6| 1.48k| 0X0300C03FF303C3F0, | | 7| 1.48k| 0X3FFF3C0FF0CCCCC0, | | 8| 1.48k| 0XF3FFF0C00F3C3CC0, | | 9| 1.48k| 0X3003333FFFC3C000, | | 10| 1.48k| 0X0FF30FFFC3FFF300, | | 11| 1.48k| 0XFFC0F300F0F0CC00, | | 12| 1.48k| 0XC0CFF3FCCC3CFC00, | | 13| 1.48k| 0XFC3C03F0F330C000, | | 14| 1.48k|}, { | | 15| 1.48k| 0X000F00000000F00F, | | 16| 1.48k| 0X00000F00F00000F0, | | 17| 1.48k| 0X0F00000F00000F00, | | 18| 1.48k| 0XF00F00F00F000000, | | 19| 1.48k| 0X00F00000000000F0, | | 20| 1.48k| 0X0000000F00000000, | | 21| 1.48k| 0XF00000000F00F000, | | 22| 1.48k| 0X00F00F00000F0000, | | 23| 1.48k| 0X0000F00000F00F00, | | 24| 1.48k| 0X000F00F00F00F000, | | 25| 1.48k| 0X00F00F0000000000, | | 26| 1.48k| 0X0000000000F00000, | | 27| 1.48k|}, { | | 28| 1.48k| 0X0000FF00FF0000FF, | | 29| 1.48k| 0X0000FF000000FF00, | | 30| 1.48k| 0XFF0000FF00FF0000, | | 31| 1.48k| 0XFFFF0000FF000000, | | 32| 1.48k| 0X00FF00FF00FF0000, | | 33| 1.48k| 0X0000FFFFFF000000, | | 34| 1.48k| 0X00FFFF00FF000000, | | 35| 1.48k| 0XFFFFFF0000FF0000, | | 36| 1.48k| 0XFFFF00FFFF00FF00, | | 37| 1.48k| 0X0000FF0000000000, | | 38| 1.48k| 0XFFFFFF00FF000000, | | 39| 1.48k| 0X00FF000000000000, | | 40| 1.48k|}, { | | 41| 1.48k| 0X000000000000FFFF, | | 42| 1.48k| 0X00000000FFFF0000, | | 43| 1.48k| 0X0000000000000000, | | 44| 1.48k| 0XFFFF000000000000, | | 45| 1.48k| 0X00000000FFFF0000, | | 46| 1.48k| 0X0000FFFF00000000, | | 47| 1.48k| 0X0000000000000000, | | 48| 1.48k| 0X00000000FFFF0000, | | 49| 1.48k| 0X0000FFFF00000000, | | 50| 1.48k| 0X0000000000000000, | | 51| 1.48k| 0X0000000000000000, | | 52| 1.48k| 0X0000000000000000, | | 53| 1.48k|}, { | | 54| 1.48k| 0X00000000FFFFFFFF, | | 55| 1.48k| 0XFFFFFFFF00000000, | | 56| 1.48k| 0XFFFFFFFF00000000, | | 57| 1.48k| 0X0000000000000000, | | 58| 1.48k| 0X0000000000000000, | | 59| 1.48k| 0XFFFFFFFF00000000, | | 60| 1.48k| 0X0000000000000000, | | 61| 1.48k| 0X0000000000000000, | | 62| 1.48k| 0XFFFFFFFF00000000, | | 63| 1.48k| 0X0000000000000000, | | 64| 1.48k| 0X0000000000000000, | | 65| 1.48k| 0X0000000000000000, | | 66| 1.48k|} ------------------ 28| 1.48k| }; 29| | 30| | // 31| | 32| 8.89k| for (j = 0; j <= 4; j++) { ------------------ | Branch (32:17): [True: 7.41k, False: 1.48k] ------------------ 33| 96.3k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 96.3k|#define GFBITS 12 ------------------ | Branch (33:21): [True: 88.9k, False: 7.41k] ------------------ 34| 355k| for (k = 4; k >= j; k--) { ------------------ | Branch (34:25): [True: 266k, False: 88.9k] ------------------ 35| 266k| in[i] ^= (in[i] & mask[k][0]) >> (1 << k); 36| 266k| in[i] ^= (in[i] & mask[k][1]) >> (1 << k); 37| 266k| } 38| 88.9k| } 39| | 40| 7.41k| vec_mul(in, in, s[j]); // scaling 41| 7.41k| } 42| 1.48k|} fft.c:butterflies: 46| 1.48k|static void butterflies(vec256 out[][ GFBITS ], const uint64_t *in) { 47| 1.48k| int i, j, k, s, b; 48| | 49| 1.48k| uint64_t t0, t1, t2, t3; 50| | 51| 1.48k| const vec256 consts[ 17 ][ GFBITS ] = { 52| 1.48k|#include "consts.data" ------------------ | | 1| 1.48k|{ | | 2| 1.48k| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 3| 1.48k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0), | | 4| 1.48k| vec256_set4x(0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0), | | 5| 1.48k| vec256_set4x(0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA), | | 6| 1.48k| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 7| 1.48k| vec256_set4x(0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC), | | 8| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 9| 1.48k| vec256_set4x(0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC), | | 10| 1.48k| vec256_set4x(0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC), | | 11| 1.48k| vec256_set4x(0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A), | | 12| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 13| 1.48k| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 14| 1.48k|}, { | | 15| 1.48k| vec256_set4x(0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C), | | 16| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 17| 1.48k| vec256_set4x(0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555, 0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555), | | 18| 1.48k| vec256_set4x(0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC), | | 19| 1.48k| vec256_set4x(0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C), | | 20| 1.48k| vec256_set4x(0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA), | | 21| 1.48k| vec256_set4x(0x33333333CCCCCCCC, 0x33333333CCCCCCCC, 0x33333333CCCCCCCC, 0x33333333CCCCCCCC), | | 22| 1.48k| vec256_set4x(0x00FF00FFFF00FF00, 0xFF00FF0000FF00FF, 0x00FF00FFFF00FF00, 0xFF00FF0000FF00FF), | | 23| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 24| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 25| 1.48k| vec256_set4x(0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000), | | 26| 1.48k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0), | | 27| 1.48k|}, { | | 28| 1.48k| vec256_set4x(0xAA55AA5555AA55AA, 0x55AA55AAAA55AA55, 0xAA55AA5555AA55AA, 0x55AA55AAAA55AA55), | | 29| 1.48k| vec256_set4x(0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0x33CC33CCCC33CC33, 0x33CC33CCCC33CC33), | | 30| 1.48k| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC), | | 31| 1.48k| vec256_set4x(0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA), | | 32| 1.48k| vec256_set4x(0xFF0000FF00FFFF00, 0xFF0000FF00FFFF00, 0x00FFFF00FF0000FF, 0x00FFFF00FF0000FF), | | 33| 1.48k| vec256_set4x(0x3CC33CC3C33CC33C, 0xC33CC33C3CC33CC3, 0x3CC33CC3C33CC33C, 0xC33CC33C3CC33CC3), | | 34| 1.48k| vec256_set4x(0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555, 0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555), | | 35| 1.48k| vec256_set4x(0x0FF00FF00FF00FF0, 0xF00FF00FF00FF00F, 0x0FF00FF00FF00FF0, 0xF00FF00FF00FF00F), | | 36| 1.48k| vec256_set4x(0xCCCC33333333CCCC, 0x3333CCCCCCCC3333, 0x3333CCCCCCCC3333, 0xCCCC33333333CCCC), | | 37| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 38| 1.48k| vec256_set4x(0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF), | | 39| 1.48k| vec256_set4x(0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C), | | 40| 1.48k|}, { | | 41| 1.48k| vec256_set4x(0x6699669999669966, 0x9966996666996699, 0x6699669999669966, 0x9966996666996699), | | 42| 1.48k| vec256_set4x(0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC), | | 43| 1.48k| vec256_set4x(0xA5A5A5A55A5A5A5A, 0xA5A5A5A55A5A5A5A, 0x5A5A5A5AA5A5A5A5, 0x5A5A5A5AA5A5A5A5), | | 44| 1.48k| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 45| 1.48k| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 46| 1.48k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 47| 1.48k| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 48| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F, 0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F), | | 49| 1.48k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 50| 1.48k| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33), | | 51| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 52| 1.48k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 53| 1.48k|}, { | | 54| 1.48k| vec256_set4x(0x6699669999669966, 0x9966996666996699, 0x6699669999669966, 0x9966996666996699), | | 55| 1.48k| vec256_set4x(0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33), | | 56| 1.48k| vec256_set4x(0x5A5A5A5AA5A5A5A5, 0x5A5A5A5AA5A5A5A5, 0xA5A5A5A55A5A5A5A, 0xA5A5A5A55A5A5A5A), | | 57| 1.48k| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 58| 1.48k| vec256_set4x(0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0, 0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F), | | 59| 1.48k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 60| 1.48k| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 61| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F, 0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F), | | 62| 1.48k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 63| 1.48k| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33), | | 64| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 65| 1.48k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 66| 1.48k|}, { | | 67| 1.48k| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 68| 1.48k| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 69| 1.48k| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 70| 1.48k| vec256_set4x(0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF), | | 71| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00), | | 72| 1.48k| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 73| 1.48k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 74| 1.48k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 75| 1.48k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 76| 1.48k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 77| 1.48k| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 78| 1.48k| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 79| 1.48k|}, { | | 80| 1.48k| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 81| 1.48k| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 82| 1.48k| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 83| 1.48k| vec256_set4x(0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00), | | 84| 1.48k| vec256_set4x(0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF), | | 85| 1.48k| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 86| 1.48k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 87| 1.48k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 88| 1.48k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 89| 1.48k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 90| 1.48k| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 91| 1.48k| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 92| 1.48k|}, { | | 93| 1.48k| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 94| 1.48k| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 95| 1.48k| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 96| 1.48k| vec256_set4x(0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF), | | 97| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00), | | 98| 1.48k| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 99| 1.48k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 100| 1.48k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 101| 1.48k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 102| 1.48k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 103| 1.48k| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 104| 1.48k| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 105| 1.48k|}, { | | 106| 1.48k| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 107| 1.48k| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 108| 1.48k| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 109| 1.48k| vec256_set4x(0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00), | | 110| 1.48k| vec256_set4x(0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF), | | 111| 1.48k| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 112| 1.48k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 113| 1.48k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 114| 1.48k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 115| 1.48k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 116| 1.48k| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 117| 1.48k| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 118| 1.48k|}, { | | 119| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 120| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 121| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 122| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 123| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 124| 1.48k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 125| 1.48k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 126| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 127| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 128| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 129| 1.48k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 130| 1.48k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 131| 1.48k|}, { | | 132| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 133| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 134| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 135| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 136| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 137| 1.48k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 138| 1.48k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 139| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 140| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 141| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 142| 1.48k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 143| 1.48k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 144| 1.48k|}, { | | 145| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 146| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 147| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 148| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 149| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 150| 1.48k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 151| 1.48k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 152| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 153| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 154| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 155| 1.48k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 156| 1.48k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 157| 1.48k|}, { | | 158| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 159| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 160| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 161| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 162| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 163| 1.48k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 164| 1.48k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 165| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 166| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 167| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 168| 1.48k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 169| 1.48k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 170| 1.48k|}, { | | 171| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 172| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 173| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 174| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 175| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 176| 1.48k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 177| 1.48k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 178| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 179| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 180| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 181| 1.48k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 182| 1.48k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 183| 1.48k|}, { | | 184| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 185| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 186| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 187| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 188| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 189| 1.48k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 190| 1.48k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 191| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 192| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 193| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 194| 1.48k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 195| 1.48k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 196| 1.48k|}, { | | 197| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 198| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 199| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 200| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 201| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 202| 1.48k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 203| 1.48k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 204| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 205| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 206| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 207| 1.48k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 208| 1.48k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 209| 1.48k|}, { | | 210| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 211| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 212| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 213| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 214| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 215| 1.48k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 216| 1.48k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 217| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 218| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 219| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 220| 1.48k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 221| 1.48k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 222| 1.48k|}, ------------------ 53| 1.48k| }; 54| | 55| 1.48k| uint64_t consts_ptr = 0; 56| | 57| 1.48k| const unsigned char reversal[64] = { 58| 1.48k| 0, 32, 16, 48, 8, 40, 24, 56, 59| 1.48k| 4, 36, 20, 52, 12, 44, 28, 60, 60| 1.48k| 2, 34, 18, 50, 10, 42, 26, 58, 61| 1.48k| 6, 38, 22, 54, 14, 46, 30, 62, 62| 1.48k| 1, 33, 17, 49, 9, 41, 25, 57, 63| 1.48k| 5, 37, 21, 53, 13, 45, 29, 61, 64| 1.48k| 3, 35, 19, 51, 11, 43, 27, 59, 65| 1.48k| 7, 39, 23, 55, 15, 47, 31, 63 66| 1.48k| }; 67| | 68| | // boradcast 69| | 70| 1.48k| vec256 tmp256[ GFBITS ]; 71| 1.48k| vec256 x[ GFBITS ], y[ GFBITS ]; 72| | 73| 13.3k| for (j = 0; j < 64; j += 8) { ------------------ | Branch (73:17): [True: 11.8k, False: 1.48k] ------------------ 74| 154k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 154k|#define GFBITS 12 ------------------ | Branch (74:21): [True: 142k, False: 11.8k] ------------------ 75| 142k| t0 = (in[i] >> reversal[j + 0]) & 1; 76| 142k| t0 = -t0; 77| 142k| t1 = (in[i] >> reversal[j + 2]) & 1; 78| 142k| t1 = -t1; 79| 142k| t2 = (in[i] >> reversal[j + 4]) & 1; 80| 142k| t2 = -t2; 81| 142k| t3 = (in[i] >> reversal[j + 6]) & 1; 82| 142k| t3 = -t3; 83| | 84| 142k| out[j / 4 + 0][i] = vec256_set4x(t0, t1, t2, t3); 85| | 86| 142k| t0 = (in[i] >> reversal[j + 1]) & 1; 87| 142k| t0 = -t0; 88| 142k| t1 = (in[i] >> reversal[j + 3]) & 1; 89| 142k| t1 = -t1; 90| 142k| t2 = (in[i] >> reversal[j + 5]) & 1; 91| 142k| t2 = -t2; 92| 142k| t3 = (in[i] >> reversal[j + 7]) & 1; 93| 142k| t3 = -t3; 94| | 95| 142k| out[j / 4 + 1][i] = vec256_set4x(t0, t1, t2, t3); 96| 142k| } 97| 11.8k| } 98| | 99| | // 100| | 101| 13.3k| for (i = 0; i < 16; i += 2) { ------------------ | Branch (101:17): [True: 11.8k, False: 1.48k] ------------------ 102| 11.8k| vec256_mul(tmp256, out[i + 1], consts[ 0 ]); 103| | 104| 154k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 154k|#define GFBITS 12 ------------------ | Branch (104:21): [True: 142k, False: 11.8k] ------------------ 105| 142k| out[i + 0][b] ^= tmp256[b]; 106| 142k| } 107| 154k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 154k|#define GFBITS 12 ------------------ | Branch (107:21): [True: 142k, False: 11.8k] ------------------ 108| 142k| out[i + 1][b] ^= out[i + 0][b]; 109| 142k| } 110| 11.8k| } 111| | 112| 13.3k| for (i = 0; i < 16; i += 2) { ------------------ | Branch (112:17): [True: 11.8k, False: 1.48k] ------------------ 113| 154k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 154k|#define GFBITS 12 ------------------ | Branch (113:21): [True: 142k, False: 11.8k] ------------------ 114| 142k| x[b] = vec256_unpack_low_2x(out[i + 0][b], out[i + 1][b]); 115| 142k| } 116| 154k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 154k|#define GFBITS 12 ------------------ | Branch (116:21): [True: 142k, False: 11.8k] ------------------ 117| 142k| y[b] = vec256_unpack_high_2x(out[i + 0][b], out[i + 1][b]); 118| 142k| } 119| | 120| 11.8k| vec256_mul(tmp256, y, consts[ 1 ]); 121| | 122| 154k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 154k|#define GFBITS 12 ------------------ | Branch (122:21): [True: 142k, False: 11.8k] ------------------ 123| 142k| x[b] ^= tmp256[b]; 124| 142k| } 125| 154k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 154k|#define GFBITS 12 ------------------ | Branch (125:21): [True: 142k, False: 11.8k] ------------------ 126| 142k| y[b] ^= x[b]; 127| 142k| } 128| | 129| 154k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 154k|#define GFBITS 12 ------------------ | Branch (129:21): [True: 142k, False: 11.8k] ------------------ 130| 142k| out[i + 0][b] = vec256_unpack_low(x[b], y[b]); 131| 142k| } 132| 154k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 154k|#define GFBITS 12 ------------------ | Branch (132:21): [True: 142k, False: 11.8k] ------------------ 133| 142k| out[i + 1][b] = vec256_unpack_high(x[b], y[b]); 134| 142k| } 135| 11.8k| } 136| | 137| 1.48k| consts_ptr = 2; 138| | 139| 7.41k| for (i = 0; i <= 3; i++) { ------------------ | Branch (139:17): [True: 5.93k, False: 1.48k] ------------------ 140| 5.93k| s = 1 << i; 141| | 142| 28.1k| for (j = 0; j < 16; j += 2 * s) { ------------------ | Branch (142:21): [True: 22.2k, False: 5.93k] ------------------ 143| 69.7k| for (k = j; k < j + s; k++) { ------------------ | Branch (143:25): [True: 47.4k, False: 22.2k] ------------------ 144| 47.4k| vec256_mul(tmp256, out[k + s], consts[ consts_ptr + (k - j) ]); 145| | 146| 616k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 616k|#define GFBITS 12 ------------------ | Branch (146:29): [True: 569k, False: 47.4k] ------------------ 147| 569k| out[k][b] ^= tmp256[b]; 148| 569k| } 149| 616k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 616k|#define GFBITS 12 ------------------ | Branch (149:29): [True: 569k, False: 47.4k] ------------------ 150| 569k| out[k + s][b] ^= out[k][b]; 151| 569k| } 152| 47.4k| } 153| 22.2k| } 154| | 155| 5.93k| consts_ptr += s; 156| 5.93k| } 157| | 158| | // adding the part contributed by x^64 159| | 160| 1.48k| vec256 powers[16][GFBITS] = { 161| 1.48k|#include "powers.data" ------------------ | | 1| 1.48k|{ | | 2| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 3| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 4| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 5| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 6| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 7| 1.48k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 8| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 9| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 10| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 11| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 12| 1.48k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 13| 1.48k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 14| 1.48k|}, { | | 15| 1.48k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 16| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 17| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 18| 1.48k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 19| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 20| 1.48k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 21| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 22| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 23| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 24| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 25| 1.48k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 26| 1.48k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 27| 1.48k|}, { | | 28| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 29| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 30| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 31| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 32| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 33| 1.48k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 34| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 35| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 36| 1.48k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 37| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 38| 1.48k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 39| 1.48k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 40| 1.48k|}, { | | 41| 1.48k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 42| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 43| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 44| 1.48k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 45| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 46| 1.48k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 47| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 48| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 49| 1.48k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 50| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 51| 1.48k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 52| 1.48k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 53| 1.48k|}, { | | 54| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 55| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 56| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 57| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 58| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 59| 1.48k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 60| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 61| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 62| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 63| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 64| 1.48k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 65| 1.48k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 66| 1.48k|}, { | | 67| 1.48k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 68| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 69| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 70| 1.48k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 71| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 72| 1.48k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 73| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 74| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 75| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 76| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 77| 1.48k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 78| 1.48k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 79| 1.48k|}, { | | 80| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 81| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 82| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 83| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 84| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 85| 1.48k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 86| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 87| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 88| 1.48k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 89| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 90| 1.48k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 91| 1.48k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 92| 1.48k|}, { | | 93| 1.48k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 94| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 95| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 96| 1.48k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 97| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 98| 1.48k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 99| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 100| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 101| 1.48k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 102| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 103| 1.48k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 104| 1.48k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 105| 1.48k|}, { | | 106| 1.48k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 107| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 108| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 109| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 110| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 111| 1.48k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 112| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 113| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 114| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 115| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 116| 1.48k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 117| 1.48k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 118| 1.48k|}, { | | 119| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 120| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 121| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 122| 1.48k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 123| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 124| 1.48k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 125| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 126| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 127| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 128| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 129| 1.48k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 130| 1.48k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 131| 1.48k|}, { | | 132| 1.48k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 133| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 134| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 135| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 136| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 137| 1.48k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 138| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 139| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 140| 1.48k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 141| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 142| 1.48k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 143| 1.48k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 144| 1.48k|}, { | | 145| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 146| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 147| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 148| 1.48k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 149| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 150| 1.48k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 151| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 152| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 153| 1.48k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 154| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 155| 1.48k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 156| 1.48k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 157| 1.48k|}, { | | 158| 1.48k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 159| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 160| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 161| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 162| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 163| 1.48k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 164| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 165| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 166| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 167| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 168| 1.48k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 169| 1.48k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 170| 1.48k|}, { | | 171| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 172| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 173| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 174| 1.48k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 175| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 176| 1.48k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 177| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 178| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 179| 1.48k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 180| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 181| 1.48k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 182| 1.48k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 183| 1.48k|}, { | | 184| 1.48k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 185| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 186| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 187| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 188| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 189| 1.48k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 190| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 191| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 192| 1.48k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 193| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 194| 1.48k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 195| 1.48k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 196| 1.48k|}, { | | 197| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 198| 1.48k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 199| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 200| 1.48k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 201| 1.48k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 202| 1.48k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 203| 1.48k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 204| 1.48k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 205| 1.48k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 206| 1.48k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 207| 1.48k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 208| 1.48k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 209| 1.48k|}, ------------------ 162| 1.48k| }; 163| | 164| 25.2k| for (i = 0; i < 16; i++) { ------------------ | Branch (164:17): [True: 23.7k, False: 1.48k] ------------------ 165| 308k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 308k|#define GFBITS 12 ------------------ | Branch (165:21): [True: 284k, False: 23.7k] ------------------ 166| 284k| out[i][b] = vec256_xor(out[i][b], powers[i][b]); 167| 284k| } 168| 23.7k| } 169| 1.48k|} PQCLEAN_MCELIECE348864_AVX2_fft_tr: 354| 206|void fft_tr(vec128 out[GFBITS], vec256 in[][ GFBITS ]) { 355| 206| butterflies_tr(out, in); 356| 206| radix_conversions_tr(out); 357| 206|} fft_tr.c:butterflies_tr: 65| 366|static void butterflies_tr(vec128 out[ GFBITS ], vec256 in[][ GFBITS ]) { 66| 366| int i, j, k, s, b; 67| | 68| 366| uint64_t tmp[ GFBITS ]; 69| 366| uint64_t pre[6][ GFBITS ]; 70| 366| uint64_t out64[2][64]; 71| | 72| 366| vec256 p2[ 6 ]; 73| 366| vec256 buf[64]; 74| 366| vec256 x[ GFBITS ], y[ GFBITS ]; 75| 366| vec256 tmp256[ GFBITS ]; 76| | 77| 366| const vec256 consts[ 17 ][ GFBITS ] = { 78| 366|#include "consts.data" ------------------ | | 1| 366|{ | | 2| 366| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 3| 366| vec256_set4x(0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0), | | 4| 366| vec256_set4x(0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0), | | 5| 366| vec256_set4x(0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA), | | 6| 366| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 7| 366| vec256_set4x(0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC), | | 8| 366| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 9| 366| vec256_set4x(0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC), | | 10| 366| vec256_set4x(0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC), | | 11| 366| vec256_set4x(0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A), | | 12| 366| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 13| 366| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 14| 366|}, { | | 15| 366| vec256_set4x(0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C), | | 16| 366| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 17| 366| vec256_set4x(0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555, 0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555), | | 18| 366| vec256_set4x(0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC), | | 19| 366| vec256_set4x(0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C), | | 20| 366| vec256_set4x(0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA), | | 21| 366| vec256_set4x(0x33333333CCCCCCCC, 0x33333333CCCCCCCC, 0x33333333CCCCCCCC, 0x33333333CCCCCCCC), | | 22| 366| vec256_set4x(0x00FF00FFFF00FF00, 0xFF00FF0000FF00FF, 0x00FF00FFFF00FF00, 0xFF00FF0000FF00FF), | | 23| 366| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 24| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 25| 366| vec256_set4x(0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000), | | 26| 366| vec256_set4x(0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0), | | 27| 366|}, { | | 28| 366| vec256_set4x(0xAA55AA5555AA55AA, 0x55AA55AAAA55AA55, 0xAA55AA5555AA55AA, 0x55AA55AAAA55AA55), | | 29| 366| vec256_set4x(0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0x33CC33CCCC33CC33, 0x33CC33CCCC33CC33), | | 30| 366| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC), | | 31| 366| vec256_set4x(0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA), | | 32| 366| vec256_set4x(0xFF0000FF00FFFF00, 0xFF0000FF00FFFF00, 0x00FFFF00FF0000FF, 0x00FFFF00FF0000FF), | | 33| 366| vec256_set4x(0x3CC33CC3C33CC33C, 0xC33CC33C3CC33CC3, 0x3CC33CC3C33CC33C, 0xC33CC33C3CC33CC3), | | 34| 366| vec256_set4x(0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555, 0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555), | | 35| 366| vec256_set4x(0x0FF00FF00FF00FF0, 0xF00FF00FF00FF00F, 0x0FF00FF00FF00FF0, 0xF00FF00FF00FF00F), | | 36| 366| vec256_set4x(0xCCCC33333333CCCC, 0x3333CCCCCCCC3333, 0x3333CCCCCCCC3333, 0xCCCC33333333CCCC), | | 37| 366| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 38| 366| vec256_set4x(0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF), | | 39| 366| vec256_set4x(0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C), | | 40| 366|}, { | | 41| 366| vec256_set4x(0x6699669999669966, 0x9966996666996699, 0x6699669999669966, 0x9966996666996699), | | 42| 366| vec256_set4x(0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC), | | 43| 366| vec256_set4x(0xA5A5A5A55A5A5A5A, 0xA5A5A5A55A5A5A5A, 0x5A5A5A5AA5A5A5A5, 0x5A5A5A5AA5A5A5A5), | | 44| 366| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 45| 366| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 46| 366| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 47| 366| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 48| 366| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F, 0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F), | | 49| 366| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 50| 366| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33), | | 51| 366| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 52| 366| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 53| 366|}, { | | 54| 366| vec256_set4x(0x6699669999669966, 0x9966996666996699, 0x6699669999669966, 0x9966996666996699), | | 55| 366| vec256_set4x(0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33), | | 56| 366| vec256_set4x(0x5A5A5A5AA5A5A5A5, 0x5A5A5A5AA5A5A5A5, 0xA5A5A5A55A5A5A5A, 0xA5A5A5A55A5A5A5A), | | 57| 366| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 58| 366| vec256_set4x(0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0, 0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F), | | 59| 366| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 60| 366| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 61| 366| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F, 0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F), | | 62| 366| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 63| 366| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33), | | 64| 366| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 65| 366| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 66| 366|}, { | | 67| 366| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 68| 366| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 69| 366| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 70| 366| vec256_set4x(0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF), | | 71| 366| vec256_set4x(0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00), | | 72| 366| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 73| 366| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 74| 366| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 75| 366| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 76| 366| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 77| 366| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 78| 366| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 79| 366|}, { | | 80| 366| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 81| 366| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 82| 366| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 83| 366| vec256_set4x(0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00), | | 84| 366| vec256_set4x(0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF), | | 85| 366| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 86| 366| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 87| 366| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 88| 366| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 89| 366| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 90| 366| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 91| 366| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 92| 366|}, { | | 93| 366| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 94| 366| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 95| 366| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 96| 366| vec256_set4x(0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF), | | 97| 366| vec256_set4x(0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00), | | 98| 366| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 99| 366| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 100| 366| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 101| 366| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 102| 366| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 103| 366| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 104| 366| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 105| 366|}, { | | 106| 366| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 107| 366| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 108| 366| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 109| 366| vec256_set4x(0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00), | | 110| 366| vec256_set4x(0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF), | | 111| 366| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 112| 366| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 113| 366| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 114| 366| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 115| 366| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 116| 366| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 117| 366| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 118| 366|}, { | | 119| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 120| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 121| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 122| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 123| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 124| 366| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 125| 366| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 126| 366| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 127| 366| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 128| 366| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 129| 366| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 130| 366| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 131| 366|}, { | | 132| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 133| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 134| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 135| 366| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 136| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 137| 366| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 138| 366| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 139| 366| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 140| 366| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 141| 366| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 142| 366| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 143| 366| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 144| 366|}, { | | 145| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 146| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 147| 366| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 148| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 149| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 150| 366| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 151| 366| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 152| 366| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 153| 366| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 154| 366| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 155| 366| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 156| 366| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 157| 366|}, { | | 158| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 159| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 160| 366| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 161| 366| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 162| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 163| 366| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 164| 366| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 165| 366| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 166| 366| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 167| 366| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 168| 366| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 169| 366| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 170| 366|}, { | | 171| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 172| 366| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 173| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 174| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 175| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 176| 366| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 177| 366| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 178| 366| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 179| 366| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 180| 366| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 181| 366| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 182| 366| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 183| 366|}, { | | 184| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 185| 366| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 186| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 187| 366| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 188| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 189| 366| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 190| 366| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 191| 366| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 192| 366| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 193| 366| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 194| 366| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 195| 366| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 196| 366|}, { | | 197| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 198| 366| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 199| 366| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 200| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 201| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 202| 366| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 203| 366| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 204| 366| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 205| 366| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 206| 366| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 207| 366| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 208| 366| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 209| 366|}, { | | 210| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 211| 366| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 212| 366| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 213| 366| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 214| 366| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 215| 366| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 216| 366| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 217| 366| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 218| 366| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 219| 366| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 220| 366| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 221| 366| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 222| 366|}, ------------------ 79| 366| }; 80| | 81| 366| uint64_t consts_ptr = 17; 82| | 83| 366| const unsigned char reversal[64] = { 84| 366| 0, 32, 16, 48, 8, 40, 24, 56, 85| 366| 4, 36, 20, 52, 12, 44, 28, 60, 86| 366| 2, 34, 18, 50, 10, 42, 26, 58, 87| 366| 6, 38, 22, 54, 14, 46, 30, 62, 88| 366| 1, 33, 17, 49, 9, 41, 25, 57, 89| 366| 5, 37, 21, 53, 13, 45, 29, 61, 90| 366| 3, 35, 19, 51, 11, 43, 27, 59, 91| 366| 7, 39, 23, 55, 15, 47, 31, 63 92| 366| }; 93| | 94| 366| const uint16_t beta[6] = {8, 1300, 3408, 1354, 2341, 1154}; 95| | 96| | // butterflies 97| | 98| 1.83k| for (i = 3; i >= 0; i--) { ------------------ | Branch (98:17): [True: 1.46k, False: 366] ------------------ 99| 1.46k| s = 1 << i; 100| 1.46k| consts_ptr -= s; 101| | 102| 6.95k| for (j = 0; j < 16; j += 2 * s) { ------------------ | Branch (102:21): [True: 5.49k, False: 1.46k] ------------------ 103| 17.2k| for (k = j; k < j + s; k++) { ------------------ | Branch (103:25): [True: 11.7k, False: 5.49k] ------------------ 104| 152k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 152k|#define GFBITS 12 ------------------ | Branch (104:29): [True: 140k, False: 11.7k] ------------------ 105| 140k| in[k][b] ^= in[k + s][b]; 106| 140k| } 107| 11.7k| vec256_mul(tmp256, in[k], consts[ consts_ptr + (k - j) ]); 108| 152k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 152k|#define GFBITS 12 ------------------ | Branch (108:29): [True: 140k, False: 11.7k] ------------------ 109| 140k| in[k + s][b] ^= tmp256[b]; 110| 140k| } 111| 11.7k| } 112| 5.49k| } 113| 1.46k| } 114| | 115| 3.29k| for (i = 0; i < 16; i += 2) { ------------------ | Branch (115:17): [True: 2.92k, False: 366] ------------------ 116| 38.0k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 38.0k|#define GFBITS 12 ------------------ | Branch (116:21): [True: 35.1k, False: 2.92k] ------------------ 117| 35.1k| x[b] = vec256_unpack_low(in[i + 0][b], in[i + 1][b]); 118| 35.1k| } 119| 38.0k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 38.0k|#define GFBITS 12 ------------------ | Branch (119:21): [True: 35.1k, False: 2.92k] ------------------ 120| 35.1k| y[b] = vec256_unpack_high(in[i + 0][b], in[i + 1][b]); 121| 35.1k| } 122| | 123| 38.0k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 38.0k|#define GFBITS 12 ------------------ | Branch (123:21): [True: 35.1k, False: 2.92k] ------------------ 124| 35.1k| x[b] ^= y[b]; 125| 35.1k| } 126| 2.92k| vec256_mul(tmp256, x, consts[ 1 ]); 127| 38.0k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 38.0k|#define GFBITS 12 ------------------ | Branch (127:21): [True: 35.1k, False: 2.92k] ------------------ 128| 35.1k| y[b] ^= tmp256[b]; 129| 35.1k| } 130| | 131| 38.0k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 38.0k|#define GFBITS 12 ------------------ | Branch (131:21): [True: 35.1k, False: 2.92k] ------------------ 132| 35.1k| in[i + 0][b] = vec256_unpack_low_2x(x[b], y[b]); 133| 35.1k| } 134| 38.0k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 38.0k|#define GFBITS 12 ------------------ | Branch (134:21): [True: 35.1k, False: 2.92k] ------------------ 135| 35.1k| in[i + 1][b] = vec256_unpack_high_2x(x[b], y[b]); 136| 35.1k| } 137| 2.92k| } 138| | 139| 3.29k| for (i = 0; i < 16; i += 2) { ------------------ | Branch (139:17): [True: 2.92k, False: 366] ------------------ 140| 38.0k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 38.0k|#define GFBITS 12 ------------------ | Branch (140:21): [True: 35.1k, False: 2.92k] ------------------ 141| 35.1k| in[i + 0][b] ^= in[i + 1][b]; 142| 35.1k| } 143| 2.92k| vec256_mul(tmp256, in[i + 0], consts[ 0 ]); 144| 38.0k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 38.0k|#define GFBITS 12 ------------------ | Branch (144:21): [True: 35.1k, False: 2.92k] ------------------ 145| 35.1k| in[i + 1][b] ^= tmp256[b]; 146| 35.1k| } 147| 2.92k| } 148| | 149| | // transpose 150| | 151| 1.46k| for (i = 0; i < GFBITS; i += 4) { ------------------ | | 6| 1.46k|#define GFBITS 12 ------------------ | Branch (151:17): [True: 1.09k, False: 366] ------------------ 152| 9.88k| for (j = 0; j < 64; j += 8) { ------------------ | Branch (152:21): [True: 8.78k, False: 1.09k] ------------------ 153| 8.78k| buf[ reversal[j + 0] ] = vec256_set4x(vec256_extract(in[j / 4 + 0][i + 0], 0), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 154| 8.78k| vec256_extract(in[j / 4 + 0][i + 1], 0), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 155| 8.78k| vec256_extract(in[j / 4 + 0][i + 2], 0), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 156| 8.78k| vec256_extract(in[j / 4 + 0][i + 3], 0)); ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 157| 8.78k| buf[ reversal[j + 1] ] = vec256_set4x(vec256_extract(in[j / 4 + 1][i + 0], 0), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 158| 8.78k| vec256_extract(in[j / 4 + 1][i + 1], 0), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 159| 8.78k| vec256_extract(in[j / 4 + 1][i + 2], 0), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 160| 8.78k| vec256_extract(in[j / 4 + 1][i + 3], 0)); ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 161| 8.78k| buf[ reversal[j + 2] ] = vec256_set4x(vec256_extract(in[j / 4 + 0][i + 0], 1), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 162| 8.78k| vec256_extract(in[j / 4 + 0][i + 1], 1), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 163| 8.78k| vec256_extract(in[j / 4 + 0][i + 2], 1), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 164| 8.78k| vec256_extract(in[j / 4 + 0][i + 3], 1)); ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 165| 8.78k| buf[ reversal[j + 3] ] = vec256_set4x(vec256_extract(in[j / 4 + 1][i + 0], 1), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 166| 8.78k| vec256_extract(in[j / 4 + 1][i + 1], 1), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 167| 8.78k| vec256_extract(in[j / 4 + 1][i + 2], 1), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 168| 8.78k| vec256_extract(in[j / 4 + 1][i + 3], 1)); ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 169| 8.78k| buf[ reversal[j + 4] ] = vec256_set4x(vec256_extract(in[j / 4 + 0][i + 0], 2), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 170| 8.78k| vec256_extract(in[j / 4 + 0][i + 1], 2), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 171| 8.78k| vec256_extract(in[j / 4 + 0][i + 2], 2), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 172| 8.78k| vec256_extract(in[j / 4 + 0][i + 3], 2)); ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 173| 8.78k| buf[ reversal[j + 5] ] = vec256_set4x(vec256_extract(in[j / 4 + 1][i + 0], 2), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 174| 8.78k| vec256_extract(in[j / 4 + 1][i + 1], 2), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 175| 8.78k| vec256_extract(in[j / 4 + 1][i + 2], 2), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 176| 8.78k| vec256_extract(in[j / 4 + 1][i + 3], 2)); ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 177| 8.78k| buf[ reversal[j + 6] ] = vec256_set4x(vec256_extract(in[j / 4 + 0][i + 0], 3), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 178| 8.78k| vec256_extract(in[j / 4 + 0][i + 1], 3), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 179| 8.78k| vec256_extract(in[j / 4 + 0][i + 2], 3), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 180| 8.78k| vec256_extract(in[j / 4 + 0][i + 3], 3)); ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 181| 8.78k| buf[ reversal[j + 7] ] = vec256_set4x(vec256_extract(in[j / 4 + 1][i + 0], 3), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 182| 8.78k| vec256_extract(in[j / 4 + 1][i + 1], 3), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 183| 8.78k| vec256_extract(in[j / 4 + 1][i + 2], 3), ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 184| 8.78k| vec256_extract(in[j / 4 + 1][i + 3], 3)); ------------------ | | 39| 8.78k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 185| 8.78k| } 186| | 187| 1.09k| transpose_64x256_sp(buf); 188| | 189| 1.09k| p2[0] = buf[32]; 190| 1.09k| buf[33] = vec256_xor(buf[33], buf[32]); 191| 1.09k| p2[1] = buf[33]; 192| 1.09k| buf[35] = vec256_xor(buf[35], buf[33]); 193| 1.09k| p2[0] = vec256_xor(p2[0], buf[35]); 194| 1.09k| buf[34] = vec256_xor(buf[34], buf[35]); 195| 1.09k| p2[2] = buf[34]; 196| 1.09k| buf[38] = vec256_xor(buf[38], buf[34]); 197| 1.09k| p2[0] = vec256_xor(p2[0], buf[38]); 198| 1.09k| buf[39] = vec256_xor(buf[39], buf[38]); 199| 1.09k| p2[1] = vec256_xor(p2[1], buf[39]); 200| 1.09k| buf[37] = vec256_xor(buf[37], buf[39]); 201| 1.09k| p2[0] = vec256_xor(p2[0], buf[37]); 202| 1.09k| buf[36] = vec256_xor(buf[36], buf[37]); 203| 1.09k| p2[3] = buf[36]; 204| 1.09k| buf[44] = vec256_xor(buf[44], buf[36]); 205| 1.09k| p2[0] = vec256_xor(p2[0], buf[44]); 206| 1.09k| buf[45] = vec256_xor(buf[45], buf[44]); 207| 1.09k| p2[1] = vec256_xor(p2[1], buf[45]); 208| 1.09k| buf[47] = vec256_xor(buf[47], buf[45]); 209| 1.09k| p2[0] = vec256_xor(p2[0], buf[47]); 210| 1.09k| buf[46] = vec256_xor(buf[46], buf[47]); 211| 1.09k| p2[2] = vec256_xor(p2[2], buf[46]); 212| 1.09k| buf[42] = vec256_xor(buf[42], buf[46]); 213| 1.09k| p2[0] = vec256_xor(p2[0], buf[42]); 214| 1.09k| buf[43] = vec256_xor(buf[43], buf[42]); 215| 1.09k| p2[1] = vec256_xor(p2[1], buf[43]); 216| 1.09k| buf[41] = vec256_xor(buf[41], buf[43]); 217| 1.09k| p2[0] = vec256_xor(p2[0], buf[41]); 218| 1.09k| buf[40] = vec256_xor(buf[40], buf[41]); 219| 1.09k| p2[4] = buf[40]; 220| 1.09k| buf[56] = vec256_xor(buf[56], buf[40]); 221| 1.09k| p2[0] = vec256_xor(p2[0], buf[56]); 222| 1.09k| buf[57] = vec256_xor(buf[57], buf[56]); 223| 1.09k| p2[1] = vec256_xor(p2[1], buf[57]); 224| 1.09k| buf[59] = vec256_xor(buf[59], buf[57]); 225| 1.09k| p2[0] = vec256_xor(p2[0], buf[59]); 226| 1.09k| buf[58] = vec256_xor(buf[58], buf[59]); 227| 1.09k| p2[2] = vec256_xor(p2[2], buf[58]); 228| 1.09k| buf[62] = vec256_xor(buf[62], buf[58]); 229| 1.09k| p2[0] = vec256_xor(p2[0], buf[62]); 230| 1.09k| buf[63] = vec256_xor(buf[63], buf[62]); 231| 1.09k| p2[1] = vec256_xor(p2[1], buf[63]); 232| 1.09k| buf[61] = vec256_xor(buf[61], buf[63]); 233| 1.09k| p2[0] = vec256_xor(p2[0], buf[61]); 234| 1.09k| buf[60] = vec256_xor(buf[60], buf[61]); 235| 1.09k| p2[3] = vec256_xor(p2[3], buf[60]); 236| 1.09k| buf[52] = vec256_xor(buf[52], buf[60]); 237| 1.09k| p2[0] = vec256_xor(p2[0], buf[52]); 238| 1.09k| buf[53] = vec256_xor(buf[53], buf[52]); 239| 1.09k| p2[1] = vec256_xor(p2[1], buf[53]); 240| 1.09k| buf[55] = vec256_xor(buf[55], buf[53]); 241| 1.09k| p2[0] = vec256_xor(p2[0], buf[55]); 242| 1.09k| buf[54] = vec256_xor(buf[54], buf[55]); 243| 1.09k| p2[2] = vec256_xor(p2[2], buf[54]); 244| 1.09k| buf[50] = vec256_xor(buf[50], buf[54]); 245| 1.09k| p2[0] = vec256_xor(p2[0], buf[50]); 246| 1.09k| buf[51] = vec256_xor(buf[51], buf[50]); 247| 1.09k| p2[1] = vec256_xor(p2[1], buf[51]); 248| 1.09k| buf[49] = vec256_xor(buf[49], buf[51]); 249| 1.09k| p2[0] = vec256_xor(p2[0], buf[49]); 250| 1.09k| buf[48] = vec256_xor(buf[48], buf[49]); 251| 1.09k| p2[5] = buf[48]; 252| 1.09k| buf[16] = vec256_xor(buf[16], buf[48]); 253| 1.09k| p2[0] = vec256_xor(p2[0], buf[16]); 254| 1.09k| buf[17] = vec256_xor(buf[17], buf[16]); 255| 1.09k| p2[1] = vec256_xor(p2[1], buf[17]); 256| 1.09k| buf[19] = vec256_xor(buf[19], buf[17]); 257| 1.09k| p2[0] = vec256_xor(p2[0], buf[19]); 258| 1.09k| buf[18] = vec256_xor(buf[18], buf[19]); 259| 1.09k| p2[2] = vec256_xor(p2[2], buf[18]); 260| 1.09k| buf[22] = vec256_xor(buf[22], buf[18]); 261| 1.09k| p2[0] = vec256_xor(p2[0], buf[22]); 262| 1.09k| buf[23] = vec256_xor(buf[23], buf[22]); 263| 1.09k| p2[1] = vec256_xor(p2[1], buf[23]); 264| 1.09k| buf[21] = vec256_xor(buf[21], buf[23]); 265| 1.09k| p2[0] = vec256_xor(p2[0], buf[21]); 266| 1.09k| buf[20] = vec256_xor(buf[20], buf[21]); 267| 1.09k| p2[3] = vec256_xor(p2[3], buf[20]); 268| 1.09k| buf[28] = vec256_xor(buf[28], buf[20]); 269| 1.09k| p2[0] = vec256_xor(p2[0], buf[28]); 270| 1.09k| buf[29] = vec256_xor(buf[29], buf[28]); 271| 1.09k| p2[1] = vec256_xor(p2[1], buf[29]); 272| 1.09k| buf[31] = vec256_xor(buf[31], buf[29]); 273| 1.09k| p2[0] = vec256_xor(p2[0], buf[31]); 274| 1.09k| buf[30] = vec256_xor(buf[30], buf[31]); 275| 1.09k| p2[2] = vec256_xor(p2[2], buf[30]); 276| 1.09k| buf[26] = vec256_xor(buf[26], buf[30]); 277| 1.09k| p2[0] = vec256_xor(p2[0], buf[26]); 278| 1.09k| buf[27] = vec256_xor(buf[27], buf[26]); 279| 1.09k| p2[1] = vec256_xor(p2[1], buf[27]); 280| 1.09k| buf[25] = vec256_xor(buf[25], buf[27]); 281| 1.09k| p2[0] = vec256_xor(p2[0], buf[25]); 282| 1.09k| buf[24] = vec256_xor(buf[24], buf[25]); 283| 1.09k| p2[4] = vec256_xor(p2[4], buf[24]); 284| 1.09k| buf[8] = vec256_xor(buf[8], buf[24]); 285| 1.09k| p2[0] = vec256_xor(p2[0], buf[8]); 286| 1.09k| buf[9] = vec256_xor(buf[9], buf[8]); 287| 1.09k| p2[1] = vec256_xor(p2[1], buf[9]); 288| 1.09k| buf[11] = vec256_xor(buf[11], buf[9]); 289| 1.09k| p2[0] = vec256_xor(p2[0], buf[11]); 290| 1.09k| buf[10] = vec256_xor(buf[10], buf[11]); 291| 1.09k| p2[2] = vec256_xor(p2[2], buf[10]); 292| 1.09k| buf[14] = vec256_xor(buf[14], buf[10]); 293| 1.09k| p2[0] = vec256_xor(p2[0], buf[14]); 294| 1.09k| buf[15] = vec256_xor(buf[15], buf[14]); 295| 1.09k| p2[1] = vec256_xor(p2[1], buf[15]); 296| 1.09k| buf[13] = vec256_xor(buf[13], buf[15]); 297| 1.09k| p2[0] = vec256_xor(p2[0], buf[13]); 298| 1.09k| buf[12] = vec256_xor(buf[12], buf[13]); 299| 1.09k| p2[3] = vec256_xor(p2[3], buf[12]); 300| 1.09k| buf[4] = vec256_xor(buf[4], buf[12]); 301| 1.09k| p2[0] = vec256_xor(p2[0], buf[4]); 302| 1.09k| buf[5] = vec256_xor(buf[5], buf[4]); 303| 1.09k| p2[1] = vec256_xor(p2[1], buf[5]); 304| 1.09k| buf[7] = vec256_xor(buf[7], buf[5]); 305| 1.09k| p2[0] = vec256_xor(p2[0], buf[7]); 306| 1.09k| buf[6] = vec256_xor(buf[6], buf[7]); 307| 1.09k| p2[2] = vec256_xor(p2[2], buf[6]); 308| 1.09k| buf[2] = vec256_xor(buf[2], buf[6]); 309| 1.09k| p2[0] = vec256_xor(p2[0], buf[2]); 310| 1.09k| buf[3] = vec256_xor(buf[3], buf[2]); 311| 1.09k| p2[1] = vec256_xor(p2[1], buf[3]); 312| 1.09k| buf[1] = vec256_xor(buf[1], buf[3]); 313| | 314| 1.09k| p2[0] = vec256_xor(p2[0], buf[1]); 315| 1.09k| buf[0] = vec256_xor(buf[0], buf[1]); 316| | 317| 7.68k| for (j = 0; j < 6; j++) { ------------------ | Branch (317:21): [True: 6.58k, False: 1.09k] ------------------ 318| 6.58k| pre[j][i + 0] = vec256_extract(p2[j], 0); ------------------ | | 39| 6.58k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 319| 6.58k| pre[j][i + 1] = vec256_extract(p2[j], 1); ------------------ | | 39| 6.58k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 320| 6.58k| pre[j][i + 2] = vec256_extract(p2[j], 2); ------------------ | | 39| 6.58k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 321| 6.58k| pre[j][i + 3] = vec256_extract(p2[j], 3); ------------------ | | 39| 6.58k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 322| 6.58k| } 323| | 324| 1.09k| out64[0][i + 0] = vec256_extract(buf[0], 0); ------------------ | | 39| 1.09k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 325| 1.09k| out64[0][i + 1] = vec256_extract(buf[0], 1); ------------------ | | 39| 1.09k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 326| 1.09k| out64[0][i + 2] = vec256_extract(buf[0], 2); ------------------ | | 39| 1.09k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 327| 1.09k| out64[0][i + 3] = vec256_extract(buf[0], 3); ------------------ | | 39| 1.09k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 328| 1.09k| } 329| | 330| | // 331| | 332| 4.75k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 4.75k|#define GFBITS 12 ------------------ | Branch (332:17): [True: 4.39k, False: 366] ------------------ 333| 4.39k| tmp[j] = (beta[0] >> j) & 1; 334| 4.39k| tmp[j] = -tmp[j]; 335| 4.39k| } 336| | 337| 366| vec_mul(out64[1], pre[0], tmp); 338| | 339| 2.19k| for (i = 1; i < 6; i++) { ------------------ | Branch (339:17): [True: 1.83k, False: 366] ------------------ 340| 23.7k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 23.7k|#define GFBITS 12 ------------------ | Branch (340:21): [True: 21.9k, False: 1.83k] ------------------ 341| 21.9k| tmp[j] = (beta[i] >> j) & 1; 342| 21.9k| tmp[j] = -tmp[j]; 343| 21.9k| } 344| | 345| 1.83k| vec_mul(tmp, pre[i], tmp); 346| 1.83k| vec_add(out64[1], out64[1], tmp); 347| 1.83k| } 348| | 349| 4.75k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 4.75k|#define GFBITS 12 ------------------ | Branch (349:17): [True: 4.39k, False: 366] ------------------ 350| 4.39k| out[i] = vec128_set2x(out64[0][i], out64[1][i]); 351| 4.39k| } 352| 366|} fft_tr.c:radix_conversions_tr: 16| 366|static void radix_conversions_tr(vec128 in[ GFBITS ]) { 17| 366| int i, j, k; 18| | 19| 366| const vec128 mask[10] = { 20| 366| vec128_set2x(0x2222222222222222, 0x2222222222222222), 21| 366| vec128_set2x(0x4444444444444444, 0x4444444444444444), 22| 366| vec128_set2x(0x0C0C0C0C0C0C0C0C, 0x0C0C0C0C0C0C0C0C), 23| 366| vec128_set2x(0x3030303030303030, 0x3030303030303030), 24| 366| vec128_set2x(0x00F000F000F000F0, 0x00F000F000F000F0), 25| 366| vec128_set2x(0x0F000F000F000F00, 0x0F000F000F000F00), 26| 366| vec128_set2x(0x0000FF000000FF00, 0x0000FF000000FF00), 27| 366| vec128_set2x(0x00FF000000FF0000, 0x00FF000000FF0000), 28| 366| vec128_set2x(0x00000000FFFF0000, 0x00000000FFFF0000), 29| 366| vec128_set2x(0x0000FFFF00000000, 0x0000FFFF00000000) 30| 366| }; 31| | 32| 366| const vec128 s[5][GFBITS] = { 33| 366|#include "scalars_2x.data" ------------------ | | 1| 366|{ | | 2| 366| vec128_set2x(0xf3cfc030fc30f003, 0x000c03c0c3c0330c), | | 3| 366| vec128_set2x(0x3fcf0f003c00c00c, 0xf330cffcc00f33c0), | | 4| 366| vec128_set2x(0x30033cc300c0c03c, 0xccf330f00f3c0333), | | 5| 366| vec128_set2x(0xccff0f3c0f30f0c0, 0xff03fff3ff0cf0c0), | | 6| 366| vec128_set2x(0x0300c03ff303c3f0, 0x3cc3fcf00fcc303c), | | 7| 366| vec128_set2x(0x3fff3c0ff0ccccc0, 0x0f000c0fc30303f3), | | 8| 366| vec128_set2x(0xf3fff0c00f3c3cc0, 0xcf0fc3ff333ccf3c), | | 9| 366| vec128_set2x(0x3003333fffc3c000, 0x003f3fc3c0ff333f), | | 10| 366| vec128_set2x(0x0ff30fffc3fff300, 0x3cc3f0f3cf0ff00f), | | 11| 366| vec128_set2x(0xffc0f300f0f0cc00, 0xf3f33cc03fc30cc0), | | 12| 366| vec128_set2x(0xc0cff3fccc3cfc00, 0x3cc330cfc333f33f), | | 13| 366| vec128_set2x(0xfc3c03f0f330c000, 0x3cc0303ff3c3fffc), | | 14| 366|}, { | | 15| 366| vec128_set2x(0x000f00000000f00f, 0x0f00f00f00000000), | | 16| 366| vec128_set2x(0x00000f00f00000f0, 0xf00000000000f000), | | 17| 366| vec128_set2x(0x0f00000f00000f00, 0x00000f00000000f0), | | 18| 366| vec128_set2x(0xf00f00f00f000000, 0x0f00f00000f00000), | | 19| 366| vec128_set2x(0x00f00000000000f0, 0x000f00000f00f00f), | | 20| 366| vec128_set2x(0x0000000f00000000, 0x00f00f00f00f0000), | | 21| 366| vec128_set2x(0xf00000000f00f000, 0x0f00f00000000000), | | 22| 366| vec128_set2x(0x00f00f00000f0000, 0x000000000f000000), | | 23| 366| vec128_set2x(0x0000f00000f00f00, 0x00f00000000f00f0), | | 24| 366| vec128_set2x(0x000f00f00f00f000, 0x0000f00f00000f00), | | 25| 366| vec128_set2x(0x00f00f0000000000, 0xf00000f00000f00f), | | 26| 366| vec128_set2x(0x0000000000f00000, 0x00000f00f00f00f0), | | 27| 366|}, { | | 28| 366| vec128_set2x(0x0000ff00ff0000ff, 0xff00ffffff000000), | | 29| 366| vec128_set2x(0x0000ff000000ff00, 0xff0000ffff000000), | | 30| 366| vec128_set2x(0xff0000ff00ff0000, 0xffff00ffff000000), | | 31| 366| vec128_set2x(0xffff0000ff000000, 0xff00ffffffffff00), | | 32| 366| vec128_set2x(0x00ff00ff00ff0000, 0x00000000ff00ff00), | | 33| 366| vec128_set2x(0x0000ffffff000000, 0xffffffff00ff0000), | | 34| 366| vec128_set2x(0x00ffff00ff000000, 0x00ffffff00ff0000), | | 35| 366| vec128_set2x(0xffffff0000ff0000, 0xffff00ffff00ffff), | | 36| 366| vec128_set2x(0xffff00ffff00ff00, 0xffff0000ffffffff), | | 37| 366| vec128_set2x(0x0000ff0000000000, 0xff00000000ff0000), | | 38| 366| vec128_set2x(0xffffff00ff000000, 0x000000ff00ff00ff), | | 39| 366| vec128_set2x(0x00ff000000000000, 0x00ff00ff00ffff00), | | 40| 366|}, { | | 41| 366| vec128_set2x(0x000000000000ffff, 0x0000000000000000), | | 42| 366| vec128_set2x(0x00000000ffff0000, 0xffff000000000000), | | 43| 366| vec128_set2x(0x0000000000000000, 0x0000000000000000), | | 44| 366| vec128_set2x(0xffff000000000000, 0x0000000000000000), | | 45| 366| vec128_set2x(0x00000000ffff0000, 0xffff00000000ffff), | | 46| 366| vec128_set2x(0x0000ffff00000000, 0x0000000000000000), | | 47| 366| vec128_set2x(0x0000000000000000, 0x0000ffff00000000), | | 48| 366| vec128_set2x(0x00000000ffff0000, 0xffff00000000ffff), | | 49| 366| vec128_set2x(0x0000ffff00000000, 0x00000000ffff0000), | | 50| 366| vec128_set2x(0x0000000000000000, 0x0000000000000000), | | 51| 366| vec128_set2x(0x0000000000000000, 0xffff00000000ffff), | | 52| 366| vec128_set2x(0x0000000000000000, 0x00000000ffff0000), | | 53| 366|}, { | | 54| 366| vec128_set2x(0x00000000ffffffff, 0x0000000000000000), | | 55| 366| vec128_set2x(0xffffffff00000000, 0x0000000000000000), | | 56| 366| vec128_set2x(0xffffffff00000000, 0x00000000ffffffff), | | 57| 366| vec128_set2x(0x0000000000000000, 0xffffffff00000000), | | 58| 366| vec128_set2x(0x0000000000000000, 0xffffffff00000000), | | 59| 366| vec128_set2x(0xffffffff00000000, 0x0000000000000000), | | 60| 366| vec128_set2x(0x0000000000000000, 0xffffffff00000000), | | 61| 366| vec128_set2x(0x0000000000000000, 0xffffffffffffffff), | | 62| 366| vec128_set2x(0xffffffff00000000, 0xffffffff00000000), | | 63| 366| vec128_set2x(0x0000000000000000, 0x0000000000000000), | | 64| 366| vec128_set2x(0x0000000000000000, 0xffffffffffffffff), | | 65| 366| vec128_set2x(0x0000000000000000, 0xffffffff00000000), | | 66| 366|}, ------------------ 34| 366| }; 35| | 36| 366| uint64_t v0, v1; 37| | 38| | // 39| | 40| 2.56k| for (j = 5; j >= 0; j--) { ------------------ | Branch (40:17): [True: 2.19k, False: 366] ------------------ 41| | 42| 2.19k| if (j < 5) { ------------------ | Branch (42:13): [True: 1.83k, False: 366] ------------------ 43| 1.83k| vec128_mul(in, in, s[j]); 44| 1.83k| } 45| | 46| 28.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 28.5k|#define GFBITS 12 ------------------ | Branch (46:21): [True: 26.3k, False: 2.19k] ------------------ 47| 92.2k| for (k = j; k <= 4; k++) { ------------------ | Branch (47:25): [True: 65.8k, False: 26.3k] ------------------ 48| 65.8k| in[i] ^= vec128_sll_2x(in[i] & mask[2 * k + 0], 1 << k); ------------------ | | 46| 65.8k|#define vec128_sll_2x(a, s) ((vec128) _mm_slli_epi64((vec128) (a), (s))) ------------------ 49| 65.8k| in[i] ^= vec128_sll_2x(in[i] & mask[2 * k + 1], 1 << k); ------------------ | | 46| 65.8k|#define vec128_sll_2x(a, s) ((vec128) _mm_slli_epi64((vec128) (a), (s))) ------------------ 50| 65.8k| } 51| 26.3k| } 52| | 53| 28.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 28.5k|#define GFBITS 12 ------------------ | Branch (53:21): [True: 26.3k, False: 2.19k] ------------------ 54| 26.3k| v0 = vec128_extract(in[i], 0); ------------------ | | 28| 26.3k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 55| 26.3k| v1 = vec128_extract(in[i], 1); ------------------ | | 28| 26.3k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 56| | 57| 26.3k| v1 ^= v0 >> 32; 58| 26.3k| v1 ^= v1 << 32; 59| | 60| 26.3k| in[i] = vec128_set2x(v0, v1); 61| 26.3k| } 62| 2.19k| } 63| 366|} PQCLEAN_MCELIECE348864_AVX2_gf_mul: 22| 4.48M|gf gf_mul(gf in0, gf in1) { 23| 4.48M| int i; 24| | 25| 4.48M| uint32_t tmp; 26| 4.48M| uint32_t t0; 27| 4.48M| uint32_t t1; 28| 4.48M| uint32_t t; 29| | 30| 4.48M| t0 = in0; 31| 4.48M| t1 = in1; 32| | 33| 4.48M| tmp = t0 * (t1 & 1); 34| | 35| 53.7M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 53.7M|#define GFBITS 12 ------------------ | Branch (35:17): [True: 49.3M, False: 4.48M] ------------------ 36| 49.3M| tmp ^= (t0 * (t1 & (1 << i))); 37| 49.3M| } 38| | 39| 4.48M| t = tmp & 0x7FC000; 40| 4.48M| tmp ^= t >> 9; 41| 4.48M| tmp ^= t >> 12; 42| | 43| 4.48M| t = tmp & 0x3000; 44| 4.48M| tmp ^= t >> 9; 45| 4.48M| tmp ^= t >> 12; 46| | 47| 4.48M| return tmp & ((1 << GFBITS) - 1); ------------------ | | 6| 4.48M|#define GFBITS 12 ------------------ 48| 4.48M|} PQCLEAN_MCELIECE348864_AVX2_gf_inv: 74| 65.0k|gf gf_inv(gf in) { 75| 65.0k| gf tmp_11; 76| 65.0k| gf tmp_1111; 77| | 78| 65.0k| gf out = in; 79| | 80| 65.0k| out = gf_sq(out); 81| 65.0k| tmp_11 = gf_mul(out, in); // 11 ------------------ | | 14| 65.0k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 65.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 82| | 83| 65.0k| out = gf_sq(tmp_11); 84| 65.0k| out = gf_sq(out); 85| 65.0k| tmp_1111 = gf_mul(out, tmp_11); // 1111 ------------------ | | 14| 65.0k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 65.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 86| | 87| 65.0k| out = gf_sq(tmp_1111); 88| 65.0k| out = gf_sq(out); 89| 65.0k| out = gf_sq(out); 90| 65.0k| out = gf_sq(out); 91| 65.0k| out = gf_mul(out, tmp_1111); // 11111111 ------------------ | | 14| 65.0k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 65.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 92| | 93| 65.0k| out = gf_sq(out); 94| 65.0k| out = gf_sq(out); 95| 65.0k| out = gf_mul(out, tmp_11); // 1111111111 ------------------ | | 14| 65.0k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 65.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 96| | 97| 65.0k| out = gf_sq(out); 98| 65.0k| out = gf_mul(out, in); // 11111111111 ------------------ | | 14| 65.0k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 65.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 99| | 100| 65.0k| return gf_sq(out); // 111111111110 101| 65.0k|} bm.c:PQCLEAN_MCELIECE348864_AVX2_gf_mul2: 32| 13.1k|static inline uint64_t gf_mul2(gf a, gf b0, gf b1) { 33| 13.1k| int i; 34| | 35| 13.1k| uint64_t tmp = 0; 36| 13.1k| uint64_t t0; 37| 13.1k| uint64_t t1; 38| 13.1k| uint64_t t; 39| 13.1k| uint64_t mask = 0x0000000100000001; 40| | 41| 13.1k| t0 = a; 42| 13.1k| t1 = b1; 43| 13.1k| t1 = (t1 << 32) | b0; 44| | 45| 171k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 171k|#define GFBITS 12 ------------------ | Branch (45:17): [True: 158k, False: 13.1k] ------------------ 46| 158k| tmp ^= t0 * (t1 & mask); 47| 158k| mask += mask; 48| 158k| } 49| | 50| | // 51| | 52| 13.1k| t = tmp & 0x007FC000007FC000; 53| 13.1k| tmp ^= (t >> 9) ^ (t >> 12); 54| | 55| 13.1k| t = tmp & 0x0000300000003000; 56| 13.1k| tmp ^= (t >> 9) ^ (t >> 12); 57| | 58| 13.1k| return tmp & 0x00000FFF00000FFF; 59| 13.1k|} pk_gen.c:PQCLEAN_MCELIECE348864_AVX2_int32_sort: 21| 103|static void int32_sort(int32_t *x, long long n) { 22| 103| long long top, p, q, r, i; 23| | 24| 103| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 103] ------------------ 25| 0| return; 26| 0| } 27| 103| top = 1; 28| 1.03k| while (top < n - top) { ------------------ | Branch (28:12): [True: 927, False: 103] ------------------ 29| 927| top += top; 30| 927| } 31| | 32| 1.13k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.03k, False: 103] ------------------ 33| 686k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 685k, False: 1.03k] ------------------ 34| 685k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 369k, False: 316k] ------------------ 35| 369k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 369k| do { \ | | 12| 369k| int32_t ab = (b) ^ (a); \ | | 13| 369k| int32_t c = (b) - (a); \ | | 14| 369k| c ^= ab & ((c) ^ (b)); \ | | 15| 369k| c >>= 31; \ | | 16| 369k| c &= ab; \ | | 17| 369k| (a) ^= c; \ | | 18| 369k| (b) ^= c; \ | | 19| 369k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 369k] | | ------------------ ------------------ 36| 369k| } 37| 685k| } 38| 1.03k| i = 0; 39| 5.66k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 4.63k, False: 1.03k] ------------------ 40| 611k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 606k, False: 4.63k] ------------------ 41| 606k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 316k, False: 290k] ------------------ 42| 316k| int32_t a = x[i + p]; 43| 1.68M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 1.37M, False: 316k] ------------------ 44| 1.37M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 1.37M| do { \ | | 12| 1.37M| int32_t ab = (b) ^ (a); \ | | 13| 1.37M| int32_t c = (b) - (a); \ | | 14| 1.37M| c ^= ab & ((c) ^ (b)); \ | | 15| 1.37M| c >>= 31; \ | | 16| 1.37M| c &= ab; \ | | 17| 1.37M| (a) ^= c; \ | | 18| 1.37M| (b) ^= c; \ | | 19| 1.37M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.37M] | | ------------------ ------------------ 45| 1.37M| } 46| 316k| x[i + p] = a; 47| 316k| } 48| 606k| } 49| 4.63k| } 50| 1.03k| } 51| 103|} controlbits.c:PQCLEAN_MCELIECE348864_AVX2_int32_sort: 21| 1.68M|static void int32_sort(int32_t *x, long long n) { 22| 1.68M| long long top, p, q, r, i; 23| | 24| 1.68M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 1.68M] ------------------ 25| 0| return; 26| 0| } 27| 1.68M| top = 1; 28| 5.89M| while (top < n - top) { ------------------ | Branch (28:12): [True: 4.20M, False: 1.68M] ------------------ 29| 4.20M| top += top; 30| 4.20M| } 31| | 32| 7.57M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 5.89M, False: 1.68M] ------------------ 33| 621M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 615M, False: 5.89M] ------------------ 34| 615M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 347M, False: 267M] ------------------ 35| 347M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 347M| do { \ | | 12| 347M| int32_t ab = (b) ^ (a); \ | | 13| 347M| int32_t c = (b) - (a); \ | | 14| 347M| c ^= ab & ((c) ^ (b)); \ | | 15| 347M| c >>= 31; \ | | 16| 347M| c &= ab; \ | | 17| 347M| (a) ^= c; \ | | 18| 347M| (b) ^= c; \ | | 19| 347M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 347M] | | ------------------ ------------------ 36| 347M| } 37| 615M| } 38| 5.89M| i = 0; 39| 15.8M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 9.98M, False: 5.89M] ------------------ 40| 545M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 535M, False: 9.98M] ------------------ 41| 535M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 267M, False: 267M] ------------------ 42| 267M| int32_t a = x[i + p]; 43| 1.48G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 1.21G, False: 267M] ------------------ 44| 1.21G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 1.21G| do { \ | | 12| 1.21G| int32_t ab = (b) ^ (a); \ | | 13| 1.21G| int32_t c = (b) - (a); \ | | 14| 1.21G| c ^= ab & ((c) ^ (b)); \ | | 15| 1.21G| c >>= 31; \ | | 16| 1.21G| c &= ab; \ | | 17| 1.21G| (a) ^= c; \ | | 18| 1.21G| (b) ^= c; \ | | 19| 1.21G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.21G] | | ------------------ ------------------ 45| 1.21G| } 46| 267M| x[i + p] = a; 47| 267M| } 48| 535M| } 49| 9.98M| } 50| 5.89M| } 51| 1.68M|} encrypt.c:PQCLEAN_MCELIECE348864_AVX2_int32_sort: 21| 315|static void int32_sort(int32_t *x, long long n) { 22| 315| long long top, p, q, r, i; 23| | 24| 315| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 315] ------------------ 25| 0| return; 26| 0| } 27| 315| top = 1; 28| 1.89k| while (top < n - top) { ------------------ | Branch (28:12): [True: 1.57k, False: 315] ------------------ 29| 1.57k| top += top; 30| 1.57k| } 31| | 32| 2.20k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.89k, False: 315] ------------------ 33| 103k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 101k, False: 1.89k] ------------------ 34| 101k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 60.4k, False: 40.6k] ------------------ 35| 60.4k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 60.4k| do { \ | | 12| 60.4k| int32_t ab = (b) ^ (a); \ | | 13| 60.4k| int32_t c = (b) - (a); \ | | 14| 60.4k| c ^= ab & ((c) ^ (b)); \ | | 15| 60.4k| c >>= 31; \ | | 16| 60.4k| c &= ab; \ | | 17| 60.4k| (a) ^= c; \ | | 18| 60.4k| (b) ^= c; \ | | 19| 60.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 60.4k] | | ------------------ ------------------ 36| 60.4k| } 37| 101k| } 38| 1.89k| i = 0; 39| 6.61k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 4.72k, False: 1.89k] ------------------ 40| 85.9k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 81.2k, False: 4.72k] ------------------ 41| 81.2k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 40.6k, False: 40.6k] ------------------ 42| 40.6k| int32_t a = x[i + p]; 43| 151k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 110k, False: 40.6k] ------------------ 44| 110k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 110k| do { \ | | 12| 110k| int32_t ab = (b) ^ (a); \ | | 13| 110k| int32_t c = (b) - (a); \ | | 14| 110k| c ^= ab & ((c) ^ (b)); \ | | 15| 110k| c >>= 31; \ | | 16| 110k| c &= ab; \ | | 17| 110k| (a) ^= c; \ | | 18| 110k| (b) ^= c; \ | | 19| 110k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 110k] | | ------------------ ------------------ 45| 110k| } 46| 40.6k| x[i + p] = a; 47| 40.6k| } 48| 81.2k| } 49| 4.72k| } 50| 1.89k| } 51| 315|} PQCLEAN_MCELIECE348864_AVX2_crypto_kem_enc: 22| 103|) { 23| 103| unsigned char e[ SYS_N / 8 ]; 24| 103| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 103| encrypt(c, pk, e); ------------------ | | 9| 103|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 103|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 103| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 103|#define SYS_N 3488 ------------------ 31| 103| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 103|#define SYS_N 3488 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 103|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 103|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 103|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 103|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 103| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 103| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 103|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 103| return 0; 36| 103|} PQCLEAN_MCELIECE348864_AVX2_crypto_kem_dec: 42| 103|) { 43| 103| int i; 44| | 45| 103| unsigned char ret_decrypt = 0; 46| | 47| 103| uint16_t m; 48| | 49| 103| unsigned char e[ SYS_N / 8 ]; 50| 103| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 103| unsigned char *x = preimage; 52| 103| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 103|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 103|#define SYS_T 64 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 103|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 103|#define GFBITS 12 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 103|#define GFBITS 12 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 103| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 103|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 103|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 103| m = ret_decrypt; 59| 103| m -= 1; 60| 103| m >>= 8; 61| | 62| 103| *x++ = m & 1; 63| 45.0k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 45.0k|#define SYS_N 3488 ------------------ | Branch (63:17): [True: 44.9k, False: 103] ------------------ 64| 44.9k| *x++ = (~m & s[i]) | (m & e[i]); 65| 44.9k| } 66| | 67| 9.99k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 9.99k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 9.99k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 9.99k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 9.99k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 9.88k, False: 103] ------------------ 68| 9.88k| *x++ = c[i]; 69| 9.88k| } 70| | 71| 103| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 103| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 103|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 103| return 0; 74| 103|} PQCLEAN_MCELIECE348864_AVX2_crypto_kem_keypair: 80| 103|) { 81| 103| int i; 82| 103| unsigned char seed[ 33 ] = {64}; 83| 103| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 103| unsigned char *rp, *skp; 85| | 86| 103| gf f[ SYS_T ]; // element in GF(2^mt) 87| 103| gf irr[ SYS_T ]; // Goppa polynomial 88| 103| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 89| 103| int16_t pi[ 1 << GFBITS ]; // random permutation 90| | 91| 103| randombytes(seed + 1, 32); ------------------ | | 8| 103|#define randombytes OQS_randombytes ------------------ 92| | 93| 1.01k| while (1) { ------------------ | Branch (93:12): [True: 1.01k, Folded] ------------------ 94| 1.01k| rp = &r[ sizeof(r) - 32 ]; 95| 1.01k| skp = sk; 96| | 97| | // expanding and updating the seed 98| | 99| 1.01k| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 1.01k| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 1.01k|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 100| 1.01k| memcpy(skp, seed + 1, 32); 101| 1.01k| skp += 32 + 8; 102| 1.01k| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 103| | 104| | // generating irreducible polynomial 105| | 106| 1.01k| rp -= sizeof(f); 107| | 108| 65.9k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 65.9k|#define SYS_T 64 ------------------ | Branch (108:21): [True: 64.9k, False: 1.01k] ------------------ 109| 64.9k| f[i] = load_gf(rp + i * 2); 110| 64.9k| } 111| | 112| 1.01k| if (genpoly_gen(irr, f)) { ------------------ | | 9| 1.01k|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 1.01k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ | Branch (112:13): [True: 0, False: 1.01k] ------------------ 113| 0| continue; 114| 0| } 115| | 116| 65.9k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 65.9k|#define SYS_T 64 ------------------ | Branch (116:21): [True: 64.9k, False: 1.01k] ------------------ 117| 64.9k| store_gf(skp + i * 2, irr[i]); 118| 64.9k| } 119| | 120| 1.01k| skp += IRR_BYTES; ------------------ | | 11| 1.01k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.01k|#define SYS_T 64 | | ------------------ ------------------ 121| | 122| | // generating permutation 123| | 124| 1.01k| rp -= sizeof(perm); 125| | 126| 4.15M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 4.15M|#define GFBITS 12 ------------------ | Branch (126:21): [True: 4.15M, False: 1.01k] ------------------ 127| 4.15M| perm[i] = load4(rp + i * 4); 128| 4.15M| } 129| | 130| 1.01k| if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 9| 1.01k|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 1.01k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 11| 1.01k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.01k|#define SYS_T 64 | | ------------------ ------------------ | Branch (130:13): [True: 912, False: 103] ------------------ 131| 912| continue; 132| 912| } 133| | 134| 103| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 103|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 103|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 103|#define GFBITS 12 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 103|#define GFBITS 12 ------------------ 135| 103| skp += COND_BYTES; ------------------ | | 10| 103|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 103|#define GFBITS 12 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 103|#define GFBITS 12 | | ------------------ ------------------ 136| | 137| | // storing the random string s 138| | 139| 103| rp -= SYS_N / 8; ------------------ | | 7| 103|#define SYS_N 3488 ------------------ 140| 103| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 103|#define SYS_N 3488 ------------------ 141| | 142| | // storing positions of the 32 pivots 143| | 144| 103| store8(sk + 32, 0xFFFFFFFF); 145| | 146| 103| break; 147| 1.01k| } 148| | 149| 103| return 0; 150| 103|} PQCLEAN_MCELIECE348864_AVX2_pk_gen: 198| 1.01k|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi) { 199| 1.01k|#define nBlocks_I ((PK_NROWS + 255) / 256) 200| | 201| 1.01k| int i, j, k, b; 202| 1.01k| int row, c; 203| | 204| 1.01k| union { 205| 1.01k| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 206| 1.01k| vec256 v[ PK_NROWS ][ nBlocks_I ]; 207| 1.01k| } mat; 208| | 209| 1.01k| union { 210| 1.01k| uint64_t w[ PK_NROWS ][ par_width * 4 ]; 211| 1.01k| vec256 v[ PK_NROWS ][ par_width ]; 212| 1.01k| } par; 213| | 214| 1.01k| uint16_t m; 215| 1.01k| vec256 mm; 216| | 217| 1.01k| uint64_t sk_int[ GFBITS ]; 218| | 219| 1.01k| vec256 consts[ 16 ][ GFBITS ]; 220| 1.01k| vec256 eval[ 16 ][ GFBITS ]; 221| 1.01k| vec256 prod[ 16 ][ GFBITS ]; 222| 1.01k| vec256 tmp[ GFBITS ]; 223| | 224| 1.01k| uint64_t list[1 << GFBITS]; 225| 1.01k| uint64_t one = 1; 226| 1.01k| uint64_t t; 227| | 228| 1.01k| uint16_t ind[ PK_NROWS ]; 229| 1.01k| uint16_t ind_inv[ PK_NROWS ]; 230| | 231| | // compute the inverses 232| | 233| 1.01k| irr_load(sk_int, irr); 234| | 235| 1.01k| fft(eval, sk_int); ------------------ | | 10| 1.01k|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 1.01k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 236| | 237| 1.01k| vec256_copy(prod[0], eval[0]); 238| | 239| 16.2k| for (i = 1; i < 16; i++) { ------------------ | Branch (239:17): [True: 15.2k, False: 1.01k] ------------------ 240| 15.2k| vec256_mul(prod[i], prod[i - 1], eval[i]); 241| 15.2k| } 242| | 243| 1.01k| vec256_inv(tmp, prod[15]); ------------------ | | 11| 1.01k|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 1.01k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 244| | 245| 16.2k| for (i = 14; i >= 0; i--) { ------------------ | Branch (245:18): [True: 15.2k, False: 1.01k] ------------------ 246| 15.2k| vec256_mul(prod[i + 1], prod[i], tmp); 247| 15.2k| vec256_mul(tmp, tmp, eval[i + 1]); 248| 15.2k| } 249| | 250| 1.01k| vec256_copy(prod[0], tmp); 251| | 252| | // fill matrix 253| | 254| 1.01k| de_bitslicing(list, prod); 255| | 256| 4.15M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 4.15M|#define GFBITS 12 ------------------ | Branch (256:17): [True: 4.15M, False: 1.01k] ------------------ 257| 4.15M| list[i] <<= GFBITS; ------------------ | | 6| 4.15M|#define GFBITS 12 ------------------ 258| 4.15M| list[i] |= i; 259| 4.15M| list[i] |= ((uint64_t) perm[i]) << 31; 260| 4.15M| } 261| | 262| 1.01k| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 1.01k|#define GFBITS 12 ------------------ 263| | 264| 4.09M| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 4.09M|#define GFBITS 12 ------------------ | Branch (264:17): [True: 4.09M, False: 988] ------------------ 265| 4.09M| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (265:13): [True: 27, False: 4.09M] ------------------ 266| 27| return -1; 267| 27| } 268| 4.09M| } 269| | 270| 988| to_bitslicing_2x(consts, prod, list); 271| | 272| 4.04M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 4.04M|#define GFBITS 12 ------------------ | Branch (272:17): [True: 4.04M, False: 988] ------------------ 273| 4.04M| pi[i] = list[i] & GFMASK; ------------------ | | 19| 4.04M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 4.04M|#define GFBITS 12 | | ------------------ ------------------ 274| 4.04M| } 275| | 276| 3.95k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 199| 3.95k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 3.95k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 3.95k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 3.95k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (276:17): [True: 2.96k, False: 988] ------------------ 277| 38.5k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 38.5k|#define GFBITS 12 ------------------ | Branch (277:21): [True: 35.5k, False: 2.96k] ------------------ 278| 35.5k| mat.v[ k ][ j ] = prod[ j ][ k ]; 279| 35.5k| } 280| 2.96k| } 281| | 282| 63.2k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 63.2k|#define SYS_T 64 ------------------ | Branch (282:17): [True: 62.2k, False: 988] ------------------ 283| 248k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 199| 248k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 248k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 248k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 248k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (283:21): [True: 186k, False: 62.2k] ------------------ 284| 186k| vec256_mul(prod[j], prod[j], consts[j]); 285| | 286| 2.42M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 2.42M|#define GFBITS 12 ------------------ | Branch (286:25): [True: 2.24M, False: 186k] ------------------ 287| 2.24M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 2.24M|#define GFBITS 12 ------------------ 288| 2.24M| } 289| 186k| } 290| 62.2k| } 291| | 292| | // gaussian elimination to obtain L, U, and P such that LP M = U 293| | // L and U are stored in the space of M 294| | // P is stored in ind 295| | 296| 759k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 759k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 759k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 759k|#define GFBITS 12 | | ------------------ ------------------ | Branch (296:17): [True: 758k, False: 988] ------------------ 297| 758k| ind_inv[i] = ind[ i ] = i; 298| 758k| } 299| | 300| 757k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 757k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 757k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 757k|#define GFBITS 12 | | ------------------ ------------------ | Branch (300:19): [True: 757k, False: 103] ------------------ 301| 757k| i = row >> 6; 302| 757k| j = row & 63; 303| | 304| 291M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 291M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 291M|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 291M|#define GFBITS 12 | | ------------------ ------------------ | Branch (304:27): [True: 290M, False: 757k] ------------------ 305| 290M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 306| 290M| uint16_cswap(&ind[row], &ind[k], m); 307| | 308| 290M| mm = vec256_set1_16b(m); 309| 1.16G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 199| 1.16G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 1.16G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 1.16G|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 1.16G|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (309:25): [True: 872M, False: 290M] ------------------ 310| 872M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 311| 872M| } 312| 290M| } 313| | 314| 757k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (314:14): [True: 885, False: 756k] ------------------ 315| 885| return -1; 316| 885| } 317| | 318| 291M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 291M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 291M|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 291M|#define GFBITS 12 | | ------------------ ------------------ | Branch (318:27): [True: 290M, False: 756k] ------------------ 319| 290M| t = mat.w[ k ][ i ] & (one << j); 320| 290M| mm = extract_mask256(mat.w[k], row); 321| | 322| 1.16G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 199| 1.16G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 1.16G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 1.16G|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 1.16G|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (322:25): [True: 872M, False: 290M] ------------------ 323| 872M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 324| 872M| } 325| | 326| 290M| mat.w[ k ][ i ] |= t; 327| 290M| } 328| 756k| } 329| | 330| | // apply M^-1 to the remaining columns 331| | 332| 103| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 103|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 103|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 103|#define GFBITS 12 | | ------------------ ------------------ 333| | 334| 1.33k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 1.33k|#define GFBITS 12 ------------------ | Branch (334:17): [True: 1.23k, False: 103] ------------------ 335| 14.8k| for (b = 0; b < par_width; b++) { ------------------ | | 29| 14.8k|#define par_width 11 ------------------ | Branch (335:21): [True: 13.5k, False: 1.23k] ------------------ 336| 13.5k| par.v[ k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 199| 13.5k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 13.5k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 13.5k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 13.5k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 337| 13.5k| } 338| 1.23k| } 339| | 340| 6.59k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 6.59k|#define SYS_T 64 ------------------ | Branch (340:17): [True: 6.48k, False: 103] ------------------ 341| 77.8k| for (b = 0; b < par_width; b++) { ------------------ | | 29| 77.8k|#define par_width 11 ------------------ | Branch (341:21): [True: 71.3k, False: 6.48k] ------------------ 342| 71.3k| vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 199| 71.3k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 71.3k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 71.3k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 71.3k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 199| 71.3k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 71.3k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 71.3k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 71.3k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 199| 71.3k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 71.3k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 71.3k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 71.3k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 343| 71.3k| } 344| | 345| 84.3k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 84.3k|#define GFBITS 12 ------------------ | Branch (345:21): [True: 77.8k, False: 6.48k] ------------------ 346| 934k| for (b = 0; b < par_width; b++) { ------------------ | | 29| 934k|#define par_width 11 ------------------ | Branch (346:25): [True: 856k, False: 77.8k] ------------------ 347| 856k| par.v[ i * GFBITS + k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 6| 856k|#define GFBITS 12 ------------------ par.v[ i * GFBITS + k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 199| 856k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 856k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 856k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 856k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 348| 856k| } 349| 77.8k| } 350| 6.48k| } 351| | 352| | // apply P 353| | 354| 79.2k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 79.2k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 79.2k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 79.2k|#define GFBITS 12 | | ------------------ ------------------ | Branch (354:17): [True: 79.1k, False: 103] ------------------ 355| 79.1k| ind[i] = ind_inv[i]; 356| 79.1k| } 357| | 358| 103| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 103|#define GFBITS 12 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 103|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 103|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 103|#define GFBITS 12 | | ------------------ ------------------ 359| | 360| | // apply L 361| | 362| 79.2k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 103|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 103|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 103|#define GFBITS 12 | | ------------------ ------------------ | Branch (362:30): [True: 79.1k, False: 103] ------------------ 363| 30.4M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (363:27): [True: 30.3M, False: 79.1k] ------------------ 364| 30.3M| mm = extract_mask256(mat.w[row], i); 365| | 366| 364M| for (k = 0; k < par_width; k++) { ------------------ | | 29| 364M|#define par_width 11 ------------------ | Branch (366:25): [True: 333M, False: 30.3M] ------------------ 367| 333M| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 368| 333M| } 369| 30.3M| } 370| 79.1k| } 371| | 372| | // apply U^-1 373| | 374| 79.2k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 103|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 103|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 103|#define GFBITS 12 | | ------------------ ------------------ | Branch (374:30): [True: 79.1k, False: 103] ------------------ 375| 30.4M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 79.1k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 79.1k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 79.1k|#define GFBITS 12 | | ------------------ ------------------ | Branch (375:32): [True: 30.3M, False: 79.1k] ------------------ 376| 30.3M| mm = extract_mask256(mat.w[row], i); 377| | 378| 364M| for (k = 0; k < par_width; k++) { ------------------ | | 29| 364M|#define par_width 11 ------------------ | Branch (378:25): [True: 333M, False: 30.3M] ------------------ 379| 333M| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 380| 333M| } 381| 30.3M| } 382| 79.1k| } 383| | 384| 79.2k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 79.2k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 79.2k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 79.2k|#define GFBITS 12 | | ------------------ ------------------ | Branch (384:19): [True: 79.1k, False: 103] ------------------ 385| 3.40M| for (k = 0; k < 42; k++) { ------------------ | Branch (385:21): [True: 3.32M, False: 79.1k] ------------------ 386| 3.32M| store8(pk + PK_ROW_BYTES * row + k * 8, par.w[row][k]); ------------------ | | 15| 3.32M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 3.32M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 3.32M|#define SYS_N 3488 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 3.32M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 3.32M|#define SYS_T 64 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 3.32M|#define GFBITS 12 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 387| 3.32M| } 388| | 389| 79.1k| store_i(pk + PK_ROW_BYTES * row + k * 8, par.w[row][k], 4); ------------------ | | 15| 79.1k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 79.1k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 79.1k|#define SYS_N 3488 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 79.1k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 79.1k|#define SYS_T 64 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 79.1k|#define GFBITS 12 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 390| 79.1k| } 391| | 392| | // 393| | 394| 103| return 0; 395| 988|} pk_gen.c:de_bitslicing: 117| 5.49k|static void de_bitslicing(uint64_t *out, vec256 in[][GFBITS]) { 118| 5.49k| int i, j, r; 119| 5.49k| uint64_t u = 0; 120| | 121| 40.4M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 40.4M|#define GFBITS 12 ------------------ | Branch (121:17): [True: 40.3M, False: 5.49k] ------------------ 122| 40.3M| out[i] = 0 ; 123| 40.3M| } 124| | 125| 163k| for (i = 0; i < 16; i++) { ------------------ | Branch (125:17): [True: 157k, False: 5.49k] ------------------ 126| 2.19M| for (j = GFBITS - 1; j >= 0; j--) { ------------------ | | 6| 157k|#define GFBITS 12 ------------------ | Branch (126:30): [True: 2.03M, False: 157k] ------------------ 127| 2.03M| u = vec256_extract(in[i][j], 0); ------------------ | | 39| 2.03M|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 128| 132M| for (r = 0; r < 64; r++) { ------------------ | Branch (128:25): [True: 130M, False: 2.03M] ------------------ 129| 130M| out[i * 256 + 0 * 64 + r] <<= 1; 130| 130M| out[i * 256 + 0 * 64 + r] |= (u >> r) & 1; 131| 130M| } 132| 2.03M| u = vec256_extract(in[i][j], 1); ------------------ | | 39| 2.03M|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 133| 132M| for (r = 0; r < 64; r++) { ------------------ | Branch (133:25): [True: 130M, False: 2.03M] ------------------ 134| 130M| out[i * 256 + 1 * 64 + r] <<= 1; 135| 130M| out[i * 256 + 1 * 64 + r] |= (u >> r) & 1; 136| 130M| } 137| 2.03M| u = vec256_extract(in[i][j], 2); ------------------ | | 39| 2.03M|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 138| 132M| for (r = 0; r < 64; r++) { ------------------ | Branch (138:25): [True: 130M, False: 2.03M] ------------------ 139| 130M| out[i * 256 + 2 * 64 + r] <<= 1; 140| 130M| out[i * 256 + 2 * 64 + r] |= (u >> r) & 1; 141| 130M| } 142| 2.03M| u = vec256_extract(in[i][j], 3); ------------------ | | 39| 2.03M|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 143| 132M| for (r = 0; r < 64; r++) { ------------------ | Branch (143:25): [True: 130M, False: 2.03M] ------------------ 144| 130M| out[i * 256 + 3 * 64 + r] <<= 1; 145| 130M| out[i * 256 + 3 * 64 + r] |= (u >> r) & 1; 146| 130M| } 147| 2.03M| } 148| 157k| } 149| 5.49k|} pk_gen.c:to_bitslicing_2x: 152| 5.22k|static void to_bitslicing_2x(vec256 out0[][GFBITS], vec256 out1[][GFBITS], const uint64_t *in) { 153| 5.22k| int i, j, k, r; 154| 5.22k| uint64_t u[2][4] = {{0}}; 155| | 156| 155k| for (i = 0; i < 16; i++) { ------------------ | Branch (156:17): [True: 150k, False: 5.22k] ------------------ 157| 2.08M| for (j = GFBITS - 1; j >= 0; j--) { ------------------ | | 6| 150k|#define GFBITS 12 ------------------ | Branch (157:30): [True: 1.93M, False: 150k] ------------------ 158| 9.66M| for (k = 0; k < 4; k++) { ------------------ | Branch (158:25): [True: 7.73M, False: 1.93M] ------------------ 159| 502M| for (r = 63; r >= 0; r--) { ------------------ | Branch (159:30): [True: 495M, False: 7.73M] ------------------ 160| 495M| u[0][k] <<= 1; 161| 495M| u[0][k] |= (in[i * 256 + k * 64 + r] >> (GFBITS - 1 - j)) & 1; ------------------ | | 6| 495M|#define GFBITS 12 ------------------ 162| | 163| 495M| u[1][k] <<= 1; 164| 495M| u[1][k] |= (in[i * 256 + k * 64 + r] >> (j + GFBITS)) & 1; ------------------ | | 6| 495M|#define GFBITS 12 ------------------ 165| 495M| } 166| 7.73M| } 167| | 168| 1.93M| out0[i][j] = vec256_set4x(u[0][0], u[0][1], u[0][2], u[0][3]); 169| 1.93M| out1[i][j] = vec256_set4x(u[1][0], u[1][1], u[1][2], u[1][3]); 170| 1.93M| } 171| 150k| } 172| 5.22k|} pk_gen.c:extract_01_masks: 33| 5.10G|static inline void extract_01_masks(uint16_t *m, const uint64_t *x, const uint64_t *y, int i) { 34| 5.10G| *m = (((~x[ i >> 6 ]) & y[ i >> 6 ]) >> (i & 63)) & 1; 35| 5.10G| *m = -(*m); 36| 5.10G|} pk_gen.c:uint16_cswap: 49| 5.18G|static inline void uint16_cswap(uint16_t *x, uint16_t *y, uint16_t m) { 50| 5.18G| uint16_t d; 51| | 52| 5.18G| d = *x ^ *y; 53| 5.18G| d &= m; 54| 5.18G| *x ^= d; 55| 5.18G| *y ^= d; 56| 5.18G|} pk_gen.c:vec256_cswap: 59| 33.3G|static inline void vec256_cswap(vec256 *x, vec256 *y, vec256 m) { 60| 33.3G| vec256 d; 61| | 62| 33.3G| d = *x ^ *y; 63| 33.3G| d &= m; 64| 33.3G| *x ^= d; 65| 33.3G| *y ^= d; 66| 33.3G|} pk_gen.c:extract_mask256: 39| 9.18G|static inline vec256 extract_mask256(const uint64_t v[], int i) { 40| 9.18G| uint32_t mask; 41| | 42| 9.18G| mask = (v[ i >> 6 ] >> (i & 63)) & 1; 43| 9.18G| mask = -mask; 44| | 45| 9.18G| return vec256_set1_32b(mask); 46| 9.18G|} pk_gen.c:composeinv: 176| 918|static void composeinv(int n, uint16_t y[n], const uint16_t x[n], const uint16_t pi[n]) { 177| 918| int i; 178| 918| int32_t t[n]; 179| | 180| 1.26M| for (i = 0; i < n; ++i) { ------------------ | Branch (180:17): [True: 1.25M, False: 918] ------------------ 181| 1.25M| t[i] = pi[i]; 182| 1.25M| t[i] <<= 16; 183| 1.25M| t[i] |= x[i]; 184| 1.25M| } 185| | 186| 918| int32_sort(t, n); ------------------ | | 6| 918|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 918|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 187| | 188| 1.26M| for (i = 0; i < n; ++i) { ------------------ | Branch (188:17): [True: 1.25M, False: 918] ------------------ 189| 1.25M| y[i] = t[i] & 0xFFFF; 190| 1.25M| } 191| 918|} pk_gen.c:sort_rows: 107| 7.17M|static void sort_rows(int n, int bound, uint16_t *x, vec256 (*mat)[par_width], int off) { 108| 7.17M| if (n <= 1) { ------------------ | Branch (108:9): [True: 3.58M, False: 3.58M] ------------------ 109| 3.58M| return; 110| 3.58M| } 111| 3.58M| sort_rows(n / 2, bound, x, mat, off); 112| 3.58M| sort_rows(n / 2, bound, x, mat, off + n / 2); 113| 3.58M| merge_rows(n / 2, bound, x, mat, off, 1); 114| 3.58M|} pk_gen.c:merge_rows: 89| 35.6M|static void merge_rows(int n, int bound, uint16_t *x, vec256 (*mat)[par_width], int off, int step) { 90| 35.6M| int i; 91| | 92| 35.6M| if (n == 1) { ------------------ | Branch (92:9): [True: 19.6M, False: 16.0M] ------------------ 93| 19.6M| if (off + step < bound) { ------------------ | Branch (93:13): [True: 13.7M, False: 5.85M] ------------------ 94| 13.7M| minmax_rows(x, mat, off, off + step); 95| 13.7M| } 96| 19.6M| } else { 97| 16.0M| merge_rows(n / 2, bound, x, mat, off, step * 2); 98| 16.0M| merge_rows(n / 2, bound, x, mat, off + step, step * 2); 99| | 100| 76.9M| for (i = 1; i < 2 * n - 1 && off + (i + 1) * step < bound; i += 2) { ------------------ | Branch (100:21): [True: 65.8M, False: 11.0M] | Branch (100:38): [True: 60.9M, False: 4.95M] ------------------ 101| 60.9M| minmax_rows(x, mat, off + i * step, off + (i + 1)*step); 102| 60.9M| } 103| 16.0M| } 104| 35.6M|} pk_gen.c:minmax_rows: 70| 74.7M|static inline void minmax_rows(uint16_t *x, vec256 (*mat)[par_width], int i0, int i1) { 71| 74.7M| int i; 72| 74.7M| uint16_t m; 73| 74.7M| vec256 mm; 74| | 75| 74.7M| m = x[i1] - x[i0]; 76| 74.7M| m >>= 15; 77| 74.7M| m = -m; 78| 74.7M| mm = vec256_set1_16b(m); 79| | 80| 74.7M| uint16_cswap(&x[i0], &x[i1], m); 81| | 82| 764M| for (i = 0; i < par_width; i++) { ------------------ | | 29| 764M|#define par_width 11 ------------------ | Branch (82:17): [True: 689M, False: 74.7M] ------------------ 83| 689M| vec256_cswap(&mat[i0][i], &mat[i1][i], mm); 84| 689M| } 85| 74.7M|} PQCLEAN_MCELIECE348864_AVX2_genpoly_gen: 55| 1.01k|int genpoly_gen(gf *out, gf *f) { 56| 1.01k| int i, j, k; 57| | 58| 1.01k| gf t, inv; 59| | 60| 1.01k| vec v[ GFBITS ], buf[ GFBITS ][ 64 ], mat[ 64 ][ GFBITS ], mask; 61| | 62| | // fill matrix 63| | 64| 1.01k| buf[0][0] = 1; 65| 12.1k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 12.1k|#define GFBITS 12 ------------------ | Branch (65:17): [True: 11.1k, False: 1.01k] ------------------ 66| 11.1k| buf[i][0] = 0; 67| 11.1k| } 68| | 69| 13.1k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 13.1k|#define GFBITS 12 ------------------ | Branch (69:17): [True: 12.1k, False: 1.01k] ------------------ 70| 791k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 12.1k|#define SYS_T 64 ------------------ | Branch (70:29): [True: 779k, False: 12.1k] ------------------ 71| 779k| v[j] <<= 1; 72| 779k| v[j] |= (f[i] >> j) & 1; 73| 779k| } 74| 12.1k| } 75| | 76| 13.1k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 13.1k|#define GFBITS 12 ------------------ | Branch (76:17): [True: 12.1k, False: 1.01k] ------------------ 77| 12.1k| buf[i][1] = v[i]; 78| 12.1k| } 79| | 80| 64.9k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 64.9k|#define SYS_T 64 ------------------ | Branch (80:17): [True: 63.9k, False: 1.01k] ------------------ 81| 63.9k| vec_GF_mul(v, v, f); ------------------ | | 6| 63.9k|#define vec_GF_mul CRYPTO_NAMESPACE(vec_GF_mul) | | ------------------ | | | | 4| 63.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 82| | 83| 63.9k| if (k < SYS_T) { ------------------ | | 8| 63.9k|#define SYS_T 64 ------------------ | Branch (83:13): [True: 62.9k, False: 1.01k] ------------------ 84| 818k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 818k|#define GFBITS 12 ------------------ | Branch (84:25): [True: 755k, False: 62.9k] ------------------ 85| 755k| buf[i][k] = v[i]; 86| 755k| } 87| 62.9k| } else { 88| 65.9k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 65.9k|#define SYS_T 64 ------------------ | Branch (88:25): [True: 64.9k, False: 1.01k] ------------------ 89| 64.9k| out[i] = extract_gf(v, i); 90| 64.9k| } 91| 1.01k| } 92| 63.9k| } 93| | 94| 13.1k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 13.1k|#define GFBITS 12 ------------------ | Branch (94:17): [True: 12.1k, False: 1.01k] ------------------ 95| 12.1k| transpose_64x64(buf[i]); 96| 12.1k| } 97| | 98| 65.9k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 65.9k|#define SYS_T 64 ------------------ | Branch (98:17): [True: 64.9k, False: 1.01k] ------------------ 99| 844k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 844k|#define GFBITS 12 ------------------ | Branch (99:21): [True: 779k, False: 64.9k] ------------------ 100| 779k| mat[j][i] = buf[i][j]; 101| 779k| } 102| 64.9k| } 103| | 104| | // gaussian 105| | 106| 65.9k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 65.9k|#define SYS_T 64 ------------------ | Branch (106:17): [True: 64.9k, False: 1.01k] ------------------ 107| 2.11M| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 2.11M|#define SYS_T 64 ------------------ | Branch (107:25): [True: 2.04M, False: 64.9k] ------------------ 108| 2.04M| mask = extract_bit(mat[i], i); 109| 2.04M| mask -= 1; 110| | 111| 26.6M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 26.6M|#define GFBITS 12 ------------------ | Branch (111:25): [True: 24.5M, False: 2.04M] ------------------ 112| 24.5M| mat[i][k] ^= mat[j][k] & mask; 113| 24.5M| } 114| | 115| 2.04M| out[i] ^= out[j] & mask; 116| 2.04M| } 117| | 118| | // 119| | 120| 64.9k| t = extract_gf(mat[i], i); 121| | 122| 64.9k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (122:13): [True: 0, False: 64.9k] ------------------ 123| 0| return -1; // return if not systematic 124| 0| } 125| | 126| | // 127| | 128| 64.9k| inv = gf_inv(t); ------------------ | | 11| 64.9k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 64.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 129| 64.9k| vec_mul_gf(mat[i], mat[i], inv); 130| | 131| 64.9k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 64.9k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 64.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 132| | 133| 4.22M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 4.22M|#define SYS_T 64 ------------------ | Branch (133:21): [True: 4.15M, False: 64.9k] ------------------ 134| 4.15M| if (j != i) { ------------------ | Branch (134:17): [True: 4.09M, False: 64.9k] ------------------ 135| 4.09M| t = extract_gf(mat[j], i); 136| | 137| 4.09M| vec_mul_gf(v, mat[i], t); 138| 4.09M| vec_add(mat[j], mat[j], v); 139| | 140| 4.09M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 4.09M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 4.09M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 141| 4.09M| } 142| 4.15M| } 143| 64.9k| } 144| | 145| 1.01k| return 0; 146| 1.01k|} sk_gen.c:extract_gf: 26| 65.0M|static inline gf extract_gf(const vec v[GFBITS], int idx) { 27| 65.0M| int i; 28| 65.0M| gf ret; 29| | 30| 65.0M| ret = 0; 31| 905M| for (i = GFBITS - 1; i >= 0; i--) { ------------------ | | 6| 65.0M|#define GFBITS 12 ------------------ | Branch (31:26): [True: 840M, False: 65.0M] ------------------ 32| 840M| ret <<= 1; 33| 840M| ret |= (v[i] >> idx) & 1; 34| 840M| } 35| | 36| 65.0M| return ret; 37| 65.0M|} sk_gen.c:extract_bit: 40| 31.9M|static inline vec extract_bit(const vec v[GFBITS], int idx) { 41| 31.9M| int i; 42| 31.9M| vec ret; 43| | 44| 31.9M| ret = 0; 45| 444M| for (i = GFBITS - 1; i >= 0; i--) { ------------------ | | 6| 31.9M|#define GFBITS 12 ------------------ | Branch (45:26): [True: 412M, False: 31.9M] ------------------ 46| 412M| ret |= v[i]; 47| 412M| } 48| | 49| 31.9M| return (ret >> idx) & 1; 50| 31.9M|} sk_gen.c:transpose_64x64: 19| 240k|static inline void transpose_64x64(uint64_t *in) { 20| 240k| transpose_64x64_asm(in); ------------------ | | 11| 240k|#define transpose_64x64_asm CRYPTO_NAMESPACE(transpose_64x64_asm) | | ------------------ | | | | 4| 240k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 21| 240k|} fft_tr.c:transpose_64x256_sp: 25| 11.3k|static inline void transpose_64x256_sp(vec256 *in) { 26| 11.3k| transpose_64x256_sp_asm(in); ------------------ | | 10| 11.3k|#define transpose_64x256_sp_asm CRYPTO_NAMESPACE(transpose_64x256_sp_asm) | | ------------------ | | | | 4| 11.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 27| 11.3k|} benes.c:transpose_64x64: 19| 3.66k|static inline void transpose_64x64(uint64_t *in) { 20| 3.66k| transpose_64x64_asm(in); ------------------ | | 11| 3.66k|#define transpose_64x64_asm CRYPTO_NAMESPACE(transpose_64x64_asm) | | ------------------ | | | | 4| 3.66k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 21| 3.66k|} operations.c:load_gf: 27| 579k|static inline uint16_t load_gf(const unsigned char *src) { 28| 579k| uint16_t a; 29| | 30| 579k| a = src[1]; 31| 579k| a <<= 8; 32| 579k| a |= src[0]; 33| | 34| 579k| return a & GFMASK; ------------------ | | 19| 579k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 579k|#define GFBITS 12 | | ------------------ ------------------ 35| 579k|} operations.c:store_gf: 22| 579k|static inline void store_gf(unsigned char *dest, gf a) { 23| 579k| dest[0] = a & 0xFF; 24| 579k| dest[1] = a >> 8; 25| 579k|} operations.c:load4: 37| 40.3M|static inline uint32_t load4(const unsigned char *src) { 38| 40.3M| uint32_t a; 39| | 40| 40.3M| a = src[3]; 41| 40.3M| a <<= 8; 42| 40.3M| a |= src[2]; 43| 40.3M| a <<= 8; 44| 40.3M| a |= src[1]; 45| 40.3M| a <<= 8; 46| 40.3M| a |= src[0]; 47| | 48| 40.3M| return a; 49| 40.3M|} operations.c:store8: 73| 918|static inline void store8(unsigned char *out, uint64_t in) { 74| 918| out[0] = (in >> 0x00) & 0xFF; 75| 918| out[1] = (in >> 0x08) & 0xFF; 76| 918| out[2] = (in >> 0x10) & 0xFF; 77| 918| out[3] = (in >> 0x18) & 0xFF; 78| 918| out[4] = (in >> 0x20) & 0xFF; 79| 918| out[5] = (in >> 0x28) & 0xFF; 80| 918| out[6] = (in >> 0x30) & 0xFF; 81| 918| out[7] = (in >> 0x38) & 0xFF; 82| 918|} pk_gen.c:irr_load: 51| 1.11k|static inline void irr_load(uint64_t *out, const unsigned char *in) { 52| 1.11k| int i, j; 53| 1.11k| uint16_t irr[ SYS_T + 1 ]; 54| | 55| 72.6k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 72.6k|#define SYS_T 64 ------------------ | Branch (55:17): [True: 71.4k, False: 1.11k] ------------------ 56| 71.4k| irr[i] = load_gf(in + i * 2); 57| 71.4k| } 58| | 59| 1.11k| irr[ SYS_T ] = 1; ------------------ | | 8| 1.11k|#define SYS_T 64 ------------------ 60| | 61| 14.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 14.5k|#define GFBITS 12 ------------------ | Branch (61:17): [True: 13.4k, False: 1.11k] ------------------ 62| 13.4k| out[i] = 0; 63| 13.4k| } 64| | 65| 73.7k| for (i = SYS_T; i >= 0; i--) { ------------------ | | 8| 1.11k|#define SYS_T 64 ------------------ | Branch (65:21): [True: 72.6k, False: 1.11k] ------------------ 66| 943k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 943k|#define GFBITS 12 ------------------ | Branch (66:21): [True: 871k, False: 72.6k] ------------------ 67| 871k| out[j] <<= 1; 68| 871k| out[j] |= (irr[i] >> j) & 1; 69| 871k| } 70| 72.6k| } 71| 1.11k|} pk_gen.c:load_gf: 27| 579k|static inline uint16_t load_gf(const unsigned char *src) { 28| 579k| uint16_t a; 29| | 30| 579k| a = src[1]; 31| 579k| a <<= 8; 32| 579k| a |= src[0]; 33| | 34| 579k| return a & GFMASK; ------------------ | | 19| 579k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 579k|#define GFBITS 12 | | ------------------ ------------------ 35| 579k|} pk_gen.c:store8: 73| 94.7M|static inline void store8(unsigned char *out, uint64_t in) { 74| 94.7M| out[0] = (in >> 0x00) & 0xFF; 75| 94.7M| out[1] = (in >> 0x08) & 0xFF; 76| 94.7M| out[2] = (in >> 0x10) & 0xFF; 77| 94.7M| out[3] = (in >> 0x18) & 0xFF; 78| 94.7M| out[4] = (in >> 0x20) & 0xFF; 79| 94.7M| out[5] = (in >> 0x28) & 0xFF; 80| 94.7M| out[6] = (in >> 0x30) & 0xFF; 81| 94.7M| out[7] = (in >> 0x38) & 0xFF; 82| 94.7M|} pk_gen.c:store_i: 14| 1.00M|static inline void store_i(unsigned char *out, uint64_t in, int i) { 15| 1.00M| int j; 16| | 17| 5.34M| for (j = 0; j < i; j++) { ------------------ | Branch (17:17): [True: 4.33M, False: 1.00M] ------------------ 18| 4.33M| out[j] = (in >> (j * 8)) & 0xFF; 19| 4.33M| } 20| 1.00M|} decrypt.c:load16: 105| 45.1k|static inline vec128 load16(const unsigned char *in) { 106| 45.1k| return vec128_set2x( load8(in), load8(in + 8) ); 107| 45.1k|} decrypt.c:load8: 84| 90.3k|static inline uint64_t load8(const unsigned char *in) { 85| 90.3k| int i; 86| 90.3k| uint64_t ret = in[7]; 87| | 88| 723k| for (i = 6; i >= 0; i--) { ------------------ | Branch (88:17): [True: 632k, False: 90.3k] ------------------ 89| 632k| ret <<= 8; 90| 632k| ret |= in[i]; 91| 632k| } 92| | 93| 90.3k| return ret; 94| 90.3k|} decrypt.c:irr_load: 51| 183|static inline void irr_load(uint64_t *out, const unsigned char *in) { 52| 183| int i, j; 53| 183| uint16_t irr[ SYS_T + 1 ]; 54| | 55| 11.8k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 11.8k|#define SYS_T 64 ------------------ | Branch (55:17): [True: 11.7k, False: 183] ------------------ 56| 11.7k| irr[i] = load_gf(in + i * 2); 57| 11.7k| } 58| | 59| 183| irr[ SYS_T ] = 1; ------------------ | | 8| 183|#define SYS_T 64 ------------------ 60| | 61| 2.37k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 2.37k|#define GFBITS 12 ------------------ | Branch (61:17): [True: 2.19k, False: 183] ------------------ 62| 2.19k| out[i] = 0; 63| 2.19k| } 64| | 65| 12.0k| for (i = SYS_T; i >= 0; i--) { ------------------ | | 8| 183|#define SYS_T 64 ------------------ | Branch (65:21): [True: 11.8k, False: 183] ------------------ 66| 154k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 154k|#define GFBITS 12 ------------------ | Branch (66:21): [True: 142k, False: 11.8k] ------------------ 67| 142k| out[j] <<= 1; 68| 142k| out[j] |= (irr[i] >> j) & 1; 69| 142k| } 70| 11.8k| } 71| 183|} decrypt.c:load_gf: 27| 97.7k|static inline uint16_t load_gf(const unsigned char *src) { 28| 97.7k| uint16_t a; 29| | 30| 97.7k| a = src[1]; 31| 97.7k| a <<= 8; 32| 97.7k| a |= src[0]; 33| | 34| 97.7k| return a & GFMASK; ------------------ | | 19| 97.7k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 97.7k|#define GFBITS 12 | | ------------------ ------------------ 35| 97.7k|} decrypt.c:store8: 73| 105k|static inline void store8(unsigned char *out, uint64_t in) { 74| 105k| out[0] = (in >> 0x00) & 0xFF; 75| 105k| out[1] = (in >> 0x08) & 0xFF; 76| 105k| out[2] = (in >> 0x10) & 0xFF; 77| 105k| out[3] = (in >> 0x18) & 0xFF; 78| 105k| out[4] = (in >> 0x20) & 0xFF; 79| 105k| out[5] = (in >> 0x28) & 0xFF; 80| 105k| out[6] = (in >> 0x30) & 0xFF; 81| 105k| out[7] = (in >> 0x38) & 0xFF; 82| 105k|} encrypt.c:load_gf: 27| 967k|static inline uint16_t load_gf(const unsigned char *src) { 28| 967k| uint16_t a; 29| | 30| 967k| a = src[1]; 31| 967k| a <<= 8; 32| 967k| a |= src[0]; 33| | 34| 967k| return a & GFMASK; ------------------ | | 19| 967k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 967k|#define GFBITS 12 | | ------------------ ------------------ 35| 967k|} encrypt.c:store8: 73| 84.5k|static inline void store8(unsigned char *out, uint64_t in) { 74| 84.5k| out[0] = (in >> 0x00) & 0xFF; 75| 84.5k| out[1] = (in >> 0x08) & 0xFF; 76| 84.5k| out[2] = (in >> 0x10) & 0xFF; 77| 84.5k| out[3] = (in >> 0x18) & 0xFF; 78| 84.5k| out[4] = (in >> 0x20) & 0xFF; 79| 84.5k| out[5] = (in >> 0x28) & 0xFF; 80| 84.5k| out[6] = (in >> 0x30) & 0xFF; 81| 84.5k| out[7] = (in >> 0x38) & 0xFF; 82| 84.5k|} benes.c:load4: 37| 140k|static inline uint32_t load4(const unsigned char *src) { 38| 140k| uint32_t a; 39| | 40| 140k| a = src[3]; 41| 140k| a <<= 8; 42| 140k| a |= src[2]; 43| 140k| a <<= 8; 44| 140k| a |= src[1]; 45| 140k| a <<= 8; 46| 140k| a |= src[0]; 47| | 48| 140k| return a; 49| 140k|} benes.c:load8: 84| 1.24M|static inline uint64_t load8(const unsigned char *in) { 85| 1.24M| int i; 86| 1.24M| uint64_t ret = in[7]; 87| | 88| 9.92M| for (i = 6; i >= 0; i--) { ------------------ | Branch (88:17): [True: 8.68M, False: 1.24M] ------------------ 89| 8.68M| ret <<= 8; 90| 8.68M| ret |= in[i]; 91| 8.68M| } 92| | 93| 1.24M| return ret; 94| 1.24M|} PQCLEAN_MCELIECE348864_AVX2_vec_GF_mul: 6| 63.9k|void vec_GF_mul(vec out[ GFBITS ], vec v[ GFBITS ], gf a[ SYS_T ]) { 7| 63.9k| int i, j; 8| 63.9k| vec buf[GFBITS][2], prod[GFBITS], tmp[GFBITS]; 9| | 10| 63.9k| const vec allone = -1; 11| | 12| | // polynomial multiplication 13| | 14| 831k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 831k|#define GFBITS 12 ------------------ | Branch (14:17): [True: 767k, False: 63.9k] ------------------ 15| 767k| buf[i][0] = 0; 16| 767k| buf[i][1] = 0; 17| 767k| } 18| | 19| 4.15M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 63.9k|#define SYS_T 64 ------------------ | Branch (19:25): [True: 4.09M, False: 63.9k] ------------------ 20| 53.2M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 53.2M|#define GFBITS 12 ------------------ | Branch (20:21): [True: 49.1M, False: 4.09M] ------------------ 21| 49.1M| buf[j][1] <<= 1; 22| 49.1M| buf[j][1] |= buf[j][0] >> 63; 23| 49.1M| buf[j][0] <<= 1; 24| 49.1M| } 25| | 26| 4.09M| vec_mul_gf(prod, v, a[i]); 27| | 28| 53.2M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 53.2M|#define GFBITS 12 ------------------ | Branch (28:21): [True: 49.1M, False: 4.09M] ------------------ 29| 49.1M| buf[j][0] ^= prod[j]; 30| 49.1M| } 31| 4.09M| } 32| | 33| | // reduction modulo y^64 + y^3 + y + z 34| | 35| 831k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 831k|#define GFBITS 12 ------------------ | Branch (35:17): [True: 767k, False: 63.9k] ------------------ 36| 767k| prod[i] = buf[i][1] & (allone << 3); 37| 767k| } 38| | 39| 63.9k| vec_mul_gf(tmp, prod, 2); 40| | 41| 831k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 831k|#define GFBITS 12 ------------------ | Branch (41:17): [True: 767k, False: 63.9k] ------------------ 42| 767k| buf[i][1] ^= prod[i] >> (SYS_T - 3); ------------------ | | 8| 767k|#define SYS_T 64 ------------------ 43| 767k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 3)); ------------------ | | 8| 767k|#define SYS_T 64 ------------------ 44| 767k| buf[i][1] ^= prod[i] >> (SYS_T - 1); ------------------ | | 8| 767k|#define SYS_T 64 ------------------ 45| 767k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 1)); ------------------ | | 8| 767k|#define SYS_T 64 ------------------ 46| 767k| buf[i][0] ^= tmp[i]; 47| 767k| } 48| | 49| | // 50| | 51| 831k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 831k|#define GFBITS 12 ------------------ | Branch (51:17): [True: 767k, False: 63.9k] ------------------ 52| 767k| prod[i] = buf[i][1] & 0x7; 53| 767k| } 54| | 55| 63.9k| vec_mul_gf(tmp, prod, 2); 56| | 57| 831k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 831k|#define GFBITS 12 ------------------ | Branch (57:17): [True: 767k, False: 63.9k] ------------------ 58| 767k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 3)); ------------------ | | 8| 767k|#define SYS_T 64 ------------------ 59| 767k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 1)); ------------------ | | 8| 767k|#define SYS_T 64 ------------------ 60| 767k| buf[i][0] ^= tmp[i]; 61| 767k| } 62| | 63| | // 64| | 65| 831k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 831k|#define GFBITS 12 ------------------ | Branch (65:17): [True: 767k, False: 63.9k] ------------------ 66| 767k| out[i] = buf[i][0]; 67| 767k| } 68| 63.9k|} sk_gen.c:vec_mul_gf: 37| 4.57M|static inline void vec_mul_gf(vec out[ GFBITS ], vec v[ GFBITS ], gf a) { 38| 4.57M| int i; 39| | 40| 4.57M| vec bits[GFBITS]; 41| | 42| 59.4M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 59.4M|#define GFBITS 12 ------------------ | Branch (42:17): [True: 54.9M, False: 4.57M] ------------------ 43| 54.9M| bits[i] = -((a >> i) & 1); 44| 54.9M| } 45| | 46| 4.57M| vec_mul_asm(out, v, bits); ------------------ | | 7| 4.57M|#define vec_mul_asm CRYPTO_NAMESPACE(vec_mul_asm) | | ------------------ | | | | 4| 4.57M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 47| 4.57M|} sk_gen.c:vec_add: 29| 4.50M|static inline void vec_add(vec *h, const vec *f, const vec *g) { 30| 4.50M| int b; 31| | 32| 58.5M| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 58.5M|#define GFBITS 12 ------------------ | Branch (32:17): [True: 54.0M, False: 4.50M] ------------------ 33| 54.0M| h[b] = f[b] ^ g[b]; 34| 54.0M| } 35| 4.50M|} vec.c:vec_mul_gf: 37| 4.64M|static inline void vec_mul_gf(vec out[ GFBITS ], vec v[ GFBITS ], gf a) { 38| 4.64M| int i; 39| | 40| 4.64M| vec bits[GFBITS]; 41| | 42| 60.3M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 60.3M|#define GFBITS 12 ------------------ | Branch (42:17): [True: 55.7M, False: 4.64M] ------------------ 43| 55.7M| bits[i] = -((a >> i) & 1); 44| 55.7M| } 45| | 46| 4.64M| vec_mul_asm(out, v, bits); ------------------ | | 7| 4.64M|#define vec_mul_asm CRYPTO_NAMESPACE(vec_mul_asm) | | ------------------ | | | | 4| 4.64M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 47| 4.64M|} fft.c:vec_mul: 19| 7.41k|static inline void vec_mul(vec *h, const vec *f, const vec *g) { 20| 7.41k| vec_mul_asm(h, f, g); ------------------ | | 7| 7.41k|#define vec_mul_asm CRYPTO_NAMESPACE(vec_mul_asm) | | ------------------ | | | | 4| 7.41k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 21| 7.41k|} fft_tr.c:vec_mul: 19| 2.19k|static inline void vec_mul(vec *h, const vec *f, const vec *g) { 20| 2.19k| vec_mul_asm(h, f, g); ------------------ | | 7| 2.19k|#define vec_mul_asm CRYPTO_NAMESPACE(vec_mul_asm) | | ------------------ | | | | 4| 2.19k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 21| 2.19k|} fft_tr.c:vec_add: 29| 1.83k|static inline void vec_add(vec *h, const vec *f, const vec *g) { 30| 1.83k| int b; 31| | 32| 23.7k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 23.7k|#define GFBITS 12 ------------------ | Branch (32:17): [True: 21.9k, False: 1.83k] ------------------ 33| 21.9k| h[b] = f[b] ^ g[b]; 34| 21.9k| } 35| 1.83k|} bm.c:vec_mul_sp: 25| 23.6k|static inline void vec_mul_sp(vec *h, const vec *f, const vec *g) { 26| 23.6k| vec_mul_sp_asm(h, f, g); ------------------ | | 8| 23.6k|#define vec_mul_sp_asm CRYPTO_NAMESPACE(vec_mul_sp_asm) | | ------------------ | | | | 4| 23.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 27| 23.6k|} decrypt.c:vec128_set2x: 49| 107k|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 50| 107k| return _mm_set_epi64x(a1, a0); 51| 107k|} decrypt.c:vec128_xor: 38| 2.19k|static inline vec128 vec128_xor(vec128 a, vec128 b) { 39| 2.19k| return _mm_xor_si128(a, b); 40| 2.19k|} decrypt.c:vec128_or: 42| 2.01k|static inline vec128 vec128_or(vec128 a, vec128 b) { 43| 2.01k| return _mm_or_si128(a, b); 44| 2.01k|} decrypt.c:vec128_testz: 30| 183|static inline int vec128_testz(vec128 a) { 31| 183| return _mm_testz_si128(a, a); 32| 183|} fft_tr.c:vec128_set2x: 49| 56.3k|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 50| 56.3k| return _mm_set_epi64x(a1, a0); 51| 56.3k|} fft_tr.c:vec128_mul: 96| 10.6k|static inline void vec128_mul(vec128 *h, vec128 *f, const vec128 *g) { 97| 10.6k| vec128_mul_asm(h, f, g, 16); ------------------ | | 10| 10.6k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 10.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 98| 10.6k|} bm.c:vec128_setzero: 24| 19.4k|static inline vec128 vec128_setzero(void) { 25| 19.4k| return _mm_setzero_si128(); 26| 19.4k|} bm.c:vec128_set1_16b: 20| 345k|static inline vec128 vec128_set1_16b(uint16_t a) { 21| 345k| return _mm_set1_epi16(a); 22| 345k|} bm.c:vec128_or: 42| 2.24M|static inline vec128 vec128_or(vec128 a, vec128 b) { 43| 2.24M| return _mm_or_si128(a, b); 44| 2.24M|} bm.c:vec128_and: 34| 4.49M|static inline vec128 vec128_and(vec128 a, vec128 b) { 35| 4.49M| return _mm_and_si128(a, b); 36| 4.49M|} bm.c:vec128_mul: 96| 23.4k|static inline void vec128_mul(vec128 *h, vec128 *f, const vec128 *g) { 97| 23.4k| vec128_mul_asm(h, f, g, 16); ------------------ | | 10| 23.4k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 23.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 98| 23.4k|} PQCLEAN_MCELIECE348864_AVX2_vec256_sq: 9| 13.9k|void vec256_sq(vec256 *out, vec256 *in) { 10| 13.9k| int i; 11| 13.9k| vec256 result[GFBITS]; 12| | 13| 13.9k| result[0] = in[0] ^ in[6]; 14| 13.9k| result[1] = in[11]; 15| 13.9k| result[2] = in[1] ^ in[7]; 16| 13.9k| result[3] = in[6]; 17| 13.9k| result[4] = in[2] ^ in[11] ^ in[8]; 18| 13.9k| result[5] = in[7]; 19| 13.9k| result[6] = in[3] ^ in[9]; 20| 13.9k| result[7] = in[8]; 21| 13.9k| result[8] = in[4] ^ in[10]; 22| 13.9k| result[9] = in[9]; 23| 13.9k| result[10] = in[5] ^ in[11]; 24| 13.9k| result[11] = in[10]; 25| | 26| 181k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 181k|#define GFBITS 12 ------------------ | Branch (26:17): [True: 167k, False: 13.9k] ------------------ 27| 167k| out[i] = result[i]; 28| 167k| } 29| 13.9k|} PQCLEAN_MCELIECE348864_AVX2_vec256_inv: 32| 1.11k|void vec256_inv(vec256 *out, vec256 *in) { 33| 1.11k| vec256 tmp_11[ GFBITS ]; 34| 1.11k| vec256 tmp_1111[ GFBITS ]; 35| | 36| 1.11k| vec256_copy(out, in); 37| | 38| 1.11k| vec256_sq(out, out); ------------------ | | 14| 1.11k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.11k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 39| 1.11k| vec256_mul(tmp_11, out, in); // ^11 40| | 41| 1.11k| vec256_sq(out, tmp_11); ------------------ | | 14| 1.11k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.11k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 42| 1.11k| vec256_sq(out, out); ------------------ | | 14| 1.11k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.11k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 43| 1.11k| vec256_mul(tmp_1111, out, tmp_11); // ^1111 44| | 45| 1.11k| vec256_sq(out, tmp_1111); ------------------ | | 14| 1.11k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.11k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 46| 1.11k| vec256_sq(out, out); ------------------ | | 14| 1.11k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.11k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 47| 1.11k| vec256_sq(out, out); ------------------ | | 14| 1.11k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.11k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 48| 1.11k| vec256_sq(out, out); ------------------ | | 14| 1.11k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.11k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 49| 1.11k| vec256_mul(out, out, tmp_1111); // ^11111111 50| | 51| 1.11k| vec256_sq(out, out); ------------------ | | 14| 1.11k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.11k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 52| 1.11k| vec256_sq(out, out); ------------------ | | 14| 1.11k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.11k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 53| 1.11k| vec256_mul(out, out, tmp_11); // ^1111111111 54| 1.11k| vec256_sq(out, out); ------------------ | | 14| 1.11k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.11k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 55| 1.11k| vec256_mul(out, out, in); // ^11111111111 56| | 57| 1.11k| vec256_sq(out, out); // ^111111111110 ------------------ | | 14| 1.11k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.11k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 58| 1.11k|} pk_gen.c:vec256_copy: 88| 10.9k|static inline void vec256_copy(vec256 *dest, vec256 *src) { 89| 10.9k| int i; 90| | 91| 151k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 151k|#define GFBITS 12 ------------------ | Branch (91:17): [True: 140k, False: 10.9k] ------------------ 92| 140k| dest[i] = src[i]; 93| 140k| } 94| 10.9k|} pk_gen.c:vec256_mul: 99| 5.68M|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 5.68M| vec256_mul_asm(h, f, g); ------------------ | | 13| 5.68M|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 5.68M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 101| 5.68M|} pk_gen.c:vec256_set4x: 34| 3.86M|static inline vec256 vec256_set4x(uint64_t a0, uint64_t a1, uint64_t a2, uint64_t a3) { 35| 3.86M| return _mm256_set_epi64x(a3, a2, a1, a0); 36| 3.86M|} pk_gen.c:vec256_set1_16b: 22| 5.18G|static inline vec256 vec256_set1_16b(uint16_t a) { 23| 5.18G| return _mm256_set1_epi16(a); 24| 5.18G|} pk_gen.c:vec256_set1_32b: 26| 9.18G|static inline vec256 vec256_set1_32b(uint64_t a) { 27| 9.18G| return _mm256_set1_epi32(a); 28| 9.18G|} vec256.c:vec256_copy: 88| 6.40k|static inline void vec256_copy(vec256 *dest, vec256 *src) { 89| 6.40k| int i; 90| | 91| 88.4k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 88.4k|#define GFBITS 12 ------------------ | Branch (91:17): [True: 82.0k, False: 6.40k] ------------------ 92| 82.0k| dest[i] = src[i]; 93| 82.0k| } 94| 6.40k|} vec256.c:vec256_mul: 99| 26.9k|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 26.9k| vec256_mul_asm(h, f, g); ------------------ | | 13| 26.9k|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 26.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 101| 26.9k|} decrypt.c:vec256_set4x: 34| 26.4k|static inline vec256 vec256_set4x(uint64_t a0, uint64_t a1, uint64_t a2, uint64_t a3) { 35| 26.4k| return _mm256_set_epi64x(a3, a2, a1, a0); 36| 26.4k|} decrypt.c:vec256_copy: 88| 1.83k|static inline void vec256_copy(vec256 *dest, vec256 *src) { 89| 1.83k| int i; 90| | 91| 25.3k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 25.3k|#define GFBITS 12 ------------------ | Branch (91:17): [True: 23.5k, False: 1.83k] ------------------ 92| 23.5k| dest[i] = src[i]; 93| 23.5k| } 94| 1.83k|} decrypt.c:vec256_mul: 99| 76.5k|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 76.5k| vec256_mul_asm(h, f, g); ------------------ | | 13| 76.5k|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 76.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 101| 76.5k|} decrypt.c:vec256_and: 45| 681k|static inline vec256 vec256_and(vec256 a, vec256 b) { 46| 681k| return _mm256_and_si256(a, b); 47| 681k|} decrypt.c:vec256_set1_16b: 22| 918|static inline vec256 vec256_set1_16b(uint16_t a) { 23| 918| return _mm256_set1_epi16(a); 24| 918|} decrypt.c:vec256_or_reduce: 76| 26.4k|static inline vec256 vec256_or_reduce(vec256 *a) { 77| 26.4k| int i; 78| 26.4k| vec256 ret; 79| | 80| 26.4k| ret = a[0]; 81| 340k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 340k|#define GFBITS 12 ------------------ | Branch (81:17): [True: 314k, False: 26.4k] ------------------ 82| 314k| ret = vec256_or(ret, a[i]); 83| 314k| } 84| | 85| 26.4k| return ret; 86| 26.4k|} decrypt.c:vec256_or: 53| 323k|static inline vec256 vec256_or(vec256 a, vec256 b) { 54| 323k| return _mm256_or_si256(a, b); 55| 323k|} decrypt.c:vec256_xor: 49| 36.0k|static inline vec256 vec256_xor(vec256 a, vec256 b) { 50| 36.0k| return _mm256_xor_si256(a, b); 51| 36.0k|} fft.c:vec256_set4x: 34| 4.41M|static inline vec256 vec256_set4x(uint64_t a0, uint64_t a1, uint64_t a2, uint64_t a3) { 35| 4.41M| return _mm256_set_epi64x(a3, a2, a1, a0); 36| 4.41M|} fft.c:vec256_mul: 99| 71.1k|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 71.1k| vec256_mul_asm(h, f, g); ------------------ | | 13| 71.1k|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 71.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 101| 71.1k|} fft.c:vec256_unpack_low_2x: 68| 142k|static inline vec256 vec256_unpack_low_2x(vec256 a, vec256 b) { 69| 142k| return _mm256_unpacklo_epi64 (a, b); 70| 142k|} fft.c:vec256_unpack_high_2x: 72| 142k|static inline vec256 vec256_unpack_high_2x(vec256 a, vec256 b) { 73| 142k| return _mm256_unpackhi_epi64 (a, b); 74| 142k|} fft.c:vec256_unpack_low: 60| 3.88M|static inline vec256 vec256_unpack_low(vec256 a, vec256 b) { 61| | return _mm256_permute2x128_si256 (a, b, 0x20); 62| 3.88M|} fft.c:vec256_unpack_high: 64| 3.69M|static inline vec256 vec256_unpack_high(vec256 a, vec256 b) { 65| | return _mm256_permute2x128_si256 (a, b, 0x31); 66| 3.69M|} fft.c:vec256_xor: 49| 3.90M|static inline vec256 vec256_xor(vec256 a, vec256 b) { 50| 3.90M| return _mm256_xor_si256(a, b); 51| 3.90M|} fft_tr.c:vec256_set4x: 34| 1.18M|static inline vec256 vec256_set4x(uint64_t a0, uint64_t a1, uint64_t a2, uint64_t a3) { 35| 1.18M| return _mm256_set_epi64x(a3, a2, a1, a0); 36| 1.18M|} fft_tr.c:vec256_mul: 99| 26.3k|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 26.3k| vec256_mul_asm(h, f, g); ------------------ | | 13| 26.3k|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 26.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 101| 26.3k|} fft_tr.c:vec256_unpack_low: 60| 646k|static inline vec256 vec256_unpack_low(vec256 a, vec256 b) { 61| | return _mm256_permute2x128_si256 (a, b, 0x20); 62| 646k|} fft_tr.c:vec256_unpack_high: 64| 646k|static inline vec256 vec256_unpack_high(vec256 a, vec256 b) { 65| | return _mm256_permute2x128_si256 (a, b, 0x31); 66| 646k|} fft_tr.c:vec256_unpack_low_2x: 68| 646k|static inline vec256 vec256_unpack_low_2x(vec256 a, vec256 b) { 69| 646k| return _mm256_unpacklo_epi64 (a, b); 70| 646k|} fft_tr.c:vec256_unpack_high_2x: 72| 646k|static inline vec256 vec256_unpack_high_2x(vec256 a, vec256 b) { 73| 646k| return _mm256_unpackhi_epi64 (a, b); 74| 646k|} fft_tr.c:vec256_xor: 49| 1.93M|static inline vec256 vec256_xor(vec256 a, vec256 b) { 50| 1.93M| return _mm256_xor_si256(a, b); 51| 1.93M|} controlbits.c:cbrecursion: 22| 6.76M|static void cbrecursion(unsigned char *out, long long pos, long long step, const int16 *pi, long long w, long long n, int32 *temp) { 23| 6.76M|#define A temp 24| 6.76M|#define B (temp+n) 25| 6.76M|#define q ((int16 *) (temp+n+n/4)) 26| | /* q can start anywhere between temp+n and temp+n/2 */ 27| | 28| 6.76M| long long x, y, i, j, k; 29| | 30| 6.76M| if (w == 1) { ------------------ | Branch (30:9): [True: 3.38M, False: 3.38M] ------------------ 31| 3.38M| out[pos >> 3] ^= pi[0] << (pos & 7); 32| 3.38M| return; 33| 3.38M| } 34| | 35| 83.8M| for (x = 0; x < n; ++x) { ------------------ | Branch (35:17): [True: 80.4M, False: 3.38M] ------------------ 36| 80.4M| A[x] = ((pi[x] ^ 1) << 16) | pi[x ^ 1]; ------------------ | | 23| 80.4M|#define A temp ------------------ 37| 80.4M| } 38| 3.38M| int32_sort(A, n); /* A = (id<<16)+pibar */ ------------------ | | 6| 3.38M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.38M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+pibar */ ------------------ | | 23| 3.38M|#define A temp ------------------ 39| | 40| 83.8M| for (x = 0; x < n; ++x) { ------------------ | Branch (40:17): [True: 80.4M, False: 3.38M] ------------------ 41| 80.4M| int32 Ax = A[x]; ------------------ | | 23| 80.4M|#define A temp ------------------ 42| 80.4M| int32 px = Ax & 0xffff; 43| 80.4M| int32 cx = int32_min(px, (int32)x); ------------------ | | 13| 80.4M|#define int32_min crypto_int32_min | | ------------------ | | | | 23| 80.4M|#define crypto_int32_min CRYPTO_NAMESPACE(crypto_int32_min) | | | | ------------------ | | | | | | 4| 80.4M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | | | ------------------ | | ------------------ ------------------ 44| 80.4M| B[x] = ((px) << 16) | cx; ------------------ | | 24| 80.4M|#define B (temp+n) ------------------ 45| 80.4M| } 46| | /* B = (p<<16)+c */ 47| | 48| 83.8M| for (x = 0; x < n; ++x) { ------------------ | Branch (48:17): [True: 80.4M, False: 3.38M] ------------------ 49| 80.4M| A[x] = (int32)((((uint32_t)A[x]) << 16) | x); /* A = (pibar<<16)+id */ ------------------ | | 23| 80.4M|#define A temp ------------------ A[x] = (int32)((((uint32_t)A[x]) << 16) | x); /* A = (pibar<<16)+id */ ------------------ | | 23| 80.4M|#define A temp ------------------ 50| 80.4M| } 51| 3.38M| int32_sort(A, n); /* A = (id<<16)+pibar^-1 */ ------------------ | | 6| 3.38M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.38M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+pibar^-1 */ ------------------ | | 23| 3.38M|#define A temp ------------------ 52| | 53| 83.8M| for (x = 0; x < n; ++x) { ------------------ | Branch (53:17): [True: 80.4M, False: 3.38M] ------------------ 54| 80.4M| A[x] = (((uint32_t)A[x]) << 16) + (B[x] >> 16); /* A = (pibar^(-1)<<16)+pibar */ ------------------ | | 23| 80.4M|#define A temp ------------------ A[x] = (((uint32_t)A[x]) << 16) + (B[x] >> 16); /* A = (pibar^(-1)<<16)+pibar */ ------------------ | | 23| 80.4M|#define A temp ------------------ A[x] = (((uint32_t)A[x]) << 16) + (B[x] >> 16); /* A = (pibar^(-1)<<16)+pibar */ ------------------ | | 24| 80.4M|#define B (temp+n) ------------------ 55| 80.4M| } 56| 3.38M| int32_sort(A, n); /* A = (id<<16)+pibar^2 */ ------------------ | | 6| 3.38M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.38M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+pibar^2 */ ------------------ | | 23| 3.38M|#define A temp ------------------ 57| | 58| 3.38M| if (w <= 10) { ------------------ | Branch (58:9): [True: 3.37M, False: 5.69k] ------------------ 59| 64.3M| for (x = 0; x < n; ++x) { ------------------ | Branch (59:21): [True: 60.9M, False: 3.37M] ------------------ 60| 60.9M| B[x] = ((A[x] & 0xffff) << 10) | (B[x] & 0x3ff); ------------------ | | 24| 60.9M|#define B (temp+n) ------------------ B[x] = ((A[x] & 0xffff) << 10) | (B[x] & 0x3ff); ------------------ | | 23| 60.9M|#define A temp ------------------ B[x] = ((A[x] & 0xffff) << 10) | (B[x] & 0x3ff); ------------------ | | 24| 60.9M|#define B (temp+n) ------------------ 61| 60.9M| } 62| | 63| 6.69M| for (i = 1; i < w - 1; ++i) { ------------------ | Branch (63:21): [True: 3.31M, False: 3.37M] ------------------ 64| | /* B = (p<<10)+c */ 65| | 66| 247M| for (x = 0; x < n; ++x) { ------------------ | Branch (66:25): [True: 243M, False: 3.31M] ------------------ 67| 243M| A[x] = (int32)(((B[x] & ~0x3ff) << 6) | x); /* A = (p<<16)+id */ ------------------ | | 23| 243M|#define A temp ------------------ A[x] = (int32)(((B[x] & ~0x3ff) << 6) | x); /* A = (p<<16)+id */ ------------------ | | 24| 243M|#define B (temp+n) ------------------ 68| 243M| } 69| 3.31M| int32_sort(A, n); /* A = (id<<16)+p^{-1} */ ------------------ | | 6| 3.31M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.31M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+p^{-1} */ ------------------ | | 23| 3.31M|#define A temp ------------------ 70| | 71| 247M| for (x = 0; x < n; ++x) { ------------------ | Branch (71:25): [True: 243M, False: 3.31M] ------------------ 72| 243M| A[x] = ((uint32_t)A[x] << 20) | B[x]; ------------------ | | 23| 243M|#define A temp ------------------ A[x] = ((uint32_t)A[x] << 20) | B[x]; ------------------ | | 23| 243M|#define A temp ------------------ A[x] = ((uint32_t)A[x] << 20) | B[x]; ------------------ | | 24| 243M|#define B (temp+n) ------------------ 73| 243M| } /* A = (p^{-1}<<20)+(p<<10)+c */ 74| 3.31M| int32_sort(A, n); /* A = (id<<20)+(pp<<10)+cp */ ------------------ | | 6| 3.31M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.31M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<20)+(pp<<10)+cp */ ------------------ | | 23| 3.31M|#define A temp ------------------ 75| | 76| 247M| for (x = 0; x < n; ++x) { ------------------ | Branch (76:25): [True: 243M, False: 3.31M] ------------------ 77| 243M| int32 ppcpx = A[x] & 0xfffff; ------------------ | | 23| 243M|#define A temp ------------------ 78| 243M| int32 ppcx = (A[x] & 0xffc00) | (B[x] & 0x3ff); ------------------ | | 23| 243M|#define A temp ------------------ int32 ppcx = (A[x] & 0xffc00) | (B[x] & 0x3ff); ------------------ | | 24| 243M|#define B (temp+n) ------------------ 79| 243M| B[x] = int32_min(ppcx, ppcpx); ------------------ | | 24| 243M|#define B (temp+n) ------------------ B[x] = int32_min(ppcx, ppcpx); ------------------ | | 13| 243M|#define int32_min crypto_int32_min | | ------------------ | | | | 23| 243M|#define crypto_int32_min CRYPTO_NAMESPACE(crypto_int32_min) | | | | ------------------ | | | | | | 4| 243M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | | | ------------------ | | ------------------ ------------------ 80| 243M| } 81| 3.31M| } 82| 64.3M| for (x = 0; x < n; ++x) { ------------------ | Branch (82:21): [True: 60.9M, False: 3.37M] ------------------ 83| 60.9M| B[x] &= 0x3ff; ------------------ | | 24| 60.9M|#define B (temp+n) ------------------ 84| 60.9M| } 85| 3.37M| } else { 86| 19.5M| for (x = 0; x < n; ++x) { ------------------ | Branch (86:21): [True: 19.5M, False: 5.69k] ------------------ 87| 19.5M| B[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 24| 19.5M|#define B (temp+n) ------------------ B[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 23| 19.5M|#define A temp ------------------ B[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 24| 19.5M|#define B (temp+n) ------------------ 88| 19.5M| } 89| | 90| 60.0k| for (i = 1; i < w - 1; ++i) { ------------------ | Branch (90:21): [True: 54.3k, False: 5.69k] ------------------ 91| | /* B = (p<<16)+c */ 92| | 93| 194M| for (x = 0; x < n; ++x) { ------------------ | Branch (93:25): [True: 194M, False: 54.3k] ------------------ 94| 194M| A[x] = (int32)((B[x] & ~0xffff) | x); ------------------ | | 23| 194M|#define A temp ------------------ A[x] = (int32)((B[x] & ~0xffff) | x); ------------------ | | 24| 194M|#define B (temp+n) ------------------ 95| 194M| } 96| 54.3k| int32_sort(A, n); /* A = (id<<16)+p^(-1) */ ------------------ | | 6| 54.3k|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 54.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+p^(-1) */ ------------------ | | 23| 54.3k|#define A temp ------------------ 97| | 98| 194M| for (x = 0; x < n; ++x) { ------------------ | Branch (98:25): [True: 194M, False: 54.3k] ------------------ 99| 194M| A[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 23| 194M|#define A temp ------------------ A[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 23| 194M|#define A temp ------------------ A[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 24| 194M|#define B (temp+n) ------------------ 100| 194M| } 101| | /* A = p^(-1)<<16+c */ 102| | 103| 54.3k| if (i < w - 2) { ------------------ | Branch (103:17): [True: 48.6k, False: 5.69k] ------------------ 104| 175M| for (x = 0; x < n; ++x) { ------------------ | Branch (104:29): [True: 175M, False: 48.6k] ------------------ 105| 175M| B[x] = (A[x] & ~0xffff) | (B[x] >> 16); ------------------ | | 24| 175M|#define B (temp+n) ------------------ B[x] = (A[x] & ~0xffff) | (B[x] >> 16); ------------------ | | 23| 175M|#define A temp ------------------ B[x] = (A[x] & ~0xffff) | (B[x] >> 16); ------------------ | | 24| 175M|#define B (temp+n) ------------------ 106| 175M| } 107| | /* B = (p^(-1)<<16)+p */ 108| 48.6k| int32_sort(B, n); /* B = (id<<16)+p^(-2) */ ------------------ | | 6| 48.6k|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 48.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(B, n); /* B = (id<<16)+p^(-2) */ ------------------ | | 24| 48.6k|#define B (temp+n) ------------------ 109| 175M| for (x = 0; x < n; ++x) { ------------------ | Branch (109:29): [True: 175M, False: 48.6k] ------------------ 110| 175M| B[x] = (((uint32_t)B[x]) << 16) | (A[x] & 0xffff); ------------------ | | 24| 175M|#define B (temp+n) ------------------ B[x] = (((uint32_t)B[x]) << 16) | (A[x] & 0xffff); ------------------ | | 24| 175M|#define B (temp+n) ------------------ B[x] = (((uint32_t)B[x]) << 16) | (A[x] & 0xffff); ------------------ | | 23| 175M|#define A temp ------------------ 111| 175M| } 112| | /* B = (p^(-2)<<16)+c */ 113| 48.6k| } 114| | 115| 54.3k| int32_sort(A, n); ------------------ | | 6| 54.3k|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 54.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); ------------------ | | 23| 54.3k|#define A temp ------------------ 116| | /* A = id<<16+cp */ 117| 194M| for (x = 0; x < n; ++x) { ------------------ | Branch (117:25): [True: 194M, False: 54.3k] ------------------ 118| 194M| int32 cpx = (B[x] & ~0xffff) | (A[x] & 0xffff); ------------------ | | 24| 194M|#define B (temp+n) ------------------ int32 cpx = (B[x] & ~0xffff) | (A[x] & 0xffff); ------------------ | | 23| 194M|#define A temp ------------------ 119| 194M| B[x] = int32_min(B[x], cpx); ------------------ | | 24| 194M|#define B (temp+n) ------------------ B[x] = int32_min(B[x], cpx); ------------------ | | 13| 194M|#define int32_min crypto_int32_min | | ------------------ | | | | 23| 194M|#define crypto_int32_min CRYPTO_NAMESPACE(crypto_int32_min) | | | | ------------------ | | | | | | 4| 194M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | | | ------------------ | | ------------------ ------------------ B[x] = int32_min(B[x], cpx); ------------------ | | 24| 194M|#define B (temp+n) ------------------ 120| 194M| } 121| 54.3k| } 122| 19.5M| for (x = 0; x < n; ++x) { ------------------ | Branch (122:21): [True: 19.5M, False: 5.69k] ------------------ 123| 19.5M| B[x] &= 0xffff; ------------------ | | 24| 19.5M|#define B (temp+n) ------------------ 124| 19.5M| } 125| 5.69k| } 126| | 127| 83.8M| for (x = 0; x < n; ++x) { ------------------ | Branch (127:17): [True: 80.4M, False: 3.38M] ------------------ 128| 80.4M| A[x] = (int32)((((int32)pi[x]) << 16) + x); ------------------ | | 23| 80.4M|#define A temp ------------------ 129| 80.4M| } 130| 3.38M| int32_sort(A, n); /* A = (id<<16)+pi^(-1) */ ------------------ | | 6| 3.38M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.38M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+pi^(-1) */ ------------------ | | 23| 3.38M|#define A temp ------------------ 131| | 132| 43.6M| for (j = 0; j < n / 2; ++j) { ------------------ | Branch (132:17): [True: 40.2M, False: 3.38M] ------------------ 133| 40.2M| x = 2 * j; 134| 40.2M| int32 fj = B[x] & 1; /* f[j] */ ------------------ | | 24| 40.2M|#define B (temp+n) ------------------ 135| 40.2M| int32 Fx = (int32)(x + fj); /* F[x] */ 136| 40.2M| int32 Fx1 = Fx ^ 1; /* F[x+1] */ 137| | 138| 40.2M| out[pos >> 3] ^= fj << (pos & 7); 139| 40.2M| pos += step; 140| | 141| 40.2M| B[x] = ((uint32_t)A[x] << 16) | Fx; ------------------ | | 24| 40.2M|#define B (temp+n) ------------------ B[x] = ((uint32_t)A[x] << 16) | Fx; ------------------ | | 23| 40.2M|#define A temp ------------------ 142| 40.2M| B[x + 1] = ((uint32_t)A[x + 1] << 16) | Fx1; ------------------ | | 24| 40.2M|#define B (temp+n) ------------------ B[x + 1] = ((uint32_t)A[x + 1] << 16) | Fx1; ------------------ | | 23| 40.2M|#define A temp ------------------ 143| 40.2M| } 144| | /* B = (pi^(-1)<<16)+F */ 145| | 146| 3.38M| int32_sort(B, n); /* B = (id<<16)+F(pi) */ ------------------ | | 6| 3.38M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.38M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(B, n); /* B = (id<<16)+F(pi) */ ------------------ | | 24| 3.38M|#define B (temp+n) ------------------ 147| | 148| 3.38M| pos += (2 * w - 3) * step * (n / 2); 149| | 150| 43.6M| for (k = 0; k < n / 2; ++k) { ------------------ | Branch (150:17): [True: 40.2M, False: 3.38M] ------------------ 151| 40.2M| y = 2 * k; 152| 40.2M| int32 lk = B[y] & 1; /* l[k] */ ------------------ | | 24| 40.2M|#define B (temp+n) ------------------ 153| 40.2M| int32 Ly = (int32)(y + lk); /* L[y] */ 154| 40.2M| int32 Ly1 = Ly ^ 1; /* L[y+1] */ 155| | 156| 40.2M| out[pos >> 3] ^= lk << (pos & 7); 157| 40.2M| pos += step; 158| | 159| 40.2M| A[y] = (Ly << 16) | (B[y] & 0xffff); ------------------ | | 23| 40.2M|#define A temp ------------------ A[y] = (Ly << 16) | (B[y] & 0xffff); ------------------ | | 24| 40.2M|#define B (temp+n) ------------------ 160| 40.2M| A[y + 1] = (Ly1 << 16) | (B[y + 1] & 0xffff); ------------------ | | 23| 40.2M|#define A temp ------------------ A[y + 1] = (Ly1 << 16) | (B[y + 1] & 0xffff); ------------------ | | 24| 40.2M|#define B (temp+n) ------------------ 161| 40.2M| } 162| | /* A = (L<<16)+F(pi) */ 163| | 164| 3.38M| int32_sort(A, n); /* A = (id<<16)+F(pi(L)) = (id<<16)+M */ ------------------ | | 6| 3.38M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.38M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+F(pi(L)) = (id<<16)+M */ ------------------ | | 23| 3.38M|#define A temp ------------------ 165| | 166| 3.38M| pos -= (2 * w - 2) * step * (n / 2); 167| | 168| 43.6M| for (j = 0; j < n / 2; ++j) { ------------------ | Branch (168:17): [True: 40.2M, False: 3.38M] ------------------ 169| 40.2M| q[j] = (A[2 * j] & 0xffff) >> 1; ------------------ | | 25| 40.2M|#define q ((int16 *) (temp+n+n/4)) ------------------ q[j] = (A[2 * j] & 0xffff) >> 1; ------------------ | | 23| 40.2M|#define A temp ------------------ 170| 40.2M| q[j + n / 2] = (A[2 * j + 1] & 0xffff) >> 1; ------------------ | | 25| 40.2M|#define q ((int16 *) (temp+n+n/4)) ------------------ q[j + n / 2] = (A[2 * j + 1] & 0xffff) >> 1; ------------------ | | 23| 40.2M|#define A temp ------------------ 171| 40.2M| } 172| | 173| 3.38M| cbrecursion(out, pos, step * 2, q, w - 1, n / 2, temp); ------------------ | | 25| 3.38M|#define q ((int16 *) (temp+n+n/4)) ------------------ 174| 3.38M| cbrecursion(out, pos + step, step * 2, q + n / 2, w - 1, n / 2, temp); ------------------ | | 25| 3.38M|#define q ((int16 *) (temp+n+n/4)) ------------------ 175| 3.38M|} controlbits.c:layer: 182| 22.5k|static void layer(int16_t *p, const unsigned char *cb, int s, int n) { 183| 22.5k| int i, j; 184| 22.5k| int stride = 1 << (uint8_t)(s & 0x1F); 185| 22.5k| int index = 0; 186| 22.5k| int16_t d, m; 187| | 188| 13.5M| for (i = 0; i < n; i += stride * 2) { ------------------ | Branch (188:17): [True: 13.5M, False: 22.5k] ------------------ 189| 97.4M| for (j = 0; j < stride; j++) { ------------------ | Branch (189:21): [True: 83.8M, False: 13.5M] ------------------ 190| 83.8M| d = p[ i + j ] ^ p[ i + j + stride ]; 191| 83.8M| m = (cb[ index >> 3 ] >> (index & 7)) & 1; 192| 83.8M| m = -m; 193| 83.8M| d &= m; 194| 83.8M| p[ i + j ] ^= d; 195| 83.8M| p[ i + j + stride ] ^= d; 196| 83.8M| index++; 197| 83.8M| } 198| 13.5M| } 199| 22.5k|} encrypt.c:uint16_is_smaller_declassify: 22| 582k|static inline crypto_uint16 uint16_is_smaller_declassify(uint16_t t, uint16_t u) { 23| 582k| crypto_uint16 mask = crypto_uint16_smaller_mask(t, u); ------------------ | | 21| 582k|#define crypto_uint16_smaller_mask CRYPTO_NAMESPACE(crypto_uint16_smaller_mask) | | ------------------ | | | | 4| 582k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ 24| 582k| crypto_declassify(&mask, sizeof mask); 25| 582k| return mask; 26| 582k|} encrypt.c:uint32_is_equal_declassify: 28| 520k|static inline crypto_uint32 uint32_is_equal_declassify(uint32_t t, uint32_t u) { 29| 520k| crypto_uint32 mask = crypto_uint32_equal_mask(t, u); ------------------ | | 19| 520k|#define crypto_uint32_equal_mask CRYPTO_NAMESPACE(crypto_uint32_equal_mask) | | ------------------ | | | | 4| 520k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ 30| 520k| crypto_declassify(&mask, sizeof mask); 31| 520k| return mask; 32| 520k|} gf.c:gf_sq: 52| 788k|static inline gf gf_sq(gf in) { 53| 788k| const uint32_t B[] = {0x55555555, 0x33333333, 0x0F0F0F0F, 0x00FF00FF}; 54| | 55| 788k| uint32_t x = in; 56| 788k| uint32_t t; 57| | 58| 788k| x = (x | (x << 8)) & B[3]; 59| 788k| x = (x | (x << 4)) & B[2]; 60| 788k| x = (x | (x << 2)) & B[1]; 61| 788k| x = (x | (x << 1)) & B[0]; 62| | 63| 788k| t = x & 0x7FC000; 64| 788k| x ^= t >> 9; 65| 788k| x ^= t >> 12; 66| | 67| 788k| t = x & 0x3000; 68| 788k| x ^= t >> 9; 69| 788k| x ^= t >> 12; 70| | 71| 788k| return x & ((1 << GFBITS) - 1); ------------------ | | 6| 788k|#define GFBITS 12 ------------------ 72| 788k|} pk_gen.c:uint64_is_equal_declassify: 20| 39.4M|static crypto_uint64 uint64_is_equal_declassify(uint64_t t, uint64_t u) { 21| 39.4M| crypto_uint64 mask = crypto_uint64_equal_mask(t, u); ------------------ | | 19| 39.4M|#define crypto_uint64_equal_mask CRYPTO_NAMESPACE(crypto_uint64_equal_mask) | | ------------------ | | | | 4| 39.4M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ 22| 39.4M| crypto_declassify(&mask, sizeof mask); 23| 39.4M| return mask; 24| 39.4M|} pk_gen.c:uint64_is_zero_declassify: 26| 7.10M|static crypto_uint64 uint64_is_zero_declassify(uint64_t t) { 27| 7.10M| crypto_uint64 mask = crypto_uint64_zero_mask(t); ------------------ | | 15| 7.10M|#define crypto_uint64_zero_mask CRYPTO_NAMESPACE(crypto_uint64_zero_mask) | | ------------------ | | | | 4| 7.10M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ 28| 7.10M| crypto_declassify(&mask, sizeof mask); 29| 7.10M| return mask; 30| 7.10M|} sk_gen.c:gf_is_zero_declassify: 15| 579k|static inline crypto_uint16 gf_is_zero_declassify(gf t) { 16| 579k| crypto_uint16 mask = crypto_uint16_zero_mask(t); ------------------ | | 15| 579k|#define crypto_uint16_zero_mask CRYPTO_NAMESPACE(crypto_uint16_zero_mask) | | ------------------ | | | | 4| 579k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ 17| 579k| crypto_declassify(&mask, sizeof mask); 18| 579k| return mask; 19| 579k|} pk_gen.c:uint64_sort: 20| 5.49k|static void uint64_sort(uint64_t *x, long long n) { 21| 5.49k| long long top, p, q, r, i; 22| | 23| 5.49k| if (n < 2) { ------------------ | Branch (23:9): [True: 0, False: 5.49k] ------------------ 24| 0| return; 25| 0| } 26| 5.49k| top = 1; 27| 70.2k| while (top < n - top) { ------------------ | Branch (27:12): [True: 64.7k, False: 5.49k] ------------------ 28| 64.7k| top += top; 29| 64.7k| } 30| | 31| 75.7k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (31:19): [True: 70.2k, False: 5.49k] ------------------ 32| 480M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (32:21): [True: 480M, False: 70.2k] ------------------ 33| 480M| if (!(i & p)) { ------------------ | Branch (33:17): [True: 260M, False: 219M] ------------------ 34| 260M| uint64_MINMAX(x[i], x[i + p]); ------------------ | | 11| 260M| do { \ | | 12| 260M| uint64_t c = (b) - (a); \ | | 13| 260M| c >>= 63; \ | | 14| 260M| c = -c; \ | | 15| 260M| c &= (a) ^ (b); \ | | 16| 260M| (a) ^= c; \ | | 17| 260M| (b) ^= c; \ | | 18| 260M| } while(0) | | ------------------ | | | Branch (18:13): [Folded, False: 260M] | | ------------------ ------------------ 35| 260M| } 36| 480M| } 37| 70.2k| i = 0; 38| 485k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (38:23): [True: 414k, False: 70.2k] ------------------ 39| 440M| for (; i < n - q; ++i) { ------------------ | Branch (39:20): [True: 439M, False: 414k] ------------------ 40| 439M| if (!(i & p)) { ------------------ | Branch (40:21): [True: 219M, False: 219M] ------------------ 41| 219M| uint64_t a = x[i + p]; 42| 1.54G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (42:33): [True: 1.32G, False: 219M] ------------------ 43| 1.32G| uint64_MINMAX(a, x[i + r]); ------------------ | | 11| 1.32G| do { \ | | 12| 1.32G| uint64_t c = (b) - (a); \ | | 13| 1.32G| c >>= 63; \ | | 14| 1.32G| c = -c; \ | | 15| 1.32G| c &= (a) ^ (b); \ | | 16| 1.32G| (a) ^= c; \ | | 17| 1.32G| (b) ^= c; \ | | 18| 1.32G| } while(0) | | ------------------ | | | Branch (18:13): [Folded, False: 1.32G] | | ------------------ ------------------ 44| 1.32G| } 45| 219M| x[i + p] = a; 46| 219M| } 47| 439M| } 48| 414k| } 49| 70.2k| } 50| 5.49k|} PQCLEAN_MCELIECE348864F_AVX2_load_bits: 168| 80|void load_bits(uint64_t out[][32], const unsigned char *bits) { 169| 80| int i, low, block = 0; 170| | 171| 80| uint64_t cond[64]; 172| | 173| | // 174| | 175| 560| for (low = 0; low <= 5; low++) { ------------------ | Branch (175:19): [True: 480, False: 80] ------------------ 176| 31.2k| for (i = 0; i < 64; i++) { ------------------ | Branch (176:21): [True: 30.7k, False: 480] ------------------ 177| 30.7k| cond[i] = load4(bits + block * 256 + i * 4); 178| 30.7k| } 179| 480| transpose_64x64(cond); 180| | 181| 15.8k| for (i = 0; i < 32; i++) { ------------------ | Branch (181:21): [True: 15.3k, False: 480] ------------------ 182| 15.3k| out[ block ][i] = cond[i]; 183| 15.3k| } 184| 480| block++; 185| 480| } 186| | 187| 560| for (low = 0; low <= 5; low++) { ------------------ | Branch (187:19): [True: 480, False: 80] ------------------ 188| 15.8k| for (i = 0; i < 32; i++) { ------------------ | Branch (188:21): [True: 15.3k, False: 480] ------------------ 189| 15.3k| out[ block ][i] = load8(bits + block * 256 + i * 8); 190| 15.3k| } 191| 480| block++; 192| 480| } 193| | 194| 480| for (low = 4; low >= 0; low--) { ------------------ | Branch (194:19): [True: 400, False: 80] ------------------ 195| 13.2k| for (i = 0; i < 32; i++) { ------------------ | Branch (195:21): [True: 12.8k, False: 400] ------------------ 196| 12.8k| out[ block ][i] = load8(bits + block * 256 + i * 8); 197| 12.8k| } 198| 400| block++; 199| 400| } 200| | 201| 560| for (low = 5; low >= 0; low--) { ------------------ | Branch (201:19): [True: 480, False: 80] ------------------ 202| 31.2k| for (i = 0; i < 64; i++) { ------------------ | Branch (202:21): [True: 30.7k, False: 480] ------------------ 203| 30.7k| cond[i] = load4(bits + block * 256 + i * 4); 204| 30.7k| } 205| 480| transpose_64x64(cond); 206| | 207| 15.8k| for (i = 0; i < 32; i++) { ------------------ | Branch (207:21): [True: 15.3k, False: 480] ------------------ 208| 15.3k| out[ block ][i] = cond[i]; 209| 15.3k| } 210| 480| block++; 211| 480| } 212| 80|} PQCLEAN_MCELIECE348864F_AVX2_benes: 218| 160|void benes(uint64_t *r, uint64_t cond[][32], int rev) { 219| 160| int block, inc; 220| | 221| 160| uint64_t *bs = r; 222| | 223| | // 224| | 225| 160| if (rev == 0) { ------------------ | Branch (225:9): [True: 80, False: 80] ------------------ 226| 80| block = 0; 227| 80| inc = 1; 228| 80| } else { 229| 80| block = 22; 230| 80| inc = -1; 231| 80| } 232| | 233| 160| transpose_64x64(bs); 234| | 235| 160| layer_0(bs, cond[ block ]); 236| 160| block += inc; 237| 160| layer_1(bs, cond[ block ]); 238| 160| block += inc; 239| 160| layer_2(bs, cond[ block ]); 240| 160| block += inc; 241| 160| layer_3(bs, cond[ block ]); 242| 160| block += inc; 243| 160| layer_4(bs, cond[ block ]); 244| 160| block += inc; 245| 160| layer_5(bs, cond[ block ]); 246| 160| block += inc; 247| | 248| 160| transpose_64x64(bs); 249| | 250| 160| layer_0(bs, cond[ block ]); 251| 160| block += inc; 252| 160| layer_1(bs, cond[ block ]); 253| 160| block += inc; 254| 160| layer_2(bs, cond[ block ]); 255| 160| block += inc; 256| 160| layer_3(bs, cond[ block ]); 257| 160| block += inc; 258| 160| layer_4(bs, cond[ block ]); 259| 160| block += inc; 260| 160| layer_5(bs, cond[ block ]); 261| 160| block += inc; 262| 160| layer_4(bs, cond[ block ]); 263| 160| block += inc; 264| 160| layer_3(bs, cond[ block ]); 265| 160| block += inc; 266| 160| layer_2(bs, cond[ block ]); 267| 160| block += inc; 268| 160| layer_1(bs, cond[ block ]); 269| 160| block += inc; 270| 160| layer_0(bs, cond[ block ]); 271| 160| block += inc; 272| | 273| 160| transpose_64x64(bs); 274| | 275| 160| layer_5(bs, cond[ block ]); 276| 160| block += inc; 277| 160| layer_4(bs, cond[ block ]); 278| 160| block += inc; 279| 160| layer_3(bs, cond[ block ]); 280| 160| block += inc; 281| 160| layer_2(bs, cond[ block ]); 282| 160| block += inc; 283| 160| layer_1(bs, cond[ block ]); 284| 160| block += inc; 285| 160| layer_0(bs, cond[ block ]); 286| | 287| 160| transpose_64x64(bs); 288| 160|} PQCLEAN_MCELIECE348864F_AVX2_bm: 140| 80|void bm(uint64_t out[ GFBITS ], vec128 in[ GFBITS ]) { 141| 80| uint16_t i; 142| 80| uint16_t N, L; 143| | 144| 80| uint64_t prod[ GFBITS ]; 145| 80| uint64_t in_tmp[ GFBITS ]; 146| | 147| 80| uint64_t db[ GFBITS ][ 2 ]; 148| 80| uint64_t BC_tmp[ GFBITS ][ 2 ]; 149| 80| uint64_t BC[ GFBITS ][ 2 ]; 150| | 151| 80| uint64_t mask, t; 152| | 153| 80| gf d, b, c0 = 1; 154| | 155| 80| gf coefs[SYS_T * 2]; 156| | 157| | // init 158| | 159| 80| BC[0][1] = 0; 160| 80| BC[0][0] = 1; 161| 80| BC[0][0] <<= 63; 162| | 163| 960| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 960|#define GFBITS 12 ------------------ | Branch (163:17): [True: 880, False: 80] ------------------ 164| 880| BC[i][0] = BC[i][1] = 0; 165| 880| } 166| | 167| 80| b = 1; 168| 80| L = 0; 169| | 170| | // 171| | 172| 80| get_coefs(coefs, in); 173| | 174| 1.04k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.04k|#define GFBITS 12 ------------------ | Branch (174:17): [True: 960, False: 80] ------------------ 175| 960| in_tmp[i] = 0; 176| 960| } 177| | 178| 10.3k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 10.3k|#define SYS_T 64 ------------------ | Branch (178:17): [True: 10.2k, False: 80] ------------------ 179| | // computing d 180| | 181| 10.2k| vec_mul_sp(prod, in_tmp, &BC[0][0]); 182| | 183| 10.2k| update_asm(in_tmp, coefs[N], 8); ------------------ | | 1| 10.2k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 10.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 184| | 185| 10.2k| d = vec_reduce_asm(prod); ------------------ | | 3| 10.2k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 10.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 10.2k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 10.2k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 10.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 188| | 189| 10.2k| d ^= t & 0xFFFFFFFF; 190| | 191| | // 3 cases 192| | 193| 10.2k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 194| | 195| 133k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 133k|#define GFBITS 12 ------------------ | Branch (195:21): [True: 122k, False: 10.2k] ------------------ 196| 122k| db[i][0] = (d >> i) & 1; 197| 122k| db[i][0] = -db[i][0]; 198| 122k| db[i][1] = (b >> i) & 1; 199| 122k| db[i][1] = -db[i][1]; 200| 122k| } 201| | 202| 10.2k| vec128_mul((vec128 *) BC_tmp, (vec128 *) db, (vec128 *) BC); 203| | 204| 10.2k| vec_cmov(BC, mask); 205| | 206| 10.2k| update_asm(BC, mask & c0, 16); ------------------ | | 1| 10.2k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 10.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 207| | 208| 133k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 133k|#define GFBITS 12 ------------------ | Branch (208:21): [True: 122k, False: 10.2k] ------------------ 209| 122k| BC[i][1] = BC_tmp[i][0] ^ BC_tmp[i][1]; 210| 122k| } 211| | 212| 10.2k| c0 = t >> 32; 213| 10.2k| b = (d & mask) | (b & ~mask); 214| 10.2k| L = ((N + 1 - L) & mask) | (L & ~mask); 215| | 216| 10.2k| } 217| | 218| 80| c0 = gf_inv(c0); ------------------ | | 11| 80|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 80|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 1.04k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.04k|#define GFBITS 12 ------------------ | Branch (220:17): [True: 960, False: 80] ------------------ 221| 960| out[i] = (c0 >> i) & 1; 222| 960| out[i] = -out[i]; 223| 960| } 224| | 225| 80| vec_mul_sp(out, out, &BC[0][0]); 226| 80|} PQCLEAN_MCELIECE348864F_AVX2_controlbitsfrompermutation: 205| 80|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 80| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 80|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 80| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 80|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 80| int16 diff; 209| 80| int i; 210| 80| unsigned char *ptr; 211| | 212| 80| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 80| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 80| while (1) { ------------------ | Branch (215:12): [True: 80, Folded] ------------------ 216| 80| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 80| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 327k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 327k, False: 80] ------------------ 222| 327k| pi_test[i] = (int16)i; 223| 327k| } 224| | 225| 80| ptr = out; 226| 1.04k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 960, False: 80] ------------------ 227| 960| layer(pi_test, ptr, i, (int32)n); 228| 960| ptr += n >> 4; 229| 960| } 230| | 231| 960| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 880, False: 80] ------------------ 232| 880| layer(pi_test, ptr, i, (int32)n); 233| 880| ptr += n >> 4; 234| 880| } 235| | 236| 80| diff = 0; 237| 327k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 327k, False: 80] ------------------ 238| 327k| diff |= pi[i] ^ pi_test[i]; 239| 327k| } 240| | 241| 80| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 80|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 80|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 242| 80| crypto_declassify(&diff, sizeof diff); 243| 80| if (diff == 0) { ------------------ | Branch (243:13): [True: 80, False: 0] ------------------ 244| 80| break; 245| 80| } 246| 80| } 247| 80|} PQCLEAN_MCELIECE348864F_AVX2_crypto_int16_negative_mask: 3| 160|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 160| return crypto_int16_x >> 15; 5| 160|} PQCLEAN_MCELIECE348864F_AVX2_crypto_int16_nonzero_mask: 7| 80|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 80| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 80|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 80|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 80|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 80|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 9| 80|} PQCLEAN_MCELIECE348864F_AVX2_crypto_int32_negative_mask: 3| 21.6M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 21.6M| return crypto_int32_x >> 31; 5| 21.6M|} PQCLEAN_MCELIECE348864F_AVX2_crypto_int32_min: 37| 21.6M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 21.6M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 21.6M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 21.6M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 21.6M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 21.6M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 21.6M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 42| 21.6M| crypto_int32_z &= crypto_int32_xy; 43| 21.6M| return crypto_int32_x ^ crypto_int32_z; 44| 21.6M|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint16_signed_negative_mask: 3| 34.0k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 34.0k| return crypto_uint16_signed_x >> 15; 5| 34.0k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint16_nonzero_mask: 7| 6.52k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 6.52k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 6.52k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 6.52k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 6.52k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 6.52k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 9| 6.52k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint16_zero_mask: 11| 6.52k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 6.52k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 6.52k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 6.52k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 13| 6.52k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint16_smaller_mask: 24| 20.9k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 20.9k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 20.9k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 20.9k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 20.9k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 20.9k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 20.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 29| 20.9k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint32_signed_negative_mask: 3| 35.2k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 35.2k| return crypto_uint32_signed_x >> 31; 5| 35.2k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint32_nonzero_mask: 7| 17.6k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 17.6k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 17.6k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 17.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 17.6k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 17.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 9| 17.6k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint32_unequal_mask: 15| 17.6k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 17.6k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 17.6k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 17.6k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 17.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 18| 17.6k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint32_equal_mask: 20| 17.6k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 17.6k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 17.6k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 17.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 22| 17.6k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint64_signed_negative_mask: 3| 847k|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 847k| return crypto_uint64_signed_x >> 63; 5| 847k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint64_nonzero_mask: 7| 423k|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 423k| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 423k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 423k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 423k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 423k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 9| 423k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint64_zero_mask: 11| 64.0k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 64.0k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 64.0k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 64.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 13| 64.0k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint64_unequal_mask: 15| 359k|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 359k| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 359k| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 359k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 359k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 18| 359k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint64_equal_mask: 20| 359k|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 359k| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 359k|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 359k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 22| 359k|} PQCLEAN_MCELIECE348864F_AVX2_decrypt: 171| 80|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 80| int i; 173| | 174| 80| uint16_t check_synd; 175| 80| uint16_t check_weight; 176| | 177| 80| vec256 inv[ 16 ][ GFBITS ]; 178| 80| vec256 scaled[ 16 ][ GFBITS ]; 179| 80| vec256 eval[16][ GFBITS ]; 180| | 181| 80| vec128 error128[ 32 ]; 182| 80| vec256 error256[ 16 ]; 183| | 184| 80| vec128 s_priv[ GFBITS ]; 185| 80| vec128 s_priv_cmp[ GFBITS ]; 186| 80| uint64_t locator[ GFBITS ]; 187| | 188| 80| vec128 recv128[ 32 ]; 189| 80| vec256 recv256[ 16 ]; 190| 80| vec256 allone; 191| | 192| 80| uint64_t bits_int[23][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 80| preprocess(recv128, s); 197| | 198| 80| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 80|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 80|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 80|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 80|#define SYS_T 64 | | ------------------ ------------------ 199| 80| benes((uint64_t *) recv128, bits_int, 1); ------------------ | | 9| 80|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 80|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 80| reformat_128to256(recv256, recv128); 202| | 203| 80| scaling(scaled, inv, sk, recv256); 204| 80| fft_tr(s_priv, scaled); ------------------ | | 9| 80|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 80|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 205| 80| bm(locator, s_priv); ------------------ | | 10| 80|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 80|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 80| fft(eval, locator); ------------------ | | 10| 80|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 80|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 80| allone = vec256_set1_16b(0xFFFF); 212| | 213| 1.36k| for (i = 0; i < 16; i++) { ------------------ | Branch (213:17): [True: 1.28k, False: 80] ------------------ 214| 1.28k| error256[i] = vec256_or_reduce(eval[i]); 215| 1.28k| error256[i] = vec256_xor(error256[i], allone); 216| 1.28k| } 217| | 218| 80| scaling_inv(scaled, inv, error256); 219| 80| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 80|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 80|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 80| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 80| reformat_256to128(error128, error256); 226| 80| benes((uint64_t *) error128, bits_int, 0); ------------------ | | 9| 80|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 80|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 80| postprocess(e, error128); 229| | 230| 80| check_weight = weight_check(e, error128); 231| | 232| 80| return 1 - (check_synd & check_weight); 233| 80|} PQCLEAN_MCELIECE348864F_AVX2_encrypt: 114| 80|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 115| 80| gen_e(e); 116| | 117| 80| syndrome_asm(s, pk, e); ------------------ | | 1| 80|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 80|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 118| 80|} PQCLEAN_MCELIECE348864F_AVX2_fft: 171| 262|void fft(vec256 out[][ GFBITS ], uint64_t *in) { 172| 262| radix_conversions(in); 173| 262| butterflies(out, in); 174| 262|} PQCLEAN_MCELIECE348864F_AVX2_fft_tr: 354| 160|void fft_tr(vec128 out[GFBITS], vec256 in[][ GFBITS ]) { 355| 160| butterflies_tr(out, in); 356| 160| radix_conversions_tr(out); 357| 160|} PQCLEAN_MCELIECE348864F_AVX2_gf_mul: 22| 450k|gf gf_mul(gf in0, gf in1) { 23| 450k| int i; 24| | 25| 450k| uint32_t tmp; 26| 450k| uint32_t t0; 27| 450k| uint32_t t1; 28| 450k| uint32_t t; 29| | 30| 450k| t0 = in0; 31| 450k| t1 = in1; 32| | 33| 450k| tmp = t0 * (t1 & 1); 34| | 35| 5.40M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 5.40M|#define GFBITS 12 ------------------ | Branch (35:17): [True: 4.95M, False: 450k] ------------------ 36| 4.95M| tmp ^= (t0 * (t1 & (1 << i))); 37| 4.95M| } 38| | 39| 450k| t = tmp & 0x7FC000; 40| 450k| tmp ^= t >> 9; 41| 450k| tmp ^= t >> 12; 42| | 43| 450k| t = tmp & 0x3000; 44| 450k| tmp ^= t >> 9; 45| 450k| tmp ^= t >> 12; 46| | 47| 450k| return tmp & ((1 << GFBITS) - 1); ------------------ | | 6| 450k|#define GFBITS 12 ------------------ 48| 450k|} PQCLEAN_MCELIECE348864F_AVX2_gf_inv: 74| 6.60k|gf gf_inv(gf in) { 75| 6.60k| gf tmp_11; 76| 6.60k| gf tmp_1111; 77| | 78| 6.60k| gf out = in; 79| | 80| 6.60k| out = gf_sq(out); 81| 6.60k| tmp_11 = gf_mul(out, in); // 11 ------------------ | | 14| 6.60k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.60k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 82| | 83| 6.60k| out = gf_sq(tmp_11); 84| 6.60k| out = gf_sq(out); 85| 6.60k| tmp_1111 = gf_mul(out, tmp_11); // 1111 ------------------ | | 14| 6.60k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.60k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 86| | 87| 6.60k| out = gf_sq(tmp_1111); 88| 6.60k| out = gf_sq(out); 89| 6.60k| out = gf_sq(out); 90| 6.60k| out = gf_sq(out); 91| 6.60k| out = gf_mul(out, tmp_1111); // 11111111 ------------------ | | 14| 6.60k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.60k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 92| | 93| 6.60k| out = gf_sq(out); 94| 6.60k| out = gf_sq(out); 95| 6.60k| out = gf_mul(out, tmp_11); // 1111111111 ------------------ | | 14| 6.60k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.60k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 96| | 97| 6.60k| out = gf_sq(out); 98| 6.60k| out = gf_mul(out, in); // 11111111111 ------------------ | | 14| 6.60k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.60k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 99| | 100| 6.60k| return gf_sq(out); // 111111111110 101| 6.60k|} bm.c:PQCLEAN_MCELIECE348864F_AVX2_gf_mul2: 32| 10.2k|static inline uint64_t gf_mul2(gf a, gf b0, gf b1) { 33| 10.2k| int i; 34| | 35| 10.2k| uint64_t tmp = 0; 36| 10.2k| uint64_t t0; 37| 10.2k| uint64_t t1; 38| 10.2k| uint64_t t; 39| 10.2k| uint64_t mask = 0x0000000100000001; 40| | 41| 10.2k| t0 = a; 42| 10.2k| t1 = b1; 43| 10.2k| t1 = (t1 << 32) | b0; 44| | 45| 133k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 133k|#define GFBITS 12 ------------------ | Branch (45:17): [True: 122k, False: 10.2k] ------------------ 46| 122k| tmp ^= t0 * (t1 & mask); 47| 122k| mask += mask; 48| 122k| } 49| | 50| | // 51| | 52| 10.2k| t = tmp & 0x007FC000007FC000; 53| 10.2k| tmp ^= (t >> 9) ^ (t >> 12); 54| | 55| 10.2k| t = tmp & 0x0000300000003000; 56| 10.2k| tmp ^= (t >> 9) ^ (t >> 12); 57| | 58| 10.2k| return tmp & 0x00000FFF00000FFF; 59| 10.2k|} pk_gen.c:PQCLEAN_MCELIECE348864F_AVX2_int32_sort: 21| 80|static void int32_sort(int32_t *x, long long n) { 22| 80| long long top, p, q, r, i; 23| | 24| 80| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 80] ------------------ 25| 0| return; 26| 0| } 27| 80| top = 1; 28| 800| while (top < n - top) { ------------------ | Branch (28:12): [True: 720, False: 80] ------------------ 29| 720| top += top; 30| 720| } 31| | 32| 880| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 800, False: 80] ------------------ 33| 533k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 532k, False: 800] ------------------ 34| 532k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 286k, False: 245k] ------------------ 35| 286k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 286k| do { \ | | 12| 286k| int32_t ab = (b) ^ (a); \ | | 13| 286k| int32_t c = (b) - (a); \ | | 14| 286k| c ^= ab & ((c) ^ (b)); \ | | 15| 286k| c >>= 31; \ | | 16| 286k| c &= ab; \ | | 17| 286k| (a) ^= c; \ | | 18| 286k| (b) ^= c; \ | | 19| 286k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 286k] | | ------------------ ------------------ 36| 286k| } 37| 532k| } 38| 800| i = 0; 39| 4.40k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 3.60k, False: 800] ------------------ 40| 474k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 471k, False: 3.60k] ------------------ 41| 471k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 245k, False: 225k] ------------------ 42| 245k| int32_t a = x[i + p]; 43| 1.31M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 1.06M, False: 245k] ------------------ 44| 1.06M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 1.06M| do { \ | | 12| 1.06M| int32_t ab = (b) ^ (a); \ | | 13| 1.06M| int32_t c = (b) - (a); \ | | 14| 1.06M| c ^= ab & ((c) ^ (b)); \ | | 15| 1.06M| c >>= 31; \ | | 16| 1.06M| c &= ab; \ | | 17| 1.06M| (a) ^= c; \ | | 18| 1.06M| (b) ^= c; \ | | 19| 1.06M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.06M] | | ------------------ ------------------ 45| 1.06M| } 46| 245k| x[i + p] = a; 47| 245k| } 48| 471k| } 49| 3.60k| } 50| 800| } 51| 80|} controlbits.c:PQCLEAN_MCELIECE348864F_AVX2_int32_sort: 21| 1.31M|static void int32_sort(int32_t *x, long long n) { 22| 1.31M| long long top, p, q, r, i; 23| | 24| 1.31M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 1.31M] ------------------ 25| 0| return; 26| 0| } 27| 1.31M| top = 1; 28| 4.57M| while (top < n - top) { ------------------ | Branch (28:12): [True: 3.26M, False: 1.31M] ------------------ 29| 3.26M| top += top; 30| 3.26M| } 31| | 32| 5.88M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 4.57M, False: 1.31M] ------------------ 33| 482M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 478M, False: 4.57M] ------------------ 34| 478M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 270M, False: 208M] ------------------ 35| 270M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 270M| do { \ | | 12| 270M| int32_t ab = (b) ^ (a); \ | | 13| 270M| int32_t c = (b) - (a); \ | | 14| 270M| c ^= ab & ((c) ^ (b)); \ | | 15| 270M| c >>= 31; \ | | 16| 270M| c &= ab; \ | | 17| 270M| (a) ^= c; \ | | 18| 270M| (b) ^= c; \ | | 19| 270M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 270M] | | ------------------ ------------------ 36| 270M| } 37| 478M| } 38| 4.57M| i = 0; 39| 12.3M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 7.75M, False: 4.57M] ------------------ 40| 423M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 416M, False: 7.75M] ------------------ 41| 416M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 208M, False: 208M] ------------------ 42| 208M| int32_t a = x[i + p]; 43| 1.15G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 945M, False: 208M] ------------------ 44| 945M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 945M| do { \ | | 12| 945M| int32_t ab = (b) ^ (a); \ | | 13| 945M| int32_t c = (b) - (a); \ | | 14| 945M| c ^= ab & ((c) ^ (b)); \ | | 15| 945M| c >>= 31; \ | | 16| 945M| c &= ab; \ | | 17| 945M| (a) ^= c; \ | | 18| 945M| (b) ^= c; \ | | 19| 945M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 945M] | | ------------------ ------------------ 45| 945M| } 46| 208M| x[i + p] = a; 47| 208M| } 48| 416M| } 49| 7.75M| } 50| 4.57M| } 51| 1.31M|} encrypt.c:PQCLEAN_MCELIECE348864F_AVX2_int32_sort: 21| 280|static void int32_sort(int32_t *x, long long n) { 22| 280| long long top, p, q, r, i; 23| | 24| 280| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 280] ------------------ 25| 0| return; 26| 0| } 27| 280| top = 1; 28| 1.68k| while (top < n - top) { ------------------ | Branch (28:12): [True: 1.40k, False: 280] ------------------ 29| 1.40k| top += top; 30| 1.40k| } 31| | 32| 1.96k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.68k, False: 280] ------------------ 33| 91.5k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 89.8k, False: 1.68k] ------------------ 34| 89.8k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 53.7k, False: 36.1k] ------------------ 35| 53.7k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 53.7k| do { \ | | 12| 53.7k| int32_t ab = (b) ^ (a); \ | | 13| 53.7k| int32_t c = (b) - (a); \ | | 14| 53.7k| c ^= ab & ((c) ^ (b)); \ | | 15| 53.7k| c >>= 31; \ | | 16| 53.7k| c &= ab; \ | | 17| 53.7k| (a) ^= c; \ | | 18| 53.7k| (b) ^= c; \ | | 19| 53.7k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 53.7k] | | ------------------ ------------------ 36| 53.7k| } 37| 89.8k| } 38| 1.68k| i = 0; 39| 5.88k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 4.20k, False: 1.68k] ------------------ 40| 76.4k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 72.2k, False: 4.20k] ------------------ 41| 72.2k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 36.1k, False: 36.1k] ------------------ 42| 36.1k| int32_t a = x[i + p]; 43| 134k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 98.2k, False: 36.1k] ------------------ 44| 98.2k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 98.2k| do { \ | | 12| 98.2k| int32_t ab = (b) ^ (a); \ | | 13| 98.2k| int32_t c = (b) - (a); \ | | 14| 98.2k| c ^= ab & ((c) ^ (b)); \ | | 15| 98.2k| c >>= 31; \ | | 16| 98.2k| c &= ab; \ | | 17| 98.2k| (a) ^= c; \ | | 18| 98.2k| (b) ^= c; \ | | 19| 98.2k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 98.2k] | | ------------------ ------------------ 45| 98.2k| } 46| 36.1k| x[i + p] = a; 47| 36.1k| } 48| 72.2k| } 49| 4.20k| } 50| 1.68k| } 51| 280|} PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_enc: 22| 80|) { 23| 80| unsigned char e[ SYS_N / 8 ]; 24| 80| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 80| encrypt(c, pk, e); ------------------ | | 9| 80|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 80|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 80| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 80|#define SYS_N 3488 ------------------ 31| 80| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 80|#define SYS_N 3488 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 80|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 80|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 80|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 80|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 80| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 80| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 80|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 80| return 0; 36| 80|} PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_dec: 42| 80|) { 43| 80| int i; 44| | 45| 80| unsigned char ret_decrypt = 0; 46| | 47| 80| uint16_t m; 48| | 49| 80| unsigned char e[ SYS_N / 8 ]; 50| 80| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 80| unsigned char *x = preimage; 52| 80| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 80|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 80|#define SYS_T 64 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 80|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 80|#define GFBITS 12 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 80|#define GFBITS 12 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 80| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 80|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 80|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 80| m = ret_decrypt; 59| 80| m -= 1; 60| 80| m >>= 8; 61| | 62| 80| *x++ = m & 1; 63| 34.9k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 34.9k|#define SYS_N 3488 ------------------ | Branch (63:17): [True: 34.8k, False: 80] ------------------ 64| 34.8k| *x++ = (~m & s[i]) | (m & e[i]); 65| 34.8k| } 66| | 67| 7.76k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 7.76k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 7.76k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 7.76k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 7.76k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 7.68k, False: 80] ------------------ 68| 7.68k| *x++ = c[i]; 69| 7.68k| } 70| | 71| 80| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 80| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 80|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 80| return 0; 74| 80|} PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_keypair: 80| 80|) { 81| 80| int i; 82| 80| unsigned char seed[ 33 ] = {64}; 83| 80| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 80| unsigned char *rp, *skp; 85| 80| uint64_t pivots; 86| | 87| 80| gf f[ SYS_T ]; // element in GF(2^mt) 88| 80| gf irr[ SYS_T ]; // Goppa polynomial 89| 80| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 90| 80| int16_t pi[ 1 << GFBITS ]; // random permutation 91| | 92| 80| randombytes(seed + 1, 32); ------------------ | | 8| 80|#define randombytes OQS_randombytes ------------------ 93| | 94| 102| while (1) { ------------------ | Branch (94:12): [True: 102, Folded] ------------------ 95| 102| rp = &r[ sizeof(r) - 32 ]; 96| 102| skp = sk; 97| | 98| | // expanding and updating the seed 99| | 100| 102| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 102| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 102|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 101| 102| memcpy(skp, seed + 1, 32); 102| 102| skp += 32 + 8; 103| 102| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 104| | 105| | // generating irreducible polynomial 106| | 107| 102| rp -= sizeof(f); 108| | 109| 6.63k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 6.63k|#define SYS_T 64 ------------------ | Branch (109:21): [True: 6.52k, False: 102] ------------------ 110| 6.52k| f[i] = load_gf(rp + i * 2); 111| 6.52k| } 112| | 113| 102| if (genpoly_gen(irr, f)) { ------------------ | | 9| 102|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ | Branch (113:13): [True: 0, False: 102] ------------------ 114| 0| continue; 115| 0| } 116| | 117| 6.63k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 6.63k|#define SYS_T 64 ------------------ | Branch (117:21): [True: 6.52k, False: 102] ------------------ 118| 6.52k| store_gf(skp + i * 2, irr[i]); 119| 6.52k| } 120| | 121| 102| skp += IRR_BYTES; ------------------ | | 11| 102|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 102|#define SYS_T 64 | | ------------------ ------------------ 122| | 123| | // generating permutation 124| | 125| 102| rp -= sizeof(perm); 126| | 127| 417k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 417k|#define GFBITS 12 ------------------ | Branch (127:21): [True: 417k, False: 102] ------------------ 128| 417k| perm[i] = load4(rp + i * 4); 129| 417k| } 130| | 131| 102| if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 9| 102|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 11| 102|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 102|#define SYS_T 64 | | ------------------ ------------------ | Branch (131:13): [True: 22, False: 80] ------------------ 132| 22| continue; 133| 22| } 134| | 135| 80| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 80|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 80|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 80|#define GFBITS 12 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 80|#define GFBITS 12 ------------------ 136| 80| skp += COND_BYTES; ------------------ | | 10| 80|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 80|#define GFBITS 12 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 80|#define GFBITS 12 | | ------------------ ------------------ 137| | 138| | // storing the random string s 139| | 140| 80| rp -= SYS_N / 8; ------------------ | | 7| 80|#define SYS_N 3488 ------------------ 141| 80| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 80|#define SYS_N 3488 ------------------ 142| | 143| | // storing positions of the 32 pivots 144| | 145| 80| store8(sk + 32, pivots); 146| | 147| 80| break; 148| 102| } 149| | 150| 80| return 0; 151| 80|} PQCLEAN_MCELIECE348864F_AVX2_pk_gen: 316| 102|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi, uint64_t *pivots) { 317| 102| int i, j, k, b; 318| 102| int row, c; 319| | 320| 102| union { 321| 102| uint64_t w[ PK_NROWS ][ (nBlocks_I + 1) * 4 ]; 322| 102| vec256 v[ PK_NROWS ][ nBlocks_I + 1 ]; 323| 102| } mat; 324| | 325| 102| union { 326| 102| uint64_t w[ PK_NROWS ][ par_width * 4 ]; 327| 102| vec256 v[ PK_NROWS ][ par_width ]; 328| 102| } par; 329| | 330| 102| uint16_t m; 331| 102| vec256 mm; 332| | 333| 102| uint64_t sk_int[ GFBITS ]; 334| | 335| 102| vec256 consts[ 16 ][ GFBITS ]; 336| 102| vec256 eval[ 16 ][ GFBITS ]; 337| 102| vec256 prod[ 16 ][ GFBITS ]; 338| 102| vec256 tmp[ GFBITS ]; 339| | 340| 102| uint64_t list[1 << GFBITS]; 341| 102| uint64_t one = 1; 342| 102| uint64_t t; 343| | 344| 102| uint16_t ind[ PK_NROWS ]; 345| 102| uint16_t ind_inv[ PK_NROWS ]; 346| | 347| | // compute the inverses 348| | 349| 102| irr_load(sk_int, irr); 350| | 351| 102| fft(eval, sk_int); ------------------ | | 10| 102|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 352| | 353| 102| vec256_copy(prod[0], eval[0]); 354| | 355| 1.63k| for (i = 1; i < 16; i++) { ------------------ | Branch (355:17): [True: 1.53k, False: 102] ------------------ 356| 1.53k| vec256_mul(prod[i], prod[i - 1], eval[i]); 357| 1.53k| } 358| | 359| 102| vec256_inv(tmp, prod[15]); ------------------ | | 11| 102|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 360| | 361| 1.63k| for (i = 14; i >= 0; i--) { ------------------ | Branch (361:18): [True: 1.53k, False: 102] ------------------ 362| 1.53k| vec256_mul(prod[i + 1], prod[i], tmp); 363| 1.53k| vec256_mul(tmp, tmp, eval[i + 1]); 364| 1.53k| } 365| | 366| 102| vec256_copy(prod[0], tmp); 367| | 368| | // fill matrix 369| | 370| 102| de_bitslicing(list, prod); 371| | 372| 417k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 417k|#define GFBITS 12 ------------------ | Branch (372:17): [True: 417k, False: 102] ------------------ 373| 417k| list[i] <<= GFBITS; ------------------ | | 6| 417k|#define GFBITS 12 ------------------ 374| 417k| list[i] |= i; 375| 417k| list[i] |= ((uint64_t) perm[i]) << 31; 376| 417k| } 377| | 378| 102| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 102|#define GFBITS 12 ------------------ 379| | 380| 360k| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 360k|#define GFBITS 12 ------------------ | Branch (380:17): [True: 359k, False: 80] ------------------ 381| 359k| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (381:13): [True: 22, False: 359k] ------------------ 382| 22| return -1; 383| 22| } 384| 359k| } 385| | 386| 80| to_bitslicing_2x(consts, prod, list); 387| | 388| 327k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 327k|#define GFBITS 12 ------------------ | Branch (388:17): [True: 327k, False: 80] ------------------ 389| 327k| pi[i] = list[i] & GFMASK; ------------------ | | 19| 327k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 327k|#define GFBITS 12 | | ------------------ ------------------ 390| 327k| } 391| | 392| 400| for (j = 0; j < nBlocks_I + 1; j++) { ------------------ | | 33| 400|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 400|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 400|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 400|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (392:17): [True: 320, False: 80] ------------------ 393| 4.16k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 4.16k|#define GFBITS 12 ------------------ | Branch (393:21): [True: 3.84k, False: 320] ------------------ 394| 3.84k| mat.v[ k ][ j ] = prod[ j ][ k ]; 395| 3.84k| } 396| 320| } 397| | 398| 5.12k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 5.12k|#define SYS_T 64 ------------------ | Branch (398:17): [True: 5.04k, False: 80] ------------------ 399| 25.2k| for (j = 0; j < nBlocks_I + 1; j++) { ------------------ | | 33| 25.2k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 25.2k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 25.2k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 25.2k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (399:21): [True: 20.1k, False: 5.04k] ------------------ 400| 20.1k| vec256_mul(prod[j], prod[j], consts[j]); 401| | 402| 262k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 262k|#define GFBITS 12 ------------------ | Branch (402:25): [True: 241k, False: 20.1k] ------------------ 403| 241k| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 241k|#define GFBITS 12 ------------------ 404| 241k| } 405| 20.1k| } 406| 5.04k| } 407| | 408| | // Gaussian elimination + column swaps to obtain L, U, and P such that LP M = U 409| | // L and U are stored in the space of M 410| | // P is stored in ind 411| | 412| 61.5k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 61.5k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 61.5k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 61.5k|#define GFBITS 12 | | ------------------ ------------------ | Branch (412:17): [True: 61.4k, False: 80] ------------------ 413| 61.4k| ind_inv[i] = ind[ i ] = i; 414| 61.4k| } 415| | 416| 61.5k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 61.5k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 61.5k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 61.5k|#define GFBITS 12 | | ------------------ ------------------ | Branch (416:19): [True: 61.4k, False: 80] ------------------ 417| 61.4k| i = row >> 6; 418| 61.4k| j = row & 63; 419| | 420| 61.4k| if (row == PK_NROWS - 32) { ------------------ | | 13| 61.4k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 61.4k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 61.4k|#define GFBITS 12 | | ------------------ ------------------ | Branch (420:13): [True: 80, False: 61.3k] ------------------ 421| 80| if (mov_columns(mat.w, pi, pivots)) { ------------------ | Branch (421:17): [True: 0, False: 80] ------------------ 422| 0| return -1; 423| 0| } 424| 80| } 425| | 426| 23.6M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 23.6M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 23.6M|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 23.6M|#define GFBITS 12 | | ------------------ ------------------ | Branch (426:27): [True: 23.5M, False: 61.4k] ------------------ 427| 23.5M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 428| 23.5M| uint16_cswap(&ind[row], &ind[k], m); 429| | 430| 23.5M| mm = vec256_set1_16b(m); 431| 117M| for (c = 0; c < nBlocks_I + 1; c++) { ------------------ | | 33| 117M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 117M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 117M|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 117M|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (431:25): [True: 94.2M, False: 23.5M] ------------------ 432| 94.2M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 433| 94.2M| } 434| 23.5M| } 435| | 436| 61.4k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (436:14): [True: 0, False: 61.4k] ------------------ 437| 0| return -1; 438| 0| } 439| | 440| 23.6M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 23.6M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 23.6M|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 23.6M|#define GFBITS 12 | | ------------------ ------------------ | Branch (440:27): [True: 23.5M, False: 61.4k] ------------------ 441| 23.5M| t = mat.w[ k ][ i ] & (one << j); 442| 23.5M| mm = extract_mask256(mat.w[k], row); 443| | 444| 117M| for (c = 0; c < nBlocks_I + 1; c++) { ------------------ | | 33| 117M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 117M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 117M|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 117M|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (444:25): [True: 94.2M, False: 23.5M] ------------------ 445| 94.2M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 446| 94.2M| } 447| | 448| 23.5M| mat.w[ k ][ i ] |= t; 449| 23.5M| } 450| 61.4k| } 451| | 452| | // apply M^-1 to the remaining columns 453| | 454| 80| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 80|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 80|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 80|#define GFBITS 12 | | ------------------ ------------------ 455| | 456| 1.04k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 1.04k|#define GFBITS 12 ------------------ | Branch (456:17): [True: 960, False: 80] ------------------ 457| 10.5k| for (b = 1; b < par_width; b++) { ------------------ | | 34| 10.5k|#define par_width 11 ------------------ | Branch (457:21): [True: 9.60k, False: 960] ------------------ 458| 9.60k| par.v[ k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 33| 9.60k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 9.60k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 9.60k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 9.60k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 459| 9.60k| } 460| 960| } 461| | 462| 5.12k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 5.12k|#define SYS_T 64 ------------------ | Branch (462:17): [True: 5.04k, False: 80] ------------------ 463| 55.4k| for (b = 1; b < par_width; b++) { ------------------ | | 34| 55.4k|#define par_width 11 ------------------ | Branch (463:21): [True: 50.4k, False: 5.04k] ------------------ 464| 50.4k| vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 33| 50.4k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 50.4k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 50.4k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 50.4k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 33| 50.4k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 50.4k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 50.4k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 50.4k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 33| 50.4k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 50.4k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 50.4k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 50.4k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 465| 50.4k| } 466| | 467| 65.5k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 65.5k|#define GFBITS 12 ------------------ | Branch (467:21): [True: 60.4k, False: 5.04k] ------------------ 468| 665k| for (b = 1; b < par_width; b++) { ------------------ | | 34| 665k|#define par_width 11 ------------------ | Branch (468:25): [True: 604k, False: 60.4k] ------------------ 469| 604k| par.v[ i * GFBITS + k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 6| 604k|#define GFBITS 12 ------------------ par.v[ i * GFBITS + k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 33| 604k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 604k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 604k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 604k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 470| 604k| } 471| 60.4k| } 472| 5.04k| } 473| | 474| | // apply P 475| | 476| 61.5k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 61.5k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 61.5k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 61.5k|#define GFBITS 12 | | ------------------ ------------------ | Branch (476:17): [True: 61.4k, False: 80] ------------------ 477| 61.4k| ind[i] = ind_inv[i]; 478| 61.4k| } 479| | 480| 80| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 80|#define GFBITS 12 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 80|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 80|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 80|#define GFBITS 12 | | ------------------ ------------------ 481| | 482| | // apply L 483| | 484| 61.5k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 80|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 80|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 80|#define GFBITS 12 | | ------------------ ------------------ | Branch (484:30): [True: 61.4k, False: 80] ------------------ 485| 23.6M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (485:27): [True: 23.5M, False: 61.4k] ------------------ 486| 23.5M| mm = extract_mask256(mat.w[row], i); 487| | 488| 259M| for (k = 1; k < par_width; k++) { ------------------ | | 34| 259M|#define par_width 11 ------------------ | Branch (488:25): [True: 235M, False: 23.5M] ------------------ 489| 235M| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 490| 235M| } 491| 23.5M| } 492| 61.4k| } 493| | 494| | // apply U^-1 495| | 496| 61.5k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 61.5k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 61.5k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 61.5k|#define GFBITS 12 | | ------------------ ------------------ | Branch (496:17): [True: 61.4k, False: 80] ------------------ 497| 61.4k| par.v[i][0] = mat.v[i][nBlocks_I]; ------------------ | | 33| 61.4k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 61.4k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 61.4k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 61.4k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 498| 61.4k| } 499| | 500| 61.5k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 80|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 80|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 80|#define GFBITS 12 | | ------------------ ------------------ | Branch (500:30): [True: 61.4k, False: 80] ------------------ 501| 23.6M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 61.4k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 61.4k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 61.4k|#define GFBITS 12 | | ------------------ ------------------ | Branch (501:32): [True: 23.5M, False: 61.4k] ------------------ 502| 23.5M| mm = extract_mask256(mat.w[row], i); 503| | 504| 282M| for (k = 0; k < par_width; k++) { ------------------ | | 34| 282M|#define par_width 11 ------------------ | Branch (504:25): [True: 259M, False: 23.5M] ------------------ 505| 259M| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 506| 259M| } 507| 23.5M| } 508| 61.4k| } 509| | 510| 61.5k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 61.5k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 61.5k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 61.5k|#define GFBITS 12 | | ------------------ ------------------ | Branch (510:19): [True: 61.4k, False: 80] ------------------ 511| 2.64M| for (k = 0; k < 42; k++) { ------------------ | Branch (511:21): [True: 2.58M, False: 61.4k] ------------------ 512| 2.58M| store8(pk + PK_ROW_BYTES * row + k * 8, par.w[row][k]); ------------------ | | 15| 2.58M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 2.58M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 2.58M|#define SYS_N 3488 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 2.58M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 2.58M|#define SYS_T 64 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 2.58M|#define GFBITS 12 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 513| 2.58M| } 514| | 515| 61.4k| store_i(pk + PK_ROW_BYTES * row + k * 8, par.w[row][k], 4); ------------------ | | 15| 61.4k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 61.4k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 61.4k|#define SYS_N 3488 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 61.4k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 61.4k|#define SYS_T 64 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 61.4k|#define GFBITS 12 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 516| 61.4k| } 517| | 518| | // 519| | 520| 80| return 0; 521| 80|} pk_gen.c:int16_cswap: 79| 626k|static inline void int16_cswap(int16_t *x, int16_t *y, uint16_t m) { 80| 626k| int16_t d; 81| | 82| 626k| d = *x ^ *y; 83| 626k| d &= m; 84| 626k| *x ^= d; 85| 626k| *y ^= d; 86| 626k|} PQCLEAN_MCELIECE348864F_AVX2_genpoly_gen: 55| 102|int genpoly_gen(gf *out, gf *f) { 56| 102| int i, j, k; 57| | 58| 102| gf t, inv; 59| | 60| 102| vec v[ GFBITS ], buf[ GFBITS ][ 64 ], mat[ 64 ][ GFBITS ], mask; 61| | 62| | // fill matrix 63| | 64| 102| buf[0][0] = 1; 65| 1.22k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.22k|#define GFBITS 12 ------------------ | Branch (65:17): [True: 1.12k, False: 102] ------------------ 66| 1.12k| buf[i][0] = 0; 67| 1.12k| } 68| | 69| 1.32k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 1.32k|#define GFBITS 12 ------------------ | Branch (69:17): [True: 1.22k, False: 102] ------------------ 70| 79.5k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 1.22k|#define SYS_T 64 ------------------ | Branch (70:29): [True: 78.3k, False: 1.22k] ------------------ 71| 78.3k| v[j] <<= 1; 72| 78.3k| v[j] |= (f[i] >> j) & 1; 73| 78.3k| } 74| 1.22k| } 75| | 76| 1.32k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.32k|#define GFBITS 12 ------------------ | Branch (76:17): [True: 1.22k, False: 102] ------------------ 77| 1.22k| buf[i][1] = v[i]; 78| 1.22k| } 79| | 80| 6.52k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 6.52k|#define SYS_T 64 ------------------ | Branch (80:17): [True: 6.42k, False: 102] ------------------ 81| 6.42k| vec_GF_mul(v, v, f); ------------------ | | 6| 6.42k|#define vec_GF_mul CRYPTO_NAMESPACE(vec_GF_mul) | | ------------------ | | | | 4| 6.42k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 82| | 83| 6.42k| if (k < SYS_T) { ------------------ | | 8| 6.42k|#define SYS_T 64 ------------------ | Branch (83:13): [True: 6.32k, False: 102] ------------------ 84| 82.2k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 82.2k|#define GFBITS 12 ------------------ | Branch (84:25): [True: 75.8k, False: 6.32k] ------------------ 85| 75.8k| buf[i][k] = v[i]; 86| 75.8k| } 87| 6.32k| } else { 88| 6.63k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 6.63k|#define SYS_T 64 ------------------ | Branch (88:25): [True: 6.52k, False: 102] ------------------ 89| 6.52k| out[i] = extract_gf(v, i); 90| 6.52k| } 91| 102| } 92| 6.42k| } 93| | 94| 1.32k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.32k|#define GFBITS 12 ------------------ | Branch (94:17): [True: 1.22k, False: 102] ------------------ 95| 1.22k| transpose_64x64(buf[i]); 96| 1.22k| } 97| | 98| 6.63k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 6.63k|#define SYS_T 64 ------------------ | Branch (98:17): [True: 6.52k, False: 102] ------------------ 99| 84.8k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 84.8k|#define GFBITS 12 ------------------ | Branch (99:21): [True: 78.3k, False: 6.52k] ------------------ 100| 78.3k| mat[j][i] = buf[i][j]; 101| 78.3k| } 102| 6.52k| } 103| | 104| | // gaussian 105| | 106| 6.63k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 6.63k|#define SYS_T 64 ------------------ | Branch (106:17): [True: 6.52k, False: 102] ------------------ 107| 212k| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 212k|#define SYS_T 64 ------------------ | Branch (107:25): [True: 205k, False: 6.52k] ------------------ 108| 205k| mask = extract_bit(mat[i], i); 109| 205k| mask -= 1; 110| | 111| 2.67M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 2.67M|#define GFBITS 12 ------------------ | Branch (111:25): [True: 2.46M, False: 205k] ------------------ 112| 2.46M| mat[i][k] ^= mat[j][k] & mask; 113| 2.46M| } 114| | 115| 205k| out[i] ^= out[j] & mask; 116| 205k| } 117| | 118| | // 119| | 120| 6.52k| t = extract_gf(mat[i], i); 121| | 122| 6.52k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (122:13): [True: 0, False: 6.52k] ------------------ 123| 0| return -1; // return if not systematic 124| 0| } 125| | 126| | // 127| | 128| 6.52k| inv = gf_inv(t); ------------------ | | 11| 6.52k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 6.52k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 129| 6.52k| vec_mul_gf(mat[i], mat[i], inv); 130| | 131| 6.52k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 6.52k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.52k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 132| | 133| 424k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 424k|#define SYS_T 64 ------------------ | Branch (133:21): [True: 417k, False: 6.52k] ------------------ 134| 417k| if (j != i) { ------------------ | Branch (134:17): [True: 411k, False: 6.52k] ------------------ 135| 411k| t = extract_gf(mat[j], i); 136| | 137| 411k| vec_mul_gf(v, mat[i], t); 138| 411k| vec_add(mat[j], mat[j], v); 139| | 140| 411k| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 411k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 411k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 141| 411k| } 142| 417k| } 143| 6.52k| } 144| | 145| 102| return 0; 146| 102|} PQCLEAN_MCELIECE348864F_AVX2_vec_GF_mul: 6| 6.42k|void vec_GF_mul(vec out[ GFBITS ], vec v[ GFBITS ], gf a[ SYS_T ]) { 7| 6.42k| int i, j; 8| 6.42k| vec buf[GFBITS][2], prod[GFBITS], tmp[GFBITS]; 9| | 10| 6.42k| const vec allone = -1; 11| | 12| | // polynomial multiplication 13| | 14| 83.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 83.5k|#define GFBITS 12 ------------------ | Branch (14:17): [True: 77.1k, False: 6.42k] ------------------ 15| 77.1k| buf[i][0] = 0; 16| 77.1k| buf[i][1] = 0; 17| 77.1k| } 18| | 19| 417k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 6.42k|#define SYS_T 64 ------------------ | Branch (19:25): [True: 411k, False: 6.42k] ------------------ 20| 5.34M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 5.34M|#define GFBITS 12 ------------------ | Branch (20:21): [True: 4.93M, False: 411k] ------------------ 21| 4.93M| buf[j][1] <<= 1; 22| 4.93M| buf[j][1] |= buf[j][0] >> 63; 23| 4.93M| buf[j][0] <<= 1; 24| 4.93M| } 25| | 26| 411k| vec_mul_gf(prod, v, a[i]); 27| | 28| 5.34M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 5.34M|#define GFBITS 12 ------------------ | Branch (28:21): [True: 4.93M, False: 411k] ------------------ 29| 4.93M| buf[j][0] ^= prod[j]; 30| 4.93M| } 31| 411k| } 32| | 33| | // reduction modulo y^64 + y^3 + y + z 34| | 35| 83.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 83.5k|#define GFBITS 12 ------------------ | Branch (35:17): [True: 77.1k, False: 6.42k] ------------------ 36| 77.1k| prod[i] = buf[i][1] & (allone << 3); 37| 77.1k| } 38| | 39| 6.42k| vec_mul_gf(tmp, prod, 2); 40| | 41| 83.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 83.5k|#define GFBITS 12 ------------------ | Branch (41:17): [True: 77.1k, False: 6.42k] ------------------ 42| 77.1k| buf[i][1] ^= prod[i] >> (SYS_T - 3); ------------------ | | 8| 77.1k|#define SYS_T 64 ------------------ 43| 77.1k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 3)); ------------------ | | 8| 77.1k|#define SYS_T 64 ------------------ 44| 77.1k| buf[i][1] ^= prod[i] >> (SYS_T - 1); ------------------ | | 8| 77.1k|#define SYS_T 64 ------------------ 45| 77.1k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 1)); ------------------ | | 8| 77.1k|#define SYS_T 64 ------------------ 46| 77.1k| buf[i][0] ^= tmp[i]; 47| 77.1k| } 48| | 49| | // 50| | 51| 83.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 83.5k|#define GFBITS 12 ------------------ | Branch (51:17): [True: 77.1k, False: 6.42k] ------------------ 52| 77.1k| prod[i] = buf[i][1] & 0x7; 53| 77.1k| } 54| | 55| 6.42k| vec_mul_gf(tmp, prod, 2); 56| | 57| 83.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 83.5k|#define GFBITS 12 ------------------ | Branch (57:17): [True: 77.1k, False: 6.42k] ------------------ 58| 77.1k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 3)); ------------------ | | 8| 77.1k|#define SYS_T 64 ------------------ 59| 77.1k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 1)); ------------------ | | 8| 77.1k|#define SYS_T 64 ------------------ 60| 77.1k| buf[i][0] ^= tmp[i]; 61| 77.1k| } 62| | 63| | // 64| | 65| 83.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 83.5k|#define GFBITS 12 ------------------ | Branch (65:17): [True: 77.1k, False: 6.42k] ------------------ 66| 77.1k| out[i] = buf[i][0]; 67| 77.1k| } 68| 6.42k|} PQCLEAN_MCELIECE348864F_AVX2_vec256_sq: 9| 3.28k|void vec256_sq(vec256 *out, vec256 *in) { 10| 3.28k| int i; 11| 3.28k| vec256 result[GFBITS]; 12| | 13| 3.28k| result[0] = in[0] ^ in[6]; 14| 3.28k| result[1] = in[11]; 15| 3.28k| result[2] = in[1] ^ in[7]; 16| 3.28k| result[3] = in[6]; 17| 3.28k| result[4] = in[2] ^ in[11] ^ in[8]; 18| 3.28k| result[5] = in[7]; 19| 3.28k| result[6] = in[3] ^ in[9]; 20| 3.28k| result[7] = in[8]; 21| 3.28k| result[8] = in[4] ^ in[10]; 22| 3.28k| result[9] = in[9]; 23| 3.28k| result[10] = in[5] ^ in[11]; 24| 3.28k| result[11] = in[10]; 25| | 26| 42.6k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 42.6k|#define GFBITS 12 ------------------ | Branch (26:17): [True: 39.3k, False: 3.28k] ------------------ 27| 39.3k| out[i] = result[i]; 28| 39.3k| } 29| 3.28k|} PQCLEAN_MCELIECE348864F_AVX2_vec256_inv: 32| 182|void vec256_inv(vec256 *out, vec256 *in) { 33| 182| vec256 tmp_11[ GFBITS ]; 34| 182| vec256 tmp_1111[ GFBITS ]; 35| | 36| 182| vec256_copy(out, in); 37| | 38| 182| vec256_sq(out, out); ------------------ | | 14| 182|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 182|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 39| 182| vec256_mul(tmp_11, out, in); // ^11 40| | 41| 182| vec256_sq(out, tmp_11); ------------------ | | 14| 182|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 182|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 42| 182| vec256_sq(out, out); ------------------ | | 14| 182|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 182|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 43| 182| vec256_mul(tmp_1111, out, tmp_11); // ^1111 44| | 45| 182| vec256_sq(out, tmp_1111); ------------------ | | 14| 182|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 182|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 46| 182| vec256_sq(out, out); ------------------ | | 14| 182|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 182|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 47| 182| vec256_sq(out, out); ------------------ | | 14| 182|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 182|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 48| 182| vec256_sq(out, out); ------------------ | | 14| 182|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 182|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 49| 182| vec256_mul(out, out, tmp_1111); // ^11111111 50| | 51| 182| vec256_sq(out, out); ------------------ | | 14| 182|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 182|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 52| 182| vec256_sq(out, out); ------------------ | | 14| 182|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 182|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 53| 182| vec256_mul(out, out, tmp_11); // ^1111111111 54| 182| vec256_sq(out, out); ------------------ | | 14| 182|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 182|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 55| 182| vec256_mul(out, out, in); // ^11111111111 56| | 57| 182| vec256_sq(out, out); // ^111111111110 ------------------ | | 14| 182|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 182|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 58| 182|} pk_gen.c:mov_columns: 58| 412|static int mov_columns(uint8_t mat[][ SYS_N / 8 ], int16_t *pi, uint64_t *pivots) { 59| 412| int i, j, k, s, block_idx, row; 60| 412| uint64_t buf[64], ctz_list[32], t, d, mask, one = 1; 61| | 62| 412| row = PK_NROWS - 32; ------------------ | | 13| 412|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 412|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 412|#define GFBITS 12 | | ------------------ ------------------ 63| 412| block_idx = row / 8; 64| | 65| | // extract the 32x64 matrix 66| | 67| 13.5k| for (i = 0; i < 32; i++) { ------------------ | Branch (67:17): [True: 13.1k, False: 412] ------------------ 68| 13.1k| buf[i] = load8( &mat[ row + i ][ block_idx ] ); ------------------ | | 11| 13.1k|#define load8 CRYPTO_NAMESPACE(load8) | | ------------------ | | | | 4| 13.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_CLEAN_ ## fun | | ------------------ ------------------ 69| 13.1k| } 70| | 71| | // compute the column indices of pivots by Gaussian elimination. 72| | // the indices are stored in ctz_list 73| | 74| 412| *pivots = 0; 75| | 76| 13.5k| for (i = 0; i < 32; i++) { ------------------ | Branch (76:17): [True: 13.1k, False: 412] ------------------ 77| 13.1k| t = buf[i]; 78| 217k| for (j = i + 1; j < 32; j++) { ------------------ | Branch (78:25): [True: 204k, False: 13.1k] ------------------ 79| 204k| t |= buf[j]; 80| 204k| } 81| | 82| 13.1k| if (uint64_is_zero_declassify(t)) { ------------------ | Branch (82:13): [True: 0, False: 13.1k] ------------------ 83| 0| return -1; // return if buf is not full rank 84| 0| } 85| | 86| 13.1k| ctz_list[i] = s = ctz(t); 87| 13.1k| *pivots |= one << ctz_list[i]; 88| | 89| 217k| for (j = i + 1; j < 32; j++) { ------------------ | Branch (89:25): [True: 204k, False: 13.1k] ------------------ 90| 204k| mask = (buf[i] >> s) & 1; 91| 204k| mask -= 1; 92| 204k| buf[i] ^= buf[j] & mask; 93| 204k| } 94| 217k| for (j = i + 1; j < 32; j++) { ------------------ | Branch (94:25): [True: 204k, False: 13.1k] ------------------ 95| 204k| mask = (buf[j] >> s) & 1; 96| 204k| mask = -mask; 97| 204k| buf[j] ^= buf[i] & mask; 98| 204k| } 99| 13.1k| } 100| | 101| | // updating permutation 102| | 103| 13.5k| for (j = 0; j < 32; j++) { ------------------ | Branch (103:19): [True: 13.1k, False: 412] ------------------ 104| 639k| for (k = j + 1; k < 64; k++) { ------------------ | Branch (104:25): [True: 626k, False: 13.1k] ------------------ 105| 626k| d = pi[ row + j ] ^ pi[ row + k ]; 106| 626k| d &= same_mask((uint16_t)k, (uint16_t)ctz_list[j]); 107| 626k| pi[ row + j ] ^= d; 108| 626k| pi[ row + k ] ^= d; 109| 626k| } 110| 13.1k| } 111| | 112| | // moving columns of mat according to the column indices of pivots 113| | 114| 568k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 568k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 568k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 568k|#define GFBITS 12 | | ------------------ ------------------ | Branch (114:17): [True: 567k, False: 412] ------------------ 115| 567k| t = load8( &mat[ i ][ block_idx ] ); ------------------ | | 11| 567k|#define load8 CRYPTO_NAMESPACE(load8) | | ------------------ | | | | 4| 567k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_CLEAN_ ## fun | | ------------------ ------------------ 116| | 117| 18.7M| for (j = 0; j < 32; j++) { ------------------ | Branch (117:21): [True: 18.1M, False: 567k] ------------------ 118| 18.1M| d = t >> j; 119| 18.1M| d ^= t >> ctz_list[j]; 120| 18.1M| d &= 1; 121| | 122| 18.1M| t ^= d << ctz_list[j]; 123| 18.1M| t ^= d << j; 124| 18.1M| } 125| | 126| 567k| store8( &mat[ i ][ block_idx ], t ); ------------------ | | 13| 567k|#define store8 CRYPTO_NAMESPACE(store8) | | ------------------ | | | | 4| 567k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_CLEAN_ ## fun | | ------------------ ------------------ 127| 567k| } 128| | 129| 412| return 0; 130| 412|} pk_gen.c:ctz: 35| 13.1k|static inline int ctz(uint64_t in) { 36| 13.1k| int i, b, m = 0, r = 0; 37| | 38| 856k| for (i = 0; i < 64; i++) { ------------------ | Branch (38:17): [True: 843k, False: 13.1k] ------------------ 39| 843k| b = (in >> i) & 1; 40| 843k| m |= b; 41| 843k| r += (m ^ 1) & (b ^ 1); 42| 843k| } 43| | 44| 13.1k| return r; 45| 13.1k|} pk_gen.c:same_mask: 47| 626k|static inline uint64_t same_mask(uint16_t x, uint16_t y) { 48| 626k| uint64_t mask; 49| | 50| 626k| mask = x ^ y; 51| 626k| mask -= 1; 52| 626k| mask >>= 63; 53| 626k| mask = -mask; 54| | 55| 626k| return mask; 56| 626k|} PQCLEAN_MCELIECE460896_AVX2_load_bits: 188| 110|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 110| int i, j; 190| 110| const unsigned char *ptr = bits; 191| | 192| 110| vec128 buf[64]; 193| | 194| 440| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 330, False: 110] ------------------ 195| 21.4k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 21.1k, False: 330] ------------------ 196| 21.1k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 21.1k| ptr += 8; 198| 21.1k| } 199| | 200| 330| transpose_64x128_sp( buf ); 201| | 202| 10.8k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 10.5k, False: 330] ------------------ 203| 10.5k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 10.5k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 10.5k| } 206| | 207| 330| ptr += 512; 208| 330| } 209| | 210| 1.54k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.43k, False: 110] ------------------ 211| 47.1k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 45.7k, False: 1.43k] ------------------ 212| 45.7k| bits_int[i][j] = load16(ptr); 213| 45.7k| ptr += 16; 214| 45.7k| } 215| 1.43k| } 216| | 217| 440| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 330, False: 110] ------------------ 218| 21.4k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 21.1k, False: 330] ------------------ 219| 21.1k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 21.1k| ptr += 8; 221| 21.1k| } 222| | 223| 330| transpose_64x128_sp( buf ); 224| | 225| 10.8k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 10.5k, False: 330] ------------------ 226| 10.5k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 10.5k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 10.5k| } 229| | 230| 330| ptr += 512; 231| 330| } 232| 110|} PQCLEAN_MCELIECE460896_AVX2_benes: 238| 220|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 220| int inc; 240| | 241| 220| vec128 *b_ptr; 242| | 243| 220| if (rev == 0) { ------------------ | Branch (243:9): [True: 110, False: 110] ------------------ 244| 110| inc = 32; 245| 110| b_ptr = b[ 0]; 246| 110| } else { 247| 110| inc = -32; 248| 110| b_ptr = b[24]; 249| 110| } 250| | 251| | // 252| | 253| 220| transpose_64x128_sp( r ); 254| | 255| 220| layer_0(r, b_ptr); 256| 220| b_ptr += inc; 257| 220| layer_1(r, b_ptr); 258| 220| b_ptr += inc; 259| 220| layer_2(r, b_ptr); 260| 220| b_ptr += inc; 261| 220| layer_3(r, b_ptr); 262| 220| b_ptr += inc; 263| 220| layer_4(r, b_ptr); 264| 220| b_ptr += inc; 265| 220| layer_5(r, b_ptr); 266| 220| b_ptr += inc; 267| | 268| 220| transpose_64x128_sp( r ); 269| | 270| 220| layer_x(r, b_ptr); 271| 220| b_ptr += inc; 272| 220| layer_0(r, b_ptr); 273| 220| b_ptr += inc; 274| 220| layer_1(r, b_ptr); 275| 220| b_ptr += inc; 276| 220| layer_2(r, b_ptr); 277| 220| b_ptr += inc; 278| 220| layer_3(r, b_ptr); 279| 220| b_ptr += inc; 280| 220| layer_4(r, b_ptr); 281| 220| b_ptr += inc; 282| 220| layer_5(r, b_ptr); 283| 220| b_ptr += inc; 284| 220| layer_4(r, b_ptr); 285| 220| b_ptr += inc; 286| 220| layer_3(r, b_ptr); 287| 220| b_ptr += inc; 288| 220| layer_2(r, b_ptr); 289| 220| b_ptr += inc; 290| 220| layer_1(r, b_ptr); 291| 220| b_ptr += inc; 292| 220| layer_0(r, b_ptr); 293| 220| b_ptr += inc; 294| 220| layer_x(r, b_ptr); 295| 220| b_ptr += inc; 296| | 297| 220| transpose_64x128_sp( r ); 298| | 299| 220| layer_5(r, b_ptr); 300| 220| b_ptr += inc; 301| 220| layer_4(r, b_ptr); 302| 220| b_ptr += inc; 303| 220| layer_3(r, b_ptr); 304| 220| b_ptr += inc; 305| 220| layer_2(r, b_ptr); 306| 220| b_ptr += inc; 307| 220| layer_1(r, b_ptr); 308| 220| b_ptr += inc; 309| 220| layer_0(r, b_ptr); 310| | 311| 220| transpose_64x128_sp( r ); 312| 220|} benes.c:layer_x: 14| 2.94k|static void layer_x(vec128 *data, vec128 *bits) { 15| 2.94k| int i; 16| 2.94k| vec128 v0, v1; 17| 2.94k| vec128 d; 18| | 19| 97.0k| for (i = 0; i < 64; i += 2) { ------------------ | Branch (19:17): [True: 94.0k, False: 2.94k] ------------------ 20| 94.0k| v0 = vec128_unpack_low(data[i + 0], data[i + 1]); 21| 94.0k| v1 = vec128_unpack_high(data[i + 0], data[i + 1]); 22| | 23| 94.0k| d = vec128_xor(v0, v1); 24| 94.0k| d = vec128_and(d, *bits++); 25| 94.0k| v0 = vec128_xor(v0, d); 26| 94.0k| v1 = vec128_xor(v1, d); 27| | 28| 94.0k| data[i + 0] = vec128_unpack_low(v0, v1); 29| 94.0k| data[i + 1] = vec128_unpack_high(v0, v1); 30| 94.0k| } 31| 2.94k|} PQCLEAN_MCELIECE460896_AVX2_bm: 147| 110|void bm(vec128 *out, vec256 *in) { 148| 110| int i; 149| 110| uint16_t N, L; 150| 110| uint16_t mask; 151| 110| uint64_t one = 1; 152| 110| uint64_t v[2]; 153| | 154| 110| typedef union { 155| 110| vec128 v[GFBITS][2]; 156| 110| vec256 V[GFBITS]; 157| 110| } db_t; 158| | 159| 110| vec128 prod[ GFBITS ]; 160| 110| vec128 interval[GFBITS]; 161| | 162| 110| db_t db; 163| 110| db_t BC_tmp; 164| 110| db_t BC; 165| | 166| 110| gf d, b; 167| 110| gf coefs[256]; 168| | 169| | // initialization 170| | 171| 110| get_coefs(coefs, in); 172| | 173| 110| BC.v[0][0] = vec128_set2x(0, one << 62); 174| 110| BC.v[0][1] = vec128_set2x(0, one << 63); 175| | 176| 1.43k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.43k|#define GFBITS 13 ------------------ | Branch (176:17): [True: 1.32k, False: 110] ------------------ 177| 1.32k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 178| 1.32k| } 179| | 180| 110| b = 1; 181| 110| L = 0; 182| | 183| | // 184| | 185| 1.54k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.54k|#define GFBITS 13 ------------------ | Branch (185:17): [True: 1.43k, False: 110] ------------------ 186| 1.43k| interval[i] = vec128_setzero(); 187| 1.43k| } 188| | 189| 21.2k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 21.2k|#define SYS_T 96 ------------------ | Branch (189:17): [True: 21.1k, False: 110] ------------------ 190| 21.1k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 21.1k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 21.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 191| 21.1k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 21.1k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 21.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 192| | 193| 21.1k| d = vec_reduce_asm(prod); ------------------ | | 3| 21.1k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 21.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 194| | 195| 21.1k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 196| | 197| 295k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 295k|#define GFBITS 13 ------------------ | Branch (197:21): [True: 274k, False: 21.1k] ------------------ 198| 274k| db.v[i][0] = vec128_setbits((d >> i) & 1); 199| 274k| db.v[i][1] = vec128_setbits((b >> i) & 1); 200| 274k| } 201| | 202| 21.1k| vec256_mul((vec256 *)BC_tmp.V, (vec256 *)db.V, (vec256 *)BC.V); 203| | 204| 21.1k| vec128_cmov(BC.v, mask); 205| 21.1k| update_asm(BC.v, 0, 32); ------------------ | | 1| 21.1k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 21.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 295k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 295k|#define GFBITS 13 ------------------ | Branch (207:21): [True: 274k, False: 21.1k] ------------------ 208| 274k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 209| 274k| } 210| | 211| 21.1k| b = (d & mask) | (b & ~mask); 212| 21.1k| L = ((N + 1 - L) & mask) | (L & ~mask); 213| 21.1k| } 214| | 215| 1.54k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.54k|#define GFBITS 13 ------------------ | Branch (215:17): [True: 1.43k, False: 110] ------------------ 216| 1.43k| v[0] = vec128_extract(BC.v[i][1], 0); ------------------ | | 29| 1.43k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 217| 1.43k| v[1] = vec128_extract(BC.v[i][1], 1); ------------------ | | 29| 1.43k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 218| | 219| 1.43k| out[i] = vec128_set2x((v[0] >> 31) | (v[1] << 33), v[1] >> 31); 220| 1.43k| } 221| 110|} bm.c:vec128_cmov: 45| 172k|static inline void vec128_cmov(vec128 out[][2], uint16_t mask) { 46| 172k| int i; 47| | 48| 172k| vec128 v0, v1; 49| | 50| 172k| vec128 m0 = vec128_set1_16b( mask); 51| 172k| vec128 m1 = vec128_set1_16b(~mask); 52| | 53| 2.40M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 2.40M|#define GFBITS 13 ------------------ | Branch (53:17): [True: 2.23M, False: 172k] ------------------ 54| 2.23M| v0 = vec128_and(out[i][1], m0); 55| 2.23M| v1 = vec128_and(out[i][0], m1); 56| 2.23M| out[i][0] = vec128_or(v0, v1); 57| 2.23M| } 58| 172k|} PQCLEAN_MCELIECE460896_AVX2_controlbitsfrompermutation: 205| 110|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 110| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 110|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 110| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 110|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 110| int16 diff; 209| 110| int i; 210| 110| unsigned char *ptr; 211| | 212| 110| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 110| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 110| while (1) { ------------------ | Branch (215:12): [True: 110, Folded] ------------------ 216| 110| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 110| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 901k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 901k, False: 110] ------------------ 222| 901k| pi_test[i] = (int16)i; 223| 901k| } 224| | 225| 110| ptr = out; 226| 1.54k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.43k, False: 110] ------------------ 227| 1.43k| layer(pi_test, ptr, i, (int32)n); 228| 1.43k| ptr += n >> 4; 229| 1.43k| } 230| | 231| 1.43k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.32k, False: 110] ------------------ 232| 1.32k| layer(pi_test, ptr, i, (int32)n); 233| 1.32k| ptr += n >> 4; 234| 1.32k| } 235| | 236| 110| diff = 0; 237| 901k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 901k, False: 110] ------------------ 238| 901k| diff |= pi[i] ^ pi_test[i]; 239| 901k| } 240| | 241| 110| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 110|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 110|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 242| 110| crypto_declassify(&diff, sizeof diff); 243| 110| if (diff == 0) { ------------------ | Branch (243:13): [True: 110, False: 0] ------------------ 244| 110| break; 245| 110| } 246| 110| } 247| 110|} PQCLEAN_MCELIECE460896_AVX2_crypto_int16_negative_mask: 3| 220|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 220| return crypto_int16_x >> 15; 5| 220|} PQCLEAN_MCELIECE460896_AVX2_crypto_int16_nonzero_mask: 7| 110|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 110| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 110|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 110|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 110|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 110|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 9| 110|} PQCLEAN_MCELIECE460896_AVX2_crypto_int32_negative_mask: 3| 70.2M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 70.2M| return crypto_int32_x >> 31; 5| 70.2M|} PQCLEAN_MCELIECE460896_AVX2_crypto_int32_min: 37| 70.2M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 70.2M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 70.2M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 70.2M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 70.2M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 70.2M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 70.2M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 42| 70.2M| crypto_int32_z &= crypto_int32_xy; 43| 70.2M| return crypto_int32_x ^ crypto_int32_z; 44| 70.2M|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint16_signed_negative_mask: 3| 316k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 316k| return crypto_uint16_signed_x >> 15; 5| 316k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint16_nonzero_mask: 7| 109k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 109k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 109k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 109k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 109k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 109k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 9| 109k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint16_zero_mask: 11| 109k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 109k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 109k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 109k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 13| 109k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint16_smaller_mask: 24| 98.7k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 98.7k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 98.7k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 98.7k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 98.7k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 98.7k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 98.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 29| 98.7k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint32_signed_negative_mask: 3| 103k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 103k| return crypto_uint32_signed_x >> 31; 5| 103k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint32_nonzero_mask: 7| 51.6k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 51.6k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 51.6k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 51.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 51.6k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 51.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 9| 51.6k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint32_unequal_mask: 15| 51.6k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 51.6k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 51.6k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 51.6k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 51.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 18| 51.6k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint32_equal_mask: 20| 51.6k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 51.6k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 51.6k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 51.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 22| 51.6k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint64_signed_negative_mask: 3| 21.1M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 21.1M| return crypto_uint64_signed_x >> 63; 5| 21.1M|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint64_nonzero_mask: 7| 10.5M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 10.5M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 10.5M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 10.5M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 10.5M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 10.5M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 9| 10.5M|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint64_zero_mask: 11| 1.37M|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 1.37M| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 1.37M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 1.37M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 13| 1.37M|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint64_unequal_mask: 15| 9.20M|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 9.20M| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 9.20M| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 9.20M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 9.20M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 18| 9.20M|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint64_equal_mask: 20| 9.20M|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 9.20M| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 9.20M|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 9.20M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 22| 9.20M|} PQCLEAN_MCELIECE460896_AVX2_decrypt: 171| 110|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 110| int i; 173| | 174| 110| uint16_t check_synd; 175| 110| uint16_t check_weight; 176| | 177| 110| vec256 inv[ 32 ][ GFBITS ]; 178| 110| vec256 scaled[ 32 ][ GFBITS ]; 179| 110| vec256 eval[32][ GFBITS ]; 180| | 181| 110| vec128 error128[ 64 ]; 182| 110| vec256 error256[ 32 ]; 183| | 184| 110| vec256 s_priv[ GFBITS ]; 185| 110| vec256 s_priv_cmp[ GFBITS ]; 186| 110| vec128 locator[ GFBITS ]; 187| | 188| 110| vec128 recv128[ 64 ]; 189| 110| vec256 recv256[ 32 ]; 190| 110| vec256 allone; 191| | 192| 110| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 110| preprocess(recv128, s); 197| | 198| 110| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 110|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 110|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 110|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 110|#define SYS_T 96 | | ------------------ ------------------ 199| 110| benes(recv128, bits_int, 1); ------------------ | | 9| 110|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 110|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 110| reformat_128to256(recv256, recv128); 202| | 203| 110| scaling(scaled, inv, sk, recv256); 204| 110| fft_tr(s_priv, scaled); ------------------ | | 9| 110|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 110|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 205| 110| bm(locator, s_priv); ------------------ | | 10| 110|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 110|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 110| fft(eval, locator); ------------------ | | 10| 110|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 110|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 110| allone = vec256_set1_16b(0xFFFF); 212| | 213| 3.63k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 3.52k, False: 110] ------------------ 214| 3.52k| error256[i] = vec256_or_reduce(eval[i]); 215| 3.52k| error256[i] = vec256_xor(error256[i], allone); 216| 3.52k| } 217| | 218| 110| scaling_inv(scaled, inv, error256); 219| 110| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 110|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 110|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 110| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 110| reformat_256to128(error128, error256); 226| 110| benes(error128, bits_int, 0); ------------------ | | 9| 110|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 110|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 110| postprocess(e, error128); 229| | 230| 110| check_weight = weight_check(e, error128); 231| | 232| 110| return 1 - (check_synd & check_weight); 233| 110|} PQCLEAN_MCELIECE460896_AVX2_encrypt: 112| 110|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 113| 110| gen_e(e); 114| | 115| 110| syndrome_asm(s, pk, e); ------------------ | | 1| 110|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 110|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 116| 110|} PQCLEAN_MCELIECE460896_AVX2_fft: 265| 1.35k|void fft(vec256 out[][GFBITS], vec128 *in) { 266| 1.35k| radix_conversions(in); 267| 1.35k| butterflies(out, in); 268| 1.35k|} PQCLEAN_MCELIECE460896_AVX2_fft_tr: 397| 220|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 398| 220| butterflies_tr(out, in); 399| 220| radix_conversions_tr(out); 400| | 401| 220| postprocess(out); 402| 220|} fft_tr.c:postprocess: 381| 788|static void postprocess(vec256 *out) { 382| 788| int i; 383| 788| uint64_t v[4]; 384| | 385| 11.0k| for (i = 0; i < 13; i++) { ------------------ | Branch (385:17): [True: 10.2k, False: 788] ------------------ 386| 10.2k| v[0] = vec256_extract(out[i], 0); ------------------ | | 39| 10.2k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 387| 10.2k| v[1] = vec256_extract(out[i], 1); ------------------ | | 39| 10.2k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 388| 10.2k| v[2] = vec256_extract(out[i], 2); ------------------ | | 39| 10.2k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 389| 10.2k| v[3] = vec256_extract(out[i], 3); ------------------ | | 39| 10.2k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 390| | 391| 10.2k| v[3] = 0; 392| | 393| 10.2k| out[i] = vec256_set4x(v[0], v[1], v[2], v[3]); 394| 10.2k| } 395| 788|} PQCLEAN_MCELIECE460896_AVX2_gf_mul: 20| 10.4M|gf gf_mul(gf in0, gf in1) { 21| 10.4M| int i; 22| | 23| 10.4M| uint64_t tmp; 24| 10.4M| uint64_t t0; 25| 10.4M| uint64_t t1; 26| 10.4M| uint64_t t; 27| | 28| 10.4M| t0 = in0; 29| 10.4M| t1 = in1; 30| | 31| 10.4M| tmp = t0 * (t1 & 1); 32| | 33| 136M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 136M|#define GFBITS 13 ------------------ | Branch (33:17): [True: 125M, False: 10.4M] ------------------ 34| 125M| tmp ^= (t0 * (t1 & (1 << i))); 35| 125M| } 36| | 37| | // 38| | 39| 10.4M| t = tmp & 0x1FF0000; 40| 10.4M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 41| | 42| 10.4M| t = tmp & 0x000E000; 43| 10.4M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 44| | 45| 10.4M| return tmp & GFMASK; ------------------ | | 19| 10.4M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 10.4M|#define GFBITS 13 | | ------------------ ------------------ 46| 10.4M|} PQCLEAN_MCELIECE460896_AVX2_gf_frac: 156| 109k|gf gf_frac(gf den, gf num) { 157| 109k| gf tmp_11; 158| 109k| gf tmp_1111; 159| 109k| gf out; 160| | 161| 109k| tmp_11 = gf_sqmul(den, den); // ^11 162| 109k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // ^1111 163| 109k| out = gf_sq2(tmp_1111); 164| 109k| out = gf_sq2mul(out, tmp_1111); // ^11111111 165| 109k| out = gf_sq2(out); 166| 109k| out = gf_sq2mul(out, tmp_1111); // ^111111111111 167| | 168| 109k| return gf_sqmul(out, num); // ^1111111111110 = ^-1 169| 109k|} PQCLEAN_MCELIECE460896_AVX2_gf_inv: 172| 109k|gf gf_inv(gf den) { 173| 109k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 109k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 109k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 174| 109k|} pk_gen.c:PQCLEAN_MCELIECE460896_AVX2_int32_sort: 21| 110|static void int32_sort(int32_t *x, long long n) { 22| 110| long long top, p, q, r, i; 23| | 24| 110| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 110] ------------------ 25| 0| return; 26| 0| } 27| 110| top = 1; 28| 1.21k| while (top < n - top) { ------------------ | Branch (28:12): [True: 1.10k, False: 110] ------------------ 29| 1.10k| top += top; 30| 1.10k| } 31| | 32| 1.32k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.21k, False: 110] ------------------ 33| 1.28M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.28M, False: 1.21k] ------------------ 34| 1.28M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 681k, False: 603k] ------------------ 35| 681k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 681k| do { \ | | 12| 681k| int32_t ab = (b) ^ (a); \ | | 13| 681k| int32_t c = (b) - (a); \ | | 14| 681k| c ^= ab & ((c) ^ (b)); \ | | 15| 681k| c >>= 31; \ | | 16| 681k| c &= ab; \ | | 17| 681k| (a) ^= c; \ | | 18| 681k| (b) ^= c; \ | | 19| 681k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 681k] | | ------------------ ------------------ 36| 681k| } 37| 1.28M| } 38| 1.21k| i = 0; 39| 7.26k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 6.05k, False: 1.21k] ------------------ 40| 1.15M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.14M, False: 6.05k] ------------------ 41| 1.14M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 603k, False: 543k] ------------------ 42| 603k| int32_t a = x[i + p]; 43| 3.42M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.81M, False: 603k] ------------------ 44| 2.81M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.81M| do { \ | | 12| 2.81M| int32_t ab = (b) ^ (a); \ | | 13| 2.81M| int32_t c = (b) - (a); \ | | 14| 2.81M| c ^= ab & ((c) ^ (b)); \ | | 15| 2.81M| c >>= 31; \ | | 16| 2.81M| c &= ab; \ | | 17| 2.81M| (a) ^= c; \ | | 18| 2.81M| (b) ^= c; \ | | 19| 2.81M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.81M] | | ------------------ ------------------ 45| 2.81M| } 46| 603k| x[i + p] = a; 47| 603k| } 48| 1.14M| } 49| 6.05k| } 50| 1.21k| } 51| 110|} controlbits.c:PQCLEAN_MCELIECE460896_AVX2_int32_sort: 21| 3.60M|static void int32_sort(int32_t *x, long long n) { 22| 3.60M| long long top, p, q, r, i; 23| | 24| 3.60M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 3.60M] ------------------ 25| 0| return; 26| 0| } 27| 3.60M| top = 1; 28| 12.6M| while (top < n - top) { ------------------ | Branch (28:12): [True: 9.03M, False: 3.60M] ------------------ 29| 9.03M| top += top; 30| 9.03M| } 31| | 32| 16.2M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 12.6M, False: 3.60M] ------------------ 33| 1.73G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.72G, False: 12.6M] ------------------ 34| 1.72G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 965M, False: 760M] ------------------ 35| 965M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 965M| do { \ | | 12| 965M| int32_t ab = (b) ^ (a); \ | | 13| 965M| int32_t c = (b) - (a); \ | | 14| 965M| c ^= ab & ((c) ^ (b)); \ | | 15| 965M| c >>= 31; \ | | 16| 965M| c &= ab; \ | | 17| 965M| (a) ^= c; \ | | 18| 965M| (b) ^= c; \ | | 19| 965M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 965M] | | ------------------ ------------------ 36| 965M| } 37| 1.72G| } 38| 12.6M| i = 0; 39| 34.2M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 21.6M, False: 12.6M] ------------------ 40| 1.54G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.52G, False: 21.6M] ------------------ 41| 1.52G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 760M, False: 760M] ------------------ 42| 760M| int32_t a = x[i + p]; 43| 4.50G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.74G, False: 760M] ------------------ 44| 3.74G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.74G| do { \ | | 12| 3.74G| int32_t ab = (b) ^ (a); \ | | 13| 3.74G| int32_t c = (b) - (a); \ | | 14| 3.74G| c ^= ab & ((c) ^ (b)); \ | | 15| 3.74G| c >>= 31; \ | | 16| 3.74G| c &= ab; \ | | 17| 3.74G| (a) ^= c; \ | | 18| 3.74G| (b) ^= c; \ | | 19| 3.74G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.74G] | | ------------------ ------------------ 45| 3.74G| } 46| 760M| x[i + p] = a; 47| 760M| } 48| 1.52G| } 49| 21.6M| } 50| 12.6M| } 51| 3.60M|} encrypt.c:PQCLEAN_MCELIECE460896_AVX2_int32_sort: 21| 544|static void int32_sort(int32_t *x, long long n) { 22| 544| long long top, p, q, r, i; 23| | 24| 544| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 544] ------------------ 25| 0| return; 26| 0| } 27| 544| top = 1; 28| 3.80k| while (top < n - top) { ------------------ | Branch (28:12): [True: 3.26k, False: 544] ------------------ 29| 3.26k| top += top; 30| 3.26k| } 31| | 32| 4.35k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 3.80k, False: 544] ------------------ 33| 300k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 296k, False: 3.80k] ------------------ 34| 296k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 165k, False: 131k] ------------------ 35| 165k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 165k| do { \ | | 12| 165k| int32_t ab = (b) ^ (a); \ | | 13| 165k| int32_t c = (b) - (a); \ | | 14| 165k| c ^= ab & ((c) ^ (b)); \ | | 15| 165k| c >>= 31; \ | | 16| 165k| c &= ab; \ | | 17| 165k| (a) ^= c; \ | | 18| 165k| (b) ^= c; \ | | 19| 165k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 165k] | | ------------------ ------------------ 36| 165k| } 37| 296k| } 38| 3.80k| i = 0; 39| 15.2k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 11.4k, False: 3.80k] ------------------ 40| 256k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 244k, False: 11.4k] ------------------ 41| 244k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 131k, False: 113k] ------------------ 42| 131k| int32_t a = x[i + p]; 43| 513k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 382k, False: 131k] ------------------ 44| 382k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 382k| do { \ | | 12| 382k| int32_t ab = (b) ^ (a); \ | | 13| 382k| int32_t c = (b) - (a); \ | | 14| 382k| c ^= ab & ((c) ^ (b)); \ | | 15| 382k| c >>= 31; \ | | 16| 382k| c &= ab; \ | | 17| 382k| (a) ^= c; \ | | 18| 382k| (b) ^= c; \ | | 19| 382k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 382k] | | ------------------ ------------------ 45| 382k| } 46| 131k| x[i + p] = a; 47| 131k| } 48| 244k| } 49| 11.4k| } 50| 3.80k| } 51| 544|} PQCLEAN_MCELIECE460896_AVX2_crypto_kem_enc: 22| 110|) { 23| 110| unsigned char e[ SYS_N / 8 ]; 24| 110| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 110| encrypt(c, pk, e); ------------------ | | 9| 110|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 110|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 110| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 110|#define SYS_N 4608 ------------------ 31| 110| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 110|#define SYS_N 4608 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 110|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 110|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 110|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 110|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 110| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 110| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 110|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 110| return 0; 36| 110|} PQCLEAN_MCELIECE460896_AVX2_crypto_kem_dec: 42| 110|) { 43| 110| int i; 44| | 45| 110| unsigned char ret_decrypt = 0; 46| | 47| 110| uint16_t m; 48| | 49| 110| unsigned char e[ SYS_N / 8 ]; 50| 110| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 110| unsigned char *x = preimage; 52| 110| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 110|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 110|#define SYS_T 96 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 110|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 110|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 110|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 110| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 110|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 110|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 110| m = ret_decrypt; 59| 110| m -= 1; 60| 110| m >>= 8; 61| | 62| 110| *x++ = m & 1; 63| 63.4k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 63.4k|#define SYS_N 4608 ------------------ | Branch (63:17): [True: 63.3k, False: 110] ------------------ 64| 63.3k| *x++ = (~m & s[i]) | (m & e[i]); 65| 63.3k| } 66| | 67| 17.2k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 17.2k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 17.2k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 17.2k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 17.2k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 17.1k, False: 110] ------------------ 68| 17.1k| *x++ = c[i]; 69| 17.1k| } 70| | 71| 110| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 110| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 110|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 110| return 0; 74| 110|} PQCLEAN_MCELIECE460896_AVX2_crypto_kem_keypair: 80| 110|) { 81| 110| int i; 82| 110| unsigned char seed[ 33 ] = {64}; 83| 110| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 110| unsigned char *rp, *skp; 85| | 86| 110| gf f[ SYS_T ]; // element in GF(2^mt) 87| 110| gf irr[ SYS_T ]; // Goppa polynomial 88| 110| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 89| 110| int16_t pi[ 1 << GFBITS ]; // random permutation 90| | 91| 110| randombytes(seed + 1, 32); ------------------ | | 8| 110|#define randombytes OQS_randombytes ------------------ 92| | 93| 1.13k| while (1) { ------------------ | Branch (93:12): [True: 1.13k, Folded] ------------------ 94| 1.13k| rp = &r[ sizeof(r) - 32 ]; 95| 1.13k| skp = sk; 96| | 97| | // expanding and updating the seed 98| | 99| 1.13k| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 1.13k| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 1.13k|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 100| 1.13k| memcpy(skp, seed + 1, 32); 101| 1.13k| skp += 32 + 8; 102| 1.13k| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 103| | 104| | // generating irreducible polynomial 105| | 106| 1.13k| rp -= sizeof(f); 107| | 108| 110k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 110k|#define SYS_T 96 ------------------ | Branch (108:21): [True: 109k, False: 1.13k] ------------------ 109| 109k| f[i] = load_gf(rp + i * 2); 110| 109k| } 111| | 112| 1.13k| if (genpoly_gen(irr, f)) { ------------------ | | 9| 1.13k|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 1.13k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ | Branch (112:13): [True: 0, False: 1.13k] ------------------ 113| 0| continue; 114| 0| } 115| | 116| 110k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 110k|#define SYS_T 96 ------------------ | Branch (116:21): [True: 109k, False: 1.13k] ------------------ 117| 109k| store_gf(skp + i * 2, irr[i]); 118| 109k| } 119| | 120| 1.13k| skp += IRR_BYTES; ------------------ | | 11| 1.13k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.13k|#define SYS_T 96 | | ------------------ ------------------ 121| | 122| | // generating permutation 123| | 124| 1.13k| rp -= sizeof(perm); 125| | 126| 9.30M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.30M|#define GFBITS 13 ------------------ | Branch (126:21): [True: 9.30M, False: 1.13k] ------------------ 127| 9.30M| perm[i] = load4(rp + i * 4); 128| 9.30M| } 129| | 130| 1.13k| if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 9| 1.13k|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 1.13k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 11| 1.13k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.13k|#define SYS_T 96 | | ------------------ ------------------ | Branch (130:13): [True: 1.02k, False: 110] ------------------ 131| 1.02k| continue; 132| 1.02k| } 133| | 134| 110| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 110|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 110|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 110|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 110|#define GFBITS 13 ------------------ 135| 110| skp += COND_BYTES; ------------------ | | 10| 110|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 110|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 110|#define GFBITS 13 | | ------------------ ------------------ 136| | 137| | // storing the random string s 138| | 139| 110| rp -= SYS_N / 8; ------------------ | | 7| 110|#define SYS_N 4608 ------------------ 140| 110| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 110|#define SYS_N 4608 ------------------ 141| | 142| | // storing positions of the 32 pivots 143| | 144| 110| store8(sk + 32, 0xFFFFFFFF); 145| | 146| 110| break; 147| 1.13k| } 148| | 149| 110| return 0; 150| 110|} PQCLEAN_MCELIECE460896_AVX2_pk_gen: 199| 1.13k|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi) { 200| 1.13k|#define nBlocks_I ((PK_NROWS + 255) / 256) 201| | 202| 1.13k| int i, j, k, b; 203| 1.13k| int row, c; 204| | 205| 1.13k| union { 206| 1.13k| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 207| 1.13k| vec256 v[ PK_NROWS ][ nBlocks_I ]; 208| 1.13k| } mat; 209| | 210| 1.13k| union { 211| 1.13k| uint64_t w[ PK_NROWS ][ par_width * 4 ]; 212| 1.13k| vec256 v[ PK_NROWS ][ par_width ]; 213| 1.13k| } par; 214| | 215| 1.13k| uint64_t one = 1; 216| 1.13k| uint64_t t; 217| 1.13k| uint16_t m; 218| 1.13k| vec256 mm; 219| | 220| 1.13k| vec128 sk_int[ GFBITS ]; 221| | 222| 1.13k| vec256 consts[ 32 ][ GFBITS ]; 223| 1.13k| vec256 eval[ 32 ][ GFBITS ]; 224| 1.13k| vec256 prod[ 32 ][ GFBITS ]; 225| 1.13k| vec256 tmp[ GFBITS ]; 226| | 227| 1.13k| uint64_t list[1 << GFBITS]; 228| | 229| 1.13k| uint16_t ind[ PK_NROWS ]; 230| 1.13k| uint16_t ind_inv[ PK_NROWS ]; 231| | 232| | // compute the inverses 233| | 234| 1.13k| irr_load(sk_int, irr); 235| | 236| 1.13k| fft(eval, sk_int); ------------------ | | 10| 1.13k|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 1.13k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 237| | 238| 1.13k| vec256_copy(prod[0], eval[0]); 239| | 240| 36.3k| for (i = 1; i < 32; i++) { ------------------ | Branch (240:17): [True: 35.2k, False: 1.13k] ------------------ 241| 35.2k| vec256_mul(prod[i], prod[i - 1], eval[i]); 242| 35.2k| } 243| | 244| 1.13k| vec256_inv(tmp, prod[31]); ------------------ | | 11| 1.13k|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 1.13k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 245| | 246| 36.3k| for (i = 30; i >= 0; i--) { ------------------ | Branch (246:18): [True: 35.2k, False: 1.13k] ------------------ 247| 35.2k| vec256_mul(prod[i + 1], prod[i], tmp); 248| 35.2k| vec256_mul(tmp, tmp, eval[i + 1]); 249| 35.2k| } 250| | 251| 1.13k| vec256_copy(prod[0], tmp); 252| | 253| | // fill matrix 254| | 255| 1.13k| de_bitslicing(list, prod); 256| | 257| 9.30M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.30M|#define GFBITS 13 ------------------ | Branch (257:17): [True: 9.30M, False: 1.13k] ------------------ 258| 9.30M| list[i] <<= GFBITS; ------------------ | | 6| 9.30M|#define GFBITS 13 ------------------ 259| 9.30M| list[i] |= i; 260| 9.30M| list[i] |= ((uint64_t) perm[i]) << 31; 261| 9.30M| } 262| | 263| 1.13k| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 1.13k|#define GFBITS 13 ------------------ 264| | 265| 9.20M| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.20M|#define GFBITS 13 ------------------ | Branch (265:17): [True: 9.20M, False: 1.10k] ------------------ 266| 9.20M| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (266:13): [True: 31, False: 9.20M] ------------------ 267| 31| return -1; 268| 31| } 269| 9.20M| } 270| | 271| 1.10k| to_bitslicing_2x(consts, prod, list); 272| | 273| 9.05M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.05M|#define GFBITS 13 ------------------ | Branch (273:17): [True: 9.05M, False: 1.10k] ------------------ 274| 9.05M| pi[i] = list[i] & GFMASK; ------------------ | | 19| 9.05M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 9.05M|#define GFBITS 13 | | ------------------ ------------------ 275| 9.05M| } 276| | 277| 6.63k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 6.63k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 6.63k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 6.63k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 6.63k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (277:17): [True: 5.52k, False: 1.10k] ------------------ 278| 77.3k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 77.3k|#define GFBITS 13 ------------------ | Branch (278:21): [True: 71.8k, False: 5.52k] ------------------ 279| 71.8k| mat.v[ k ][ j ] = prod[ j ][ k ]; 280| 71.8k| } 281| 5.52k| } 282| | 283| 106k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 106k|#define SYS_T 96 ------------------ | Branch (283:17): [True: 104k, False: 1.10k] ------------------ 284| 629k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 629k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 629k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 629k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 629k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (284:21): [True: 524k, False: 104k] ------------------ 285| 524k| vec256_mul(prod[j], prod[j], consts[j]); 286| | 287| 7.34M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 7.34M|#define GFBITS 13 ------------------ | Branch (287:25): [True: 6.82M, False: 524k] ------------------ 288| 6.82M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 6.82M|#define GFBITS 13 ------------------ 289| 6.82M| } 290| 524k| } 291| 104k| } 292| | 293| | // gaussian elimination to obtain L, U, and P such that LP M = U 294| | // L and U are stored in the space of M 295| | // P is stored in ind 296| | 297| 1.38M| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 1.38M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.38M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.38M|#define GFBITS 13 | | ------------------ ------------------ | Branch (297:17): [True: 1.37M, False: 1.10k] ------------------ 298| 1.37M| ind_inv[i] = ind[ i ] = i; 299| 1.37M| } 300| | 301| 1.37M| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 1.37M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.37M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.37M|#define GFBITS 13 | | ------------------ ------------------ | Branch (301:19): [True: 1.37M, False: 110] ------------------ 302| 1.37M| i = row >> 6; 303| 1.37M| j = row & 63; 304| | 305| 861M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 861M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 861M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 861M|#define GFBITS 13 | | ------------------ ------------------ | Branch (305:27): [True: 859M, False: 1.37M] ------------------ 306| 859M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 307| 859M| uint16_cswap(&ind[row], &ind[k], m); 308| | 309| 859M| mm = vec256_set1_16b(m); 310| 5.15G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 5.15G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 5.15G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 5.15G|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 5.15G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (310:25): [True: 4.29G, False: 859M] ------------------ 311| 4.29G| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 312| 4.29G| } 313| 859M| } 314| | 315| 1.37M| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (315:14): [True: 995, False: 1.37M] ------------------ 316| 995| return -1; 317| 995| } 318| | 319| 861M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 861M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 861M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 861M|#define GFBITS 13 | | ------------------ ------------------ | Branch (319:27): [True: 859M, False: 1.37M] ------------------ 320| 859M| t = mat.w[ k ][ i ] & (one << j); 321| 859M| mm = extract_mask256(mat.w[k], row); 322| | 323| 5.15G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 5.15G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 5.15G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 5.15G|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 5.15G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (323:25): [True: 4.29G, False: 859M] ------------------ 324| 4.29G| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 325| 4.29G| } 326| | 327| 859M| mat.w[ k ][ i ] |= t; 328| 859M| } 329| 1.37M| } 330| | 331| | // apply M^-1 to the remaining columns 332| | 333| 110| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 110|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 110|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 110|#define GFBITS 13 | | ------------------ ------------------ 334| | 335| 330| for (j = 4; j < 18; j += par_width) { ------------------ | | 30| 220|#define par_width 7 ------------------ | Branch (335:17): [True: 220, False: 110] ------------------ 336| 3.08k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 3.08k|#define GFBITS 13 ------------------ | Branch (336:21): [True: 2.86k, False: 220] ------------------ 337| 22.8k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 22.8k|#define par_width 7 ------------------ | Branch (337:25): [True: 20.0k, False: 2.86k] ------------------ 338| 20.0k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 339| 20.0k| } 340| 2.86k| } 341| | 342| 21.1k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 21.1k|#define SYS_T 96 ------------------ | Branch (342:21): [True: 20.9k, False: 220] ------------------ 343| 167k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 167k|#define par_width 7 ------------------ | Branch (343:25): [True: 146k, False: 20.9k] ------------------ 344| 146k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 345| 146k| } 346| | 347| 292k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 292k|#define GFBITS 13 ------------------ | Branch (347:25): [True: 271k, False: 20.9k] ------------------ 348| 2.17M| for (b = 0; b < par_width; b++) { ------------------ | | 30| 2.17M|#define par_width 7 ------------------ | Branch (348:29): [True: 1.90M, False: 271k] ------------------ 349| 1.90M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 1.90M|#define GFBITS 13 ------------------ 350| 1.90M| } 351| 271k| } 352| 20.9k| } 353| | 354| | // apply P 355| | 356| 274k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 274k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 274k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 274k|#define GFBITS 13 | | ------------------ ------------------ | Branch (356:21): [True: 274k, False: 220] ------------------ 357| 274k| ind[i] = ind_inv[i]; 358| 274k| } 359| | 360| 220| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 220|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 220|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 220|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 220|#define GFBITS 13 | | ------------------ ------------------ 361| | 362| | // apply L 363| | 364| 274k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 220|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 220|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 220|#define GFBITS 13 | | ------------------ ------------------ | Branch (364:34): [True: 274k, False: 220] ------------------ 365| 171M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (365:31): [True: 171M, False: 274k] ------------------ 366| 171M| mm = extract_mask256(mat.w[row], i); 367| | 368| 1.36G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 1.36G|#define par_width 7 ------------------ | Branch (368:29): [True: 1.19G, False: 171M] ------------------ 369| 1.19G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 370| 1.19G| } 371| 171M| } 372| 274k| } 373| | 374| | // apply U^-1 375| | 376| 220| if (j == 4) { ------------------ | Branch (376:13): [True: 110, False: 110] ------------------ 377| 137k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 137k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 137k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 137k|#define GFBITS 13 | | ------------------ ------------------ | Branch (377:25): [True: 137k, False: 110] ------------------ 378| 137k| par.v[i][0] = mat.v[i][nBlocks_I - 1]; ------------------ | | 200| 137k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 137k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 137k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 137k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 379| 137k| } 380| 110| } 381| | 382| 274k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 220|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 220|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 220|#define GFBITS 13 | | ------------------ ------------------ | Branch (382:34): [True: 274k, False: 220] ------------------ 383| 171M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 274k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 274k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 274k|#define GFBITS 13 | | ------------------ ------------------ | Branch (383:36): [True: 171M, False: 274k] ------------------ 384| 171M| mm = extract_mask256(mat.w[row], i); 385| | 386| 1.36G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 1.36G|#define par_width 7 ------------------ | Branch (386:29): [True: 1.19G, False: 171M] ------------------ 387| 1.19G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 388| 1.19G| } 389| 171M| } 390| 274k| } 391| | 392| 220| if (j == 4) { ------------------ | Branch (392:13): [True: 110, False: 110] ------------------ 393| 137k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 137k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 137k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 137k|#define GFBITS 13 | | ------------------ ------------------ | Branch (393:27): [True: 137k, False: 110] ------------------ 394| 137k| k = 3; 395| 137k| store_i(pk + PK_ROW_BYTES * row + j * 32 + k * 8 + 4 - 13 * 12, par.w[row][k] >> 32, 4); ------------------ | | 15| 137k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 137k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 137k|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 137k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 137k|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 137k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 396| | 397| 3.43M| for (k = 4; k < 28; k++) { ------------------ | Branch (397:29): [True: 3.29M, False: 137k] ------------------ 398| 3.29M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 12, par.w[row][k]); ------------------ | | 15| 3.29M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 3.29M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 3.29M|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 3.29M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 3.29M|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 3.29M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 399| 3.29M| } 400| 137k| } 401| 110| } else { 402| 137k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 137k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 137k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 137k|#define GFBITS 13 | | ------------------ ------------------ | Branch (402:27): [True: 137k, False: 110] ------------------ 403| 3.98M| for (k = 0; k < 28; k++) { ------------------ | Branch (403:29): [True: 3.84M, False: 137k] ------------------ 404| 3.84M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 12, par.w[row][k]); ------------------ | | 15| 3.84M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 3.84M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 3.84M|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 3.84M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 3.84M|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 3.84M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 405| 3.84M| } 406| 137k| } 407| 110| } 408| 220| } 409| | 410| | // 411| | 412| 110| return 0; 413| 1.10k|} PQCLEAN_MCELIECE460896_AVX2_genpoly_gen: 88| 1.13k|int genpoly_gen(gf *out, gf *f) { 89| 1.13k| int i, j, k; 90| | 91| 1.13k| gf t, inv; 92| | 93| 1.13k| uint64_t m; 94| 1.13k| vec128 mask; 95| | 96| 1.13k| union { 97| 1.13k| uint64_t d[ GFBITS ][ 128 ][2]; 98| 1.13k| vec128 v[ GFBITS ][ 128 ]; 99| 1.13k| } buf; 100| | 101| 1.13k| union { 102| 1.13k| uint64_t d[GFBITS][2]; 103| 1.13k| vec128 v[GFBITS]; 104| 1.13k| } v; 105| | 106| 1.13k| union { 107| 1.13k| uint64_t d[SYS_T][GFBITS][2]; 108| 1.13k| vec128 v[SYS_T][GFBITS]; 109| 1.13k| } mat; 110| | 111| | // fill matrix 112| | 113| 1.13k| buf.v[0][0] = vec128_set2x(1, 0); 114| 14.7k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 14.7k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 13.6k, False: 1.13k] ------------------ 115| 13.6k| buf.v[i][0] = vec128_setzero(); 116| 13.6k| } 117| | 118| 15.9k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 15.9k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 14.7k, False: 1.13k] ------------------ 119| 14.7k| v.v[j] = vec128_setzero(); 120| | 121| 1.43M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 14.7k|#define SYS_T 96 ------------------ | Branch (121:29): [True: 1.41M, False: 14.7k] ------------------ 122| 1.41M| v.d[j][1] <<= 1; 123| 1.41M| v.d[j][1] |= v.d[j][0] >> 63; 124| 1.41M| v.d[j][0] <<= 1; 125| 1.41M| v.d[j][0] |= (f[i] >> j) & 1; 126| 1.41M| } 127| 14.7k| } 128| | 129| 15.9k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 15.9k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 14.7k, False: 1.13k] ------------------ 130| 14.7k| buf.v[i][1] = v.v[i]; 131| 14.7k| } 132| | 133| 109k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 109k|#define SYS_T 96 ------------------ | Branch (133:17): [True: 107k, False: 1.13k] ------------------ 134| 107k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 107k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 107k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 107k| if (k < SYS_T) { ------------------ | | 8| 107k|#define SYS_T 96 ------------------ | Branch (136:13): [True: 106k, False: 1.13k] ------------------ 137| 1.49M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.49M|#define GFBITS 13 ------------------ | Branch (137:25): [True: 1.38M, False: 106k] ------------------ 138| 1.38M| buf.v[i][k] = v.v[i]; 139| 1.38M| } 140| 106k| } else { 141| 110k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 110k|#define SYS_T 96 ------------------ | Branch (141:25): [True: 109k, False: 1.13k] ------------------ 142| 109k| out[i] = extract_gf(v.d, i); 143| 109k| } 144| 1.13k| } 145| 107k| } 146| | 147| 15.9k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 15.9k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 14.7k, False: 1.13k] ------------------ 148| 14.7k| transpose_128x128(buf.d[i]); 149| 14.7k| } 150| | 151| 110k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 110k|#define SYS_T 96 ------------------ | Branch (151:17): [True: 109k, False: 1.13k] ------------------ 152| 1.52M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.52M|#define GFBITS 13 ------------------ | Branch (152:21): [True: 1.41M, False: 109k] ------------------ 153| 1.41M| mat.v[j][i] = buf.v[i][j]; 154| 1.41M| } 155| 109k| } 156| | 157| | // gaussian 158| | 159| 110k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 110k|#define SYS_T 96 ------------------ | Branch (159:17): [True: 109k, False: 1.13k] ------------------ 160| 5.28M| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 5.28M|#define SYS_T 96 ------------------ | Branch (160:25): [True: 5.18M, False: 109k] ------------------ 161| 5.18M| m = extract_bit(mat.d[i], i); 162| 5.18M| m -= 1; 163| 5.18M| mask = vec128_set2x(m, m); 164| | 165| 72.5M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 72.5M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 67.3M, False: 5.18M] ------------------ 166| 67.3M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 67.3M| } 168| | 169| 5.18M| out[i] ^= out[j] & m; 170| 5.18M| } 171| | 172| | // 173| | 174| 109k| t = extract_gf(mat.d[i], i); 175| | 176| 109k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 109k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 109k| inv = gf_inv(t); ------------------ | | 11| 109k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 109k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 183| 109k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 109k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 109k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 109k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 10.5M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 10.5M|#define SYS_T 96 ------------------ | Branch (187:21): [True: 10.4M, False: 109k] ------------------ 188| 10.4M| if (j != i) { ------------------ | Branch (188:17): [True: 10.3M, False: 109k] ------------------ 189| 10.3M| t = extract_gf(mat.d[j], i); 190| | 191| 10.3M| vec128_mul_gf(v.v, mat.v[i], t); 192| 10.3M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 10.3M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 10.3M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 10.3M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 195| 10.3M| } 196| 10.4M| } 197| 109k| } 198| | 199| 1.13k| return 0; 200| 1.13k|} sk_gen.c:transpose_128x128: 52| 56.8k|static void transpose_128x128(uint64_t (*in)[2]) { 53| 56.8k| int i, j, k; 54| 56.8k| uint64_t m[2][2][64], t; 55| | 56| 170k| for (i = 0; i < 2; i++) { ------------------ | Branch (56:17): [True: 113k, False: 56.8k] ------------------ 57| 341k| for (j = 0; j < 2; j++) { ------------------ | Branch (57:21): [True: 227k, False: 113k] ------------------ 58| 14.7M| for (k = 0; k < 64; k++) { ------------------ | Branch (58:25): [True: 14.5M, False: 227k] ------------------ 59| 14.5M| m[i][j][k] = in[64 * i + k][j]; 60| 14.5M| } 61| 227k| } 62| 113k| } 63| | 64| 3.69M| for (k = 0; k < 64; k++) { ------------------ | Branch (64:17): [True: 3.63M, False: 56.8k] ------------------ 65| 3.63M| t = m[0][1][k]; 66| 3.63M| m[0][1][k] = m[1][0][k]; 67| 3.63M| m[1][0][k] = t; 68| 3.63M| } 69| | 70| 170k| for (i = 0; i < 2; i++) { ------------------ | Branch (70:17): [True: 113k, False: 56.8k] ------------------ 71| 341k| for (j = 0; j < 2; j++) { ------------------ | Branch (71:21): [True: 227k, False: 113k] ------------------ 72| 227k| transpose_64x64(m[i][j]); 73| 227k| } 74| 113k| } 75| | 76| 170k| for (i = 0; i < 2; i++) { ------------------ | Branch (76:17): [True: 113k, False: 56.8k] ------------------ 77| 341k| for (j = 0; j < 2; j++) { ------------------ | Branch (77:21): [True: 227k, False: 113k] ------------------ 78| 14.7M| for (k = 0; k < 64; k++) { ------------------ | Branch (78:25): [True: 14.5M, False: 227k] ------------------ 79| 14.5M| in[64 * i + k][j] = m[i][j][k]; 80| 14.5M| } 81| 227k| } 82| 113k| } 83| 56.8k|} fft.c:transpose_64x256_sp: 31| 40.9k|static inline void transpose_64x256_sp(vec256 *in) { 32| 40.9k| transpose_64x256_sp_asm(in); ------------------ | | 10| 40.9k|#define transpose_64x256_sp_asm CRYPTO_NAMESPACE(transpose_64x256_sp_asm) | | ------------------ | | | | 4| 40.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 33| 40.9k|} benes.c:transpose_64x128_sp: 25| 10.2k|static inline void transpose_64x128_sp(vec128 *in) { 26| 10.2k| transpose_64x128_sp_asm(in); ------------------ | | 9| 10.2k|#define transpose_64x128_sp_asm CRYPTO_NAMESPACE(transpose_64x128_sp_asm) | | ------------------ | | | | 4| 10.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 27| 10.2k|} benes.c:load16: 100| 305k|static inline vec128 load16(const unsigned char *in) { 101| 305k| return vec128_set2x( load8(in), load8(in + 8) ); 102| 305k|} PQCLEAN_MCELIECE460896_AVX2_vec128_mul_GF: 6| 107k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 107k| int i, j; 8| 107k| uint64_t buf[GFBITS][3]; 9| 107k| vec128 prod[GFBITS]; 10| 107k| uint64_t p[GFBITS]; 11| | 12| 107k| const uint64_t allone = -1; 13| | 14| | // polynomial multiplication 15| | 16| 1.51M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.51M|#define GFBITS 13 ------------------ | Branch (16:17): [True: 1.40M, False: 107k] ------------------ 17| 1.40M| buf[i][0] = 0; 18| 1.40M| buf[i][1] = 0; 19| 1.40M| buf[i][2] = 0; 20| 1.40M| } 21| | 22| 10.4M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 107k|#define SYS_T 96 ------------------ | Branch (22:25): [True: 10.3M, False: 107k] ------------------ 23| 145M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 145M|#define GFBITS 13 ------------------ | Branch (23:21): [True: 134M, False: 10.3M] ------------------ 24| 134M| buf[j][2] <<= 1; 25| 134M| buf[j][2] |= buf[j][1] >> 63; 26| 134M| buf[j][1] <<= 1; 27| 134M| buf[j][1] |= buf[j][0] >> 63; 28| 134M| buf[j][0] <<= 1; 29| 134M| } 30| | 31| 10.3M| vec128_mul_gf(prod, v, a[i]); 32| | 33| 145M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 145M|#define GFBITS 13 ------------------ | Branch (33:21): [True: 134M, False: 10.3M] ------------------ 34| 134M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 134M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 35| 134M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 134M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 134M| } 37| 10.3M| } 38| | 39| | // reduction modulo y^96+y^10+y^9+y^6+1 40| | 41| 1.51M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.51M|#define GFBITS 13 ------------------ | Branch (41:17): [True: 1.40M, False: 107k] ------------------ 42| 1.40M| p[i] = buf[i][2]; 43| | 44| 1.40M| buf[i][1] ^= p[i] >> (SYS_T - 10 - 64); ------------------ | | 8| 1.40M|#define SYS_T 96 ------------------ 45| 1.40M| buf[i][0] ^= p[i] << (64 - (SYS_T - 10 - 64)); ------------------ | | 8| 1.40M|#define SYS_T 96 ------------------ 46| 1.40M| buf[i][1] ^= p[i] >> (SYS_T - 9 - 64); ------------------ | | 8| 1.40M|#define SYS_T 96 ------------------ 47| 1.40M| buf[i][0] ^= p[i] << (64 - (SYS_T - 9 - 64)); ------------------ | | 8| 1.40M|#define SYS_T 96 ------------------ 48| 1.40M| buf[i][1] ^= p[i] >> (SYS_T - 6 - 64); ------------------ | | 8| 1.40M|#define SYS_T 96 ------------------ 49| 1.40M| buf[i][0] ^= p[i] << (64 - (SYS_T - 6 - 64)); ------------------ | | 8| 1.40M|#define SYS_T 96 ------------------ 50| 1.40M| buf[i][1] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 1.40M|#define SYS_T 96 ------------------ 51| 1.40M| buf[i][0] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 1.40M|#define SYS_T 96 ------------------ 52| 1.40M| } 53| | 54| | // 55| | 56| 1.51M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.51M|#define GFBITS 13 ------------------ | Branch (56:17): [True: 1.40M, False: 107k] ------------------ 57| 1.40M| p[i] = buf[i][1] & (allone << 32); 58| | 59| 1.40M| buf[i][0] ^= p[i] >> (SYS_T - 10 - 64); ------------------ | | 8| 1.40M|#define SYS_T 96 ------------------ 60| 1.40M| buf[i][0] ^= p[i] >> (SYS_T - 9 - 64); ------------------ | | 8| 1.40M|#define SYS_T 96 ------------------ 61| 1.40M| buf[i][0] ^= p[i] >> (SYS_T - 6 - 64); ------------------ | | 8| 1.40M|#define SYS_T 96 ------------------ 62| 1.40M| buf[i][0] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 1.40M|#define SYS_T 96 ------------------ 63| 1.40M| } 64| | 65| | // 66| | 67| 1.51M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.51M|#define GFBITS 13 ------------------ | Branch (67:17): [True: 1.40M, False: 107k] ------------------ 68| 1.40M| out[i] = vec128_set2x(buf[i][0], buf[i][1] & 0xFFFFFFFF); 69| 1.40M| } 70| 107k|} pk_gen.c:vec128_set2x: 46| 56.8k|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 56.8k| return _mm_set_epi64x(a1, a0); 48| 56.8k|} sk_gen.c:vec128_setzero: 25| 109k|static inline vec128 vec128_setzero(void) { 26| 109k| return _mm_setzero_si128(); 27| 109k|} sk_gen.c:vec128_xor: 35| 771M|static inline vec128 vec128_xor(vec128 a, vec128 b) { 36| 771M| return _mm_xor_si128(a, b); 37| 771M|} sk_gen.c:vec128_set2x: 46| 807M|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 807M| return _mm_set_epi64x(a1, a0); 48| 807M|} sk_gen.c:vec128_add: 70| 59.3M|static inline void vec128_add(vec128 *c, vec128 *a, vec128 *b) { 71| 59.3M| int i; 72| | 73| 830M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 830M|#define GFBITS 13 ------------------ | Branch (73:17): [True: 771M, False: 59.3M] ------------------ 74| 771M| c[i] = vec128_xor(a[i], b[i]); 75| 771M| } 76| 59.3M|} sk_gen.c:vec128_mul: 93| 59.8M|static inline void vec128_mul(vec128 *h, vec128 *f, const vec128 *g) { 94| 59.8M| vec128_mul_asm(h, f, g, 16); ------------------ | | 10| 59.8M|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 59.8M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 95| 59.8M|} sk_gen.c:vec128_mul_gf: 97| 59.8M|static inline void vec128_mul_gf(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a) { 98| 59.8M| int i; 99| | 100| 59.8M| uint64_t b; 101| 59.8M| vec128 bits[GFBITS]; 102| | 103| 838M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 838M|#define GFBITS 13 ------------------ | Branch (103:17): [True: 778M, False: 59.8M] ------------------ 104| 778M| b = -((a >> i) & 1); 105| 778M| bits[i] = vec128_set2x(b, b); 106| 778M| } 107| | 108| 59.8M| vec128_mul(out, v, bits); 109| 59.8M|} vec128.c:vec128_mul_gf: 97| 59.3M|static inline void vec128_mul_gf(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a) { 98| 59.3M| int i; 99| | 100| 59.3M| uint64_t b; 101| 59.3M| vec128 bits[GFBITS]; 102| | 103| 830M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 830M|#define GFBITS 13 ------------------ | Branch (103:17): [True: 771M, False: 59.3M] ------------------ 104| 771M| b = -((a >> i) & 1); 105| 771M| bits[i] = vec128_set2x(b, b); 106| 771M| } 107| | 108| 59.3M| vec128_mul(out, v, bits); 109| 59.3M|} vec128.c:vec128_mul: 93| 59.3M|static inline void vec128_mul(vec128 *h, vec128 *f, const vec128 *g) { 94| 59.3M| vec128_mul_asm(h, f, g, 16); ------------------ | | 10| 59.3M|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 59.3M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 95| 59.3M|} vec128.c:vec128_set2x: 46| 778M|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 778M| return _mm_set_epi64x(a1, a0); 48| 778M|} fft.c:vec128_and: 31| 2.27M|static inline vec128 vec128_and(vec128 a, vec128 b) { 32| 2.27M| return _mm_and_si128(a, b); 33| 2.27M|} fft.c:vec128_xor: 35| 2.27M|static inline vec128 vec128_xor(vec128 a, vec128 b) { 36| 2.27M| return _mm_xor_si128(a, b); 37| 2.27M|} fft.c:vec128_set2x: 46| 1.19M|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 1.19M| return _mm_set_epi64x(a1, a0); 48| 1.19M|} fft.c:vec128_unpack_low: 50| 379k|static inline vec128 vec128_unpack_low(vec128 a, vec128 b) { 51| 379k| return _mm_unpacklo_epi64(a, b); 52| 379k|} fft.c:vec128_unpack_high: 54| 379k|static inline vec128 vec128_unpack_high(vec128 a, vec128 b) { 55| 379k| return _mm_unpackhi_epi64(a, b); 56| 379k|} fft.c:vec128_mul: 93| 52.5k|static inline void vec128_mul(vec128 *h, vec128 *f, const vec128 *g) { 94| 52.5k| vec128_mul_asm(h, f, g, 16); ------------------ | | 10| 52.5k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 52.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 95| 52.5k|} fft_tr.c:vec128_xor: 35| 95.5k|static inline vec128 vec128_xor(vec128 a, vec128 b) { 36| 95.5k| return _mm_xor_si128(a, b); 37| 95.5k|} fft_tr.c:vec128_setbits: 58| 114k|static inline vec128 vec128_setbits(uint64_t a) { 59| 114k| return _mm_set1_epi64x(-a); 60| 114k|} benes.c:vec128_and: 31| 1.17M|static inline vec128 vec128_and(vec128 a, vec128 b) { 32| 1.17M| return _mm_and_si128(a, b); 33| 1.17M|} benes.c:vec128_xor: 35| 3.52M|static inline vec128 vec128_xor(vec128 a, vec128 b) { 36| 3.52M| return _mm_xor_si128(a, b); 37| 3.52M|} benes.c:vec128_set2x: 46| 588k|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 588k| return _mm_set_epi64x(a1, a0); 48| 588k|} benes.c:vec128_unpack_low: 50| 329k|static inline vec128 vec128_unpack_low(vec128 a, vec128 b) { 51| 329k| return _mm_unpacklo_epi64(a, b); 52| 329k|} benes.c:vec128_unpack_high: 54| 329k|static inline vec128 vec128_unpack_high(vec128 a, vec128 b) { 55| 329k| return _mm_unpackhi_epi64(a, b); 56| 329k|} bm.c:vec128_xor: 35| 2.23M|static inline vec128 vec128_xor(vec128 a, vec128 b) { 36| 2.23M| return _mm_xor_si128(a, b); 37| 2.23M|} bm.c:vec128_set2x: 46| 6.25k|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 6.25k| return _mm_set_epi64x(a1, a0); 48| 6.25k|} bm.c:vec128_setbits: 58| 4.47M|static inline vec128 vec128_setbits(uint64_t a) { 59| 4.47M| return _mm_set1_epi64x(-a); 60| 4.47M|} PQCLEAN_MCELIECE460896_AVX2_vec256_sq: 9| 18.4k|void vec256_sq(vec256 *out, vec256 *in) { 10| 18.4k| int i; 11| 18.4k| vec256 result[GFBITS], t; 12| | 13| 18.4k| t = vec256_xor(in[11], in[12]); 14| | 15| 18.4k| result[0] = vec256_xor(in[0], in[11]); 16| 18.4k| result[1] = vec256_xor(in[7], t); 17| 18.4k| result[2] = vec256_xor(in[1], in[7]); 18| 18.4k| result[3] = vec256_xor(in[8], t); 19| 18.4k| result[4] = vec256_xor(in[2], in[7]); 20| 18.4k| result[4] = vec256_xor(result[4], in[8]); 21| 18.4k| result[4] = vec256_xor(result[4], t); 22| 18.4k| result[5] = vec256_xor(in[7], in[9]); 23| 18.4k| result[6] = vec256_xor(in[3], in[8]); 24| 18.4k| result[6] = vec256_xor(result[6], in[9]); 25| 18.4k| result[6] = vec256_xor(result[6], in[12]); 26| 18.4k| result[7] = vec256_xor(in[8], in[10]); 27| 18.4k| result[8] = vec256_xor(in[4], in[9]); 28| 18.4k| result[8] = vec256_xor(result[8], in[10]); 29| 18.4k| result[9] = vec256_xor(in[9], in[11]); 30| 18.4k| result[10] = vec256_xor(in[5], in[10]); 31| 18.4k| result[10] = vec256_xor(result[10], in[11]); 32| 18.4k| result[11] = vec256_xor(in[10], in[12]); 33| 18.4k| result[12] = vec256_xor(in[6], t); 34| | 35| 258k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 258k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 240k, False: 18.4k] ------------------ 36| 240k| out[i] = result[i]; 37| 240k| } 38| 18.4k|} PQCLEAN_MCELIECE460896_AVX2_vec256_inv: 41| 1.24k|void vec256_inv(vec256 *out, vec256 *in) { 42| 1.24k| vec256 tmp_11[ GFBITS ]; 43| 1.24k| vec256 tmp_1111[ GFBITS ]; 44| | 45| 1.24k| vec256_copy(out, in); 46| | 47| 1.24k| vec256_sq(out, out); ------------------ | | 14| 1.24k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.24k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 48| 1.24k| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 1.24k| vec256_sq(out, tmp_11); ------------------ | | 14| 1.24k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.24k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 51| 1.24k| vec256_sq(out, out); ------------------ | | 14| 1.24k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.24k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 52| 1.24k| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 1.24k| vec256_sq(out, tmp_1111); ------------------ | | 14| 1.24k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.24k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 55| 1.24k| vec256_sq(out, out); ------------------ | | 14| 1.24k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.24k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 56| 1.24k| vec256_sq(out, out); ------------------ | | 14| 1.24k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.24k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 57| 1.24k| vec256_sq(out, out); ------------------ | | 14| 1.24k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.24k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 58| 1.24k| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 1.24k| vec256_sq(out, out); ------------------ | | 14| 1.24k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.24k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 61| 1.24k| vec256_sq(out, out); ------------------ | | 14| 1.24k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.24k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 62| 1.24k| vec256_sq(out, out); ------------------ | | 14| 1.24k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.24k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 63| 1.24k| vec256_sq(out, out); ------------------ | | 14| 1.24k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.24k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 64| 1.24k| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 1.24k| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 1.24k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.24k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 67| 1.24k|} vec256.c:vec256_xor: 49| 1.69M|static inline vec256 vec256_xor(vec256 a, vec256 b) { 50| 1.69M| return _mm256_xor_si256(a, b); 51| 1.69M|} decrypt.c:vec256_testz: 41| 735|static inline int vec256_testz(vec256 a) { 42| 735| return _mm256_testz_si256(a, a); 43| 735|} fft_tr.c:vec256_and: 45| 573k|static inline vec256 vec256_and(vec256 a, vec256 b) { 46| 573k| return _mm256_and_si256(a, b); 47| 573k|} bm.c:vec256_setzero: 30| 2.20k|static inline vec256 vec256_setzero(void) { 31| 2.20k| return _mm256_setzero_si256(); 32| 2.20k|} bm.c:vec256_set1_16b: 22| 5.88k|static inline vec256 vec256_set1_16b(uint16_t a) { 23| 5.88k| return _mm256_set1_epi16(a); 24| 5.88k|} bm.c:vec256_or: 53| 47.0k|static inline vec256 vec256_or(vec256 a, vec256 b) { 54| 47.0k| return _mm256_or_si256(a, b); 55| 47.0k|} bm.c:vec256_and: 45| 94.0k|static inline vec256 vec256_and(vec256 a, vec256 b) { 46| 94.0k| return _mm256_and_si256(a, b); 47| 94.0k|} bm.c:vec256_mul: 99| 172k|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 172k| vec256_mul_asm(h, f, g); ------------------ | | 13| 172k|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 172k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 101| 172k|} gf.c:gf_sqmul: 85| 1.01M|static inline gf gf_sqmul(gf in, gf m) { 86| 1.01M| int i; 87| | 88| 1.01M| uint64_t x; 89| 1.01M| uint64_t t0; 90| 1.01M| uint64_t t1; 91| 1.01M| uint64_t t; 92| | 93| 1.01M| const uint64_t M[] = {0x0000001FF0000000, 94| 1.01M| 0x000000000FF80000, 95| 1.01M| 0x000000000007E000 96| 1.01M| }; 97| | 98| 1.01M| t0 = in; 99| 1.01M| t1 = m; 100| | 101| 1.01M| x = (t1 << 6) * (t0 & (1 << 6)); 102| | 103| 1.01M| t0 ^= (t0 << 7); 104| | 105| 1.01M| x ^= (t1 * (t0 & (0x04001))); 106| 1.01M| x ^= (t1 * (t0 & (0x08002))) << 1; 107| 1.01M| x ^= (t1 * (t0 & (0x10004))) << 2; 108| 1.01M| x ^= (t1 * (t0 & (0x20008))) << 3; 109| 1.01M| x ^= (t1 * (t0 & (0x40010))) << 4; 110| 1.01M| x ^= (t1 * (t0 & (0x80020))) << 5; 111| | 112| 4.06M| for (i = 0; i < 3; i++) { ------------------ | Branch (112:17): [True: 3.05M, False: 1.01M] ------------------ 113| 3.05M| t = x & M[i]; 114| 3.05M| x ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 115| 3.05M| } 116| | 117| 1.01M| return x & GFMASK; ------------------ | | 19| 1.01M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.01M|#define GFBITS 13 | | ------------------ ------------------ 118| 1.01M|} gf.c:gf_sq2mul: 122| 1.52M|static inline gf gf_sq2mul(gf in, gf m) { 123| 1.52M| int i; 124| | 125| 1.52M| uint64_t x; 126| 1.52M| uint64_t t0; 127| 1.52M| uint64_t t1; 128| 1.52M| uint64_t t; 129| | 130| 1.52M| const uint64_t M[] = {0x1FF0000000000000, 131| 1.52M| 0x000FF80000000000, 132| 1.52M| 0x000007FC00000000, 133| 1.52M| 0x00000003FE000000, 134| 1.52M| 0x0000000001FE0000, 135| 1.52M| 0x000000000001E000 136| 1.52M| }; 137| | 138| 1.52M| t0 = in; 139| 1.52M| t1 = m; 140| | 141| 1.52M| x = (t1 << 18) * (t0 & (1 << 6)); 142| | 143| 1.52M| t0 ^= (t0 << 21); 144| | 145| 1.52M| x ^= (t1 * (t0 & (0x010000001))); 146| 1.52M| x ^= (t1 * (t0 & (0x020000002))) << 3; 147| 1.52M| x ^= (t1 * (t0 & (0x040000004))) << 6; 148| 1.52M| x ^= (t1 * (t0 & (0x080000008))) << 9; 149| 1.52M| x ^= (t1 * (t0 & (0x100000010))) << 12; 150| 1.52M| x ^= (t1 * (t0 & (0x200000020))) << 15; 151| | 152| 10.6M| for (i = 0; i < 6; i++) { ------------------ | Branch (152:17): [True: 9.15M, False: 1.52M] ------------------ 153| 9.15M| t = x & M[i]; 154| 9.15M| x ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 155| 9.15M| } 156| | 157| 1.52M| return x & GFMASK; ------------------ | | 19| 1.52M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.52M|#define GFBITS 13 | | ------------------ ------------------ 158| 1.52M|} gf.c:gf_sq2: 52| 1.01M|static inline gf gf_sq2(gf in) { 53| 1.01M| int i; 54| | 55| 1.01M| const uint64_t B[] = {0x1111111111111111, 56| 1.01M| 0x0303030303030303, 57| 1.01M| 0x000F000F000F000F, 58| 1.01M| 0x000000FF000000FF 59| 1.01M| }; 60| | 61| 1.01M| const uint64_t M[] = {0x0001FF0000000000, 62| 1.01M| 0x000000FF80000000, 63| 1.01M| 0x000000007FC00000, 64| 1.01M| 0x00000000003FE000 65| 1.01M| }; 66| | 67| 1.01M| uint64_t x = in; 68| 1.01M| uint64_t t; 69| | 70| 1.01M| x = (x | (x << 24)) & B[3]; 71| 1.01M| x = (x | (x << 12)) & B[2]; 72| 1.01M| x = (x | (x << 6)) & B[1]; 73| 1.01M| x = (x | (x << 3)) & B[0]; 74| | 75| 5.08M| for (i = 0; i < 4; i++) { ------------------ | Branch (75:17): [True: 4.06M, False: 1.01M] ------------------ 76| 4.06M| t = x & M[i]; 77| 4.06M| x ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 78| 4.06M| } 79| | 80| 1.01M| return x & GFMASK; ------------------ | | 19| 1.01M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.01M|#define GFBITS 13 | | ------------------ ------------------ 81| 1.01M|} PQCLEAN_MCELIECE460896F_AVX2_load_bits: 188| 85|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 85| int i, j; 190| 85| const unsigned char *ptr = bits; 191| | 192| 85| vec128 buf[64]; 193| | 194| 340| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 255, False: 85] ------------------ 195| 16.5k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 16.3k, False: 255] ------------------ 196| 16.3k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 16.3k| ptr += 8; 198| 16.3k| } 199| | 200| 255| transpose_64x128_sp( buf ); 201| | 202| 8.41k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 8.16k, False: 255] ------------------ 203| 8.16k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 8.16k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 8.16k| } 206| | 207| 255| ptr += 512; 208| 255| } 209| | 210| 1.19k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.10k, False: 85] ------------------ 211| 36.4k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 35.3k, False: 1.10k] ------------------ 212| 35.3k| bits_int[i][j] = load16(ptr); 213| 35.3k| ptr += 16; 214| 35.3k| } 215| 1.10k| } 216| | 217| 340| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 255, False: 85] ------------------ 218| 16.5k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 16.3k, False: 255] ------------------ 219| 16.3k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 16.3k| ptr += 8; 221| 16.3k| } 222| | 223| 255| transpose_64x128_sp( buf ); 224| | 225| 8.41k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 8.16k, False: 255] ------------------ 226| 8.16k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 8.16k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 8.16k| } 229| | 230| 255| ptr += 512; 231| 255| } 232| 85|} PQCLEAN_MCELIECE460896F_AVX2_benes: 238| 170|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 170| int inc; 240| | 241| 170| vec128 *b_ptr; 242| | 243| 170| if (rev == 0) { ------------------ | Branch (243:9): [True: 85, False: 85] ------------------ 244| 85| inc = 32; 245| 85| b_ptr = b[ 0]; 246| 85| } else { 247| 85| inc = -32; 248| 85| b_ptr = b[24]; 249| 85| } 250| | 251| | // 252| | 253| 170| transpose_64x128_sp( r ); 254| | 255| 170| layer_0(r, b_ptr); 256| 170| b_ptr += inc; 257| 170| layer_1(r, b_ptr); 258| 170| b_ptr += inc; 259| 170| layer_2(r, b_ptr); 260| 170| b_ptr += inc; 261| 170| layer_3(r, b_ptr); 262| 170| b_ptr += inc; 263| 170| layer_4(r, b_ptr); 264| 170| b_ptr += inc; 265| 170| layer_5(r, b_ptr); 266| 170| b_ptr += inc; 267| | 268| 170| transpose_64x128_sp( r ); 269| | 270| 170| layer_x(r, b_ptr); 271| 170| b_ptr += inc; 272| 170| layer_0(r, b_ptr); 273| 170| b_ptr += inc; 274| 170| layer_1(r, b_ptr); 275| 170| b_ptr += inc; 276| 170| layer_2(r, b_ptr); 277| 170| b_ptr += inc; 278| 170| layer_3(r, b_ptr); 279| 170| b_ptr += inc; 280| 170| layer_4(r, b_ptr); 281| 170| b_ptr += inc; 282| 170| layer_5(r, b_ptr); 283| 170| b_ptr += inc; 284| 170| layer_4(r, b_ptr); 285| 170| b_ptr += inc; 286| 170| layer_3(r, b_ptr); 287| 170| b_ptr += inc; 288| 170| layer_2(r, b_ptr); 289| 170| b_ptr += inc; 290| 170| layer_1(r, b_ptr); 291| 170| b_ptr += inc; 292| 170| layer_0(r, b_ptr); 293| 170| b_ptr += inc; 294| 170| layer_x(r, b_ptr); 295| 170| b_ptr += inc; 296| | 297| 170| transpose_64x128_sp( r ); 298| | 299| 170| layer_5(r, b_ptr); 300| 170| b_ptr += inc; 301| 170| layer_4(r, b_ptr); 302| 170| b_ptr += inc; 303| 170| layer_3(r, b_ptr); 304| 170| b_ptr += inc; 305| 170| layer_2(r, b_ptr); 306| 170| b_ptr += inc; 307| 170| layer_1(r, b_ptr); 308| 170| b_ptr += inc; 309| 170| layer_0(r, b_ptr); 310| | 311| 170| transpose_64x128_sp( r ); 312| 170|} PQCLEAN_MCELIECE460896F_AVX2_bm: 147| 85|void bm(vec128 *out, vec256 *in) { 148| 85| int i; 149| 85| uint16_t N, L; 150| 85| uint16_t mask; 151| 85| uint64_t one = 1; 152| 85| uint64_t v[2]; 153| | 154| 85| typedef union { 155| 85| vec128 v[GFBITS][2]; 156| 85| vec256 V[GFBITS]; 157| 85| } db_t; 158| | 159| 85| vec128 prod[ GFBITS ]; 160| 85| vec128 interval[GFBITS]; 161| | 162| 85| db_t db; 163| 85| db_t BC_tmp; 164| 85| db_t BC; 165| | 166| 85| gf d, b; 167| 85| gf coefs[256]; 168| | 169| | // initialization 170| | 171| 85| get_coefs(coefs, in); 172| | 173| 85| BC.v[0][0] = vec128_set2x(0, one << 62); 174| 85| BC.v[0][1] = vec128_set2x(0, one << 63); 175| | 176| 1.10k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.10k|#define GFBITS 13 ------------------ | Branch (176:17): [True: 1.02k, False: 85] ------------------ 177| 1.02k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 178| 1.02k| } 179| | 180| 85| b = 1; 181| 85| L = 0; 182| | 183| | // 184| | 185| 1.19k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.19k|#define GFBITS 13 ------------------ | Branch (185:17): [True: 1.10k, False: 85] ------------------ 186| 1.10k| interval[i] = vec128_setzero(); 187| 1.10k| } 188| | 189| 16.4k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 16.4k|#define SYS_T 96 ------------------ | Branch (189:17): [True: 16.3k, False: 85] ------------------ 190| 16.3k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 16.3k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 16.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 191| 16.3k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 16.3k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 16.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 192| | 193| 16.3k| d = vec_reduce_asm(prod); ------------------ | | 3| 16.3k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 16.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 194| | 195| 16.3k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 196| | 197| 228k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 228k|#define GFBITS 13 ------------------ | Branch (197:21): [True: 212k, False: 16.3k] ------------------ 198| 212k| db.v[i][0] = vec128_setbits((d >> i) & 1); 199| 212k| db.v[i][1] = vec128_setbits((b >> i) & 1); 200| 212k| } 201| | 202| 16.3k| vec256_mul((vec256 *)BC_tmp.V, (vec256 *)db.V, (vec256 *)BC.V); 203| | 204| 16.3k| vec128_cmov(BC.v, mask); 205| 16.3k| update_asm(BC.v, 0, 32); ------------------ | | 1| 16.3k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 16.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 228k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 228k|#define GFBITS 13 ------------------ | Branch (207:21): [True: 212k, False: 16.3k] ------------------ 208| 212k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 209| 212k| } 210| | 211| 16.3k| b = (d & mask) | (b & ~mask); 212| 16.3k| L = ((N + 1 - L) & mask) | (L & ~mask); 213| 16.3k| } 214| | 215| 1.19k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.19k|#define GFBITS 13 ------------------ | Branch (215:17): [True: 1.10k, False: 85] ------------------ 216| 1.10k| v[0] = vec128_extract(BC.v[i][1], 0); ------------------ | | 29| 1.10k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 217| 1.10k| v[1] = vec128_extract(BC.v[i][1], 1); ------------------ | | 29| 1.10k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 218| | 219| 1.10k| out[i] = vec128_set2x((v[0] >> 31) | (v[1] << 33), v[1] >> 31); 220| 1.10k| } 221| 85|} PQCLEAN_MCELIECE460896F_AVX2_controlbitsfrompermutation: 205| 85|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 85| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 85|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 85| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 85|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 85| int16 diff; 209| 85| int i; 210| 85| unsigned char *ptr; 211| | 212| 85| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 85| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 85| while (1) { ------------------ | Branch (215:12): [True: 85, Folded] ------------------ 216| 85| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 85| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 696k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 696k, False: 85] ------------------ 222| 696k| pi_test[i] = (int16)i; 223| 696k| } 224| | 225| 85| ptr = out; 226| 1.19k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.10k, False: 85] ------------------ 227| 1.10k| layer(pi_test, ptr, i, (int32)n); 228| 1.10k| ptr += n >> 4; 229| 1.10k| } 230| | 231| 1.10k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.02k, False: 85] ------------------ 232| 1.02k| layer(pi_test, ptr, i, (int32)n); 233| 1.02k| ptr += n >> 4; 234| 1.02k| } 235| | 236| 85| diff = 0; 237| 696k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 696k, False: 85] ------------------ 238| 696k| diff |= pi[i] ^ pi_test[i]; 239| 696k| } 240| | 241| 85| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 85|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 242| 85| crypto_declassify(&diff, sizeof diff); 243| 85| if (diff == 0) { ------------------ | Branch (243:13): [True: 85, False: 0] ------------------ 244| 85| break; 245| 85| } 246| 85| } 247| 85|} PQCLEAN_MCELIECE460896F_AVX2_crypto_int16_negative_mask: 3| 170|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 170| return crypto_int16_x >> 15; 5| 170|} PQCLEAN_MCELIECE460896F_AVX2_crypto_int16_nonzero_mask: 7| 85|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 85| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 85|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 85|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 9| 85|} PQCLEAN_MCELIECE460896F_AVX2_crypto_int32_negative_mask: 3| 54.3M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 54.3M| return crypto_int32_x >> 31; 5| 54.3M|} PQCLEAN_MCELIECE460896F_AVX2_crypto_int32_min: 37| 54.3M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 54.3M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 54.3M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 54.3M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 54.3M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 54.3M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 54.3M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 42| 54.3M| crypto_int32_z &= crypto_int32_xy; 43| 54.3M| return crypto_int32_x ^ crypto_int32_z; 44| 54.3M|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint16_signed_negative_mask: 3| 101k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 101k| return crypto_uint16_signed_x >> 15; 5| 101k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint16_nonzero_mask: 7| 9.50k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 9.50k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 9.50k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 9.50k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 9.50k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 9.50k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 9| 9.50k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint16_zero_mask: 11| 9.50k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 9.50k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 9.50k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 9.50k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 13| 9.50k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint16_smaller_mask: 24| 82.8k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 82.8k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 82.8k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 82.8k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 82.8k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 82.8k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 82.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 29| 82.8k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint32_signed_negative_mask: 3| 85.8k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 85.8k| return crypto_uint32_signed_x >> 31; 5| 85.8k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint32_nonzero_mask: 7| 42.9k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 42.9k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 42.9k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 42.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 42.9k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 42.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 9| 42.9k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint32_unequal_mask: 15| 42.9k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 42.9k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 42.9k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 42.9k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 42.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 18| 42.9k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint32_equal_mask: 20| 42.9k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 42.9k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 42.9k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 42.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 22| 42.9k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint64_signed_negative_mask: 3| 1.71M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 1.71M| return crypto_uint64_signed_x >> 63; 5| 1.71M|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint64_nonzero_mask: 7| 858k|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 858k| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 858k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 858k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 858k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 858k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 9| 858k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint64_zero_mask: 11| 108k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 108k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 108k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 108k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 13| 108k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint64_unequal_mask: 15| 749k|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 749k| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 749k| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 749k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 749k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 18| 749k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint64_equal_mask: 20| 749k|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 749k| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 749k|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 749k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 22| 749k|} PQCLEAN_MCELIECE460896F_AVX2_decrypt: 171| 85|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 85| int i; 173| | 174| 85| uint16_t check_synd; 175| 85| uint16_t check_weight; 176| | 177| 85| vec256 inv[ 32 ][ GFBITS ]; 178| 85| vec256 scaled[ 32 ][ GFBITS ]; 179| 85| vec256 eval[32][ GFBITS ]; 180| | 181| 85| vec128 error128[ 64 ]; 182| 85| vec256 error256[ 32 ]; 183| | 184| 85| vec256 s_priv[ GFBITS ]; 185| 85| vec256 s_priv_cmp[ GFBITS ]; 186| 85| vec128 locator[ GFBITS ]; 187| | 188| 85| vec128 recv128[ 64 ]; 189| 85| vec256 recv256[ 32 ]; 190| 85| vec256 allone; 191| | 192| 85| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 85| preprocess(recv128, s); 197| | 198| 85| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 85|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 85|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 85|#define SYS_T 96 | | ------------------ ------------------ 199| 85| benes(recv128, bits_int, 1); ------------------ | | 9| 85|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 85| reformat_128to256(recv256, recv128); 202| | 203| 85| scaling(scaled, inv, sk, recv256); 204| 85| fft_tr(s_priv, scaled); ------------------ | | 9| 85|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 205| 85| bm(locator, s_priv); ------------------ | | 10| 85|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 85| fft(eval, locator); ------------------ | | 10| 85|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 85| allone = vec256_set1_16b(0xFFFF); 212| | 213| 2.80k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 2.72k, False: 85] ------------------ 214| 2.72k| error256[i] = vec256_or_reduce(eval[i]); 215| 2.72k| error256[i] = vec256_xor(error256[i], allone); 216| 2.72k| } 217| | 218| 85| scaling_inv(scaled, inv, error256); 219| 85| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 85|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 85| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 85| reformat_256to128(error128, error256); 226| 85| benes(error128, bits_int, 0); ------------------ | | 9| 85|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 85| postprocess(e, error128); 229| | 230| 85| check_weight = weight_check(e, error128); 231| | 232| 85| return 1 - (check_synd & check_weight); 233| 85|} PQCLEAN_MCELIECE460896F_AVX2_encrypt: 112| 85|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 113| 85| gen_e(e); 114| | 115| 85| syndrome_asm(s, pk, e); ------------------ | | 1| 85|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 116| 85|} PQCLEAN_MCELIECE460896F_AVX2_fft: 265| 269|void fft(vec256 out[][GFBITS], vec128 *in) { 266| 269| radix_conversions(in); 267| 269| butterflies(out, in); 268| 269|} PQCLEAN_MCELIECE460896F_AVX2_fft_tr: 397| 170|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 398| 170| butterflies_tr(out, in); 399| 170| radix_conversions_tr(out); 400| | 401| 170| postprocess(out); 402| 170|} PQCLEAN_MCELIECE460896F_AVX2_gf_mul: 20| 912k|gf gf_mul(gf in0, gf in1) { 21| 912k| int i; 22| | 23| 912k| uint64_t tmp; 24| 912k| uint64_t t0; 25| 912k| uint64_t t1; 26| 912k| uint64_t t; 27| | 28| 912k| t0 = in0; 29| 912k| t1 = in1; 30| | 31| 912k| tmp = t0 * (t1 & 1); 32| | 33| 11.8M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 11.8M|#define GFBITS 13 ------------------ | Branch (33:17): [True: 10.9M, False: 912k] ------------------ 34| 10.9M| tmp ^= (t0 * (t1 & (1 << i))); 35| 10.9M| } 36| | 37| | // 38| | 39| 912k| t = tmp & 0x1FF0000; 40| 912k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 41| | 42| 912k| t = tmp & 0x000E000; 43| 912k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 44| | 45| 912k| return tmp & GFMASK; ------------------ | | 19| 912k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 912k|#define GFBITS 13 | | ------------------ ------------------ 46| 912k|} PQCLEAN_MCELIECE460896F_AVX2_gf_frac: 156| 9.50k|gf gf_frac(gf den, gf num) { 157| 9.50k| gf tmp_11; 158| 9.50k| gf tmp_1111; 159| 9.50k| gf out; 160| | 161| 9.50k| tmp_11 = gf_sqmul(den, den); // ^11 162| 9.50k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // ^1111 163| 9.50k| out = gf_sq2(tmp_1111); 164| 9.50k| out = gf_sq2mul(out, tmp_1111); // ^11111111 165| 9.50k| out = gf_sq2(out); 166| 9.50k| out = gf_sq2mul(out, tmp_1111); // ^111111111111 167| | 168| 9.50k| return gf_sqmul(out, num); // ^1111111111110 = ^-1 169| 9.50k|} PQCLEAN_MCELIECE460896F_AVX2_gf_inv: 172| 9.50k|gf gf_inv(gf den) { 173| 9.50k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 9.50k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 9.50k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 174| 9.50k|} pk_gen.c:PQCLEAN_MCELIECE460896F_AVX2_int32_sort: 21| 85|static void int32_sort(int32_t *x, long long n) { 22| 85| long long top, p, q, r, i; 23| | 24| 85| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 85] ------------------ 25| 0| return; 26| 0| } 27| 85| top = 1; 28| 935| while (top < n - top) { ------------------ | Branch (28:12): [True: 850, False: 85] ------------------ 29| 850| top += top; 30| 850| } 31| | 32| 1.02k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 935, False: 85] ------------------ 33| 993k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 992k, False: 935] ------------------ 34| 992k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 526k, False: 466k] ------------------ 35| 526k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 526k| do { \ | | 12| 526k| int32_t ab = (b) ^ (a); \ | | 13| 526k| int32_t c = (b) - (a); \ | | 14| 526k| c ^= ab & ((c) ^ (b)); \ | | 15| 526k| c >>= 31; \ | | 16| 526k| c &= ab; \ | | 17| 526k| (a) ^= c; \ | | 18| 526k| (b) ^= c; \ | | 19| 526k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 526k] | | ------------------ ------------------ 36| 526k| } 37| 992k| } 38| 935| i = 0; 39| 5.61k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 4.67k, False: 935] ------------------ 40| 891k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 886k, False: 4.67k] ------------------ 41| 886k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 466k, False: 420k] ------------------ 42| 466k| int32_t a = x[i + p]; 43| 2.64M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.17M, False: 466k] ------------------ 44| 2.17M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.17M| do { \ | | 12| 2.17M| int32_t ab = (b) ^ (a); \ | | 13| 2.17M| int32_t c = (b) - (a); \ | | 14| 2.17M| c ^= ab & ((c) ^ (b)); \ | | 15| 2.17M| c >>= 31; \ | | 16| 2.17M| c &= ab; \ | | 17| 2.17M| (a) ^= c; \ | | 18| 2.17M| (b) ^= c; \ | | 19| 2.17M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.17M] | | ------------------ ------------------ 45| 2.17M| } 46| 466k| x[i + p] = a; 47| 466k| } 48| 886k| } 49| 4.67k| } 50| 935| } 51| 85|} controlbits.c:PQCLEAN_MCELIECE460896F_AVX2_int32_sort: 21| 2.78M|static void int32_sort(int32_t *x, long long n) { 22| 2.78M| long long top, p, q, r, i; 23| | 24| 2.78M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 2.78M] ------------------ 25| 0| return; 26| 0| } 27| 2.78M| top = 1; 28| 9.76M| while (top < n - top) { ------------------ | Branch (28:12): [True: 6.97M, False: 2.78M] ------------------ 29| 6.97M| top += top; 30| 6.97M| } 31| | 32| 12.5M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 9.76M, False: 2.78M] ------------------ 33| 1.34G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.33G, False: 9.76M] ------------------ 34| 1.33G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 745M, False: 587M] ------------------ 35| 745M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 745M| do { \ | | 12| 745M| int32_t ab = (b) ^ (a); \ | | 13| 745M| int32_t c = (b) - (a); \ | | 14| 745M| c ^= ab & ((c) ^ (b)); \ | | 15| 745M| c >>= 31; \ | | 16| 745M| c &= ab; \ | | 17| 745M| (a) ^= c; \ | | 18| 745M| (b) ^= c; \ | | 19| 745M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 745M] | | ------------------ ------------------ 36| 745M| } 37| 1.33G| } 38| 9.76M| i = 0; 39| 26.5M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 16.7M, False: 9.76M] ------------------ 40| 1.19G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.17G, False: 16.7M] ------------------ 41| 1.17G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 587M, False: 587M] ------------------ 42| 587M| int32_t a = x[i + p]; 43| 3.48G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.89G, False: 587M] ------------------ 44| 2.89G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.89G| do { \ | | 12| 2.89G| int32_t ab = (b) ^ (a); \ | | 13| 2.89G| int32_t c = (b) - (a); \ | | 14| 2.89G| c ^= ab & ((c) ^ (b)); \ | | 15| 2.89G| c >>= 31; \ | | 16| 2.89G| c &= ab; \ | | 17| 2.89G| (a) ^= c; \ | | 18| 2.89G| (b) ^= c; \ | | 19| 2.89G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.89G] | | ------------------ ------------------ 45| 2.89G| } 46| 587M| x[i + p] = a; 47| 587M| } 48| 1.17G| } 49| 16.7M| } 50| 9.76M| } 51| 2.78M|} encrypt.c:PQCLEAN_MCELIECE460896F_AVX2_int32_sort: 21| 452|static void int32_sort(int32_t *x, long long n) { 22| 452| long long top, p, q, r, i; 23| | 24| 452| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 452] ------------------ 25| 0| return; 26| 0| } 27| 452| top = 1; 28| 3.16k| while (top < n - top) { ------------------ | Branch (28:12): [True: 2.71k, False: 452] ------------------ 29| 2.71k| top += top; 30| 2.71k| } 31| | 32| 3.61k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 3.16k, False: 452] ------------------ 33| 249k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 246k, False: 3.16k] ------------------ 34| 246k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 137k, False: 108k] ------------------ 35| 137k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 137k| do { \ | | 12| 137k| int32_t ab = (b) ^ (a); \ | | 13| 137k| int32_t c = (b) - (a); \ | | 14| 137k| c ^= ab & ((c) ^ (b)); \ | | 15| 137k| c >>= 31; \ | | 16| 137k| c &= ab; \ | | 17| 137k| (a) ^= c; \ | | 18| 137k| (b) ^= c; \ | | 19| 137k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 137k] | | ------------------ ------------------ 36| 137k| } 37| 246k| } 38| 3.16k| i = 0; 39| 12.6k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 9.49k, False: 3.16k] ------------------ 40| 212k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 203k, False: 9.49k] ------------------ 41| 203k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 108k, False: 94.4k] ------------------ 42| 108k| int32_t a = x[i + p]; 43| 426k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 317k, False: 108k] ------------------ 44| 317k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 317k| do { \ | | 12| 317k| int32_t ab = (b) ^ (a); \ | | 13| 317k| int32_t c = (b) - (a); \ | | 14| 317k| c ^= ab & ((c) ^ (b)); \ | | 15| 317k| c >>= 31; \ | | 16| 317k| c &= ab; \ | | 17| 317k| (a) ^= c; \ | | 18| 317k| (b) ^= c; \ | | 19| 317k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 317k] | | ------------------ ------------------ 45| 317k| } 46| 108k| x[i + p] = a; 47| 108k| } 48| 203k| } 49| 9.49k| } 50| 3.16k| } 51| 452|} PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_enc: 22| 85|) { 23| 85| unsigned char e[ SYS_N / 8 ]; 24| 85| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 85| encrypt(c, pk, e); ------------------ | | 9| 85|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 85| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 85|#define SYS_N 4608 ------------------ 31| 85| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 85|#define SYS_N 4608 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 85|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 85|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 85|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 85|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 85| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 85| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 85|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 85| return 0; 36| 85|} PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_dec: 42| 85|) { 43| 85| int i; 44| | 45| 85| unsigned char ret_decrypt = 0; 46| | 47| 85| uint16_t m; 48| | 49| 85| unsigned char e[ SYS_N / 8 ]; 50| 85| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 85| unsigned char *x = preimage; 52| 85| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 85|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 85|#define SYS_T 96 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 85|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 85|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 85|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 85| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 85|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 85| m = ret_decrypt; 59| 85| m -= 1; 60| 85| m >>= 8; 61| | 62| 85| *x++ = m & 1; 63| 49.0k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 49.0k|#define SYS_N 4608 ------------------ | Branch (63:17): [True: 48.9k, False: 85] ------------------ 64| 48.9k| *x++ = (~m & s[i]) | (m & e[i]); 65| 48.9k| } 66| | 67| 13.3k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 13.3k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 13.3k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 13.3k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 13.3k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 13.2k, False: 85] ------------------ 68| 13.2k| *x++ = c[i]; 69| 13.2k| } 70| | 71| 85| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 85| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 85|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 85| return 0; 74| 85|} PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_keypair: 80| 85|) { 81| 85| int i; 82| 85| unsigned char seed[ 33 ] = {64}; 83| 85| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 85| unsigned char *rp, *skp; 85| 85| uint64_t pivots; 86| | 87| 85| gf f[ SYS_T ]; // element in GF(2^mt) 88| 85| gf irr[ SYS_T ]; // Goppa polynomial 89| 85| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 90| 85| int16_t pi[ 1 << GFBITS ]; // random permutation 91| | 92| 85| randombytes(seed + 1, 32); ------------------ | | 8| 85|#define randombytes OQS_randombytes ------------------ 93| | 94| 99| while (1) { ------------------ | Branch (94:12): [True: 99, Folded] ------------------ 95| 99| rp = &r[ sizeof(r) - 32 ]; 96| 99| skp = sk; 97| | 98| | // expanding and updating the seed 99| | 100| 99| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 99| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 99|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 101| 99| memcpy(skp, seed + 1, 32); 102| 99| skp += 32 + 8; 103| 99| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 104| | 105| | // generating irreducible polynomial 106| | 107| 99| rp -= sizeof(f); 108| | 109| 9.60k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 9.60k|#define SYS_T 96 ------------------ | Branch (109:21): [True: 9.50k, False: 99] ------------------ 110| 9.50k| f[i] = load_gf(rp + i * 2); 111| 9.50k| } 112| | 113| 99| if (genpoly_gen(irr, f)) { ------------------ | | 9| 99|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ | Branch (113:13): [True: 0, False: 99] ------------------ 114| 0| continue; 115| 0| } 116| | 117| 9.60k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 9.60k|#define SYS_T 96 ------------------ | Branch (117:21): [True: 9.50k, False: 99] ------------------ 118| 9.50k| store_gf(skp + i * 2, irr[i]); 119| 9.50k| } 120| | 121| 99| skp += IRR_BYTES; ------------------ | | 11| 99|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 99|#define SYS_T 96 | | ------------------ ------------------ 122| | 123| | // generating permutation 124| | 125| 99| rp -= sizeof(perm); 126| | 127| 811k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 811k|#define GFBITS 13 ------------------ | Branch (127:21): [True: 811k, False: 99] ------------------ 128| 811k| perm[i] = load4(rp + i * 4); 129| 811k| } 130| | 131| 99| if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 9| 99|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 11| 99|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 99|#define SYS_T 96 | | ------------------ ------------------ | Branch (131:13): [True: 14, False: 85] ------------------ 132| 14| continue; 133| 14| } 134| | 135| 85| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 85|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 85|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 85|#define GFBITS 13 ------------------ 136| 85| skp += COND_BYTES; ------------------ | | 10| 85|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 85|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 85|#define GFBITS 13 | | ------------------ ------------------ 137| | 138| | // storing the random string s 139| | 140| 85| rp -= SYS_N / 8; ------------------ | | 7| 85|#define SYS_N 4608 ------------------ 141| 85| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 85|#define SYS_N 4608 ------------------ 142| | 143| | // storing positions of the 32 pivots 144| | 145| 85| store8(sk + 32, pivots); 146| | 147| 85| break; 148| 99| } 149| | 150| 85| return 0; 151| 85|} PQCLEAN_MCELIECE460896F_AVX2_pk_gen: 312| 99|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi, uint64_t *pivots) { 313| 99| int i, j, k, b; 314| 99| int row, c; 315| | 316| 99| union { 317| 99| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 318| 99| vec256 v[ PK_NROWS ][ nBlocks_I ]; 319| 99| } mat; 320| | 321| 99| union { 322| 99| uint64_t w[ PK_NROWS ][ 28 ]; 323| 99| vec256 v[ PK_NROWS ][ 7 ]; 324| 99| } par; 325| | 326| 99| uint64_t one = 1; 327| 99| uint64_t t; 328| 99| uint16_t m; 329| 99| vec256 mm; 330| | 331| 99| vec128 sk_int[ GFBITS ]; 332| | 333| 99| vec256 consts[ 32 ][ GFBITS ]; 334| 99| vec256 eval[ 32 ][ GFBITS ]; 335| 99| vec256 prod[ 32 ][ GFBITS ]; 336| 99| vec256 tmp[ GFBITS ]; 337| | 338| 99| uint64_t list[1 << GFBITS]; 339| | 340| 99| uint16_t ind[ PK_NROWS ]; 341| 99| uint16_t ind_inv[ PK_NROWS ]; 342| | 343| | // compute the inverses 344| | 345| 99| irr_load(sk_int, irr); 346| | 347| 99| fft(eval, sk_int); ------------------ | | 10| 99|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 348| | 349| 99| vec256_copy(prod[0], eval[0]); 350| | 351| 3.16k| for (i = 1; i < 32; i++) { ------------------ | Branch (351:17): [True: 3.06k, False: 99] ------------------ 352| 3.06k| vec256_mul(prod[i], prod[i - 1], eval[i]); 353| 3.06k| } 354| | 355| 99| vec256_inv(tmp, prod[31]); ------------------ | | 11| 99|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 356| | 357| 3.16k| for (i = 30; i >= 0; i--) { ------------------ | Branch (357:18): [True: 3.06k, False: 99] ------------------ 358| 3.06k| vec256_mul(prod[i + 1], prod[i], tmp); 359| 3.06k| vec256_mul(tmp, tmp, eval[i + 1]); 360| 3.06k| } 361| | 362| 99| vec256_copy(prod[0], tmp); 363| | 364| | // fill matrix 365| | 366| 99| de_bitslicing(list, prod); 367| | 368| 811k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 811k|#define GFBITS 13 ------------------ | Branch (368:17): [True: 811k, False: 99] ------------------ 369| 811k| list[i] <<= GFBITS; ------------------ | | 6| 811k|#define GFBITS 13 ------------------ 370| 811k| list[i] |= i; 371| 811k| list[i] |= ((uint64_t) perm[i]) << 31; 372| 811k| } 373| | 374| 99| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 99|#define GFBITS 13 ------------------ 375| | 376| 749k| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 749k|#define GFBITS 13 ------------------ | Branch (376:17): [True: 749k, False: 85] ------------------ 377| 749k| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (377:13): [True: 14, False: 749k] ------------------ 378| 14| return -1; 379| 14| } 380| 749k| } 381| | 382| 85| to_bitslicing_2x(consts, prod, list); 383| | 384| 696k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 696k|#define GFBITS 13 ------------------ | Branch (384:17): [True: 696k, False: 85] ------------------ 385| 696k| pi[i] = list[i] & GFMASK; ------------------ | | 19| 696k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 696k|#define GFBITS 13 | | ------------------ ------------------ 386| 696k| } 387| | 388| 510| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 510|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 510|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 510|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 510|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (388:17): [True: 425, False: 85] ------------------ 389| 5.95k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 5.95k|#define GFBITS 13 ------------------ | Branch (389:21): [True: 5.52k, False: 425] ------------------ 390| 5.52k| mat.v[ k ][ j ] = prod[ j ][ k ]; 391| 5.52k| } 392| 425| } 393| | 394| 8.16k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 8.16k|#define SYS_T 96 ------------------ | Branch (394:17): [True: 8.07k, False: 85] ------------------ 395| 48.4k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 48.4k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 48.4k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 48.4k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 48.4k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (395:21): [True: 40.3k, False: 8.07k] ------------------ 396| 40.3k| vec256_mul(prod[j], prod[j], consts[j]); 397| | 398| 565k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 565k|#define GFBITS 13 ------------------ | Branch (398:25): [True: 524k, False: 40.3k] ------------------ 399| 524k| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 524k|#define GFBITS 13 ------------------ 400| 524k| } 401| 40.3k| } 402| 8.07k| } 403| | 404| | // gaussian elimination to obtain L, U, and P such that LP M = U 405| | // L and U are stored in the space of M 406| | // P is stored in ind 407| | 408| 106k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 106k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 106k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 106k|#define GFBITS 13 | | ------------------ ------------------ | Branch (408:17): [True: 106k, False: 85] ------------------ 409| 106k| ind_inv[i] = ind[ i ] = i; 410| 106k| } 411| | 412| 106k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 106k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 106k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 106k|#define GFBITS 13 | | ------------------ ------------------ | Branch (412:19): [True: 106k, False: 85] ------------------ 413| 106k| i = row >> 6; 414| 106k| j = row & 63; 415| | 416| 106k| if (row == PK_NROWS - 32) { ------------------ | | 13| 106k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 106k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 106k|#define GFBITS 13 | | ------------------ ------------------ | Branch (416:13): [True: 85, False: 105k] ------------------ 417| 85| if (mov_columns(mat.w, pi, pivots)) { ------------------ | Branch (417:17): [True: 0, False: 85] ------------------ 418| 0| return -1; 419| 0| } 420| 85| } 421| | 422| 66.2M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 66.2M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 66.2M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 66.2M|#define GFBITS 13 | | ------------------ ------------------ | Branch (422:27): [True: 66.1M, False: 106k] ------------------ 423| 66.1M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 424| 66.1M| uint16_cswap(&ind[row], &ind[k], m); 425| | 426| 66.1M| mm = vec256_set1_16b(m); 427| 396M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 396M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 396M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 396M|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 396M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (427:25): [True: 330M, False: 66.1M] ------------------ 428| 330M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 429| 330M| } 430| 66.1M| } 431| | 432| 106k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (432:14): [True: 0, False: 106k] ------------------ 433| 0| return -1; 434| 0| } 435| | 436| 66.2M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 66.2M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 66.2M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 66.2M|#define GFBITS 13 | | ------------------ ------------------ | Branch (436:27): [True: 66.1M, False: 106k] ------------------ 437| 66.1M| t = mat.w[ k ][ i ] & (one << j); 438| 66.1M| mm = extract_mask256(mat.w[k], row); 439| | 440| 396M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 396M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 396M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 396M|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 396M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (440:25): [True: 330M, False: 66.1M] ------------------ 441| 330M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 442| 330M| } 443| | 444| 66.1M| mat.w[ k ][ i ] |= t; 445| 66.1M| } 446| 106k| } 447| | 448| | // apply M^-1 to the remaining columns 449| | 450| 85| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 85|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 85|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 85|#define GFBITS 13 | | ------------------ ------------------ 451| | 452| 255| for (j = 4; j < 18; j += par_width) { ------------------ | | 33| 170|#define par_width 7 ------------------ | Branch (452:17): [True: 170, False: 85] ------------------ 453| 2.38k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 2.38k|#define GFBITS 13 ------------------ | Branch (453:21): [True: 2.21k, False: 170] ------------------ 454| 17.6k| for (b = 0; b < par_width; b++) { ------------------ | | 33| 17.6k|#define par_width 7 ------------------ | Branch (454:25): [True: 15.4k, False: 2.21k] ------------------ 455| 15.4k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 456| 15.4k| } 457| 2.21k| } 458| | 459| 16.3k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 16.3k|#define SYS_T 96 ------------------ | Branch (459:21): [True: 16.1k, False: 170] ------------------ 460| 129k| for (b = 0; b < par_width; b++) { ------------------ | | 33| 129k|#define par_width 7 ------------------ | Branch (460:25): [True: 113k, False: 16.1k] ------------------ 461| 113k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 462| 113k| } 463| | 464| 226k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 226k|#define GFBITS 13 ------------------ | Branch (464:25): [True: 209k, False: 16.1k] ------------------ 465| 1.67M| for (b = 0; b < par_width; b++) { ------------------ | | 33| 1.67M|#define par_width 7 ------------------ | Branch (465:29): [True: 1.46M, False: 209k] ------------------ 466| 1.46M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 1.46M|#define GFBITS 13 ------------------ 467| 1.46M| } 468| 209k| } 469| 16.1k| } 470| | 471| | // apply P 472| | 473| 212k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 212k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 212k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 212k|#define GFBITS 13 | | ------------------ ------------------ | Branch (473:21): [True: 212k, False: 170] ------------------ 474| 212k| ind[i] = ind_inv[i]; 475| 212k| } 476| | 477| 170| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 170|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 170|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 170|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 170|#define GFBITS 13 | | ------------------ ------------------ 478| | 479| | // apply L 480| | 481| 212k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 170|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 170|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 170|#define GFBITS 13 | | ------------------ ------------------ | Branch (481:34): [True: 212k, False: 170] ------------------ 482| 132M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (482:31): [True: 132M, False: 212k] ------------------ 483| 132M| mm = extract_mask256(mat.w[row], i); 484| | 485| 1.05G| for (k = 0; k < par_width; k++) { ------------------ | | 33| 1.05G|#define par_width 7 ------------------ | Branch (485:29): [True: 925M, False: 132M] ------------------ 486| 925M| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 487| 925M| } 488| 132M| } 489| 212k| } 490| | 491| | // apply U^-1 492| | 493| 170| if (j == 4) { ------------------ | Branch (493:13): [True: 85, False: 85] ------------------ 494| 106k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 106k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 106k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 106k|#define GFBITS 13 | | ------------------ ------------------ | Branch (494:25): [True: 106k, False: 85] ------------------ 495| 106k| par.v[i][0] = mat.v[i][ nBlocks_I - 1 ]; ------------------ | | 32| 106k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 106k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 106k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 106k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 496| 106k| } 497| 85| } 498| | 499| 212k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 170|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 170|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 170|#define GFBITS 13 | | ------------------ ------------------ | Branch (499:34): [True: 212k, False: 170] ------------------ 500| 132M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 212k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 212k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 212k|#define GFBITS 13 | | ------------------ ------------------ | Branch (500:36): [True: 132M, False: 212k] ------------------ 501| 132M| mm = extract_mask256(mat.w[row], i); 502| | 503| 1.05G| for (k = 0; k < par_width; k++) { ------------------ | | 33| 1.05G|#define par_width 7 ------------------ | Branch (503:29): [True: 925M, False: 132M] ------------------ 504| 925M| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 505| 925M| } 506| 132M| } 507| 212k| } 508| | 509| 170| if (j == 4) { ------------------ | Branch (509:13): [True: 85, False: 85] ------------------ 510| 106k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 106k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 106k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 106k|#define GFBITS 13 | | ------------------ ------------------ | Branch (510:27): [True: 106k, False: 85] ------------------ 511| 106k| k = 3; 512| 106k| store_i(pk + PK_ROW_BYTES * row + j * 32 + k * 8 + 4 - 13 * 12, par.w[row][k] >> 32, 4); ------------------ | | 15| 106k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 106k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 106k|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 106k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 106k|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 106k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 513| | 514| 2.65M| for (k = 4; k < 28; k++) { ------------------ | Branch (514:29): [True: 2.54M, False: 106k] ------------------ 515| 2.54M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 12, par.w[row][k]); ------------------ | | 15| 2.54M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 2.54M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 2.54M|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 2.54M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 2.54M|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 2.54M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 516| 2.54M| } 517| 106k| } 518| 85| } else { 519| 106k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 106k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 106k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 106k|#define GFBITS 13 | | ------------------ ------------------ | Branch (519:27): [True: 106k, False: 85] ------------------ 520| 3.07M| for (k = 0; k < 28; k++) { ------------------ | Branch (520:29): [True: 2.97M, False: 106k] ------------------ 521| 2.97M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 12, par.w[row][k]); ------------------ | | 15| 2.97M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 2.97M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 2.97M|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 2.97M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 2.97M|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 2.97M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 522| 2.97M| } 523| 106k| } 524| 85| } 525| 170| } 526| | 527| | // 528| | 529| 85| return 0; 530| 85|} PQCLEAN_MCELIECE460896F_AVX2_genpoly_gen: 88| 99|int genpoly_gen(gf *out, gf *f) { 89| 99| int i, j, k; 90| | 91| 99| gf t, inv; 92| | 93| 99| uint64_t m; 94| 99| vec128 mask; 95| | 96| 99| union { 97| 99| uint64_t d[ GFBITS ][ 128 ][2]; 98| 99| vec128 v[ GFBITS ][ 128 ]; 99| 99| } buf; 100| | 101| 99| union { 102| 99| uint64_t d[GFBITS][2]; 103| 99| vec128 v[GFBITS]; 104| 99| } v; 105| | 106| 99| union { 107| 99| uint64_t d[SYS_T][GFBITS][2]; 108| 99| vec128 v[SYS_T][GFBITS]; 109| 99| } mat; 110| | 111| | // fill matrix 112| | 113| 99| buf.v[0][0] = vec128_set2x(1, 0); 114| 1.28k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.28k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 1.18k, False: 99] ------------------ 115| 1.18k| buf.v[i][0] = vec128_setzero(); 116| 1.18k| } 117| | 118| 1.38k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 1.38k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 1.28k, False: 99] ------------------ 119| 1.28k| v.v[j] = vec128_setzero(); 120| | 121| 124k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 1.28k|#define SYS_T 96 ------------------ | Branch (121:29): [True: 123k, False: 1.28k] ------------------ 122| 123k| v.d[j][1] <<= 1; 123| 123k| v.d[j][1] |= v.d[j][0] >> 63; 124| 123k| v.d[j][0] <<= 1; 125| 123k| v.d[j][0] |= (f[i] >> j) & 1; 126| 123k| } 127| 1.28k| } 128| | 129| 1.38k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.38k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 1.28k, False: 99] ------------------ 130| 1.28k| buf.v[i][1] = v.v[i]; 131| 1.28k| } 132| | 133| 9.50k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 9.50k|#define SYS_T 96 ------------------ | Branch (133:17): [True: 9.40k, False: 99] ------------------ 134| 9.40k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 9.40k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 9.40k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 9.40k| if (k < SYS_T) { ------------------ | | 8| 9.40k|#define SYS_T 96 ------------------ | Branch (136:13): [True: 9.30k, False: 99] ------------------ 137| 130k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 130k|#define GFBITS 13 ------------------ | Branch (137:25): [True: 120k, False: 9.30k] ------------------ 138| 120k| buf.v[i][k] = v.v[i]; 139| 120k| } 140| 9.30k| } else { 141| 9.60k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 9.60k|#define SYS_T 96 ------------------ | Branch (141:25): [True: 9.50k, False: 99] ------------------ 142| 9.50k| out[i] = extract_gf(v.d, i); 143| 9.50k| } 144| 99| } 145| 9.40k| } 146| | 147| 1.38k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.38k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 1.28k, False: 99] ------------------ 148| 1.28k| transpose_128x128(buf.d[i]); 149| 1.28k| } 150| | 151| 9.60k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 9.60k|#define SYS_T 96 ------------------ | Branch (151:17): [True: 9.50k, False: 99] ------------------ 152| 133k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 133k|#define GFBITS 13 ------------------ | Branch (152:21): [True: 123k, False: 9.50k] ------------------ 153| 123k| mat.v[j][i] = buf.v[i][j]; 154| 123k| } 155| 9.50k| } 156| | 157| | // gaussian 158| | 159| 9.60k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 9.60k|#define SYS_T 96 ------------------ | Branch (159:17): [True: 9.50k, False: 99] ------------------ 160| 460k| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 460k|#define SYS_T 96 ------------------ | Branch (160:25): [True: 451k, False: 9.50k] ------------------ 161| 451k| m = extract_bit(mat.d[i], i); 162| 451k| m -= 1; 163| 451k| mask = vec128_set2x(m, m); 164| | 165| 6.32M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 6.32M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 5.86M, False: 451k] ------------------ 166| 5.86M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 5.86M| } 168| | 169| 451k| out[i] ^= out[j] & m; 170| 451k| } 171| | 172| | // 173| | 174| 9.50k| t = extract_gf(mat.d[i], i); 175| | 176| 9.50k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 9.50k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 9.50k| inv = gf_inv(t); ------------------ | | 11| 9.50k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 9.50k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 183| 9.50k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 9.50k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 9.50k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 9.50k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 921k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 921k|#define SYS_T 96 ------------------ | Branch (187:21): [True: 912k, False: 9.50k] ------------------ 188| 912k| if (j != i) { ------------------ | Branch (188:17): [True: 902k, False: 9.50k] ------------------ 189| 902k| t = extract_gf(mat.d[j], i); 190| | 191| 902k| vec128_mul_gf(v.v, mat.v[i], t); 192| 902k| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 902k| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 902k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 902k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 195| 902k| } 196| 912k| } 197| 9.50k| } 198| | 199| 99| return 0; 200| 99|} PQCLEAN_MCELIECE460896F_AVX2_vec128_mul_GF: 6| 9.40k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 9.40k| int i, j; 8| 9.40k| uint64_t buf[GFBITS][3]; 9| 9.40k| vec128 prod[GFBITS]; 10| 9.40k| uint64_t p[GFBITS]; 11| | 12| 9.40k| const uint64_t allone = -1; 13| | 14| | // polynomial multiplication 15| | 16| 131k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 131k|#define GFBITS 13 ------------------ | Branch (16:17): [True: 122k, False: 9.40k] ------------------ 17| 122k| buf[i][0] = 0; 18| 122k| buf[i][1] = 0; 19| 122k| buf[i][2] = 0; 20| 122k| } 21| | 22| 912k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 9.40k|#define SYS_T 96 ------------------ | Branch (22:25): [True: 902k, False: 9.40k] ------------------ 23| 12.6M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 12.6M|#define GFBITS 13 ------------------ | Branch (23:21): [True: 11.7M, False: 902k] ------------------ 24| 11.7M| buf[j][2] <<= 1; 25| 11.7M| buf[j][2] |= buf[j][1] >> 63; 26| 11.7M| buf[j][1] <<= 1; 27| 11.7M| buf[j][1] |= buf[j][0] >> 63; 28| 11.7M| buf[j][0] <<= 1; 29| 11.7M| } 30| | 31| 902k| vec128_mul_gf(prod, v, a[i]); 32| | 33| 12.6M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 12.6M|#define GFBITS 13 ------------------ | Branch (33:21): [True: 11.7M, False: 902k] ------------------ 34| 11.7M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 11.7M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 35| 11.7M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 11.7M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 11.7M| } 37| 902k| } 38| | 39| | // reduction modulo y^96+y^10+y^9+y^6+1 40| | 41| 131k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 131k|#define GFBITS 13 ------------------ | Branch (41:17): [True: 122k, False: 9.40k] ------------------ 42| 122k| p[i] = buf[i][2]; 43| | 44| 122k| buf[i][1] ^= p[i] >> (SYS_T - 10 - 64); ------------------ | | 8| 122k|#define SYS_T 96 ------------------ 45| 122k| buf[i][0] ^= p[i] << (64 - (SYS_T - 10 - 64)); ------------------ | | 8| 122k|#define SYS_T 96 ------------------ 46| 122k| buf[i][1] ^= p[i] >> (SYS_T - 9 - 64); ------------------ | | 8| 122k|#define SYS_T 96 ------------------ 47| 122k| buf[i][0] ^= p[i] << (64 - (SYS_T - 9 - 64)); ------------------ | | 8| 122k|#define SYS_T 96 ------------------ 48| 122k| buf[i][1] ^= p[i] >> (SYS_T - 6 - 64); ------------------ | | 8| 122k|#define SYS_T 96 ------------------ 49| 122k| buf[i][0] ^= p[i] << (64 - (SYS_T - 6 - 64)); ------------------ | | 8| 122k|#define SYS_T 96 ------------------ 50| 122k| buf[i][1] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 122k|#define SYS_T 96 ------------------ 51| 122k| buf[i][0] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 122k|#define SYS_T 96 ------------------ 52| 122k| } 53| | 54| | // 55| | 56| 131k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 131k|#define GFBITS 13 ------------------ | Branch (56:17): [True: 122k, False: 9.40k] ------------------ 57| 122k| p[i] = buf[i][1] & (allone << 32); 58| | 59| 122k| buf[i][0] ^= p[i] >> (SYS_T - 10 - 64); ------------------ | | 8| 122k|#define SYS_T 96 ------------------ 60| 122k| buf[i][0] ^= p[i] >> (SYS_T - 9 - 64); ------------------ | | 8| 122k|#define SYS_T 96 ------------------ 61| 122k| buf[i][0] ^= p[i] >> (SYS_T - 6 - 64); ------------------ | | 8| 122k|#define SYS_T 96 ------------------ 62| 122k| buf[i][0] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 122k|#define SYS_T 96 ------------------ 63| 122k| } 64| | 65| | // 66| | 67| 131k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 131k|#define GFBITS 13 ------------------ | Branch (67:17): [True: 122k, False: 9.40k] ------------------ 68| 122k| out[i] = vec128_set2x(buf[i][0], buf[i][1] & 0xFFFFFFFF); 69| 122k| } 70| 9.40k|} PQCLEAN_MCELIECE460896F_AVX2_vec256_sq: 9| 4.92k|void vec256_sq(vec256 *out, vec256 *in) { 10| 4.92k| int i; 11| 4.92k| vec256 result[GFBITS], t; 12| | 13| 4.92k| t = vec256_xor(in[11], in[12]); 14| | 15| 4.92k| result[0] = vec256_xor(in[0], in[11]); 16| 4.92k| result[1] = vec256_xor(in[7], t); 17| 4.92k| result[2] = vec256_xor(in[1], in[7]); 18| 4.92k| result[3] = vec256_xor(in[8], t); 19| 4.92k| result[4] = vec256_xor(in[2], in[7]); 20| 4.92k| result[4] = vec256_xor(result[4], in[8]); 21| 4.92k| result[4] = vec256_xor(result[4], t); 22| 4.92k| result[5] = vec256_xor(in[7], in[9]); 23| 4.92k| result[6] = vec256_xor(in[3], in[8]); 24| 4.92k| result[6] = vec256_xor(result[6], in[9]); 25| 4.92k| result[6] = vec256_xor(result[6], in[12]); 26| 4.92k| result[7] = vec256_xor(in[8], in[10]); 27| 4.92k| result[8] = vec256_xor(in[4], in[9]); 28| 4.92k| result[8] = vec256_xor(result[8], in[10]); 29| 4.92k| result[9] = vec256_xor(in[9], in[11]); 30| 4.92k| result[10] = vec256_xor(in[5], in[10]); 31| 4.92k| result[10] = vec256_xor(result[10], in[11]); 32| 4.92k| result[11] = vec256_xor(in[10], in[12]); 33| 4.92k| result[12] = vec256_xor(in[6], t); 34| | 35| 68.9k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 68.9k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 64.0k, False: 4.92k] ------------------ 36| 64.0k| out[i] = result[i]; 37| 64.0k| } 38| 4.92k|} PQCLEAN_MCELIECE460896F_AVX2_vec256_inv: 41| 184|void vec256_inv(vec256 *out, vec256 *in) { 42| 184| vec256 tmp_11[ GFBITS ]; 43| 184| vec256 tmp_1111[ GFBITS ]; 44| | 45| 184| vec256_copy(out, in); 46| | 47| 184| vec256_sq(out, out); ------------------ | | 14| 184|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 184|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 48| 184| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 184| vec256_sq(out, tmp_11); ------------------ | | 14| 184|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 184|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 51| 184| vec256_sq(out, out); ------------------ | | 14| 184|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 184|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 52| 184| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 184| vec256_sq(out, tmp_1111); ------------------ | | 14| 184|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 184|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 55| 184| vec256_sq(out, out); ------------------ | | 14| 184|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 184|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 56| 184| vec256_sq(out, out); ------------------ | | 14| 184|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 184|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 57| 184| vec256_sq(out, out); ------------------ | | 14| 184|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 184|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 58| 184| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 184| vec256_sq(out, out); ------------------ | | 14| 184|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 184|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 61| 184| vec256_sq(out, out); ------------------ | | 14| 184|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 184|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 62| 184| vec256_sq(out, out); ------------------ | | 14| 184|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 184|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 63| 184| vec256_sq(out, out); ------------------ | | 14| 184|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 184|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 64| 184| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 184| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 184|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 184|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 67| 184|} PQCLEAN_MCELIECE6688128_AVX2_load_bits: 188| 99|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 99| int i, j; 190| 99| const unsigned char *ptr = bits; 191| | 192| 99| vec128 buf[64]; 193| | 194| 396| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 297, False: 99] ------------------ 195| 19.3k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 19.0k, False: 297] ------------------ 196| 19.0k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 19.0k| ptr += 8; 198| 19.0k| } 199| | 200| 297| transpose_64x128_sp( buf ); 201| | 202| 9.80k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 9.50k, False: 297] ------------------ 203| 9.50k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 9.50k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 9.50k| } 206| | 207| 297| ptr += 512; 208| 297| } 209| | 210| 1.38k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.28k, False: 99] ------------------ 211| 42.4k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 41.1k, False: 1.28k] ------------------ 212| 41.1k| bits_int[i][j] = load16(ptr); 213| 41.1k| ptr += 16; 214| 41.1k| } 215| 1.28k| } 216| | 217| 396| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 297, False: 99] ------------------ 218| 19.3k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 19.0k, False: 297] ------------------ 219| 19.0k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 19.0k| ptr += 8; 221| 19.0k| } 222| | 223| 297| transpose_64x128_sp( buf ); 224| | 225| 9.80k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 9.50k, False: 297] ------------------ 226| 9.50k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 9.50k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 9.50k| } 229| | 230| 297| ptr += 512; 231| 297| } 232| 99|} PQCLEAN_MCELIECE6688128_AVX2_benes: 238| 198|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 198| int inc; 240| | 241| 198| vec128 *b_ptr; 242| | 243| 198| if (rev == 0) { ------------------ | Branch (243:9): [True: 99, False: 99] ------------------ 244| 99| inc = 32; 245| 99| b_ptr = b[ 0]; 246| 99| } else { 247| 99| inc = -32; 248| 99| b_ptr = b[24]; 249| 99| } 250| | 251| | // 252| | 253| 198| transpose_64x128_sp( r ); 254| | 255| 198| layer_0(r, b_ptr); 256| 198| b_ptr += inc; 257| 198| layer_1(r, b_ptr); 258| 198| b_ptr += inc; 259| 198| layer_2(r, b_ptr); 260| 198| b_ptr += inc; 261| 198| layer_3(r, b_ptr); 262| 198| b_ptr += inc; 263| 198| layer_4(r, b_ptr); 264| 198| b_ptr += inc; 265| 198| layer_5(r, b_ptr); 266| 198| b_ptr += inc; 267| | 268| 198| transpose_64x128_sp( r ); 269| | 270| 198| layer_x(r, b_ptr); 271| 198| b_ptr += inc; 272| 198| layer_0(r, b_ptr); 273| 198| b_ptr += inc; 274| 198| layer_1(r, b_ptr); 275| 198| b_ptr += inc; 276| 198| layer_2(r, b_ptr); 277| 198| b_ptr += inc; 278| 198| layer_3(r, b_ptr); 279| 198| b_ptr += inc; 280| 198| layer_4(r, b_ptr); 281| 198| b_ptr += inc; 282| 198| layer_5(r, b_ptr); 283| 198| b_ptr += inc; 284| 198| layer_4(r, b_ptr); 285| 198| b_ptr += inc; 286| 198| layer_3(r, b_ptr); 287| 198| b_ptr += inc; 288| 198| layer_2(r, b_ptr); 289| 198| b_ptr += inc; 290| 198| layer_1(r, b_ptr); 291| 198| b_ptr += inc; 292| 198| layer_0(r, b_ptr); 293| 198| b_ptr += inc; 294| 198| layer_x(r, b_ptr); 295| 198| b_ptr += inc; 296| | 297| 198| transpose_64x128_sp( r ); 298| | 299| 198| layer_5(r, b_ptr); 300| 198| b_ptr += inc; 301| 198| layer_4(r, b_ptr); 302| 198| b_ptr += inc; 303| 198| layer_3(r, b_ptr); 304| 198| b_ptr += inc; 305| 198| layer_2(r, b_ptr); 306| 198| b_ptr += inc; 307| 198| layer_1(r, b_ptr); 308| 198| b_ptr += inc; 309| 198| layer_0(r, b_ptr); 310| | 311| 198| transpose_64x128_sp( r ); 312| 198|} PQCLEAN_MCELIECE6688128_AVX2_bm: 147| 99|void bm(vec128 *out, vec256 *in) { 148| 99| int i; 149| 99| uint16_t N, L; 150| 99| uint16_t mask; 151| 99| uint64_t one = 1, t; 152| | 153| 99| vec128 prod[ GFBITS ]; 154| 99| vec128 interval[GFBITS]; 155| | 156| 99| typedef union { 157| 99| vec128 v[GFBITS][2]; 158| 99| vec256 V[GFBITS]; 159| 99| } db_t; 160| | 161| 99| db_t db; 162| 99| db_t BC_tmp; 163| 99| db_t BC; 164| | 165| 99| gf d, b, c0 = 1; 166| 99| gf coefs[256]; 167| | 168| | // initialization 169| | 170| 99| get_coefs(coefs, in); 171| | 172| 99| BC.v[0][0] = vec128_set2x(0, one << 63); 173| 99| BC.v[0][1] = vec128_setzero(); 174| | 175| 1.28k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.28k|#define GFBITS 13 ------------------ | Branch (175:17): [True: 1.18k, False: 99] ------------------ 176| 1.18k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 177| 1.18k| } 178| | 179| 99| b = 1; 180| 99| L = 0; 181| | 182| | // 183| | 184| 1.38k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.38k|#define GFBITS 13 ------------------ | Branch (184:17): [True: 1.28k, False: 99] ------------------ 185| 1.28k| interval[i] = vec128_setzero(); 186| 1.28k| } 187| | 188| 25.4k| for (N = 0; N < 256; N++) { ------------------ | Branch (188:17): [True: 25.3k, False: 99] ------------------ 189| 25.3k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 25.3k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 25.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 190| 25.3k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 25.3k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 25.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 191| | 192| 25.3k| d = vec_reduce_asm(prod); ------------------ | | 3| 25.3k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 25.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 25.3k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 25.3k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 25.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 195| 25.3k| d ^= t & 0xFFFFFFFF; 196| | 197| 25.3k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 198| | 199| 354k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 354k|#define GFBITS 13 ------------------ | Branch (199:21): [True: 329k, False: 25.3k] ------------------ 200| 329k| db.v[i][0] = vec128_setbits((d >> i) & 1); 201| 329k| db.v[i][1] = vec128_setbits((b >> i) & 1); 202| 329k| } 203| | 204| 25.3k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 205| | 206| 25.3k| vec128_cmov(BC.v, mask); 207| 25.3k| update_asm(BC.v, c0 & mask, 32); ------------------ | | 1| 25.3k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 25.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| 354k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 354k|#define GFBITS 13 ------------------ | Branch (209:21): [True: 329k, False: 25.3k] ------------------ 210| 329k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 211| 329k| } 212| | 213| 25.3k| c0 = t >> 32; 214| 25.3k| b = (d & mask) | (b & ~mask); 215| 25.3k| L = ((N + 1 - L) & mask) | (L & ~mask); 216| 25.3k| } 217| | 218| 99| c0 = gf_inv(c0); ------------------ | | 11| 99|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 1.38k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.38k|#define GFBITS 13 ------------------ | Branch (220:17): [True: 1.28k, False: 99] ------------------ 221| 1.28k| prod[i] = vec128_setbits((c0 >> i) & 1); 222| 1.28k| } 223| | 224| 99| vec128_mul_asm(out, prod, BC.v[0] + 1, 32); ------------------ | | 10| 99|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 225| 99|} PQCLEAN_MCELIECE6688128_AVX2_controlbitsfrompermutation: 205| 99|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 99| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 99|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 99| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 99|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 99| int16 diff; 209| 99| int i; 210| 99| unsigned char *ptr; 211| | 212| 99| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 99| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 99| while (1) { ------------------ | Branch (215:12): [True: 99, Folded] ------------------ 216| 99| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 99| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 811k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 811k, False: 99] ------------------ 222| 811k| pi_test[i] = (int16)i; 223| 811k| } 224| | 225| 99| ptr = out; 226| 1.38k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.28k, False: 99] ------------------ 227| 1.28k| layer(pi_test, ptr, i, (int32)n); 228| 1.28k| ptr += n >> 4; 229| 1.28k| } 230| | 231| 1.28k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.18k, False: 99] ------------------ 232| 1.18k| layer(pi_test, ptr, i, (int32)n); 233| 1.18k| ptr += n >> 4; 234| 1.18k| } 235| | 236| 99| diff = 0; 237| 811k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 811k, False: 99] ------------------ 238| 811k| diff |= pi[i] ^ pi_test[i]; 239| 811k| } 240| | 241| 99| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 99|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 242| 99| crypto_declassify(&diff, sizeof diff); 243| 99| if (diff == 0) { ------------------ | Branch (243:13): [True: 99, False: 0] ------------------ 244| 99| break; 245| 99| } 246| 99| } 247| 99|} PQCLEAN_MCELIECE6688128_AVX2_crypto_int16_negative_mask: 3| 198|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 198| return crypto_int16_x >> 15; 5| 198|} PQCLEAN_MCELIECE6688128_AVX2_crypto_int16_nonzero_mask: 7| 99|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 99| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 99|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 99|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 9| 99|} PQCLEAN_MCELIECE6688128_AVX2_crypto_int32_negative_mask: 3| 63.2M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 63.2M| return crypto_int32_x >> 31; 5| 63.2M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_int32_min: 37| 63.2M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 63.2M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 63.2M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 63.2M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 63.2M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 63.2M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 63.2M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 42| 63.2M| crypto_int32_z &= crypto_int32_xy; 43| 63.2M| return crypto_int32_x ^ crypto_int32_z; 44| 63.2M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint16_signed_negative_mask: 3| 330k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 330k| return crypto_uint16_signed_x >> 15; 5| 330k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint16_nonzero_mask: 7| 111k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 111k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 111k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 111k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 111k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 111k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 9| 111k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint16_zero_mask: 11| 111k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 111k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 111k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 111k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 13| 111k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint16_smaller_mask: 24| 106k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 106k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 106k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 106k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 106k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 106k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 106k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 29| 106k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint32_signed_negative_mask: 3| 172k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 172k| return crypto_uint32_signed_x >> 31; 5| 172k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint32_nonzero_mask: 7| 86.3k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 86.3k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 86.3k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 86.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 86.3k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 86.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 9| 86.3k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint32_unequal_mask: 15| 86.3k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 86.3k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 86.3k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 86.3k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 86.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 18| 86.3k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint32_equal_mask: 20| 86.3k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 86.3k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 86.3k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 86.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 22| 86.3k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint64_signed_negative_mask: 3| 16.7M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 16.7M| return crypto_uint64_signed_x >> 63; 5| 16.7M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint64_nonzero_mask: 7| 8.37M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 8.37M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 8.37M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 8.37M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 8.37M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 8.37M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 9| 8.37M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint64_zero_mask: 11| 1.39M|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 1.39M| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 1.39M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 1.39M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 13| 1.39M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint64_unequal_mask: 15| 6.98M|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 6.98M| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 6.98M| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 6.98M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 6.98M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 18| 6.98M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint64_equal_mask: 20| 6.98M|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 6.98M| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 6.98M|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 6.98M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 22| 6.98M|} PQCLEAN_MCELIECE6688128_AVX2_decrypt: 171| 99|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 99| int i; 173| | 174| 99| uint16_t check_synd; 175| 99| uint16_t check_weight; 176| | 177| 99| vec256 inv[ 32 ][ GFBITS ]; 178| 99| vec256 scaled[ 32 ][ GFBITS ]; 179| 99| vec256 eval[32][ GFBITS ]; 180| | 181| 99| vec128 error128[ 64 ]; 182| 99| vec256 error256[ 32 ]; 183| | 184| 99| vec256 s_priv[ GFBITS ]; 185| 99| vec256 s_priv_cmp[ GFBITS ]; 186| 99| vec128 locator[ GFBITS ]; 187| | 188| 99| vec128 recv128[ 64 ]; 189| 99| vec256 recv256[ 32 ]; 190| 99| vec256 allone; 191| | 192| 99| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 99| preprocess(recv128, s); 197| | 198| 99| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 99|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 99|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 99|#define SYS_T 128 | | ------------------ ------------------ 199| 99| benes(recv128, bits_int, 1); ------------------ | | 9| 99|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 99| reformat_128to256(recv256, recv128); 202| | 203| 99| scaling(scaled, inv, sk, recv256); 204| 99| fft_tr(s_priv, scaled); ------------------ | | 9| 99|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 205| 99| bm(locator, s_priv); ------------------ | | 10| 99|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 99| fft(eval, locator); ------------------ | | 10| 99|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 99| allone = vec256_set1_16b(0xFFFF); 212| | 213| 3.26k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 3.16k, False: 99] ------------------ 214| 3.16k| error256[i] = vec256_or_reduce(eval[i]); 215| 3.16k| error256[i] = vec256_xor(error256[i], allone); 216| 3.16k| } 217| | 218| 99| scaling_inv(scaled, inv, error256); 219| 99| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 99|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 99| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 99| reformat_256to128(error128, error256); 226| 99| benes(error128, bits_int, 0); ------------------ | | 9| 99|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 99| postprocess(e, error128); 229| | 230| 99| check_weight = weight_check(e, error128); 231| | 232| 99| return 1 - (check_synd & check_weight); 233| 99|} PQCLEAN_MCELIECE6688128_AVX2_encrypt: 116| 99|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 117| 99| gen_e(e); 118| | 119| 99| syndrome_asm(s, pk, e); ------------------ | | 1| 99|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 120| 99|} PQCLEAN_MCELIECE6688128_AVX2_fft: 277| 1.07k|void fft(vec256 out[][GFBITS], vec128 *in) { 278| 1.07k| radix_conversions(in); 279| 1.07k| butterflies(out, in); 280| 1.07k|} PQCLEAN_MCELIECE6688128_AVX2_fft_tr: 380| 198|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 381| 198| butterflies_tr(out, in); 382| 198| radix_conversions_tr(out); 383| 198|} PQCLEAN_MCELIECE6688128_AVX2_gf_mul: 12| 14.3M|gf gf_mul(gf in0, gf in1) { 13| 14.3M| int i; 14| | 15| 14.3M| uint64_t tmp; 16| 14.3M| uint64_t t0; 17| 14.3M| uint64_t t1; 18| 14.3M| uint64_t t; 19| | 20| 14.3M| t0 = in0; 21| 14.3M| t1 = in1; 22| | 23| 14.3M| tmp = t0 * (t1 & 1); 24| | 25| 186M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 186M|#define GFBITS 13 ------------------ | Branch (25:17): [True: 171M, False: 14.3M] ------------------ 26| 171M| tmp ^= (t0 * (t1 & (1 << i))); 27| 171M| } 28| | 29| | // 30| | 31| 14.3M| t = tmp & 0x1FF0000; 32| 14.3M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 33| | 34| 14.3M| t = tmp & 0x000E000; 35| 14.3M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 36| | 37| 14.3M| return tmp & GFMASK; ------------------ | | 19| 14.3M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 14.3M|#define GFBITS 13 | | ------------------ ------------------ 38| 14.3M|} PQCLEAN_MCELIECE6688128_AVX2_gf_mul2: 41| 25.3k|uint64_t gf_mul2(gf a, gf b0, gf b1) { 42| 25.3k| int i; 43| | 44| 25.3k| uint64_t tmp = 0; 45| 25.3k| uint64_t t0; 46| 25.3k| uint64_t t1; 47| 25.3k| uint64_t t; 48| 25.3k| uint64_t mask = 0x0000000100000001; 49| | 50| 25.3k| t0 = a; 51| 25.3k| t1 = b1; 52| 25.3k| t1 = (t1 << 32) | b0; 53| | 54| 354k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 354k|#define GFBITS 13 ------------------ | Branch (54:17): [True: 329k, False: 25.3k] ------------------ 55| 329k| tmp ^= t0 * (t1 & mask); 56| 329k| mask += mask; 57| 329k| } 58| | 59| | // 60| | 61| 25.3k| t = tmp & 0x01FF000001FF0000; 62| 25.3k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 63| | 64| 25.3k| t = tmp & 0x0000E0000000E000; 65| 25.3k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 66| | 67| 25.3k| return tmp & 0x00001FFF00001FFF; 68| 25.3k|} PQCLEAN_MCELIECE6688128_AVX2_gf_frac: 178| 111k|gf gf_frac(gf den, gf num) { 179| 111k| gf tmp_11; 180| 111k| gf tmp_1111; 181| 111k| gf out; 182| | 183| 111k| tmp_11 = gf_sqmul(den, den); // 11 184| 111k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // 1111 185| 111k| out = gf_sq2(tmp_1111); 186| 111k| out = gf_sq2mul(out, tmp_1111); // 11111111 187| 111k| out = gf_sq2(out); 188| 111k| out = gf_sq2mul(out, tmp_1111); // 111111111111 189| | 190| 111k| return gf_sqmul(out, num); // 1111111111110 191| 111k|} PQCLEAN_MCELIECE6688128_AVX2_gf_inv: 194| 111k|gf gf_inv(gf den) { 195| 111k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 111k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 111k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 196| 111k|} pk_gen.c:PQCLEAN_MCELIECE6688128_AVX2_int32_sort: 21| 99|static void int32_sort(int32_t *x, long long n) { 22| 99| long long top, p, q, r, i; 23| | 24| 99| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 99] ------------------ 25| 0| return; 26| 0| } 27| 99| top = 1; 28| 1.08k| while (top < n - top) { ------------------ | Branch (28:12): [True: 990, False: 99] ------------------ 29| 990| top += top; 30| 990| } 31| | 32| 1.18k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.08k, False: 99] ------------------ 33| 1.61M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.60M, False: 1.08k] ------------------ 34| 1.60M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 855k, False: 754k] ------------------ 35| 855k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 855k| do { \ | | 12| 855k| int32_t ab = (b) ^ (a); \ | | 13| 855k| int32_t c = (b) - (a); \ | | 14| 855k| c ^= ab & ((c) ^ (b)); \ | | 15| 855k| c >>= 31; \ | | 16| 855k| c &= ab; \ | | 17| 855k| (a) ^= c; \ | | 18| 855k| (b) ^= c; \ | | 19| 855k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 855k] | | ------------------ ------------------ 36| 855k| } 37| 1.60M| } 38| 1.08k| i = 0; 39| 6.53k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 5.44k, False: 1.08k] ------------------ 40| 1.45M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.44M, False: 5.44k] ------------------ 41| 1.44M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 754k, False: 690k] ------------------ 42| 754k| int32_t a = x[i + p]; 43| 4.42M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.66M, False: 754k] ------------------ 44| 3.66M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.66M| do { \ | | 12| 3.66M| int32_t ab = (b) ^ (a); \ | | 13| 3.66M| int32_t c = (b) - (a); \ | | 14| 3.66M| c ^= ab & ((c) ^ (b)); \ | | 15| 3.66M| c >>= 31; \ | | 16| 3.66M| c &= ab; \ | | 17| 3.66M| (a) ^= c; \ | | 18| 3.66M| (b) ^= c; \ | | 19| 3.66M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.66M] | | ------------------ ------------------ 45| 3.66M| } 46| 754k| x[i + p] = a; 47| 754k| } 48| 1.44M| } 49| 5.44k| } 50| 1.08k| } 51| 99|} controlbits.c:PQCLEAN_MCELIECE6688128_AVX2_int32_sort: 21| 3.24M|static void int32_sort(int32_t *x, long long n) { 22| 3.24M| long long top, p, q, r, i; 23| | 24| 3.24M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 3.24M] ------------------ 25| 0| return; 26| 0| } 27| 3.24M| top = 1; 28| 11.3M| while (top < n - top) { ------------------ | Branch (28:12): [True: 8.12M, False: 3.24M] ------------------ 29| 8.12M| top += top; 30| 8.12M| } 31| | 32| 14.6M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 11.3M, False: 3.24M] ------------------ 33| 1.56G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.55G, False: 11.3M] ------------------ 34| 1.55G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 868M, False: 684M] ------------------ 35| 868M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 868M| do { \ | | 12| 868M| int32_t ab = (b) ^ (a); \ | | 13| 868M| int32_t c = (b) - (a); \ | | 14| 868M| c ^= ab & ((c) ^ (b)); \ | | 15| 868M| c >>= 31; \ | | 16| 868M| c &= ab; \ | | 17| 868M| (a) ^= c; \ | | 18| 868M| (b) ^= c; \ | | 19| 868M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 868M] | | ------------------ ------------------ 36| 868M| } 37| 1.55G| } 38| 11.3M| i = 0; 39| 30.8M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 19.4M, False: 11.3M] ------------------ 40| 1.38G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.36G, False: 19.4M] ------------------ 41| 1.36G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 684M, False: 684M] ------------------ 42| 684M| int32_t a = x[i + p]; 43| 4.05G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.37G, False: 684M] ------------------ 44| 3.37G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.37G| do { \ | | 12| 3.37G| int32_t ab = (b) ^ (a); \ | | 13| 3.37G| int32_t c = (b) - (a); \ | | 14| 3.37G| c ^= ab & ((c) ^ (b)); \ | | 15| 3.37G| c >>= 31; \ | | 16| 3.37G| c &= ab; \ | | 17| 3.37G| (a) ^= c; \ | | 18| 3.37G| (b) ^= c; \ | | 19| 3.37G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.37G] | | ------------------ ------------------ 45| 3.37G| } 46| 684M| x[i + p] = a; 47| 684M| } 48| 1.36G| } 49| 19.4M| } 50| 11.3M| } 51| 3.24M|} encrypt.c:PQCLEAN_MCELIECE6688128_AVX2_int32_sort: 21| 680|static void int32_sort(int32_t *x, long long n) { 22| 680| long long top, p, q, r, i; 23| | 24| 680| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 680] ------------------ 25| 0| return; 26| 0| } 27| 680| top = 1; 28| 4.76k| while (top < n - top) { ------------------ | Branch (28:12): [True: 4.08k, False: 680] ------------------ 29| 4.08k| top += top; 30| 4.08k| } 31| | 32| 5.44k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 4.76k, False: 680] ------------------ 33| 527k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 522k, False: 4.76k] ------------------ 34| 522k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 304k, False: 218k] ------------------ 35| 304k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 304k| do { \ | | 12| 304k| int32_t ab = (b) ^ (a); \ | | 13| 304k| int32_t c = (b) - (a); \ | | 14| 304k| c ^= ab & ((c) ^ (b)); \ | | 15| 304k| c >>= 31; \ | | 16| 304k| c &= ab; \ | | 17| 304k| (a) ^= c; \ | | 18| 304k| (b) ^= c; \ | | 19| 304k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 304k] | | ------------------ ------------------ 36| 304k| } 37| 522k| } 38| 4.76k| i = 0; 39| 19.0k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 14.2k, False: 4.76k] ------------------ 40| 450k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 436k, False: 14.2k] ------------------ 41| 436k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 218k, False: 218k] ------------------ 42| 218k| int32_t a = x[i + p]; 43| 913k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 695k, False: 218k] ------------------ 44| 695k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 695k| do { \ | | 12| 695k| int32_t ab = (b) ^ (a); \ | | 13| 695k| int32_t c = (b) - (a); \ | | 14| 695k| c ^= ab & ((c) ^ (b)); \ | | 15| 695k| c >>= 31; \ | | 16| 695k| c &= ab; \ | | 17| 695k| (a) ^= c; \ | | 18| 695k| (b) ^= c; \ | | 19| 695k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 695k] | | ------------------ ------------------ 45| 695k| } 46| 218k| x[i + p] = a; 47| 218k| } 48| 436k| } 49| 14.2k| } 50| 4.76k| } 51| 680|} PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_enc: 22| 99|) { 23| 99| unsigned char e[ SYS_N / 8 ]; 24| 99| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 99| encrypt(c, pk, e); ------------------ | | 9| 99|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 99| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 99|#define SYS_N 6688 ------------------ 31| 99| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 99|#define SYS_N 6688 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 99|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 99|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 99|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 99|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 99| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 99| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 99|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 99| return 0; 36| 99|} PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_dec: 42| 99|) { 43| 99| int i; 44| | 45| 99| unsigned char ret_decrypt = 0; 46| | 47| 99| uint16_t m; 48| | 49| 99| unsigned char e[ SYS_N / 8 ]; 50| 99| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 99| unsigned char *x = preimage; 52| 99| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 99|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 99|#define SYS_T 128 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 99|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 99|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 99|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 99| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 99|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 99| m = ret_decrypt; 59| 99| m -= 1; 60| 99| m >>= 8; 61| | 62| 99| *x++ = m & 1; 63| 82.8k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 82.8k|#define SYS_N 6688 ------------------ | Branch (63:17): [True: 82.7k, False: 99] ------------------ 64| 82.7k| *x++ = (~m & s[i]) | (m & e[i]); 65| 82.7k| } 66| | 67| 20.6k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 20.6k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 20.6k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 20.6k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 20.6k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 20.5k, False: 99] ------------------ 68| 20.5k| *x++ = c[i]; 69| 20.5k| } 70| | 71| 99| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 99| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 99|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 99| return 0; 74| 99|} PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_keypair: 80| 99|) { 81| 99| int i; 82| 99| unsigned char seed[ 33 ] = {64}; 83| 99| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 99| unsigned char *rp, *skp; 85| | 86| 99| gf f[ SYS_T ]; // element in GF(2^mt) 87| 99| gf irr[ SYS_T ]; // Goppa polynomial 88| 99| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 89| 99| int16_t pi[ 1 << GFBITS ]; // random permutation 90| | 91| 99| randombytes(seed + 1, 32); ------------------ | | 8| 99|#define randombytes OQS_randombytes ------------------ 92| | 93| 874| while (1) { ------------------ | Branch (93:12): [True: 874, Folded] ------------------ 94| 874| rp = &r[ sizeof(r) - 32 ]; 95| 874| skp = sk; 96| | 97| | // expanding and updating the seed 98| | 99| 874| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 874| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 874|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 100| 874| memcpy(skp, seed + 1, 32); 101| 874| skp += 32 + 8; 102| 874| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 103| | 104| | // generating irreducible polynomial 105| | 106| 874| rp -= sizeof(f); 107| | 108| 112k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 112k|#define SYS_T 128 ------------------ | Branch (108:21): [True: 111k, False: 874] ------------------ 109| 111k| f[i] = load_gf(rp + i * 2); 110| 111k| } 111| | 112| 874| if (genpoly_gen(irr, f)) { ------------------ | | 9| 874|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 874|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ | Branch (112:13): [True: 0, False: 874] ------------------ 113| 0| continue; 114| 0| } 115| | 116| 112k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 112k|#define SYS_T 128 ------------------ | Branch (116:21): [True: 111k, False: 874] ------------------ 117| 111k| store_gf(skp + i * 2, irr[i]); 118| 111k| } 119| | 120| 874| skp += IRR_BYTES; ------------------ | | 11| 874|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 874|#define SYS_T 128 | | ------------------ ------------------ 121| | 122| | // generating permutation 123| | 124| 874| rp -= sizeof(perm); 125| | 126| 7.16M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 7.16M|#define GFBITS 13 ------------------ | Branch (126:21): [True: 7.15M, False: 874] ------------------ 127| 7.15M| perm[i] = load4(rp + i * 4); 128| 7.15M| } 129| | 130| 874| if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 9| 874|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 874|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 11| 874|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 874|#define SYS_T 128 | | ------------------ ------------------ | Branch (130:13): [True: 775, False: 99] ------------------ 131| 775| continue; 132| 775| } 133| | 134| 99| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 99|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 99|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 99|#define GFBITS 13 ------------------ 135| 99| skp += COND_BYTES; ------------------ | | 10| 99|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 99|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 99|#define GFBITS 13 | | ------------------ ------------------ 136| | 137| | // storing the random string s 138| | 139| 99| rp -= SYS_N / 8; ------------------ | | 7| 99|#define SYS_N 6688 ------------------ 140| 99| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 99|#define SYS_N 6688 ------------------ 141| | 142| | // storing positions of the 32 pivots 143| | 144| 99| store8(sk + 32, 0xFFFFFFFF); 145| | 146| 99| break; 147| 874| } 148| | 149| 99| return 0; 150| 99|} PQCLEAN_MCELIECE6688128_AVX2_pk_gen: 199| 874|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi) { 200| 874|#define nBlocks_I ((PK_NROWS + 255) / 256) 201| | 202| 874| int i, j, k, b; 203| 874| int row, c; 204| | 205| 874| union { 206| 874| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 207| 874| vec256 v[ PK_NROWS ][ nBlocks_I ]; 208| 874| } mat; 209| | 210| 874| union { 211| 874| uint64_t w[ PK_NROWS ][ 28 ]; 212| 874| vec256 v[ PK_NROWS ][ 7 ]; 213| 874| } par; 214| | 215| 874| uint16_t m; 216| 874| vec256 mm; 217| | 218| 874| vec128 sk_int[ GFBITS ]; 219| | 220| 874| vec256 consts[ 32 ][ GFBITS ]; 221| 874| vec256 eval[ 32 ][ GFBITS ]; 222| 874| vec256 prod[ 32 ][ GFBITS ]; 223| 874| vec256 tmp[ GFBITS ]; 224| | 225| 874| uint64_t list[1 << GFBITS]; 226| 874| uint64_t one = 1; 227| 874| uint64_t t; 228| | 229| 874| uint16_t ind[ PK_NROWS ]; 230| 874| uint16_t ind_inv[ PK_NROWS ]; 231| | 232| | // compute the inverses 233| | 234| 874| irr_load(sk_int, irr); 235| | 236| 874| fft(eval, sk_int); ------------------ | | 10| 874|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 874|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 237| | 238| 874| vec256_copy(prod[0], eval[0]); 239| | 240| 27.9k| for (i = 1; i < 32; i++) { ------------------ | Branch (240:17): [True: 27.0k, False: 874] ------------------ 241| 27.0k| vec256_mul(prod[i], prod[i - 1], eval[i]); 242| 27.0k| } 243| | 244| 874| vec256_inv(tmp, prod[31]); ------------------ | | 11| 874|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 874|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 245| | 246| 27.9k| for (i = 30; i >= 0; i--) { ------------------ | Branch (246:18): [True: 27.0k, False: 874] ------------------ 247| 27.0k| vec256_mul(prod[i + 1], prod[i], tmp); 248| 27.0k| vec256_mul(tmp, tmp, eval[i + 1]); 249| 27.0k| } 250| | 251| 874| vec256_copy(prod[0], tmp); 252| | 253| | // fill matrix 254| | 255| 874| de_bitslicing(list, prod); 256| | 257| 7.16M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 7.16M|#define GFBITS 13 ------------------ | Branch (257:17): [True: 7.15M, False: 874] ------------------ 258| 7.15M| list[i] <<= GFBITS; ------------------ | | 6| 7.15M|#define GFBITS 13 ------------------ 259| 7.15M| list[i] |= i; 260| 7.15M| list[i] |= ((uint64_t) perm[i]) << 31; 261| 7.15M| } 262| | 263| 874| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 874|#define GFBITS 13 ------------------ 264| | 265| 6.98M| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 6.98M|#define GFBITS 13 ------------------ | Branch (265:17): [True: 6.98M, False: 836] ------------------ 266| 6.98M| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (266:13): [True: 38, False: 6.98M] ------------------ 267| 38| return -1; 268| 38| } 269| 6.98M| } 270| | 271| 836| to_bitslicing_2x(consts, prod, list); 272| | 273| 6.84M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 6.84M|#define GFBITS 13 ------------------ | Branch (273:17): [True: 6.84M, False: 836] ------------------ 274| 6.84M| pi[i] = list[i] & GFMASK; ------------------ | | 19| 6.84M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 6.84M|#define GFBITS 13 | | ------------------ ------------------ 275| 6.84M| } 276| | 277| 6.68k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 6.68k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 6.68k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 6.68k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 6.68k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (277:17): [True: 5.85k, False: 836] ------------------ 278| 81.9k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 81.9k|#define GFBITS 13 ------------------ | Branch (278:21): [True: 76.0k, False: 5.85k] ------------------ 279| 76.0k| mat.v[ k ][ j ] = prod[ j ][ k ]; 280| 76.0k| } 281| 5.85k| } 282| | 283| 107k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 107k|#define SYS_T 128 ------------------ | Branch (283:17): [True: 106k, False: 836] ------------------ 284| 849k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 849k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 849k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 849k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 849k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (284:21): [True: 743k, False: 106k] ------------------ 285| 743k| vec256_mul(prod[j], prod[j], consts[j]); 286| | 287| 10.4M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 10.4M|#define GFBITS 13 ------------------ | Branch (287:25): [True: 9.66M, False: 743k] ------------------ 288| 9.66M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 9.66M|#define GFBITS 13 ------------------ 289| 9.66M| } 290| 743k| } 291| 106k| } 292| | 293| | // gaussian elimination to obtain L, U, and P such that LP M = U 294| | // L and U are stored in the space of M 295| | // P is stored in ind 296| | 297| 1.39M| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 1.39M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.39M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.39M|#define GFBITS 13 | | ------------------ ------------------ | Branch (297:17): [True: 1.39M, False: 836] ------------------ 298| 1.39M| ind_inv[i] = ind[ i ] = i; 299| 1.39M| } 300| | 301| 1.39M| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 1.39M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.39M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.39M|#define GFBITS 13 | | ------------------ ------------------ | Branch (301:19): [True: 1.39M, False: 99] ------------------ 302| 1.39M| i = row >> 6; 303| 1.39M| j = row & 63; 304| | 305| 1.15G| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 1.15G|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.15G|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.15G|#define GFBITS 13 | | ------------------ ------------------ | Branch (305:27): [True: 1.15G, False: 1.39M] ------------------ 306| 1.15G| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 307| 1.15G| uint16_cswap(&ind[row], &ind[k], m); 308| | 309| 1.15G| mm = vec256_set1_16b(m); 310| 9.25G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 9.25G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 9.25G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 9.25G|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 9.25G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (310:25): [True: 8.09G, False: 1.15G] ------------------ 311| 8.09G| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 312| 8.09G| } 313| 1.15G| } 314| | 315| 1.39M| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (315:14): [True: 737, False: 1.38M] ------------------ 316| 737| return -1; 317| 737| } 318| | 319| 1.15G| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 1.15G|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.15G|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.15G|#define GFBITS 13 | | ------------------ ------------------ | Branch (319:27): [True: 1.15G, False: 1.38M] ------------------ 320| 1.15G| t = mat.w[ k ][ i ] & (one << j); 321| 1.15G| mm = extract_mask256(mat.w[k], row); 322| | 323| 9.25G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 9.25G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 9.25G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 9.25G|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 9.25G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (323:25): [True: 8.09G, False: 1.15G] ------------------ 324| 8.09G| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 325| 8.09G| } 326| | 327| 1.15G| mat.w[ k ][ i ] |= t; 328| 1.15G| } 329| 1.38M| } 330| | 331| | // apply M^-1 to the remaining columns 332| | 333| 99| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 99|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 99|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 99|#define GFBITS 13 | | ------------------ ------------------ 334| | 335| 396| for (j = 6; j < 27; j += par_width) { ------------------ | | 30| 297|#define par_width 7 ------------------ | Branch (335:17): [True: 297, False: 99] ------------------ 336| 4.15k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 4.15k|#define GFBITS 13 ------------------ | Branch (336:21): [True: 3.86k, False: 297] ------------------ 337| 30.8k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 30.8k|#define par_width 7 ------------------ | Branch (337:25): [True: 27.0k, False: 3.86k] ------------------ 338| 27.0k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 339| 27.0k| } 340| 3.86k| } 341| | 342| 38.0k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 38.0k|#define SYS_T 128 ------------------ | Branch (342:21): [True: 37.7k, False: 297] ------------------ 343| 301k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 301k|#define par_width 7 ------------------ | Branch (343:25): [True: 264k, False: 37.7k] ------------------ 344| 264k| vec256_mul(prod[ j + b ], prod[ j + b ], consts[ j + b ]); 345| 264k| } 346| | 347| 528k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 528k|#define GFBITS 13 ------------------ | Branch (347:25): [True: 490k, False: 37.7k] ------------------ 348| 3.92M| for (b = 0; b < par_width; b++) { ------------------ | | 30| 3.92M|#define par_width 7 ------------------ | Branch (348:29): [True: 3.43M, False: 490k] ------------------ 349| 3.43M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 3.43M|#define GFBITS 13 ------------------ 350| 3.43M| } 351| 490k| } 352| 37.7k| } 353| | 354| | // apply P 355| | 356| 494k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 494k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 494k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 494k|#define GFBITS 13 | | ------------------ ------------------ | Branch (356:21): [True: 494k, False: 297] ------------------ 357| 494k| ind[i] = ind_inv[i]; 358| 494k| } 359| | 360| 297| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 297|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 297|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 297|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 297|#define GFBITS 13 | | ------------------ ------------------ 361| | 362| | // apply L 363| | 364| 494k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 297|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 297|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 297|#define GFBITS 13 | | ------------------ ------------------ | Branch (364:34): [True: 494k, False: 297] ------------------ 365| 411M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (365:31): [True: 410M, False: 494k] ------------------ 366| 410M| mm = extract_mask256(mat.w[row], i); 367| | 368| 3.28G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.28G|#define par_width 7 ------------------ | Branch (368:29): [True: 2.87G, False: 410M] ------------------ 369| 2.87G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 370| 2.87G| } 371| 410M| } 372| 494k| } 373| | 374| | // apply U^-1 375| | 376| 297| if (j == 6) { ------------------ | Branch (376:13): [True: 99, False: 198] ------------------ 377| 164k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 164k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 164k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 164k|#define GFBITS 13 | | ------------------ ------------------ | Branch (377:25): [True: 164k, False: 99] ------------------ 378| 164k| par.v[i][0] = mat.v[i][nBlocks_I - 1]; ------------------ | | 200| 164k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 164k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 164k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 164k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 379| 164k| } 380| 99| } 381| | 382| 494k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 297|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 297|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 297|#define GFBITS 13 | | ------------------ ------------------ | Branch (382:34): [True: 494k, False: 297] ------------------ 383| 411M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 494k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 494k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 494k|#define GFBITS 13 | | ------------------ ------------------ | Branch (383:36): [True: 410M, False: 494k] ------------------ 384| 410M| mm = extract_mask256(mat.w[row], i); 385| | 386| 3.28G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.28G|#define par_width 7 ------------------ | Branch (386:29): [True: 2.87G, False: 410M] ------------------ 387| 2.87G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 388| 2.87G| } 389| 410M| } 390| 494k| } 391| | 392| 297| if (j + par_width < 27) { ------------------ | | 30| 297|#define par_width 7 ------------------ | Branch (392:13): [True: 198, False: 99] ------------------ 393| 329k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 329k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 329k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 329k|#define GFBITS 13 | | ------------------ ------------------ | Branch (393:27): [True: 329k, False: 198] ------------------ 394| 329k| if (j == 6) { ------------------ | Branch (394:21): [True: 164k, False: 164k] ------------------ 395| 164k| k = 2; 396| 164k| } else { 397| 164k| k = 0; 398| 164k| } 399| 9.22M| for (; k < 28; k++) { ------------------ | Branch (399:24): [True: 8.89M, False: 329k] ------------------ 400| 8.89M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 8.89M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 8.89M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 8.89M|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 8.89M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 8.89M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 8.89M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 401| 8.89M| } 402| 329k| } 403| 198| } else { 404| 164k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 164k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 164k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 164k|#define GFBITS 13 | | ------------------ ------------------ | Branch (404:27): [True: 164k, False: 99] ------------------ 405| 4.11M| for (k = 0; k < 24; k++) { ------------------ | Branch (405:29): [True: 3.95M, False: 164k] ------------------ 406| 3.95M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 3.95M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 3.95M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 3.95M|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 3.95M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 3.95M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 3.95M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 407| 3.95M| } 408| | 409| 164k| store_i(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k], 4); ------------------ | | 15| 164k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 164k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 164k|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 164k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 164k|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 164k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 410| 164k| } 411| 99| } 412| 297| } 413| | 414| | // 415| | 416| 99| return 0; 417| 836|} PQCLEAN_MCELIECE6688128_AVX2_genpoly_gen: 88| 874|int genpoly_gen(gf *out, gf *f) { 89| 874| int i, j, k; 90| | 91| 874| gf t, inv; 92| | 93| 874| uint64_t m; 94| 874| vec128 mask; 95| | 96| 874| union { 97| 874| uint64_t d[ GFBITS ][ 128 ][2]; 98| 874| vec128 v[ GFBITS ][ 128 ]; 99| 874| } buf; 100| | 101| 874| union { 102| 874| uint64_t d[GFBITS][2]; 103| 874| vec128 v[GFBITS]; 104| 874| } v; 105| | 106| 874| union { 107| 874| uint64_t d[SYS_T][GFBITS][2]; 108| 874| vec128 v[SYS_T][GFBITS]; 109| 874| } mat; 110| | 111| | // fill matrix 112| | 113| 874| buf.v[0][0] = vec128_set2x(1, 0); 114| 11.3k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 11.3k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 10.4k, False: 874] ------------------ 115| 10.4k| buf.v[i][0] = vec128_setzero(); 116| 10.4k| } 117| | 118| 12.2k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 12.2k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 11.3k, False: 874] ------------------ 119| 11.3k| v.v[j] = vec128_setzero(); 120| | 121| 1.46M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 11.3k|#define SYS_T 128 ------------------ | Branch (121:29): [True: 1.45M, False: 11.3k] ------------------ 122| 1.45M| v.d[j][1] <<= 1; 123| 1.45M| v.d[j][1] |= v.d[j][0] >> 63; 124| 1.45M| v.d[j][0] <<= 1; 125| 1.45M| v.d[j][0] |= (f[i] >> j) & 1; 126| 1.45M| } 127| 11.3k| } 128| | 129| 12.2k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 12.2k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 11.3k, False: 874] ------------------ 130| 11.3k| buf.v[i][1] = v.v[i]; 131| 11.3k| } 132| | 133| 111k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 111k|#define SYS_T 128 ------------------ | Branch (133:17): [True: 110k, False: 874] ------------------ 134| 110k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 110k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 110k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 110k| if (k < SYS_T) { ------------------ | | 8| 110k|#define SYS_T 128 ------------------ | Branch (136:13): [True: 110k, False: 874] ------------------ 137| 1.54M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.54M|#define GFBITS 13 ------------------ | Branch (137:25): [True: 1.43M, False: 110k] ------------------ 138| 1.43M| buf.v[i][k] = v.v[i]; 139| 1.43M| } 140| 110k| } else { 141| 112k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 112k|#define SYS_T 128 ------------------ | Branch (141:25): [True: 111k, False: 874] ------------------ 142| 111k| out[i] = extract_gf(v.d, i); 143| 111k| } 144| 874| } 145| 110k| } 146| | 147| 12.2k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 12.2k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 11.3k, False: 874] ------------------ 148| 11.3k| transpose_128x128(buf.d[i]); 149| 11.3k| } 150| | 151| 112k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 112k|#define SYS_T 128 ------------------ | Branch (151:17): [True: 111k, False: 874] ------------------ 152| 1.56M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.56M|#define GFBITS 13 ------------------ | Branch (152:21): [True: 1.45M, False: 111k] ------------------ 153| 1.45M| mat.v[j][i] = buf.v[i][j]; 154| 1.45M| } 155| 111k| } 156| | 157| | // gaussian 158| | 159| 112k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 112k|#define SYS_T 128 ------------------ | Branch (159:17): [True: 111k, False: 874] ------------------ 160| 7.21M| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 7.21M|#define SYS_T 128 ------------------ | Branch (160:25): [True: 7.10M, False: 111k] ------------------ 161| 7.10M| m = extract_bit(mat.d[i], i); 162| 7.10M| m -= 1; 163| 7.10M| mask = vec128_set2x(m, m); 164| | 165| 99.4M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 99.4M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 92.3M, False: 7.10M] ------------------ 166| 92.3M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 92.3M| } 168| | 169| 7.10M| out[i] ^= out[j] & m; 170| 7.10M| } 171| | 172| | // 173| | 174| 111k| t = extract_gf(mat.d[i], i); 175| | 176| 111k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 111k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 111k| inv = gf_inv(t); ------------------ | | 11| 111k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 111k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 183| 111k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 111k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 111k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 111k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 14.4M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 14.4M|#define SYS_T 128 ------------------ | Branch (187:21): [True: 14.3M, False: 111k] ------------------ 188| 14.3M| if (j != i) { ------------------ | Branch (188:17): [True: 14.2M, False: 111k] ------------------ 189| 14.2M| t = extract_gf(mat.d[j], i); 190| | 191| 14.2M| vec128_mul_gf(v.v, mat.v[i], t); 192| 14.2M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 14.2M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 14.2M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 14.2M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 195| 14.2M| } 196| 14.3M| } 197| 111k| } 198| | 199| 874| return 0; 200| 874|} PQCLEAN_MCELIECE6688128_AVX2_vec128_mul_GF: 6| 110k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 110k| int i, j; 8| 110k| uint64_t buf[GFBITS][4]; 9| 110k| vec128 prod[GFBITS]; 10| 110k| uint64_t p[GFBITS]; 11| | 12| | // polynomial multiplication 13| | 14| 1.55M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.55M|#define GFBITS 13 ------------------ | Branch (14:17): [True: 1.44M, False: 110k] ------------------ 15| 1.44M| buf[i][0] = 0; 16| 1.44M| buf[i][1] = 0; 17| 1.44M| buf[i][2] = 0; 18| 1.44M| buf[i][3] = 0; 19| 1.44M| } 20| | 21| 14.3M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 110k|#define SYS_T 128 ------------------ | Branch (21:25): [True: 14.2M, False: 110k] ------------------ 22| 198M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 198M|#define GFBITS 13 ------------------ | Branch (22:21): [True: 184M, False: 14.2M] ------------------ 23| 184M| buf[j][3] <<= 1; 24| 184M| buf[j][3] |= buf[j][2] >> 63; 25| 184M| buf[j][2] <<= 1; 26| 184M| buf[j][2] |= buf[j][1] >> 63; 27| 184M| buf[j][1] <<= 1; 28| 184M| buf[j][1] |= buf[j][0] >> 63; 29| 184M| buf[j][0] <<= 1; 30| 184M| } 31| | 32| 14.2M| vec128_mul_gf(prod, v, a[i]); 33| | 34| 198M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 198M|#define GFBITS 13 ------------------ | Branch (34:21): [True: 184M, False: 14.2M] ------------------ 35| 184M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 184M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 184M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 184M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 37| 184M| } 38| 14.2M| } 39| | 40| | // reduction modulo y^128+y^7+y^2+y+1 41| | 42| 1.55M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.55M|#define GFBITS 13 ------------------ | Branch (42:17): [True: 1.44M, False: 110k] ------------------ 43| 1.44M| p[i] = buf[i][3]; 44| | 45| 1.44M| buf[i][2] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 1.44M|#define SYS_T 128 ------------------ 46| 1.44M| buf[i][1] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 1.44M|#define SYS_T 128 ------------------ 47| 1.44M| buf[i][2] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 1.44M|#define SYS_T 128 ------------------ 48| 1.44M| buf[i][1] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 1.44M|#define SYS_T 128 ------------------ 49| 1.44M| buf[i][2] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 1.44M|#define SYS_T 128 ------------------ 50| 1.44M| buf[i][1] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 1.44M|#define SYS_T 128 ------------------ 51| 1.44M| buf[i][1] ^= p[i]; 52| 1.44M| } 53| | 54| | // 55| | 56| 1.55M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.55M|#define GFBITS 13 ------------------ | Branch (56:17): [True: 1.44M, False: 110k] ------------------ 57| 1.44M| p[i] = buf[i][2]; 58| | 59| 1.44M| buf[i][1] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 1.44M|#define SYS_T 128 ------------------ 60| 1.44M| buf[i][0] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 1.44M|#define SYS_T 128 ------------------ 61| 1.44M| buf[i][1] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 1.44M|#define SYS_T 128 ------------------ 62| 1.44M| buf[i][0] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 1.44M|#define SYS_T 128 ------------------ 63| 1.44M| buf[i][1] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 1.44M|#define SYS_T 128 ------------------ 64| 1.44M| buf[i][0] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 1.44M|#define SYS_T 128 ------------------ 65| 1.44M| buf[i][0] ^= p[i]; 66| 1.44M| } 67| | 68| | // 69| | 70| 1.55M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.55M|#define GFBITS 13 ------------------ | Branch (70:17): [True: 1.44M, False: 110k] ------------------ 71| 1.44M| out[i] = vec128_set2x(buf[i][0], buf[i][1]); 72| 1.44M| } 73| 110k|} PQCLEAN_MCELIECE6688128_AVX2_vec256_sq: 9| 14.8k|void vec256_sq(vec256 *out, vec256 *in) { 10| 14.8k| int i; 11| 14.8k| vec256 result[GFBITS], t; 12| | 13| 14.8k| t = vec256_xor(in[11], in[12]); 14| | 15| 14.8k| result[0] = vec256_xor(in[0], in[11]); 16| 14.8k| result[1] = vec256_xor(in[7], t); 17| 14.8k| result[2] = vec256_xor(in[1], in[7]); 18| 14.8k| result[3] = vec256_xor(in[8], t); 19| 14.8k| result[4] = vec256_xor(in[2], in[7]); 20| 14.8k| result[4] = vec256_xor(result[4], in[8]); 21| 14.8k| result[4] = vec256_xor(result[4], t); 22| 14.8k| result[5] = vec256_xor(in[7], in[9]); 23| 14.8k| result[6] = vec256_xor(in[3], in[8]); 24| 14.8k| result[6] = vec256_xor(result[6], in[9]); 25| 14.8k| result[6] = vec256_xor(result[6], in[12]); 26| 14.8k| result[7] = vec256_xor(in[8], in[10]); 27| 14.8k| result[8] = vec256_xor(in[4], in[9]); 28| 14.8k| result[8] = vec256_xor(result[8], in[10]); 29| 14.8k| result[9] = vec256_xor(in[9], in[11]); 30| 14.8k| result[10] = vec256_xor(in[5], in[10]); 31| 14.8k| result[10] = vec256_xor(result[10], in[11]); 32| 14.8k| result[11] = vec256_xor(in[10], in[12]); 33| 14.8k| result[12] = vec256_xor(in[6], t); 34| | 35| 207k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 207k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 192k, False: 14.8k] ------------------ 36| 192k| out[i] = result[i]; 37| 192k| } 38| 14.8k|} PQCLEAN_MCELIECE6688128_AVX2_vec256_inv: 41| 973|void vec256_inv(vec256 *out, vec256 *in) { 42| 973| vec256 tmp_11[ GFBITS ]; 43| 973| vec256 tmp_1111[ GFBITS ]; 44| | 45| 973| vec256_copy(out, in); 46| | 47| 973| vec256_sq(out, out); ------------------ | | 14| 973|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 973|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 48| 973| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 973| vec256_sq(out, tmp_11); ------------------ | | 14| 973|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 973|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 51| 973| vec256_sq(out, out); ------------------ | | 14| 973|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 973|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 52| 973| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 973| vec256_sq(out, tmp_1111); ------------------ | | 14| 973|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 973|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 55| 973| vec256_sq(out, out); ------------------ | | 14| 973|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 973|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 56| 973| vec256_sq(out, out); ------------------ | | 14| 973|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 973|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 57| 973| vec256_sq(out, out); ------------------ | | 14| 973|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 973|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 58| 973| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 973| vec256_sq(out, out); ------------------ | | 14| 973|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 973|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 61| 973| vec256_sq(out, out); ------------------ | | 14| 973|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 973|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 62| 973| vec256_sq(out, out); ------------------ | | 14| 973|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 973|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 63| 973| vec256_sq(out, out); ------------------ | | 14| 973|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 973|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 64| 973| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 973| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 973|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 973|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 67| 973|} PQCLEAN_MCELIECE6688128F_AVX2_load_bits: 188| 91|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 91| int i, j; 190| 91| const unsigned char *ptr = bits; 191| | 192| 91| vec128 buf[64]; 193| | 194| 364| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 273, False: 91] ------------------ 195| 17.7k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 17.4k, False: 273] ------------------ 196| 17.4k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 17.4k| ptr += 8; 198| 17.4k| } 199| | 200| 273| transpose_64x128_sp( buf ); 201| | 202| 9.00k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 8.73k, False: 273] ------------------ 203| 8.73k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 8.73k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 8.73k| } 206| | 207| 273| ptr += 512; 208| 273| } 209| | 210| 1.27k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.18k, False: 91] ------------------ 211| 39.0k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 37.8k, False: 1.18k] ------------------ 212| 37.8k| bits_int[i][j] = load16(ptr); 213| 37.8k| ptr += 16; 214| 37.8k| } 215| 1.18k| } 216| | 217| 364| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 273, False: 91] ------------------ 218| 17.7k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 17.4k, False: 273] ------------------ 219| 17.4k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 17.4k| ptr += 8; 221| 17.4k| } 222| | 223| 273| transpose_64x128_sp( buf ); 224| | 225| 9.00k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 8.73k, False: 273] ------------------ 226| 8.73k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 8.73k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 8.73k| } 229| | 230| 273| ptr += 512; 231| 273| } 232| 91|} PQCLEAN_MCELIECE6688128F_AVX2_benes: 238| 182|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 182| int inc; 240| | 241| 182| vec128 *b_ptr; 242| | 243| 182| if (rev == 0) { ------------------ | Branch (243:9): [True: 91, False: 91] ------------------ 244| 91| inc = 32; 245| 91| b_ptr = b[ 0]; 246| 91| } else { 247| 91| inc = -32; 248| 91| b_ptr = b[24]; 249| 91| } 250| | 251| | // 252| | 253| 182| transpose_64x128_sp( r ); 254| | 255| 182| layer_0(r, b_ptr); 256| 182| b_ptr += inc; 257| 182| layer_1(r, b_ptr); 258| 182| b_ptr += inc; 259| 182| layer_2(r, b_ptr); 260| 182| b_ptr += inc; 261| 182| layer_3(r, b_ptr); 262| 182| b_ptr += inc; 263| 182| layer_4(r, b_ptr); 264| 182| b_ptr += inc; 265| 182| layer_5(r, b_ptr); 266| 182| b_ptr += inc; 267| | 268| 182| transpose_64x128_sp( r ); 269| | 270| 182| layer_x(r, b_ptr); 271| 182| b_ptr += inc; 272| 182| layer_0(r, b_ptr); 273| 182| b_ptr += inc; 274| 182| layer_1(r, b_ptr); 275| 182| b_ptr += inc; 276| 182| layer_2(r, b_ptr); 277| 182| b_ptr += inc; 278| 182| layer_3(r, b_ptr); 279| 182| b_ptr += inc; 280| 182| layer_4(r, b_ptr); 281| 182| b_ptr += inc; 282| 182| layer_5(r, b_ptr); 283| 182| b_ptr += inc; 284| 182| layer_4(r, b_ptr); 285| 182| b_ptr += inc; 286| 182| layer_3(r, b_ptr); 287| 182| b_ptr += inc; 288| 182| layer_2(r, b_ptr); 289| 182| b_ptr += inc; 290| 182| layer_1(r, b_ptr); 291| 182| b_ptr += inc; 292| 182| layer_0(r, b_ptr); 293| 182| b_ptr += inc; 294| 182| layer_x(r, b_ptr); 295| 182| b_ptr += inc; 296| | 297| 182| transpose_64x128_sp( r ); 298| | 299| 182| layer_5(r, b_ptr); 300| 182| b_ptr += inc; 301| 182| layer_4(r, b_ptr); 302| 182| b_ptr += inc; 303| 182| layer_3(r, b_ptr); 304| 182| b_ptr += inc; 305| 182| layer_2(r, b_ptr); 306| 182| b_ptr += inc; 307| 182| layer_1(r, b_ptr); 308| 182| b_ptr += inc; 309| 182| layer_0(r, b_ptr); 310| | 311| 182| transpose_64x128_sp( r ); 312| 182|} PQCLEAN_MCELIECE6688128F_AVX2_bm: 147| 91|void bm(vec128 *out, vec256 *in) { 148| 91| int i; 149| 91| uint16_t N, L; 150| 91| uint16_t mask; 151| 91| uint64_t one = 1, t; 152| | 153| 91| vec128 prod[ GFBITS ]; 154| 91| vec128 interval[GFBITS]; 155| | 156| 91| typedef union { 157| 91| vec128 v[GFBITS][2]; 158| 91| vec256 V[GFBITS]; 159| 91| } db_t; 160| | 161| 91| db_t db; 162| 91| db_t BC_tmp; 163| 91| db_t BC; 164| | 165| 91| gf d, b, c0 = 1; 166| 91| gf coefs[256]; 167| | 168| | // initialization 169| | 170| 91| get_coefs(coefs, in); 171| | 172| 91| BC.v[0][0] = vec128_set2x(0, one << 63); 173| 91| BC.v[0][1] = vec128_setzero(); 174| | 175| 1.18k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.18k|#define GFBITS 13 ------------------ | Branch (175:17): [True: 1.09k, False: 91] ------------------ 176| 1.09k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 177| 1.09k| } 178| | 179| 91| b = 1; 180| 91| L = 0; 181| | 182| | // 183| | 184| 1.27k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.27k|#define GFBITS 13 ------------------ | Branch (184:17): [True: 1.18k, False: 91] ------------------ 185| 1.18k| interval[i] = vec128_setzero(); 186| 1.18k| } 187| | 188| 23.3k| for (N = 0; N < 256; N++) { ------------------ | Branch (188:17): [True: 23.2k, False: 91] ------------------ 189| 23.2k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 23.2k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 23.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 190| 23.2k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 23.2k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 23.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 191| | 192| 23.2k| d = vec_reduce_asm(prod); ------------------ | | 3| 23.2k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 23.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 23.2k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 23.2k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 23.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 195| 23.2k| d ^= t & 0xFFFFFFFF; 196| | 197| 23.2k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 198| | 199| 326k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 326k|#define GFBITS 13 ------------------ | Branch (199:21): [True: 302k, False: 23.2k] ------------------ 200| 302k| db.v[i][0] = vec128_setbits((d >> i) & 1); 201| 302k| db.v[i][1] = vec128_setbits((b >> i) & 1); 202| 302k| } 203| | 204| 23.2k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 205| | 206| 23.2k| vec128_cmov(BC.v, mask); 207| 23.2k| update_asm(BC.v, c0 & mask, 32); ------------------ | | 1| 23.2k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 23.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| 326k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 326k|#define GFBITS 13 ------------------ | Branch (209:21): [True: 302k, False: 23.2k] ------------------ 210| 302k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 211| 302k| } 212| | 213| 23.2k| c0 = t >> 32; 214| 23.2k| b = (d & mask) | (b & ~mask); 215| 23.2k| L = ((N + 1 - L) & mask) | (L & ~mask); 216| 23.2k| } 217| | 218| 91| c0 = gf_inv(c0); ------------------ | | 11| 91|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 1.27k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.27k|#define GFBITS 13 ------------------ | Branch (220:17): [True: 1.18k, False: 91] ------------------ 221| 1.18k| prod[i] = vec128_setbits((c0 >> i) & 1); 222| 1.18k| } 223| | 224| 91| vec128_mul_asm(out, prod, BC.v[0] + 1, 32); ------------------ | | 10| 91|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 225| 91|} PQCLEAN_MCELIECE6688128F_AVX2_controlbitsfrompermutation: 205| 91|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 91| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 91|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 91| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 91|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 91| int16 diff; 209| 91| int i; 210| 91| unsigned char *ptr; 211| | 212| 91| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 91| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 91| while (1) { ------------------ | Branch (215:12): [True: 91, Folded] ------------------ 216| 91| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 91| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 745k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 745k, False: 91] ------------------ 222| 745k| pi_test[i] = (int16)i; 223| 745k| } 224| | 225| 91| ptr = out; 226| 1.27k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.18k, False: 91] ------------------ 227| 1.18k| layer(pi_test, ptr, i, (int32)n); 228| 1.18k| ptr += n >> 4; 229| 1.18k| } 230| | 231| 1.18k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.09k, False: 91] ------------------ 232| 1.09k| layer(pi_test, ptr, i, (int32)n); 233| 1.09k| ptr += n >> 4; 234| 1.09k| } 235| | 236| 91| diff = 0; 237| 745k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 745k, False: 91] ------------------ 238| 745k| diff |= pi[i] ^ pi_test[i]; 239| 745k| } 240| | 241| 91| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 91|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 242| 91| crypto_declassify(&diff, sizeof diff); 243| 91| if (diff == 0) { ------------------ | Branch (243:13): [True: 91, False: 0] ------------------ 244| 91| break; 245| 91| } 246| 91| } 247| 91|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_int16_negative_mask: 3| 182|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 182| return crypto_int16_x >> 15; 5| 182|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_int16_nonzero_mask: 7| 91|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 91| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 91|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 91|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 9| 91|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_int32_negative_mask: 3| 58.1M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 58.1M| return crypto_int32_x >> 31; 5| 58.1M|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_int32_min: 37| 58.1M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 58.1M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 58.1M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 58.1M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 58.1M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 58.1M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 58.1M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 42| 58.1M| crypto_int32_z &= crypto_int32_xy; 43| 58.1M| return crypto_int32_x ^ crypto_int32_z; 44| 58.1M|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint16_signed_negative_mask: 3| 130k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 130k| return crypto_uint16_signed_x >> 15; 5| 130k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint16_nonzero_mask: 7| 14.3k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 14.3k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 14.3k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 14.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 14.3k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 14.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 9| 14.3k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint16_zero_mask: 11| 14.3k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 14.3k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 14.3k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 14.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 13| 14.3k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint16_smaller_mask: 24| 101k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 101k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 101k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 101k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 101k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 101k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 101k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 29| 101k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint32_signed_negative_mask: 3| 165k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 165k| return crypto_uint32_signed_x >> 31; 5| 165k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint32_nonzero_mask: 7| 82.6k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 82.6k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 82.6k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 82.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 82.6k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 82.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 9| 82.6k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint32_unequal_mask: 15| 82.6k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 82.6k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 82.6k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 82.6k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 82.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 18| 82.6k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint32_equal_mask: 20| 82.6k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 82.6k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 82.6k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 82.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 22| 82.6k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint64_signed_negative_mask: 3| 1.98M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 1.98M| return crypto_uint64_signed_x >> 63; 5| 1.98M|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint64_nonzero_mask: 7| 990k|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 990k| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 990k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 990k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 990k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 990k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 9| 990k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint64_zero_mask: 11| 154k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 154k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 154k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 154k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 13| 154k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint64_unequal_mask: 15| 836k|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 836k| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 836k| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 836k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 836k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 18| 836k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint64_equal_mask: 20| 836k|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 836k| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 836k|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 836k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 22| 836k|} PQCLEAN_MCELIECE6688128F_AVX2_decrypt: 171| 91|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 91| int i; 173| | 174| 91| uint16_t check_synd; 175| 91| uint16_t check_weight; 176| | 177| 91| vec256 inv[ 32 ][ GFBITS ]; 178| 91| vec256 scaled[ 32 ][ GFBITS ]; 179| 91| vec256 eval[32][ GFBITS ]; 180| | 181| 91| vec128 error128[ 64 ]; 182| 91| vec256 error256[ 32 ]; 183| | 184| 91| vec256 s_priv[ GFBITS ]; 185| 91| vec256 s_priv_cmp[ GFBITS ]; 186| 91| vec128 locator[ GFBITS ]; 187| | 188| 91| vec128 recv128[ 64 ]; 189| 91| vec256 recv256[ 32 ]; 190| 91| vec256 allone; 191| | 192| 91| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 91| preprocess(recv128, s); 197| | 198| 91| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 91|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 91|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 91|#define SYS_T 128 | | ------------------ ------------------ 199| 91| benes(recv128, bits_int, 1); ------------------ | | 9| 91|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 91| reformat_128to256(recv256, recv128); 202| | 203| 91| scaling(scaled, inv, sk, recv256); 204| 91| fft_tr(s_priv, scaled); ------------------ | | 9| 91|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 205| 91| bm(locator, s_priv); ------------------ | | 10| 91|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 91| fft(eval, locator); ------------------ | | 10| 91|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 91| allone = vec256_set1_16b(0xFFFF); 212| | 213| 3.00k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 2.91k, False: 91] ------------------ 214| 2.91k| error256[i] = vec256_or_reduce(eval[i]); 215| 2.91k| error256[i] = vec256_xor(error256[i], allone); 216| 2.91k| } 217| | 218| 91| scaling_inv(scaled, inv, error256); 219| 91| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 91|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 91| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 91| reformat_256to128(error128, error256); 226| 91| benes(error128, bits_int, 0); ------------------ | | 9| 91|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 91| postprocess(e, error128); 229| | 230| 91| check_weight = weight_check(e, error128); 231| | 232| 91| return 1 - (check_synd & check_weight); 233| 91|} PQCLEAN_MCELIECE6688128F_AVX2_encrypt: 116| 91|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 117| 91| gen_e(e); 118| | 119| 91| syndrome_asm(s, pk, e); ------------------ | | 1| 91|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 120| 91|} PQCLEAN_MCELIECE6688128F_AVX2_fft: 277| 294|void fft(vec256 out[][GFBITS], vec128 *in) { 278| 294| radix_conversions(in); 279| 294| butterflies(out, in); 280| 294|} PQCLEAN_MCELIECE6688128F_AVX2_fft_tr: 380| 182|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 381| 182| butterflies_tr(out, in); 382| 182| radix_conversions_tr(out); 383| 182|} PQCLEAN_MCELIECE6688128F_AVX2_gf_mul: 12| 1.83M|gf gf_mul(gf in0, gf in1) { 13| 1.83M| int i; 14| | 15| 1.83M| uint64_t tmp; 16| 1.83M| uint64_t t0; 17| 1.83M| uint64_t t1; 18| 1.83M| uint64_t t; 19| | 20| 1.83M| t0 = in0; 21| 1.83M| t1 = in1; 22| | 23| 1.83M| tmp = t0 * (t1 & 1); 24| | 25| 23.8M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 23.8M|#define GFBITS 13 ------------------ | Branch (25:17): [True: 22.0M, False: 1.83M] ------------------ 26| 22.0M| tmp ^= (t0 * (t1 & (1 << i))); 27| 22.0M| } 28| | 29| | // 30| | 31| 1.83M| t = tmp & 0x1FF0000; 32| 1.83M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 33| | 34| 1.83M| t = tmp & 0x000E000; 35| 1.83M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 36| | 37| 1.83M| return tmp & GFMASK; ------------------ | | 19| 1.83M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.83M|#define GFBITS 13 | | ------------------ ------------------ 38| 1.83M|} PQCLEAN_MCELIECE6688128F_AVX2_gf_mul2: 41| 23.2k|uint64_t gf_mul2(gf a, gf b0, gf b1) { 42| 23.2k| int i; 43| | 44| 23.2k| uint64_t tmp = 0; 45| 23.2k| uint64_t t0; 46| 23.2k| uint64_t t1; 47| 23.2k| uint64_t t; 48| 23.2k| uint64_t mask = 0x0000000100000001; 49| | 50| 23.2k| t0 = a; 51| 23.2k| t1 = b1; 52| 23.2k| t1 = (t1 << 32) | b0; 53| | 54| 326k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 326k|#define GFBITS 13 ------------------ | Branch (54:17): [True: 302k, False: 23.2k] ------------------ 55| 302k| tmp ^= t0 * (t1 & mask); 56| 302k| mask += mask; 57| 302k| } 58| | 59| | // 60| | 61| 23.2k| t = tmp & 0x01FF000001FF0000; 62| 23.2k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 63| | 64| 23.2k| t = tmp & 0x0000E0000000E000; 65| 23.2k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 66| | 67| 23.2k| return tmp & 0x00001FFF00001FFF; 68| 23.2k|} PQCLEAN_MCELIECE6688128F_AVX2_gf_frac: 178| 14.4k|gf gf_frac(gf den, gf num) { 179| 14.4k| gf tmp_11; 180| 14.4k| gf tmp_1111; 181| 14.4k| gf out; 182| | 183| 14.4k| tmp_11 = gf_sqmul(den, den); // 11 184| 14.4k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // 1111 185| 14.4k| out = gf_sq2(tmp_1111); 186| 14.4k| out = gf_sq2mul(out, tmp_1111); // 11111111 187| 14.4k| out = gf_sq2(out); 188| 14.4k| out = gf_sq2mul(out, tmp_1111); // 111111111111 189| | 190| 14.4k| return gf_sqmul(out, num); // 1111111111110 191| 14.4k|} PQCLEAN_MCELIECE6688128F_AVX2_gf_inv: 194| 14.4k|gf gf_inv(gf den) { 195| 14.4k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 14.4k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 14.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 196| 14.4k|} pk_gen.c:PQCLEAN_MCELIECE6688128F_AVX2_int32_sort: 21| 91|static void int32_sort(int32_t *x, long long n) { 22| 91| long long top, p, q, r, i; 23| | 24| 91| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 91] ------------------ 25| 0| return; 26| 0| } 27| 91| top = 1; 28| 1.00k| while (top < n - top) { ------------------ | Branch (28:12): [True: 910, False: 91] ------------------ 29| 910| top += top; 30| 910| } 31| | 32| 1.09k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.00k, False: 91] ------------------ 33| 1.48M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.47M, False: 1.00k] ------------------ 34| 1.47M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 786k, False: 693k] ------------------ 35| 786k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 786k| do { \ | | 12| 786k| int32_t ab = (b) ^ (a); \ | | 13| 786k| int32_t c = (b) - (a); \ | | 14| 786k| c ^= ab & ((c) ^ (b)); \ | | 15| 786k| c >>= 31; \ | | 16| 786k| c &= ab; \ | | 17| 786k| (a) ^= c; \ | | 18| 786k| (b) ^= c; \ | | 19| 786k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 786k] | | ------------------ ------------------ 36| 786k| } 37| 1.47M| } 38| 1.00k| i = 0; 39| 6.00k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 5.00k, False: 1.00k] ------------------ 40| 1.33M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.32M, False: 5.00k] ------------------ 41| 1.32M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 693k, False: 634k] ------------------ 42| 693k| int32_t a = x[i + p]; 43| 4.06M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.37M, False: 693k] ------------------ 44| 3.37M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.37M| do { \ | | 12| 3.37M| int32_t ab = (b) ^ (a); \ | | 13| 3.37M| int32_t c = (b) - (a); \ | | 14| 3.37M| c ^= ab & ((c) ^ (b)); \ | | 15| 3.37M| c >>= 31; \ | | 16| 3.37M| c &= ab; \ | | 17| 3.37M| (a) ^= c; \ | | 18| 3.37M| (b) ^= c; \ | | 19| 3.37M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.37M] | | ------------------ ------------------ 45| 3.37M| } 46| 693k| x[i + p] = a; 47| 693k| } 48| 1.32M| } 49| 5.00k| } 50| 1.00k| } 51| 91|} controlbits.c:PQCLEAN_MCELIECE6688128F_AVX2_int32_sort: 21| 2.98M|static void int32_sort(int32_t *x, long long n) { 22| 2.98M| long long top, p, q, r, i; 23| | 24| 2.98M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 2.98M] ------------------ 25| 0| return; 26| 0| } 27| 2.98M| top = 1; 28| 10.4M| while (top < n - top) { ------------------ | Branch (28:12): [True: 7.47M, False: 2.98M] ------------------ 29| 7.47M| top += top; 30| 7.47M| } 31| | 32| 13.4M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 10.4M, False: 2.98M] ------------------ 33| 1.43G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.42G, False: 10.4M] ------------------ 34| 1.42G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 798M, False: 629M] ------------------ 35| 798M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 798M| do { \ | | 12| 798M| int32_t ab = (b) ^ (a); \ | | 13| 798M| int32_t c = (b) - (a); \ | | 14| 798M| c ^= ab & ((c) ^ (b)); \ | | 15| 798M| c >>= 31; \ | | 16| 798M| c &= ab; \ | | 17| 798M| (a) ^= c; \ | | 18| 798M| (b) ^= c; \ | | 19| 798M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 798M] | | ------------------ ------------------ 36| 798M| } 37| 1.42G| } 38| 10.4M| i = 0; 39| 28.3M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 17.9M, False: 10.4M] ------------------ 40| 1.27G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.25G, False: 17.9M] ------------------ 41| 1.25G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 629M, False: 629M] ------------------ 42| 629M| int32_t a = x[i + p]; 43| 3.72G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.09G, False: 629M] ------------------ 44| 3.09G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.09G| do { \ | | 12| 3.09G| int32_t ab = (b) ^ (a); \ | | 13| 3.09G| int32_t c = (b) - (a); \ | | 14| 3.09G| c ^= ab & ((c) ^ (b)); \ | | 15| 3.09G| c >>= 31; \ | | 16| 3.09G| c &= ab; \ | | 17| 3.09G| (a) ^= c; \ | | 18| 3.09G| (b) ^= c; \ | | 19| 3.09G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.09G] | | ------------------ ------------------ 45| 3.09G| } 46| 629M| x[i + p] = a; 47| 629M| } 48| 1.25G| } 49| 17.9M| } 50| 10.4M| } 51| 2.98M|} encrypt.c:PQCLEAN_MCELIECE6688128F_AVX2_int32_sort: 21| 651|static void int32_sort(int32_t *x, long long n) { 22| 651| long long top, p, q, r, i; 23| | 24| 651| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 651] ------------------ 25| 0| return; 26| 0| } 27| 651| top = 1; 28| 4.55k| while (top < n - top) { ------------------ | Branch (28:12): [True: 3.90k, False: 651] ------------------ 29| 3.90k| top += top; 30| 3.90k| } 31| | 32| 5.20k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 4.55k, False: 651] ------------------ 33| 505k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 500k, False: 4.55k] ------------------ 34| 500k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 291k, False: 208k] ------------------ 35| 291k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 291k| do { \ | | 12| 291k| int32_t ab = (b) ^ (a); \ | | 13| 291k| int32_t c = (b) - (a); \ | | 14| 291k| c ^= ab & ((c) ^ (b)); \ | | 15| 291k| c >>= 31; \ | | 16| 291k| c &= ab; \ | | 17| 291k| (a) ^= c; \ | | 18| 291k| (b) ^= c; \ | | 19| 291k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 291k] | | ------------------ ------------------ 36| 291k| } 37| 500k| } 38| 4.55k| i = 0; 39| 18.2k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 13.6k, False: 4.55k] ------------------ 40| 431k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 417k, False: 13.6k] ------------------ 41| 417k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 208k, False: 208k] ------------------ 42| 208k| int32_t a = x[i + p]; 43| 874k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 665k, False: 208k] ------------------ 44| 665k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 665k| do { \ | | 12| 665k| int32_t ab = (b) ^ (a); \ | | 13| 665k| int32_t c = (b) - (a); \ | | 14| 665k| c ^= ab & ((c) ^ (b)); \ | | 15| 665k| c >>= 31; \ | | 16| 665k| c &= ab; \ | | 17| 665k| (a) ^= c; \ | | 18| 665k| (b) ^= c; \ | | 19| 665k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 665k] | | ------------------ ------------------ 45| 665k| } 46| 208k| x[i + p] = a; 47| 208k| } 48| 417k| } 49| 13.6k| } 50| 4.55k| } 51| 651|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_enc: 22| 91|) { 23| 91| unsigned char e[ SYS_N / 8 ]; 24| 91| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 91| encrypt(c, pk, e); ------------------ | | 9| 91|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 91| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 91|#define SYS_N 6688 ------------------ 31| 91| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 91|#define SYS_N 6688 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 91|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 91|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 91|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 91|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 91| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 91| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 91|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 91| return 0; 36| 91|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_dec: 42| 91|) { 43| 91| int i; 44| | 45| 91| unsigned char ret_decrypt = 0; 46| | 47| 91| uint16_t m; 48| | 49| 91| unsigned char e[ SYS_N / 8 ]; 50| 91| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 91| unsigned char *x = preimage; 52| 91| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 91|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 91|#define SYS_T 128 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 91|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 91|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 91|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 91| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 91|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 91| m = ret_decrypt; 59| 91| m -= 1; 60| 91| m >>= 8; 61| | 62| 91| *x++ = m & 1; 63| 76.1k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 76.1k|#define SYS_N 6688 ------------------ | Branch (63:17): [True: 76.0k, False: 91] ------------------ 64| 76.0k| *x++ = (~m & s[i]) | (m & e[i]); 65| 76.0k| } 66| | 67| 19.0k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 19.0k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 19.0k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 19.0k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 19.0k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 18.9k, False: 91] ------------------ 68| 18.9k| *x++ = c[i]; 69| 18.9k| } 70| | 71| 91| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 91| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 91|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 91| return 0; 74| 91|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_keypair: 80| 91|) { 81| 91| int i; 82| 91| unsigned char seed[ 33 ] = {64}; 83| 91| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 91| unsigned char *rp, *skp; 85| 91| uint64_t pivots; 86| | 87| 91| gf f[ SYS_T ]; // element in GF(2^mt) 88| 91| gf irr[ SYS_T ]; // Goppa polynomial 89| 91| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 90| 91| int16_t pi[ 1 << GFBITS ]; // random permutation 91| | 92| 91| randombytes(seed + 1, 32); ------------------ | | 8| 91|#define randombytes OQS_randombytes ------------------ 93| | 94| 112| while (1) { ------------------ | Branch (94:12): [True: 112, Folded] ------------------ 95| 112| rp = &r[ sizeof(r) - 32 ]; 96| 112| skp = sk; 97| | 98| | // expanding and updating the seed 99| | 100| 112| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 112| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 112|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 101| 112| memcpy(skp, seed + 1, 32); 102| 112| skp += 32 + 8; 103| 112| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 104| | 105| | // generating irreducible polynomial 106| | 107| 112| rp -= sizeof(f); 108| | 109| 14.4k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 14.4k|#define SYS_T 128 ------------------ | Branch (109:21): [True: 14.3k, False: 112] ------------------ 110| 14.3k| f[i] = load_gf(rp + i * 2); 111| 14.3k| } 112| | 113| 112| if (genpoly_gen(irr, f)) { ------------------ | | 9| 112|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 112|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ | Branch (113:13): [True: 0, False: 112] ------------------ 114| 0| continue; 115| 0| } 116| | 117| 14.4k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 14.4k|#define SYS_T 128 ------------------ | Branch (117:21): [True: 14.3k, False: 112] ------------------ 118| 14.3k| store_gf(skp + i * 2, irr[i]); 119| 14.3k| } 120| | 121| 112| skp += IRR_BYTES; ------------------ | | 11| 112|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 112|#define SYS_T 128 | | ------------------ ------------------ 122| | 123| | // generating permutation 124| | 125| 112| rp -= sizeof(perm); 126| | 127| 917k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 917k|#define GFBITS 13 ------------------ | Branch (127:21): [True: 917k, False: 112] ------------------ 128| 917k| perm[i] = load4(rp + i * 4); 129| 917k| } 130| | 131| 112| if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 9| 112|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 112|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 11| 112|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 112|#define SYS_T 128 | | ------------------ ------------------ | Branch (131:13): [True: 21, False: 91] ------------------ 132| 21| continue; 133| 21| } 134| | 135| 91| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 91|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 91|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 91|#define GFBITS 13 ------------------ 136| 91| skp += COND_BYTES; ------------------ | | 10| 91|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 91|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 91|#define GFBITS 13 | | ------------------ ------------------ 137| | 138| | // storing the random string s 139| | 140| 91| rp -= SYS_N / 8; ------------------ | | 7| 91|#define SYS_N 6688 ------------------ 141| 91| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 91|#define SYS_N 6688 ------------------ 142| | 143| | // storing positions of the 32 pivots 144| | 145| 91| store8(sk + 32, pivots); 146| | 147| 91| break; 148| 112| } 149| | 150| 91| return 0; 151| 91|} PQCLEAN_MCELIECE6688128F_AVX2_pk_gen: 315| 112|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi, uint64_t *pivots) { 316| 112| int i, j, k, b; 317| 112| int row, c; 318| | 319| 112| union { 320| 112| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 321| 112| vec256 v[ PK_NROWS ][ nBlocks_I ]; 322| 112| } mat; 323| | 324| 112| union { 325| 112| uint64_t w[ PK_NROWS ][ 28 ]; 326| 112| vec256 v[ PK_NROWS ][ 7 ]; 327| 112| } par; 328| | 329| 112| uint16_t m; 330| 112| vec256 mm; 331| | 332| 112| vec128 sk_int[ GFBITS ]; 333| | 334| 112| vec256 consts[ 32 ][ GFBITS ]; 335| 112| vec256 eval[ 32 ][ GFBITS ]; 336| 112| vec256 prod[ 32 ][ GFBITS ]; 337| 112| vec256 tmp[ GFBITS ]; 338| | 339| 112| uint64_t list[1 << GFBITS]; 340| 112| uint64_t one = 1; 341| 112| uint64_t t; 342| | 343| 112| uint16_t ind[ PK_NROWS ]; 344| 112| uint16_t ind_inv[ PK_NROWS ]; 345| | 346| | // compute the inverses 347| | 348| 112| irr_load(sk_int, irr); 349| | 350| 112| fft(eval, sk_int); ------------------ | | 10| 112|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 112|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 351| | 352| 112| vec256_copy(prod[0], eval[0]); 353| | 354| 3.58k| for (i = 1; i < 32; i++) { ------------------ | Branch (354:17): [True: 3.47k, False: 112] ------------------ 355| 3.47k| vec256_mul(prod[i], prod[i - 1], eval[i]); 356| 3.47k| } 357| | 358| 112| vec256_inv(tmp, prod[31]); ------------------ | | 11| 112|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 112|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 359| | 360| 3.58k| for (i = 30; i >= 0; i--) { ------------------ | Branch (360:18): [True: 3.47k, False: 112] ------------------ 361| 3.47k| vec256_mul(prod[i + 1], prod[i], tmp); 362| 3.47k| vec256_mul(tmp, tmp, eval[i + 1]); 363| 3.47k| } 364| | 365| 112| vec256_copy(prod[0], tmp); 366| | 367| | // fill matrix 368| | 369| 112| de_bitslicing(list, prod); 370| | 371| 917k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 917k|#define GFBITS 13 ------------------ | Branch (371:17): [True: 917k, False: 112] ------------------ 372| 917k| list[i] <<= GFBITS; ------------------ | | 6| 917k|#define GFBITS 13 ------------------ 373| 917k| list[i] |= i; 374| 917k| list[i] |= ((uint64_t) perm[i]) << 31; 375| 917k| } 376| | 377| 112| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 112|#define GFBITS 13 ------------------ 378| | 379| 836k| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 836k|#define GFBITS 13 ------------------ | Branch (379:17): [True: 836k, False: 91] ------------------ 380| 836k| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (380:13): [True: 21, False: 835k] ------------------ 381| 21| return -1; 382| 21| } 383| 836k| } 384| | 385| 91| to_bitslicing_2x(consts, prod, list); 386| | 387| 745k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 745k|#define GFBITS 13 ------------------ | Branch (387:17): [True: 745k, False: 91] ------------------ 388| 745k| pi[i] = list[i] & GFMASK; ------------------ | | 19| 745k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 745k|#define GFBITS 13 | | ------------------ ------------------ 389| 745k| } 390| | 391| 728| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 728|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 728|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 728|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 728|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (391:17): [True: 637, False: 91] ------------------ 392| 8.91k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 8.91k|#define GFBITS 13 ------------------ | Branch (392:21): [True: 8.28k, False: 637] ------------------ 393| 8.28k| mat.v[ k ][ j ] = prod[ j ][ k ]; 394| 8.28k| } 395| 637| } 396| | 397| 11.6k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 11.6k|#define SYS_T 128 ------------------ | Branch (397:17): [True: 11.5k, False: 91] ------------------ 398| 92.4k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 92.4k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 92.4k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 92.4k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 92.4k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (398:21): [True: 80.8k, False: 11.5k] ------------------ 399| 80.8k| vec256_mul(prod[j], prod[j], consts[j]); 400| | 401| 1.13M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 1.13M|#define GFBITS 13 ------------------ | Branch (401:25): [True: 1.05M, False: 80.8k] ------------------ 402| 1.05M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 1.05M|#define GFBITS 13 ------------------ 403| 1.05M| } 404| 80.8k| } 405| 11.5k| } 406| | 407| | // gaussian elimination to obtain L, U, and P such that LP M = U 408| | // L and U are stored in the space of M 409| | // P is stored in ind 410| | 411| 151k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 151k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 151k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 151k|#define GFBITS 13 | | ------------------ ------------------ | Branch (411:17): [True: 151k, False: 91] ------------------ 412| 151k| ind_inv[i] = ind[ i ] = i; 413| 151k| } 414| | 415| 151k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 151k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 151k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 151k|#define GFBITS 13 | | ------------------ ------------------ | Branch (415:19): [True: 151k, False: 91] ------------------ 416| 151k| i = row >> 6; 417| 151k| j = row & 63; 418| | 419| 151k| if (row == PK_NROWS - 32) { ------------------ | | 13| 151k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 151k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 151k|#define GFBITS 13 | | ------------------ ------------------ | Branch (419:13): [True: 91, False: 151k] ------------------ 420| 91| if (mov_columns(mat.w, pi, pivots)) { ------------------ | Branch (420:17): [True: 0, False: 91] ------------------ 421| 0| return -1; 422| 0| } 423| 91| } 424| | 425| 126M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 126M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 126M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 126M|#define GFBITS 13 | | ------------------ ------------------ | Branch (425:27): [True: 125M, False: 151k] ------------------ 426| 125M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 427| 125M| uint16_cswap(&ind[row], &ind[k], m); 428| | 429| 125M| mm = vec256_set1_16b(m); 430| 1.00G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 1.00G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 1.00G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 1.00G|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 1.00G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (430:25): [True: 881M, False: 125M] ------------------ 431| 881M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 432| 881M| } 433| 125M| } 434| | 435| 151k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (435:14): [True: 0, False: 151k] ------------------ 436| 0| return -1; 437| 0| } 438| | 439| 126M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 126M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 126M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 126M|#define GFBITS 13 | | ------------------ ------------------ | Branch (439:27): [True: 125M, False: 151k] ------------------ 440| 125M| t = mat.w[ k ][ i ] & (one << j); 441| 125M| mm = extract_mask256(mat.w[k], row); 442| | 443| 1.00G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 1.00G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 1.00G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 1.00G|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 1.00G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (443:25): [True: 881M, False: 125M] ------------------ 444| 881M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 445| 881M| } 446| | 447| 125M| mat.w[ k ][ i ] |= t; 448| 125M| } 449| 151k| } 450| | 451| | // apply M^-1 to the remaining columns 452| | 453| 91| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 91|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 91|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 91|#define GFBITS 13 | | ------------------ ------------------ 454| | 455| 364| for (j = 6; j < 27; j += par_width) { ------------------ | | 33| 273|#define par_width 7 ------------------ | Branch (455:17): [True: 273, False: 91] ------------------ 456| 3.82k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 3.82k|#define GFBITS 13 ------------------ | Branch (456:21): [True: 3.54k, False: 273] ------------------ 457| 28.3k| for (b = 0; b < par_width; b++) { ------------------ | | 33| 28.3k|#define par_width 7 ------------------ | Branch (457:25): [True: 24.8k, False: 3.54k] ------------------ 458| 24.8k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 459| 24.8k| } 460| 3.54k| } 461| | 462| 34.9k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 34.9k|#define SYS_T 128 ------------------ | Branch (462:21): [True: 34.6k, False: 273] ------------------ 463| 277k| for (b = 0; b < par_width; b++) { ------------------ | | 33| 277k|#define par_width 7 ------------------ | Branch (463:25): [True: 242k, False: 34.6k] ------------------ 464| 242k| vec256_mul(prod[ j + b ], prod[ j + b ], consts[ j + b ]); 465| 242k| } 466| | 467| 485k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 485k|#define GFBITS 13 ------------------ | Branch (467:25): [True: 450k, False: 34.6k] ------------------ 468| 3.60M| for (b = 0; b < par_width; b++) { ------------------ | | 33| 3.60M|#define par_width 7 ------------------ | Branch (468:29): [True: 3.15M, False: 450k] ------------------ 469| 3.15M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 3.15M|#define GFBITS 13 ------------------ 470| 3.15M| } 471| 450k| } 472| 34.6k| } 473| | 474| | // apply P 475| | 476| 454k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 454k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 454k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 454k|#define GFBITS 13 | | ------------------ ------------------ | Branch (476:21): [True: 454k, False: 273] ------------------ 477| 454k| ind[i] = ind_inv[i]; 478| 454k| } 479| | 480| 273| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 273|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 273|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 273|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 273|#define GFBITS 13 | | ------------------ ------------------ 481| | 482| | // apply L 483| | 484| 454k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 273|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 273|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 273|#define GFBITS 13 | | ------------------ ------------------ | Branch (484:34): [True: 454k, False: 273] ------------------ 485| 378M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (485:31): [True: 377M, False: 454k] ------------------ 486| 377M| mm = extract_mask256(mat.w[row], i); 487| | 488| 3.02G| for (k = 0; k < par_width; k++) { ------------------ | | 33| 3.02G|#define par_width 7 ------------------ | Branch (488:29): [True: 2.64G, False: 377M] ------------------ 489| 2.64G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 490| 2.64G| } 491| 377M| } 492| 454k| } 493| | 494| | // apply U^-1 495| | 496| 273| if (j == 6) { ------------------ | Branch (496:13): [True: 91, False: 182] ------------------ 497| 151k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 151k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 151k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 151k|#define GFBITS 13 | | ------------------ ------------------ | Branch (497:25): [True: 151k, False: 91] ------------------ 498| 151k| par.v[i][0] = mat.v[i][ nBlocks_I - 1 ]; ------------------ | | 32| 151k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 151k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 151k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 151k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 499| 151k| } 500| 91| } 501| | 502| 454k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 273|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 273|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 273|#define GFBITS 13 | | ------------------ ------------------ | Branch (502:34): [True: 454k, False: 273] ------------------ 503| 378M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 454k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 454k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 454k|#define GFBITS 13 | | ------------------ ------------------ | Branch (503:36): [True: 377M, False: 454k] ------------------ 504| 377M| mm = extract_mask256(mat.w[row], i); 505| | 506| 3.02G| for (k = 0; k < par_width; k++) { ------------------ | | 33| 3.02G|#define par_width 7 ------------------ | Branch (506:29): [True: 2.64G, False: 377M] ------------------ 507| 2.64G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 508| 2.64G| } 509| 377M| } 510| 454k| } 511| | 512| | // 513| | 514| 273| if (j + par_width < 27) { ------------------ | | 33| 273|#define par_width 7 ------------------ | Branch (514:13): [True: 182, False: 91] ------------------ 515| 303k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 303k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 303k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 303k|#define GFBITS 13 | | ------------------ ------------------ | Branch (515:27): [True: 302k, False: 182] ------------------ 516| 302k| if (j == 6) { ------------------ | Branch (516:21): [True: 151k, False: 151k] ------------------ 517| 151k| k = 2; 518| 151k| } else { 519| 151k| k = 0; 520| 151k| } 521| 8.47M| for (; k < 28; k++) { ------------------ | Branch (521:24): [True: 8.17M, False: 302k] ------------------ 522| 8.17M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 8.17M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 8.17M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 8.17M|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 8.17M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 8.17M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 8.17M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 523| 8.17M| } 524| 302k| } 525| 182| } else { 526| 151k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 151k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 151k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 151k|#define GFBITS 13 | | ------------------ ------------------ | Branch (526:27): [True: 151k, False: 91] ------------------ 527| 3.78M| for (k = 0; k < 24; k++) { ------------------ | Branch (527:29): [True: 3.63M, False: 151k] ------------------ 528| 3.63M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 3.63M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 3.63M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 3.63M|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 3.63M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 3.63M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 3.63M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 529| 3.63M| } 530| | 531| 151k| store_i(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k], 4); ------------------ | | 15| 151k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 151k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 151k|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 151k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 151k|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 151k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 532| 151k| } 533| 91| } 534| 273| } 535| | 536| | // 537| | 538| 91| return 0; 539| 91|} PQCLEAN_MCELIECE6688128F_AVX2_genpoly_gen: 88| 112|int genpoly_gen(gf *out, gf *f) { 89| 112| int i, j, k; 90| | 91| 112| gf t, inv; 92| | 93| 112| uint64_t m; 94| 112| vec128 mask; 95| | 96| 112| union { 97| 112| uint64_t d[ GFBITS ][ 128 ][2]; 98| 112| vec128 v[ GFBITS ][ 128 ]; 99| 112| } buf; 100| | 101| 112| union { 102| 112| uint64_t d[GFBITS][2]; 103| 112| vec128 v[GFBITS]; 104| 112| } v; 105| | 106| 112| union { 107| 112| uint64_t d[SYS_T][GFBITS][2]; 108| 112| vec128 v[SYS_T][GFBITS]; 109| 112| } mat; 110| | 111| | // fill matrix 112| | 113| 112| buf.v[0][0] = vec128_set2x(1, 0); 114| 1.45k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.45k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 1.34k, False: 112] ------------------ 115| 1.34k| buf.v[i][0] = vec128_setzero(); 116| 1.34k| } 117| | 118| 1.56k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 1.56k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 1.45k, False: 112] ------------------ 119| 1.45k| v.v[j] = vec128_setzero(); 120| | 121| 187k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 1.45k|#define SYS_T 128 ------------------ | Branch (121:29): [True: 186k, False: 1.45k] ------------------ 122| 186k| v.d[j][1] <<= 1; 123| 186k| v.d[j][1] |= v.d[j][0] >> 63; 124| 186k| v.d[j][0] <<= 1; 125| 186k| v.d[j][0] |= (f[i] >> j) & 1; 126| 186k| } 127| 1.45k| } 128| | 129| 1.56k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.56k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 1.45k, False: 112] ------------------ 130| 1.45k| buf.v[i][1] = v.v[i]; 131| 1.45k| } 132| | 133| 14.3k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 14.3k|#define SYS_T 128 ------------------ | Branch (133:17): [True: 14.2k, False: 112] ------------------ 134| 14.2k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 14.2k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 14.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 14.2k| if (k < SYS_T) { ------------------ | | 8| 14.2k|#define SYS_T 128 ------------------ | Branch (136:13): [True: 14.1k, False: 112] ------------------ 137| 197k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 197k|#define GFBITS 13 ------------------ | Branch (137:25): [True: 183k, False: 14.1k] ------------------ 138| 183k| buf.v[i][k] = v.v[i]; 139| 183k| } 140| 14.1k| } else { 141| 14.4k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 14.4k|#define SYS_T 128 ------------------ | Branch (141:25): [True: 14.3k, False: 112] ------------------ 142| 14.3k| out[i] = extract_gf(v.d, i); 143| 14.3k| } 144| 112| } 145| 14.2k| } 146| | 147| 1.56k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.56k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 1.45k, False: 112] ------------------ 148| 1.45k| transpose_128x128(buf.d[i]); 149| 1.45k| } 150| | 151| 14.4k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 14.4k|#define SYS_T 128 ------------------ | Branch (151:17): [True: 14.3k, False: 112] ------------------ 152| 200k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 200k|#define GFBITS 13 ------------------ | Branch (152:21): [True: 186k, False: 14.3k] ------------------ 153| 186k| mat.v[j][i] = buf.v[i][j]; 154| 186k| } 155| 14.3k| } 156| | 157| | // gaussian 158| | 159| 14.4k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 14.4k|#define SYS_T 128 ------------------ | Branch (159:17): [True: 14.3k, False: 112] ------------------ 160| 924k| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 924k|#define SYS_T 128 ------------------ | Branch (160:25): [True: 910k, False: 14.3k] ------------------ 161| 910k| m = extract_bit(mat.d[i], i); 162| 910k| m -= 1; 163| 910k| mask = vec128_set2x(m, m); 164| | 165| 12.7M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 12.7M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 11.8M, False: 910k] ------------------ 166| 11.8M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 11.8M| } 168| | 169| 910k| out[i] ^= out[j] & m; 170| 910k| } 171| | 172| | // 173| | 174| 14.3k| t = extract_gf(mat.d[i], i); 175| | 176| 14.3k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 14.3k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 14.3k| inv = gf_inv(t); ------------------ | | 11| 14.3k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 14.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 183| 14.3k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 14.3k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 14.3k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 14.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 1.84M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 1.84M|#define SYS_T 128 ------------------ | Branch (187:21): [True: 1.83M, False: 14.3k] ------------------ 188| 1.83M| if (j != i) { ------------------ | Branch (188:17): [True: 1.82M, False: 14.3k] ------------------ 189| 1.82M| t = extract_gf(mat.d[j], i); 190| | 191| 1.82M| vec128_mul_gf(v.v, mat.v[i], t); 192| 1.82M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 1.82M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 1.82M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 1.82M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 195| 1.82M| } 196| 1.83M| } 197| 14.3k| } 198| | 199| 112| return 0; 200| 112|} PQCLEAN_MCELIECE6688128F_AVX2_vec128_mul_GF: 6| 14.2k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 14.2k| int i, j; 8| 14.2k| uint64_t buf[GFBITS][4]; 9| 14.2k| vec128 prod[GFBITS]; 10| 14.2k| uint64_t p[GFBITS]; 11| | 12| | // polynomial multiplication 13| | 14| 199k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 199k|#define GFBITS 13 ------------------ | Branch (14:17): [True: 184k, False: 14.2k] ------------------ 15| 184k| buf[i][0] = 0; 16| 184k| buf[i][1] = 0; 17| 184k| buf[i][2] = 0; 18| 184k| buf[i][3] = 0; 19| 184k| } 20| | 21| 1.83M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 14.2k|#define SYS_T 128 ------------------ | Branch (21:25): [True: 1.82M, False: 14.2k] ------------------ 22| 25.4M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 25.4M|#define GFBITS 13 ------------------ | Branch (22:21): [True: 23.6M, False: 1.82M] ------------------ 23| 23.6M| buf[j][3] <<= 1; 24| 23.6M| buf[j][3] |= buf[j][2] >> 63; 25| 23.6M| buf[j][2] <<= 1; 26| 23.6M| buf[j][2] |= buf[j][1] >> 63; 27| 23.6M| buf[j][1] <<= 1; 28| 23.6M| buf[j][1] |= buf[j][0] >> 63; 29| 23.6M| buf[j][0] <<= 1; 30| 23.6M| } 31| | 32| 1.82M| vec128_mul_gf(prod, v, a[i]); 33| | 34| 25.4M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 25.4M|#define GFBITS 13 ------------------ | Branch (34:21): [True: 23.6M, False: 1.82M] ------------------ 35| 23.6M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 23.6M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 23.6M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 23.6M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 37| 23.6M| } 38| 1.82M| } 39| | 40| | // reduction modulo y^128+y^7+y^2+y+1 41| | 42| 199k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 199k|#define GFBITS 13 ------------------ | Branch (42:17): [True: 184k, False: 14.2k] ------------------ 43| 184k| p[i] = buf[i][3]; 44| | 45| 184k| buf[i][2] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 184k|#define SYS_T 128 ------------------ 46| 184k| buf[i][1] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 184k|#define SYS_T 128 ------------------ 47| 184k| buf[i][2] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 184k|#define SYS_T 128 ------------------ 48| 184k| buf[i][1] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 184k|#define SYS_T 128 ------------------ 49| 184k| buf[i][2] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 184k|#define SYS_T 128 ------------------ 50| 184k| buf[i][1] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 184k|#define SYS_T 128 ------------------ 51| 184k| buf[i][1] ^= p[i]; 52| 184k| } 53| | 54| | // 55| | 56| 199k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 199k|#define GFBITS 13 ------------------ | Branch (56:17): [True: 184k, False: 14.2k] ------------------ 57| 184k| p[i] = buf[i][2]; 58| | 59| 184k| buf[i][1] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 184k|#define SYS_T 128 ------------------ 60| 184k| buf[i][0] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 184k|#define SYS_T 128 ------------------ 61| 184k| buf[i][1] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 184k|#define SYS_T 128 ------------------ 62| 184k| buf[i][0] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 184k|#define SYS_T 128 ------------------ 63| 184k| buf[i][1] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 184k|#define SYS_T 128 ------------------ 64| 184k| buf[i][0] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 184k|#define SYS_T 128 ------------------ 65| 184k| buf[i][0] ^= p[i]; 66| 184k| } 67| | 68| | // 69| | 70| 199k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 199k|#define GFBITS 13 ------------------ | Branch (70:17): [True: 184k, False: 14.2k] ------------------ 71| 184k| out[i] = vec128_set2x(buf[i][0], buf[i][1]); 72| 184k| } 73| 14.2k|} PQCLEAN_MCELIECE6688128F_AVX2_vec256_sq: 9| 5.34k|void vec256_sq(vec256 *out, vec256 *in) { 10| 5.34k| int i; 11| 5.34k| vec256 result[GFBITS], t; 12| | 13| 5.34k| t = vec256_xor(in[11], in[12]); 14| | 15| 5.34k| result[0] = vec256_xor(in[0], in[11]); 16| 5.34k| result[1] = vec256_xor(in[7], t); 17| 5.34k| result[2] = vec256_xor(in[1], in[7]); 18| 5.34k| result[3] = vec256_xor(in[8], t); 19| 5.34k| result[4] = vec256_xor(in[2], in[7]); 20| 5.34k| result[4] = vec256_xor(result[4], in[8]); 21| 5.34k| result[4] = vec256_xor(result[4], t); 22| 5.34k| result[5] = vec256_xor(in[7], in[9]); 23| 5.34k| result[6] = vec256_xor(in[3], in[8]); 24| 5.34k| result[6] = vec256_xor(result[6], in[9]); 25| 5.34k| result[6] = vec256_xor(result[6], in[12]); 26| 5.34k| result[7] = vec256_xor(in[8], in[10]); 27| 5.34k| result[8] = vec256_xor(in[4], in[9]); 28| 5.34k| result[8] = vec256_xor(result[8], in[10]); 29| 5.34k| result[9] = vec256_xor(in[9], in[11]); 30| 5.34k| result[10] = vec256_xor(in[5], in[10]); 31| 5.34k| result[10] = vec256_xor(result[10], in[11]); 32| 5.34k| result[11] = vec256_xor(in[10], in[12]); 33| 5.34k| result[12] = vec256_xor(in[6], t); 34| | 35| 74.8k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 74.8k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 69.5k, False: 5.34k] ------------------ 36| 69.5k| out[i] = result[i]; 37| 69.5k| } 38| 5.34k|} PQCLEAN_MCELIECE6688128F_AVX2_vec256_inv: 41| 203|void vec256_inv(vec256 *out, vec256 *in) { 42| 203| vec256 tmp_11[ GFBITS ]; 43| 203| vec256 tmp_1111[ GFBITS ]; 44| | 45| 203| vec256_copy(out, in); 46| | 47| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 48| 203| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 203| vec256_sq(out, tmp_11); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 51| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 52| 203| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 203| vec256_sq(out, tmp_1111); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 55| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 56| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 57| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 58| 203| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 61| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 62| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 63| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 64| 203| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 203| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 67| 203|} PQCLEAN_MCELIECE6960119_AVX2_load_bits: 188| 109|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 109| int i, j; 190| 109| const unsigned char *ptr = bits; 191| | 192| 109| vec128 buf[64]; 193| | 194| 436| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 327, False: 109] ------------------ 195| 21.2k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 20.9k, False: 327] ------------------ 196| 20.9k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 20.9k| ptr += 8; 198| 20.9k| } 199| | 200| 327| transpose_64x128_sp( buf ); 201| | 202| 10.7k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 10.4k, False: 327] ------------------ 203| 10.4k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 10.4k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 10.4k| } 206| | 207| 327| ptr += 512; 208| 327| } 209| | 210| 1.52k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.41k, False: 109] ------------------ 211| 46.7k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 45.3k, False: 1.41k] ------------------ 212| 45.3k| bits_int[i][j] = load16(ptr); 213| 45.3k| ptr += 16; 214| 45.3k| } 215| 1.41k| } 216| | 217| 436| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 327, False: 109] ------------------ 218| 21.2k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 20.9k, False: 327] ------------------ 219| 20.9k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 20.9k| ptr += 8; 221| 20.9k| } 222| | 223| 327| transpose_64x128_sp( buf ); 224| | 225| 10.7k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 10.4k, False: 327] ------------------ 226| 10.4k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 10.4k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 10.4k| } 229| | 230| 327| ptr += 512; 231| 327| } 232| 109|} PQCLEAN_MCELIECE6960119_AVX2_benes: 238| 218|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 218| int inc; 240| | 241| 218| vec128 *b_ptr; 242| | 243| 218| if (rev == 0) { ------------------ | Branch (243:9): [True: 109, False: 109] ------------------ 244| 109| inc = 32; 245| 109| b_ptr = b[ 0]; 246| 109| } else { 247| 109| inc = -32; 248| 109| b_ptr = b[24]; 249| 109| } 250| | 251| | // 252| | 253| 218| transpose_64x128_sp( r ); 254| | 255| 218| layer_0(r, b_ptr); 256| 218| b_ptr += inc; 257| 218| layer_1(r, b_ptr); 258| 218| b_ptr += inc; 259| 218| layer_2(r, b_ptr); 260| 218| b_ptr += inc; 261| 218| layer_3(r, b_ptr); 262| 218| b_ptr += inc; 263| 218| layer_4(r, b_ptr); 264| 218| b_ptr += inc; 265| 218| layer_5(r, b_ptr); 266| 218| b_ptr += inc; 267| | 268| 218| transpose_64x128_sp( r ); 269| | 270| 218| layer_x(r, b_ptr); 271| 218| b_ptr += inc; 272| 218| layer_0(r, b_ptr); 273| 218| b_ptr += inc; 274| 218| layer_1(r, b_ptr); 275| 218| b_ptr += inc; 276| 218| layer_2(r, b_ptr); 277| 218| b_ptr += inc; 278| 218| layer_3(r, b_ptr); 279| 218| b_ptr += inc; 280| 218| layer_4(r, b_ptr); 281| 218| b_ptr += inc; 282| 218| layer_5(r, b_ptr); 283| 218| b_ptr += inc; 284| 218| layer_4(r, b_ptr); 285| 218| b_ptr += inc; 286| 218| layer_3(r, b_ptr); 287| 218| b_ptr += inc; 288| 218| layer_2(r, b_ptr); 289| 218| b_ptr += inc; 290| 218| layer_1(r, b_ptr); 291| 218| b_ptr += inc; 292| 218| layer_0(r, b_ptr); 293| 218| b_ptr += inc; 294| 218| layer_x(r, b_ptr); 295| 218| b_ptr += inc; 296| | 297| 218| transpose_64x128_sp( r ); 298| | 299| 218| layer_5(r, b_ptr); 300| 218| b_ptr += inc; 301| 218| layer_4(r, b_ptr); 302| 218| b_ptr += inc; 303| 218| layer_3(r, b_ptr); 304| 218| b_ptr += inc; 305| 218| layer_2(r, b_ptr); 306| 218| b_ptr += inc; 307| 218| layer_1(r, b_ptr); 308| 218| b_ptr += inc; 309| 218| layer_0(r, b_ptr); 310| | 311| 218| transpose_64x128_sp( r ); 312| 218|} PQCLEAN_MCELIECE6960119_AVX2_bm: 147| 109|void bm(vec128 *out, vec256 *in) { 148| 109| int i; 149| 109| uint16_t N, L; 150| 109| uint16_t mask; 151| 109| uint64_t one = 1; 152| 109| uint64_t v[2]; 153| | 154| 109| vec128 prod[ GFBITS ]; 155| 109| vec128 interval[GFBITS]; 156| | 157| 109| typedef union { 158| 109| vec128 v[GFBITS][2]; 159| 109| vec256 V[GFBITS]; 160| 109| } db_t; 161| | 162| 109| db_t db; 163| 109| db_t BC_tmp; 164| 109| db_t BC; 165| | 166| 109| gf d, b; 167| 109| gf coefs[256]; 168| | 169| | // initialization 170| | 171| 109| get_coefs(coefs, in); 172| | 173| 109| BC.v[0][0] = vec128_set2x(0, one << 62); 174| 109| BC.v[0][1] = vec128_set2x(0, one << 63); 175| | 176| 1.41k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.41k|#define GFBITS 13 ------------------ | Branch (176:17): [True: 1.30k, False: 109] ------------------ 177| 1.30k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 178| 1.30k| } 179| | 180| 109| b = 1; 181| 109| L = 0; 182| | 183| | // 184| | 185| 1.52k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.52k|#define GFBITS 13 ------------------ | Branch (185:17): [True: 1.41k, False: 109] ------------------ 186| 1.41k| interval[i] = vec128_setzero(); 187| 1.41k| } 188| | 189| 26.0k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 26.0k|#define SYS_T 119 ------------------ | Branch (189:17): [True: 25.9k, False: 109] ------------------ 190| 25.9k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 25.9k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 25.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 191| 25.9k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 25.9k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 25.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 192| | 193| 25.9k| d = vec_reduce_asm(prod); ------------------ | | 3| 25.9k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 25.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 194| | 195| 25.9k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 196| | 197| 363k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 363k|#define GFBITS 13 ------------------ | Branch (197:21): [True: 337k, False: 25.9k] ------------------ 198| 337k| db.v[i][0] = vec128_setbits((d >> i) & 1); 199| 337k| db.v[i][1] = vec128_setbits((b >> i) & 1); 200| 337k| } 201| | 202| 25.9k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 203| | 204| 25.9k| vec128_cmov(BC.v, mask); 205| 25.9k| update_asm(BC.v, 0, 32); ------------------ | | 1| 25.9k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 25.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 363k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 363k|#define GFBITS 13 ------------------ | Branch (207:21): [True: 337k, False: 25.9k] ------------------ 208| 337k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 209| 337k| } 210| | 211| 25.9k| b = (d & mask) | (b & ~mask); 212| 25.9k| L = ((N + 1 - L) & mask) | (L & ~mask); 213| 25.9k| } 214| | 215| 1.52k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.52k|#define GFBITS 13 ------------------ | Branch (215:17): [True: 1.41k, False: 109] ------------------ 216| 1.41k| v[0] = vec128_extract(BC.v[i][1], 0); ------------------ | | 29| 1.41k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 217| 1.41k| v[1] = vec128_extract(BC.v[i][1], 1); ------------------ | | 29| 1.41k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 218| | 219| 1.41k| out[i] = vec128_set2x((v[0] >> 8) | (v[1] << 56), v[1] >> 8); 220| 1.41k| } 221| 109|} PQCLEAN_MCELIECE6960119_AVX2_controlbitsfrompermutation: 205| 109|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 109| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 109|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 109| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 109|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 109| int16 diff; 209| 109| int i; 210| 109| unsigned char *ptr; 211| | 212| 109| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 109| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 109| while (1) { ------------------ | Branch (215:12): [True: 109, Folded] ------------------ 216| 109| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 109| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 893k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 892k, False: 109] ------------------ 222| 892k| pi_test[i] = (int16)i; 223| 892k| } 224| | 225| 109| ptr = out; 226| 1.52k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.41k, False: 109] ------------------ 227| 1.41k| layer(pi_test, ptr, i, (int32)n); 228| 1.41k| ptr += n >> 4; 229| 1.41k| } 230| | 231| 1.41k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.30k, False: 109] ------------------ 232| 1.30k| layer(pi_test, ptr, i, (int32)n); 233| 1.30k| ptr += n >> 4; 234| 1.30k| } 235| | 236| 109| diff = 0; 237| 893k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 892k, False: 109] ------------------ 238| 892k| diff |= pi[i] ^ pi_test[i]; 239| 892k| } 240| | 241| 109| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 109|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 242| 109| crypto_declassify(&diff, sizeof diff); 243| 109| if (diff == 0) { ------------------ | Branch (243:13): [True: 109, False: 0] ------------------ 244| 109| break; 245| 109| } 246| 109| } 247| 109|} PQCLEAN_MCELIECE6960119_AVX2_crypto_int16_negative_mask: 3| 218|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 218| return crypto_int16_x >> 15; 5| 218|} PQCLEAN_MCELIECE6960119_AVX2_crypto_int16_nonzero_mask: 7| 109|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 109| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 109|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 109|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 9| 109|} PQCLEAN_MCELIECE6960119_AVX2_crypto_int32_negative_mask: 3| 69.6M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 69.6M| return crypto_int32_x >> 31; 5| 69.6M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_int32_min: 37| 69.6M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 69.6M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 69.6M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 69.6M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 69.6M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 69.6M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 69.6M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 42| 69.6M| crypto_int32_z &= crypto_int32_xy; 43| 69.6M| return crypto_int32_x ^ crypto_int32_z; 44| 69.6M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint16_signed_negative_mask: 3| 365k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 365k| return crypto_uint16_signed_x >> 15; 5| 365k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint16_nonzero_mask: 7| 143k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 143k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 143k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 143k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 143k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 143k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 9| 143k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint16_zero_mask: 11| 143k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 143k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 143k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 143k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 13| 143k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint16_smaller_mask: 24| 79.7k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 79.7k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 79.7k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 79.7k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 79.7k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 79.7k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 79.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 29| 79.7k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint32_signed_negative_mask: 3| 134k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 134k| return crypto_uint32_signed_x >> 31; 5| 134k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint32_nonzero_mask: 7| 67.1k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 67.1k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 67.1k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 67.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 67.1k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 67.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 9| 67.1k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint32_unequal_mask: 15| 67.1k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 67.1k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 67.1k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 67.1k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 67.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 18| 67.1k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint32_equal_mask: 20| 67.1k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 67.1k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 67.1k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 67.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 22| 67.1k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint64_signed_negative_mask: 3| 23.0M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 23.0M| return crypto_uint64_signed_x >> 63; 5| 23.0M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint64_nonzero_mask: 7| 11.5M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 11.5M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 11.5M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 11.5M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 11.5M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 11.5M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 9| 11.5M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint64_zero_mask: 11| 1.80M|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 1.80M| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 1.80M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 1.80M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 13| 1.80M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint64_unequal_mask: 15| 9.70M|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 9.70M| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 9.70M| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 9.70M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 9.70M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 18| 9.70M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint64_equal_mask: 20| 9.70M|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 9.70M| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 9.70M|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 9.70M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 22| 9.70M|} PQCLEAN_MCELIECE6960119_AVX2_decrypt: 171| 109|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 109| int i; 173| | 174| 109| uint16_t check_synd; 175| 109| uint16_t check_weight; 176| | 177| 109| vec256 inv[ 32 ][ GFBITS ]; 178| 109| vec256 scaled[ 32 ][ GFBITS ]; 179| 109| vec256 eval[32][ GFBITS ]; 180| | 181| 109| vec128 error128[ 64 ]; 182| 109| vec256 error256[ 32 ]; 183| | 184| 109| vec256 s_priv[ GFBITS ]; 185| 109| vec256 s_priv_cmp[ GFBITS ]; 186| 109| vec128 locator[ GFBITS ]; 187| | 188| 109| vec128 recv128[ 64 ]; 189| 109| vec256 recv256[ 32 ]; 190| 109| vec256 allone; 191| | 192| 109| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 109| preprocess(recv128, s); 197| | 198| 109| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 109|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 109|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 109|#define SYS_T 119 | | ------------------ ------------------ 199| 109| benes(recv128, bits_int, 1); ------------------ | | 9| 109|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 109| reformat_128to256(recv256, recv128); 202| | 203| 109| scaling(scaled, inv, sk, recv256); 204| 109| fft_tr(s_priv, scaled); ------------------ | | 9| 109|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 205| 109| bm(locator, s_priv); ------------------ | | 10| 109|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 109| fft(eval, locator); ------------------ | | 10| 109|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 109| allone = vec256_set1_16b(0xFFFF); 212| | 213| 3.59k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 3.48k, False: 109] ------------------ 214| 3.48k| error256[i] = vec256_or_reduce(eval[i]); 215| 3.48k| error256[i] = vec256_xor(error256[i], allone); 216| 3.48k| } 217| | 218| 109| scaling_inv(scaled, inv, error256); 219| 109| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 109|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 109| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 109| reformat_256to128(error128, error256); 226| 109| benes(error128, bits_int, 0); ------------------ | | 9| 109|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 109| postprocess(e, error128); 229| | 230| 109| check_weight = weight_check(e, error128); 231| | 232| 109| return 1 - (check_synd & check_weight); 233| 109|} PQCLEAN_MCELIECE6960119_AVX2_encrypt: 116| 109|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 117| 109| gen_e(e); 118| | 119| 109| syndrome_asm(s, pk, e); ------------------ | | 1| 109|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 120| 109|} PQCLEAN_MCELIECE6960119_AVX2_fft: 265| 1.42k|void fft(vec256 out[][GFBITS], vec128 *in) { 266| 1.42k| radix_conversions(in); 267| 1.42k| butterflies(out, in); 268| 1.42k|} PQCLEAN_MCELIECE6960119_AVX2_fft_tr: 398| 218|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 399| 218| butterflies_tr(out, in); 400| 218| radix_conversions_tr(out); 401| | 402| 218| postprocess(out); 403| 218|} PQCLEAN_MCELIECE6960119_AVX2_gf_mul: 20| 17.0M|gf gf_mul(gf in0, gf in1) { 21| 17.0M| int i; 22| | 23| 17.0M| uint64_t tmp; 24| 17.0M| uint64_t t0; 25| 17.0M| uint64_t t1; 26| 17.0M| uint64_t t; 27| | 28| 17.0M| t0 = in0; 29| 17.0M| t1 = in1; 30| | 31| 17.0M| tmp = t0 * (t1 & 1); 32| | 33| 221M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 221M|#define GFBITS 13 ------------------ | Branch (33:17): [True: 204M, False: 17.0M] ------------------ 34| 204M| tmp ^= (t0 * (t1 & (1 << i))); 35| 204M| } 36| | 37| | // 38| | 39| 17.0M| t = tmp & 0x1FF0000; 40| 17.0M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 41| | 42| 17.0M| t = tmp & 0x000E000; 43| 17.0M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 44| | 45| 17.0M| return tmp & GFMASK; ------------------ | | 19| 17.0M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 17.0M|#define GFBITS 13 | | ------------------ ------------------ 46| 17.0M|} PQCLEAN_MCELIECE6960119_AVX2_gf_frac: 156| 143k|gf gf_frac(gf den, gf num) { 157| 143k| gf tmp_11; 158| 143k| gf tmp_1111; 159| 143k| gf out; 160| | 161| 143k| tmp_11 = gf_sqmul(den, den); // ^11 162| 143k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // ^1111 163| 143k| out = gf_sq2(tmp_1111); 164| 143k| out = gf_sq2mul(out, tmp_1111); // ^11111111 165| 143k| out = gf_sq2(out); 166| 143k| out = gf_sq2mul(out, tmp_1111); // ^111111111111 167| | 168| 143k| return gf_sqmul(out, num); // ^1111111111110 = ^-1 169| 143k|} PQCLEAN_MCELIECE6960119_AVX2_gf_inv: 172| 143k|gf gf_inv(gf den) { 173| 143k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 143k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 143k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 174| 143k|} pk_gen.c:PQCLEAN_MCELIECE6960119_AVX2_int32_sort: 21| 109|static void int32_sort(int32_t *x, long long n) { 22| 109| long long top, p, q, r, i; 23| | 24| 109| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 109] ------------------ 25| 0| return; 26| 0| } 27| 109| top = 1; 28| 1.19k| while (top < n - top) { ------------------ | Branch (28:12): [True: 1.09k, False: 109] ------------------ 29| 1.09k| top += top; 30| 1.09k| } 31| | 32| 1.30k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.19k, False: 109] ------------------ 33| 1.63M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.63M, False: 1.19k] ------------------ 34| 1.63M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 869k, False: 762k] ------------------ 35| 869k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 869k| do { \ | | 12| 869k| int32_t ab = (b) ^ (a); \ | | 13| 869k| int32_t c = (b) - (a); \ | | 14| 869k| c ^= ab & ((c) ^ (b)); \ | | 15| 869k| c >>= 31; \ | | 16| 869k| c &= ab; \ | | 17| 869k| (a) ^= c; \ | | 18| 869k| (b) ^= c; \ | | 19| 869k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 869k] | | ------------------ ------------------ 36| 869k| } 37| 1.63M| } 38| 1.19k| i = 0; 39| 7.19k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 5.99k, False: 1.19k] ------------------ 40| 1.46M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.46M, False: 5.99k] ------------------ 41| 1.46M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 762k, False: 700k] ------------------ 42| 762k| int32_t a = x[i + p]; 43| 4.43M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.67M, False: 762k] ------------------ 44| 3.67M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.67M| do { \ | | 12| 3.67M| int32_t ab = (b) ^ (a); \ | | 13| 3.67M| int32_t c = (b) - (a); \ | | 14| 3.67M| c ^= ab & ((c) ^ (b)); \ | | 15| 3.67M| c >>= 31; \ | | 16| 3.67M| c &= ab; \ | | 17| 3.67M| (a) ^= c; \ | | 18| 3.67M| (b) ^= c; \ | | 19| 3.67M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.67M] | | ------------------ ------------------ 45| 3.67M| } 46| 762k| x[i + p] = a; 47| 762k| } 48| 1.46M| } 49| 5.99k| } 50| 1.19k| } 51| 109|} controlbits.c:PQCLEAN_MCELIECE6960119_AVX2_int32_sort: 21| 3.57M|static void int32_sort(int32_t *x, long long n) { 22| 3.57M| long long top, p, q, r, i; 23| | 24| 3.57M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 3.57M] ------------------ 25| 0| return; 26| 0| } 27| 3.57M| top = 1; 28| 12.5M| while (top < n - top) { ------------------ | Branch (28:12): [True: 8.94M, False: 3.57M] ------------------ 29| 8.94M| top += top; 30| 8.94M| } 31| | 32| 16.0M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 12.5M, False: 3.57M] ------------------ 33| 1.72G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.70G, False: 12.5M] ------------------ 34| 1.70G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 956M, False: 753M] ------------------ 35| 956M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 956M| do { \ | | 12| 956M| int32_t ab = (b) ^ (a); \ | | 13| 956M| int32_t c = (b) - (a); \ | | 14| 956M| c ^= ab & ((c) ^ (b)); \ | | 15| 956M| c >>= 31; \ | | 16| 956M| c &= ab; \ | | 17| 956M| (a) ^= c; \ | | 18| 956M| (b) ^= c; \ | | 19| 956M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 956M] | | ------------------ ------------------ 36| 956M| } 37| 1.70G| } 38| 12.5M| i = 0; 39| 33.9M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 21.4M, False: 12.5M] ------------------ 40| 1.52G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.50G, False: 21.4M] ------------------ 41| 1.50G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 753M, False: 753M] ------------------ 42| 753M| int32_t a = x[i + p]; 43| 4.46G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.71G, False: 753M] ------------------ 44| 3.71G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.71G| do { \ | | 12| 3.71G| int32_t ab = (b) ^ (a); \ | | 13| 3.71G| int32_t c = (b) - (a); \ | | 14| 3.71G| c ^= ab & ((c) ^ (b)); \ | | 15| 3.71G| c >>= 31; \ | | 16| 3.71G| c &= ab; \ | | 17| 3.71G| (a) ^= c; \ | | 18| 3.71G| (b) ^= c; \ | | 19| 3.71G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.71G] | | ------------------ ------------------ 45| 3.71G| } 46| 753M| x[i + p] = a; 47| 753M| } 48| 1.50G| } 49| 21.4M| } 50| 12.5M| } 51| 3.57M|} encrypt.c:PQCLEAN_MCELIECE6960119_AVX2_int32_sort: 21| 569|static void int32_sort(int32_t *x, long long n) { 22| 569| long long top, p, q, r, i; 23| | 24| 569| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 569] ------------------ 25| 0| return; 26| 0| } 27| 569| top = 1; 28| 3.98k| while (top < n - top) { ------------------ | Branch (28:12): [True: 3.41k, False: 569] ------------------ 29| 3.41k| top += top; 30| 3.41k| } 31| | 32| 4.55k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 3.98k, False: 569] ------------------ 33| 405k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 401k, False: 3.98k] ------------------ 34| 401k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 226k, False: 175k] ------------------ 35| 226k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 226k| do { \ | | 12| 226k| int32_t ab = (b) ^ (a); \ | | 13| 226k| int32_t c = (b) - (a); \ | | 14| 226k| c ^= ab & ((c) ^ (b)); \ | | 15| 226k| c >>= 31; \ | | 16| 226k| c &= ab; \ | | 17| 226k| (a) ^= c; \ | | 18| 226k| (b) ^= c; \ | | 19| 226k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 226k] | | ------------------ ------------------ 36| 226k| } 37| 401k| } 38| 3.98k| i = 0; 39| 15.9k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 11.9k, False: 3.98k] ------------------ 40| 346k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 334k, False: 11.9k] ------------------ 41| 334k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 175k, False: 159k] ------------------ 42| 175k| int32_t a = x[i + p]; 43| 721k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 546k, False: 175k] ------------------ 44| 546k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 546k| do { \ | | 12| 546k| int32_t ab = (b) ^ (a); \ | | 13| 546k| int32_t c = (b) - (a); \ | | 14| 546k| c ^= ab & ((c) ^ (b)); \ | | 15| 546k| c >>= 31; \ | | 16| 546k| c &= ab; \ | | 17| 546k| (a) ^= c; \ | | 18| 546k| (b) ^= c; \ | | 19| 546k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 546k] | | ------------------ ------------------ 45| 546k| } 46| 175k| x[i + p] = a; 47| 175k| } 48| 334k| } 49| 11.9k| } 50| 3.98k| } 51| 569|} PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_enc: 40| 109|) { 41| 109| unsigned char e[ SYS_N / 8 ]; 42| 109| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 43| 109| unsigned char mask; 44| 109| int i, padding_ok; 45| | 46| | // 47| | 48| 109| padding_ok = check_pk_padding(pk); 49| | 50| 109| encrypt(c, pk, e); ------------------ | | 9| 109|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 51| | 52| 109| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 109|#define SYS_N 6960 ------------------ 53| 109| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 109|#define SYS_N 6960 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 109|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 109|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 109|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 109|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 54| | 55| 109| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 109| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 109|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 56| | 57| | // clear outputs (set to all 0's) if padding bits are not all zero 58| | 59| 109| mask = (unsigned char)padding_ok; 60| 109| mask ^= 0xFF; 61| | 62| 21.2k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 21.2k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 21.2k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 21.2k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 21.2k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (62:17): [True: 21.1k, False: 109] ------------------ 63| 21.1k| c[i] &= mask; 64| 21.1k| } 65| | 66| 3.59k| for (i = 0; i < 32; i++) { ------------------ | Branch (66:17): [True: 3.48k, False: 109] ------------------ 67| 3.48k| key[i] &= mask; 68| 3.48k| } 69| | 70| 109| return padding_ok; 71| 109|} PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_dec: 90| 109|) { 91| 109| int i, padding_ok; 92| | 93| 109| unsigned char mask; 94| 109| unsigned char ret_decrypt = 0; 95| | 96| 109| uint16_t m; 97| | 98| 109| unsigned char e[ SYS_N / 8 ]; 99| 109| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 100| 109| unsigned char *x = preimage; 101| 109| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 109|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 109|#define SYS_T 119 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 109|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 109|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 109|#define GFBITS 13 | | ------------------ ------------------ 102| | 103| | // 104| | 105| 109| padding_ok = check_c_padding(c); 106| | 107| 109| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 109|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 108| | 109| 109| m = ret_decrypt; 110| 109| m -= 1; 111| 109| m >>= 8; 112| | 113| 109| *x++ = m & 1; 114| 94.9k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 94.9k|#define SYS_N 6960 ------------------ | Branch (114:17): [True: 94.8k, False: 109] ------------------ 115| 94.8k| *x++ = (~m & s[i]) | (m & e[i]); 116| 94.8k| } 117| | 118| 21.2k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 21.2k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 21.2k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 21.2k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 21.2k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (118:17): [True: 21.1k, False: 109] ------------------ 119| 21.1k| *x++ = c[i]; 120| 21.1k| } 121| | 122| 109| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 109| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 109|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 123| | 124| | // clear outputs (set to all 1's) if padding bits are not all zero 125| | 126| 109| mask = (unsigned char)padding_ok; 127| | 128| 3.59k| for (i = 0; i < 32; i++) { ------------------ | Branch (128:17): [True: 3.48k, False: 109] ------------------ 129| 3.48k| key[i] |= mask; 130| 3.48k| } 131| | 132| 109| return padding_ok; 133| 109|} PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_keypair: 139| 109|) { 140| 109| int i; 141| 109| unsigned char seed[ 33 ] = {64}; 142| 109| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 143| 109| unsigned char *rp, *skp; 144| | 145| 109| gf f[ SYS_T ]; // element in GF(2^mt) 146| 109| gf irr[ SYS_T ]; // Goppa polynomial 147| 109| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 148| 109| int16_t pi[ 1 << GFBITS ]; // random permutation 149| | 150| 109| randombytes(seed + 1, 32); ------------------ | | 8| 109|#define randombytes OQS_randombytes ------------------ 151| | 152| 1.20k| while (1) { ------------------ | Branch (152:12): [True: 1.20k, Folded] ------------------ 153| 1.20k| rp = &r[ sizeof(r) - 32 ]; 154| 1.20k| skp = sk; 155| | 156| | // expanding and updating the seed 157| | 158| 1.20k| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 1.20k| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 1.20k|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 159| 1.20k| memcpy(skp, seed + 1, 32); 160| 1.20k| skp += 32 + 8; 161| 1.20k| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 162| | 163| | // generating irreducible polynomial 164| | 165| 1.20k| rp -= sizeof(f); 166| | 167| 144k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 144k|#define SYS_T 119 ------------------ | Branch (167:21): [True: 143k, False: 1.20k] ------------------ 168| 143k| f[i] = load_gf(rp + i * 2); 169| 143k| } 170| | 171| 1.20k| if (genpoly_gen(irr, f)) { ------------------ | | 9| 1.20k|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 1.20k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ | Branch (171:13): [True: 0, False: 1.20k] ------------------ 172| 0| continue; 173| 0| } 174| | 175| 144k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 144k|#define SYS_T 119 ------------------ | Branch (175:21): [True: 143k, False: 1.20k] ------------------ 176| 143k| store_gf(skp + i * 2, irr[i]); 177| 143k| } 178| | 179| 1.20k| skp += IRR_BYTES; ------------------ | | 11| 1.20k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.20k|#define SYS_T 119 | | ------------------ ------------------ 180| | 181| | // generating permutation 182| | 183| 1.20k| rp -= sizeof(perm); 184| | 185| 9.84M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.84M|#define GFBITS 13 ------------------ | Branch (185:21): [True: 9.84M, False: 1.20k] ------------------ 186| 9.84M| perm[i] = load4(rp + i * 4); 187| 9.84M| } 188| | 189| 1.20k| if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 9| 1.20k|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 1.20k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 11| 1.20k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.20k|#define SYS_T 119 | | ------------------ ------------------ | Branch (189:13): [True: 1.09k, False: 109] ------------------ 190| 1.09k| continue; 191| 1.09k| } 192| | 193| 109| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 109|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 109|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 109|#define GFBITS 13 ------------------ 194| 109| skp += COND_BYTES; ------------------ | | 10| 109|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 109|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 109|#define GFBITS 13 | | ------------------ ------------------ 195| | 196| | // storing the random string s 197| | 198| 109| rp -= SYS_N / 8; ------------------ | | 7| 109|#define SYS_N 6960 ------------------ 199| 109| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 109|#define SYS_N 6960 ------------------ 200| | 201| | // storing positions of the 32 pivots 202| | 203| 109| store8(sk + 32, 0xFFFFFFFF); 204| | 205| 109| break; 206| 1.20k| } 207| | 208| 109| return 0; 209| 109|} PQCLEAN_MCELIECE6960119_AVX2_pk_gen: 199| 1.20k|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi) { 200| 1.20k|#define nBlocks_I ((PK_NROWS + 255) / 256) 201| 1.20k| const int head = PK_NROWS % 64; ------------------ | | 13| 1.20k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.20k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.20k|#define GFBITS 13 | | ------------------ ------------------ 202| 1.20k| const int tail = PK_NCOLS % 64; ------------------ | | 14| 1.20k|#define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 7| 1.20k|#define SYS_N 6960 | | ------------------ | | #define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 13| 1.20k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 1.20k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 1.20k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 203| 1.20k| const uint64_t one = 1; 204| | 205| 1.20k| int i, j, k, b; 206| 1.20k| int row, c; 207| | 208| 1.20k| union { 209| 1.20k| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 210| 1.20k| vec256 v[ PK_NROWS ][ nBlocks_I ]; 211| 1.20k| } mat; 212| | 213| 1.20k| union { 214| 1.20k| uint64_t w[ PK_NROWS ][ par_width * 4 ]; 215| 1.20k| vec256 v[ PK_NROWS ][ par_width ]; 216| 1.20k| } par; 217| | 218| 1.20k| uint16_t m; 219| 1.20k| vec256 mm; 220| | 221| 1.20k| vec128 sk_int[ GFBITS ]; 222| | 223| 1.20k| vec256 consts[ 32 ][ GFBITS ]; 224| 1.20k| vec256 eval[ 32 ][ GFBITS ]; 225| 1.20k| vec256 prod[ 32 ][ GFBITS ]; 226| 1.20k| vec256 tmp[ GFBITS ]; 227| | 228| 1.20k| uint64_t list[1 << GFBITS]; 229| 1.20k| uint64_t buf[ PK_NROWS ]; 230| 1.20k| uint64_t t; 231| | 232| 1.20k| uint16_t ind[ PK_NROWS ]; 233| 1.20k| uint16_t ind_inv[ PK_NROWS ]; 234| | 235| | // compute the inverses 236| | 237| 1.20k| irr_load(sk_int, irr); 238| | 239| 1.20k| fft(eval, sk_int); ------------------ | | 10| 1.20k|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 1.20k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 240| | 241| 1.20k| vec256_copy(prod[0], eval[0]); 242| | 243| 38.4k| for (i = 1; i < 32; i++) { ------------------ | Branch (243:17): [True: 37.2k, False: 1.20k] ------------------ 244| 37.2k| vec256_mul(prod[i], prod[i - 1], eval[i]); 245| 37.2k| } 246| | 247| 1.20k| vec256_inv(tmp, prod[31]); ------------------ | | 11| 1.20k|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 1.20k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 248| | 249| 38.4k| for (i = 30; i >= 0; i--) { ------------------ | Branch (249:18): [True: 37.2k, False: 1.20k] ------------------ 250| 37.2k| vec256_mul(prod[i + 1], prod[i], tmp); 251| 37.2k| vec256_mul(tmp, tmp, eval[i + 1]); 252| 37.2k| } 253| | 254| 1.20k| vec256_copy(prod[0], tmp); 255| | 256| | // fill matrix 257| | 258| 1.20k| de_bitslicing(list, prod); 259| | 260| 9.84M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.84M|#define GFBITS 13 ------------------ | Branch (260:17): [True: 9.84M, False: 1.20k] ------------------ 261| 9.84M| list[i] <<= GFBITS; ------------------ | | 6| 9.84M|#define GFBITS 13 ------------------ 262| 9.84M| list[i] |= i; 263| 9.84M| list[i] |= ((uint64_t) perm[i]) << 31; 264| 9.84M| } 265| | 266| 1.20k| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 1.20k|#define GFBITS 13 ------------------ 267| | 268| 9.70M| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.70M|#define GFBITS 13 ------------------ | Branch (268:17): [True: 9.70M, False: 1.16k] ------------------ 269| 9.70M| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (269:13): [True: 33, False: 9.70M] ------------------ 270| 33| return -1; 271| 33| } 272| 9.70M| } 273| | 274| 1.16k| to_bitslicing_2x(consts, prod, list); 275| | 276| 9.57M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.57M|#define GFBITS 13 ------------------ | Branch (276:17): [True: 9.57M, False: 1.16k] ------------------ 277| 9.57M| pi[i] = list[i] & GFMASK; ------------------ | | 19| 9.57M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 9.57M|#define GFBITS 13 | | ------------------ ------------------ 278| 9.57M| } 279| | 280| 9.35k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 9.35k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 9.35k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 9.35k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 9.35k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (280:17): [True: 8.18k, False: 1.16k] ------------------ 281| 114k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 114k|#define GFBITS 13 ------------------ | Branch (281:21): [True: 106k, False: 8.18k] ------------------ 282| 106k| mat.v[ k ][ j ] = prod[ j ][ k ]; 283| 106k| } 284| 8.18k| } 285| | 286| 139k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 139k|#define SYS_T 119 ------------------ | Branch (286:17): [True: 137k, False: 1.16k] ------------------ 287| 1.10M| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 1.10M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 1.10M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 1.10M|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 1.10M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (287:21): [True: 965k, False: 137k] ------------------ 288| 965k| vec256_mul(prod[j], prod[j], consts[j]); 289| | 290| 13.5M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 13.5M|#define GFBITS 13 ------------------ | Branch (290:25): [True: 12.5M, False: 965k] ------------------ 291| 12.5M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 12.5M|#define GFBITS 13 ------------------ 292| 12.5M| } 293| 965k| } 294| 137k| } 295| | 296| | // gaussian elimination to obtain L, U, and P such that LP M = U 297| | // L and U are stored in the space of M 298| | // P is stored in ind 299| | 300| 1.80M| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 1.80M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.80M|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.80M|#define GFBITS 13 | | ------------------ ------------------ | Branch (300:17): [True: 1.80M, False: 1.16k] ------------------ 301| 1.80M| ind_inv[i] = ind[ i ] = i; 302| 1.80M| } 303| | 304| 1.80M| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 1.80M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.80M|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.80M|#define GFBITS 13 | | ------------------ ------------------ | Branch (304:19): [True: 1.80M, False: 109] ------------------ 305| 1.80M| i = row >> 6; 306| 1.80M| j = row & 63; 307| | 308| 1.39G| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 1.39G|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.39G|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.39G|#define GFBITS 13 | | ------------------ ------------------ | Branch (308:27): [True: 1.39G, False: 1.80M] ------------------ 309| 1.39G| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 310| 1.39G| uint16_cswap(&ind[row], &ind[k], m); 311| | 312| 1.39G| mm = vec256_set1_16b(m); 313| 11.1G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 11.1G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 11.1G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 11.1G|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 11.1G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (313:25): [True: 9.78G, False: 1.39G] ------------------ 314| 9.78G| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 315| 9.78G| } 316| 1.39G| } 317| | 318| 1.80M| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (318:14): [True: 1.06k, False: 1.80M] ------------------ 319| 1.06k| return -1; 320| 1.06k| } 321| | 322| 1.39G| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 1.39G|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.39G|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.39G|#define GFBITS 13 | | ------------------ ------------------ | Branch (322:27): [True: 1.39G, False: 1.80M] ------------------ 323| 1.39G| t = mat.w[ k ][ i ] & (one << j); 324| 1.39G| mm = extract_mask256(mat.w[k], row); 325| | 326| 11.1G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 11.1G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 11.1G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 11.1G|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 11.1G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (326:25): [True: 9.78G, False: 1.39G] ------------------ 327| 9.78G| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 328| 9.78G| } 329| | 330| 1.39G| mat.w[ k ][ i ] |= t; 331| 1.39G| } 332| 1.80M| } 333| | 334| | // apply M^-1 to the remaining columns 335| | 336| 109| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 109|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109|#define GFBITS 13 | | ------------------ ------------------ 337| | 338| 327| for (j = 6; j < 28; j += par_width) { ------------------ | | 30| 218|#define par_width 11 ------------------ | Branch (338:17): [True: 218, False: 109] ------------------ 339| 3.05k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 3.05k|#define GFBITS 13 ------------------ | Branch (339:21): [True: 2.83k, False: 218] ------------------ 340| 34.0k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 34.0k|#define par_width 11 ------------------ | Branch (340:25): [True: 31.1k, False: 2.83k] ------------------ 341| 31.1k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 342| 31.1k| } 343| 2.83k| } 344| | 345| 25.9k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 25.9k|#define SYS_T 119 ------------------ | Branch (345:21): [True: 25.7k, False: 218] ------------------ 346| 308k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 308k|#define par_width 11 ------------------ | Branch (346:25): [True: 282k, False: 25.7k] ------------------ 347| 282k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 348| 282k| } 349| | 350| 360k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 360k|#define GFBITS 13 ------------------ | Branch (350:25): [True: 334k, False: 25.7k] ------------------ 351| 4.01M| for (b = 0; b < par_width; b++) { ------------------ | | 30| 4.01M|#define par_width 11 ------------------ | Branch (351:29): [True: 3.67M, False: 334k] ------------------ 352| 3.67M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 3.67M|#define GFBITS 13 ------------------ 353| 3.67M| } 354| 334k| } 355| 25.7k| } 356| | 357| | // apply P 358| | 359| 337k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 337k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 337k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 337k|#define GFBITS 13 | | ------------------ ------------------ | Branch (359:21): [True: 337k, False: 218] ------------------ 360| 337k| ind[i] = ind_inv[i]; 361| 337k| } 362| | 363| 218| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 218|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 218|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 218|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 218|#define GFBITS 13 | | ------------------ ------------------ 364| | 365| | // apply L 366| | 367| 337k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 218|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 218|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 218|#define GFBITS 13 | | ------------------ ------------------ | Branch (367:34): [True: 337k, False: 218] ------------------ 368| 261M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (368:31): [True: 260M, False: 337k] ------------------ 369| 260M| mm = extract_mask256(mat.w[row], i); 370| | 371| 3.12G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.12G|#define par_width 11 ------------------ | Branch (371:29): [True: 2.86G, False: 260M] ------------------ 372| 2.86G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 373| 2.86G| } 374| 260M| } 375| 337k| } 376| | 377| | // apply U^-1 378| | 379| 218| if (j == 6) { ------------------ | Branch (379:13): [True: 109, False: 109] ------------------ 380| 168k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 168k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 168k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 168k|#define GFBITS 13 | | ------------------ ------------------ | Branch (380:25): [True: 168k, False: 109] ------------------ 381| 168k| par.v[i][0] = mat.v[i][nBlocks_I - 1]; ------------------ | | 200| 168k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 168k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 168k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 168k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 382| 168k| } 383| 109| } 384| | 385| 337k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 218|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 218|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 218|#define GFBITS 13 | | ------------------ ------------------ | Branch (385:34): [True: 337k, False: 218] ------------------ 386| 261M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 337k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 337k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 337k|#define GFBITS 13 | | ------------------ ------------------ | Branch (386:36): [True: 260M, False: 337k] ------------------ 387| 260M| mm = extract_mask256(mat.w[row], i); 388| | 389| 3.12G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.12G|#define par_width 11 ------------------ | Branch (389:29): [True: 2.86G, False: 260M] ------------------ 390| 2.86G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 391| 2.86G| } 392| 260M| } 393| 337k| } 394| | 395| 218| if (j == 6) { ------------------ | Branch (395:13): [True: 109, False: 109] ------------------ 396| 168k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 168k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 168k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 168k|#define GFBITS 13 | | ------------------ ------------------ | Branch (396:27): [True: 168k, False: 109] ------------------ 397| 7.41M| for (i = 0; i < 43; i++) { ------------------ | Branch (397:29): [True: 7.25M, False: 168k] ------------------ 398| 7.25M| store8(pk + PK_ROW_BYTES * row + i * 8, (par.w[row][i] >> head) | (par.w[row][i + 1] << (64 - head))); ------------------ | | 15| 7.25M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 7.25M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 7.25M|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 7.25M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 7.25M|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 7.25M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 399| 7.25M| } 400| | 401| 168k| buf[row] = par.w[row][i] >> head; 402| 168k| } 403| 109| } else { 404| 168k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 168k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 168k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 168k|#define GFBITS 13 | | ------------------ ------------------ | Branch (404:27): [True: 168k, False: 109] ------------------ 405| 168k| store8(pk + PK_ROW_BYTES * row + 43 * 8, buf[row] | (par.w[row][0] << (64 - head))); ------------------ | | 15| 168k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 168k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 168k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 168k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 168k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 168k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 406| | 407| 6.91M| for (i = 0; i < 40; i++) { ------------------ | Branch (407:29): [True: 6.74M, False: 168k] ------------------ 408| 6.74M| store8(pk + PK_ROW_BYTES * row + (i + 44) * 8, (par.w[row][i] >> head) | (par.w[row][i + 1] << (64 - head))); ------------------ | | 15| 6.74M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 6.74M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 6.74M|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 6.74M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 6.74M|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 6.74M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 409| 6.74M| } 410| | 411| 168k| par.w[row][i] >>= head; 412| 168k| par.w[row][i] &= (one << tail) - 1; 413| | 414| 168k| store_i(pk + PK_ROW_BYTES * row + (i + 44) * 8, par.w[row][i], (tail + 7) / 8); ------------------ | | 15| 168k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 168k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 168k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 168k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 168k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 168k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 415| 168k| } 416| 109| } 417| 218| } 418| | 419| | // 420| | 421| 109| return 0; 422| 1.16k|} PQCLEAN_MCELIECE6960119_AVX2_genpoly_gen: 88| 1.20k|int genpoly_gen(gf *out, gf *f) { 89| 1.20k| int i, j, k; 90| | 91| 1.20k| gf t, inv; 92| | 93| 1.20k| uint64_t m; 94| 1.20k| vec128 mask; 95| | 96| 1.20k| union { 97| 1.20k| uint64_t d[ GFBITS ][ 128 ][2]; 98| 1.20k| vec128 v[ GFBITS ][ 128 ]; 99| 1.20k| } buf; 100| | 101| 1.20k| union { 102| 1.20k| uint64_t d[GFBITS][2]; 103| 1.20k| vec128 v[GFBITS]; 104| 1.20k| } v; 105| | 106| 1.20k| union { 107| 1.20k| uint64_t d[SYS_T][GFBITS][2]; 108| 1.20k| vec128 v[SYS_T][GFBITS]; 109| 1.20k| } mat; 110| | 111| | // fill matrix 112| | 113| 1.20k| buf.v[0][0] = vec128_set2x(1, 0); 114| 15.6k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 15.6k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 14.4k, False: 1.20k] ------------------ 115| 14.4k| buf.v[i][0] = vec128_setzero(); 116| 14.4k| } 117| | 118| 16.8k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 16.8k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 15.6k, False: 1.20k] ------------------ 119| 15.6k| v.v[j] = vec128_setzero(); 120| | 121| 1.87M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 15.6k|#define SYS_T 119 ------------------ | Branch (121:29): [True: 1.85M, False: 15.6k] ------------------ 122| 1.85M| v.d[j][1] <<= 1; 123| 1.85M| v.d[j][1] |= v.d[j][0] >> 63; 124| 1.85M| v.d[j][0] <<= 1; 125| 1.85M| v.d[j][0] |= (f[i] >> j) & 1; 126| 1.85M| } 127| 15.6k| } 128| | 129| 16.8k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 16.8k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 15.6k, False: 1.20k] ------------------ 130| 15.6k| buf.v[i][1] = v.v[i]; 131| 15.6k| } 132| | 133| 143k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 143k|#define SYS_T 119 ------------------ | Branch (133:17): [True: 141k, False: 1.20k] ------------------ 134| 141k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 141k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 141k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 141k| if (k < SYS_T) { ------------------ | | 8| 141k|#define SYS_T 119 ------------------ | Branch (136:13): [True: 140k, False: 1.20k] ------------------ 137| 1.96M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.96M|#define GFBITS 13 ------------------ | Branch (137:25): [True: 1.82M, False: 140k] ------------------ 138| 1.82M| buf.v[i][k] = v.v[i]; 139| 1.82M| } 140| 140k| } else { 141| 144k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 144k|#define SYS_T 119 ------------------ | Branch (141:25): [True: 143k, False: 1.20k] ------------------ 142| 143k| out[i] = extract_gf(v.d, i); 143| 143k| } 144| 1.20k| } 145| 141k| } 146| | 147| 16.8k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 16.8k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 15.6k, False: 1.20k] ------------------ 148| 15.6k| transpose_128x128(buf.d[i]); 149| 15.6k| } 150| | 151| 144k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 144k|#define SYS_T 119 ------------------ | Branch (151:17): [True: 143k, False: 1.20k] ------------------ 152| 2.00M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 2.00M|#define GFBITS 13 ------------------ | Branch (152:21): [True: 1.85M, False: 143k] ------------------ 153| 1.85M| mat.v[j][i] = buf.v[i][j]; 154| 1.85M| } 155| 143k| } 156| | 157| | // gaussian 158| | 159| 144k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 144k|#define SYS_T 119 ------------------ | Branch (159:17): [True: 143k, False: 1.20k] ------------------ 160| 8.58M| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 8.58M|#define SYS_T 119 ------------------ | Branch (160:25): [True: 8.43M, False: 143k] ------------------ 161| 8.43M| m = extract_bit(mat.d[i], i); 162| 8.43M| m -= 1; 163| 8.43M| mask = vec128_set2x(m, m); 164| | 165| 118M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 118M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 109M, False: 8.43M] ------------------ 166| 109M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 109M| } 168| | 169| 8.43M| out[i] ^= out[j] & m; 170| 8.43M| } 171| | 172| | // 173| | 174| 143k| t = extract_gf(mat.d[i], i); 175| | 176| 143k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 143k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 143k| inv = gf_inv(t); ------------------ | | 11| 143k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 143k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 183| 143k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 143k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 143k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 143k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 17.1M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 17.1M|#define SYS_T 119 ------------------ | Branch (187:21): [True: 17.0M, False: 143k] ------------------ 188| 17.0M| if (j != i) { ------------------ | Branch (188:17): [True: 16.8M, False: 143k] ------------------ 189| 16.8M| t = extract_gf(mat.d[j], i); 190| | 191| 16.8M| vec128_mul_gf(v.v, mat.v[i], t); 192| 16.8M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 16.8M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 16.8M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 16.8M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 195| 16.8M| } 196| 17.0M| } 197| 143k| } 198| | 199| 1.20k| return 0; 200| 1.20k|} PQCLEAN_MCELIECE6960119_AVX2_vec128_mul_GF: 6| 141k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 141k| int i, j; 8| 141k| uint64_t buf[GFBITS][4]; 9| 141k| vec128 prod[GFBITS]; 10| 141k| uint64_t p[GFBITS]; 11| | 12| 141k| const uint64_t allone = -1; 13| | 14| | // polynomial multiplication 15| | 16| 1.98M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.98M|#define GFBITS 13 ------------------ | Branch (16:17): [True: 1.84M, False: 141k] ------------------ 17| 1.84M| buf[i][0] = 0; 18| 1.84M| buf[i][1] = 0; 19| 1.84M| buf[i][2] = 0; 20| 1.84M| buf[i][3] = 0; 21| 1.84M| } 22| | 23| 17.0M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 141k|#define SYS_T 119 ------------------ | Branch (23:25): [True: 16.8M, False: 141k] ------------------ 24| 236M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 236M|#define GFBITS 13 ------------------ | Branch (24:21): [True: 219M, False: 16.8M] ------------------ 25| 219M| buf[j][3] <<= 1; 26| 219M| buf[j][3] |= buf[j][2] >> 63; 27| 219M| buf[j][2] <<= 1; 28| 219M| buf[j][2] |= buf[j][1] >> 63; 29| 219M| buf[j][1] <<= 1; 30| 219M| buf[j][1] |= buf[j][0] >> 63; 31| 219M| buf[j][0] <<= 1; 32| 219M| } 33| | 34| 16.8M| vec128_mul_gf(prod, v, a[i]); 35| | 36| 236M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 236M|#define GFBITS 13 ------------------ | Branch (36:21): [True: 219M, False: 16.8M] ------------------ 37| 219M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 219M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 38| 219M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 219M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 39| 219M| } 40| 16.8M| } 41| | 42| | // reduction modulo y^119 + y^8 + 1 43| | 44| 1.98M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.98M|#define GFBITS 13 ------------------ | Branch (44:17): [True: 1.84M, False: 141k] ------------------ 45| 1.84M| p[i] = buf[i][3]; 46| | 47| 1.84M| buf[i][2] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 1.84M|#define SYS_T 119 ------------------ 48| 1.84M| buf[i][1] ^= p[i] << (64 - (SYS_T - 8 - 64)); ------------------ | | 8| 1.84M|#define SYS_T 119 ------------------ 49| 1.84M| buf[i][2] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 1.84M|#define SYS_T 119 ------------------ 50| 1.84M| buf[i][1] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 1.84M|#define SYS_T 119 ------------------ 51| 1.84M| } 52| | 53| | // 54| | 55| 1.98M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.98M|#define GFBITS 13 ------------------ | Branch (55:17): [True: 1.84M, False: 141k] ------------------ 56| 1.84M| p[i] = buf[i][2]; 57| | 58| 1.84M| buf[i][1] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 1.84M|#define SYS_T 119 ------------------ 59| 1.84M| buf[i][0] ^= p[i] << (64 - (SYS_T - 8 - 64)); ------------------ | | 8| 1.84M|#define SYS_T 119 ------------------ 60| 1.84M| buf[i][1] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 1.84M|#define SYS_T 119 ------------------ 61| 1.84M| buf[i][0] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 1.84M|#define SYS_T 119 ------------------ 62| 1.84M| } 63| | 64| | // 65| | 66| 1.98M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.98M|#define GFBITS 13 ------------------ | Branch (66:17): [True: 1.84M, False: 141k] ------------------ 67| 1.84M| p[i] = buf[i][1] & (allone << (SYS_T - 64)); ------------------ | | 8| 1.84M|#define SYS_T 119 ------------------ 68| | 69| 1.84M| buf[i][0] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 1.84M|#define SYS_T 119 ------------------ 70| 1.84M| buf[i][0] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 1.84M|#define SYS_T 119 ------------------ 71| 1.84M| } 72| | 73| | // 74| | 75| 1.98M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.98M|#define GFBITS 13 ------------------ | Branch (75:17): [True: 1.84M, False: 141k] ------------------ 76| 1.84M| out[i] = vec128_set2x(buf[i][0], buf[i][1] & (allone >> (128 - SYS_T))); ------------------ | | 8| 1.84M|#define SYS_T 119 ------------------ 77| 1.84M| } 78| 141k|} PQCLEAN_MCELIECE6960119_AVX2_vec256_sq: 9| 19.2k|void vec256_sq(vec256 *out, vec256 *in) { 10| 19.2k| int i; 11| 19.2k| vec256 result[GFBITS], t; 12| | 13| 19.2k| t = vec256_xor(in[11], in[12]); 14| | 15| 19.2k| result[0] = vec256_xor(in[0], in[11]); 16| 19.2k| result[1] = vec256_xor(in[7], t); 17| 19.2k| result[2] = vec256_xor(in[1], in[7]); 18| 19.2k| result[3] = vec256_xor(in[8], t); 19| 19.2k| result[4] = vec256_xor(in[2], in[7]); 20| 19.2k| result[4] = vec256_xor(result[4], in[8]); 21| 19.2k| result[4] = vec256_xor(result[4], t); 22| 19.2k| result[5] = vec256_xor(in[7], in[9]); 23| 19.2k| result[6] = vec256_xor(in[3], in[8]); 24| 19.2k| result[6] = vec256_xor(result[6], in[9]); 25| 19.2k| result[6] = vec256_xor(result[6], in[12]); 26| 19.2k| result[7] = vec256_xor(in[8], in[10]); 27| 19.2k| result[8] = vec256_xor(in[4], in[9]); 28| 19.2k| result[8] = vec256_xor(result[8], in[10]); 29| 19.2k| result[9] = vec256_xor(in[9], in[11]); 30| 19.2k| result[10] = vec256_xor(in[5], in[10]); 31| 19.2k| result[10] = vec256_xor(result[10], in[11]); 32| 19.2k| result[11] = vec256_xor(in[10], in[12]); 33| 19.2k| result[12] = vec256_xor(in[6], t); 34| | 35| 269k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 269k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 249k, False: 19.2k] ------------------ 36| 249k| out[i] = result[i]; 37| 249k| } 38| 19.2k|} PQCLEAN_MCELIECE6960119_AVX2_vec256_inv: 41| 1.31k|void vec256_inv(vec256 *out, vec256 *in) { 42| 1.31k| vec256 tmp_11[ GFBITS ]; 43| 1.31k| vec256 tmp_1111[ GFBITS ]; 44| | 45| 1.31k| vec256_copy(out, in); 46| | 47| 1.31k| vec256_sq(out, out); ------------------ | | 14| 1.31k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.31k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 48| 1.31k| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 1.31k| vec256_sq(out, tmp_11); ------------------ | | 14| 1.31k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.31k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 51| 1.31k| vec256_sq(out, out); ------------------ | | 14| 1.31k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.31k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 52| 1.31k| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 1.31k| vec256_sq(out, tmp_1111); ------------------ | | 14| 1.31k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.31k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 55| 1.31k| vec256_sq(out, out); ------------------ | | 14| 1.31k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.31k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 56| 1.31k| vec256_sq(out, out); ------------------ | | 14| 1.31k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.31k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 57| 1.31k| vec256_sq(out, out); ------------------ | | 14| 1.31k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.31k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 58| 1.31k| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 1.31k| vec256_sq(out, out); ------------------ | | 14| 1.31k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.31k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 61| 1.31k| vec256_sq(out, out); ------------------ | | 14| 1.31k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.31k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 62| 1.31k| vec256_sq(out, out); ------------------ | | 14| 1.31k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.31k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 63| 1.31k| vec256_sq(out, out); ------------------ | | 14| 1.31k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.31k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 64| 1.31k| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 1.31k| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 1.31k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.31k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 67| 1.31k|} operations.c:check_pk_padding: 19| 199|static int check_pk_padding(const unsigned char *pk) { 20| 199| unsigned char b; 21| 199| int i, ret; 22| | 23| 199| b = 0; 24| 308k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 308k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 308k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 308k|#define GFBITS 13 | | ------------------ ------------------ | Branch (24:17): [True: 307k, False: 199] ------------------ 25| 307k| b |= pk[i * PK_ROW_BYTES + PK_ROW_BYTES - 1]; ------------------ | | 15| 307k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 307k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 307k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 307k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 307k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 307k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ b |= pk[i * PK_ROW_BYTES + PK_ROW_BYTES - 1]; ------------------ | | 15| 307k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 307k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 307k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 307k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 307k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 307k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 26| 307k| } 27| | 28| 199| b >>= (PK_NCOLS % 8); ------------------ | | 14| 199|#define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 7| 199|#define SYS_N 6960 | | ------------------ | | #define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 13| 199|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 199|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 199|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 29| 199| b -= 1; 30| 199| b >>= 7; 31| 199| ret = b; 32| | 33| 199| return ret - 1; 34| 199|} operations.c:check_c_padding: 74| 199|static int check_c_padding(const unsigned char *c) { 75| 199| unsigned char b; 76| 199| int ret; 77| | 78| 199| b = c[ SYND_BYTES - 1 ] >> (PK_NROWS % 8); ------------------ | | 17| 199|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 199|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 199|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 199|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ b = c[ SYND_BYTES - 1 ] >> (PK_NROWS % 8); ------------------ | | 13| 199|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 199|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 199|#define GFBITS 13 | | ------------------ ------------------ 79| 199| b -= 1; 80| 199| b >>= 7; 81| 199| ret = b; 82| | 83| 199| return ret - 1; 84| 199|} PQCLEAN_MCELIECE6960119F_AVX2_load_bits: 188| 90|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 90| int i, j; 190| 90| const unsigned char *ptr = bits; 191| | 192| 90| vec128 buf[64]; 193| | 194| 360| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 270, False: 90] ------------------ 195| 17.5k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 17.2k, False: 270] ------------------ 196| 17.2k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 17.2k| ptr += 8; 198| 17.2k| } 199| | 200| 270| transpose_64x128_sp( buf ); 201| | 202| 8.91k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 8.64k, False: 270] ------------------ 203| 8.64k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 8.64k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 8.64k| } 206| | 207| 270| ptr += 512; 208| 270| } 209| | 210| 1.26k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.17k, False: 90] ------------------ 211| 38.6k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 37.4k, False: 1.17k] ------------------ 212| 37.4k| bits_int[i][j] = load16(ptr); 213| 37.4k| ptr += 16; 214| 37.4k| } 215| 1.17k| } 216| | 217| 360| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 270, False: 90] ------------------ 218| 17.5k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 17.2k, False: 270] ------------------ 219| 17.2k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 17.2k| ptr += 8; 221| 17.2k| } 222| | 223| 270| transpose_64x128_sp( buf ); 224| | 225| 8.91k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 8.64k, False: 270] ------------------ 226| 8.64k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 8.64k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 8.64k| } 229| | 230| 270| ptr += 512; 231| 270| } 232| 90|} PQCLEAN_MCELIECE6960119F_AVX2_benes: 238| 180|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 180| int inc; 240| | 241| 180| vec128 *b_ptr; 242| | 243| 180| if (rev == 0) { ------------------ | Branch (243:9): [True: 90, False: 90] ------------------ 244| 90| inc = 32; 245| 90| b_ptr = b[ 0]; 246| 90| } else { 247| 90| inc = -32; 248| 90| b_ptr = b[24]; 249| 90| } 250| | 251| | // 252| | 253| 180| transpose_64x128_sp( r ); 254| | 255| 180| layer_0(r, b_ptr); 256| 180| b_ptr += inc; 257| 180| layer_1(r, b_ptr); 258| 180| b_ptr += inc; 259| 180| layer_2(r, b_ptr); 260| 180| b_ptr += inc; 261| 180| layer_3(r, b_ptr); 262| 180| b_ptr += inc; 263| 180| layer_4(r, b_ptr); 264| 180| b_ptr += inc; 265| 180| layer_5(r, b_ptr); 266| 180| b_ptr += inc; 267| | 268| 180| transpose_64x128_sp( r ); 269| | 270| 180| layer_x(r, b_ptr); 271| 180| b_ptr += inc; 272| 180| layer_0(r, b_ptr); 273| 180| b_ptr += inc; 274| 180| layer_1(r, b_ptr); 275| 180| b_ptr += inc; 276| 180| layer_2(r, b_ptr); 277| 180| b_ptr += inc; 278| 180| layer_3(r, b_ptr); 279| 180| b_ptr += inc; 280| 180| layer_4(r, b_ptr); 281| 180| b_ptr += inc; 282| 180| layer_5(r, b_ptr); 283| 180| b_ptr += inc; 284| 180| layer_4(r, b_ptr); 285| 180| b_ptr += inc; 286| 180| layer_3(r, b_ptr); 287| 180| b_ptr += inc; 288| 180| layer_2(r, b_ptr); 289| 180| b_ptr += inc; 290| 180| layer_1(r, b_ptr); 291| 180| b_ptr += inc; 292| 180| layer_0(r, b_ptr); 293| 180| b_ptr += inc; 294| 180| layer_x(r, b_ptr); 295| 180| b_ptr += inc; 296| | 297| 180| transpose_64x128_sp( r ); 298| | 299| 180| layer_5(r, b_ptr); 300| 180| b_ptr += inc; 301| 180| layer_4(r, b_ptr); 302| 180| b_ptr += inc; 303| 180| layer_3(r, b_ptr); 304| 180| b_ptr += inc; 305| 180| layer_2(r, b_ptr); 306| 180| b_ptr += inc; 307| 180| layer_1(r, b_ptr); 308| 180| b_ptr += inc; 309| 180| layer_0(r, b_ptr); 310| | 311| 180| transpose_64x128_sp( r ); 312| 180|} PQCLEAN_MCELIECE6960119F_AVX2_bm: 147| 90|void bm(vec128 *out, vec256 *in) { 148| 90| int i; 149| 90| uint16_t N, L; 150| 90| uint16_t mask; 151| 90| uint64_t one = 1; 152| 90| uint64_t v[2]; 153| | 154| 90| vec128 prod[ GFBITS ]; 155| 90| vec128 interval[GFBITS]; 156| | 157| 90| typedef union { 158| 90| vec128 v[GFBITS][2]; 159| 90| vec256 V[GFBITS]; 160| 90| } db_t; 161| | 162| 90| db_t db; 163| 90| db_t BC_tmp; 164| 90| db_t BC; 165| | 166| 90| gf d, b; 167| 90| gf coefs[256]; 168| | 169| | // initialization 170| | 171| 90| get_coefs(coefs, in); 172| | 173| 90| BC.v[0][0] = vec128_set2x(0, one << 62); 174| 90| BC.v[0][1] = vec128_set2x(0, one << 63); 175| | 176| 1.17k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.17k|#define GFBITS 13 ------------------ | Branch (176:17): [True: 1.08k, False: 90] ------------------ 177| 1.08k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 178| 1.08k| } 179| | 180| 90| b = 1; 181| 90| L = 0; 182| | 183| | // 184| | 185| 1.26k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.26k|#define GFBITS 13 ------------------ | Branch (185:17): [True: 1.17k, False: 90] ------------------ 186| 1.17k| interval[i] = vec128_setzero(); 187| 1.17k| } 188| | 189| 21.5k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 21.5k|#define SYS_T 119 ------------------ | Branch (189:17): [True: 21.4k, False: 90] ------------------ 190| 21.4k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 21.4k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 21.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 191| 21.4k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 21.4k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 21.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 192| | 193| 21.4k| d = vec_reduce_asm(prod); ------------------ | | 3| 21.4k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 21.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 194| | 195| 21.4k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 196| | 197| 299k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 299k|#define GFBITS 13 ------------------ | Branch (197:21): [True: 278k, False: 21.4k] ------------------ 198| 278k| db.v[i][0] = vec128_setbits((d >> i) & 1); 199| 278k| db.v[i][1] = vec128_setbits((b >> i) & 1); 200| 278k| } 201| | 202| 21.4k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 203| | 204| 21.4k| vec128_cmov(BC.v, mask); 205| 21.4k| update_asm(BC.v, 0, 32); ------------------ | | 1| 21.4k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 21.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 299k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 299k|#define GFBITS 13 ------------------ | Branch (207:21): [True: 278k, False: 21.4k] ------------------ 208| 278k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 209| 278k| } 210| | 211| 21.4k| b = (d & mask) | (b & ~mask); 212| 21.4k| L = ((N + 1 - L) & mask) | (L & ~mask); 213| 21.4k| } 214| | 215| 1.26k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.26k|#define GFBITS 13 ------------------ | Branch (215:17): [True: 1.17k, False: 90] ------------------ 216| 1.17k| v[0] = vec128_extract(BC.v[i][1], 0); ------------------ | | 29| 1.17k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 217| 1.17k| v[1] = vec128_extract(BC.v[i][1], 1); ------------------ | | 29| 1.17k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 218| | 219| 1.17k| out[i] = vec128_set2x((v[0] >> 8) | (v[1] << 56), v[1] >> 8); 220| 1.17k| } 221| 90|} PQCLEAN_MCELIECE6960119F_AVX2_controlbitsfrompermutation: 205| 90|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 90| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 90|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 90| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 90|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 90| int16 diff; 209| 90| int i; 210| 90| unsigned char *ptr; 211| | 212| 90| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 90| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 90| while (1) { ------------------ | Branch (215:12): [True: 90, Folded] ------------------ 216| 90| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 90| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 737k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 737k, False: 90] ------------------ 222| 737k| pi_test[i] = (int16)i; 223| 737k| } 224| | 225| 90| ptr = out; 226| 1.26k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.17k, False: 90] ------------------ 227| 1.17k| layer(pi_test, ptr, i, (int32)n); 228| 1.17k| ptr += n >> 4; 229| 1.17k| } 230| | 231| 1.17k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.08k, False: 90] ------------------ 232| 1.08k| layer(pi_test, ptr, i, (int32)n); 233| 1.08k| ptr += n >> 4; 234| 1.08k| } 235| | 236| 90| diff = 0; 237| 737k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 737k, False: 90] ------------------ 238| 737k| diff |= pi[i] ^ pi_test[i]; 239| 737k| } 240| | 241| 90| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 90|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 242| 90| crypto_declassify(&diff, sizeof diff); 243| 90| if (diff == 0) { ------------------ | Branch (243:13): [True: 90, False: 0] ------------------ 244| 90| break; 245| 90| } 246| 90| } 247| 90|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_int16_negative_mask: 3| 180|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 180| return crypto_int16_x >> 15; 5| 180|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_int16_nonzero_mask: 7| 90|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 90| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 90|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 90|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 9| 90|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_int32_negative_mask: 3| 57.5M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 57.5M| return crypto_int32_x >> 31; 5| 57.5M|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_int32_min: 37| 57.5M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 57.5M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 57.5M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 57.5M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 57.5M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 57.5M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 57.5M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 42| 57.5M| crypto_int32_z &= crypto_int32_xy; 43| 57.5M| return crypto_int32_x ^ crypto_int32_z; 44| 57.5M|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint16_signed_negative_mask: 3| 96.7k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 96.7k| return crypto_uint16_signed_x >> 15; 5| 96.7k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint16_nonzero_mask: 7| 14.0k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 14.0k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 14.0k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 14.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 14.0k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 14.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 9| 14.0k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint16_zero_mask: 11| 14.0k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 14.0k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 14.0k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 14.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 13| 14.0k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint16_smaller_mask: 24| 68.6k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 68.6k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 68.6k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 68.6k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 68.6k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 68.6k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 68.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 29| 68.6k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint32_signed_negative_mask: 3| 115k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 115k| return crypto_uint32_signed_x >> 31; 5| 115k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint32_nonzero_mask: 7| 57.8k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 57.8k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 57.8k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 57.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 57.8k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 57.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 9| 57.8k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint32_unequal_mask: 15| 57.8k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 57.8k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 57.8k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 57.8k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 57.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 18| 57.8k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint32_equal_mask: 20| 57.8k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 57.8k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 57.8k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 57.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 22| 57.8k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint64_signed_negative_mask: 3| 1.99M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 1.99M| return crypto_uint64_signed_x >> 63; 5| 1.99M|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint64_nonzero_mask: 7| 996k|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 996k| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 996k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 996k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 996k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 996k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 9| 996k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint64_zero_mask: 11| 142k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 142k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 142k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 142k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 13| 142k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint64_unequal_mask: 15| 854k|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 854k| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 854k| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 854k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 854k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 18| 854k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint64_equal_mask: 20| 854k|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 854k| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 854k|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 854k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 22| 854k|} PQCLEAN_MCELIECE6960119F_AVX2_decrypt: 171| 90|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 90| int i; 173| | 174| 90| uint16_t check_synd; 175| 90| uint16_t check_weight; 176| | 177| 90| vec256 inv[ 32 ][ GFBITS ]; 178| 90| vec256 scaled[ 32 ][ GFBITS ]; 179| 90| vec256 eval[32][ GFBITS ]; 180| | 181| 90| vec128 error128[ 64 ]; 182| 90| vec256 error256[ 32 ]; 183| | 184| 90| vec256 s_priv[ GFBITS ]; 185| 90| vec256 s_priv_cmp[ GFBITS ]; 186| 90| vec128 locator[ GFBITS ]; 187| | 188| 90| vec128 recv128[ 64 ]; 189| 90| vec256 recv256[ 32 ]; 190| 90| vec256 allone; 191| | 192| 90| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 90| preprocess(recv128, s); 197| | 198| 90| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 90|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 90|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 90|#define SYS_T 119 | | ------------------ ------------------ 199| 90| benes(recv128, bits_int, 1); ------------------ | | 9| 90|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 90| reformat_128to256(recv256, recv128); 202| | 203| 90| scaling(scaled, inv, sk, recv256); 204| 90| fft_tr(s_priv, scaled); ------------------ | | 9| 90|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 205| 90| bm(locator, s_priv); ------------------ | | 10| 90|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 90| fft(eval, locator); ------------------ | | 10| 90|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 90| allone = vec256_set1_16b(0xFFFF); 212| | 213| 2.97k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 2.88k, False: 90] ------------------ 214| 2.88k| error256[i] = vec256_or_reduce(eval[i]); 215| 2.88k| error256[i] = vec256_xor(error256[i], allone); 216| 2.88k| } 217| | 218| 90| scaling_inv(scaled, inv, error256); 219| 90| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 90|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 90| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 90| reformat_256to128(error128, error256); 226| 90| benes(error128, bits_int, 0); ------------------ | | 9| 90|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 90| postprocess(e, error128); 229| | 230| 90| check_weight = weight_check(e, error128); 231| | 232| 90| return 1 - (check_synd & check_weight); 233| 90|} PQCLEAN_MCELIECE6960119F_AVX2_encrypt: 116| 90|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 117| 90| gen_e(e); 118| | 119| 90| syndrome_asm(s, pk, e); ------------------ | | 1| 90|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 120| 90|} PQCLEAN_MCELIECE6960119F_AVX2_fft: 265| 298|void fft(vec256 out[][GFBITS], vec128 *in) { 266| 298| radix_conversions(in); 267| 298| butterflies(out, in); 268| 298|} PQCLEAN_MCELIECE6960119F_AVX2_fft_tr: 398| 180|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 399| 180| butterflies_tr(out, in); 400| 180| radix_conversions_tr(out); 401| | 402| 180| postprocess(out); 403| 180|} PQCLEAN_MCELIECE6960119F_AVX2_gf_mul: 20| 1.67M|gf gf_mul(gf in0, gf in1) { 21| 1.67M| int i; 22| | 23| 1.67M| uint64_t tmp; 24| 1.67M| uint64_t t0; 25| 1.67M| uint64_t t1; 26| 1.67M| uint64_t t; 27| | 28| 1.67M| t0 = in0; 29| 1.67M| t1 = in1; 30| | 31| 1.67M| tmp = t0 * (t1 & 1); 32| | 33| 21.7M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 21.7M|#define GFBITS 13 ------------------ | Branch (33:17): [True: 20.0M, False: 1.67M] ------------------ 34| 20.0M| tmp ^= (t0 * (t1 & (1 << i))); 35| 20.0M| } 36| | 37| | // 38| | 39| 1.67M| t = tmp & 0x1FF0000; 40| 1.67M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 41| | 42| 1.67M| t = tmp & 0x000E000; 43| 1.67M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 44| | 45| 1.67M| return tmp & GFMASK; ------------------ | | 19| 1.67M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.67M|#define GFBITS 13 | | ------------------ ------------------ 46| 1.67M|} PQCLEAN_MCELIECE6960119F_AVX2_gf_frac: 156| 14.0k|gf gf_frac(gf den, gf num) { 157| 14.0k| gf tmp_11; 158| 14.0k| gf tmp_1111; 159| 14.0k| gf out; 160| | 161| 14.0k| tmp_11 = gf_sqmul(den, den); // ^11 162| 14.0k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // ^1111 163| 14.0k| out = gf_sq2(tmp_1111); 164| 14.0k| out = gf_sq2mul(out, tmp_1111); // ^11111111 165| 14.0k| out = gf_sq2(out); 166| 14.0k| out = gf_sq2mul(out, tmp_1111); // ^111111111111 167| | 168| 14.0k| return gf_sqmul(out, num); // ^1111111111110 = ^-1 169| 14.0k|} PQCLEAN_MCELIECE6960119F_AVX2_gf_inv: 172| 14.0k|gf gf_inv(gf den) { 173| 14.0k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 14.0k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 14.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 174| 14.0k|} pk_gen.c:PQCLEAN_MCELIECE6960119F_AVX2_int32_sort: 21| 90|static void int32_sort(int32_t *x, long long n) { 22| 90| long long top, p, q, r, i; 23| | 24| 90| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 90] ------------------ 25| 0| return; 26| 0| } 27| 90| top = 1; 28| 990| while (top < n - top) { ------------------ | Branch (28:12): [True: 900, False: 90] ------------------ 29| 900| top += top; 30| 900| } 31| | 32| 1.08k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 990, False: 90] ------------------ 33| 1.34M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.34M, False: 990] ------------------ 34| 1.34M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 717k, False: 629k] ------------------ 35| 717k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 717k| do { \ | | 12| 717k| int32_t ab = (b) ^ (a); \ | | 13| 717k| int32_t c = (b) - (a); \ | | 14| 717k| c ^= ab & ((c) ^ (b)); \ | | 15| 717k| c >>= 31; \ | | 16| 717k| c &= ab; \ | | 17| 717k| (a) ^= c; \ | | 18| 717k| (b) ^= c; \ | | 19| 717k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 717k] | | ------------------ ------------------ 36| 717k| } 37| 1.34M| } 38| 990| i = 0; 39| 5.94k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 4.95k, False: 990] ------------------ 40| 1.21M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.20M, False: 4.95k] ------------------ 41| 1.20M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 629k, False: 578k] ------------------ 42| 629k| int32_t a = x[i + p]; 43| 3.66M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.03M, False: 629k] ------------------ 44| 3.03M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.03M| do { \ | | 12| 3.03M| int32_t ab = (b) ^ (a); \ | | 13| 3.03M| int32_t c = (b) - (a); \ | | 14| 3.03M| c ^= ab & ((c) ^ (b)); \ | | 15| 3.03M| c >>= 31; \ | | 16| 3.03M| c &= ab; \ | | 17| 3.03M| (a) ^= c; \ | | 18| 3.03M| (b) ^= c; \ | | 19| 3.03M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.03M] | | ------------------ ------------------ 45| 3.03M| } 46| 629k| x[i + p] = a; 47| 629k| } 48| 1.20M| } 49| 4.95k| } 50| 990| } 51| 90|} controlbits.c:PQCLEAN_MCELIECE6960119F_AVX2_int32_sort: 21| 2.95M|static void int32_sort(int32_t *x, long long n) { 22| 2.95M| long long top, p, q, r, i; 23| | 24| 2.95M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 2.95M] ------------------ 25| 0| return; 26| 0| } 27| 2.95M| top = 1; 28| 10.3M| while (top < n - top) { ------------------ | Branch (28:12): [True: 7.38M, False: 2.95M] ------------------ 29| 7.38M| top += top; 30| 7.38M| } 31| | 32| 13.2M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 10.3M, False: 2.95M] ------------------ 33| 1.42G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.41G, False: 10.3M] ------------------ 34| 1.41G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 789M, False: 622M] ------------------ 35| 789M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 789M| do { \ | | 12| 789M| int32_t ab = (b) ^ (a); \ | | 13| 789M| int32_t c = (b) - (a); \ | | 14| 789M| c ^= ab & ((c) ^ (b)); \ | | 15| 789M| c >>= 31; \ | | 16| 789M| c &= ab; \ | | 17| 789M| (a) ^= c; \ | | 18| 789M| (b) ^= c; \ | | 19| 789M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 789M] | | ------------------ ------------------ 36| 789M| } 37| 1.41G| } 38| 10.3M| i = 0; 39| 28.0M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 17.7M, False: 10.3M] ------------------ 40| 1.26G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.24G, False: 17.7M] ------------------ 41| 1.24G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 622M, False: 622M] ------------------ 42| 622M| int32_t a = x[i + p]; 43| 3.68G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.06G, False: 622M] ------------------ 44| 3.06G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.06G| do { \ | | 12| 3.06G| int32_t ab = (b) ^ (a); \ | | 13| 3.06G| int32_t c = (b) - (a); \ | | 14| 3.06G| c ^= ab & ((c) ^ (b)); \ | | 15| 3.06G| c >>= 31; \ | | 16| 3.06G| c &= ab; \ | | 17| 3.06G| (a) ^= c; \ | | 18| 3.06G| (b) ^= c; \ | | 19| 3.06G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.06G] | | ------------------ ------------------ 45| 3.06G| } 46| 622M| x[i + p] = a; 47| 622M| } 48| 1.24G| } 49| 17.7M| } 50| 10.3M| } 51| 2.95M|} encrypt.c:PQCLEAN_MCELIECE6960119F_AVX2_int32_sort: 21| 490|static void int32_sort(int32_t *x, long long n) { 22| 490| long long top, p, q, r, i; 23| | 24| 490| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 490] ------------------ 25| 0| return; 26| 0| } 27| 490| top = 1; 28| 3.43k| while (top < n - top) { ------------------ | Branch (28:12): [True: 2.94k, False: 490] ------------------ 29| 2.94k| top += top; 30| 2.94k| } 31| | 32| 3.92k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 3.43k, False: 490] ------------------ 33| 349k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 345k, False: 3.43k] ------------------ 34| 345k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 195k, False: 150k] ------------------ 35| 195k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 195k| do { \ | | 12| 195k| int32_t ab = (b) ^ (a); \ | | 13| 195k| int32_t c = (b) - (a); \ | | 14| 195k| c ^= ab & ((c) ^ (b)); \ | | 15| 195k| c >>= 31; \ | | 16| 195k| c &= ab; \ | | 17| 195k| (a) ^= c; \ | | 18| 195k| (b) ^= c; \ | | 19| 195k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 195k] | | ------------------ ------------------ 36| 195k| } 37| 345k| } 38| 3.43k| i = 0; 39| 13.7k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 10.2k, False: 3.43k] ------------------ 40| 298k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 288k, False: 10.2k] ------------------ 41| 288k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 150k, False: 137k] ------------------ 42| 150k| int32_t a = x[i + p]; 43| 621k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 470k, False: 150k] ------------------ 44| 470k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 470k| do { \ | | 12| 470k| int32_t ab = (b) ^ (a); \ | | 13| 470k| int32_t c = (b) - (a); \ | | 14| 470k| c ^= ab & ((c) ^ (b)); \ | | 15| 470k| c >>= 31; \ | | 16| 470k| c &= ab; \ | | 17| 470k| (a) ^= c; \ | | 18| 470k| (b) ^= c; \ | | 19| 470k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 470k] | | ------------------ ------------------ 45| 470k| } 46| 150k| x[i + p] = a; 47| 150k| } 48| 288k| } 49| 10.2k| } 50| 3.43k| } 51| 490|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_enc: 40| 90|) { 41| 90| unsigned char e[ SYS_N / 8 ]; 42| 90| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 43| 90| unsigned char mask; 44| 90| int i, padding_ok; 45| | 46| | // 47| | 48| 90| padding_ok = check_pk_padding(pk); 49| | 50| 90| encrypt(c, pk, e); ------------------ | | 9| 90|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 51| | 52| 90| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 90|#define SYS_N 6960 ------------------ 53| 90| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 90|#define SYS_N 6960 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 90|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 90|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 90|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 90|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 54| | 55| 90| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 90| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 90|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 56| | 57| | // clear outputs (set to all 0's) if padding bits are not all zero 58| | 59| 90| mask = (unsigned char)padding_ok; 60| 90| mask ^= 0xFF; 61| | 62| 17.5k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 17.5k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 17.5k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 17.5k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 17.5k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (62:17): [True: 17.4k, False: 90] ------------------ 63| 17.4k| c[i] &= mask; 64| 17.4k| } 65| | 66| 2.97k| for (i = 0; i < 32; i++) { ------------------ | Branch (66:17): [True: 2.88k, False: 90] ------------------ 67| 2.88k| key[i] &= mask; 68| 2.88k| } 69| | 70| 90| return padding_ok; 71| 90|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_dec: 90| 90|) { 91| 90| int i, padding_ok; 92| | 93| 90| unsigned char mask; 94| 90| unsigned char ret_decrypt = 0; 95| | 96| 90| uint16_t m; 97| | 98| 90| unsigned char e[ SYS_N / 8 ]; 99| 90| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 100| 90| unsigned char *x = preimage; 101| 90| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 90|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 90|#define SYS_T 119 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 90|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 90|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 90|#define GFBITS 13 | | ------------------ ------------------ 102| | 103| | // 104| | 105| 90| padding_ok = check_c_padding(c); 106| | 107| 90| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 90|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 108| | 109| 90| m = ret_decrypt; 110| 90| m -= 1; 111| 90| m >>= 8; 112| | 113| 90| *x++ = m & 1; 114| 78.3k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 78.3k|#define SYS_N 6960 ------------------ | Branch (114:17): [True: 78.3k, False: 90] ------------------ 115| 78.3k| *x++ = (~m & s[i]) | (m & e[i]); 116| 78.3k| } 117| | 118| 17.5k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 17.5k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 17.5k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 17.5k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 17.5k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (118:17): [True: 17.4k, False: 90] ------------------ 119| 17.4k| *x++ = c[i]; 120| 17.4k| } 121| | 122| 90| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 90| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 90|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 123| | 124| | // clear outputs (set to all 1's) if padding bits are not all zero 125| | 126| 90| mask = (unsigned char)padding_ok; 127| | 128| 2.97k| for (i = 0; i < 32; i++) { ------------------ | Branch (128:17): [True: 2.88k, False: 90] ------------------ 129| 2.88k| key[i] |= mask; 130| 2.88k| } 131| | 132| 90| return padding_ok; 133| 90|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_keypair: 139| 90|) { 140| 90| int i; 141| 90| unsigned char seed[ 33 ] = {64}; 142| 90| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 143| 90| unsigned char *rp, *skp; 144| 90| uint64_t pivots; 145| | 146| 90| gf f[ SYS_T ]; // element in GF(2^mt) 147| 90| gf irr[ SYS_T ]; // Goppa polynomial 148| 90| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 149| 90| int16_t pi[ 1 << GFBITS ]; // random permutation 150| | 151| 90| randombytes(seed + 1, 32); ------------------ | | 8| 90|#define randombytes OQS_randombytes ------------------ 152| | 153| 118| while (1) { ------------------ | Branch (153:12): [True: 118, Folded] ------------------ 154| 118| rp = &r[ sizeof(r) - 32 ]; 155| 118| skp = sk; 156| | 157| | // expanding and updating the seed 158| | 159| 118| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 118| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 118|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 160| 118| memcpy(skp, seed + 1, 32); 161| 118| skp += 32 + 8; 162| 118| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 163| | 164| | // generating irreducible polynomial 165| | 166| 118| rp -= sizeof(f); 167| | 168| 14.1k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 14.1k|#define SYS_T 119 ------------------ | Branch (168:21): [True: 14.0k, False: 118] ------------------ 169| 14.0k| f[i] = load_gf(rp + i * 2); 170| 14.0k| } 171| | 172| 118| if (genpoly_gen(irr, f)) { ------------------ | | 9| 118|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 118|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ | Branch (172:13): [True: 0, False: 118] ------------------ 173| 0| continue; 174| 0| } 175| | 176| 14.1k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 14.1k|#define SYS_T 119 ------------------ | Branch (176:21): [True: 14.0k, False: 118] ------------------ 177| 14.0k| store_gf(skp + i * 2, irr[i]); 178| 14.0k| } 179| | 180| 118| skp += IRR_BYTES; ------------------ | | 11| 118|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 118|#define SYS_T 119 | | ------------------ ------------------ 181| | 182| | // generating permutation 183| | 184| 118| rp -= sizeof(perm); 185| | 186| 966k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 966k|#define GFBITS 13 ------------------ | Branch (186:21): [True: 966k, False: 118] ------------------ 187| 966k| perm[i] = load4(rp + i * 4); 188| 966k| } 189| | 190| 118| if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 9| 118|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 118|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 11| 118|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 118|#define SYS_T 119 | | ------------------ ------------------ | Branch (190:13): [True: 28, False: 90] ------------------ 191| 28| continue; 192| 28| } 193| | 194| 90| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 90|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 90|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 90|#define GFBITS 13 ------------------ 195| 90| skp += COND_BYTES; ------------------ | | 10| 90|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 90|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 90|#define GFBITS 13 | | ------------------ ------------------ 196| | 197| | // storing the random string s 198| | 199| 90| rp -= SYS_N / 8; ------------------ | | 7| 90|#define SYS_N 6960 ------------------ 200| 90| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 90|#define SYS_N 6960 ------------------ 201| | 202| | // storing positions of the 32 pivots 203| | 204| 90| store8(sk + 32, pivots); 205| | 206| 90| break; 207| 118| } 208| | 209| 90| return 0; 210| 90|} PQCLEAN_MCELIECE6960119F_AVX2_pk_gen: 316| 118|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi, uint64_t *pivots) { 317| |// const int nBlocks_I = (PK_NROWS + 255) / 256; 318| 118| const int head = PK_NROWS % 64; ------------------ | | 13| 118|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 118|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 118|#define GFBITS 13 | | ------------------ ------------------ 319| 118| const int tail = PK_NCOLS % 64; ------------------ | | 14| 118|#define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 7| 118|#define SYS_N 6960 | | ------------------ | | #define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 13| 118|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 118|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 118|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 320| 118| const uint64_t one = 1; 321| | 322| 118| int i, j, k, b; 323| 118| int row, c; 324| | 325| 118| union { 326| 118| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 327| 118| vec256 v[ PK_NROWS ][ nBlocks_I ]; 328| 118| } mat; 329| | 330| 118| union { 331| 118| uint64_t w[ PK_NROWS ][ 44 ]; 332| 118| vec256 v[ PK_NROWS ][ 11 ]; 333| 118| } par; 334| | 335| 118| uint16_t m; 336| 118| vec256 mm; 337| | 338| 118| vec128 sk_int[ GFBITS ]; 339| | 340| 118| vec256 consts[ 32 ][ GFBITS ]; 341| 118| vec256 eval[ 32 ][ GFBITS ]; 342| 118| vec256 prod[ 32 ][ GFBITS ]; 343| 118| vec256 tmp[ GFBITS ]; 344| | 345| 118| uint64_t list[1 << GFBITS]; 346| 118| uint64_t buf[ PK_NROWS ]; 347| 118| uint64_t t; 348| | 349| 118| uint16_t ind[ PK_NROWS ]; 350| 118| uint16_t ind_inv[ PK_NROWS ]; 351| | 352| | // compute the inverses 353| | 354| 118| irr_load(sk_int, irr); 355| | 356| 118| fft(eval, sk_int); ------------------ | | 10| 118|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 118|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 357| | 358| 118| vec256_copy(prod[0], eval[0]); 359| | 360| 3.77k| for (i = 1; i < 32; i++) { ------------------ | Branch (360:17): [True: 3.65k, False: 118] ------------------ 361| 3.65k| vec256_mul(prod[i], prod[i - 1], eval[i]); 362| 3.65k| } 363| | 364| 118| vec256_inv(tmp, prod[31]); ------------------ | | 11| 118|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 118|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 365| | 366| 3.77k| for (i = 30; i >= 0; i--) { ------------------ | Branch (366:18): [True: 3.65k, False: 118] ------------------ 367| 3.65k| vec256_mul(prod[i + 1], prod[i], tmp); 368| 3.65k| vec256_mul(tmp, tmp, eval[i + 1]); 369| 3.65k| } 370| | 371| 118| vec256_copy(prod[0], tmp); 372| | 373| | // fill matrix 374| | 375| 118| de_bitslicing(list, prod); 376| | 377| 966k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 966k|#define GFBITS 13 ------------------ | Branch (377:17): [True: 966k, False: 118] ------------------ 378| 966k| list[i] <<= GFBITS; ------------------ | | 6| 966k|#define GFBITS 13 ------------------ 379| 966k| list[i] |= i; 380| 966k| list[i] |= ((uint64_t) perm[i]) << 31; 381| 966k| } 382| | 383| 118| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 118|#define GFBITS 13 ------------------ 384| | 385| 854k| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 854k|#define GFBITS 13 ------------------ | Branch (385:17): [True: 854k, False: 90] ------------------ 386| 854k| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (386:13): [True: 28, False: 854k] ------------------ 387| 28| return -1; 388| 28| } 389| 854k| } 390| | 391| 90| to_bitslicing_2x(consts, prod, list); 392| | 393| 737k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 737k|#define GFBITS 13 ------------------ | Branch (393:17): [True: 737k, False: 90] ------------------ 394| 737k| pi[i] = list[i] & GFMASK; ------------------ | | 19| 737k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 737k|#define GFBITS 13 | | ------------------ ------------------ 395| 737k| } 396| | 397| 720| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 720|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 720|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 720|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 720|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (397:17): [True: 630, False: 90] ------------------ 398| 8.82k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 8.82k|#define GFBITS 13 ------------------ | Branch (398:21): [True: 8.19k, False: 630] ------------------ 399| 8.19k| mat.v[ k ][ j ] = prod[ j ][ k ]; 400| 8.19k| } 401| 630| } 402| | 403| 10.7k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 10.7k|#define SYS_T 119 ------------------ | Branch (403:17): [True: 10.6k, False: 90] ------------------ 404| 84.9k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 84.9k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 84.9k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 84.9k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 84.9k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (404:21): [True: 74.3k, False: 10.6k] ------------------ 405| 74.3k| vec256_mul(prod[j], prod[j], consts[j]); 406| | 407| 1.04M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 1.04M|#define GFBITS 13 ------------------ | Branch (407:25): [True: 966k, False: 74.3k] ------------------ 408| 966k| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 966k|#define GFBITS 13 ------------------ 409| 966k| } 410| 74.3k| } 411| 10.6k| } 412| | 413| | // gaussian elimination to obtain L, U, and P such that LP M = U 414| | // L and U are stored in the space of M 415| | // P is stored in ind 416| | 417| 139k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 139k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 139k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 139k|#define GFBITS 13 | | ------------------ ------------------ | Branch (417:17): [True: 139k, False: 90] ------------------ 418| 139k| ind_inv[i] = ind[ i ] = i; 419| 139k| } 420| | 421| 139k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 139k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 139k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 139k|#define GFBITS 13 | | ------------------ ------------------ | Branch (421:19): [True: 139k, False: 90] ------------------ 422| 139k| i = row >> 6; 423| 139k| j = row & 63; 424| | 425| 139k| if (row == PK_NROWS - 32) { ------------------ | | 13| 139k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 139k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 139k|#define GFBITS 13 | | ------------------ ------------------ | Branch (425:13): [True: 90, False: 139k] ------------------ 426| 90| if (mov_columns(mat.w, pi, pivots)) { ------------------ | Branch (426:17): [True: 0, False: 90] ------------------ 427| 0| return -1; 428| 0| } 429| 90| } 430| | 431| 107M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 107M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 107M|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 107M|#define GFBITS 13 | | ------------------ ------------------ | Branch (431:27): [True: 107M, False: 139k] ------------------ 432| 107M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 433| 107M| uint16_cswap(&ind[row], &ind[k], m); 434| | 435| 107M| mm = vec256_set1_16b(m); 436| 860M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 860M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 860M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 860M|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 860M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (436:25): [True: 753M, False: 107M] ------------------ 437| 753M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 438| 753M| } 439| 107M| } 440| | 441| 139k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (441:14): [True: 0, False: 139k] ------------------ 442| 0| return -1; 443| 0| } 444| | 445| 107M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 107M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 107M|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 107M|#define GFBITS 13 | | ------------------ ------------------ | Branch (445:27): [True: 107M, False: 139k] ------------------ 446| 107M| t = mat.w[ k ][ i ] & (one << j); 447| 107M| mm = extract_mask256(mat.w[k], row); 448| | 449| 860M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 860M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 860M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 860M|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 860M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (449:25): [True: 753M, False: 107M] ------------------ 450| 753M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 451| 753M| } 452| | 453| 107M| mat.w[ k ][ i ] |= t; 454| 107M| } 455| 139k| } 456| | 457| | // apply M^-1 to the remaining columns 458| | 459| 90| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 90|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 90|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 90|#define GFBITS 13 | | ------------------ ------------------ 460| | 461| 270| for (j = 6; j < 28; j += 11) { ------------------ | Branch (461:17): [True: 180, False: 90] ------------------ 462| 2.52k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 2.52k|#define GFBITS 13 ------------------ | Branch (462:21): [True: 2.34k, False: 180] ------------------ 463| 28.0k| for (b = 0; b < 11; b++) { ------------------ | Branch (463:25): [True: 25.7k, False: 2.34k] ------------------ 464| 25.7k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 465| 25.7k| } 466| 2.34k| } 467| | 468| 21.4k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 21.4k|#define SYS_T 119 ------------------ | Branch (468:21): [True: 21.2k, False: 180] ------------------ 469| 254k| for (b = 0; b < 11; b++) { ------------------ | Branch (469:25): [True: 233k, False: 21.2k] ------------------ 470| 233k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 471| 233k| } 472| | 473| 297k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 297k|#define GFBITS 13 ------------------ | Branch (473:25): [True: 276k, False: 21.2k] ------------------ 474| 3.31M| for (b = 0; b < 11; b++) { ------------------ | Branch (474:29): [True: 3.03M, False: 276k] ------------------ 475| 3.03M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 3.03M|#define GFBITS 13 ------------------ 476| 3.03M| } 477| 276k| } 478| 21.2k| } 479| | 480| | // apply P 481| | 482| 278k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 278k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 278k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 278k|#define GFBITS 13 | | ------------------ ------------------ | Branch (482:21): [True: 278k, False: 180] ------------------ 483| 278k| ind[i] = ind_inv[i]; 484| 278k| } 485| | 486| 180| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 180|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 180|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 180|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 180|#define GFBITS 13 | | ------------------ ------------------ 487| | 488| | // apply L 489| | 490| 278k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 180|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 180|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 180|#define GFBITS 13 | | ------------------ ------------------ | Branch (490:34): [True: 278k, False: 180] ------------------ 491| 215M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (491:31): [True: 215M, False: 278k] ------------------ 492| 215M| mm = extract_mask256(mat.w[row], i); 493| | 494| 2.58G| for (k = 0; k < 11; k++) { ------------------ | Branch (494:29): [True: 2.36G, False: 215M] ------------------ 495| 2.36G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 496| 2.36G| } 497| 215M| } 498| 278k| } 499| | 500| | // apply U^-1 501| | 502| 180| if (j == 6) { ------------------ | Branch (502:13): [True: 90, False: 90] ------------------ 503| 139k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 139k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 139k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 139k|#define GFBITS 13 | | ------------------ ------------------ | Branch (503:25): [True: 139k, False: 90] ------------------ 504| 139k| par.v[i][0] = mat.v[ i ][ nBlocks_I - 1 ]; ------------------ | | 32| 139k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 139k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 139k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 139k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 505| 139k| } 506| 90| } 507| | 508| 278k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 180|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 180|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 180|#define GFBITS 13 | | ------------------ ------------------ | Branch (508:34): [True: 278k, False: 180] ------------------ 509| 215M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 278k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 278k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 278k|#define GFBITS 13 | | ------------------ ------------------ | Branch (509:36): [True: 215M, False: 278k] ------------------ 510| 215M| mm = extract_mask256(mat.w[row], i); 511| | 512| 2.58G| for (k = 0; k < 11; k++) { ------------------ | Branch (512:29): [True: 2.36G, False: 215M] ------------------ 513| 2.36G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 514| 2.36G| } 515| 215M| } 516| 278k| } 517| | 518| 180| if (j == 6) { ------------------ | Branch (518:13): [True: 90, False: 90] ------------------ 519| 139k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 139k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 139k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 139k|#define GFBITS 13 | | ------------------ ------------------ | Branch (519:27): [True: 139k, False: 90] ------------------ 520| 6.12M| for (i = 0; i < 43; i++) { ------------------ | Branch (520:29): [True: 5.98M, False: 139k] ------------------ 521| 5.98M| store8(pk + PK_ROW_BYTES * row + i * 8, (par.w[row][i] >> head) | (par.w[row][i + 1] << (64 - head))); ------------------ | | 15| 5.98M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 5.98M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 5.98M|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 5.98M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 5.98M|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 5.98M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 522| 5.98M| } 523| | 524| 139k| buf[row] = par.w[row][i] >> head; 525| 139k| } 526| 90| } else { 527| 139k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 139k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 139k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 139k|#define GFBITS 13 | | ------------------ ------------------ | Branch (527:27): [True: 139k, False: 90] ------------------ 528| 139k| store8(pk + PK_ROW_BYTES * row + 43 * 8, buf[row] | (par.w[row][0] << (64 - head))); ------------------ | | 15| 139k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 139k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 139k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 139k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 139k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 139k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 529| | 530| 5.70M| for (i = 0; i < 40; i++) { ------------------ | Branch (530:29): [True: 5.56M, False: 139k] ------------------ 531| 5.56M| store8(pk + PK_ROW_BYTES * row + (i + 44) * 8, (par.w[row][i] >> head) | (par.w[row][i + 1] << (64 - head))); ------------------ | | 15| 5.56M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 5.56M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 5.56M|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 5.56M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 5.56M|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 5.56M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 532| 5.56M| } 533| | 534| 139k| par.w[row][i] >>= head; 535| 139k| par.w[row][i] &= (one << tail) - 1; 536| | 537| 139k| store_i(pk + PK_ROW_BYTES * row + (i + 44) * 8, par.w[row][i], (tail + 7) / 8); ------------------ | | 15| 139k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 139k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 139k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 139k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 139k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 139k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 538| 139k| } 539| 90| } 540| | 541| 180| } 542| | 543| | // 544| | 545| 90| return 0; 546| 90|} PQCLEAN_MCELIECE6960119F_AVX2_genpoly_gen: 88| 118|int genpoly_gen(gf *out, gf *f) { 89| 118| int i, j, k; 90| | 91| 118| gf t, inv; 92| | 93| 118| uint64_t m; 94| 118| vec128 mask; 95| | 96| 118| union { 97| 118| uint64_t d[ GFBITS ][ 128 ][2]; 98| 118| vec128 v[ GFBITS ][ 128 ]; 99| 118| } buf; 100| | 101| 118| union { 102| 118| uint64_t d[GFBITS][2]; 103| 118| vec128 v[GFBITS]; 104| 118| } v; 105| | 106| 118| union { 107| 118| uint64_t d[SYS_T][GFBITS][2]; 108| 118| vec128 v[SYS_T][GFBITS]; 109| 118| } mat; 110| | 111| | // fill matrix 112| | 113| 118| buf.v[0][0] = vec128_set2x(1, 0); 114| 1.53k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.53k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 1.41k, False: 118] ------------------ 115| 1.41k| buf.v[i][0] = vec128_setzero(); 116| 1.41k| } 117| | 118| 1.65k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 1.65k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 1.53k, False: 118] ------------------ 119| 1.53k| v.v[j] = vec128_setzero(); 120| | 121| 184k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 1.53k|#define SYS_T 119 ------------------ | Branch (121:29): [True: 182k, False: 1.53k] ------------------ 122| 182k| v.d[j][1] <<= 1; 123| 182k| v.d[j][1] |= v.d[j][0] >> 63; 124| 182k| v.d[j][0] <<= 1; 125| 182k| v.d[j][0] |= (f[i] >> j) & 1; 126| 182k| } 127| 1.53k| } 128| | 129| 1.65k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.65k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 1.53k, False: 118] ------------------ 130| 1.53k| buf.v[i][1] = v.v[i]; 131| 1.53k| } 132| | 133| 14.0k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 14.0k|#define SYS_T 119 ------------------ | Branch (133:17): [True: 13.9k, False: 118] ------------------ 134| 13.9k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 13.9k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 13.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 13.9k| if (k < SYS_T) { ------------------ | | 8| 13.9k|#define SYS_T 119 ------------------ | Branch (136:13): [True: 13.8k, False: 118] ------------------ 137| 193k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 193k|#define GFBITS 13 ------------------ | Branch (137:25): [True: 179k, False: 13.8k] ------------------ 138| 179k| buf.v[i][k] = v.v[i]; 139| 179k| } 140| 13.8k| } else { 141| 14.1k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 14.1k|#define SYS_T 119 ------------------ | Branch (141:25): [True: 14.0k, False: 118] ------------------ 142| 14.0k| out[i] = extract_gf(v.d, i); 143| 14.0k| } 144| 118| } 145| 13.9k| } 146| | 147| 1.65k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.65k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 1.53k, False: 118] ------------------ 148| 1.53k| transpose_128x128(buf.d[i]); 149| 1.53k| } 150| | 151| 14.1k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 14.1k|#define SYS_T 119 ------------------ | Branch (151:17): [True: 14.0k, False: 118] ------------------ 152| 196k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 196k|#define GFBITS 13 ------------------ | Branch (152:21): [True: 182k, False: 14.0k] ------------------ 153| 182k| mat.v[j][i] = buf.v[i][j]; 154| 182k| } 155| 14.0k| } 156| | 157| | // gaussian 158| | 159| 14.1k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 14.1k|#define SYS_T 119 ------------------ | Branch (159:17): [True: 14.0k, False: 118] ------------------ 160| 842k| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 842k|#define SYS_T 119 ------------------ | Branch (160:25): [True: 828k, False: 14.0k] ------------------ 161| 828k| m = extract_bit(mat.d[i], i); 162| 828k| m -= 1; 163| 828k| mask = vec128_set2x(m, m); 164| | 165| 11.5M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 11.5M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 10.7M, False: 828k] ------------------ 166| 10.7M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 10.7M| } 168| | 169| 828k| out[i] ^= out[j] & m; 170| 828k| } 171| | 172| | // 173| | 174| 14.0k| t = extract_gf(mat.d[i], i); 175| | 176| 14.0k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 14.0k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 14.0k| inv = gf_inv(t); ------------------ | | 11| 14.0k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 14.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 183| 14.0k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 14.0k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 14.0k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 14.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 1.68M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 1.68M|#define SYS_T 119 ------------------ | Branch (187:21): [True: 1.67M, False: 14.0k] ------------------ 188| 1.67M| if (j != i) { ------------------ | Branch (188:17): [True: 1.65M, False: 14.0k] ------------------ 189| 1.65M| t = extract_gf(mat.d[j], i); 190| | 191| 1.65M| vec128_mul_gf(v.v, mat.v[i], t); 192| 1.65M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 1.65M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 1.65M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 1.65M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 195| 1.65M| } 196| 1.67M| } 197| 14.0k| } 198| | 199| 118| return 0; 200| 118|} PQCLEAN_MCELIECE6960119F_AVX2_vec128_mul_GF: 6| 13.9k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 13.9k| int i, j; 8| 13.9k| uint64_t buf[GFBITS][4]; 9| 13.9k| vec128 prod[GFBITS]; 10| 13.9k| uint64_t p[GFBITS]; 11| | 12| 13.9k| const uint64_t allone = -1; 13| | 14| | // polynomial multiplication 15| | 16| 194k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 194k|#define GFBITS 13 ------------------ | Branch (16:17): [True: 181k, False: 13.9k] ------------------ 17| 181k| buf[i][0] = 0; 18| 181k| buf[i][1] = 0; 19| 181k| buf[i][2] = 0; 20| 181k| buf[i][3] = 0; 21| 181k| } 22| | 23| 1.67M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 13.9k|#define SYS_T 119 ------------------ | Branch (23:25): [True: 1.65M, False: 13.9k] ------------------ 24| 23.1M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 23.1M|#define GFBITS 13 ------------------ | Branch (24:21): [True: 21.5M, False: 1.65M] ------------------ 25| 21.5M| buf[j][3] <<= 1; 26| 21.5M| buf[j][3] |= buf[j][2] >> 63; 27| 21.5M| buf[j][2] <<= 1; 28| 21.5M| buf[j][2] |= buf[j][1] >> 63; 29| 21.5M| buf[j][1] <<= 1; 30| 21.5M| buf[j][1] |= buf[j][0] >> 63; 31| 21.5M| buf[j][0] <<= 1; 32| 21.5M| } 33| | 34| 1.65M| vec128_mul_gf(prod, v, a[i]); 35| | 36| 23.1M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 23.1M|#define GFBITS 13 ------------------ | Branch (36:21): [True: 21.5M, False: 1.65M] ------------------ 37| 21.5M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 21.5M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 38| 21.5M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 21.5M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 39| 21.5M| } 40| 1.65M| } 41| | 42| | // reduction modulo y^119 + y^8 + 1 43| | 44| 194k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 194k|#define GFBITS 13 ------------------ | Branch (44:17): [True: 181k, False: 13.9k] ------------------ 45| 181k| p[i] = buf[i][3]; 46| | 47| 181k| buf[i][2] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 181k|#define SYS_T 119 ------------------ 48| 181k| buf[i][1] ^= p[i] << (64 - (SYS_T - 8 - 64)); ------------------ | | 8| 181k|#define SYS_T 119 ------------------ 49| 181k| buf[i][2] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 181k|#define SYS_T 119 ------------------ 50| 181k| buf[i][1] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 181k|#define SYS_T 119 ------------------ 51| 181k| } 52| | 53| | // 54| | 55| 194k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 194k|#define GFBITS 13 ------------------ | Branch (55:17): [True: 181k, False: 13.9k] ------------------ 56| 181k| p[i] = buf[i][2]; 57| | 58| 181k| buf[i][1] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 181k|#define SYS_T 119 ------------------ 59| 181k| buf[i][0] ^= p[i] << (64 - (SYS_T - 8 - 64)); ------------------ | | 8| 181k|#define SYS_T 119 ------------------ 60| 181k| buf[i][1] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 181k|#define SYS_T 119 ------------------ 61| 181k| buf[i][0] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 181k|#define SYS_T 119 ------------------ 62| 181k| } 63| | 64| | // 65| | 66| 194k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 194k|#define GFBITS 13 ------------------ | Branch (66:17): [True: 181k, False: 13.9k] ------------------ 67| 181k| p[i] = buf[i][1] & (allone << (SYS_T - 64)); ------------------ | | 8| 181k|#define SYS_T 119 ------------------ 68| | 69| 181k| buf[i][0] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 181k|#define SYS_T 119 ------------------ 70| 181k| buf[i][0] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 181k|#define SYS_T 119 ------------------ 71| 181k| } 72| | 73| | // 74| | 75| 194k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 194k|#define GFBITS 13 ------------------ | Branch (75:17): [True: 181k, False: 13.9k] ------------------ 76| 181k| out[i] = vec128_set2x(buf[i][0], buf[i][1] & (allone >> (128 - SYS_T))); ------------------ | | 8| 181k|#define SYS_T 119 ------------------ 77| 181k| } 78| 13.9k|} PQCLEAN_MCELIECE6960119F_AVX2_vec256_sq: 9| 5.37k|void vec256_sq(vec256 *out, vec256 *in) { 10| 5.37k| int i; 11| 5.37k| vec256 result[GFBITS], t; 12| | 13| 5.37k| t = vec256_xor(in[11], in[12]); 14| | 15| 5.37k| result[0] = vec256_xor(in[0], in[11]); 16| 5.37k| result[1] = vec256_xor(in[7], t); 17| 5.37k| result[2] = vec256_xor(in[1], in[7]); 18| 5.37k| result[3] = vec256_xor(in[8], t); 19| 5.37k| result[4] = vec256_xor(in[2], in[7]); 20| 5.37k| result[4] = vec256_xor(result[4], in[8]); 21| 5.37k| result[4] = vec256_xor(result[4], t); 22| 5.37k| result[5] = vec256_xor(in[7], in[9]); 23| 5.37k| result[6] = vec256_xor(in[3], in[8]); 24| 5.37k| result[6] = vec256_xor(result[6], in[9]); 25| 5.37k| result[6] = vec256_xor(result[6], in[12]); 26| 5.37k| result[7] = vec256_xor(in[8], in[10]); 27| 5.37k| result[8] = vec256_xor(in[4], in[9]); 28| 5.37k| result[8] = vec256_xor(result[8], in[10]); 29| 5.37k| result[9] = vec256_xor(in[9], in[11]); 30| 5.37k| result[10] = vec256_xor(in[5], in[10]); 31| 5.37k| result[10] = vec256_xor(result[10], in[11]); 32| 5.37k| result[11] = vec256_xor(in[10], in[12]); 33| 5.37k| result[12] = vec256_xor(in[6], t); 34| | 35| 75.2k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 75.2k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 69.8k, False: 5.37k] ------------------ 36| 69.8k| out[i] = result[i]; 37| 69.8k| } 38| 5.37k|} PQCLEAN_MCELIECE6960119F_AVX2_vec256_inv: 41| 208|void vec256_inv(vec256 *out, vec256 *in) { 42| 208| vec256 tmp_11[ GFBITS ]; 43| 208| vec256 tmp_1111[ GFBITS ]; 44| | 45| 208| vec256_copy(out, in); 46| | 47| 208| vec256_sq(out, out); ------------------ | | 14| 208|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 208|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 48| 208| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 208| vec256_sq(out, tmp_11); ------------------ | | 14| 208|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 208|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 51| 208| vec256_sq(out, out); ------------------ | | 14| 208|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 208|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 52| 208| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 208| vec256_sq(out, tmp_1111); ------------------ | | 14| 208|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 208|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 55| 208| vec256_sq(out, out); ------------------ | | 14| 208|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 208|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 56| 208| vec256_sq(out, out); ------------------ | | 14| 208|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 208|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 57| 208| vec256_sq(out, out); ------------------ | | 14| 208|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 208|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 58| 208| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 208| vec256_sq(out, out); ------------------ | | 14| 208|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 208|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 61| 208| vec256_sq(out, out); ------------------ | | 14| 208|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 208|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 62| 208| vec256_sq(out, out); ------------------ | | 14| 208|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 208|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 63| 208| vec256_sq(out, out); ------------------ | | 14| 208|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 208|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 64| 208| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 208| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 208|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 208|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 67| 208|} PQCLEAN_MCELIECE8192128_AVX2_load_bits: 188| 85|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 85| int i, j; 190| 85| const unsigned char *ptr = bits; 191| | 192| 85| vec128 buf[64]; 193| | 194| 340| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 255, False: 85] ------------------ 195| 16.5k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 16.3k, False: 255] ------------------ 196| 16.3k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 16.3k| ptr += 8; 198| 16.3k| } 199| | 200| 255| transpose_64x128_sp( buf ); 201| | 202| 8.41k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 8.16k, False: 255] ------------------ 203| 8.16k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 8.16k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 8.16k| } 206| | 207| 255| ptr += 512; 208| 255| } 209| | 210| 1.19k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.10k, False: 85] ------------------ 211| 36.4k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 35.3k, False: 1.10k] ------------------ 212| 35.3k| bits_int[i][j] = load16(ptr); 213| 35.3k| ptr += 16; 214| 35.3k| } 215| 1.10k| } 216| | 217| 340| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 255, False: 85] ------------------ 218| 16.5k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 16.3k, False: 255] ------------------ 219| 16.3k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 16.3k| ptr += 8; 221| 16.3k| } 222| | 223| 255| transpose_64x128_sp( buf ); 224| | 225| 8.41k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 8.16k, False: 255] ------------------ 226| 8.16k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 8.16k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 8.16k| } 229| | 230| 255| ptr += 512; 231| 255| } 232| 85|} PQCLEAN_MCELIECE8192128_AVX2_benes: 238| 170|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 170| int inc; 240| | 241| 170| vec128 *b_ptr; 242| | 243| 170| if (rev == 0) { ------------------ | Branch (243:9): [True: 85, False: 85] ------------------ 244| 85| inc = 32; 245| 85| b_ptr = b[ 0]; 246| 85| } else { 247| 85| inc = -32; 248| 85| b_ptr = b[24]; 249| 85| } 250| | 251| | // 252| | 253| 170| transpose_64x128_sp( r ); 254| | 255| 170| layer_0(r, b_ptr); 256| 170| b_ptr += inc; 257| 170| layer_1(r, b_ptr); 258| 170| b_ptr += inc; 259| 170| layer_2(r, b_ptr); 260| 170| b_ptr += inc; 261| 170| layer_3(r, b_ptr); 262| 170| b_ptr += inc; 263| 170| layer_4(r, b_ptr); 264| 170| b_ptr += inc; 265| 170| layer_5(r, b_ptr); 266| 170| b_ptr += inc; 267| | 268| 170| transpose_64x128_sp( r ); 269| | 270| 170| layer_x(r, b_ptr); 271| 170| b_ptr += inc; 272| 170| layer_0(r, b_ptr); 273| 170| b_ptr += inc; 274| 170| layer_1(r, b_ptr); 275| 170| b_ptr += inc; 276| 170| layer_2(r, b_ptr); 277| 170| b_ptr += inc; 278| 170| layer_3(r, b_ptr); 279| 170| b_ptr += inc; 280| 170| layer_4(r, b_ptr); 281| 170| b_ptr += inc; 282| 170| layer_5(r, b_ptr); 283| 170| b_ptr += inc; 284| 170| layer_4(r, b_ptr); 285| 170| b_ptr += inc; 286| 170| layer_3(r, b_ptr); 287| 170| b_ptr += inc; 288| 170| layer_2(r, b_ptr); 289| 170| b_ptr += inc; 290| 170| layer_1(r, b_ptr); 291| 170| b_ptr += inc; 292| 170| layer_0(r, b_ptr); 293| 170| b_ptr += inc; 294| 170| layer_x(r, b_ptr); 295| 170| b_ptr += inc; 296| | 297| 170| transpose_64x128_sp( r ); 298| | 299| 170| layer_5(r, b_ptr); 300| 170| b_ptr += inc; 301| 170| layer_4(r, b_ptr); 302| 170| b_ptr += inc; 303| 170| layer_3(r, b_ptr); 304| 170| b_ptr += inc; 305| 170| layer_2(r, b_ptr); 306| 170| b_ptr += inc; 307| 170| layer_1(r, b_ptr); 308| 170| b_ptr += inc; 309| 170| layer_0(r, b_ptr); 310| | 311| 170| transpose_64x128_sp( r ); 312| 170|} PQCLEAN_MCELIECE8192128_AVX2_bm: 147| 85|void bm(vec128 *out, vec256 *in) { 148| 85| int i; 149| 85| uint16_t N, L; 150| 85| uint16_t mask; 151| 85| uint64_t one = 1, t; 152| | 153| 85| vec128 prod[ GFBITS ]; 154| 85| vec128 interval[GFBITS]; 155| | 156| 85| typedef union { 157| 85| vec128 v[GFBITS][2]; 158| 85| vec256 V[GFBITS]; 159| 85| } db_t; 160| | 161| 85| db_t db; 162| 85| db_t BC_tmp; 163| 85| db_t BC; 164| | 165| 85| gf d, b, c0 = 1; 166| 85| gf coefs[256]; 167| | 168| | // initialization 169| | 170| 85| get_coefs(coefs, in); 171| | 172| 85| BC.v[0][0] = vec128_set2x(0, one << 63); 173| 85| BC.v[0][1] = vec128_setzero(); 174| | 175| 1.10k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.10k|#define GFBITS 13 ------------------ | Branch (175:17): [True: 1.02k, False: 85] ------------------ 176| 1.02k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 177| 1.02k| } 178| | 179| 85| b = 1; 180| 85| L = 0; 181| | 182| | // 183| | 184| 1.19k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.19k|#define GFBITS 13 ------------------ | Branch (184:17): [True: 1.10k, False: 85] ------------------ 185| 1.10k| interval[i] = vec128_setzero(); 186| 1.10k| } 187| | 188| 21.8k| for (N = 0; N < 256; N++) { ------------------ | Branch (188:17): [True: 21.7k, False: 85] ------------------ 189| 21.7k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 21.7k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 21.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 190| 21.7k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 21.7k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 21.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 191| | 192| 21.7k| d = vec_reduce_asm(prod); ------------------ | | 3| 21.7k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 21.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 21.7k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 21.7k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 21.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 195| 21.7k| d ^= t & 0xFFFFFFFF; 196| | 197| 21.7k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 198| | 199| 304k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 304k|#define GFBITS 13 ------------------ | Branch (199:21): [True: 282k, False: 21.7k] ------------------ 200| 282k| db.v[i][0] = vec128_setbits((d >> i) & 1); 201| 282k| db.v[i][1] = vec128_setbits((b >> i) & 1); 202| 282k| } 203| | 204| 21.7k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 205| | 206| 21.7k| vec128_cmov(BC.v, mask); 207| 21.7k| update_asm(BC.v, c0 & mask, 32); ------------------ | | 1| 21.7k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 21.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| 304k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 304k|#define GFBITS 13 ------------------ | Branch (209:21): [True: 282k, False: 21.7k] ------------------ 210| 282k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 211| 282k| } 212| | 213| 21.7k| c0 = t >> 32; 214| 21.7k| b = (d & mask) | (b & ~mask); 215| 21.7k| L = ((N + 1 - L) & mask) | (L & ~mask); 216| 21.7k| } 217| | 218| 85| c0 = gf_inv(c0); ------------------ | | 11| 85|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 1.19k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.19k|#define GFBITS 13 ------------------ | Branch (220:17): [True: 1.10k, False: 85] ------------------ 221| 1.10k| prod[i] = vec128_setbits((c0 >> i) & 1); 222| 1.10k| } 223| | 224| 85| vec128_mul_asm(out, prod, BC.v[0] + 1, 32); ------------------ | | 10| 85|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 225| 85|} PQCLEAN_MCELIECE8192128_AVX2_controlbitsfrompermutation: 205| 85|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 85| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 85|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 85| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 85|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 85| int16 diff; 209| 85| int i; 210| 85| unsigned char *ptr; 211| | 212| 85| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 85| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 85| while (1) { ------------------ | Branch (215:12): [True: 85, Folded] ------------------ 216| 85| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 85| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 696k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 696k, False: 85] ------------------ 222| 696k| pi_test[i] = (int16)i; 223| 696k| } 224| | 225| 85| ptr = out; 226| 1.19k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.10k, False: 85] ------------------ 227| 1.10k| layer(pi_test, ptr, i, (int32)n); 228| 1.10k| ptr += n >> 4; 229| 1.10k| } 230| | 231| 1.10k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.02k, False: 85] ------------------ 232| 1.02k| layer(pi_test, ptr, i, (int32)n); 233| 1.02k| ptr += n >> 4; 234| 1.02k| } 235| | 236| 85| diff = 0; 237| 696k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 696k, False: 85] ------------------ 238| 696k| diff |= pi[i] ^ pi_test[i]; 239| 696k| } 240| | 241| 85| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 85|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 242| 85| crypto_declassify(&diff, sizeof diff); 243| 85| if (diff == 0) { ------------------ | Branch (243:13): [True: 85, False: 0] ------------------ 244| 85| break; 245| 85| } 246| 85| } 247| 85|} PQCLEAN_MCELIECE8192128_AVX2_crypto_int16_negative_mask: 3| 170|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 170| return crypto_int16_x >> 15; 5| 170|} PQCLEAN_MCELIECE8192128_AVX2_crypto_int16_nonzero_mask: 7| 85|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 85| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 85|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 85|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 9| 85|} PQCLEAN_MCELIECE8192128_AVX2_crypto_int32_negative_mask: 3| 54.3M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 54.3M| return crypto_int32_x >> 31; 5| 54.3M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_int32_min: 37| 54.3M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 54.3M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 54.3M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 54.3M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 54.3M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 54.3M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 54.3M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 42| 54.3M| crypto_int32_z &= crypto_int32_xy; 43| 54.3M| return crypto_int32_x ^ crypto_int32_z; 44| 54.3M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint16_signed_negative_mask: 3| 192k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 192k| return crypto_uint16_signed_x >> 15; 5| 192k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint16_nonzero_mask: 7| 96.1k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 96.1k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 96.1k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 96.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 96.1k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 96.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 9| 96.1k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint16_zero_mask: 11| 96.1k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 96.1k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 96.1k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 96.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 13| 96.1k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint32_signed_negative_mask: 3| 102k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 102k| return crypto_uint32_signed_x >> 31; 5| 102k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint32_nonzero_mask: 7| 51.1k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 51.1k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 51.1k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 51.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 51.1k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 51.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 9| 51.1k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint32_unequal_mask: 15| 51.1k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 51.1k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 51.1k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 51.1k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 51.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 18| 51.1k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint32_equal_mask: 20| 51.1k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 51.1k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 51.1k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 51.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 22| 51.1k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint64_signed_negative_mask: 3| 14.4M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 14.4M| return crypto_uint64_signed_x >> 63; 5| 14.4M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint64_nonzero_mask: 7| 7.20M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 7.20M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 7.20M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 7.20M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 7.20M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 7.20M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 9| 7.20M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint64_zero_mask: 11| 1.18M|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 1.18M| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 1.18M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 1.18M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 13| 1.18M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint64_unequal_mask: 15| 6.01M|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 6.01M| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 6.01M| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 6.01M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 6.01M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 18| 6.01M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint64_equal_mask: 20| 6.01M|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 6.01M| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 6.01M|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 6.01M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 22| 6.01M|} PQCLEAN_MCELIECE8192128_AVX2_decrypt: 141| 85|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 142| 85| int i; 143| | 144| 85| uint16_t check_synd; 145| 85| uint16_t check_weight; 146| | 147| 85| vec256 inv[ 64 ][ GFBITS ]; 148| 85| vec256 scaled[ 64 ][ GFBITS ]; 149| 85| vec256 eval[ 64 ][ GFBITS ]; 150| | 151| 85| vec128 error128[ 64 ]; 152| 85| vec256 error256[ 32 ]; 153| | 154| 85| vec256 s_priv[ GFBITS ]; 155| 85| vec256 s_priv_cmp[ GFBITS ]; 156| 85| vec128 locator[ GFBITS ]; 157| | 158| 85| vec128 recv128[ 64 ]; 159| 85| vec256 recv256[ 32 ]; 160| 85| vec256 allone; 161| | 162| 85| vec128 bits_int[25][32]; 163| | 164| | // Berlekamp decoder 165| | 166| 85| preprocess(recv128, s); 167| | 168| 85| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 85|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 85|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 85|#define SYS_T 128 | | ------------------ ------------------ 169| 85| benes(recv128, bits_int, 1); ------------------ | | 9| 85|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 170| 85| reformat_128to256(recv256, recv128); 171| | 172| 85| scaling(scaled, inv, sk, recv256); // scaling 173| 85| fft_tr(s_priv, scaled); // transposed FFT ------------------ | | 9| 85|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 174| 85| bm(locator, s_priv); // Berlekamp Massey ------------------ | | 10| 85|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 175| | 176| 85| fft(eval, locator); // FFT ------------------ | | 10| 85|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 177| | 178| | // reencryption and weight check 179| | 180| 85| allone = vec256_set1_16b(0xFFFF); 181| | 182| 2.80k| for (i = 0; i < 32; i++) { ------------------ | Branch (182:17): [True: 2.72k, False: 85] ------------------ 183| 2.72k| error256[i] = vec256_or_reduce(eval[i]); 184| 2.72k| error256[i] = vec256_xor(error256[i], allone); 185| 2.72k| } 186| | 187| 85| check_weight = weight(error256) ^ SYS_T; ------------------ | | 8| 85|#define SYS_T 128 ------------------ 188| 85| check_weight -= 1; 189| 85| check_weight >>= 15; 190| | 191| 85| scaling_inv(scaled, inv, error256); 192| 85| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 85|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 85| check_synd = synd_cmp(s_priv, s_priv_cmp); 195| | 196| | // 197| | 198| 85| reformat_256to128(error128, error256); 199| 85| benes(error128, bits_int, 0); ------------------ | | 9| 85|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 5.52k| for (i = 0; i < 64; i++) { ------------------ | Branch (201:17): [True: 5.44k, False: 85] ------------------ 202| 5.44k| store16(e + i * 16, error128[i]); 203| 5.44k| } 204| | 205| 85| return 1 - (check_synd & check_weight); 206| 85|} decrypt.c:weight: 81| 151|static int weight(vec256 *v) { 82| 151| int i, w = 0; 83| | 84| 4.98k| for (i = 0; i < 32; i++) { ------------------ | Branch (84:17): [True: 4.83k, False: 151] ------------------ 85| 4.83k| w += __builtin_popcountll( vec256_extract(v[i], 0) ); ------------------ | | 39| 4.83k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 86| 4.83k| w += __builtin_popcountll( vec256_extract(v[i], 1) ); ------------------ | | 39| 4.83k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 87| 4.83k| w += __builtin_popcountll( vec256_extract(v[i], 2) ); ------------------ | | 39| 4.83k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 88| 4.83k| w += __builtin_popcountll( vec256_extract(v[i], 3) ); ------------------ | | 39| 4.83k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 89| 4.83k| } 90| | 91| 151| return w; 92| 151|} PQCLEAN_MCELIECE8192128_AVX2_encrypt: 87| 85|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 88| 85| gen_e(e); 89| | 90| 85| syndrome_asm(s, pk, e); ------------------ | | 1| 85|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 91| 85|} PQCLEAN_MCELIECE8192128_AVX2_fft: 277| 921|void fft(vec256 out[][GFBITS], vec128 *in) { 278| 921| radix_conversions(in); 279| 921| butterflies(out, in); 280| 921|} PQCLEAN_MCELIECE8192128_AVX2_fft_tr: 380| 170|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 381| 170| butterflies_tr(out, in); 382| 170| radix_conversions_tr(out); 383| 170|} PQCLEAN_MCELIECE8192128_AVX2_gf_mul: 12| 12.3M|gf gf_mul(gf in0, gf in1) { 13| 12.3M| int i; 14| | 15| 12.3M| uint64_t tmp; 16| 12.3M| uint64_t t0; 17| 12.3M| uint64_t t1; 18| 12.3M| uint64_t t; 19| | 20| 12.3M| t0 = in0; 21| 12.3M| t1 = in1; 22| | 23| 12.3M| tmp = t0 * (t1 & 1); 24| | 25| 159M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 159M|#define GFBITS 13 ------------------ | Branch (25:17): [True: 147M, False: 12.3M] ------------------ 26| 147M| tmp ^= (t0 * (t1 & (1 << i))); 27| 147M| } 28| | 29| | // 30| | 31| 12.3M| t = tmp & 0x1FF0000; 32| 12.3M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 33| | 34| 12.3M| t = tmp & 0x000E000; 35| 12.3M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 36| | 37| 12.3M| return tmp & GFMASK; ------------------ | | 19| 12.3M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 12.3M|#define GFBITS 13 | | ------------------ ------------------ 38| 12.3M|} PQCLEAN_MCELIECE8192128_AVX2_gf_frac: 148| 96.2k|gf gf_frac(gf den, gf num) { 149| 96.2k| gf tmp_11; 150| 96.2k| gf tmp_1111; 151| 96.2k| gf out; 152| | 153| 96.2k| tmp_11 = gf_sqmul(den, den); // 11 154| 96.2k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // 1111 155| 96.2k| out = gf_sq2(tmp_1111); 156| 96.2k| out = gf_sq2mul(out, tmp_1111); // 11111111 157| 96.2k| out = gf_sq2(out); 158| 96.2k| out = gf_sq2mul(out, tmp_1111); // 111111111111 159| | 160| 96.2k| return gf_sqmul(out, num); // 1111111111110 161| 96.2k|} PQCLEAN_MCELIECE8192128_AVX2_gf_inv: 164| 96.2k|gf gf_inv(gf den) { 165| 96.2k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 96.2k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 96.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 166| 96.2k|} bm.c:PQCLEAN_MCELIECE8192128_AVX2_gf_mul2: 31| 21.7k|static inline uint64_t gf_mul2(gf a, gf b0, gf b1) { 32| 21.7k| int i; 33| | 34| 21.7k| uint64_t tmp = 0; 35| 21.7k| uint64_t t0; 36| 21.7k| uint64_t t1; 37| 21.7k| uint64_t t; 38| 21.7k| uint64_t mask = 0x0000000100000001; 39| | 40| 21.7k| t0 = a; 41| 21.7k| t1 = b1; 42| 21.7k| t1 = (t1 << 32) | b0; 43| | 44| 304k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 304k|#define GFBITS 13 ------------------ | Branch (44:17): [True: 282k, False: 21.7k] ------------------ 45| 282k| tmp ^= t0 * (t1 & mask); 46| 282k| mask += mask; 47| 282k| } 48| | 49| | // 50| | 51| 21.7k| t = tmp & 0x01FF000001FF0000; 52| 21.7k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 53| | 54| 21.7k| t = tmp & 0x0000E0000000E000; 55| 21.7k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 56| | 57| 21.7k| return tmp & 0x00001FFF00001FFF; 58| 21.7k|} pk_gen.c:PQCLEAN_MCELIECE8192128_AVX2_int32_sort: 21| 85|static void int32_sort(int32_t *x, long long n) { 22| 85| long long top, p, q, r, i; 23| | 24| 85| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 85] ------------------ 25| 0| return; 26| 0| } 27| 85| top = 1; 28| 935| while (top < n - top) { ------------------ | Branch (28:12): [True: 850, False: 85] ------------------ 29| 850| top += top; 30| 850| } 31| | 32| 1.02k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 935, False: 85] ------------------ 33| 1.38M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.38M, False: 935] ------------------ 34| 1.38M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 734k, False: 647k] ------------------ 35| 734k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 734k| do { \ | | 12| 734k| int32_t ab = (b) ^ (a); \ | | 13| 734k| int32_t c = (b) - (a); \ | | 14| 734k| c ^= ab & ((c) ^ (b)); \ | | 15| 734k| c >>= 31; \ | | 16| 734k| c &= ab; \ | | 17| 734k| (a) ^= c; \ | | 18| 734k| (b) ^= c; \ | | 19| 734k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 734k] | | ------------------ ------------------ 36| 734k| } 37| 1.38M| } 38| 935| i = 0; 39| 5.61k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 4.67k, False: 935] ------------------ 40| 1.24M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.24M, False: 4.67k] ------------------ 41| 1.24M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 647k, False: 593k] ------------------ 42| 647k| int32_t a = x[i + p]; 43| 3.79M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.14M, False: 647k] ------------------ 44| 3.14M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.14M| do { \ | | 12| 3.14M| int32_t ab = (b) ^ (a); \ | | 13| 3.14M| int32_t c = (b) - (a); \ | | 14| 3.14M| c ^= ab & ((c) ^ (b)); \ | | 15| 3.14M| c >>= 31; \ | | 16| 3.14M| c &= ab; \ | | 17| 3.14M| (a) ^= c; \ | | 18| 3.14M| (b) ^= c; \ | | 19| 3.14M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.14M] | | ------------------ ------------------ 45| 3.14M| } 46| 647k| x[i + p] = a; 47| 647k| } 48| 1.24M| } 49| 4.67k| } 50| 935| } 51| 85|} controlbits.c:PQCLEAN_MCELIECE8192128_AVX2_int32_sort: 21| 2.78M|static void int32_sort(int32_t *x, long long n) { 22| 2.78M| long long top, p, q, r, i; 23| | 24| 2.78M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 2.78M] ------------------ 25| 0| return; 26| 0| } 27| 2.78M| top = 1; 28| 9.76M| while (top < n - top) { ------------------ | Branch (28:12): [True: 6.97M, False: 2.78M] ------------------ 29| 6.97M| top += top; 30| 6.97M| } 31| | 32| 12.5M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 9.76M, False: 2.78M] ------------------ 33| 1.34G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.33G, False: 9.76M] ------------------ 34| 1.33G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 745M, False: 587M] ------------------ 35| 745M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 745M| do { \ | | 12| 745M| int32_t ab = (b) ^ (a); \ | | 13| 745M| int32_t c = (b) - (a); \ | | 14| 745M| c ^= ab & ((c) ^ (b)); \ | | 15| 745M| c >>= 31; \ | | 16| 745M| c &= ab; \ | | 17| 745M| (a) ^= c; \ | | 18| 745M| (b) ^= c; \ | | 19| 745M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 745M] | | ------------------ ------------------ 36| 745M| } 37| 1.33G| } 38| 9.76M| i = 0; 39| 26.5M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 16.7M, False: 9.76M] ------------------ 40| 1.19G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.17G, False: 16.7M] ------------------ 41| 1.17G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 587M, False: 587M] ------------------ 42| 587M| int32_t a = x[i + p]; 43| 3.48G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.89G, False: 587M] ------------------ 44| 2.89G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.89G| do { \ | | 12| 2.89G| int32_t ab = (b) ^ (a); \ | | 13| 2.89G| int32_t c = (b) - (a); \ | | 14| 2.89G| c ^= ab & ((c) ^ (b)); \ | | 15| 2.89G| c >>= 31; \ | | 16| 2.89G| c &= ab; \ | | 17| 2.89G| (a) ^= c; \ | | 18| 2.89G| (b) ^= c; \ | | 19| 2.89G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.89G] | | ------------------ ------------------ 45| 2.89G| } 46| 587M| x[i + p] = a; 47| 587M| } 48| 1.17G| } 49| 16.7M| } 50| 9.76M| } 51| 2.78M|} encrypt.c:PQCLEAN_MCELIECE8192128_AVX2_int32_sort: 21| 403|static void int32_sort(int32_t *x, long long n) { 22| 403| long long top, p, q, r, i; 23| | 24| 403| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 403] ------------------ 25| 0| return; 26| 0| } 27| 403| top = 1; 28| 2.82k| while (top < n - top) { ------------------ | Branch (28:12): [True: 2.41k, False: 403] ------------------ 29| 2.41k| top += top; 30| 2.41k| } 31| | 32| 3.22k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 2.82k, False: 403] ------------------ 33| 312k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 309k, False: 2.82k] ------------------ 34| 309k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 180k, False: 129k] ------------------ 35| 180k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 180k| do { \ | | 12| 180k| int32_t ab = (b) ^ (a); \ | | 13| 180k| int32_t c = (b) - (a); \ | | 14| 180k| c ^= ab & ((c) ^ (b)); \ | | 15| 180k| c >>= 31; \ | | 16| 180k| c &= ab; \ | | 17| 180k| (a) ^= c; \ | | 18| 180k| (b) ^= c; \ | | 19| 180k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 180k] | | ------------------ ------------------ 36| 180k| } 37| 309k| } 38| 2.82k| i = 0; 39| 11.2k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 8.46k, False: 2.82k] ------------------ 40| 267k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 258k, False: 8.46k] ------------------ 41| 258k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 129k, False: 129k] ------------------ 42| 129k| int32_t a = x[i + p]; 43| 541k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 412k, False: 129k] ------------------ 44| 412k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 412k| do { \ | | 12| 412k| int32_t ab = (b) ^ (a); \ | | 13| 412k| int32_t c = (b) - (a); \ | | 14| 412k| c ^= ab & ((c) ^ (b)); \ | | 15| 412k| c >>= 31; \ | | 16| 412k| c &= ab; \ | | 17| 412k| (a) ^= c; \ | | 18| 412k| (b) ^= c; \ | | 19| 412k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 412k] | | ------------------ ------------------ 45| 412k| } 46| 129k| x[i + p] = a; 47| 129k| } 48| 258k| } 49| 8.46k| } 50| 2.82k| } 51| 403|} PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_enc: 22| 85|) { 23| 85| unsigned char e[ SYS_N / 8 ]; 24| 85| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 85| encrypt(c, pk, e); ------------------ | | 9| 85|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 85| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 85|#define SYS_N 8192 ------------------ 31| 85| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 85|#define SYS_N 8192 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 85|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 85|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 85|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 85|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 85| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 85| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 85|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 85| return 0; 36| 85|} PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_dec: 42| 85|) { 43| 85| int i; 44| | 45| 85| unsigned char ret_decrypt = 0; 46| | 47| 85| uint16_t m; 48| | 49| 85| unsigned char e[ SYS_N / 8 ]; 50| 85| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 85| unsigned char *x = preimage; 52| 85| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 85|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 85|#define SYS_T 128 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 85|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 85|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 85|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 85| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 85|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 85| m = ret_decrypt; 59| 85| m -= 1; 60| 85| m >>= 8; 61| | 62| 85| *x++ = m & 1; 63| 87.1k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 87.1k|#define SYS_N 8192 ------------------ | Branch (63:17): [True: 87.0k, False: 85] ------------------ 64| 87.0k| *x++ = (~m & s[i]) | (m & e[i]); 65| 87.0k| } 66| | 67| 17.7k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 17.7k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 17.7k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 17.7k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 17.7k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 17.6k, False: 85] ------------------ 68| 17.6k| *x++ = c[i]; 69| 17.6k| } 70| | 71| 85| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 85| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 85|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 85| return 0; 74| 85|} PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_keypair: 80| 85|) { 81| 85| int i; 82| 85| unsigned char seed[ 33 ] = {64}; 83| 85| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 85| unsigned char *rp, *skp; 85| | 86| 85| gf f[ SYS_T ]; // element in GF(2^mt) 87| 85| gf irr[ SYS_T ]; // Goppa polynomial 88| 85| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 89| 85| int16_t pi[ 1 << GFBITS ]; // random permutation 90| | 91| 85| randombytes(seed + 1, 32); ------------------ | | 8| 85|#define randombytes OQS_randombytes ------------------ 92| | 93| 751| while (1) { ------------------ | Branch (93:12): [True: 751, Folded] ------------------ 94| 751| rp = &r[ sizeof(r) - 32 ]; 95| 751| skp = sk; 96| | 97| | // expanding and updating the seed 98| | 99| 751| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 751| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 751|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 100| 751| memcpy(skp, seed + 1, 32); 101| 751| skp += 32 + 8; 102| 751| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 103| | 104| | // generating irreducible polynomial 105| | 106| 751| rp -= sizeof(f); 107| | 108| 96.8k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 96.8k|#define SYS_T 128 ------------------ | Branch (108:21): [True: 96.1k, False: 751] ------------------ 109| 96.1k| f[i] = load_gf(rp + i * 2); 110| 96.1k| } 111| | 112| 751| if (genpoly_gen(irr, f)) { ------------------ | | 9| 751|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 751|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ | Branch (112:13): [True: 0, False: 751] ------------------ 113| 0| continue; 114| 0| } 115| | 116| 96.8k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 96.8k|#define SYS_T 128 ------------------ | Branch (116:21): [True: 96.1k, False: 751] ------------------ 117| 96.1k| store_gf(skp + i * 2, irr[i]); 118| 96.1k| } 119| | 120| 751| skp += IRR_BYTES; ------------------ | | 11| 751|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 751|#define SYS_T 128 | | ------------------ ------------------ 121| | 122| | // generating permutation 123| | 124| 751| rp -= sizeof(perm); 125| | 126| 6.15M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 6.15M|#define GFBITS 13 ------------------ | Branch (126:21): [True: 6.15M, False: 751] ------------------ 127| 6.15M| perm[i] = load4(rp + i * 4); 128| 6.15M| } 129| | 130| 751| if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 9| 751|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 751|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 11| 751|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 751|#define SYS_T 128 | | ------------------ ------------------ | Branch (130:13): [True: 666, False: 85] ------------------ 131| 666| continue; 132| 666| } 133| | 134| 85| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 85|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 85|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 85|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 85|#define GFBITS 13 ------------------ 135| 85| skp += COND_BYTES; ------------------ | | 10| 85|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 85|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 85|#define GFBITS 13 | | ------------------ ------------------ 136| | 137| | // storing the random string s 138| | 139| 85| rp -= SYS_N / 8; ------------------ | | 7| 85|#define SYS_N 8192 ------------------ 140| 85| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 85|#define SYS_N 8192 ------------------ 141| | 142| | // storing positions of the 32 pivots 143| | 144| 85| store8(sk + 32, 0xFFFFFFFF); 145| | 146| 85| break; 147| 751| } 148| | 149| 85| return 0; 150| 85|} PQCLEAN_MCELIECE8192128_AVX2_pk_gen: 199| 751|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi) { 200| 751|#define nBlocks_I ((PK_NROWS + 255) / 256) 201| | 202| 751| int i, j, k, b; 203| 751| int row, c; 204| | 205| 751| union { 206| 751| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 207| 751| vec256 v[ PK_NROWS ][ nBlocks_I ]; 208| 751| } mat; 209| | 210| 751| union { 211| 751| uint64_t w[ PK_NROWS ][ par_width * 4 ]; 212| 751| vec256 v[ PK_NROWS ][ par_width ]; 213| 751| } par; 214| | 215| 751| uint16_t m; 216| 751| vec256 mm; 217| | 218| 751| vec128 sk_int[ GFBITS ]; 219| | 220| 751| vec256 consts[ 32 ][ GFBITS ]; 221| 751| vec256 eval[ 32 ][ GFBITS ]; 222| 751| vec256 prod[ 32 ][ GFBITS ]; 223| 751| vec256 tmp[ GFBITS ]; 224| | 225| 751| uint64_t list[1 << GFBITS]; 226| 751| uint64_t one = 1; 227| 751| uint64_t t; 228| | 229| 751| uint16_t ind[ PK_NROWS ]; 230| 751| uint16_t ind_inv[ PK_NROWS ]; 231| | 232| | // compute the inverses 233| | 234| 751| irr_load(sk_int, irr); 235| | 236| 751| fft(eval, sk_int); ------------------ | | 10| 751|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 751|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 237| | 238| 751| vec256_copy(prod[0], eval[0]); 239| | 240| 24.0k| for (i = 1; i < 32; i++) { ------------------ | Branch (240:17): [True: 23.2k, False: 751] ------------------ 241| 23.2k| vec256_mul(prod[i], prod[i - 1], eval[i]); 242| 23.2k| } 243| | 244| 751| vec256_inv(tmp, prod[31]); ------------------ | | 11| 751|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 751|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 245| | 246| 24.0k| for (i = 30; i >= 0; i--) { ------------------ | Branch (246:18): [True: 23.2k, False: 751] ------------------ 247| 23.2k| vec256_mul(prod[i + 1], prod[i], tmp); 248| 23.2k| vec256_mul(tmp, tmp, eval[i + 1]); 249| 23.2k| } 250| | 251| 751| vec256_copy(prod[0], tmp); 252| | 253| | // fill matrix 254| | 255| 751| de_bitslicing(list, prod); 256| | 257| 6.15M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 6.15M|#define GFBITS 13 ------------------ | Branch (257:17): [True: 6.15M, False: 751] ------------------ 258| 6.15M| list[i] <<= GFBITS; ------------------ | | 6| 6.15M|#define GFBITS 13 ------------------ 259| 6.15M| list[i] |= i; 260| 6.15M| list[i] |= ((uint64_t) perm[i]) << 31; 261| 6.15M| } 262| | 263| 751| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 751|#define GFBITS 13 ------------------ 264| | 265| 6.02M| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 6.02M|#define GFBITS 13 ------------------ | Branch (265:17): [True: 6.01M, False: 714] ------------------ 266| 6.01M| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (266:13): [True: 37, False: 6.01M] ------------------ 267| 37| return -1; 268| 37| } 269| 6.01M| } 270| | 271| 714| to_bitslicing_2x(consts, prod, list); 272| | 273| 5.84M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 5.84M|#define GFBITS 13 ------------------ | Branch (273:17): [True: 5.84M, False: 714] ------------------ 274| 5.84M| pi[i] = list[i] & GFMASK; ------------------ | | 19| 5.84M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 5.84M|#define GFBITS 13 | | ------------------ ------------------ 275| 5.84M| } 276| | 277| 5.71k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 5.71k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 5.71k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 5.71k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 5.71k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (277:17): [True: 4.99k, False: 714] ------------------ 278| 69.9k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 69.9k|#define GFBITS 13 ------------------ | Branch (278:21): [True: 64.9k, False: 4.99k] ------------------ 279| 64.9k| mat.v[ k ][ j ] = prod[ j ][ k ]; 280| 64.9k| } 281| 4.99k| } 282| | 283| 91.3k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 91.3k|#define SYS_T 128 ------------------ | Branch (283:17): [True: 90.6k, False: 714] ------------------ 284| 725k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 725k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 725k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 725k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 725k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (284:21): [True: 634k, False: 90.6k] ------------------ 285| 634k| vec256_mul(prod[j], prod[j], consts[j]); 286| | 287| 8.88M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 8.88M|#define GFBITS 13 ------------------ | Branch (287:25): [True: 8.25M, False: 634k] ------------------ 288| 8.25M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 8.25M|#define GFBITS 13 ------------------ 289| 8.25M| } 290| 634k| } 291| 90.6k| } 292| | 293| | // gaussian elimination to obtain L, U, and P such that LP M = U 294| | // L and U are stored in the space of M 295| | // P is stored in ind 296| | 297| 1.18M| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 1.18M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.18M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.18M|#define GFBITS 13 | | ------------------ ------------------ | Branch (297:17): [True: 1.18M, False: 714] ------------------ 298| 1.18M| ind_inv[i] = ind[ i ] = i; 299| 1.18M| } 300| | 301| 1.18M| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 1.18M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.18M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.18M|#define GFBITS 13 | | ------------------ ------------------ | Branch (301:19): [True: 1.18M, False: 85] ------------------ 302| 1.18M| i = row >> 6; 303| 1.18M| j = row & 63; 304| | 305| 989M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 989M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 989M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 989M|#define GFBITS 13 | | ------------------ ------------------ | Branch (305:27): [True: 987M, False: 1.18M] ------------------ 306| 987M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 307| 987M| uint16_cswap(&ind[row], &ind[k], m); 308| | 309| 987M| mm = vec256_set1_16b(m); 310| 7.90G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 7.90G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 7.90G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 7.90G|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 7.90G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (310:25): [True: 6.91G, False: 987M] ------------------ 311| 6.91G| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 312| 6.91G| } 313| 987M| } 314| | 315| 1.18M| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (315:14): [True: 629, False: 1.18M] ------------------ 316| 629| return -1; 317| 629| } 318| | 319| 989M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 989M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 989M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 989M|#define GFBITS 13 | | ------------------ ------------------ | Branch (319:27): [True: 987M, False: 1.18M] ------------------ 320| 987M| t = mat.w[ k ][ i ] & (one << j); 321| 987M| mm = extract_mask256(mat.w[k], row); 322| | 323| 7.90G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 7.90G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 7.90G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 7.90G|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 7.90G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (323:25): [True: 6.91G, False: 987M] ------------------ 324| 6.91G| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 325| 6.91G| } 326| | 327| 987M| mat.w[ k ][ i ] |= t; 328| 987M| } 329| 1.18M| } 330| | 331| | // apply M^-1 to the remaining columns 332| | 333| 85| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 85|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 85|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 85|#define GFBITS 13 | | ------------------ ------------------ 334| | 335| 255| for (j = 6; j < 32; j += par_width) { ------------------ | | 30| 170|#define par_width 13 ------------------ | Branch (335:17): [True: 170, False: 85] ------------------ 336| 2.38k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 2.38k|#define GFBITS 13 ------------------ | Branch (336:21): [True: 2.21k, False: 170] ------------------ 337| 30.9k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 30.9k|#define par_width 13 ------------------ | Branch (337:25): [True: 28.7k, False: 2.21k] ------------------ 338| 28.7k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 339| 28.7k| } 340| 2.21k| } 341| | 342| 21.7k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 21.7k|#define SYS_T 128 ------------------ | Branch (342:21): [True: 21.5k, False: 170] ------------------ 343| 302k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 302k|#define par_width 13 ------------------ | Branch (343:25): [True: 280k, False: 21.5k] ------------------ 344| 280k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 345| 280k| } 346| | 347| 302k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 302k|#define GFBITS 13 ------------------ | Branch (347:25): [True: 280k, False: 21.5k] ------------------ 348| 3.92M| for (b = 0; b < par_width; b++) { ------------------ | | 30| 3.92M|#define par_width 13 ------------------ | Branch (348:29): [True: 3.64M, False: 280k] ------------------ 349| 3.64M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 3.64M|#define GFBITS 13 ------------------ 350| 3.64M| } 351| 280k| } 352| 21.5k| } 353| | 354| | // apply P 355| | 356| 283k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 283k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 283k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 283k|#define GFBITS 13 | | ------------------ ------------------ | Branch (356:21): [True: 282k, False: 170] ------------------ 357| 282k| ind[i] = ind_inv[i]; 358| 282k| } 359| | 360| 170| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 170|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 170|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 170|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 170|#define GFBITS 13 | | ------------------ ------------------ 361| | 362| | // apply L 363| | 364| 283k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 170|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 170|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 170|#define GFBITS 13 | | ------------------ ------------------ | Branch (364:34): [True: 282k, False: 170] ------------------ 365| 235M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (365:31): [True: 235M, False: 282k] ------------------ 366| 235M| mm = extract_mask256(mat.w[row], i); 367| | 368| 3.29G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.29G|#define par_width 13 ------------------ | Branch (368:29): [True: 3.05G, False: 235M] ------------------ 369| 3.05G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 370| 3.05G| } 371| 235M| } 372| 282k| } 373| | 374| | // apply U^-1 375| | 376| 170| if (j == 6) { ------------------ | Branch (376:13): [True: 85, False: 85] ------------------ 377| 141k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 141k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 141k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 141k|#define GFBITS 13 | | ------------------ ------------------ | Branch (377:25): [True: 141k, False: 85] ------------------ 378| 141k| par.v[i][0] = mat.v[i][nBlocks_I - 1]; ------------------ | | 200| 141k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 141k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 141k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 141k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 379| 141k| } 380| 85| } 381| | 382| 283k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 170|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 170|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 170|#define GFBITS 13 | | ------------------ ------------------ | Branch (382:34): [True: 282k, False: 170] ------------------ 383| 235M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 282k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 282k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 282k|#define GFBITS 13 | | ------------------ ------------------ | Branch (383:36): [True: 235M, False: 282k] ------------------ 384| 235M| mm = extract_mask256(mat.w[row], i); 385| | 386| 3.29G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.29G|#define par_width 13 ------------------ | Branch (386:29): [True: 3.05G, False: 235M] ------------------ 387| 3.05G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 388| 3.05G| } 389| 235M| } 390| 282k| } 391| | 392| 170| if (j == 6) { ------------------ | Branch (392:13): [True: 85, False: 85] ------------------ 393| 141k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 141k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 141k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 141k|#define GFBITS 13 | | ------------------ ------------------ | Branch (393:27): [True: 141k, False: 85] ------------------ 394| 7.21M| for (k = 2; k < par_width * 4; k++) { ------------------ | | 30| 7.21M|#define par_width 13 ------------------ | Branch (394:29): [True: 7.07M, False: 141k] ------------------ 395| 7.07M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 7.07M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 7.07M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 7.07M|#define SYS_N 8192 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 7.07M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 7.07M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 7.07M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 396| 7.07M| } 397| 141k| } 398| 85| } else { 399| 141k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 141k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 141k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 141k|#define GFBITS 13 | | ------------------ ------------------ | Branch (399:27): [True: 141k, False: 85] ------------------ 400| 7.49M| for (k = 0; k < par_width * 4; k++) { ------------------ | | 30| 7.49M|#define par_width 13 ------------------ | Branch (400:29): [True: 7.35M, False: 141k] ------------------ 401| 7.35M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 7.35M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 7.35M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 7.35M|#define SYS_N 8192 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 7.35M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 7.35M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 7.35M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 402| 7.35M| } 403| 141k| } 404| 85| } 405| 170| } 406| | 407| | // 408| | 409| 85| return 0; 410| 714|} PQCLEAN_MCELIECE8192128_AVX2_genpoly_gen: 88| 751|int genpoly_gen(gf *out, gf *f) { 89| 751| int i, j, k; 90| | 91| 751| gf t, inv; 92| | 93| 751| uint64_t m; 94| 751| vec128 mask; 95| | 96| 751| union { 97| 751| uint64_t d[ GFBITS ][ 128 ][2]; 98| 751| vec128 v[ GFBITS ][ 128 ]; 99| 751| } buf; 100| | 101| 751| union { 102| 751| uint64_t d[GFBITS][2]; 103| 751| vec128 v[GFBITS]; 104| 751| } v; 105| | 106| 751| union { 107| 751| uint64_t d[SYS_T][GFBITS][2]; 108| 751| vec128 v[SYS_T][GFBITS]; 109| 751| } mat; 110| | 111| | // fill matrix 112| | 113| 751| buf.v[0][0] = vec128_set2x(1, 0); 114| 9.76k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 9.76k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 9.01k, False: 751] ------------------ 115| 9.01k| buf.v[i][0] = vec128_setzero(); 116| 9.01k| } 117| | 118| 10.5k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 10.5k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 9.76k, False: 751] ------------------ 119| 9.76k| v.v[j] = vec128_setzero(); 120| | 121| 1.25M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 9.76k|#define SYS_T 128 ------------------ | Branch (121:29): [True: 1.24M, False: 9.76k] ------------------ 122| 1.24M| v.d[j][1] <<= 1; 123| 1.24M| v.d[j][1] |= v.d[j][0] >> 63; 124| 1.24M| v.d[j][0] <<= 1; 125| 1.24M| v.d[j][0] |= (f[i] >> j) & 1; 126| 1.24M| } 127| 9.76k| } 128| | 129| 10.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 10.5k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 9.76k, False: 751] ------------------ 130| 9.76k| buf.v[i][1] = v.v[i]; 131| 9.76k| } 132| | 133| 96.1k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 96.1k|#define SYS_T 128 ------------------ | Branch (133:17): [True: 95.3k, False: 751] ------------------ 134| 95.3k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 95.3k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 95.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 95.3k| if (k < SYS_T) { ------------------ | | 8| 95.3k|#define SYS_T 128 ------------------ | Branch (136:13): [True: 94.6k, False: 751] ------------------ 137| 1.32M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.32M|#define GFBITS 13 ------------------ | Branch (137:25): [True: 1.23M, False: 94.6k] ------------------ 138| 1.23M| buf.v[i][k] = v.v[i]; 139| 1.23M| } 140| 94.6k| } else { 141| 96.8k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 96.8k|#define SYS_T 128 ------------------ | Branch (141:25): [True: 96.1k, False: 751] ------------------ 142| 96.1k| out[i] = extract_gf(v.d, i); 143| 96.1k| } 144| 751| } 145| 95.3k| } 146| | 147| 10.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 10.5k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 9.76k, False: 751] ------------------ 148| 9.76k| transpose_128x128(buf.d[i]); 149| 9.76k| } 150| | 151| 96.8k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 96.8k|#define SYS_T 128 ------------------ | Branch (151:17): [True: 96.1k, False: 751] ------------------ 152| 1.34M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.34M|#define GFBITS 13 ------------------ | Branch (152:21): [True: 1.24M, False: 96.1k] ------------------ 153| 1.24M| mat.v[j][i] = buf.v[i][j]; 154| 1.24M| } 155| 96.1k| } 156| | 157| | // gaussian 158| | 159| 96.8k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 96.8k|#define SYS_T 128 ------------------ | Branch (159:17): [True: 96.1k, False: 751] ------------------ 160| 6.20M| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 6.20M|#define SYS_T 128 ------------------ | Branch (160:25): [True: 6.10M, False: 96.1k] ------------------ 161| 6.10M| m = extract_bit(mat.d[i], i); 162| 6.10M| m -= 1; 163| 6.10M| mask = vec128_set2x(m, m); 164| | 165| 85.4M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 85.4M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 79.3M, False: 6.10M] ------------------ 166| 79.3M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 79.3M| } 168| | 169| 6.10M| out[i] ^= out[j] & m; 170| 6.10M| } 171| | 172| | // 173| | 174| 96.1k| t = extract_gf(mat.d[i], i); 175| | 176| 96.1k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 96.1k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 96.1k| inv = gf_inv(t); ------------------ | | 11| 96.1k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 96.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 183| 96.1k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 96.1k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 96.1k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 96.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 12.4M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 12.4M|#define SYS_T 128 ------------------ | Branch (187:21): [True: 12.3M, False: 96.1k] ------------------ 188| 12.3M| if (j != i) { ------------------ | Branch (188:17): [True: 12.2M, False: 96.1k] ------------------ 189| 12.2M| t = extract_gf(mat.d[j], i); 190| | 191| 12.2M| vec128_mul_gf(v.v, mat.v[i], t); 192| 12.2M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 12.2M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 12.2M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 12.2M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 195| 12.2M| } 196| 12.3M| } 197| 96.1k| } 198| | 199| 751| return 0; 200| 751|} decrypt.c:store16: 90| 9.66k|static inline void store16(unsigned char *out, vec128 in) { 91| 9.66k| store8(out + 0, vec128_extract(in, 0)); ------------------ | | 29| 9.66k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 92| | store8(out + 8, vec128_extract(in, 1)); ------------------ | | 29| 9.66k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 93| 9.66k|} PQCLEAN_MCELIECE8192128_AVX2_vec128_mul_GF: 6| 95.3k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 95.3k| int i, j; 8| 95.3k| uint64_t buf[GFBITS][4]; 9| 95.3k| vec128 prod[GFBITS]; 10| 95.3k| uint64_t p[GFBITS]; 11| | 12| | // polynomial multiplication 13| | 14| 1.33M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.33M|#define GFBITS 13 ------------------ | Branch (14:17): [True: 1.23M, False: 95.3k] ------------------ 15| 1.23M| buf[i][0] = 0; 16| 1.23M| buf[i][1] = 0; 17| 1.23M| buf[i][2] = 0; 18| 1.23M| buf[i][3] = 0; 19| 1.23M| } 20| | 21| 12.3M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 95.3k|#define SYS_T 128 ------------------ | Branch (21:25): [True: 12.2M, False: 95.3k] ------------------ 22| 170M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 170M|#define GFBITS 13 ------------------ | Branch (22:21): [True: 158M, False: 12.2M] ------------------ 23| 158M| buf[j][3] <<= 1; 24| 158M| buf[j][3] |= buf[j][2] >> 63; 25| 158M| buf[j][2] <<= 1; 26| 158M| buf[j][2] |= buf[j][1] >> 63; 27| 158M| buf[j][1] <<= 1; 28| 158M| buf[j][1] |= buf[j][0] >> 63; 29| 158M| buf[j][0] <<= 1; 30| 158M| } 31| | 32| 12.2M| vec128_mul_gf(prod, v, a[i]); 33| | 34| 170M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 170M|#define GFBITS 13 ------------------ | Branch (34:21): [True: 158M, False: 12.2M] ------------------ 35| 158M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 158M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 158M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 158M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 37| 158M| } 38| 12.2M| } 39| | 40| | // reduction modulo y^128+y^7+y^2+y+1 41| | 42| 1.33M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.33M|#define GFBITS 13 ------------------ | Branch (42:17): [True: 1.23M, False: 95.3k] ------------------ 43| 1.23M| p[i] = buf[i][3]; 44| | 45| 1.23M| buf[i][2] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 1.23M|#define SYS_T 128 ------------------ 46| 1.23M| buf[i][1] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 1.23M|#define SYS_T 128 ------------------ 47| 1.23M| buf[i][2] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 1.23M|#define SYS_T 128 ------------------ 48| 1.23M| buf[i][1] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 1.23M|#define SYS_T 128 ------------------ 49| 1.23M| buf[i][2] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 1.23M|#define SYS_T 128 ------------------ 50| 1.23M| buf[i][1] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 1.23M|#define SYS_T 128 ------------------ 51| 1.23M| buf[i][1] ^= p[i]; 52| 1.23M| } 53| | 54| | // 55| | 56| 1.33M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.33M|#define GFBITS 13 ------------------ | Branch (56:17): [True: 1.23M, False: 95.3k] ------------------ 57| 1.23M| p[i] = buf[i][2]; 58| | 59| 1.23M| buf[i][1] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 1.23M|#define SYS_T 128 ------------------ 60| 1.23M| buf[i][0] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 1.23M|#define SYS_T 128 ------------------ 61| 1.23M| buf[i][1] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 1.23M|#define SYS_T 128 ------------------ 62| 1.23M| buf[i][0] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 1.23M|#define SYS_T 128 ------------------ 63| 1.23M| buf[i][1] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 1.23M|#define SYS_T 128 ------------------ 64| 1.23M| buf[i][0] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 1.23M|#define SYS_T 128 ------------------ 65| 1.23M| buf[i][0] ^= p[i]; 66| 1.23M| } 67| | 68| | // 69| | 70| 1.33M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.33M|#define GFBITS 13 ------------------ | Branch (70:17): [True: 1.23M, False: 95.3k] ------------------ 71| 1.23M| out[i] = vec128_set2x(buf[i][0], buf[i][1]); 72| 1.23M| } 73| 95.3k|} decrypt.c:vec128_setbits: 58| 151|static inline vec128 vec128_setbits(uint64_t a) { 59| 151| return _mm_set1_epi64x(-a); 60| 151|} PQCLEAN_MCELIECE8192128_AVX2_vec256_sq: 9| 12.7k|void vec256_sq(vec256 *out, vec256 *in) { 10| 12.7k| int i; 11| 12.7k| vec256 result[GFBITS], t; 12| | 13| 12.7k| t = vec256_xor(in[11], in[12]); 14| | 15| 12.7k| result[0] = vec256_xor(in[0], in[11]); 16| 12.7k| result[1] = vec256_xor(in[7], t); 17| 12.7k| result[2] = vec256_xor(in[1], in[7]); 18| 12.7k| result[3] = vec256_xor(in[8], t); 19| 12.7k| result[4] = vec256_xor(in[2], in[7]); 20| 12.7k| result[4] = vec256_xor(result[4], in[8]); 21| 12.7k| result[4] = vec256_xor(result[4], t); 22| 12.7k| result[5] = vec256_xor(in[7], in[9]); 23| 12.7k| result[6] = vec256_xor(in[3], in[8]); 24| 12.7k| result[6] = vec256_xor(result[6], in[9]); 25| 12.7k| result[6] = vec256_xor(result[6], in[12]); 26| 12.7k| result[7] = vec256_xor(in[8], in[10]); 27| 12.7k| result[8] = vec256_xor(in[4], in[9]); 28| 12.7k| result[8] = vec256_xor(result[8], in[10]); 29| 12.7k| result[9] = vec256_xor(in[9], in[11]); 30| 12.7k| result[10] = vec256_xor(in[5], in[10]); 31| 12.7k| result[10] = vec256_xor(result[10], in[11]); 32| 12.7k| result[11] = vec256_xor(in[10], in[12]); 33| 12.7k| result[12] = vec256_xor(in[6], t); 34| | 35| 178k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 178k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 165k, False: 12.7k] ------------------ 36| 165k| out[i] = result[i]; 37| 165k| } 38| 12.7k|} PQCLEAN_MCELIECE8192128_AVX2_vec256_inv: 41| 836|void vec256_inv(vec256 *out, vec256 *in) { 42| 836| vec256 tmp_11[ GFBITS ]; 43| 836| vec256 tmp_1111[ GFBITS ]; 44| | 45| 836| vec256_copy(out, in); 46| | 47| 836| vec256_sq(out, out); ------------------ | | 14| 836|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 836|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 48| 836| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 836| vec256_sq(out, tmp_11); ------------------ | | 14| 836|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 836|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 51| 836| vec256_sq(out, out); ------------------ | | 14| 836|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 836|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 52| 836| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 836| vec256_sq(out, tmp_1111); ------------------ | | 14| 836|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 836|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 55| 836| vec256_sq(out, out); ------------------ | | 14| 836|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 836|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 56| 836| vec256_sq(out, out); ------------------ | | 14| 836|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 836|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 57| 836| vec256_sq(out, out); ------------------ | | 14| 836|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 836|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 58| 836| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 836| vec256_sq(out, out); ------------------ | | 14| 836|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 836|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 61| 836| vec256_sq(out, out); ------------------ | | 14| 836|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 836|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 62| 836| vec256_sq(out, out); ------------------ | | 14| 836|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 836|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 63| 836| vec256_sq(out, out); ------------------ | | 14| 836|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 836|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 64| 836| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 836| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 836|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 836|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 67| 836|} PQCLEAN_MCELIECE8192128F_AVX2_load_bits: 188| 66|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 66| int i, j; 190| 66| const unsigned char *ptr = bits; 191| | 192| 66| vec128 buf[64]; 193| | 194| 264| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 198, False: 66] ------------------ 195| 12.8k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 12.6k, False: 198] ------------------ 196| 12.6k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 12.6k| ptr += 8; 198| 12.6k| } 199| | 200| 198| transpose_64x128_sp( buf ); 201| | 202| 6.53k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 6.33k, False: 198] ------------------ 203| 6.33k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 6.33k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 6.33k| } 206| | 207| 198| ptr += 512; 208| 198| } 209| | 210| 924| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 858, False: 66] ------------------ 211| 28.3k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 27.4k, False: 858] ------------------ 212| 27.4k| bits_int[i][j] = load16(ptr); 213| 27.4k| ptr += 16; 214| 27.4k| } 215| 858| } 216| | 217| 264| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 198, False: 66] ------------------ 218| 12.8k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 12.6k, False: 198] ------------------ 219| 12.6k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 12.6k| ptr += 8; 221| 12.6k| } 222| | 223| 198| transpose_64x128_sp( buf ); 224| | 225| 6.53k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 6.33k, False: 198] ------------------ 226| 6.33k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 6.33k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 6.33k| } 229| | 230| 198| ptr += 512; 231| 198| } 232| 66|} PQCLEAN_MCELIECE8192128F_AVX2_benes: 238| 132|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 132| int inc; 240| | 241| 132| vec128 *b_ptr; 242| | 243| 132| if (rev == 0) { ------------------ | Branch (243:9): [True: 66, False: 66] ------------------ 244| 66| inc = 32; 245| 66| b_ptr = b[ 0]; 246| 66| } else { 247| 66| inc = -32; 248| 66| b_ptr = b[24]; 249| 66| } 250| | 251| | // 252| | 253| 132| transpose_64x128_sp( r ); 254| | 255| 132| layer_0(r, b_ptr); 256| 132| b_ptr += inc; 257| 132| layer_1(r, b_ptr); 258| 132| b_ptr += inc; 259| 132| layer_2(r, b_ptr); 260| 132| b_ptr += inc; 261| 132| layer_3(r, b_ptr); 262| 132| b_ptr += inc; 263| 132| layer_4(r, b_ptr); 264| 132| b_ptr += inc; 265| 132| layer_5(r, b_ptr); 266| 132| b_ptr += inc; 267| | 268| 132| transpose_64x128_sp( r ); 269| | 270| 132| layer_x(r, b_ptr); 271| 132| b_ptr += inc; 272| 132| layer_0(r, b_ptr); 273| 132| b_ptr += inc; 274| 132| layer_1(r, b_ptr); 275| 132| b_ptr += inc; 276| 132| layer_2(r, b_ptr); 277| 132| b_ptr += inc; 278| 132| layer_3(r, b_ptr); 279| 132| b_ptr += inc; 280| 132| layer_4(r, b_ptr); 281| 132| b_ptr += inc; 282| 132| layer_5(r, b_ptr); 283| 132| b_ptr += inc; 284| 132| layer_4(r, b_ptr); 285| 132| b_ptr += inc; 286| 132| layer_3(r, b_ptr); 287| 132| b_ptr += inc; 288| 132| layer_2(r, b_ptr); 289| 132| b_ptr += inc; 290| 132| layer_1(r, b_ptr); 291| 132| b_ptr += inc; 292| 132| layer_0(r, b_ptr); 293| 132| b_ptr += inc; 294| 132| layer_x(r, b_ptr); 295| 132| b_ptr += inc; 296| | 297| 132| transpose_64x128_sp( r ); 298| | 299| 132| layer_5(r, b_ptr); 300| 132| b_ptr += inc; 301| 132| layer_4(r, b_ptr); 302| 132| b_ptr += inc; 303| 132| layer_3(r, b_ptr); 304| 132| b_ptr += inc; 305| 132| layer_2(r, b_ptr); 306| 132| b_ptr += inc; 307| 132| layer_1(r, b_ptr); 308| 132| b_ptr += inc; 309| 132| layer_0(r, b_ptr); 310| | 311| 132| transpose_64x128_sp( r ); 312| 132|} PQCLEAN_MCELIECE8192128F_AVX2_bm: 147| 66|void bm(vec128 *out, vec256 *in) { 148| 66| int i; 149| 66| uint16_t N, L; 150| 66| uint16_t mask; 151| 66| uint64_t one = 1, t; 152| | 153| 66| vec128 prod[ GFBITS ]; 154| 66| vec128 interval[GFBITS]; 155| | 156| 66| typedef union { 157| 66| vec128 v[GFBITS][2]; 158| 66| vec256 V[GFBITS]; 159| 66| } db_t; 160| | 161| 66| db_t db; 162| 66| db_t BC_tmp; 163| 66| db_t BC; 164| | 165| 66| gf d, b, c0 = 1; 166| 66| gf coefs[256]; 167| | 168| | // initialization 169| | 170| 66| get_coefs(coefs, in); 171| | 172| 66| BC.v[0][0] = vec128_set2x(0, one << 63); 173| 66| BC.v[0][1] = vec128_setzero(); 174| | 175| 858| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 858|#define GFBITS 13 ------------------ | Branch (175:17): [True: 792, False: 66] ------------------ 176| 792| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 177| 792| } 178| | 179| 66| b = 1; 180| 66| L = 0; 181| | 182| | // 183| | 184| 924| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 924|#define GFBITS 13 ------------------ | Branch (184:17): [True: 858, False: 66] ------------------ 185| 858| interval[i] = vec128_setzero(); 186| 858| } 187| | 188| 16.9k| for (N = 0; N < 256; N++) { ------------------ | Branch (188:17): [True: 16.8k, False: 66] ------------------ 189| 16.8k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 16.8k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 16.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 190| 16.8k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 16.8k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 16.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 191| | 192| 16.8k| d = vec_reduce_asm(prod); ------------------ | | 3| 16.8k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 16.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 16.8k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 16.8k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 16.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 195| 16.8k| d ^= t & 0xFFFFFFFF; 196| | 197| 16.8k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 198| | 199| 236k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 236k|#define GFBITS 13 ------------------ | Branch (199:21): [True: 219k, False: 16.8k] ------------------ 200| 219k| db.v[i][0] = vec128_setbits((d >> i) & 1); 201| 219k| db.v[i][1] = vec128_setbits((b >> i) & 1); 202| 219k| } 203| | 204| 16.8k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 205| | 206| 16.8k| vec128_cmov(BC.v, mask); 207| 16.8k| update_asm(BC.v, c0 & mask, 32); ------------------ | | 1| 16.8k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 16.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| 236k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 236k|#define GFBITS 13 ------------------ | Branch (209:21): [True: 219k, False: 16.8k] ------------------ 210| 219k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 211| 219k| } 212| | 213| 16.8k| c0 = t >> 32; 214| 16.8k| b = (d & mask) | (b & ~mask); 215| 16.8k| L = ((N + 1 - L) & mask) | (L & ~mask); 216| 16.8k| } 217| | 218| 66| c0 = gf_inv(c0); ------------------ | | 11| 66|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 924| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 924|#define GFBITS 13 ------------------ | Branch (220:17): [True: 858, False: 66] ------------------ 221| 858| prod[i] = vec128_setbits((c0 >> i) & 1); 222| 858| } 223| | 224| 66| vec128_mul_asm(out, prod, BC.v[0] + 1, 32); ------------------ | | 10| 66|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 225| 66|} PQCLEAN_MCELIECE8192128F_AVX2_controlbitsfrompermutation: 205| 66|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 66| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 66|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 66| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 66|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 66| int16 diff; 209| 66| int i; 210| 66| unsigned char *ptr; 211| | 212| 66| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 66| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 66| while (1) { ------------------ | Branch (215:12): [True: 66, Folded] ------------------ 216| 66| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 66| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 540k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 540k, False: 66] ------------------ 222| 540k| pi_test[i] = (int16)i; 223| 540k| } 224| | 225| 66| ptr = out; 226| 924| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 858, False: 66] ------------------ 227| 858| layer(pi_test, ptr, i, (int32)n); 228| 858| ptr += n >> 4; 229| 858| } 230| | 231| 858| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 792, False: 66] ------------------ 232| 792| layer(pi_test, ptr, i, (int32)n); 233| 792| ptr += n >> 4; 234| 792| } 235| | 236| 66| diff = 0; 237| 540k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 540k, False: 66] ------------------ 238| 540k| diff |= pi[i] ^ pi_test[i]; 239| 540k| } 240| | 241| 66| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 66|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 242| 66| crypto_declassify(&diff, sizeof diff); 243| 66| if (diff == 0) { ------------------ | Branch (243:13): [True: 66, False: 0] ------------------ 244| 66| break; 245| 66| } 246| 66| } 247| 66|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_int16_negative_mask: 3| 132|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 132| return crypto_int16_x >> 15; 5| 132|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_int16_nonzero_mask: 7| 66|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 66| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 66|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 66|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 9| 66|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_int32_negative_mask: 3| 42.1M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 42.1M| return crypto_int32_x >> 31; 5| 42.1M|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_int32_min: 37| 42.1M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 42.1M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 42.1M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 42.1M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 42.1M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 42.1M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 42.1M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 42| 42.1M| crypto_int32_z &= crypto_int32_xy; 43| 42.1M| return crypto_int32_x ^ crypto_int32_z; 44| 42.1M|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint16_signed_negative_mask: 3| 20.7k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 20.7k| return crypto_uint16_signed_x >> 15; 5| 20.7k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint16_nonzero_mask: 7| 10.3k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 10.3k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 10.3k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 10.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 10.3k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 10.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 9| 10.3k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint16_zero_mask: 11| 10.3k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 10.3k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 10.3k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 10.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 13| 10.3k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint32_signed_negative_mask: 3| 86.8k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 86.8k| return crypto_uint32_signed_x >> 31; 5| 86.8k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint32_nonzero_mask: 7| 43.4k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 43.4k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 43.4k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 43.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 43.4k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 43.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 9| 43.4k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint32_unequal_mask: 15| 43.4k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 43.4k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 43.4k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 43.4k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 43.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 18| 43.4k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint32_equal_mask: 20| 43.4k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 43.4k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 43.4k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 43.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 22| 43.4k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint64_signed_negative_mask: 3| 1.44M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 1.44M| return crypto_uint64_signed_x >> 63; 5| 1.44M|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint64_nonzero_mask: 7| 720k|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 720k| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 720k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 720k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 720k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 720k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 9| 720k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint64_zero_mask: 11| 111k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 111k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 111k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 111k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 13| 111k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint64_unequal_mask: 15| 608k|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 608k| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 608k| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 608k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 608k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 18| 608k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint64_equal_mask: 20| 608k|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 608k| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 608k|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 608k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 22| 608k|} PQCLEAN_MCELIECE8192128F_AVX2_decrypt: 141| 66|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 142| 66| int i; 143| | 144| 66| uint16_t check_synd; 145| 66| uint16_t check_weight; 146| | 147| 66| vec256 inv[ 64 ][ GFBITS ]; 148| 66| vec256 scaled[ 64 ][ GFBITS ]; 149| 66| vec256 eval[ 64 ][ GFBITS ]; 150| | 151| 66| vec128 error128[ 64 ]; 152| 66| vec256 error256[ 32 ]; 153| | 154| 66| vec256 s_priv[ GFBITS ]; 155| 66| vec256 s_priv_cmp[ GFBITS ]; 156| 66| vec128 locator[ GFBITS ]; 157| | 158| 66| vec128 recv128[ 64 ]; 159| 66| vec256 recv256[ 32 ]; 160| 66| vec256 allone; 161| | 162| 66| vec128 bits_int[25][32]; 163| | 164| | // Berlekamp decoder 165| | 166| 66| preprocess(recv128, s); 167| | 168| 66| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 66|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 66|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 66|#define SYS_T 128 | | ------------------ ------------------ 169| 66| benes(recv128, bits_int, 1); ------------------ | | 9| 66|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 170| 66| reformat_128to256(recv256, recv128); 171| | 172| 66| scaling(scaled, inv, sk, recv256); // scaling 173| 66| fft_tr(s_priv, scaled); // transposed FFT ------------------ | | 9| 66|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 174| 66| bm(locator, s_priv); // Berlekamp Massey ------------------ | | 10| 66|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 175| | 176| 66| fft(eval, locator); // FFT ------------------ | | 10| 66|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 177| | 178| | // reencryption and weight check 179| | 180| 66| allone = vec256_set1_16b(0xFFFF); 181| | 182| 2.17k| for (i = 0; i < 32; i++) { ------------------ | Branch (182:17): [True: 2.11k, False: 66] ------------------ 183| 2.11k| error256[i] = vec256_or_reduce(eval[i]); 184| 2.11k| error256[i] = vec256_xor(error256[i], allone); 185| 2.11k| } 186| | 187| 66| check_weight = weight(error256) ^ SYS_T; ------------------ | | 8| 66|#define SYS_T 128 ------------------ 188| 66| check_weight -= 1; 189| 66| check_weight >>= 15; 190| | 191| 66| scaling_inv(scaled, inv, error256); 192| 66| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 66|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 66| check_synd = synd_cmp(s_priv, s_priv_cmp); 195| | 196| | // 197| | 198| 66| reformat_256to128(error128, error256); 199| 66| benes(error128, bits_int, 0); ------------------ | | 9| 66|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 4.29k| for (i = 0; i < 64; i++) { ------------------ | Branch (201:17): [True: 4.22k, False: 66] ------------------ 202| 4.22k| store16(e + i * 16, error128[i]); 203| 4.22k| } 204| | 205| 66| return 1 - (check_synd & check_weight); 206| 66|} PQCLEAN_MCELIECE8192128F_AVX2_encrypt: 87| 66|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 88| 66| gen_e(e); 89| | 90| 66| syndrome_asm(s, pk, e); ------------------ | | 1| 66|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 91| 66|} PQCLEAN_MCELIECE8192128F_AVX2_fft: 277| 213|void fft(vec256 out[][GFBITS], vec128 *in) { 278| 213| radix_conversions(in); 279| 213| butterflies(out, in); 280| 213|} PQCLEAN_MCELIECE8192128F_AVX2_fft_tr: 380| 132|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 381| 132| butterflies_tr(out, in); 382| 132| radix_conversions_tr(out); 383| 132|} PQCLEAN_MCELIECE8192128F_AVX2_gf_mul: 12| 1.32M|gf gf_mul(gf in0, gf in1) { 13| 1.32M| int i; 14| | 15| 1.32M| uint64_t tmp; 16| 1.32M| uint64_t t0; 17| 1.32M| uint64_t t1; 18| 1.32M| uint64_t t; 19| | 20| 1.32M| t0 = in0; 21| 1.32M| t1 = in1; 22| | 23| 1.32M| tmp = t0 * (t1 & 1); 24| | 25| 17.2M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 17.2M|#define GFBITS 13 ------------------ | Branch (25:17): [True: 15.9M, False: 1.32M] ------------------ 26| 15.9M| tmp ^= (t0 * (t1 & (1 << i))); 27| 15.9M| } 28| | 29| | // 30| | 31| 1.32M| t = tmp & 0x1FF0000; 32| 1.32M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 33| | 34| 1.32M| t = tmp & 0x000E000; 35| 1.32M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 36| | 37| 1.32M| return tmp & GFMASK; ------------------ | | 19| 1.32M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.32M|#define GFBITS 13 | | ------------------ ------------------ 38| 1.32M|} PQCLEAN_MCELIECE8192128F_AVX2_gf_frac: 148| 10.4k|gf gf_frac(gf den, gf num) { 149| 10.4k| gf tmp_11; 150| 10.4k| gf tmp_1111; 151| 10.4k| gf out; 152| | 153| 10.4k| tmp_11 = gf_sqmul(den, den); // 11 154| 10.4k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // 1111 155| 10.4k| out = gf_sq2(tmp_1111); 156| 10.4k| out = gf_sq2mul(out, tmp_1111); // 11111111 157| 10.4k| out = gf_sq2(out); 158| 10.4k| out = gf_sq2mul(out, tmp_1111); // 111111111111 159| | 160| 10.4k| return gf_sqmul(out, num); // 1111111111110 161| 10.4k|} PQCLEAN_MCELIECE8192128F_AVX2_gf_inv: 164| 10.4k|gf gf_inv(gf den) { 165| 10.4k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 10.4k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 10.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 166| 10.4k|} bm.c:PQCLEAN_MCELIECE8192128F_AVX2_gf_mul2: 31| 16.8k|static inline uint64_t gf_mul2(gf a, gf b0, gf b1) { 32| 16.8k| int i; 33| | 34| 16.8k| uint64_t tmp = 0; 35| 16.8k| uint64_t t0; 36| 16.8k| uint64_t t1; 37| 16.8k| uint64_t t; 38| 16.8k| uint64_t mask = 0x0000000100000001; 39| | 40| 16.8k| t0 = a; 41| 16.8k| t1 = b1; 42| 16.8k| t1 = (t1 << 32) | b0; 43| | 44| 236k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 236k|#define GFBITS 13 ------------------ | Branch (44:17): [True: 219k, False: 16.8k] ------------------ 45| 219k| tmp ^= t0 * (t1 & mask); 46| 219k| mask += mask; 47| 219k| } 48| | 49| | // 50| | 51| 16.8k| t = tmp & 0x01FF000001FF0000; 52| 16.8k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 53| | 54| 16.8k| t = tmp & 0x0000E0000000E000; 55| 16.8k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 56| | 57| 16.8k| return tmp & 0x00001FFF00001FFF; 58| 16.8k|} pk_gen.c:PQCLEAN_MCELIECE8192128F_AVX2_int32_sort: 21| 66|static void int32_sort(int32_t *x, long long n) { 22| 66| long long top, p, q, r, i; 23| | 24| 66| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 66] ------------------ 25| 0| return; 26| 0| } 27| 66| top = 1; 28| 726| while (top < n - top) { ------------------ | Branch (28:12): [True: 660, False: 66] ------------------ 29| 660| top += top; 30| 660| } 31| | 32| 792| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 726, False: 66] ------------------ 33| 1.07M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.07M, False: 726] ------------------ 34| 1.07M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 570k, False: 502k] ------------------ 35| 570k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 570k| do { \ | | 12| 570k| int32_t ab = (b) ^ (a); \ | | 13| 570k| int32_t c = (b) - (a); \ | | 14| 570k| c ^= ab & ((c) ^ (b)); \ | | 15| 570k| c >>= 31; \ | | 16| 570k| c &= ab; \ | | 17| 570k| (a) ^= c; \ | | 18| 570k| (b) ^= c; \ | | 19| 570k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 570k] | | ------------------ ------------------ 36| 570k| } 37| 1.07M| } 38| 726| i = 0; 39| 4.35k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 3.63k, False: 726] ------------------ 40| 966k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 963k, False: 3.63k] ------------------ 41| 963k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 502k, False: 460k] ------------------ 42| 502k| int32_t a = x[i + p]; 43| 2.94M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.44M, False: 502k] ------------------ 44| 2.44M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.44M| do { \ | | 12| 2.44M| int32_t ab = (b) ^ (a); \ | | 13| 2.44M| int32_t c = (b) - (a); \ | | 14| 2.44M| c ^= ab & ((c) ^ (b)); \ | | 15| 2.44M| c >>= 31; \ | | 16| 2.44M| c &= ab; \ | | 17| 2.44M| (a) ^= c; \ | | 18| 2.44M| (b) ^= c; \ | | 19| 2.44M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.44M] | | ------------------ ------------------ 45| 2.44M| } 46| 502k| x[i + p] = a; 47| 502k| } 48| 963k| } 49| 3.63k| } 50| 726| } 51| 66|} controlbits.c:PQCLEAN_MCELIECE8192128F_AVX2_int32_sort: 21| 2.16M|static void int32_sort(int32_t *x, long long n) { 22| 2.16M| long long top, p, q, r, i; 23| | 24| 2.16M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 2.16M] ------------------ 25| 0| return; 26| 0| } 27| 2.16M| top = 1; 28| 7.58M| while (top < n - top) { ------------------ | Branch (28:12): [True: 5.41M, False: 2.16M] ------------------ 29| 5.41M| top += top; 30| 5.41M| } 31| | 32| 9.74M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 7.58M, False: 2.16M] ------------------ 33| 1.04G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.03G, False: 7.58M] ------------------ 34| 1.03G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 579M, False: 456M] ------------------ 35| 579M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 579M| do { \ | | 12| 579M| int32_t ab = (b) ^ (a); \ | | 13| 579M| int32_t c = (b) - (a); \ | | 14| 579M| c ^= ab & ((c) ^ (b)); \ | | 15| 579M| c >>= 31; \ | | 16| 579M| c &= ab; \ | | 17| 579M| (a) ^= c; \ | | 18| 579M| (b) ^= c; \ | | 19| 579M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 579M] | | ------------------ ------------------ 36| 579M| } 37| 1.03G| } 38| 7.58M| i = 0; 39| 20.5M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 12.9M, False: 7.58M] ------------------ 40| 925M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 912M, False: 12.9M] ------------------ 41| 912M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 456M, False: 456M] ------------------ 42| 456M| int32_t a = x[i + p]; 43| 2.70G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.24G, False: 456M] ------------------ 44| 2.24G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.24G| do { \ | | 12| 2.24G| int32_t ab = (b) ^ (a); \ | | 13| 2.24G| int32_t c = (b) - (a); \ | | 14| 2.24G| c ^= ab & ((c) ^ (b)); \ | | 15| 2.24G| c >>= 31; \ | | 16| 2.24G| c &= ab; \ | | 17| 2.24G| (a) ^= c; \ | | 18| 2.24G| (b) ^= c; \ | | 19| 2.24G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.24G] | | ------------------ ------------------ 45| 2.24G| } 46| 456M| x[i + p] = a; 47| 456M| } 48| 912M| } 49| 12.9M| } 50| 7.58M| } 51| 2.16M|} encrypt.c:PQCLEAN_MCELIECE8192128F_AVX2_int32_sort: 21| 342|static void int32_sort(int32_t *x, long long n) { 22| 342| long long top, p, q, r, i; 23| | 24| 342| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 342] ------------------ 25| 0| return; 26| 0| } 27| 342| top = 1; 28| 2.39k| while (top < n - top) { ------------------ | Branch (28:12): [True: 2.05k, False: 342] ------------------ 29| 2.05k| top += top; 30| 2.05k| } 31| | 32| 2.73k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 2.39k, False: 342] ------------------ 33| 265k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 262k, False: 2.39k] ------------------ 34| 262k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 153k, False: 109k] ------------------ 35| 153k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 153k| do { \ | | 12| 153k| int32_t ab = (b) ^ (a); \ | | 13| 153k| int32_t c = (b) - (a); \ | | 14| 153k| c ^= ab & ((c) ^ (b)); \ | | 15| 153k| c >>= 31; \ | | 16| 153k| c &= ab; \ | | 17| 153k| (a) ^= c; \ | | 18| 153k| (b) ^= c; \ | | 19| 153k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 153k] | | ------------------ ------------------ 36| 153k| } 37| 262k| } 38| 2.39k| i = 0; 39| 9.57k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 7.18k, False: 2.39k] ------------------ 40| 226k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 219k, False: 7.18k] ------------------ 41| 219k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 109k, False: 109k] ------------------ 42| 109k| int32_t a = x[i + p]; 43| 459k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 349k, False: 109k] ------------------ 44| 349k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 349k| do { \ | | 12| 349k| int32_t ab = (b) ^ (a); \ | | 13| 349k| int32_t c = (b) - (a); \ | | 14| 349k| c ^= ab & ((c) ^ (b)); \ | | 15| 349k| c >>= 31; \ | | 16| 349k| c &= ab; \ | | 17| 349k| (a) ^= c; \ | | 18| 349k| (b) ^= c; \ | | 19| 349k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 349k] | | ------------------ ------------------ 45| 349k| } 46| 109k| x[i + p] = a; 47| 109k| } 48| 219k| } 49| 7.18k| } 50| 2.39k| } 51| 342|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_enc: 22| 66|) { 23| 66| unsigned char e[ SYS_N / 8 ]; 24| 66| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 66| encrypt(c, pk, e); ------------------ | | 9| 66|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 66| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 66|#define SYS_N 8192 ------------------ 31| 66| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 66|#define SYS_N 8192 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 66|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 66|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 66|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 66|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 66| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 66| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 66|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 66| return 0; 36| 66|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_dec: 42| 66|) { 43| 66| int i; 44| | 45| 66| unsigned char ret_decrypt = 0; 46| | 47| 66| uint16_t m; 48| | 49| 66| unsigned char e[ SYS_N / 8 ]; 50| 66| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 66| unsigned char *x = preimage; 52| 66| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 66|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 66|#define SYS_T 128 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 66|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 66|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 66|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 66| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 66|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 66| m = ret_decrypt; 59| 66| m -= 1; 60| 66| m >>= 8; 61| | 62| 66| *x++ = m & 1; 63| 67.6k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 67.6k|#define SYS_N 8192 ------------------ | Branch (63:17): [True: 67.5k, False: 66] ------------------ 64| 67.5k| *x++ = (~m & s[i]) | (m & e[i]); 65| 67.5k| } 66| | 67| 13.7k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 13.7k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 13.7k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 13.7k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 13.7k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 13.7k, False: 66] ------------------ 68| 13.7k| *x++ = c[i]; 69| 13.7k| } 70| | 71| 66| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 66| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 66|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 66| return 0; 74| 66|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_keypair: 80| 66|) { 81| 66| int i; 82| 66| unsigned char seed[ 33 ] = {64}; 83| 66| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 66| unsigned char *rp, *skp; 85| 66| uint64_t pivots; 86| | 87| 66| gf f[ SYS_T ]; // element in GF(2^mt) 88| 66| gf irr[ SYS_T ]; // Goppa polynomial 89| 66| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 90| 66| int16_t pi[ 1 << GFBITS ]; // random permutation 91| | 92| 66| randombytes(seed + 1, 32); ------------------ | | 8| 66|#define randombytes OQS_randombytes ------------------ 93| | 94| 81| while (1) { ------------------ | Branch (94:12): [True: 81, Folded] ------------------ 95| 81| rp = &r[ sizeof(r) - 32 ]; 96| 81| skp = sk; 97| | 98| | // expanding and updating the seed 99| | 100| 81| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 81| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 81|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 101| 81| memcpy(skp, seed + 1, 32); 102| 81| skp += 32 + 8; 103| 81| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 104| | 105| | // generating irreducible polynomial 106| | 107| 81| rp -= sizeof(f); 108| | 109| 10.4k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.4k|#define SYS_T 128 ------------------ | Branch (109:21): [True: 10.3k, False: 81] ------------------ 110| 10.3k| f[i] = load_gf(rp + i * 2); 111| 10.3k| } 112| | 113| 81| if (genpoly_gen(irr, f)) { ------------------ | | 9| 81|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 81|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ | Branch (113:13): [True: 0, False: 81] ------------------ 114| 0| continue; 115| 0| } 116| | 117| 10.4k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.4k|#define SYS_T 128 ------------------ | Branch (117:21): [True: 10.3k, False: 81] ------------------ 118| 10.3k| store_gf(skp + i * 2, irr[i]); 119| 10.3k| } 120| | 121| 81| skp += IRR_BYTES; ------------------ | | 11| 81|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 81|#define SYS_T 128 | | ------------------ ------------------ 122| | 123| | // generating permutation 124| | 125| 81| rp -= sizeof(perm); 126| | 127| 663k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 663k|#define GFBITS 13 ------------------ | Branch (127:21): [True: 663k, False: 81] ------------------ 128| 663k| perm[i] = load4(rp + i * 4); 129| 663k| } 130| | 131| 81| if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 9| 81|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 81|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 11| 81|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 81|#define SYS_T 128 | | ------------------ ------------------ | Branch (131:13): [True: 15, False: 66] ------------------ 132| 15| continue; 133| 15| } 134| | 135| 66| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 66|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 66|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 66|#define GFBITS 13 ------------------ 136| 66| skp += COND_BYTES; ------------------ | | 10| 66|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 66|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 66|#define GFBITS 13 | | ------------------ ------------------ 137| | 138| | // storing the random string s 139| | 140| 66| rp -= SYS_N / 8; ------------------ | | 7| 66|#define SYS_N 8192 ------------------ 141| 66| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 66|#define SYS_N 8192 ------------------ 142| | 143| | // storing positions of the 32 pivots 144| | 145| 66| store8(sk + 32, pivots); 146| | 147| 66| break; 148| 81| } 149| | 150| 66| return 0; 151| 66|} PQCLEAN_MCELIECE8192128F_AVX2_pk_gen: 315| 81|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi, uint64_t *pivots) { 316| 81| int i, j, k, b; 317| 81| int row, c; 318| | 319| 81| union { 320| 81| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 321| 81| vec256 v[ PK_NROWS ][ nBlocks_I ]; 322| 81| } mat; 323| | 324| 81| union { 325| 81| uint64_t w[ PK_NROWS ][ 52 ]; 326| 81| vec256 v[ PK_NROWS ][ 13 ]; 327| 81| } par; 328| | 329| 81| uint16_t m; 330| 81| vec256 mm; 331| | 332| 81| vec128 sk_int[ GFBITS ]; 333| | 334| 81| vec256 consts[ 32 ][ GFBITS ]; 335| 81| vec256 eval[ 32 ][ GFBITS ]; 336| 81| vec256 prod[ 32 ][ GFBITS ]; 337| 81| vec256 tmp[ GFBITS ]; 338| | 339| 81| uint64_t list[1 << GFBITS]; 340| 81| uint64_t one = 1; 341| 81| uint64_t t; 342| | 343| 81| uint16_t ind[ PK_NROWS ]; 344| 81| uint16_t ind_inv[ PK_NROWS ]; 345| | 346| | // compute the inverses 347| | 348| 81| irr_load(sk_int, irr); 349| | 350| 81| fft(eval, sk_int); ------------------ | | 10| 81|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 81|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 351| | 352| 81| vec256_copy(prod[0], eval[0]); 353| | 354| 2.59k| for (i = 1; i < 32; i++) { ------------------ | Branch (354:17): [True: 2.51k, False: 81] ------------------ 355| 2.51k| vec256_mul(prod[i], prod[i - 1], eval[i]); 356| 2.51k| } 357| | 358| 81| vec256_inv(tmp, prod[31]); ------------------ | | 11| 81|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 81|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 359| | 360| 2.59k| for (i = 30; i >= 0; i--) { ------------------ | Branch (360:18): [True: 2.51k, False: 81] ------------------ 361| 2.51k| vec256_mul(prod[i + 1], prod[i], tmp); 362| 2.51k| vec256_mul(tmp, tmp, eval[i + 1]); 363| 2.51k| } 364| | 365| 81| vec256_copy(prod[0], tmp); 366| | 367| | // fill matrix 368| | 369| 81| de_bitslicing(list, prod); 370| | 371| 663k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 663k|#define GFBITS 13 ------------------ | Branch (371:17): [True: 663k, False: 81] ------------------ 372| 663k| list[i] <<= GFBITS; ------------------ | | 6| 663k|#define GFBITS 13 ------------------ 373| 663k| list[i] |= i; 374| 663k| list[i] |= ((uint64_t) perm[i]) << 31; 375| 663k| } 376| | 377| 81| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 81|#define GFBITS 13 ------------------ 378| | 379| 608k| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 608k|#define GFBITS 13 ------------------ | Branch (379:17): [True: 608k, False: 66] ------------------ 380| 608k| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (380:13): [True: 15, False: 608k] ------------------ 381| 15| return -1; 382| 15| } 383| 608k| } 384| | 385| 66| to_bitslicing_2x(consts, prod, list); 386| | 387| 540k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 540k|#define GFBITS 13 ------------------ | Branch (387:17): [True: 540k, False: 66] ------------------ 388| 540k| pi[i] = list[i] & GFMASK; ------------------ | | 19| 540k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 540k|#define GFBITS 13 | | ------------------ ------------------ 389| 540k| } 390| | 391| 528| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 528|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 528|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 528|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 528|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (391:17): [True: 462, False: 66] ------------------ 392| 6.46k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 6.46k|#define GFBITS 13 ------------------ | Branch (392:21): [True: 6.00k, False: 462] ------------------ 393| 6.00k| mat.v[ k ][ j ] = prod[ j ][ k ]; 394| 6.00k| } 395| 462| } 396| | 397| 8.44k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 8.44k|#define SYS_T 128 ------------------ | Branch (397:17): [True: 8.38k, False: 66] ------------------ 398| 67.0k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 67.0k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 67.0k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 67.0k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 67.0k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (398:21): [True: 58.6k, False: 8.38k] ------------------ 399| 58.6k| vec256_mul(prod[j], prod[j], consts[j]); 400| | 401| 821k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 821k|#define GFBITS 13 ------------------ | Branch (401:25): [True: 762k, False: 58.6k] ------------------ 402| 762k| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 762k|#define GFBITS 13 ------------------ 403| 762k| } 404| 58.6k| } 405| 8.38k| } 406| | 407| | // gaussian elimination to obtain L, U, and P such that LP M = U 408| | // L and U are stored in the space of M 409| | // P is stored in ind 410| | 411| 109k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (411:17): [True: 109k, False: 66] ------------------ 412| 109k| ind_inv[i] = ind[ i ] = i; 413| 109k| } 414| | 415| 109k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (415:19): [True: 109k, False: 66] ------------------ 416| 109k| i = row >> 6; 417| 109k| j = row & 63; 418| | 419| 109k| if (row == PK_NROWS - 32) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (419:13): [True: 66, False: 109k] ------------------ 420| 66| if (mov_columns(mat.w, pi, pivots)) { ------------------ | Branch (420:17): [True: 0, False: 66] ------------------ 421| 0| return -1; 422| 0| } 423| 66| } 424| | 425| 91.4M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 91.4M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 91.4M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 91.4M|#define GFBITS 13 | | ------------------ ------------------ | Branch (425:27): [True: 91.3M, False: 109k] ------------------ 426| 91.3M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 427| | 428| 91.3M| uint16_cswap(&ind[row], &ind[k], m); 429| | 430| 91.3M| mm = vec256_set1_16b(m); 431| 730M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 730M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 730M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 730M|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 730M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (431:25): [True: 639M, False: 91.3M] ------------------ 432| 639M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 433| 639M| } 434| 91.3M| } 435| | 436| 109k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (436:14): [True: 0, False: 109k] ------------------ 437| 0| return -1; 438| 0| } 439| | 440| 91.4M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 91.4M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 91.4M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 91.4M|#define GFBITS 13 | | ------------------ ------------------ | Branch (440:27): [True: 91.3M, False: 109k] ------------------ 441| 91.3M| t = mat.w[ k ][ i ] & (one << j); 442| 91.3M| mm = extract_mask256(mat.w[k], row); 443| | 444| 730M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 730M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 730M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 730M|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 730M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (444:25): [True: 639M, False: 91.3M] ------------------ 445| 639M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 446| 639M| } 447| | 448| 91.3M| mat.w[ k ][ i ] |= t; 449| 91.3M| } 450| 109k| } 451| | 452| | // apply M^-1 to the remaining columns 453| | 454| 66| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 66|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 66|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 66|#define GFBITS 13 | | ------------------ ------------------ 455| | 456| 198| for (j = 6; j < 32; j += 13) { ------------------ | Branch (456:17): [True: 132, False: 66] ------------------ 457| 1.84k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 1.84k|#define GFBITS 13 ------------------ | Branch (457:21): [True: 1.71k, False: 132] ------------------ 458| 24.0k| for (b = 0; b < 13; b++) { ------------------ | Branch (458:25): [True: 22.3k, False: 1.71k] ------------------ 459| 22.3k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 460| 22.3k| } 461| 1.71k| } 462| | 463| 16.8k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 16.8k|#define SYS_T 128 ------------------ | Branch (463:21): [True: 16.7k, False: 132] ------------------ 464| 234k| for (b = 0; b < 13; b++) { ------------------ | Branch (464:25): [True: 217k, False: 16.7k] ------------------ 465| 217k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 466| 217k| } 467| | 468| 234k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 234k|#define GFBITS 13 ------------------ | Branch (468:25): [True: 217k, False: 16.7k] ------------------ 469| 3.05M| for (b = 0; b < 13; b++) { ------------------ | Branch (469:29): [True: 2.83M, False: 217k] ------------------ 470| 2.83M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 2.83M|#define GFBITS 13 ------------------ 471| 2.83M| } 472| 217k| } 473| 16.7k| } 474| | 475| | // apply P 476| | 477| 219k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 219k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 219k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 219k|#define GFBITS 13 | | ------------------ ------------------ | Branch (477:21): [True: 219k, False: 132] ------------------ 478| 219k| ind[i] = ind_inv[i]; 479| 219k| } 480| | 481| 132| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 132|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 132|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 132|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 132|#define GFBITS 13 | | ------------------ ------------------ 482| | 483| | // apply L 484| | 485| 219k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 132|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 132|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 132|#define GFBITS 13 | | ------------------ ------------------ | Branch (485:34): [True: 219k, False: 132] ------------------ 486| 182M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (486:31): [True: 182M, False: 219k] ------------------ 487| 182M| mm = extract_mask256(mat.w[row], i); 488| | 489| 2.55G| for (k = 0; k < 13; k++) { ------------------ | Branch (489:29): [True: 2.37G, False: 182M] ------------------ 490| 2.37G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 491| 2.37G| } 492| 182M| } 493| 219k| } 494| | 495| | // apply U^-1 496| | 497| 132| if (j == 6) { ------------------ | Branch (497:13): [True: 66, False: 66] ------------------ 498| 109k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (498:25): [True: 109k, False: 66] ------------------ 499| 109k| par.v[i][0] = mat.v[ i ][ nBlocks_I - 1 ]; ------------------ | | 32| 109k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 109k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 109k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 500| 109k| } 501| 66| } 502| | 503| 219k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 132|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 132|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 132|#define GFBITS 13 | | ------------------ ------------------ | Branch (503:34): [True: 219k, False: 132] ------------------ 504| 182M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 219k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 219k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 219k|#define GFBITS 13 | | ------------------ ------------------ | Branch (504:36): [True: 182M, False: 219k] ------------------ 505| 182M| mm = extract_mask256(mat.w[row], i); 506| | 507| 2.55G| for (k = 0; k < 13; k++) { ------------------ | Branch (507:29): [True: 2.37G, False: 182M] ------------------ 508| 2.37G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 509| 2.37G| } 510| 182M| } 511| 219k| } 512| | 513| 132| if (j == 6) { ------------------ | Branch (513:13): [True: 66, False: 66] ------------------ 514| 109k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (514:27): [True: 109k, False: 66] ------------------ 515| 5.60M| for (k = 2; k < 52; k++) { ------------------ | Branch (515:29): [True: 5.49M, False: 109k] ------------------ 516| 5.49M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 5.49M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 5.49M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 5.49M|#define SYS_N 8192 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 5.49M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 5.49M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 5.49M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 517| 5.49M| } 518| 109k| } 519| 66| } else { 520| 109k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (520:27): [True: 109k, False: 66] ------------------ 521| 5.82M| for (k = 0; k < 52; k++) { ------------------ | Branch (521:29): [True: 5.71M, False: 109k] ------------------ 522| 5.71M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 5.71M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 5.71M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 5.71M|#define SYS_N 8192 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 5.71M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 5.71M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 5.71M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 523| 5.71M| } 524| 109k| } 525| 66| } 526| 132| } 527| | 528| | // 529| | 530| 66| return 0; 531| 66|} PQCLEAN_MCELIECE8192128F_AVX2_genpoly_gen: 88| 81|int genpoly_gen(gf *out, gf *f) { 89| 81| int i, j, k; 90| | 91| 81| gf t, inv; 92| | 93| 81| uint64_t m; 94| 81| vec128 mask; 95| | 96| 81| union { 97| 81| uint64_t d[ GFBITS ][ 128 ][2]; 98| 81| vec128 v[ GFBITS ][ 128 ]; 99| 81| } buf; 100| | 101| 81| union { 102| 81| uint64_t d[GFBITS][2]; 103| 81| vec128 v[GFBITS]; 104| 81| } v; 105| | 106| 81| union { 107| 81| uint64_t d[SYS_T][GFBITS][2]; 108| 81| vec128 v[SYS_T][GFBITS]; 109| 81| } mat; 110| | 111| | // fill matrix 112| | 113| 81| buf.v[0][0] = vec128_set2x(1, 0); 114| 1.05k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.05k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 972, False: 81] ------------------ 115| 972| buf.v[i][0] = vec128_setzero(); 116| 972| } 117| | 118| 1.13k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 1.13k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 1.05k, False: 81] ------------------ 119| 1.05k| v.v[j] = vec128_setzero(); 120| | 121| 135k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 1.05k|#define SYS_T 128 ------------------ | Branch (121:29): [True: 134k, False: 1.05k] ------------------ 122| 134k| v.d[j][1] <<= 1; 123| 134k| v.d[j][1] |= v.d[j][0] >> 63; 124| 134k| v.d[j][0] <<= 1; 125| 134k| v.d[j][0] |= (f[i] >> j) & 1; 126| 134k| } 127| 1.05k| } 128| | 129| 1.13k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.13k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 1.05k, False: 81] ------------------ 130| 1.05k| buf.v[i][1] = v.v[i]; 131| 1.05k| } 132| | 133| 10.3k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 10.3k|#define SYS_T 128 ------------------ | Branch (133:17): [True: 10.2k, False: 81] ------------------ 134| 10.2k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 10.2k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 10.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 10.2k| if (k < SYS_T) { ------------------ | | 8| 10.2k|#define SYS_T 128 ------------------ | Branch (136:13): [True: 10.2k, False: 81] ------------------ 137| 142k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 142k|#define GFBITS 13 ------------------ | Branch (137:25): [True: 132k, False: 10.2k] ------------------ 138| 132k| buf.v[i][k] = v.v[i]; 139| 132k| } 140| 10.2k| } else { 141| 10.4k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.4k|#define SYS_T 128 ------------------ | Branch (141:25): [True: 10.3k, False: 81] ------------------ 142| 10.3k| out[i] = extract_gf(v.d, i); 143| 10.3k| } 144| 81| } 145| 10.2k| } 146| | 147| 1.13k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.13k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 1.05k, False: 81] ------------------ 148| 1.05k| transpose_128x128(buf.d[i]); 149| 1.05k| } 150| | 151| 10.4k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 10.4k|#define SYS_T 128 ------------------ | Branch (151:17): [True: 10.3k, False: 81] ------------------ 152| 145k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 145k|#define GFBITS 13 ------------------ | Branch (152:21): [True: 134k, False: 10.3k] ------------------ 153| 134k| mat.v[j][i] = buf.v[i][j]; 154| 134k| } 155| 10.3k| } 156| | 157| | // gaussian 158| | 159| 10.4k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.4k|#define SYS_T 128 ------------------ | Branch (159:17): [True: 10.3k, False: 81] ------------------ 160| 668k| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 668k|#define SYS_T 128 ------------------ | Branch (160:25): [True: 658k, False: 10.3k] ------------------ 161| 658k| m = extract_bit(mat.d[i], i); 162| 658k| m -= 1; 163| 658k| mask = vec128_set2x(m, m); 164| | 165| 9.21M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 9.21M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 8.55M, False: 658k] ------------------ 166| 8.55M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 8.55M| } 168| | 169| 658k| out[i] ^= out[j] & m; 170| 658k| } 171| | 172| | // 173| | 174| 10.3k| t = extract_gf(mat.d[i], i); 175| | 176| 10.3k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 10.3k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 10.3k| inv = gf_inv(t); ------------------ | | 11| 10.3k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 10.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 183| 10.3k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 10.3k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 10.3k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 10.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 1.33M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 1.33M|#define SYS_T 128 ------------------ | Branch (187:21): [True: 1.32M, False: 10.3k] ------------------ 188| 1.32M| if (j != i) { ------------------ | Branch (188:17): [True: 1.31M, False: 10.3k] ------------------ 189| 1.31M| t = extract_gf(mat.d[j], i); 190| | 191| 1.31M| vec128_mul_gf(v.v, mat.v[i], t); 192| 1.31M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 1.31M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 1.31M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 1.31M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 195| 1.31M| } 196| 1.32M| } 197| 10.3k| } 198| | 199| 81| return 0; 200| 81|} PQCLEAN_MCELIECE8192128F_AVX2_vec128_mul_GF: 6| 10.2k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 10.2k| int i, j; 8| 10.2k| uint64_t buf[GFBITS][4]; 9| 10.2k| vec128 prod[GFBITS]; 10| 10.2k| uint64_t p[GFBITS]; 11| | 12| | // polynomial multiplication 13| | 14| 144k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 144k|#define GFBITS 13 ------------------ | Branch (14:17): [True: 133k, False: 10.2k] ------------------ 15| 133k| buf[i][0] = 0; 16| 133k| buf[i][1] = 0; 17| 133k| buf[i][2] = 0; 18| 133k| buf[i][3] = 0; 19| 133k| } 20| | 21| 1.32M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 10.2k|#define SYS_T 128 ------------------ | Branch (21:25): [True: 1.31M, False: 10.2k] ------------------ 22| 18.4M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 18.4M|#define GFBITS 13 ------------------ | Branch (22:21): [True: 17.1M, False: 1.31M] ------------------ 23| 17.1M| buf[j][3] <<= 1; 24| 17.1M| buf[j][3] |= buf[j][2] >> 63; 25| 17.1M| buf[j][2] <<= 1; 26| 17.1M| buf[j][2] |= buf[j][1] >> 63; 27| 17.1M| buf[j][1] <<= 1; 28| 17.1M| buf[j][1] |= buf[j][0] >> 63; 29| 17.1M| buf[j][0] <<= 1; 30| 17.1M| } 31| | 32| 1.31M| vec128_mul_gf(prod, v, a[i]); 33| | 34| 18.4M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 18.4M|#define GFBITS 13 ------------------ | Branch (34:21): [True: 17.1M, False: 1.31M] ------------------ 35| 17.1M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 17.1M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 17.1M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 17.1M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 37| 17.1M| } 38| 1.31M| } 39| | 40| | // reduction modulo y^128+y^7+y^2+y+1 41| | 42| 144k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 144k|#define GFBITS 13 ------------------ | Branch (42:17): [True: 133k, False: 10.2k] ------------------ 43| 133k| p[i] = buf[i][3]; 44| | 45| 133k| buf[i][2] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 133k|#define SYS_T 128 ------------------ 46| 133k| buf[i][1] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 133k|#define SYS_T 128 ------------------ 47| 133k| buf[i][2] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 133k|#define SYS_T 128 ------------------ 48| 133k| buf[i][1] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 133k|#define SYS_T 128 ------------------ 49| 133k| buf[i][2] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 133k|#define SYS_T 128 ------------------ 50| 133k| buf[i][1] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 133k|#define SYS_T 128 ------------------ 51| 133k| buf[i][1] ^= p[i]; 52| 133k| } 53| | 54| | // 55| | 56| 144k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 144k|#define GFBITS 13 ------------------ | Branch (56:17): [True: 133k, False: 10.2k] ------------------ 57| 133k| p[i] = buf[i][2]; 58| | 59| 133k| buf[i][1] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 133k|#define SYS_T 128 ------------------ 60| 133k| buf[i][0] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 133k|#define SYS_T 128 ------------------ 61| 133k| buf[i][1] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 133k|#define SYS_T 128 ------------------ 62| 133k| buf[i][0] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 133k|#define SYS_T 128 ------------------ 63| 133k| buf[i][1] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 133k|#define SYS_T 128 ------------------ 64| 133k| buf[i][0] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 133k|#define SYS_T 128 ------------------ 65| 133k| buf[i][0] ^= p[i]; 66| 133k| } 67| | 68| | // 69| | 70| 144k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 144k|#define GFBITS 13 ------------------ | Branch (70:17): [True: 133k, False: 10.2k] ------------------ 71| 133k| out[i] = vec128_set2x(buf[i][0], buf[i][1]); 72| 133k| } 73| 10.2k|} PQCLEAN_MCELIECE8192128F_AVX2_vec256_sq: 9| 3.87k|void vec256_sq(vec256 *out, vec256 *in) { 10| 3.87k| int i; 11| 3.87k| vec256 result[GFBITS], t; 12| | 13| 3.87k| t = vec256_xor(in[11], in[12]); 14| | 15| 3.87k| result[0] = vec256_xor(in[0], in[11]); 16| 3.87k| result[1] = vec256_xor(in[7], t); 17| 3.87k| result[2] = vec256_xor(in[1], in[7]); 18| 3.87k| result[3] = vec256_xor(in[8], t); 19| 3.87k| result[4] = vec256_xor(in[2], in[7]); 20| 3.87k| result[4] = vec256_xor(result[4], in[8]); 21| 3.87k| result[4] = vec256_xor(result[4], t); 22| 3.87k| result[5] = vec256_xor(in[7], in[9]); 23| 3.87k| result[6] = vec256_xor(in[3], in[8]); 24| 3.87k| result[6] = vec256_xor(result[6], in[9]); 25| 3.87k| result[6] = vec256_xor(result[6], in[12]); 26| 3.87k| result[7] = vec256_xor(in[8], in[10]); 27| 3.87k| result[8] = vec256_xor(in[4], in[9]); 28| 3.87k| result[8] = vec256_xor(result[8], in[10]); 29| 3.87k| result[9] = vec256_xor(in[9], in[11]); 30| 3.87k| result[10] = vec256_xor(in[5], in[10]); 31| 3.87k| result[10] = vec256_xor(result[10], in[11]); 32| 3.87k| result[11] = vec256_xor(in[10], in[12]); 33| 3.87k| result[12] = vec256_xor(in[6], t); 34| | 35| 54.2k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 54.2k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 50.3k, False: 3.87k] ------------------ 36| 50.3k| out[i] = result[i]; 37| 50.3k| } 38| 3.87k|} PQCLEAN_MCELIECE8192128F_AVX2_vec256_inv: 41| 147|void vec256_inv(vec256 *out, vec256 *in) { 42| 147| vec256 tmp_11[ GFBITS ]; 43| 147| vec256 tmp_1111[ GFBITS ]; 44| | 45| 147| vec256_copy(out, in); 46| | 47| 147| vec256_sq(out, out); ------------------ | | 14| 147|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 147|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 48| 147| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 147| vec256_sq(out, tmp_11); ------------------ | | 14| 147|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 147|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 51| 147| vec256_sq(out, out); ------------------ | | 14| 147|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 147|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 52| 147| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 147| vec256_sq(out, tmp_1111); ------------------ | | 14| 147|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 147|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 55| 147| vec256_sq(out, out); ------------------ | | 14| 147|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 147|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 56| 147| vec256_sq(out, out); ------------------ | | 14| 147|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 147|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 57| 147| vec256_sq(out, out); ------------------ | | 14| 147|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 147|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 58| 147| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 147| vec256_sq(out, out); ------------------ | | 14| 147|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 147|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 61| 147| vec256_sq(out, out); ------------------ | | 14| 147|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 147|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 62| 147| vec256_sq(out, out); ------------------ | | 14| 147|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 147|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 63| 147| vec256_sq(out, out); ------------------ | | 14| 147|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 147|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 64| 147| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 147| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 147|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 147|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 67| 147|} OQS_KEM_efrodokem_640_aes_keypair: 19| 4|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 4| uint8_t *pk_seedA = &pk[0]; 23| 4| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 24| 4| uint8_t *sk_s = &sk[0]; 25| 4| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 26| 4| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 27| 4| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 28| 4| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 4| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 4| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 31| 4| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 4| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 4| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 34| 4| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 35| 4| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 4| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 4|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 39| 4| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 4| shake_input_seedSE[0] = 0x5F; 43| 4| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 44| 4| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 45| 40.9k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 40.9k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 40.9k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 40.9k, False: 4] ------------------ 46| 40.9k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 40.9k| #define LE_TO_UINT16(n) (n) ------------------ 47| 40.9k| } 48| 4| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 49| 4| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 50| 4| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 4|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_640_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 4| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 4|#define frodo_pack oqs_kem_efrodokem_640_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 4| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 57| 4| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 58| 20.4k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 20.4k, False: 4] ------------------ 59| 20.4k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 20.4k| #define UINT16_TO_LE(n) (n) ------------------ 60| 20.4k| } 61| 4| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 4| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 4| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 68| 4| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 69| 4| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 70| 4| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 71| 4| return OQS_SUCCESS; 72| 4|} OQS_KEM_efrodokem_640_aes_encaps: 86| 4|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 4| const uint8_t *pk_seedA = &pk[0]; 91| 4| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 92| 4| uint8_t *ct_c1 = &ct[0]; 93| 4| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 94| 4| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 4| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 4| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 4| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 4| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 4| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 100| 4| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 101| 4| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 4| uint8_t *pkh = &G2in[0]; 103| 4| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 104| 4| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 4| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 4| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 107| 4| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 4| uint8_t *Fin_ct = &Fin[0]; 109| 4| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ 110| 4| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 4| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 114| 4| randombytes(mu, BYTES_MU); ------------------ | | 26| 4|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 4|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 4| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 4|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 4| shake_input_seedSE[0] = 0x96; 119| 4| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 120| 4| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 121| 41.2k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 41.2k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 41.2k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 41.2k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 41.2k, False: 4] ------------------ 122| 41.2k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 41.2k| #define LE_TO_UINT16(n) (n) ------------------ 123| 41.2k| } 124| 4| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 125| 4| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 126| 4| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 4|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e ------------------ 127| 4| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 4|#define frodo_pack oqs_kem_efrodokem_640_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 4| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 131| 4| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 4|#define frodo_unpack oqs_kem_efrodokem_640_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 132| 4| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 4|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_640_aes_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 4| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 4|#define frodo_key_encode oqs_kem_efrodokem_640_aes_key_encode ------------------ 136| 4| frodo_add(C, V, C); ------------------ | | 53| 4|#define frodo_add oqs_kem_efrodokem_640_aes_add ------------------ 137| 4| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 4|#define frodo_pack oqs_kem_efrodokem_640_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 4| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ 141| 4| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 142| 4| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 4| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 146| 4| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 147| 4| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 148| 4| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 149| 4| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 4|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 4| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 151| 4| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 152| 4| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 153| 4| return OQS_SUCCESS; 154| 4|} OQS_KEM_efrodokem_640_aes_decaps: 158| 4|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 4| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 4| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 4| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 4| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 4| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 4| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 4| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 4| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 170| 4| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 171| 4| const uint8_t *ct_c1 = &ct[0]; 172| 4| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 173| 4| const uint8_t *sk_s = &sk[0]; 174| 4| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 175| 4| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 176| 4| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 4| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 178| 4| const uint8_t *pk_seedA = &sk_pk[0]; 179| 4| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 180| 4| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 4| uint8_t *pkh = &G2in[0]; 182| 4| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 183| 4| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 4| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 4| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 186| 4| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 4| uint8_t *Fin_ct = &Fin[0]; 188| 4| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ 189| 4| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 20.4k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 20.4k, False: 4] ------------------ 192| 20.4k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 20.4k| #define LE_TO_UINT16(n) (n) ------------------ 193| 20.4k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 4| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 4|#define frodo_unpack oqs_kem_efrodokem_640_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 197| 4| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 4|#define frodo_unpack oqs_kem_efrodokem_640_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 198| 4| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 4|#define frodo_mul_bs oqs_kem_efrodokem_640_aes_mul_bs ------------------ 199| 4| frodo_sub(W, C, W); ------------------ | | 54| 4|#define frodo_sub oqs_kem_efrodokem_640_aes_sub ------------------ 200| 4| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 4|#define frodo_key_decode oqs_kem_efrodokem_640_aes_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 4| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 204| 4| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 4|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 4| shake_input_seedSEprime[0] = 0x96; 208| 4| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 209| 4| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 210| 41.2k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 41.2k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 41.2k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 41.2k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 41.2k, False: 4] ------------------ 211| 41.2k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 41.2k| #define LE_TO_UINT16(n) (n) ------------------ 212| 41.2k| } 213| 4| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 214| 4| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 215| 4| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 4|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 4| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 219| 4| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 4|#define frodo_unpack oqs_kem_efrodokem_640_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 220| 4| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 4|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_640_aes_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 4| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 4|#define frodo_key_encode oqs_kem_efrodokem_640_aes_key_encode ------------------ 224| 4| frodo_add(CC, W, CC); ------------------ | | 53| 4|#define frodo_add oqs_kem_efrodokem_640_aes_add ------------------ 225| | 226| | // Prepare input to F 227| 4| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 20.4k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 20.4k|#define PARAMS_LOGQ 15 ------------------ | Branch (230:21): [True: 20.4k, False: 4] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 4| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 4|#define ct_verify oqs_kem_efrodokem_640_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 4|#define ct_verify oqs_kem_efrodokem_640_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 4| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 4|#define ct_select oqs_kem_efrodokem_640_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 236| 4| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 4| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 240| 4| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 241| 4| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 242| 4| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 243| 4| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 244| 4| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 4|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 4| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 246| 4| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 247| 4| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 248| 4| return OQS_SUCCESS; 249| 4|} OQS_KEM_efrodokem_640_shake_keypair: 19| 3|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 3| uint8_t *pk_seedA = &pk[0]; 23| 3| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 24| 3| uint8_t *sk_s = &sk[0]; 25| 3| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 26| 3| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 3|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 27| 3| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 3|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 28| 3| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 3| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 3| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 31| 3| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 3| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 3| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 34| 3| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 35| 3| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 3| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 3|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 39| 3| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 3|#define shake OQS_SHA3_shake128 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 3| shake_input_seedSE[0] = 0x5F; 43| 3| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 44| 3| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 3|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 45| 30.7k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 30.7k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 30.7k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 30.7k, False: 3] ------------------ 46| 30.7k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 30.7k| #define LE_TO_UINT16(n) (n) ------------------ 47| 30.7k| } 48| 3| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 3|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 49| 3| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 3|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 50| 3| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 3|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_640_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 3| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 3|#define frodo_pack oqs_kem_efrodokem_640_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 3|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 3| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 57| 3| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 3|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 58| 15.3k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 15.3k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 15.3k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 15.3k, False: 3] ------------------ 59| 15.3k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 15.3k| #define UINT16_TO_LE(n) (n) ------------------ 60| 15.3k| } 61| 3| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 3| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 3|#define shake OQS_SHA3_shake128 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 3|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 3| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 68| 3| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 69| 3| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 70| 3| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 71| 3| return OQS_SUCCESS; 72| 3|} OQS_KEM_efrodokem_640_shake_encaps: 86| 3|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 3| const uint8_t *pk_seedA = &pk[0]; 91| 3| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 92| 3| uint8_t *ct_c1 = &ct[0]; 93| 3| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 94| 3| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 3| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 3| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 3| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 3| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 3| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 100| 3| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 101| 3| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 3| uint8_t *pkh = &G2in[0]; 103| 3| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 104| 3| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 3| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 3| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 107| 3| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 3| uint8_t *Fin_ct = &Fin[0]; 109| 3| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 3|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ 110| 3| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 3| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 3|#define shake OQS_SHA3_shake128 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 3|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 114| 3| randombytes(mu, BYTES_MU); ------------------ | | 26| 3|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 3| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 3|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 3| shake_input_seedSE[0] = 0x96; 119| 3| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 120| 3| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 3|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 121| 30.9k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 30.9k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 30.9k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 30.9k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 30.9k, False: 3] ------------------ 122| 30.9k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 30.9k| #define LE_TO_UINT16(n) (n) ------------------ 123| 30.9k| } 124| 3| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 3|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 125| 3| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 3|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 126| 3| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 3|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e ------------------ 127| 3| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 3|#define frodo_pack oqs_kem_efrodokem_640_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 3| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 3|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 131| 3| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 3|#define frodo_unpack oqs_kem_efrodokem_640_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 3|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 132| 3| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 3|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_640_shake_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 3| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 3|#define frodo_key_encode oqs_kem_efrodokem_640_shake_key_encode ------------------ 136| 3| frodo_add(C, V, C); ------------------ | | 53| 3|#define frodo_add oqs_kem_efrodokem_640_shake_add ------------------ 137| 3| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 3|#define frodo_pack oqs_kem_efrodokem_640_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 3| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 3|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ 141| 3| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 142| 3| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 3|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 3|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 3| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 146| 3| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 147| 3| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 148| 3| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 149| 3| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 3| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 151| 3| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 152| 3| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 153| 3| return OQS_SUCCESS; 154| 3|} OQS_KEM_efrodokem_640_shake_decaps: 158| 3|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 3| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 3| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 3| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 3| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 3| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 3| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 3| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 3| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 170| 3| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 171| 3| const uint8_t *ct_c1 = &ct[0]; 172| 3| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 173| 3| const uint8_t *sk_s = &sk[0]; 174| 3| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 175| 3| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 3|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 176| 3| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 3| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 3|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 178| 3| const uint8_t *pk_seedA = &sk_pk[0]; 179| 3| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 180| 3| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 3| uint8_t *pkh = &G2in[0]; 182| 3| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 183| 3| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 3| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 3| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 186| 3| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 3| uint8_t *Fin_ct = &Fin[0]; 188| 3| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 3|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ 189| 3| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 15.3k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 15.3k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 15.3k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 15.3k, False: 3] ------------------ 192| 15.3k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 15.3k| #define LE_TO_UINT16(n) (n) ------------------ 193| 15.3k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 3| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 3|#define frodo_unpack oqs_kem_efrodokem_640_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 197| 3| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 3|#define frodo_unpack oqs_kem_efrodokem_640_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 198| 3| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 3|#define frodo_mul_bs oqs_kem_efrodokem_640_shake_mul_bs ------------------ 199| 3| frodo_sub(W, C, W); ------------------ | | 54| 3|#define frodo_sub oqs_kem_efrodokem_640_shake_sub ------------------ 200| 3| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 3|#define frodo_key_decode oqs_kem_efrodokem_640_shake_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 3| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 204| 3| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 3|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 3| shake_input_seedSEprime[0] = 0x96; 208| 3| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 209| 3| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 3|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 210| 30.9k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 30.9k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 30.9k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 30.9k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 30.9k, False: 3] ------------------ 211| 30.9k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 30.9k| #define LE_TO_UINT16(n) (n) ------------------ 212| 30.9k| } 213| 3| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 3|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 214| 3| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 3|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 215| 3| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 3|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 3| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 3|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 219| 3| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 3|#define frodo_unpack oqs_kem_efrodokem_640_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 3|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 220| 3| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 3|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_640_shake_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 3| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 3|#define frodo_key_encode oqs_kem_efrodokem_640_shake_key_encode ------------------ 224| 3| frodo_add(CC, W, CC); ------------------ | | 53| 3|#define frodo_add oqs_kem_efrodokem_640_shake_add ------------------ 225| | 226| | // Prepare input to F 227| 3| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 3|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 15.3k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 15.3k|#define PARAMS_N 640 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 15.3k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 15.3k|#define PARAMS_LOGQ 15 ------------------ | Branch (230:21): [True: 15.3k, False: 3] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 3| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 3|#define ct_verify oqs_kem_efrodokem_640_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 3|#define ct_verify oqs_kem_efrodokem_640_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 3| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 3|#define ct_select oqs_kem_efrodokem_640_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 236| 3| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 3|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 3|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 3| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 240| 3| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 241| 3| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 242| 3| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 243| 3| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 244| 3| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 3| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 246| 3| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 247| 3| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 248| 3| return OQS_SUCCESS; 249| 3|} OQS_KEM_efrodokem_976_aes_keypair: 19| 8|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 8| uint8_t *pk_seedA = &pk[0]; 23| 8| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 24| 8| uint8_t *sk_s = &sk[0]; 25| 8| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 26| 8| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 8|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 27| 8| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 8|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 28| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 8| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 8| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 31| 8| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 8| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 8| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 34| 8| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 35| 8| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 8| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 8|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 39| 8| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 8| shake_input_seedSE[0] = 0x5F; 43| 8| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 44| 8| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 45| 124k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 124k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 124k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 124k, False: 8] ------------------ 46| 124k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 124k| #define LE_TO_UINT16(n) (n) ------------------ 47| 124k| } 48| 8| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 49| 8| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 50| 8| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 8|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_976_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 8| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 8|#define frodo_pack oqs_kem_efrodokem_976_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 8|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 8| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 57| 8| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 8|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 58| 62.4k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 62.4k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 62.4k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 62.4k, False: 8] ------------------ 59| 62.4k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 62.4k| #define UINT16_TO_LE(n) (n) ------------------ 60| 62.4k| } 61| 8| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 8| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 8|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 8| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 68| 8| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 69| 8| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 70| 8| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 71| 8| return OQS_SUCCESS; 72| 8|} OQS_KEM_efrodokem_976_aes_encaps: 86| 8|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 8| const uint8_t *pk_seedA = &pk[0]; 91| 8| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 92| 8| uint8_t *ct_c1 = &ct[0]; 93| 8| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 94| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 8| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 8| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 8| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 8| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 8| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 100| 8| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 101| 8| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 8| uint8_t *pkh = &G2in[0]; 103| 8| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 104| 8| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 8| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 8| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 107| 8| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 8| uint8_t *Fin_ct = &Fin[0]; 109| 8| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 8|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ 110| 8| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 8| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 8|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 114| 8| randombytes(mu, BYTES_MU); ------------------ | | 26| 8|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 8| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 8| shake_input_seedSE[0] = 0x96; 119| 8| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 120| 8| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 121| 125k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 125k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 125k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 125k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 125k, False: 8] ------------------ 122| 125k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 125k| #define LE_TO_UINT16(n) (n) ------------------ 123| 125k| } 124| 8| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 125| 8| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 126| 8| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 8|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e ------------------ 127| 8| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 8|#define frodo_pack oqs_kem_efrodokem_976_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 8| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 131| 8| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_976_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 8|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 132| 8| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 8|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_976_aes_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 8| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 8|#define frodo_key_encode oqs_kem_efrodokem_976_aes_key_encode ------------------ 136| 8| frodo_add(C, V, C); ------------------ | | 53| 8|#define frodo_add oqs_kem_efrodokem_976_aes_add ------------------ 137| 8| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 8|#define frodo_pack oqs_kem_efrodokem_976_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 8| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 8|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ 141| 8| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 142| 8| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 8|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 8| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 146| 8| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 147| 8| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 148| 8| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 149| 8| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 8| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 151| 8| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 152| 8| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 153| 8| return OQS_SUCCESS; 154| 8|} OQS_KEM_efrodokem_976_aes_decaps: 158| 8|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 8| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 8| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 8| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 8| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 8| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 8| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 8| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 170| 8| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 171| 8| const uint8_t *ct_c1 = &ct[0]; 172| 8| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 173| 8| const uint8_t *sk_s = &sk[0]; 174| 8| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 175| 8| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 8|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 176| 8| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 8| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 8|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 178| 8| const uint8_t *pk_seedA = &sk_pk[0]; 179| 8| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 180| 8| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 8| uint8_t *pkh = &G2in[0]; 182| 8| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 183| 8| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 8| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 8| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 186| 8| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 8| uint8_t *Fin_ct = &Fin[0]; 188| 8| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 8|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ 189| 8| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 62.4k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 62.4k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 62.4k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 62.4k, False: 8] ------------------ 192| 62.4k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 62.4k| #define LE_TO_UINT16(n) (n) ------------------ 193| 62.4k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 8| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_976_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 197| 8| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_976_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 198| 8| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 8|#define frodo_mul_bs oqs_kem_efrodokem_976_aes_mul_bs ------------------ 199| 8| frodo_sub(W, C, W); ------------------ | | 54| 8|#define frodo_sub oqs_kem_efrodokem_976_aes_sub ------------------ 200| 8| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 8|#define frodo_key_decode oqs_kem_efrodokem_976_aes_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 8| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 204| 8| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 8| shake_input_seedSEprime[0] = 0x96; 208| 8| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 209| 8| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 210| 125k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 125k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 125k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 125k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 125k, False: 8] ------------------ 211| 125k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 125k| #define LE_TO_UINT16(n) (n) ------------------ 212| 125k| } 213| 8| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 214| 8| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 215| 8| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 8|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 8| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 219| 8| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_976_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 8|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 220| 8| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 8|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_976_aes_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 8| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 8|#define frodo_key_encode oqs_kem_efrodokem_976_aes_key_encode ------------------ 224| 8| frodo_add(CC, W, CC); ------------------ | | 53| 8|#define frodo_add oqs_kem_efrodokem_976_aes_add ------------------ 225| | 226| | // Prepare input to F 227| 8| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 8|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 62.4k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 62.4k|#define PARAMS_N 976 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 62.4k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 62.4k|#define PARAMS_LOGQ 16 ------------------ | Branch (230:21): [True: 62.4k, False: 8] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 8| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 8|#define ct_verify oqs_kem_efrodokem_976_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 8|#define ct_verify oqs_kem_efrodokem_976_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 8| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 8|#define ct_select oqs_kem_efrodokem_976_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 236| 8| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 8|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 8| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 240| 8| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 241| 8| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 242| 8| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 243| 8| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 244| 8| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 8| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 246| 8| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 247| 8| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 248| 8| return OQS_SUCCESS; 249| 8|} OQS_KEM_efrodokem_976_shake_keypair: 19| 8|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 8| uint8_t *pk_seedA = &pk[0]; 23| 8| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 24| 8| uint8_t *sk_s = &sk[0]; 25| 8| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 26| 8| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 27| 8| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 28| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 8| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 8| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 31| 8| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 8| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 8| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 34| 8| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 35| 8| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 8| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 8|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 39| 8| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 8| shake_input_seedSE[0] = 0x5F; 43| 8| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 44| 8| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 45| 124k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 124k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 124k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 124k, False: 8] ------------------ 46| 124k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 124k| #define LE_TO_UINT16(n) (n) ------------------ 47| 124k| } 48| 8| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 49| 8| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 50| 8| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 8|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_976_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 8| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 8|#define frodo_pack oqs_kem_efrodokem_976_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 8| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 57| 8| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 58| 62.4k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 62.4k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 62.4k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 62.4k, False: 8] ------------------ 59| 62.4k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 62.4k| #define UINT16_TO_LE(n) (n) ------------------ 60| 62.4k| } 61| 8| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 8| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 8| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 68| 8| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 69| 8| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 70| 8| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 71| 8| return OQS_SUCCESS; 72| 8|} OQS_KEM_efrodokem_976_shake_encaps: 86| 8|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 8| const uint8_t *pk_seedA = &pk[0]; 91| 8| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 92| 8| uint8_t *ct_c1 = &ct[0]; 93| 8| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 94| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 8| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 8| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 8| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 8| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 8| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 100| 8| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 101| 8| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 8| uint8_t *pkh = &G2in[0]; 103| 8| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 104| 8| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 8| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 8| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 107| 8| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 8| uint8_t *Fin_ct = &Fin[0]; 109| 8| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 8|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ 110| 8| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 8| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 114| 8| randombytes(mu, BYTES_MU); ------------------ | | 26| 8|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 8| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 8| shake_input_seedSE[0] = 0x96; 119| 8| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 120| 8| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 121| 125k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 125k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 125k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 125k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 125k, False: 8] ------------------ 122| 125k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 125k| #define LE_TO_UINT16(n) (n) ------------------ 123| 125k| } 124| 8| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 125| 8| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 126| 8| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 8|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e ------------------ 127| 8| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 8|#define frodo_pack oqs_kem_efrodokem_976_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 8| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 131| 8| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_976_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 132| 8| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 8|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_976_shake_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 8| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 8|#define frodo_key_encode oqs_kem_efrodokem_976_shake_key_encode ------------------ 136| 8| frodo_add(C, V, C); ------------------ | | 53| 8|#define frodo_add oqs_kem_efrodokem_976_shake_add ------------------ 137| 8| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 8|#define frodo_pack oqs_kem_efrodokem_976_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 8| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 8|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ 141| 8| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 142| 8| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 8|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 8| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 146| 8| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 147| 8| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 148| 8| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 149| 8| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 8| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 151| 8| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 152| 8| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 153| 8| return OQS_SUCCESS; 154| 8|} OQS_KEM_efrodokem_976_shake_decaps: 158| 8|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 8| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 8| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 8| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 8| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 8| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 8| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 8| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 170| 8| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 171| 8| const uint8_t *ct_c1 = &ct[0]; 172| 8| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 173| 8| const uint8_t *sk_s = &sk[0]; 174| 8| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 175| 8| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 176| 8| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 8| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 178| 8| const uint8_t *pk_seedA = &sk_pk[0]; 179| 8| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 180| 8| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 8| uint8_t *pkh = &G2in[0]; 182| 8| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 183| 8| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 8| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 8| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 186| 8| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 8| uint8_t *Fin_ct = &Fin[0]; 188| 8| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 8|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ 189| 8| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 62.4k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 62.4k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 62.4k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 62.4k, False: 8] ------------------ 192| 62.4k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 62.4k| #define LE_TO_UINT16(n) (n) ------------------ 193| 62.4k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 8| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_976_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 197| 8| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_976_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 198| 8| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 8|#define frodo_mul_bs oqs_kem_efrodokem_976_shake_mul_bs ------------------ 199| 8| frodo_sub(W, C, W); ------------------ | | 54| 8|#define frodo_sub oqs_kem_efrodokem_976_shake_sub ------------------ 200| 8| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 8|#define frodo_key_decode oqs_kem_efrodokem_976_shake_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 8| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 204| 8| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 8| shake_input_seedSEprime[0] = 0x96; 208| 8| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 209| 8| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 210| 125k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 125k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 125k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 125k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 125k, False: 8] ------------------ 211| 125k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 125k| #define LE_TO_UINT16(n) (n) ------------------ 212| 125k| } 213| 8| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 214| 8| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 215| 8| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 8|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 8| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 219| 8| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_976_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 220| 8| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 8|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_976_shake_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 8| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 8|#define frodo_key_encode oqs_kem_efrodokem_976_shake_key_encode ------------------ 224| 8| frodo_add(CC, W, CC); ------------------ | | 53| 8|#define frodo_add oqs_kem_efrodokem_976_shake_add ------------------ 225| | 226| | // Prepare input to F 227| 8| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 8|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 62.4k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 62.4k|#define PARAMS_N 976 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 62.4k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 62.4k|#define PARAMS_LOGQ 16 ------------------ | Branch (230:21): [True: 62.4k, False: 8] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 8| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 8|#define ct_verify oqs_kem_efrodokem_976_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 8|#define ct_verify oqs_kem_efrodokem_976_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 8| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 8|#define ct_select oqs_kem_efrodokem_976_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 236| 8| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 8|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 8| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 240| 8| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 241| 8| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 242| 8| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 243| 8| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 244| 8| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 8| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 246| 8| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 247| 8| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 248| 8| return OQS_SUCCESS; 249| 8|} OQS_KEM_efrodokem_1344_aes_keypair: 19| 8|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 8| uint8_t *pk_seedA = &pk[0]; 23| 8| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 24| 8| uint8_t *sk_s = &sk[0]; 25| 8| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 26| 8| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 27| 8| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 28| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 8| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 8| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 31| 8| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 8| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 8| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 34| 8| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 35| 8| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 8| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 8|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 39| 8| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 8| shake_input_seedSE[0] = 0x5F; 43| 8| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 44| 8| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 45| 172k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 172k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 172k, False: 8] ------------------ 46| 172k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 172k| #define LE_TO_UINT16(n) (n) ------------------ 47| 172k| } 48| 8| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 49| 8| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 50| 8| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 8|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_1344_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 8| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 8|#define frodo_pack oqs_kem_efrodokem_1344_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 8| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 57| 8| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 58| 86.0k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 86.0k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 86.0k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 86.0k, False: 8] ------------------ 59| 86.0k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 86.0k| #define UINT16_TO_LE(n) (n) ------------------ 60| 86.0k| } 61| 8| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 8| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 8| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 68| 8| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 69| 8| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 70| 8| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 71| 8| return OQS_SUCCESS; 72| 8|} OQS_KEM_efrodokem_1344_aes_encaps: 86| 8|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 8| const uint8_t *pk_seedA = &pk[0]; 91| 8| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 92| 8| uint8_t *ct_c1 = &ct[0]; 93| 8| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 94| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 8| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 8| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 8| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 8| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 8| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 100| 8| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 101| 8| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 8| uint8_t *pkh = &G2in[0]; 103| 8| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 104| 8| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 8| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 8| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 107| 8| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 8| uint8_t *Fin_ct = &Fin[0]; 109| 8| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 8|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ 110| 8| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 8| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 114| 8| randombytes(mu, BYTES_MU); ------------------ | | 26| 8|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 8| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 8| shake_input_seedSE[0] = 0x96; 119| 8| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 120| 8| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 121| 172k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 172k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 172k, False: 8] ------------------ 122| 172k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 172k| #define LE_TO_UINT16(n) (n) ------------------ 123| 172k| } 124| 8| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 125| 8| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 126| 8| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 8|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e ------------------ 127| 8| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 8|#define frodo_pack oqs_kem_efrodokem_1344_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 8| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 131| 8| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_1344_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 132| 8| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 8|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_1344_aes_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 8| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 8|#define frodo_key_encode oqs_kem_efrodokem_1344_aes_key_encode ------------------ 136| 8| frodo_add(C, V, C); ------------------ | | 53| 8|#define frodo_add oqs_kem_efrodokem_1344_aes_add ------------------ 137| 8| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 8|#define frodo_pack oqs_kem_efrodokem_1344_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 8| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 8|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ 141| 8| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 142| 8| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 8|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 8| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 146| 8| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 147| 8| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 148| 8| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 149| 8| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 8| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 151| 8| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 152| 8| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 153| 8| return OQS_SUCCESS; 154| 8|} OQS_KEM_efrodokem_1344_aes_decaps: 158| 8|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 8| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 8| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 8| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 8| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 8| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 8| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 8| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 170| 8| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 171| 8| const uint8_t *ct_c1 = &ct[0]; 172| 8| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 173| 8| const uint8_t *sk_s = &sk[0]; 174| 8| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 175| 8| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 176| 8| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 8| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 178| 8| const uint8_t *pk_seedA = &sk_pk[0]; 179| 8| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 180| 8| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 8| uint8_t *pkh = &G2in[0]; 182| 8| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 183| 8| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 8| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 8| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 186| 8| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 8| uint8_t *Fin_ct = &Fin[0]; 188| 8| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 8|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ 189| 8| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 86.0k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 86.0k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 86.0k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 86.0k, False: 8] ------------------ 192| 86.0k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 86.0k| #define LE_TO_UINT16(n) (n) ------------------ 193| 86.0k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 8| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_1344_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 197| 8| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_1344_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 198| 8| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 8|#define frodo_mul_bs oqs_kem_efrodokem_1344_aes_mul_bs ------------------ 199| 8| frodo_sub(W, C, W); ------------------ | | 54| 8|#define frodo_sub oqs_kem_efrodokem_1344_aes_sub ------------------ 200| 8| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 8|#define frodo_key_decode oqs_kem_efrodokem_1344_aes_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 8| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 204| 8| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 8| shake_input_seedSEprime[0] = 0x96; 208| 8| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 209| 8| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 210| 172k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 172k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 172k, False: 8] ------------------ 211| 172k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 172k| #define LE_TO_UINT16(n) (n) ------------------ 212| 172k| } 213| 8| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 214| 8| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 215| 8| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 8|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 8| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 219| 8| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_1344_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 220| 8| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 8|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_1344_aes_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 8| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 8|#define frodo_key_encode oqs_kem_efrodokem_1344_aes_key_encode ------------------ 224| 8| frodo_add(CC, W, CC); ------------------ | | 53| 8|#define frodo_add oqs_kem_efrodokem_1344_aes_add ------------------ 225| | 226| | // Prepare input to F 227| 8| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 8|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 86.0k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 86.0k|#define PARAMS_N 1344 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 86.0k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 86.0k|#define PARAMS_LOGQ 16 ------------------ | Branch (230:21): [True: 86.0k, False: 8] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 8| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 8|#define ct_verify oqs_kem_efrodokem_1344_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 8|#define ct_verify oqs_kem_efrodokem_1344_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 8| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 8|#define ct_select oqs_kem_efrodokem_1344_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 236| 8| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 8|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 8| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 240| 8| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 241| 8| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 242| 8| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 243| 8| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 244| 8| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 8| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 246| 8| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 247| 8| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 248| 8| return OQS_SUCCESS; 249| 8|} OQS_KEM_efrodokem_1344_shake_keypair: 19| 3|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 3| uint8_t *pk_seedA = &pk[0]; 23| 3| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 24| 3| uint8_t *sk_s = &sk[0]; 25| 3| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 26| 3| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 3|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 27| 3| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 3|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 28| 3| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 3| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 3| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 31| 3| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 3| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 3| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 34| 3| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 35| 3| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 3| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 3|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 39| 3| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 3|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 3| shake_input_seedSE[0] = 0x5F; 43| 3| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 44| 3| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 3|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 45| 64.5k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 64.5k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 64.5k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 64.5k, False: 3] ------------------ 46| 64.5k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 64.5k| #define LE_TO_UINT16(n) (n) ------------------ 47| 64.5k| } 48| 3| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 3|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 49| 3| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 3|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 50| 3| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 3|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_1344_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 3| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 3|#define frodo_pack oqs_kem_efrodokem_1344_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 3|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 3| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 57| 3| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 3|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 58| 32.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 32.2k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 32.2k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 32.2k, False: 3] ------------------ 59| 32.2k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 32.2k| #define UINT16_TO_LE(n) (n) ------------------ 60| 32.2k| } 61| 3| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 3| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 3|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 3|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 3| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 68| 3| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 69| 3| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 70| 3| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 71| 3| return OQS_SUCCESS; 72| 3|} OQS_KEM_efrodokem_1344_shake_encaps: 86| 3|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 3| const uint8_t *pk_seedA = &pk[0]; 91| 3| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 92| 3| uint8_t *ct_c1 = &ct[0]; 93| 3| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 3|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 94| 3| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 3| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 3| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 3| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 3| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 3| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 100| 3| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 101| 3| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 3| uint8_t *pkh = &G2in[0]; 103| 3| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 104| 3| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 3| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 3| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 107| 3| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 3| uint8_t *Fin_ct = &Fin[0]; 109| 3| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 3|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ 110| 3| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 3| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 3|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 3|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 114| 3| randombytes(mu, BYTES_MU); ------------------ | | 26| 3|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 3| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 3|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 3| shake_input_seedSE[0] = 0x96; 119| 3| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 120| 3| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 3|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 121| 64.7k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 64.7k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 64.7k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 64.7k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 64.7k, False: 3] ------------------ 122| 64.7k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 64.7k| #define LE_TO_UINT16(n) (n) ------------------ 123| 64.7k| } 124| 3| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 3|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 125| 3| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 3|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 126| 3| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 3|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e ------------------ 127| 3| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 3|#define frodo_pack oqs_kem_efrodokem_1344_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 16 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 3| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 3|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 131| 3| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 3|#define frodo_unpack oqs_kem_efrodokem_1344_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 3|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 16 ------------------ 132| 3| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 3|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_1344_shake_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 3| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 3|#define frodo_key_encode oqs_kem_efrodokem_1344_shake_key_encode ------------------ 136| 3| frodo_add(C, V, C); ------------------ | | 53| 3|#define frodo_add oqs_kem_efrodokem_1344_shake_add ------------------ 137| 3| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 3|#define frodo_pack oqs_kem_efrodokem_1344_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 16 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 3| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 3|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ 141| 3| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 142| 3| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 3|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 3|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 3| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 146| 3| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 147| 3| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 148| 3| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 149| 3| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 3| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 151| 3| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 152| 3| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 153| 3| return OQS_SUCCESS; 154| 3|} OQS_KEM_efrodokem_1344_shake_decaps: 158| 3|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 3| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 3| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 3| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 3| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 3| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 3| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 3| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 3| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 170| 3| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 171| 3| const uint8_t *ct_c1 = &ct[0]; 172| 3| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 3|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 173| 3| const uint8_t *sk_s = &sk[0]; 174| 3| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 175| 3| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 3|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 176| 3| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 3| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 3|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 178| 3| const uint8_t *pk_seedA = &sk_pk[0]; 179| 3| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 180| 3| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 3| uint8_t *pkh = &G2in[0]; 182| 3| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 183| 3| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 3| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 3| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 186| 3| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 3| uint8_t *Fin_ct = &Fin[0]; 188| 3| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 3|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ 189| 3| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 32.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 32.2k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 32.2k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 32.2k, False: 3] ------------------ 192| 32.2k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 32.2k| #define LE_TO_UINT16(n) (n) ------------------ 193| 32.2k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 3| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 3|#define frodo_unpack oqs_kem_efrodokem_1344_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 16 ------------------ 197| 3| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 3|#define frodo_unpack oqs_kem_efrodokem_1344_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 16 ------------------ 198| 3| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 3|#define frodo_mul_bs oqs_kem_efrodokem_1344_shake_mul_bs ------------------ 199| 3| frodo_sub(W, C, W); ------------------ | | 54| 3|#define frodo_sub oqs_kem_efrodokem_1344_shake_sub ------------------ 200| 3| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 3|#define frodo_key_decode oqs_kem_efrodokem_1344_shake_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 3| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 204| 3| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 3|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 3| shake_input_seedSEprime[0] = 0x96; 208| 3| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 209| 3| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 3|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 210| 64.7k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 64.7k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 64.7k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 64.7k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 64.7k, False: 3] ------------------ 211| 64.7k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 64.7k| #define LE_TO_UINT16(n) (n) ------------------ 212| 64.7k| } 213| 3| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 3|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 214| 3| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 3|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 215| 3| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 3|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 3| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 3|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 219| 3| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 3|#define frodo_unpack oqs_kem_efrodokem_1344_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 3|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 16 ------------------ 220| 3| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 3|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_1344_shake_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 3| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 3|#define frodo_key_encode oqs_kem_efrodokem_1344_shake_key_encode ------------------ 224| 3| frodo_add(CC, W, CC); ------------------ | | 53| 3|#define frodo_add oqs_kem_efrodokem_1344_shake_add ------------------ 225| | 226| | // Prepare input to F 227| 3| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 3|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 32.2k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 32.2k|#define PARAMS_N 1344 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 32.2k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 32.2k|#define PARAMS_LOGQ 16 ------------------ | Branch (230:21): [True: 32.2k, False: 3] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 3| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 3|#define ct_verify oqs_kem_efrodokem_1344_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 3|#define ct_verify oqs_kem_efrodokem_1344_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 3| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 3|#define ct_select oqs_kem_efrodokem_1344_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 236| 3| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 3|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 3|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 3| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 240| 3| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 241| 3| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 242| 3| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 243| 3| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 244| 3| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 3| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 246| 3| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 247| 3| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 248| 3| return OQS_SUCCESS; 249| 3|} OQS_KEM_frodokem_640_aes_keypair: 19| 2|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 2| uint8_t *pk_seedA = &pk[0]; 23| 2| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 24| 2| uint8_t *sk_s = &sk[0]; 25| 2| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 26| 2| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 27| 2| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 28| 2| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 2| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 2| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 31| 2| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 2| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 2| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 34| 2| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 35| 2| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 2| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 2|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 39| 2| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 2| shake_input_seedSE[0] = 0x5F; 43| 2| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 44| 2| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 45| 20.4k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 20.4k, False: 2] ------------------ 46| 20.4k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 20.4k| #define LE_TO_UINT16(n) (n) ------------------ 47| 20.4k| } 48| 2| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 49| 2| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 50| 2| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 2|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_640_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 2| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 2|#define frodo_pack oqs_kem_frodokem_640_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 2| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 57| 2| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 58| 10.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 10.2k, False: 2] ------------------ 59| 10.2k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 10.2k| #define UINT16_TO_LE(n) (n) ------------------ 60| 10.2k| } 61| 2| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 2| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 2| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 68| 2| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 69| 2| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 70| 2| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 71| 2| return OQS_SUCCESS; 72| 2|} OQS_KEM_frodokem_640_aes_encaps: 86| 2|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 2| const uint8_t *pk_seedA = &pk[0]; 91| 2| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 92| 2| uint8_t *ct_c1 = &ct[0]; 93| 2| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 94| 2| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 2| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 2| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 2| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 2| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 2| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 100| 2| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 101| 2| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 2| uint8_t *pkh = &G2in[0]; 103| 2| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 104| 2| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 2| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 2| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 2| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 108| 2| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 2| uint8_t *Fin_ct = &Fin[0]; 110| 2| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ 111| 2| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 2| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 115| 2| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 2|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 116| 2| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 2| shake_input_seedSE[0] = 0x96; 120| 2| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 121| 2| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 122| 20.6k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 20.6k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 20.6k, False: 2] ------------------ 123| 20.6k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 20.6k| #define LE_TO_UINT16(n) (n) ------------------ 124| 20.6k| } 125| 2| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 126| 2| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 127| 2| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 2|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_640_aes_mul_add_sa_plus_e ------------------ 128| 2| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 2|#define frodo_pack oqs_kem_frodokem_640_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 2| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 132| 2| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 2|#define frodo_unpack oqs_kem_frodokem_640_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 133| 2| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 2|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_640_aes_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 2| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 2|#define frodo_key_encode oqs_kem_frodokem_640_aes_key_encode ------------------ 137| 2| frodo_add(C, V, C); ------------------ | | 55| 2|#define frodo_add oqs_kem_frodokem_640_aes_add ------------------ 138| 2| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 2|#define frodo_pack oqs_kem_frodokem_640_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 2| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 142| 2| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ 143| 2| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 144| 2| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 2| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 148| 2| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 149| 2| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 150| 2| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 151| 2| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 2| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 153| 2| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 154| 2| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 155| 2| return OQS_SUCCESS; 156| 2|} OQS_KEM_frodokem_640_aes_decaps: 160| 2|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 2| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 2| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 2| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 2| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 2| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 2| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 2| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 2| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 172| 2| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 173| 2| const uint8_t *ct_c1 = &ct[0]; 174| 2| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 175| 2| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 176| 2| const uint8_t *sk_s = &sk[0]; 177| 2| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 178| 2| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 179| 2| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 2| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 181| 2| const uint8_t *pk_seedA = &sk_pk[0]; 182| 2| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 183| 2| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 2| uint8_t *pkh = &G2in[0]; 185| 2| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 186| 2| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 2| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 2| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 2| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 190| 2| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 2| uint8_t *Fin_ct = &Fin[0]; 192| 2| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ 193| 2| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 10.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 10.2k, False: 2] ------------------ 197| 10.2k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 10.2k| #define LE_TO_UINT16(n) (n) ------------------ 198| 10.2k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 2| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 2|#define frodo_unpack oqs_kem_frodokem_640_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 202| 2| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 2|#define frodo_unpack oqs_kem_frodokem_640_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 203| 2| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 2|#define frodo_mul_bs oqs_kem_frodokem_640_aes_mul_bs ------------------ 204| 2| frodo_sub(W, C, W); ------------------ | | 56| 2|#define frodo_sub oqs_kem_frodokem_640_aes_sub ------------------ 205| 2| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 2|#define frodo_key_decode oqs_kem_frodokem_640_aes_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 2| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 209| 2| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 210| 2| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 2| shake_input_seedSEprime[0] = 0x96; 214| 2| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 215| 2| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 216| 20.6k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 20.6k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 20.6k, False: 2] ------------------ 217| 20.6k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 20.6k| #define LE_TO_UINT16(n) (n) ------------------ 218| 20.6k| } 219| 2| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 220| 2| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 221| 2| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 2|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_640_aes_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 2| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 225| 2| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 2|#define frodo_unpack oqs_kem_frodokem_640_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 226| 2| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 2|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_640_aes_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 2| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 2|#define frodo_key_encode oqs_kem_frodokem_640_aes_key_encode ------------------ 230| 2| frodo_add(CC, W, CC); ------------------ | | 55| 2|#define frodo_add oqs_kem_frodokem_640_aes_add ------------------ 231| | 232| | // Prepare input to F 233| 2| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 10.2k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 10.2k|#define PARAMS_LOGQ 15 ------------------ | Branch (236:21): [True: 10.2k, False: 2] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 2| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 2|#define ct_verify oqs_kem_frodokem_640_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 2|#define ct_verify oqs_kem_frodokem_640_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 2| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 2|#define ct_select oqs_kem_frodokem_640_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 242| 2| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 2| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 246| 2| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 247| 2| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 248| 2| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 249| 2| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 250| 2| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 2| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 252| 2| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 253| 2| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 254| 2| return OQS_SUCCESS; 255| 2|} OQS_KEM_frodokem_640_shake_keypair: 19| 3|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 3| uint8_t *pk_seedA = &pk[0]; 23| 3| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 24| 3| uint8_t *sk_s = &sk[0]; 25| 3| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 26| 3| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 27| 3| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 28| 3| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 3| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 3| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 31| 3| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 3| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 3| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 34| 3| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 35| 3| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 3| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 3|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 39| 3| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 3| shake_input_seedSE[0] = 0x5F; 43| 3| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 44| 3| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 45| 30.7k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 30.7k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 30.7k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 30.7k, False: 3] ------------------ 46| 30.7k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 30.7k| #define LE_TO_UINT16(n) (n) ------------------ 47| 30.7k| } 48| 3| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 49| 3| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 50| 3| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 3|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_640_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 3| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 3|#define frodo_pack oqs_kem_frodokem_640_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 3| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 57| 3| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 58| 15.3k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 15.3k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 15.3k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 15.3k, False: 3] ------------------ 59| 15.3k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 15.3k| #define UINT16_TO_LE(n) (n) ------------------ 60| 15.3k| } 61| 3| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 3| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 3| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 68| 3| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 69| 3| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 70| 3| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 71| 3| return OQS_SUCCESS; 72| 3|} OQS_KEM_frodokem_640_shake_encaps: 86| 3|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 3| const uint8_t *pk_seedA = &pk[0]; 91| 3| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 92| 3| uint8_t *ct_c1 = &ct[0]; 93| 3| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 94| 3| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 3| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 3| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 3| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 3| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 3| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 100| 3| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 101| 3| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 3| uint8_t *pkh = &G2in[0]; 103| 3| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 104| 3| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 3| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 3| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 3| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 108| 3| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 3| uint8_t *Fin_ct = &Fin[0]; 110| 3| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ 111| 3| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 3| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 115| 3| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 3|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 116| 3| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 3| shake_input_seedSE[0] = 0x96; 120| 3| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 121| 3| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 122| 30.9k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 30.9k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 30.9k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 30.9k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 30.9k, False: 3] ------------------ 123| 30.9k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 30.9k| #define LE_TO_UINT16(n) (n) ------------------ 124| 30.9k| } 125| 3| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 126| 3| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 127| 3| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 3|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_640_shake_mul_add_sa_plus_e ------------------ 128| 3| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 3|#define frodo_pack oqs_kem_frodokem_640_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 3| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 132| 3| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 3|#define frodo_unpack oqs_kem_frodokem_640_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 133| 3| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 3|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_640_shake_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 3| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 3|#define frodo_key_encode oqs_kem_frodokem_640_shake_key_encode ------------------ 137| 3| frodo_add(C, V, C); ------------------ | | 55| 3|#define frodo_add oqs_kem_frodokem_640_shake_add ------------------ 138| 3| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 3|#define frodo_pack oqs_kem_frodokem_640_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 3| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 142| 3| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ 143| 3| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 144| 3| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 3| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 148| 3| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 149| 3| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 150| 3| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 151| 3| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 3| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 153| 3| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 154| 3| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 155| 3| return OQS_SUCCESS; 156| 3|} OQS_KEM_frodokem_640_shake_decaps: 160| 3|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 3| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 3| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 3| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 3| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 3| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 3| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 3| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 3| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 172| 3| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 173| 3| const uint8_t *ct_c1 = &ct[0]; 174| 3| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 175| 3| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 176| 3| const uint8_t *sk_s = &sk[0]; 177| 3| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 178| 3| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 179| 3| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 3| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 181| 3| const uint8_t *pk_seedA = &sk_pk[0]; 182| 3| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 183| 3| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 3| uint8_t *pkh = &G2in[0]; 185| 3| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 186| 3| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 3| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 3| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 3| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 190| 3| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 3| uint8_t *Fin_ct = &Fin[0]; 192| 3| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ 193| 3| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 15.3k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 15.3k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 15.3k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 15.3k, False: 3] ------------------ 197| 15.3k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 15.3k| #define LE_TO_UINT16(n) (n) ------------------ 198| 15.3k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 3| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 3|#define frodo_unpack oqs_kem_frodokem_640_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 202| 3| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 3|#define frodo_unpack oqs_kem_frodokem_640_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 203| 3| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 3|#define frodo_mul_bs oqs_kem_frodokem_640_shake_mul_bs ------------------ 204| 3| frodo_sub(W, C, W); ------------------ | | 56| 3|#define frodo_sub oqs_kem_frodokem_640_shake_sub ------------------ 205| 3| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 3|#define frodo_key_decode oqs_kem_frodokem_640_shake_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 3| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 209| 3| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 210| 3| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 3| shake_input_seedSEprime[0] = 0x96; 214| 3| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 215| 3| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 216| 30.9k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 30.9k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 30.9k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 30.9k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 30.9k, False: 3] ------------------ 217| 30.9k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 30.9k| #define LE_TO_UINT16(n) (n) ------------------ 218| 30.9k| } 219| 3| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 220| 3| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 221| 3| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 3|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_640_shake_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 3| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 225| 3| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 3|#define frodo_unpack oqs_kem_frodokem_640_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 226| 3| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 3|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_640_shake_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 3| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 3|#define frodo_key_encode oqs_kem_frodokem_640_shake_key_encode ------------------ 230| 3| frodo_add(CC, W, CC); ------------------ | | 55| 3|#define frodo_add oqs_kem_frodokem_640_shake_add ------------------ 231| | 232| | // Prepare input to F 233| 3| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 15.3k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 15.3k|#define PARAMS_N 640 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 15.3k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 15.3k|#define PARAMS_LOGQ 15 ------------------ | Branch (236:21): [True: 15.3k, False: 3] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 3| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 3|#define ct_verify oqs_kem_frodokem_640_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 3|#define ct_verify oqs_kem_frodokem_640_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 3| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 3|#define ct_select oqs_kem_frodokem_640_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 242| 3| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 3| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 246| 3| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 247| 3| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 248| 3| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 249| 3| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 250| 3| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 3| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 252| 3| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 253| 3| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 254| 3| return OQS_SUCCESS; 255| 3|} OQS_KEM_frodokem_976_aes_keypair: 19| 9|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 9| uint8_t *pk_seedA = &pk[0]; 23| 9| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 24| 9| uint8_t *sk_s = &sk[0]; 25| 9| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 26| 9| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 27| 9| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 28| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 9| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 9| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 31| 9| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 9| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 9| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 34| 9| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 35| 9| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 9| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 9|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 39| 9| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 9| shake_input_seedSE[0] = 0x5F; 43| 9| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 44| 9| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 45| 140k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 140k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 140k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 140k, False: 9] ------------------ 46| 140k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 140k| #define LE_TO_UINT16(n) (n) ------------------ 47| 140k| } 48| 9| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 49| 9| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 50| 9| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 9|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_976_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 9| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 9|#define frodo_pack oqs_kem_frodokem_976_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 9| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 57| 9| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 58| 70.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 70.2k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 70.2k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 70.2k, False: 9] ------------------ 59| 70.2k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 70.2k| #define UINT16_TO_LE(n) (n) ------------------ 60| 70.2k| } 61| 9| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 9| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 9| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 68| 9| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 69| 9| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 70| 9| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 71| 9| return OQS_SUCCESS; 72| 9|} OQS_KEM_frodokem_976_aes_encaps: 86| 9|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 9| const uint8_t *pk_seedA = &pk[0]; 91| 9| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 92| 9| uint8_t *ct_c1 = &ct[0]; 93| 9| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 94| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 9| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 9| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 9| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 9| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 9| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 100| 9| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 101| 9| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 9| uint8_t *pkh = &G2in[0]; 103| 9| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 104| 9| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 9| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 9| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 9| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 108| 9| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 9| uint8_t *Fin_ct = &Fin[0]; 110| 9| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ 111| 9| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 9| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 115| 9| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 9|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 116| 9| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 9| shake_input_seedSE[0] = 0x96; 120| 9| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 121| 9| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 122| 141k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 141k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 141k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 141k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 141k, False: 9] ------------------ 123| 141k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 141k| #define LE_TO_UINT16(n) (n) ------------------ 124| 141k| } 125| 9| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 126| 9| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 127| 9| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 9|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_976_aes_mul_add_sa_plus_e ------------------ 128| 9| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 9|#define frodo_pack oqs_kem_frodokem_976_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 9| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 132| 9| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_976_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 133| 9| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 9|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_976_aes_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 9| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 9|#define frodo_key_encode oqs_kem_frodokem_976_aes_key_encode ------------------ 137| 9| frodo_add(C, V, C); ------------------ | | 55| 9|#define frodo_add oqs_kem_frodokem_976_aes_add ------------------ 138| 9| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 9|#define frodo_pack oqs_kem_frodokem_976_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 9| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 142| 9| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ 143| 9| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 144| 9| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 9| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 148| 9| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 149| 9| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 150| 9| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 151| 9| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 9| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 153| 9| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 154| 9| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 155| 9| return OQS_SUCCESS; 156| 9|} OQS_KEM_frodokem_976_aes_decaps: 160| 9|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 9| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 9| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 9| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 9| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 9| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 9| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 9| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 172| 9| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 173| 9| const uint8_t *ct_c1 = &ct[0]; 174| 9| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 175| 9| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 176| 9| const uint8_t *sk_s = &sk[0]; 177| 9| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 178| 9| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 179| 9| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 9| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 181| 9| const uint8_t *pk_seedA = &sk_pk[0]; 182| 9| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 183| 9| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 9| uint8_t *pkh = &G2in[0]; 185| 9| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 186| 9| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 9| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 9| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 9| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 190| 9| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 9| uint8_t *Fin_ct = &Fin[0]; 192| 9| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ 193| 9| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 70.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 70.2k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 70.2k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 70.2k, False: 9] ------------------ 197| 70.2k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 70.2k| #define LE_TO_UINT16(n) (n) ------------------ 198| 70.2k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 9| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_976_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 202| 9| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_976_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 203| 9| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 9|#define frodo_mul_bs oqs_kem_frodokem_976_aes_mul_bs ------------------ 204| 9| frodo_sub(W, C, W); ------------------ | | 56| 9|#define frodo_sub oqs_kem_frodokem_976_aes_sub ------------------ 205| 9| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 9|#define frodo_key_decode oqs_kem_frodokem_976_aes_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 9| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 209| 9| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 210| 9| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 9| shake_input_seedSEprime[0] = 0x96; 214| 9| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 215| 9| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 216| 141k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 141k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 141k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 141k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 141k, False: 9] ------------------ 217| 141k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 141k| #define LE_TO_UINT16(n) (n) ------------------ 218| 141k| } 219| 9| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 220| 9| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 221| 9| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 9|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_976_aes_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 9| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 225| 9| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_976_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 226| 9| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 9|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_976_aes_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 9| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 9|#define frodo_key_encode oqs_kem_frodokem_976_aes_key_encode ------------------ 230| 9| frodo_add(CC, W, CC); ------------------ | | 55| 9|#define frodo_add oqs_kem_frodokem_976_aes_add ------------------ 231| | 232| | // Prepare input to F 233| 9| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 70.2k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 70.2k|#define PARAMS_N 976 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 70.2k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 70.2k|#define PARAMS_LOGQ 16 ------------------ | Branch (236:21): [True: 70.2k, False: 9] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 9| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 9|#define ct_verify oqs_kem_frodokem_976_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 9|#define ct_verify oqs_kem_frodokem_976_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 9| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 9|#define ct_select oqs_kem_frodokem_976_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 242| 9| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 9| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 246| 9| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 247| 9| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 248| 9| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 249| 9| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 250| 9| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 9| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 252| 9| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 253| 9| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 254| 9| return OQS_SUCCESS; 255| 9|} OQS_KEM_frodokem_976_shake_keypair: 19| 13|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 13| uint8_t *pk_seedA = &pk[0]; 23| 13| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 13|#define BYTES_SEED_A 16 ------------------ 24| 13| uint8_t *sk_s = &sk[0]; 25| 13| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 26| 13| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 13|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 13|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 27| 13| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 13|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 13|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 28| 13| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 13| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 13| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 31| 13| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 13| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 13| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 34| 13| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 35| 13| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 13| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 13|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 13|#define BYTES_SEED_A 16 ------------------ 39| 13| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 13|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 13|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 13|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 13| shake_input_seedSE[0] = 0x5F; 43| 13| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 44| 13| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 13|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 45| 203k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 203k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 203k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 203k, False: 13] ------------------ 46| 203k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 203k| #define LE_TO_UINT16(n) (n) ------------------ 47| 203k| } 48| 13| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 13|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 49| 13| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 13|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 50| 13| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 13|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_976_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 13| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 13|#define frodo_pack oqs_kem_frodokem_976_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 13|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 13|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 13|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 13|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 13| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 57| 13| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 13|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 13|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 58| 101k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 101k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 101k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 101k, False: 13] ------------------ 59| 101k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 101k| #define UINT16_TO_LE(n) (n) ------------------ 60| 101k| } 61| 13| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 13| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 13|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 13|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 13|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 13|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 13| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 68| 13| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 69| 13| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 70| 13| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 71| 13| return OQS_SUCCESS; 72| 13|} OQS_KEM_frodokem_976_shake_encaps: 86| 13|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 13| const uint8_t *pk_seedA = &pk[0]; 91| 13| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 13|#define BYTES_SEED_A 16 ------------------ 92| 13| uint8_t *ct_c1 = &ct[0]; 93| 13| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 13|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 94| 13| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 13| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 13| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 13| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 13| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 13| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 100| 13| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 101| 13| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 13| uint8_t *pkh = &G2in[0]; 103| 13| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 13|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 104| 13| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 13|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 13|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 13|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 13|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 13|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 13| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 13| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 13| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 108| 13| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 13| uint8_t *Fin_ct = &Fin[0]; 110| 13| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 13|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 13|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ 111| 13| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 13| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 13|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 13|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 13|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 13|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 115| 13| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 13|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 13|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 13|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 13|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 13|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 13|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 116| 13| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 13|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 13|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 13|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 13|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 13|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 13|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 13|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 13| shake_input_seedSE[0] = 0x96; 120| 13| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 121| 13| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 13|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 122| 203k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 203k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 203k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 203k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 203k, False: 13] ------------------ 123| 203k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 203k| #define LE_TO_UINT16(n) (n) ------------------ 124| 203k| } 125| 13| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 13|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 126| 13| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 13|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 127| 13| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 13|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_976_shake_mul_add_sa_plus_e ------------------ 128| 13| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 13|#define frodo_pack oqs_kem_frodokem_976_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 13|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 13|#define PARAMS_LOGQ 16 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 13| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 13|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 132| 13| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 13|#define frodo_unpack oqs_kem_frodokem_976_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 13|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 13|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 13|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 13|#define PARAMS_LOGQ 16 ------------------ 133| 13| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 13|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_976_shake_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 13| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 13|#define frodo_key_encode oqs_kem_frodokem_976_shake_key_encode ------------------ 137| 13| frodo_add(C, V, C); ------------------ | | 55| 13|#define frodo_add oqs_kem_frodokem_976_shake_add ------------------ 138| 13| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 13|#define frodo_pack oqs_kem_frodokem_976_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 13|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 13|#define PARAMS_LOGQ 16 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 13| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 13|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 13|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 13|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 13|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 142| 13| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 13|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 13|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ 143| 13| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 144| 13| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 13|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 13|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 13|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 13| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 148| 13| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 149| 13| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 150| 13| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 151| 13| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 13|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 13|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 13|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 13|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 13| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 153| 13| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 154| 13| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 155| 13| return OQS_SUCCESS; 156| 13|} OQS_KEM_frodokem_976_shake_decaps: 160| 13|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 13| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 13| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 13| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 13| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 13| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 13| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 13| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 13| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 172| 13| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 173| 13| const uint8_t *ct_c1 = &ct[0]; 174| 13| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 13|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 175| 13| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 13|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 13|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 13|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 176| 13| const uint8_t *sk_s = &sk[0]; 177| 13| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 178| 13| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 13|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 13|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 179| 13| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 13| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 13|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 13|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 181| 13| const uint8_t *pk_seedA = &sk_pk[0]; 182| 13| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 13|#define BYTES_SEED_A 16 ------------------ 183| 13| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 13| uint8_t *pkh = &G2in[0]; 185| 13| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 13|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 186| 13| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 13|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 13|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 13|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 13|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 13|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 13| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 13| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 13| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 190| 13| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 13| uint8_t *Fin_ct = &Fin[0]; 192| 13| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 13|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 13|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ 193| 13| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 101k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 101k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 101k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 101k, False: 13] ------------------ 197| 101k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 101k| #define LE_TO_UINT16(n) (n) ------------------ 198| 101k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 13| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 13|#define frodo_unpack oqs_kem_frodokem_976_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 13|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 13|#define PARAMS_LOGQ 16 ------------------ 202| 13| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 13|#define frodo_unpack oqs_kem_frodokem_976_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 13|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 13|#define PARAMS_LOGQ 16 ------------------ 203| 13| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 13|#define frodo_mul_bs oqs_kem_frodokem_976_shake_mul_bs ------------------ 204| 13| frodo_sub(W, C, W); ------------------ | | 56| 13|#define frodo_sub oqs_kem_frodokem_976_shake_sub ------------------ 205| 13| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 13|#define frodo_key_decode oqs_kem_frodokem_976_shake_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 13| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 13|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 209| 13| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 13|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 210| 13| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 13|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 13|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 13|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 13|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 13|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 13|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 13|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 13| shake_input_seedSEprime[0] = 0x96; 214| 13| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 215| 13| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 13|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 216| 203k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 203k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 203k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 203k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 203k, False: 13] ------------------ 217| 203k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 203k| #define LE_TO_UINT16(n) (n) ------------------ 218| 203k| } 219| 13| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 13|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 220| 13| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 13|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 221| 13| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 13|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_976_shake_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 13| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 13|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 225| 13| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 13|#define frodo_unpack oqs_kem_frodokem_976_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 13|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 13|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 13|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 13|#define PARAMS_LOGQ 16 ------------------ 226| 13| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 13|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_976_shake_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 13| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 13|#define frodo_key_encode oqs_kem_frodokem_976_shake_key_encode ------------------ 230| 13| frodo_add(CC, W, CC); ------------------ | | 55| 13|#define frodo_add oqs_kem_frodokem_976_shake_add ------------------ 231| | 232| | // Prepare input to F 233| 13| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 13|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 13|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 101k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 101k|#define PARAMS_N 976 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 101k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 101k|#define PARAMS_LOGQ 16 ------------------ | Branch (236:21): [True: 101k, False: 13] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 13| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 13|#define ct_verify oqs_kem_frodokem_976_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 13|#define ct_verify oqs_kem_frodokem_976_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 13| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 13|#define ct_select oqs_kem_frodokem_976_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 242| 13| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 13|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 13|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 13|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 13| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 246| 13| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 247| 13| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 248| 13| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 13|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 249| 13| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 250| 13| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 13|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 13|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 13|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 13|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 13| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 252| 13| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 253| 13| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 13|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 13|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 13|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 254| 13| return OQS_SUCCESS; 255| 13|} OQS_KEM_frodokem_1344_aes_keypair: 19| 9|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 9| uint8_t *pk_seedA = &pk[0]; 23| 9| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 24| 9| uint8_t *sk_s = &sk[0]; 25| 9| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 26| 9| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 9|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 27| 9| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 9|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 28| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 9| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 9| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 31| 9| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 9| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 9| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 34| 9| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 35| 9| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 9| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 9|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 39| 9| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 9| shake_input_seedSE[0] = 0x5F; 43| 9| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 44| 9| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 45| 193k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 193k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 193k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 193k, False: 9] ------------------ 46| 193k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 193k| #define LE_TO_UINT16(n) (n) ------------------ 47| 193k| } 48| 9| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 49| 9| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 50| 9| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 9|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_1344_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 9| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 9|#define frodo_pack oqs_kem_frodokem_1344_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 9|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 9| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 57| 9| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 9|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 58| 96.7k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 96.7k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 96.7k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 96.7k, False: 9] ------------------ 59| 96.7k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 96.7k| #define UINT16_TO_LE(n) (n) ------------------ 60| 96.7k| } 61| 9| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 9| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 9|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 9| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 68| 9| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 69| 9| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 70| 9| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 71| 9| return OQS_SUCCESS; 72| 9|} OQS_KEM_frodokem_1344_aes_encaps: 86| 9|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 9| const uint8_t *pk_seedA = &pk[0]; 91| 9| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 92| 9| uint8_t *ct_c1 = &ct[0]; 93| 9| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 94| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 9| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 9| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 9| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 9| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 9| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 100| 9| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 101| 9| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 9| uint8_t *pkh = &G2in[0]; 103| 9| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 104| 9| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 9| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 9| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 9| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 108| 9| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 9| uint8_t *Fin_ct = &Fin[0]; 110| 9| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 9|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ 111| 9| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 9| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 9|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 115| 9| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 9|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 116| 9| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 9| shake_input_seedSE[0] = 0x96; 120| 9| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 121| 9| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 122| 194k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 194k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 194k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 194k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 194k, False: 9] ------------------ 123| 194k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 194k| #define LE_TO_UINT16(n) (n) ------------------ 124| 194k| } 125| 9| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 126| 9| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 127| 9| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 9|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e ------------------ 128| 9| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 9|#define frodo_pack oqs_kem_frodokem_1344_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 9| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 132| 9| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_1344_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 9|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 133| 9| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 9|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_1344_aes_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 9| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 9|#define frodo_key_encode oqs_kem_frodokem_1344_aes_key_encode ------------------ 137| 9| frodo_add(C, V, C); ------------------ | | 55| 9|#define frodo_add oqs_kem_frodokem_1344_aes_add ------------------ 138| 9| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 9|#define frodo_pack oqs_kem_frodokem_1344_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 9| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 9|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 142| 9| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 9|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ 143| 9| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 144| 9| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 9|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 9| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 148| 9| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 149| 9| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 150| 9| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 151| 9| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 9| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 153| 9| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 154| 9| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 155| 9| return OQS_SUCCESS; 156| 9|} OQS_KEM_frodokem_1344_aes_decaps: 160| 9|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 9| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 9| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 9| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 9| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 9| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 9| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 9| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 172| 9| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 173| 9| const uint8_t *ct_c1 = &ct[0]; 174| 9| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 175| 9| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 9|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 176| 9| const uint8_t *sk_s = &sk[0]; 177| 9| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 178| 9| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 9|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 179| 9| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 9| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 9|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 181| 9| const uint8_t *pk_seedA = &sk_pk[0]; 182| 9| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 183| 9| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 9| uint8_t *pkh = &G2in[0]; 185| 9| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 186| 9| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 9| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 9| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 9| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 190| 9| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 9| uint8_t *Fin_ct = &Fin[0]; 192| 9| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 9|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ 193| 9| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 96.7k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 96.7k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 96.7k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 96.7k, False: 9] ------------------ 197| 96.7k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 96.7k| #define LE_TO_UINT16(n) (n) ------------------ 198| 96.7k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 9| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_1344_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 202| 9| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_1344_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 203| 9| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 9|#define frodo_mul_bs oqs_kem_frodokem_1344_aes_mul_bs ------------------ 204| 9| frodo_sub(W, C, W); ------------------ | | 56| 9|#define frodo_sub oqs_kem_frodokem_1344_aes_sub ------------------ 205| 9| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 9|#define frodo_key_decode oqs_kem_frodokem_1344_aes_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 9| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 209| 9| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 210| 9| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 9| shake_input_seedSEprime[0] = 0x96; 214| 9| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 215| 9| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 216| 194k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 194k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 194k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 194k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 194k, False: 9] ------------------ 217| 194k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 194k| #define LE_TO_UINT16(n) (n) ------------------ 218| 194k| } 219| 9| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 220| 9| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 221| 9| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 9|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 9| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 225| 9| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_1344_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 9|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 226| 9| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 9|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_1344_aes_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 9| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 9|#define frodo_key_encode oqs_kem_frodokem_1344_aes_key_encode ------------------ 230| 9| frodo_add(CC, W, CC); ------------------ | | 55| 9|#define frodo_add oqs_kem_frodokem_1344_aes_add ------------------ 231| | 232| | // Prepare input to F 233| 9| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 9|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 96.7k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 96.7k|#define PARAMS_N 1344 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 96.7k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 96.7k|#define PARAMS_LOGQ 16 ------------------ | Branch (236:21): [True: 96.7k, False: 9] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 9| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 9|#define ct_verify oqs_kem_frodokem_1344_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 9|#define ct_verify oqs_kem_frodokem_1344_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 9| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 9|#define ct_select oqs_kem_frodokem_1344_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 242| 9| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 9|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 9| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 246| 9| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 247| 9| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 248| 9| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 249| 9| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 250| 9| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 9| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 252| 9| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 253| 9| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 254| 9| return OQS_SUCCESS; 255| 9|} OQS_KEM_frodokem_1344_shake_keypair: 19| 8|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 8| uint8_t *pk_seedA = &pk[0]; 23| 8| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 24| 8| uint8_t *sk_s = &sk[0]; 25| 8| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 26| 8| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 8|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 27| 8| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 8|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 28| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 8| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 8| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 31| 8| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 8| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 8| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 34| 8| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 35| 8| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 8| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 8|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 39| 8| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 8| shake_input_seedSE[0] = 0x5F; 43| 8| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 44| 8| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 45| 172k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 172k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 172k, False: 8] ------------------ 46| 172k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 172k| #define LE_TO_UINT16(n) (n) ------------------ 47| 172k| } 48| 8| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 8|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 49| 8| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 8|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 50| 8| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 8|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_1344_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 8| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 8|#define frodo_pack oqs_kem_frodokem_1344_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 8|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 8| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 57| 8| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 8|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 58| 86.0k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 86.0k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 86.0k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 86.0k, False: 8] ------------------ 59| 86.0k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 86.0k| #define UINT16_TO_LE(n) (n) ------------------ 60| 86.0k| } 61| 8| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 8| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 8|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 8| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 68| 8| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 69| 8| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 70| 8| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 71| 8| return OQS_SUCCESS; 72| 8|} OQS_KEM_frodokem_1344_shake_encaps: 86| 8|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 8| const uint8_t *pk_seedA = &pk[0]; 91| 8| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 92| 8| uint8_t *ct_c1 = &ct[0]; 93| 8| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 94| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 8| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 8| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 8| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 8| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 8| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 100| 8| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 101| 8| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 8| uint8_t *pkh = &G2in[0]; 103| 8| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 104| 8| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 8| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 8| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 8| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 108| 8| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 8| uint8_t *Fin_ct = &Fin[0]; 110| 8| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 8|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ 111| 8| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 8| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 8|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 115| 8| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 8|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 8|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 116| 8| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 8|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 8| shake_input_seedSE[0] = 0x96; 120| 8| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 121| 8| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 122| 172k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 172k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 172k, False: 8] ------------------ 123| 172k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 172k| #define LE_TO_UINT16(n) (n) ------------------ 124| 172k| } 125| 8| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 8|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 126| 8| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 8|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 127| 8| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 8|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e ------------------ 128| 8| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 8|#define frodo_pack oqs_kem_frodokem_1344_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 8| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 8|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 132| 8| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 8|#define frodo_unpack oqs_kem_frodokem_1344_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 8|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 133| 8| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 8|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_1344_shake_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 8| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 8|#define frodo_key_encode oqs_kem_frodokem_1344_shake_key_encode ------------------ 137| 8| frodo_add(C, V, C); ------------------ | | 55| 8|#define frodo_add oqs_kem_frodokem_1344_shake_add ------------------ 138| 8| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 8|#define frodo_pack oqs_kem_frodokem_1344_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 8| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 8|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 8|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 8|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 142| 8| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 8|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ 143| 8| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 144| 8| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 8|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 8| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 148| 8| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 149| 8| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 150| 8| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 151| 8| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 8| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 153| 8| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 154| 8| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 155| 8| return OQS_SUCCESS; 156| 8|} OQS_KEM_frodokem_1344_shake_decaps: 160| 8|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 8| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 8| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 8| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 8| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 8| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 8| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 8| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 172| 8| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 173| 8| const uint8_t *ct_c1 = &ct[0]; 174| 8| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 175| 8| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 8|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 8|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 176| 8| const uint8_t *sk_s = &sk[0]; 177| 8| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 178| 8| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 8|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 179| 8| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 8| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 8|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 181| 8| const uint8_t *pk_seedA = &sk_pk[0]; 182| 8| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 183| 8| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 8| uint8_t *pkh = &G2in[0]; 185| 8| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 186| 8| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 8| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 8| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 8| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 190| 8| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 8| uint8_t *Fin_ct = &Fin[0]; 192| 8| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 8|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ 193| 8| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 86.0k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 86.0k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 86.0k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 86.0k, False: 8] ------------------ 197| 86.0k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 86.0k| #define LE_TO_UINT16(n) (n) ------------------ 198| 86.0k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 8| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 8|#define frodo_unpack oqs_kem_frodokem_1344_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 202| 8| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 8|#define frodo_unpack oqs_kem_frodokem_1344_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 203| 8| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 8|#define frodo_mul_bs oqs_kem_frodokem_1344_shake_mul_bs ------------------ 204| 8| frodo_sub(W, C, W); ------------------ | | 56| 8|#define frodo_sub oqs_kem_frodokem_1344_shake_sub ------------------ 205| 8| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 8|#define frodo_key_decode oqs_kem_frodokem_1344_shake_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 8| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 209| 8| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 8|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 210| 8| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 8|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 8| shake_input_seedSEprime[0] = 0x96; 214| 8| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 215| 8| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 216| 172k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 172k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 172k, False: 8] ------------------ 217| 172k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 172k| #define LE_TO_UINT16(n) (n) ------------------ 218| 172k| } 219| 8| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 8|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 220| 8| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 8|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 221| 8| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 8|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 8| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 8|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 225| 8| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 8|#define frodo_unpack oqs_kem_frodokem_1344_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 8|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 226| 8| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 8|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_1344_shake_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 8| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 8|#define frodo_key_encode oqs_kem_frodokem_1344_shake_key_encode ------------------ 230| 8| frodo_add(CC, W, CC); ------------------ | | 55| 8|#define frodo_add oqs_kem_frodokem_1344_shake_add ------------------ 231| | 232| | // Prepare input to F 233| 8| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 8|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 86.0k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 86.0k|#define PARAMS_N 1344 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 86.0k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 86.0k|#define PARAMS_LOGQ 16 ------------------ | Branch (236:21): [True: 86.0k, False: 8] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 8| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 8|#define ct_verify oqs_kem_frodokem_1344_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 8|#define ct_verify oqs_kem_frodokem_1344_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 8| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 8|#define ct_select oqs_kem_frodokem_1344_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 242| 8| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 8|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 8| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 246| 8| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 247| 8| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 248| 8| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 249| 8| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 250| 8| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 8| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 252| 8| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 253| 8| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 254| 8| return OQS_SUCCESS; 255| 8|} oqs_kem_frodokem_640_aes_mul_add_sa_plus_e_avx2: 5| 4|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 4| int i, j, kk; 9| | 10| 10.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 10.2k, False: 4] ------------------ 11| 10.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 10.2k| } 13| | 14| 4| int k; 15| 4| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 4| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 4| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 4| uint8_t *aes_key_schedule; 19| 4| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 2.56k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 2.56k|#define PARAMS_N 640 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 2.56k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 2.56k, False: 4] ------------------ 22| 2.56k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 2.56k| #define UINT16_TO_LE(n) (n) ------------------ 23| 2.56k| } 24| | 25| 324| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 324|#define PARAMS_N 640 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 320|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 320, False: 4] ------------------ 26| 205k| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 205k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 205k|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 204k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 204k, False: 320] ------------------ 27| 204k| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 204k| #define UINT16_TO_LE(n) (n) ------------------ 28| 204k| } 29| | 30| 320| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 320|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 205k| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 205k|#define PARAMS_N 640 ------------------ | Branch (32:21): [True: 204k, False: 320] ------------------ 33| 1.84M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 1.84M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 1.63M, False: 204k] ------------------ 34| 1.63M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 1.63M| #define LE_TO_UINT16(n) (n) ------------------ 35| 1.63M| } 36| 204k| } 37| | 38| 2.88k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 2.88k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 2.56k, False: 320] ------------------ 39| 7.68k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 7.68k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 5.12k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 5.12k, False: 2.56k] ------------------ 40| 5.12k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 5.12k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 5.12k| acc[0] = _mm256_setzero_si256(); 43| 5.12k| acc[1] = _mm256_setzero_si256(); 44| 5.12k| acc[2] = _mm256_setzero_si256(); 45| 5.12k| acc[3] = _mm256_setzero_si256(); 46| 209k| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 209k|#define PARAMS_N 640 ------------------ | Branch (46:29): [True: 204k, False: 5.12k] ------------------ 47| 204k| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 48| 204k| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 49| 204k| a[0] = _mm256_madd_epi16(a[0], b); 50| 204k| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 204k| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 52| 204k| a[1] = _mm256_madd_epi16(a[1], b); 53| 204k| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 204k| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 55| 204k| a[2] = _mm256_madd_epi16(a[2], b); 56| 204k| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 204k| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 58| 204k| a[3] = _mm256_madd_epi16(a[3], b); 59| 204k| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 204k| } 61| 5.12k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 5.12k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 63| 5.12k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 5.12k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 65| 5.12k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 5.12k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 67| 5.12k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 5.12k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 69| 5.12k| } 70| 2.56k| } 71| 320| } 72| 4| OQS_AES128_free_schedule(aes_key_schedule); 73| 4| return 1; 74| 4|} oqs_kem_frodokem_976_aes_mul_add_sa_plus_e_avx2: 5| 18|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 18| int i, j, kk; 9| | 10| 70.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 70.2k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 70.2k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 70.2k, False: 18] ------------------ 11| 70.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 70.2k| } 13| | 14| 18| int k; 15| 18| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 18| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 18| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 18| uint8_t *aes_key_schedule; 19| 18| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 17.5k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 17.5k|#define PARAMS_N 976 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 17.5k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 17.5k, False: 18] ------------------ 22| 17.5k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 17.5k| #define UINT16_TO_LE(n) (n) ------------------ 23| 17.5k| } 24| | 25| 2.21k| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 2.21k|#define PARAMS_N 976 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 2.19k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 2.19k, False: 18] ------------------ 26| 2.14M| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 2.14M|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 2.14M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 2.14M, False: 2.19k] ------------------ 27| 2.14M| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 2.14M| #define UINT16_TO_LE(n) (n) ------------------ 28| 2.14M| } 29| | 30| 2.19k| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 2.19k|#define PARAMS_N 976 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 2.19k|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 2.14M| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ | Branch (32:21): [True: 2.14M, False: 2.19k] ------------------ 33| 19.2M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 19.2M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 17.1M, False: 2.14M] ------------------ 34| 17.1M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 17.1M| #define LE_TO_UINT16(n) (n) ------------------ 35| 17.1M| } 36| 2.14M| } 37| | 38| 19.7k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 19.7k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 17.5k, False: 2.19k] ------------------ 39| 52.7k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 52.7k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 35.1k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 35.1k, False: 17.5k] ------------------ 40| 35.1k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 35.1k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 35.1k| acc[0] = _mm256_setzero_si256(); 43| 35.1k| acc[1] = _mm256_setzero_si256(); 44| 35.1k| acc[2] = _mm256_setzero_si256(); 45| 35.1k| acc[3] = _mm256_setzero_si256(); 46| 2.17M| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 2.17M|#define PARAMS_N 976 ------------------ | Branch (46:29): [True: 2.14M, False: 35.1k] ------------------ 47| 2.14M| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 48| 2.14M| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 49| 2.14M| a[0] = _mm256_madd_epi16(a[0], b); 50| 2.14M| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 2.14M| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 52| 2.14M| a[1] = _mm256_madd_epi16(a[1], b); 53| 2.14M| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 2.14M| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 55| 2.14M| a[2] = _mm256_madd_epi16(a[2], b); 56| 2.14M| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 2.14M| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 58| 2.14M| a[3] = _mm256_madd_epi16(a[3], b); 59| 2.14M| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 2.14M| } 61| 35.1k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 35.1k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ 63| 35.1k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 35.1k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ 65| 35.1k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 35.1k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ 67| 35.1k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 35.1k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ 69| 35.1k| } 70| 17.5k| } 71| 2.19k| } 72| 18| OQS_AES128_free_schedule(aes_key_schedule); 73| 18| return 1; 74| 18|} oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e_avx2: 5| 18|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 18| int i, j, kk; 9| | 10| 96.7k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 96.7k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 96.7k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 96.7k, False: 18] ------------------ 11| 96.7k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 96.7k| } 13| | 14| 18| int k; 15| 18| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 18| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 18| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 18| uint8_t *aes_key_schedule; 19| 18| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 24.2k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 24.2k|#define PARAMS_N 1344 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 24.1k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 24.1k, False: 18] ------------------ 22| 24.1k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 24.1k| #define UINT16_TO_LE(n) (n) ------------------ 23| 24.1k| } 24| | 25| 3.04k| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 3.04k|#define PARAMS_N 1344 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 3.02k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 3.02k, False: 18] ------------------ 26| 4.06M| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 4.06M|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 4.06M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 4.06M, False: 3.02k] ------------------ 27| 4.06M| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 4.06M| #define UINT16_TO_LE(n) (n) ------------------ 28| 4.06M| } 29| | 30| 3.02k| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 3.02k|#define PARAMS_N 1344 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 3.02k|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 4.06M| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ | Branch (32:21): [True: 4.06M, False: 3.02k] ------------------ 33| 36.5M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 36.5M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 32.5M, False: 4.06M] ------------------ 34| 32.5M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 32.5M| #define LE_TO_UINT16(n) (n) ------------------ 35| 32.5M| } 36| 4.06M| } 37| | 38| 27.2k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 27.2k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 24.1k, False: 3.02k] ------------------ 39| 72.5k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 72.5k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 48.3k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 48.3k, False: 24.1k] ------------------ 40| 48.3k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 48.3k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 48.3k| acc[0] = _mm256_setzero_si256(); 43| 48.3k| acc[1] = _mm256_setzero_si256(); 44| 48.3k| acc[2] = _mm256_setzero_si256(); 45| 48.3k| acc[3] = _mm256_setzero_si256(); 46| 4.11M| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 4.11M|#define PARAMS_N 1344 ------------------ | Branch (46:29): [True: 4.06M, False: 48.3k] ------------------ 47| 4.06M| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ 48| 4.06M| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ 49| 4.06M| a[0] = _mm256_madd_epi16(a[0], b); 50| 4.06M| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 4.06M| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ 52| 4.06M| a[1] = _mm256_madd_epi16(a[1], b); 53| 4.06M| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 4.06M| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ 55| 4.06M| a[2] = _mm256_madd_epi16(a[2], b); 56| 4.06M| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 4.06M| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ 58| 4.06M| a[3] = _mm256_madd_epi16(a[3], b); 59| 4.06M| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 4.06M| } 61| 48.3k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 48.3k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 48.3k|#define PARAMS_N 1344 ------------------ 63| 48.3k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 48.3k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 48.3k|#define PARAMS_N 1344 ------------------ 65| 48.3k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 48.3k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 48.3k|#define PARAMS_N 1344 ------------------ 67| 48.3k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 48.3k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 48.3k|#define PARAMS_N 1344 ------------------ 69| 48.3k| } 70| 24.1k| } 71| 3.02k| } 72| 18| OQS_AES128_free_schedule(aes_key_schedule); 73| 18| return 1; 74| 18|} oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e_avx2: 5| 8|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 8| int i, j, kk; 9| | 10| 20.4k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 20.4k, False: 8] ------------------ 11| 20.4k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 20.4k| } 13| | 14| 8| int k; 15| 8| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 8| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 8| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 8| uint8_t *aes_key_schedule; 19| 8| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 5.12k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 5.12k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 5.12k, False: 8] ------------------ 22| 5.12k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 5.12k| #define UINT16_TO_LE(n) (n) ------------------ 23| 5.12k| } 24| | 25| 648| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 648|#define PARAMS_N 640 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 640|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 640, False: 8] ------------------ 26| 410k| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 410k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 410k|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 409k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 409k, False: 640] ------------------ 27| 409k| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 409k| #define UINT16_TO_LE(n) (n) ------------------ 28| 409k| } 29| | 30| 640| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 640|#define PARAMS_N 640 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 640|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 410k| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 410k|#define PARAMS_N 640 ------------------ | Branch (32:21): [True: 409k, False: 640] ------------------ 33| 3.68M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 3.68M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 3.27M, False: 409k] ------------------ 34| 3.27M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 3.27M| #define LE_TO_UINT16(n) (n) ------------------ 35| 3.27M| } 36| 409k| } 37| | 38| 5.76k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 5.76k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 5.12k, False: 640] ------------------ 39| 15.3k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 15.3k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 10.2k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 10.2k, False: 5.12k] ------------------ 40| 10.2k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 10.2k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 10.2k| acc[0] = _mm256_setzero_si256(); 43| 10.2k| acc[1] = _mm256_setzero_si256(); 44| 10.2k| acc[2] = _mm256_setzero_si256(); 45| 10.2k| acc[3] = _mm256_setzero_si256(); 46| 419k| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 419k|#define PARAMS_N 640 ------------------ | Branch (46:29): [True: 409k, False: 10.2k] ------------------ 47| 409k| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 409k|#define PARAMS_N 640 ------------------ 48| 409k| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 409k|#define PARAMS_N 640 ------------------ 49| 409k| a[0] = _mm256_madd_epi16(a[0], b); 50| 409k| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 409k| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 409k|#define PARAMS_N 640 ------------------ 52| 409k| a[1] = _mm256_madd_epi16(a[1], b); 53| 409k| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 409k| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 409k|#define PARAMS_N 640 ------------------ 55| 409k| a[2] = _mm256_madd_epi16(a[2], b); 56| 409k| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 409k| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 409k|#define PARAMS_N 640 ------------------ 58| 409k| a[3] = _mm256_madd_epi16(a[3], b); 59| 409k| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 409k| } 61| 10.2k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 10.2k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ 63| 10.2k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 10.2k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ 65| 10.2k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 10.2k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ 67| 10.2k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 10.2k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ 69| 10.2k| } 70| 5.12k| } 71| 640| } 72| 8| OQS_AES128_free_schedule(aes_key_schedule); 73| 8| return 1; 74| 8|} oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e_avx2: 5| 16|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 16| int i, j, kk; 9| | 10| 62.4k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 62.4k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 62.4k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 62.4k, False: 16] ------------------ 11| 62.4k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 62.4k| } 13| | 14| 16| int k; 15| 16| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 16| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 16| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 16| uint8_t *aes_key_schedule; 19| 16| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 15.6k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 15.6k|#define PARAMS_N 976 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 15.6k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 15.6k, False: 16] ------------------ 22| 15.6k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 15.6k| #define UINT16_TO_LE(n) (n) ------------------ 23| 15.6k| } 24| | 25| 1.96k| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 1.96k|#define PARAMS_N 976 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 1.95k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 1.95k, False: 16] ------------------ 26| 1.90M| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 1.90M|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 1.90M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 1.90M, False: 1.95k] ------------------ 27| 1.90M| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 1.90M| #define UINT16_TO_LE(n) (n) ------------------ 28| 1.90M| } 29| | 30| 1.95k| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 1.95k|#define PARAMS_N 976 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 1.95k|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 1.90M| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ | Branch (32:21): [True: 1.90M, False: 1.95k] ------------------ 33| 17.1M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 17.1M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 15.2M, False: 1.90M] ------------------ 34| 15.2M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 15.2M| #define LE_TO_UINT16(n) (n) ------------------ 35| 15.2M| } 36| 1.90M| } 37| | 38| 17.5k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 15.6k, False: 1.95k] ------------------ 39| 46.8k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 46.8k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 31.2k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 31.2k, False: 15.6k] ------------------ 40| 31.2k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 31.2k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 31.2k| acc[0] = _mm256_setzero_si256(); 43| 31.2k| acc[1] = _mm256_setzero_si256(); 44| 31.2k| acc[2] = _mm256_setzero_si256(); 45| 31.2k| acc[3] = _mm256_setzero_si256(); 46| 1.93M| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 1.93M|#define PARAMS_N 976 ------------------ | Branch (46:29): [True: 1.90M, False: 31.2k] ------------------ 47| 1.90M| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 48| 1.90M| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 49| 1.90M| a[0] = _mm256_madd_epi16(a[0], b); 50| 1.90M| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 1.90M| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 52| 1.90M| a[1] = _mm256_madd_epi16(a[1], b); 53| 1.90M| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 1.90M| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 55| 1.90M| a[2] = _mm256_madd_epi16(a[2], b); 56| 1.90M| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 1.90M| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 58| 1.90M| a[3] = _mm256_madd_epi16(a[3], b); 59| 1.90M| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 1.90M| } 61| 31.2k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 31.2k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 31.2k|#define PARAMS_N 976 ------------------ 63| 31.2k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 31.2k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 31.2k|#define PARAMS_N 976 ------------------ 65| 31.2k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 31.2k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 31.2k|#define PARAMS_N 976 ------------------ 67| 31.2k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 31.2k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 31.2k|#define PARAMS_N 976 ------------------ 69| 31.2k| } 70| 15.6k| } 71| 1.95k| } 72| 16| OQS_AES128_free_schedule(aes_key_schedule); 73| 16| return 1; 74| 16|} oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e_avx2: 5| 16|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 16| int i, j, kk; 9| | 10| 86.0k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 86.0k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 86.0k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 86.0k, False: 16] ------------------ 11| 86.0k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 86.0k| } 13| | 14| 16| int k; 15| 16| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 16| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 16| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 16| uint8_t *aes_key_schedule; 19| 16| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 21.5k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 21.5k|#define PARAMS_N 1344 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 21.5k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 21.5k, False: 16] ------------------ 22| 21.5k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 21.5k| #define UINT16_TO_LE(n) (n) ------------------ 23| 21.5k| } 24| | 25| 2.70k| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 2.70k|#define PARAMS_N 1344 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 2.68k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 2.68k, False: 16] ------------------ 26| 3.61M| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 3.61M|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 3.61M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 3.61M, False: 2.68k] ------------------ 27| 3.61M| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 3.61M| #define UINT16_TO_LE(n) (n) ------------------ 28| 3.61M| } 29| | 30| 2.68k| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 2.68k|#define PARAMS_N 1344 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 2.68k|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 3.61M| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ | Branch (32:21): [True: 3.61M, False: 2.68k] ------------------ 33| 32.5M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 32.5M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 28.9M, False: 3.61M] ------------------ 34| 28.9M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 28.9M| #define LE_TO_UINT16(n) (n) ------------------ 35| 28.9M| } 36| 3.61M| } 37| | 38| 24.1k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 21.5k, False: 2.68k] ------------------ 39| 64.5k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 64.5k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 43.0k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 43.0k, False: 21.5k] ------------------ 40| 43.0k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 43.0k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 43.0k| acc[0] = _mm256_setzero_si256(); 43| 43.0k| acc[1] = _mm256_setzero_si256(); 44| 43.0k| acc[2] = _mm256_setzero_si256(); 45| 43.0k| acc[3] = _mm256_setzero_si256(); 46| 3.65M| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 3.65M|#define PARAMS_N 1344 ------------------ | Branch (46:29): [True: 3.61M, False: 43.0k] ------------------ 47| 3.61M| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 48| 3.61M| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 49| 3.61M| a[0] = _mm256_madd_epi16(a[0], b); 50| 3.61M| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 3.61M| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 52| 3.61M| a[1] = _mm256_madd_epi16(a[1], b); 53| 3.61M| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 3.61M| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 55| 3.61M| a[2] = _mm256_madd_epi16(a[2], b); 56| 3.61M| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 3.61M| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 58| 3.61M| a[3] = _mm256_madd_epi16(a[3], b); 59| 3.61M| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 3.61M| } 61| 43.0k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 43.0k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ 63| 43.0k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 43.0k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ 65| 43.0k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 43.0k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ 67| 43.0k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 43.0k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ 69| 43.0k| } 70| 21.5k| } 71| 2.68k| } 72| 16| OQS_AES128_free_schedule(aes_key_schedule); 73| 16| return 1; 74| 16|} oqs_kem_frodokem_640_aes_mul_add_as_plus_e_avx2: 4| 2|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 2| int i, j, k; 8| 2| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 5.12k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 5.12k, False: 2] ------------------ 11| 5.12k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 5.12k| } 13| | 14| 2|#if defined(USE_AES128_FOR_A) 15| 2| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 2| uint8_t *aes_key_schedule; 17| 2| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 162| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 162|#define PARAMS_N 640 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 160|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 160, False: 2] ------------------ 20| 160| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 160|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 160| #define UINT16_TO_LE(n) (n) ------------------ 21| 160| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 160|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 160| #define UINT16_TO_LE(n) (n) ------------------ 22| 160| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 160|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 160| #define UINT16_TO_LE(n) (n) ------------------ 23| 160| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 160|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 160| #define UINT16_TO_LE(n) (n) ------------------ 24| 160| } 25| | 26| 322| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 322|#define PARAMS_N 640 ------------------ | Branch (26:17): [True: 320, False: 2] ------------------ 27| 25.9k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 25.9k|#define PARAMS_N 640 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 25.6k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 25.6k, False: 320] ------------------ 28| 25.6k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 25.6k|#define PARAMS_N 640 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 25.6k| #define UINT16_TO_LE(n) (n) ------------------ 29| 25.6k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 25.6k|#define PARAMS_N 640 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 25.6k| #define UINT16_TO_LE(n) (n) ------------------ 30| 25.6k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 25.6k|#define PARAMS_N 640 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 25.6k| #define UINT16_TO_LE(n) (n) ------------------ 31| 25.6k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 25.6k|#define PARAMS_N 640 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 25.6k| #define UINT16_TO_LE(n) (n) ------------------ 32| 25.6k| } 33| | 34| 320| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 819k| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 819k|#define PARAMS_N 640 ------------------ | Branch (56:21): [True: 819k, False: 320] ------------------ 57| 819k| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 819k| #define LE_TO_UINT16(n) (n) ------------------ 58| 819k| } 59| 2.88k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 2.88k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 2.56k, False: 320] ------------------ 60| 2.56k| uint16_t sum[4] = {0}; 61| 1.64M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 1.64M|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 1.63M, False: 2.56k] ------------------ 62| 1.63M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 63| 1.63M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 64| 1.63M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 65| 1.63M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 66| 1.63M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 67| 1.63M| } 68| 2.56k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 69| 2.56k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 70| 2.56k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 71| 2.56k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 72| 2.56k| } 73| 320| } 74| | 75| 2|#if defined(USE_AES128_FOR_A) 76| 2| OQS_AES128_free_schedule(aes_key_schedule); 77| 2|#endif 78| 2| return 1; 79| 2|} oqs_kem_frodokem_976_aes_mul_add_as_plus_e_avx2: 4| 9|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 9| int i, j, k; 8| 9| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 35.1k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 35.1k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 35.1k, False: 9] ------------------ 11| 35.1k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 35.1k| } 13| | 14| 9|#if defined(USE_AES128_FOR_A) 15| 9| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 9| uint8_t *aes_key_schedule; 17| 9| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 1.10k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 1.10k|#define PARAMS_N 976 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 1.09k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 1.09k, False: 9] ------------------ 20| 1.09k| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 1.09k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 1.09k| #define UINT16_TO_LE(n) (n) ------------------ 21| 1.09k| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.09k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.09k| #define UINT16_TO_LE(n) (n) ------------------ 22| 1.09k| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.09k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.09k| #define UINT16_TO_LE(n) (n) ------------------ 23| 1.09k| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.09k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.09k| #define UINT16_TO_LE(n) (n) ------------------ 24| 1.09k| } 25| | 26| 2.20k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 2.20k|#define PARAMS_N 976 ------------------ | Branch (26:17): [True: 2.19k, False: 9] ------------------ 27| 270k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 270k|#define PARAMS_N 976 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 267k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 267k, False: 2.19k] ------------------ 28| 267k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 267k|#define PARAMS_N 976 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 267k| #define UINT16_TO_LE(n) (n) ------------------ 29| 267k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 267k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 267k| #define UINT16_TO_LE(n) (n) ------------------ 30| 267k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 267k|#define PARAMS_N 976 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 267k| #define UINT16_TO_LE(n) (n) ------------------ 31| 267k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 267k|#define PARAMS_N 976 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 267k| #define UINT16_TO_LE(n) (n) ------------------ 32| 267k| } 33| | 34| 2.19k| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 2.19k|#define PARAMS_N 976 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 8.57M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 8.57M|#define PARAMS_N 976 ------------------ | Branch (56:21): [True: 8.57M, False: 2.19k] ------------------ 57| 8.57M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 8.57M| #define LE_TO_UINT16(n) (n) ------------------ 58| 8.57M| } 59| 19.7k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 19.7k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 17.5k, False: 2.19k] ------------------ 60| 17.5k| uint16_t sum[4] = {0}; 61| 17.1M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 17.1M, False: 17.5k] ------------------ 62| 17.1M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 63| 17.1M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 64| 17.1M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 65| 17.1M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 66| 17.1M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 67| 17.1M| } 68| 17.5k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ 69| 17.5k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ 70| 17.5k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ 71| 17.5k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ 72| 17.5k| } 73| 2.19k| } 74| | 75| 9|#if defined(USE_AES128_FOR_A) 76| 9| OQS_AES128_free_schedule(aes_key_schedule); 77| 9|#endif 78| 9| return 1; 79| 9|} oqs_kem_frodokem_1344_aes_mul_add_as_plus_e_avx2: 4| 9|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 9| int i, j, k; 8| 9| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 48.3k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 48.3k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 48.3k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 48.3k, False: 9] ------------------ 11| 48.3k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 48.3k| } 13| | 14| 9|#if defined(USE_AES128_FOR_A) 15| 9| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 9| uint8_t *aes_key_schedule; 17| 9| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 1.52k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 1.52k|#define PARAMS_N 1344 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 1.51k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 1.51k, False: 9] ------------------ 20| 1.51k| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 1.51k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 1.51k| #define UINT16_TO_LE(n) (n) ------------------ 21| 1.51k| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.51k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.51k| #define UINT16_TO_LE(n) (n) ------------------ 22| 1.51k| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.51k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.51k| #define UINT16_TO_LE(n) (n) ------------------ 23| 1.51k| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.51k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.51k| #define UINT16_TO_LE(n) (n) ------------------ 24| 1.51k| } 25| | 26| 3.03k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 3.03k|#define PARAMS_N 1344 ------------------ | Branch (26:17): [True: 3.02k, False: 9] ------------------ 27| 511k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 511k|#define PARAMS_N 1344 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 508k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 508k, False: 3.02k] ------------------ 28| 508k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 508k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 508k| #define UINT16_TO_LE(n) (n) ------------------ 29| 508k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 508k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 508k| #define UINT16_TO_LE(n) (n) ------------------ 30| 508k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 508k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 508k| #define UINT16_TO_LE(n) (n) ------------------ 31| 508k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 508k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 508k| #define UINT16_TO_LE(n) (n) ------------------ 32| 508k| } 33| | 34| 3.02k| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 3.02k|#define PARAMS_N 1344 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 16.2M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 16.2M|#define PARAMS_N 1344 ------------------ | Branch (56:21): [True: 16.2M, False: 3.02k] ------------------ 57| 16.2M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 16.2M| #define LE_TO_UINT16(n) (n) ------------------ 58| 16.2M| } 59| 27.2k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 27.2k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 24.1k, False: 3.02k] ------------------ 60| 24.1k| uint16_t sum[4] = {0}; 61| 32.5M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 32.5M, False: 24.1k] ------------------ 62| 32.5M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ 63| 32.5M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ 64| 32.5M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ 65| 32.5M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ 66| 32.5M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ 67| 32.5M| } 68| 24.1k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ 69| 24.1k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ 70| 24.1k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ 71| 24.1k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ 72| 24.1k| } 73| 3.02k| } 74| | 75| 9|#if defined(USE_AES128_FOR_A) 76| 9| OQS_AES128_free_schedule(aes_key_schedule); 77| 9|#endif 78| 9| return 1; 79| 9|} oqs_kem_frodokem_640_shake_mul_add_as_plus_e_avx2: 4| 3|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 3| int i, j, k; 8| 3| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 7.68k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 7.68k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 7.68k, False: 3] ------------------ 11| 7.68k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 7.68k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 3| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 3| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 3| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 3| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 3| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 3| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 3| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 3| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 45| 3| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 46| 3| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 47| 3| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 48| 483| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 483|#define PARAMS_N 640 ------------------ | Branch (48:17): [True: 480, False: 3] ------------------ 49| 480| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 480| #define UINT16_TO_LE(n) (n) ------------------ 50| 480| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 480| #define UINT16_TO_LE(n) (n) ------------------ 51| 480| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 480| #define UINT16_TO_LE(n) (n) ------------------ 52| 480| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 480| #define UINT16_TO_LE(n) (n) ------------------ 53| 480| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 480|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 480|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 480|#define PARAMS_N 640 ------------------ 54| 480| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 480|#define PARAMS_N 640 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 480|#define BYTES_SEED_A 16 ------------------ 55| 480|#endif /* USE_AES128_FOR_A */ 56| 1.22M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 1.22M|#define PARAMS_N 640 ------------------ | Branch (56:21): [True: 1.22M, False: 480] ------------------ 57| 1.22M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 1.22M| #define LE_TO_UINT16(n) (n) ------------------ 58| 1.22M| } 59| 4.32k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 4.32k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 3.84k, False: 480] ------------------ 60| 3.84k| uint16_t sum[4] = {0}; 61| 2.46M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 2.46M|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 2.45M, False: 3.84k] ------------------ 62| 2.45M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 63| 2.45M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 64| 2.45M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 65| 2.45M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 66| 2.45M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 67| 2.45M| } 68| 3.84k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 3.84k|#define PARAMS_NBAR 8 ------------------ 69| 3.84k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 3.84k|#define PARAMS_NBAR 8 ------------------ 70| 3.84k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 3.84k|#define PARAMS_NBAR 8 ------------------ 71| 3.84k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 3.84k|#define PARAMS_NBAR 8 ------------------ 72| 3.84k| } 73| 480| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 3| return 1; 79| 3|} oqs_kem_frodokem_976_shake_mul_add_as_plus_e_avx2: 4| 13|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 13| int i, j, k; 8| 13| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 50.7k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 50.7k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 50.7k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 50.7k, False: 13] ------------------ 11| 50.7k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 50.7k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 13| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 13| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 13| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 13| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 13| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 13| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 13| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 13| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 13|#define BYTES_SEED_A 16 ------------------ 45| 13| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 13|#define BYTES_SEED_A 16 ------------------ 46| 13| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 13|#define BYTES_SEED_A 16 ------------------ 47| 13| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 13|#define BYTES_SEED_A 16 ------------------ 48| 3.18k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 3.18k|#define PARAMS_N 976 ------------------ | Branch (48:17): [True: 3.17k, False: 13] ------------------ 49| 3.17k| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 3.17k| #define UINT16_TO_LE(n) (n) ------------------ 50| 3.17k| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 3.17k| #define UINT16_TO_LE(n) (n) ------------------ 51| 3.17k| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 3.17k| #define UINT16_TO_LE(n) (n) ------------------ 52| 3.17k| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 3.17k| #define UINT16_TO_LE(n) (n) ------------------ 53| 3.17k| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 3.17k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 3.17k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 3.17k|#define PARAMS_N 976 ------------------ 54| 3.17k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 3.17k|#define PARAMS_N 976 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 3.17k|#define BYTES_SEED_A 16 ------------------ 55| 3.17k|#endif /* USE_AES128_FOR_A */ 56| 12.3M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 12.3M|#define PARAMS_N 976 ------------------ | Branch (56:21): [True: 12.3M, False: 3.17k] ------------------ 57| 12.3M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 12.3M| #define LE_TO_UINT16(n) (n) ------------------ 58| 12.3M| } 59| 28.5k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 28.5k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 25.3k, False: 3.17k] ------------------ 60| 25.3k| uint16_t sum[4] = {0}; 61| 24.7M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 24.7M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 24.7M, False: 25.3k] ------------------ 62| 24.7M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 24.7M|#define PARAMS_N 976 ------------------ 63| 24.7M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 24.7M|#define PARAMS_N 976 ------------------ 64| 24.7M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 24.7M|#define PARAMS_N 976 ------------------ 65| 24.7M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 24.7M|#define PARAMS_N 976 ------------------ 66| 24.7M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 24.7M|#define PARAMS_N 976 ------------------ 67| 24.7M| } 68| 25.3k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 25.3k|#define PARAMS_NBAR 8 ------------------ 69| 25.3k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 25.3k|#define PARAMS_NBAR 8 ------------------ 70| 25.3k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 25.3k|#define PARAMS_NBAR 8 ------------------ 71| 25.3k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 25.3k|#define PARAMS_NBAR 8 ------------------ 72| 25.3k| } 73| 3.17k| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 13| return 1; 79| 13|} oqs_kem_frodokem_1344_shake_mul_add_as_plus_e_avx2: 4| 8|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 8| int i, j, k; 8| 8| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 43.0k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 43.0k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 43.0k, False: 8] ------------------ 11| 43.0k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 43.0k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 8| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 8| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 8| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 8| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 8| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 8| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 8| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 8| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 45| 8| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 46| 8| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 47| 8| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 48| 2.69k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 2.69k|#define PARAMS_N 1344 ------------------ | Branch (48:17): [True: 2.68k, False: 8] ------------------ 49| 2.68k| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 2.68k| #define UINT16_TO_LE(n) (n) ------------------ 50| 2.68k| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 2.68k| #define UINT16_TO_LE(n) (n) ------------------ 51| 2.68k| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 2.68k| #define UINT16_TO_LE(n) (n) ------------------ 52| 2.68k| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 2.68k| #define UINT16_TO_LE(n) (n) ------------------ 53| 2.68k| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.68k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.68k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.68k|#define PARAMS_N 1344 ------------------ 54| 2.68k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 2.68k|#define PARAMS_N 1344 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 2.68k|#define BYTES_SEED_A 16 ------------------ 55| 2.68k|#endif /* USE_AES128_FOR_A */ 56| 14.4M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 14.4M|#define PARAMS_N 1344 ------------------ | Branch (56:21): [True: 14.4M, False: 2.68k] ------------------ 57| 14.4M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 14.4M| #define LE_TO_UINT16(n) (n) ------------------ 58| 14.4M| } 59| 24.1k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 21.5k, False: 2.68k] ------------------ 60| 21.5k| uint16_t sum[4] = {0}; 61| 28.9M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 28.9M, False: 21.5k] ------------------ 62| 28.9M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 63| 28.9M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 64| 28.9M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 65| 28.9M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 66| 28.9M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 67| 28.9M| } 68| 21.5k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 21.5k|#define PARAMS_NBAR 8 ------------------ 69| 21.5k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 21.5k|#define PARAMS_NBAR 8 ------------------ 70| 21.5k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 21.5k|#define PARAMS_NBAR 8 ------------------ 71| 21.5k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 21.5k|#define PARAMS_NBAR 8 ------------------ 72| 21.5k| } 73| 2.68k| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 8| return 1; 79| 8|} oqs_kem_efrodokem_640_aes_mul_add_as_plus_e_avx2: 4| 4|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 4| int i, j, k; 8| 4| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 10.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 10.2k, False: 4] ------------------ 11| 10.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 10.2k| } 13| | 14| 4|#if defined(USE_AES128_FOR_A) 15| 4| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 4| uint8_t *aes_key_schedule; 17| 4| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 324| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 324|#define PARAMS_N 640 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 320|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 320, False: 4] ------------------ 20| 320| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 21| 320| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 22| 320| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 23| 320| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 24| 320| } 25| | 26| 644| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 644|#define PARAMS_N 640 ------------------ | Branch (26:17): [True: 640, False: 4] ------------------ 27| 51.8k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 51.8k|#define PARAMS_N 640 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 51.2k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 51.2k, False: 640] ------------------ 28| 51.2k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 51.2k|#define PARAMS_N 640 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 51.2k| #define UINT16_TO_LE(n) (n) ------------------ 29| 51.2k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 51.2k|#define PARAMS_N 640 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 51.2k| #define UINT16_TO_LE(n) (n) ------------------ 30| 51.2k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 51.2k|#define PARAMS_N 640 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 51.2k| #define UINT16_TO_LE(n) (n) ------------------ 31| 51.2k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 51.2k|#define PARAMS_N 640 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 51.2k| #define UINT16_TO_LE(n) (n) ------------------ 32| 51.2k| } 33| | 34| 640| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 640|#define PARAMS_N 640 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 1.63M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ | Branch (56:21): [True: 1.63M, False: 640] ------------------ 57| 1.63M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 1.63M| #define LE_TO_UINT16(n) (n) ------------------ 58| 1.63M| } 59| 5.76k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 5.76k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 5.12k, False: 640] ------------------ 60| 5.12k| uint16_t sum[4] = {0}; 61| 3.28M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 3.28M|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 3.27M, False: 5.12k] ------------------ 62| 3.27M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ 63| 3.27M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ 64| 3.27M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ 65| 3.27M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ 66| 3.27M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ 67| 3.27M| } 68| 5.12k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ 69| 5.12k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ 70| 5.12k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ 71| 5.12k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ 72| 5.12k| } 73| 640| } 74| | 75| 4|#if defined(USE_AES128_FOR_A) 76| 4| OQS_AES128_free_schedule(aes_key_schedule); 77| 4|#endif 78| 4| return 1; 79| 4|} oqs_kem_efrodokem_976_aes_mul_add_as_plus_e_avx2: 4| 8|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 8| int i, j, k; 8| 8| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 31.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 31.2k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 31.2k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 31.2k, False: 8] ------------------ 11| 31.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 31.2k| } 13| | 14| 8|#if defined(USE_AES128_FOR_A) 15| 8| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 8| uint8_t *aes_key_schedule; 17| 8| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 984| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 984|#define PARAMS_N 976 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 976|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 976, False: 8] ------------------ 20| 976| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 976|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 976| #define UINT16_TO_LE(n) (n) ------------------ 21| 976| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 976|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 976| #define UINT16_TO_LE(n) (n) ------------------ 22| 976| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 976|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 976| #define UINT16_TO_LE(n) (n) ------------------ 23| 976| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 976|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 976| #define UINT16_TO_LE(n) (n) ------------------ 24| 976| } 25| | 26| 1.96k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 1.96k|#define PARAMS_N 976 ------------------ | Branch (26:17): [True: 1.95k, False: 8] ------------------ 27| 240k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 240k|#define PARAMS_N 976 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 238k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 238k, False: 1.95k] ------------------ 28| 238k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 238k|#define PARAMS_N 976 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 238k| #define UINT16_TO_LE(n) (n) ------------------ 29| 238k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 238k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 238k| #define UINT16_TO_LE(n) (n) ------------------ 30| 238k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 238k|#define PARAMS_N 976 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 238k| #define UINT16_TO_LE(n) (n) ------------------ 31| 238k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 238k|#define PARAMS_N 976 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 238k| #define UINT16_TO_LE(n) (n) ------------------ 32| 238k| } 33| | 34| 1.95k| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 1.95k|#define PARAMS_N 976 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 7.62M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 7.62M|#define PARAMS_N 976 ------------------ | Branch (56:21): [True: 7.62M, False: 1.95k] ------------------ 57| 7.62M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 7.62M| #define LE_TO_UINT16(n) (n) ------------------ 58| 7.62M| } 59| 17.5k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 15.6k, False: 1.95k] ------------------ 60| 15.6k| uint16_t sum[4] = {0}; 61| 15.2M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 15.2M, False: 15.6k] ------------------ 62| 15.2M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ 63| 15.2M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ 64| 15.2M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ 65| 15.2M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ 66| 15.2M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ 67| 15.2M| } 68| 15.6k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 15.6k|#define PARAMS_NBAR 8 ------------------ 69| 15.6k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 15.6k|#define PARAMS_NBAR 8 ------------------ 70| 15.6k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 15.6k|#define PARAMS_NBAR 8 ------------------ 71| 15.6k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 15.6k|#define PARAMS_NBAR 8 ------------------ 72| 15.6k| } 73| 1.95k| } 74| | 75| 8|#if defined(USE_AES128_FOR_A) 76| 8| OQS_AES128_free_schedule(aes_key_schedule); 77| 8|#endif 78| 8| return 1; 79| 8|} oqs_kem_efrodokem_1344_aes_mul_add_as_plus_e_avx2: 4| 8|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 8| int i, j, k; 8| 8| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 43.0k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 43.0k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 43.0k, False: 8] ------------------ 11| 43.0k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 43.0k| } 13| | 14| 8|#if defined(USE_AES128_FOR_A) 15| 8| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 8| uint8_t *aes_key_schedule; 17| 8| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 1.35k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 1.35k|#define PARAMS_N 1344 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 1.34k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 1.34k, False: 8] ------------------ 20| 1.34k| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 1.34k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 1.34k| #define UINT16_TO_LE(n) (n) ------------------ 21| 1.34k| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.34k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.34k| #define UINT16_TO_LE(n) (n) ------------------ 22| 1.34k| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.34k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.34k| #define UINT16_TO_LE(n) (n) ------------------ 23| 1.34k| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.34k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.34k| #define UINT16_TO_LE(n) (n) ------------------ 24| 1.34k| } 25| | 26| 2.69k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 2.69k|#define PARAMS_N 1344 ------------------ | Branch (26:17): [True: 2.68k, False: 8] ------------------ 27| 454k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 454k|#define PARAMS_N 1344 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 451k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 451k, False: 2.68k] ------------------ 28| 451k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 451k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 451k| #define UINT16_TO_LE(n) (n) ------------------ 29| 451k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 451k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 451k| #define UINT16_TO_LE(n) (n) ------------------ 30| 451k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 451k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 451k| #define UINT16_TO_LE(n) (n) ------------------ 31| 451k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 451k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 451k| #define UINT16_TO_LE(n) (n) ------------------ 32| 451k| } 33| | 34| 2.68k| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 2.68k|#define PARAMS_N 1344 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 14.4M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 14.4M|#define PARAMS_N 1344 ------------------ | Branch (56:21): [True: 14.4M, False: 2.68k] ------------------ 57| 14.4M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 14.4M| #define LE_TO_UINT16(n) (n) ------------------ 58| 14.4M| } 59| 24.1k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 21.5k, False: 2.68k] ------------------ 60| 21.5k| uint16_t sum[4] = {0}; 61| 28.9M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 28.9M, False: 21.5k] ------------------ 62| 28.9M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 63| 28.9M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 64| 28.9M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 65| 28.9M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 66| 28.9M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 67| 28.9M| } 68| 21.5k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 21.5k|#define PARAMS_NBAR 8 ------------------ 69| 21.5k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 21.5k|#define PARAMS_NBAR 8 ------------------ 70| 21.5k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 21.5k|#define PARAMS_NBAR 8 ------------------ 71| 21.5k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 21.5k|#define PARAMS_NBAR 8 ------------------ 72| 21.5k| } 73| 2.68k| } 74| | 75| 8|#if defined(USE_AES128_FOR_A) 76| 8| OQS_AES128_free_schedule(aes_key_schedule); 77| 8|#endif 78| 8| return 1; 79| 8|} oqs_kem_efrodokem_640_shake_mul_add_as_plus_e_avx2: 4| 3|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 3| int i, j, k; 8| 3| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 7.68k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 7.68k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 7.68k, False: 3] ------------------ 11| 7.68k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 7.68k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 3| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 3| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 3| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 3| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 3| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 3| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 3| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 3| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 45| 3| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 46| 3| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 47| 3| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 48| 483| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 483|#define PARAMS_N 640 ------------------ | Branch (48:17): [True: 480, False: 3] ------------------ 49| 480| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 480| #define UINT16_TO_LE(n) (n) ------------------ 50| 480| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 480| #define UINT16_TO_LE(n) (n) ------------------ 51| 480| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 480| #define UINT16_TO_LE(n) (n) ------------------ 52| 480| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 480| #define UINT16_TO_LE(n) (n) ------------------ 53| 480| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 480|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 480|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 480|#define PARAMS_N 640 ------------------ 54| 480| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 480|#define PARAMS_N 640 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 480|#define BYTES_SEED_A 16 ------------------ 55| 480|#endif /* USE_AES128_FOR_A */ 56| 1.22M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 1.22M|#define PARAMS_N 640 ------------------ | Branch (56:21): [True: 1.22M, False: 480] ------------------ 57| 1.22M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 1.22M| #define LE_TO_UINT16(n) (n) ------------------ 58| 1.22M| } 59| 4.32k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 4.32k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 3.84k, False: 480] ------------------ 60| 3.84k| uint16_t sum[4] = {0}; 61| 2.46M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 2.46M|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 2.45M, False: 3.84k] ------------------ 62| 2.45M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 63| 2.45M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 64| 2.45M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 65| 2.45M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 66| 2.45M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 67| 2.45M| } 68| 3.84k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 3.84k|#define PARAMS_NBAR 8 ------------------ 69| 3.84k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 3.84k|#define PARAMS_NBAR 8 ------------------ 70| 3.84k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 3.84k|#define PARAMS_NBAR 8 ------------------ 71| 3.84k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 3.84k|#define PARAMS_NBAR 8 ------------------ 72| 3.84k| } 73| 480| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 3| return 1; 79| 3|} oqs_kem_efrodokem_976_shake_mul_add_as_plus_e_avx2: 4| 8|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 8| int i, j, k; 8| 8| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 31.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 31.2k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 31.2k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 31.2k, False: 8] ------------------ 11| 31.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 31.2k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 8| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 8| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 8| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 8| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 8| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 8| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 8| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 8| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 45| 8| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 46| 8| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 47| 8| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 48| 1.96k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 1.96k|#define PARAMS_N 976 ------------------ | Branch (48:17): [True: 1.95k, False: 8] ------------------ 49| 1.95k| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 1.95k| #define UINT16_TO_LE(n) (n) ------------------ 50| 1.95k| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 1.95k| #define UINT16_TO_LE(n) (n) ------------------ 51| 1.95k| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 1.95k| #define UINT16_TO_LE(n) (n) ------------------ 52| 1.95k| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 1.95k| #define UINT16_TO_LE(n) (n) ------------------ 53| 1.95k| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 1.95k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 1.95k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 1.95k|#define PARAMS_N 976 ------------------ 54| 1.95k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 1.95k|#define PARAMS_N 976 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 1.95k|#define BYTES_SEED_A 16 ------------------ 55| 1.95k|#endif /* USE_AES128_FOR_A */ 56| 7.62M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 7.62M|#define PARAMS_N 976 ------------------ | Branch (56:21): [True: 7.62M, False: 1.95k] ------------------ 57| 7.62M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 7.62M| #define LE_TO_UINT16(n) (n) ------------------ 58| 7.62M| } 59| 17.5k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 15.6k, False: 1.95k] ------------------ 60| 15.6k| uint16_t sum[4] = {0}; 61| 15.2M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 15.2M, False: 15.6k] ------------------ 62| 15.2M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ 63| 15.2M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ 64| 15.2M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ 65| 15.2M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ 66| 15.2M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ 67| 15.2M| } 68| 15.6k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 15.6k|#define PARAMS_NBAR 8 ------------------ 69| 15.6k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 15.6k|#define PARAMS_NBAR 8 ------------------ 70| 15.6k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 15.6k|#define PARAMS_NBAR 8 ------------------ 71| 15.6k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 15.6k|#define PARAMS_NBAR 8 ------------------ 72| 15.6k| } 73| 1.95k| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 8| return 1; 79| 8|} oqs_kem_efrodokem_1344_shake_mul_add_as_plus_e_avx2: 4| 3|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 3| int i, j, k; 8| 3| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 16.1k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 16.1k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 16.1k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 16.1k, False: 3] ------------------ 11| 16.1k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 16.1k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 3| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 3| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 3| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 3| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 3| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 3| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 3| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 3| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 45| 3| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 46| 3| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 47| 3| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 48| 1.01k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 1.01k|#define PARAMS_N 1344 ------------------ | Branch (48:17): [True: 1.00k, False: 3] ------------------ 49| 1.00k| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 1.00k| #define UINT16_TO_LE(n) (n) ------------------ 50| 1.00k| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 1.00k| #define UINT16_TO_LE(n) (n) ------------------ 51| 1.00k| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 1.00k| #define UINT16_TO_LE(n) (n) ------------------ 52| 1.00k| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 1.00k| #define UINT16_TO_LE(n) (n) ------------------ 53| 1.00k| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 1.00k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 1.00k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 1.00k|#define PARAMS_N 1344 ------------------ 54| 1.00k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 1.00k|#define PARAMS_N 1344 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 1.00k|#define BYTES_SEED_A 16 ------------------ 55| 1.00k|#endif /* USE_AES128_FOR_A */ 56| 5.42M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 5.42M|#define PARAMS_N 1344 ------------------ | Branch (56:21): [True: 5.41M, False: 1.00k] ------------------ 57| 5.41M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 5.41M| #define LE_TO_UINT16(n) (n) ------------------ 58| 5.41M| } 59| 9.07k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 9.07k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 8.06k, False: 1.00k] ------------------ 60| 8.06k| uint16_t sum[4] = {0}; 61| 10.8M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 10.8M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 10.8M, False: 8.06k] ------------------ 62| 10.8M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 10.8M|#define PARAMS_N 1344 ------------------ 63| 10.8M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 10.8M|#define PARAMS_N 1344 ------------------ 64| 10.8M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 10.8M|#define PARAMS_N 1344 ------------------ 65| 10.8M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 10.8M|#define PARAMS_N 1344 ------------------ 66| 10.8M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 10.8M|#define PARAMS_N 1344 ------------------ 67| 10.8M| } 68| 8.06k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 8.06k|#define PARAMS_NBAR 8 ------------------ 69| 8.06k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 8.06k|#define PARAMS_NBAR 8 ------------------ 70| 8.06k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 8.06k|#define PARAMS_NBAR 8 ------------------ 71| 8.06k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 8.06k|#define PARAMS_NBAR 8 ------------------ 72| 8.06k| } 73| 1.00k| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 3| return 1; 79| 3|} oqs_kem_frodokem_640_aes_mul_add_as_plus_e: 27| 2|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 2|#if defined(OQS_DIST_X86_64_BUILD) 31| 2| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 2, False: 0] ------------------ 32| 2| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 2|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_640_aes_mul_add_as_plus_e_avx2 ------------------ 33| 2| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_640_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 2|} oqs_kem_frodokem_640_aes_mul_add_sa_plus_e: 44| 4|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 4|#if defined(USE_AES128_FOR_A) 48| 4| #if defined(OQS_DIST_X86_64_BUILD) 49| 4| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 4, False: 0] ------------------ 50| 4| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 51| 4|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_frodokem_640_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 4| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_frodokem_640_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 4|} oqs_kem_frodokem_640_aes_mul_bs: 75| 2|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 2| int i, j, k; 79| | 80| 18| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 18|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 16, False: 2] ------------------ 81| 144| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 144|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 128, False: 16] ------------------ 82| 128| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 128|#define PARAMS_NBAR 8 ------------------ 83| 82.0k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 82.0k|#define PARAMS_N 640 ------------------ | Branch (83:25): [True: 81.9k, False: 128] ------------------ 84| 81.9k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 81.9k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 81.9k|#define PARAMS_N 640 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 81.9k|#define PARAMS_N 640 ------------------ 85| 81.9k| } 86| 128| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 2 ------------------ 147| 256| pos++; 148| 256| } 149| 32| } 150| 4|} oqs_kem_frodokem_640_aes_key_decode: 154| 2|{ // Decoding 155| 2| unsigned int i, j, index = 0, npieces_word = 8; 156| 2| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 157| 2| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 158| 2| uint8_t *pos = (uint8_t*)out; 159| 2| uint64_t templong; 160| | 161| 18| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 16, False: 2] ------------------ 162| 16| templong = 0; 163| 144| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 128, False: 16] ------------------ 164| 128| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 128|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 128|#define PARAMS_EXTRACTED_BITS 2 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 128|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 128|#define PARAMS_EXTRACTED_BITS 2 ------------------ 165| 128| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 128|#define PARAMS_EXTRACTED_BITS 2 ------------------ 166| 128| index++; 167| 128| } 168| 48| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 48|#define PARAMS_EXTRACTED_BITS 2 ------------------ | Branch (168:21): [True: 32, False: 16] ------------------ 169| 32| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 32|#define PARAMS_EXTRACTED_BITS 2 ------------------ 170| 32| } 171| 16| } 172| 2|} oqs_kem_frodokem_640_shake_mul_add_as_plus_e: 27| 3|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 3|#if defined(OQS_DIST_X86_64_BUILD) 31| 3| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 3, False: 0] ------------------ 32| 3| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 3|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_640_shake_mul_add_as_plus_e_avx2 ------------------ 33| 3| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_640_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 3|} oqs_kem_frodokem_640_shake_mul_add_sa_plus_e: 44| 6|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 6| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 6, False: 0] ------------------ 62| 6| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 51| 6|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_frodokem_640_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 6| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_frodokem_640_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 6|#endif 72| 6|} oqs_kem_frodokem_640_shake_mul_bs: 75| 3|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 3| int i, j, k; 79| | 80| 27| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 27|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 24, False: 3] ------------------ 81| 216| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 216|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 192, False: 24] ------------------ 82| 192| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 192|#define PARAMS_NBAR 8 ------------------ 83| 123k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 123k|#define PARAMS_N 640 ------------------ | Branch (83:25): [True: 122k, False: 192] ------------------ 84| 122k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 122k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 122k|#define PARAMS_N 640 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 122k|#define PARAMS_N 640 ------------------ 85| 122k| } 86| 192| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 384|#define PARAMS_EXTRACTED_BITS 2 ------------------ 147| 384| pos++; 148| 384| } 149| 48| } 150| 6|} oqs_kem_frodokem_640_shake_key_decode: 154| 3|{ // Decoding 155| 3| unsigned int i, j, index = 0, npieces_word = 8; 156| 3| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 157| 3| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 158| 3| uint8_t *pos = (uint8_t*)out; 159| 3| uint64_t templong; 160| | 161| 27| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 24, False: 3] ------------------ 162| 24| templong = 0; 163| 216| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 192, False: 24] ------------------ 164| 192| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 192|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 2 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 192|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 2 ------------------ 165| 192| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 2 ------------------ 166| 192| index++; 167| 192| } 168| 72| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 72|#define PARAMS_EXTRACTED_BITS 2 ------------------ | Branch (168:21): [True: 48, False: 24] ------------------ 169| 48| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 48|#define PARAMS_EXTRACTED_BITS 2 ------------------ 170| 48| } 171| 24| } 172| 3|} oqs_kem_frodokem_976_aes_mul_add_as_plus_e: 27| 9|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 9|#if defined(OQS_DIST_X86_64_BUILD) 31| 9| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 9, False: 0] ------------------ 32| 9| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 9|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_976_aes_mul_add_as_plus_e_avx2 ------------------ 33| 9| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_976_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 9|} oqs_kem_frodokem_976_aes_mul_add_sa_plus_e: 44| 18|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 18|#if defined(USE_AES128_FOR_A) 48| 18| #if defined(OQS_DIST_X86_64_BUILD) 49| 18| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 18, False: 0] ------------------ 50| 18| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 51| 18|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_frodokem_976_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 18| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_frodokem_976_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 18|} oqs_kem_frodokem_976_aes_mul_bs: 75| 9|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 9| int i, j, k; 79| | 80| 81| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 81|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 72, False: 9] ------------------ 81| 648| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 648|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 576, False: 72] ------------------ 82| 576| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 576|#define PARAMS_NBAR 8 ------------------ 83| 562k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 562k|#define PARAMS_N 976 ------------------ | Branch (83:25): [True: 562k, False: 576] ------------------ 84| 562k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 562k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 562k|#define PARAMS_N 976 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 562k|#define PARAMS_N 976 ------------------ 85| 562k| } 86| 576| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.15k|#define PARAMS_EXTRACTED_BITS 3 ------------------ 147| 1.15k| pos++; 148| 1.15k| } 149| 144| } 150| 18|} oqs_kem_frodokem_976_aes_key_decode: 154| 9|{ // Decoding 155| 9| unsigned int i, j, index = 0, npieces_word = 8; 156| 9| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 157| 9| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 158| 9| uint8_t *pos = (uint8_t*)out; 159| 9| uint64_t templong; 160| | 161| 81| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 72, False: 9] ------------------ 162| 72| templong = 0; 163| 648| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 576, False: 72] ------------------ 164| 576| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 576|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 3 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 576|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 3 ------------------ 165| 576| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 3 ------------------ 166| 576| index++; 167| 576| } 168| 288| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 288|#define PARAMS_EXTRACTED_BITS 3 ------------------ | Branch (168:21): [True: 216, False: 72] ------------------ 169| 216| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 216|#define PARAMS_EXTRACTED_BITS 3 ------------------ 170| 216| } 171| 72| } 172| 9|} oqs_kem_frodokem_976_shake_mul_add_as_plus_e: 27| 13|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 13|#if defined(OQS_DIST_X86_64_BUILD) 31| 13| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 13, False: 0] ------------------ 32| 13| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 13|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_976_shake_mul_add_as_plus_e_avx2 ------------------ 33| 13| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_976_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 13|} oqs_kem_frodokem_976_shake_mul_add_sa_plus_e: 44| 26|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 26| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 26, False: 0] ------------------ 62| 26| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 51| 26|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_frodokem_976_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 26| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_frodokem_976_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 26|#endif 72| 26|} oqs_kem_frodokem_976_shake_mul_bs: 75| 13|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 13| int i, j, k; 79| | 80| 117| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 117|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 104, False: 13] ------------------ 81| 936| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 936|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 832, False: 104] ------------------ 82| 832| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 832|#define PARAMS_NBAR 8 ------------------ 83| 812k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 812k|#define PARAMS_N 976 ------------------ | Branch (83:25): [True: 812k, False: 832] ------------------ 84| 812k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 812k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 812k|#define PARAMS_N 976 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 812k|#define PARAMS_N 976 ------------------ 85| 812k| } 86| 832| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.66k|#define PARAMS_EXTRACTED_BITS 3 ------------------ 147| 1.66k| pos++; 148| 1.66k| } 149| 208| } 150| 26|} oqs_kem_frodokem_976_shake_key_decode: 154| 13|{ // Decoding 155| 13| unsigned int i, j, index = 0, npieces_word = 8; 156| 13| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 13|#define PARAMS_NBAR 8 ------------------ 157| 13| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 13|#define PARAMS_EXTRACTED_BITS 3 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 13|#define PARAMS_LOGQ 16 ------------------ 158| 13| uint8_t *pos = (uint8_t*)out; 159| 13| uint64_t templong; 160| | 161| 117| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 104, False: 13] ------------------ 162| 104| templong = 0; 163| 936| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 832, False: 104] ------------------ 164| 832| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 832|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 832|#define PARAMS_EXTRACTED_BITS 3 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 832|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 832|#define PARAMS_EXTRACTED_BITS 3 ------------------ 165| 832| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 832|#define PARAMS_EXTRACTED_BITS 3 ------------------ 166| 832| index++; 167| 832| } 168| 416| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 416|#define PARAMS_EXTRACTED_BITS 3 ------------------ | Branch (168:21): [True: 312, False: 104] ------------------ 169| 312| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 312|#define PARAMS_EXTRACTED_BITS 3 ------------------ 170| 312| } 171| 104| } 172| 13|} oqs_kem_frodokem_1344_aes_mul_add_as_plus_e: 27| 9|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 9|#if defined(OQS_DIST_X86_64_BUILD) 31| 9| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 9, False: 0] ------------------ 32| 9| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 9|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_1344_aes_mul_add_as_plus_e_avx2 ------------------ 33| 9| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_1344_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 9|} oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e: 44| 18|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 18|#if defined(USE_AES128_FOR_A) 48| 18| #if defined(OQS_DIST_X86_64_BUILD) 49| 18| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 18, False: 0] ------------------ 50| 18| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 51| 18|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 18| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 18|} oqs_kem_frodokem_1344_aes_mul_bs: 75| 9|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 9| int i, j, k; 79| | 80| 81| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 81|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 72, False: 9] ------------------ 81| 648| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 648|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 576, False: 72] ------------------ 82| 576| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 576|#define PARAMS_NBAR 8 ------------------ 83| 774k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 774k|#define PARAMS_N 1344 ------------------ | Branch (83:25): [True: 774k, False: 576] ------------------ 84| 774k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 774k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 774k|#define PARAMS_N 1344 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 774k|#define PARAMS_N 1344 ------------------ 85| 774k| } 86| 576| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.15k|#define PARAMS_EXTRACTED_BITS 4 ------------------ 147| 1.15k| pos++; 148| 1.15k| } 149| 144| } 150| 18|} oqs_kem_frodokem_1344_aes_key_decode: 154| 9|{ // Decoding 155| 9| unsigned int i, j, index = 0, npieces_word = 8; 156| 9| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 157| 9| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 158| 9| uint8_t *pos = (uint8_t*)out; 159| 9| uint64_t templong; 160| | 161| 81| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 72, False: 9] ------------------ 162| 72| templong = 0; 163| 648| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 576, False: 72] ------------------ 164| 576| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 576|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 4 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 576|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 4 ------------------ 165| 576| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 4 ------------------ 166| 576| index++; 167| 576| } 168| 360| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 360|#define PARAMS_EXTRACTED_BITS 4 ------------------ | Branch (168:21): [True: 288, False: 72] ------------------ 169| 288| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 288|#define PARAMS_EXTRACTED_BITS 4 ------------------ 170| 288| } 171| 72| } 172| 9|} oqs_kem_frodokem_1344_shake_mul_add_as_plus_e: 27| 8|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 8|#if defined(OQS_DIST_X86_64_BUILD) 31| 8| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 8, False: 0] ------------------ 32| 8| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 8|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_1344_shake_mul_add_as_plus_e_avx2 ------------------ 33| 8| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_1344_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 8|} oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e: 44| 16|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 16| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 16, False: 0] ------------------ 62| 16| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 51| 16|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 16| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 16|#endif 72| 16|} oqs_kem_frodokem_1344_shake_mul_bs: 75| 8|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 8| int i, j, k; 79| | 80| 72| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 72|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 64, False: 8] ------------------ 81| 576| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 576|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 512, False: 64] ------------------ 82| 512| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 512|#define PARAMS_NBAR 8 ------------------ 83| 688k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 688k|#define PARAMS_N 1344 ------------------ | Branch (83:25): [True: 688k, False: 512] ------------------ 84| 688k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 688k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 688k|#define PARAMS_N 1344 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 688k|#define PARAMS_N 1344 ------------------ 85| 688k| } 86| 512| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.02k|#define PARAMS_EXTRACTED_BITS 4 ------------------ 147| 1.02k| pos++; 148| 1.02k| } 149| 128| } 150| 16|} oqs_kem_frodokem_1344_shake_key_decode: 154| 8|{ // Decoding 155| 8| unsigned int i, j, index = 0, npieces_word = 8; 156| 8| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 157| 8| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 158| 8| uint8_t *pos = (uint8_t*)out; 159| 8| uint64_t templong; 160| | 161| 72| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 64, False: 8] ------------------ 162| 64| templong = 0; 163| 576| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 512, False: 64] ------------------ 164| 512| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 512|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 4 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 512|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 4 ------------------ 165| 512| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 4 ------------------ 166| 512| index++; 167| 512| } 168| 320| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 320|#define PARAMS_EXTRACTED_BITS 4 ------------------ | Branch (168:21): [True: 256, False: 64] ------------------ 169| 256| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 4 ------------------ 170| 256| } 171| 64| } 172| 8|} oqs_kem_efrodokem_640_aes_mul_add_as_plus_e: 27| 4|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 4|#if defined(OQS_DIST_X86_64_BUILD) 31| 4| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 4, False: 0] ------------------ 32| 4| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 4|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_640_aes_mul_add_as_plus_e_avx2 ------------------ 33| 4| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_ekem_frodokem_640_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 4|} oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e: 44| 8|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 8|#if defined(USE_AES128_FOR_A) 48| 8| #if defined(OQS_DIST_X86_64_BUILD) 49| 8| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 8, False: 0] ------------------ 50| 8| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 49| 8|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 8| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 8|} oqs_kem_efrodokem_640_aes_mul_bs: 75| 4|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 4| int i, j, k; 79| | 80| 36| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 36|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 32, False: 4] ------------------ 81| 288| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 288|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 256, False: 32] ------------------ 82| 256| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 256|#define PARAMS_NBAR 8 ------------------ 83| 164k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 164k|#define PARAMS_N 640 ------------------ | Branch (83:25): [True: 163k, False: 256] ------------------ 84| 163k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 163k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 163k|#define PARAMS_N 640 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 163k|#define PARAMS_N 640 ------------------ 85| 163k| } 86| 256| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 2 ------------------ 147| 512| pos++; 148| 512| } 149| 64| } 150| 8|} oqs_kem_efrodokem_640_aes_key_decode: 154| 4|{ // Decoding 155| 4| unsigned int i, j, index = 0, npieces_word = 8; 156| 4| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 157| 4| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 158| 4| uint8_t *pos = (uint8_t*)out; 159| 4| uint64_t templong; 160| | 161| 36| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 32, False: 4] ------------------ 162| 32| templong = 0; 163| 288| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 256, False: 32] ------------------ 164| 256| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 256|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 2 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 256|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 2 ------------------ 165| 256| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 2 ------------------ 166| 256| index++; 167| 256| } 168| 96| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 96|#define PARAMS_EXTRACTED_BITS 2 ------------------ | Branch (168:21): [True: 64, False: 32] ------------------ 169| 64| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 64|#define PARAMS_EXTRACTED_BITS 2 ------------------ 170| 64| } 171| 32| } 172| 4|} oqs_kem_efrodokem_640_shake_mul_add_as_plus_e: 27| 3|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 3|#if defined(OQS_DIST_X86_64_BUILD) 31| 3| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 3, False: 0] ------------------ 32| 3| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 3|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_640_shake_mul_add_as_plus_e_avx2 ------------------ 33| 3| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_efrodokem_640_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 3|} oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e: 44| 6|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 6| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 6, False: 0] ------------------ 62| 6| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 49| 6|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 6| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 6|#endif 72| 6|} oqs_kem_efrodokem_640_shake_mul_bs: 75| 3|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 3| int i, j, k; 79| | 80| 27| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 27|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 24, False: 3] ------------------ 81| 216| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 216|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 192, False: 24] ------------------ 82| 192| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 192|#define PARAMS_NBAR 8 ------------------ 83| 123k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 123k|#define PARAMS_N 640 ------------------ | Branch (83:25): [True: 122k, False: 192] ------------------ 84| 122k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 122k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 122k|#define PARAMS_N 640 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 122k|#define PARAMS_N 640 ------------------ 85| 122k| } 86| 192| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 384|#define PARAMS_EXTRACTED_BITS 2 ------------------ 147| 384| pos++; 148| 384| } 149| 48| } 150| 6|} oqs_kem_efrodokem_640_shake_key_decode: 154| 3|{ // Decoding 155| 3| unsigned int i, j, index = 0, npieces_word = 8; 156| 3| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 157| 3| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 158| 3| uint8_t *pos = (uint8_t*)out; 159| 3| uint64_t templong; 160| | 161| 27| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 24, False: 3] ------------------ 162| 24| templong = 0; 163| 216| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 192, False: 24] ------------------ 164| 192| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 192|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 2 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 192|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 2 ------------------ 165| 192| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 2 ------------------ 166| 192| index++; 167| 192| } 168| 72| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 72|#define PARAMS_EXTRACTED_BITS 2 ------------------ | Branch (168:21): [True: 48, False: 24] ------------------ 169| 48| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 48|#define PARAMS_EXTRACTED_BITS 2 ------------------ 170| 48| } 171| 24| } 172| 3|} oqs_kem_efrodokem_976_aes_mul_add_as_plus_e: 27| 8|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 8|#if defined(OQS_DIST_X86_64_BUILD) 31| 8| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 8, False: 0] ------------------ 32| 8| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 8|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_976_aes_mul_add_as_plus_e_avx2 ------------------ 33| 8| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_efrodokem_976_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 8|} oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e: 44| 16|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 16|#if defined(USE_AES128_FOR_A) 48| 16| #if defined(OQS_DIST_X86_64_BUILD) 49| 16| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 16, False: 0] ------------------ 50| 16| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 49| 16|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 16| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 16|} oqs_kem_efrodokem_976_aes_mul_bs: 75| 8|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 8| int i, j, k; 79| | 80| 72| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 72|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 64, False: 8] ------------------ 81| 576| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 576|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 512, False: 64] ------------------ 82| 512| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 512|#define PARAMS_NBAR 8 ------------------ 83| 500k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 500k|#define PARAMS_N 976 ------------------ | Branch (83:25): [True: 499k, False: 512] ------------------ 84| 499k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 499k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 499k|#define PARAMS_N 976 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 499k|#define PARAMS_N 976 ------------------ 85| 499k| } 86| 512| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.02k|#define PARAMS_EXTRACTED_BITS 3 ------------------ 147| 1.02k| pos++; 148| 1.02k| } 149| 128| } 150| 16|} oqs_kem_efrodokem_976_aes_key_decode: 154| 8|{ // Decoding 155| 8| unsigned int i, j, index = 0, npieces_word = 8; 156| 8| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 157| 8| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 158| 8| uint8_t *pos = (uint8_t*)out; 159| 8| uint64_t templong; 160| | 161| 72| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 64, False: 8] ------------------ 162| 64| templong = 0; 163| 576| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 512, False: 64] ------------------ 164| 512| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 512|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 3 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 512|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 3 ------------------ 165| 512| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 3 ------------------ 166| 512| index++; 167| 512| } 168| 256| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 3 ------------------ | Branch (168:21): [True: 192, False: 64] ------------------ 169| 192| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 3 ------------------ 170| 192| } 171| 64| } 172| 8|} oqs_kem_efrodokem_976_shake_mul_add_as_plus_e: 27| 8|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 8|#if defined(OQS_DIST_X86_64_BUILD) 31| 8| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 8, False: 0] ------------------ 32| 8| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 8|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_976_shake_mul_add_as_plus_e_avx2 ------------------ 33| 8| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_efrodokem_976_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 8|} oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e: 44| 16|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 16| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 16, False: 0] ------------------ 62| 16| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 49| 16|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 16| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 16|#endif 72| 16|} oqs_kem_efrodokem_976_shake_mul_bs: 75| 8|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 8| int i, j, k; 79| | 80| 72| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 72|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 64, False: 8] ------------------ 81| 576| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 576|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 512, False: 64] ------------------ 82| 512| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 512|#define PARAMS_NBAR 8 ------------------ 83| 500k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 500k|#define PARAMS_N 976 ------------------ | Branch (83:25): [True: 499k, False: 512] ------------------ 84| 499k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 499k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 499k|#define PARAMS_N 976 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 499k|#define PARAMS_N 976 ------------------ 85| 499k| } 86| 512| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.02k|#define PARAMS_EXTRACTED_BITS 3 ------------------ 147| 1.02k| pos++; 148| 1.02k| } 149| 128| } 150| 16|} oqs_kem_efrodokem_976_shake_key_decode: 154| 8|{ // Decoding 155| 8| unsigned int i, j, index = 0, npieces_word = 8; 156| 8| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 157| 8| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 158| 8| uint8_t *pos = (uint8_t*)out; 159| 8| uint64_t templong; 160| | 161| 72| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 64, False: 8] ------------------ 162| 64| templong = 0; 163| 576| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 512, False: 64] ------------------ 164| 512| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 512|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 3 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 512|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 3 ------------------ 165| 512| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 3 ------------------ 166| 512| index++; 167| 512| } 168| 256| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 3 ------------------ | Branch (168:21): [True: 192, False: 64] ------------------ 169| 192| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 3 ------------------ 170| 192| } 171| 64| } 172| 8|} oqs_kem_efrodokem_1344_aes_mul_add_as_plus_e: 27| 8|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 8|#if defined(OQS_DIST_X86_64_BUILD) 31| 8| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 8, False: 0] ------------------ 32| 8| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 8|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_1344_aes_mul_add_as_plus_e_avx2 ------------------ 33| 8| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_efrodokem_1344_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 8|} oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e: 44| 16|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 16|#if defined(USE_AES128_FOR_A) 48| 16| #if defined(OQS_DIST_X86_64_BUILD) 49| 16| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 16, False: 0] ------------------ 50| 16| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 49| 16|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 16| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 16|} oqs_kem_efrodokem_1344_aes_mul_bs: 75| 8|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 8| int i, j, k; 79| | 80| 72| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 72|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 64, False: 8] ------------------ 81| 576| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 576|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 512, False: 64] ------------------ 82| 512| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 512|#define PARAMS_NBAR 8 ------------------ 83| 688k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 688k|#define PARAMS_N 1344 ------------------ | Branch (83:25): [True: 688k, False: 512] ------------------ 84| 688k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 688k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 688k|#define PARAMS_N 1344 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 688k|#define PARAMS_N 1344 ------------------ 85| 688k| } 86| 512| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.02k|#define PARAMS_EXTRACTED_BITS 4 ------------------ 147| 1.02k| pos++; 148| 1.02k| } 149| 128| } 150| 16|} oqs_kem_efrodokem_1344_aes_key_decode: 154| 8|{ // Decoding 155| 8| unsigned int i, j, index = 0, npieces_word = 8; 156| 8| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 157| 8| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 158| 8| uint8_t *pos = (uint8_t*)out; 159| 8| uint64_t templong; 160| | 161| 72| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 64, False: 8] ------------------ 162| 64| templong = 0; 163| 576| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 512, False: 64] ------------------ 164| 512| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 512|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 4 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 512|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 4 ------------------ 165| 512| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 4 ------------------ 166| 512| index++; 167| 512| } 168| 320| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 320|#define PARAMS_EXTRACTED_BITS 4 ------------------ | Branch (168:21): [True: 256, False: 64] ------------------ 169| 256| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 4 ------------------ 170| 256| } 171| 64| } 172| 8|} oqs_kem_efrodokem_1344_shake_mul_add_as_plus_e: 27| 3|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 3|#if defined(OQS_DIST_X86_64_BUILD) 31| 3| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 3, False: 0] ------------------ 32| 3| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 3|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_1344_shake_mul_add_as_plus_e_avx2 ------------------ 33| 3| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_efrodokem_1344_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 3|} oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e: 44| 6|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 6| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 6, False: 0] ------------------ 62| 6| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 49| 6|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 6| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 6|#endif 72| 6|} oqs_kem_efrodokem_1344_shake_mul_bs: 75| 3|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 3| int i, j, k; 79| | 80| 27| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 27|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 24, False: 3] ------------------ 81| 216| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 216|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 192, False: 24] ------------------ 82| 192| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 192|#define PARAMS_NBAR 8 ------------------ 83| 258k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 258k|#define PARAMS_N 1344 ------------------ | Branch (83:25): [True: 258k, False: 192] ------------------ 84| 258k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 258k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 258k|#define PARAMS_N 1344 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 258k|#define PARAMS_N 1344 ------------------ 85| 258k| } 86| 192| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 384|#define PARAMS_EXTRACTED_BITS 4 ------------------ 147| 384| pos++; 148| 384| } 149| 48| } 150| 6|} oqs_kem_efrodokem_1344_shake_key_decode: 154| 3|{ // Decoding 155| 3| unsigned int i, j, index = 0, npieces_word = 8; 156| 3| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 157| 3| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 3|#define PARAMS_EXTRACTED_BITS 4 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 3|#define PARAMS_LOGQ 16 ------------------ 158| 3| uint8_t *pos = (uint8_t*)out; 159| 3| uint64_t templong; 160| | 161| 27| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 24, False: 3] ------------------ 162| 24| templong = 0; 163| 216| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 192, False: 24] ------------------ 164| 192| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 192|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 4 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 192|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 4 ------------------ 165| 192| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 4 ------------------ 166| 192| index++; 167| 192| } 168| 120| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 120|#define PARAMS_EXTRACTED_BITS 4 ------------------ | Branch (168:21): [True: 96, False: 24] ------------------ 169| 96| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 96|#define PARAMS_EXTRACTED_BITS 4 ------------------ 170| 96| } 171| 24| } 172| 3|} oqs_kem_frodokem_640_shake_mul_add_sa_plus_e_avx2: 7| 6|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 6| int i, j, kk; 11| | 12| 15.3k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 15.3k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 15.3k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 15.3k, False: 6] ------------------ 13| 15.3k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 15.3k| } 15| | 16| 6| int t=0; 17| 6| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 6| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 6| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 6| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 6| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 6| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 6| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 6| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 6| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 6| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 28| 6| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 29| 6| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 30| 6| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 31| | 32| 966| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 966|#define PARAMS_N 640 ------------------ | Branch (32:18): [True: 960, False: 6] ------------------ 33| 960| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 960| #define UINT16_TO_LE(n) (n) ------------------ 34| 960| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 960| #define UINT16_TO_LE(n) (n) ------------------ 35| 960| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 960| #define UINT16_TO_LE(n) (n) ------------------ 36| 960| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 960| #define UINT16_TO_LE(n) (n) ------------------ 37| 960| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 960|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 960|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 960|#define PARAMS_N 640 ------------------ 38| 960| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 960|#define PARAMS_N 640 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 960|#define BYTES_SEED_A 16 ------------------ 39| | 40| 8.64k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 8.64k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 7.68k, False: 960] ------------------ 41| 7.68k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 7.68k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ 43| 7.68k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ 44| 7.68k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ 45| 7.68k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ 46| 314k| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 314k|#define PARAMS_N 640 ------------------ | Branch (46:25): [True: 307k, False: 7.68k] ------------------ 47| 307k| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 48| 307k| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 49| 307k| a = _mm256_mullo_epi16(a, b0); 50| 307k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 307k| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 52| 307k| a = _mm256_mullo_epi16(a, b1); 53| 307k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 307k| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 55| 307k| a = _mm256_mullo_epi16(a, b2); 56| 307k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 307k| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 58| 307k| a = _mm256_mullo_epi16(a, b3); 59| 307k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 307k| } 61| 314k| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 314k|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 307k, False: 7.68k] ------------------ 62| 307k| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 63| 307k| } 64| 7.68k| } 65| 960| } 66| | 67| 6| return 1; 68| 6|} oqs_kem_frodokem_976_shake_mul_add_sa_plus_e_avx2: 7| 26|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 26| int i, j, kk; 11| | 12| 101k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 101k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 101k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 101k, False: 26] ------------------ 13| 101k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 101k| } 15| | 16| 26| int t=0; 17| 26| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 26| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 26| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 26| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 26| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 26| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 26| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 26| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 26| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 26| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 26|#define BYTES_SEED_A 16 ------------------ 28| 26| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 26|#define BYTES_SEED_A 16 ------------------ 29| 26| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 26|#define BYTES_SEED_A 16 ------------------ 30| 26| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 26|#define BYTES_SEED_A 16 ------------------ 31| | 32| 6.37k| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 6.37k|#define PARAMS_N 976 ------------------ | Branch (32:18): [True: 6.34k, False: 26] ------------------ 33| 6.34k| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 6.34k| #define UINT16_TO_LE(n) (n) ------------------ 34| 6.34k| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 6.34k| #define UINT16_TO_LE(n) (n) ------------------ 35| 6.34k| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 6.34k| #define UINT16_TO_LE(n) (n) ------------------ 36| 6.34k| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 6.34k| #define UINT16_TO_LE(n) (n) ------------------ 37| 6.34k| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 6.34k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 6.34k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 6.34k|#define PARAMS_N 976 ------------------ 38| 6.34k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 6.34k|#define PARAMS_N 976 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 6.34k|#define BYTES_SEED_A 16 ------------------ 39| | 40| 57.0k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 57.0k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 50.7k, False: 6.34k] ------------------ 41| 50.7k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 50.7k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 50.7k|#define PARAMS_N 976 ------------------ 43| 50.7k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 50.7k|#define PARAMS_N 976 ------------------ 44| 50.7k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 50.7k|#define PARAMS_N 976 ------------------ 45| 50.7k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 50.7k|#define PARAMS_N 976 ------------------ 46| 3.14M| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 3.14M|#define PARAMS_N 976 ------------------ | Branch (46:25): [True: 3.09M, False: 50.7k] ------------------ 47| 3.09M| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 3.09M|#define PARAMS_N 976 ------------------ 48| 3.09M| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 3.09M|#define PARAMS_N 976 ------------------ 49| 3.09M| a = _mm256_mullo_epi16(a, b0); 50| 3.09M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 3.09M| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 3.09M|#define PARAMS_N 976 ------------------ 52| 3.09M| a = _mm256_mullo_epi16(a, b1); 53| 3.09M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 3.09M| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 3.09M|#define PARAMS_N 976 ------------------ 55| 3.09M| a = _mm256_mullo_epi16(a, b2); 56| 3.09M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 3.09M| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 3.09M|#define PARAMS_N 976 ------------------ 58| 3.09M| a = _mm256_mullo_epi16(a, b3); 59| 3.09M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 3.09M| } 61| 3.14M| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 3.14M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 3.09M, False: 50.7k] ------------------ 62| 3.09M| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 3.09M|#define PARAMS_N 976 ------------------ 63| 3.09M| } 64| 50.7k| } 65| 6.34k| } 66| | 67| 26| return 1; 68| 26|} oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e_avx2: 7| 16|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 16| int i, j, kk; 11| | 12| 86.0k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 86.0k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 86.0k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 86.0k, False: 16] ------------------ 13| 86.0k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 86.0k| } 15| | 16| 16| int t=0; 17| 16| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 16| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 16| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 16| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 16| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 16| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 16| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 16| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 16| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 16| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 16|#define BYTES_SEED_A 16 ------------------ 28| 16| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 16|#define BYTES_SEED_A 16 ------------------ 29| 16| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 16|#define BYTES_SEED_A 16 ------------------ 30| 16| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 16|#define BYTES_SEED_A 16 ------------------ 31| | 32| 5.39k| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 5.39k|#define PARAMS_N 1344 ------------------ | Branch (32:18): [True: 5.37k, False: 16] ------------------ 33| 5.37k| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 5.37k| #define UINT16_TO_LE(n) (n) ------------------ 34| 5.37k| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 5.37k| #define UINT16_TO_LE(n) (n) ------------------ 35| 5.37k| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 5.37k| #define UINT16_TO_LE(n) (n) ------------------ 36| 5.37k| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 5.37k| #define UINT16_TO_LE(n) (n) ------------------ 37| 5.37k| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 5.37k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 5.37k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 5.37k|#define PARAMS_N 1344 ------------------ 38| 5.37k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 5.37k|#define PARAMS_N 1344 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 5.37k|#define BYTES_SEED_A 16 ------------------ 39| | 40| 48.3k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 48.3k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 43.0k, False: 5.37k] ------------------ 41| 43.0k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 43.0k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ 43| 43.0k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ 44| 43.0k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ 45| 43.0k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ 46| 3.65M| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 3.65M|#define PARAMS_N 1344 ------------------ | Branch (46:25): [True: 3.61M, False: 43.0k] ------------------ 47| 3.61M| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 48| 3.61M| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 49| 3.61M| a = _mm256_mullo_epi16(a, b0); 50| 3.61M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 3.61M| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 52| 3.61M| a = _mm256_mullo_epi16(a, b1); 53| 3.61M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 3.61M| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 55| 3.61M| a = _mm256_mullo_epi16(a, b2); 56| 3.61M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 3.61M| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 58| 3.61M| a = _mm256_mullo_epi16(a, b3); 59| 3.61M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 3.61M| } 61| 3.65M| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 3.65M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 3.61M, False: 43.0k] ------------------ 62| 3.61M| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 63| 3.61M| } 64| 43.0k| } 65| 5.37k| } 66| | 67| 16| return 1; 68| 16|} oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e_avx2: 7| 6|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 6| int i, j, kk; 11| | 12| 15.3k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 15.3k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 15.3k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 15.3k, False: 6] ------------------ 13| 15.3k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 15.3k| } 15| | 16| 6| int t=0; 17| 6| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 6| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 6| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 6| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 6| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 6| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 6| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 6| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 6| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 6| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 28| 6| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 29| 6| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 30| 6| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 31| | 32| 966| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 966|#define PARAMS_N 640 ------------------ | Branch (32:18): [True: 960, False: 6] ------------------ 33| 960| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 960| #define UINT16_TO_LE(n) (n) ------------------ 34| 960| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 960| #define UINT16_TO_LE(n) (n) ------------------ 35| 960| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 960| #define UINT16_TO_LE(n) (n) ------------------ 36| 960| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 960| #define UINT16_TO_LE(n) (n) ------------------ 37| 960| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 960|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 960|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 960|#define PARAMS_N 640 ------------------ 38| 960| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 960|#define PARAMS_N 640 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 960|#define BYTES_SEED_A 16 ------------------ 39| | 40| 8.64k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 8.64k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 7.68k, False: 960] ------------------ 41| 7.68k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 7.68k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ 43| 7.68k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ 44| 7.68k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ 45| 7.68k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ 46| 314k| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 314k|#define PARAMS_N 640 ------------------ | Branch (46:25): [True: 307k, False: 7.68k] ------------------ 47| 307k| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 48| 307k| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 49| 307k| a = _mm256_mullo_epi16(a, b0); 50| 307k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 307k| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 52| 307k| a = _mm256_mullo_epi16(a, b1); 53| 307k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 307k| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 55| 307k| a = _mm256_mullo_epi16(a, b2); 56| 307k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 307k| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 58| 307k| a = _mm256_mullo_epi16(a, b3); 59| 307k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 307k| } 61| 314k| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 314k|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 307k, False: 7.68k] ------------------ 62| 307k| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 63| 307k| } 64| 7.68k| } 65| 960| } 66| | 67| 6| return 1; 68| 6|} oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e_avx2: 7| 16|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 16| int i, j, kk; 11| | 12| 62.4k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 62.4k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 62.4k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 62.4k, False: 16] ------------------ 13| 62.4k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 62.4k| } 15| | 16| 16| int t=0; 17| 16| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 16| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 16| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 16| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 16| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 16| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 16| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 16| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 16| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 16| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 16|#define BYTES_SEED_A 16 ------------------ 28| 16| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 16|#define BYTES_SEED_A 16 ------------------ 29| 16| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 16|#define BYTES_SEED_A 16 ------------------ 30| 16| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 16|#define BYTES_SEED_A 16 ------------------ 31| | 32| 3.92k| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 3.92k|#define PARAMS_N 976 ------------------ | Branch (32:18): [True: 3.90k, False: 16] ------------------ 33| 3.90k| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 3.90k| #define UINT16_TO_LE(n) (n) ------------------ 34| 3.90k| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 3.90k| #define UINT16_TO_LE(n) (n) ------------------ 35| 3.90k| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 3.90k| #define UINT16_TO_LE(n) (n) ------------------ 36| 3.90k| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 3.90k| #define UINT16_TO_LE(n) (n) ------------------ 37| 3.90k| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 3.90k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 3.90k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 3.90k|#define PARAMS_N 976 ------------------ 38| 3.90k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 3.90k|#define PARAMS_N 976 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 3.90k|#define BYTES_SEED_A 16 ------------------ 39| | 40| 35.1k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 35.1k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 31.2k, False: 3.90k] ------------------ 41| 31.2k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 31.2k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 31.2k|#define PARAMS_N 976 ------------------ 43| 31.2k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 31.2k|#define PARAMS_N 976 ------------------ 44| 31.2k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 31.2k|#define PARAMS_N 976 ------------------ 45| 31.2k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 31.2k|#define PARAMS_N 976 ------------------ 46| 1.93M| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 1.93M|#define PARAMS_N 976 ------------------ | Branch (46:25): [True: 1.90M, False: 31.2k] ------------------ 47| 1.90M| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 48| 1.90M| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 49| 1.90M| a = _mm256_mullo_epi16(a, b0); 50| 1.90M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 1.90M| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 52| 1.90M| a = _mm256_mullo_epi16(a, b1); 53| 1.90M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 1.90M| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 55| 1.90M| a = _mm256_mullo_epi16(a, b2); 56| 1.90M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 1.90M| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 58| 1.90M| a = _mm256_mullo_epi16(a, b3); 59| 1.90M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 1.90M| } 61| 1.93M| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 1.93M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 1.90M, False: 31.2k] ------------------ 62| 1.90M| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 63| 1.90M| } 64| 31.2k| } 65| 3.90k| } 66| | 67| 16| return 1; 68| 16|} oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e_avx2: 7| 6|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 6| int i, j, kk; 11| | 12| 32.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 32.2k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 32.2k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 32.2k, False: 6] ------------------ 13| 32.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 32.2k| } 15| | 16| 6| int t=0; 17| 6| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 6| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 6| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 6| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 6| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 6| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 6| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 6| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 6| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 6| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 28| 6| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 29| 6| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 30| 6| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 31| | 32| 2.02k| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 2.02k|#define PARAMS_N 1344 ------------------ | Branch (32:18): [True: 2.01k, False: 6] ------------------ 33| 2.01k| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 2.01k| #define UINT16_TO_LE(n) (n) ------------------ 34| 2.01k| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 2.01k| #define UINT16_TO_LE(n) (n) ------------------ 35| 2.01k| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 2.01k| #define UINT16_TO_LE(n) (n) ------------------ 36| 2.01k| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 2.01k| #define UINT16_TO_LE(n) (n) ------------------ 37| 2.01k| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 2.01k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 2.01k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 2.01k|#define PARAMS_N 1344 ------------------ 38| 2.01k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 2.01k|#define PARAMS_N 1344 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 2.01k|#define BYTES_SEED_A 16 ------------------ 39| | 40| 18.1k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 18.1k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 16.1k, False: 2.01k] ------------------ 41| 16.1k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 16.1k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 16.1k|#define PARAMS_N 1344 ------------------ 43| 16.1k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 16.1k|#define PARAMS_N 1344 ------------------ 44| 16.1k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 16.1k|#define PARAMS_N 1344 ------------------ 45| 16.1k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 16.1k|#define PARAMS_N 1344 ------------------ 46| 1.37M| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 1.37M|#define PARAMS_N 1344 ------------------ | Branch (46:25): [True: 1.35M, False: 16.1k] ------------------ 47| 1.35M| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 1.35M|#define PARAMS_N 1344 ------------------ 48| 1.35M| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 1.35M|#define PARAMS_N 1344 ------------------ 49| 1.35M| a = _mm256_mullo_epi16(a, b0); 50| 1.35M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 1.35M| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 1.35M|#define PARAMS_N 1344 ------------------ 52| 1.35M| a = _mm256_mullo_epi16(a, b1); 53| 1.35M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 1.35M| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 1.35M|#define PARAMS_N 1344 ------------------ 55| 1.35M| a = _mm256_mullo_epi16(a, b2); 56| 1.35M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 1.35M| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 1.35M|#define PARAMS_N 1344 ------------------ 58| 1.35M| a = _mm256_mullo_epi16(a, b3); 59| 1.35M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 1.35M| } 61| 1.37M| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 1.37M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 1.35M, False: 16.1k] ------------------ 62| 1.35M| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 1.35M|#define PARAMS_N 1344 ------------------ 63| 1.35M| } 64| 16.1k| } 65| 2.01k| } 66| | 67| 6| return 1; 68| 6|} oqs_kem_frodokem_640_aes_sample_n: 8| 16|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 16| unsigned int i, j; 12| 16| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 16|#define CDF_TABLE {4643, 13363, 20579, 25843, 29227, 31145, 32103, 32525, 32689, 32745, 32762, 32766, 32767} ------------------ 13| | 14| 61.7k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 61.6k, False: 16] ------------------ 15| 61.6k| uint16_t sample = 0; 16| 61.6k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 61.6k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 802k| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 802k|#define CDF_TABLE_LEN 13 ------------------ | Branch (20:21): [True: 740k, False: 61.6k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 740k| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 740k| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 61.6k| s[i] = ((-sign) ^ sample) + sign; 26| 61.6k| } 27| 16|} oqs_kem_frodokem_640_shake_sample_n: 8| 24|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 24| unsigned int i, j; 12| 24| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 24|#define CDF_TABLE {4643, 13363, 20579, 25843, 29227, 31145, 32103, 32525, 32689, 32745, 32762, 32766, 32767} ------------------ 13| | 14| 92.5k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 92.5k, False: 24] ------------------ 15| 92.5k| uint16_t sample = 0; 16| 92.5k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 92.5k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 1.20M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 1.20M|#define CDF_TABLE_LEN 13 ------------------ | Branch (20:21): [True: 1.11M, False: 92.5k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 1.11M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 1.11M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 92.5k| s[i] = ((-sign) ^ sample) + sign; 26| 92.5k| } 27| 24|} oqs_kem_frodokem_976_aes_sample_n: 8| 72|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 72| unsigned int i, j; 12| 72| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 72|#define CDF_TABLE {5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767} ------------------ 13| | 14| 422k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 422k, False: 72] ------------------ 15| 422k| uint16_t sample = 0; 16| 422k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 422k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 4.65M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 4.65M|#define CDF_TABLE_LEN 11 ------------------ | Branch (20:21): [True: 4.22M, False: 422k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 4.22M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 4.22M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 422k| s[i] = ((-sign) ^ sample) + sign; 26| 422k| } 27| 72|} oqs_kem_frodokem_976_shake_sample_n: 8| 104|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 104| unsigned int i, j; 12| 104| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 104|#define CDF_TABLE {5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767} ------------------ 13| | 14| 610k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 610k, False: 104] ------------------ 15| 610k| uint16_t sample = 0; 16| 610k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 610k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 6.71M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 6.71M|#define CDF_TABLE_LEN 11 ------------------ | Branch (20:21): [True: 6.10M, False: 610k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 6.10M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 6.10M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 610k| s[i] = ((-sign) ^ sample) + sign; 26| 610k| } 27| 104|} oqs_kem_frodokem_1344_aes_sample_n: 8| 72|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 72| unsigned int i, j; 12| 72| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 72|#define CDF_TABLE {9142, 23462, 30338, 32361, 32725, 32765, 32767} ------------------ 13| | 14| 581k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 581k, False: 72] ------------------ 15| 581k| uint16_t sample = 0; 16| 581k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 581k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 4.07M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 4.07M|#define CDF_TABLE_LEN 7 ------------------ | Branch (20:21): [True: 3.49M, False: 581k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 3.49M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 3.49M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 581k| s[i] = ((-sign) ^ sample) + sign; 26| 581k| } 27| 72|} oqs_kem_frodokem_1344_shake_sample_n: 8| 64|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 64| unsigned int i, j; 12| 64| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 64|#define CDF_TABLE {9142, 23462, 30338, 32361, 32725, 32765, 32767} ------------------ 13| | 14| 517k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 517k, False: 64] ------------------ 15| 517k| uint16_t sample = 0; 16| 517k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 517k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 3.61M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 3.61M|#define CDF_TABLE_LEN 7 ------------------ | Branch (20:21): [True: 3.10M, False: 517k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 3.10M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 3.10M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 517k| s[i] = ((-sign) ^ sample) + sign; 26| 517k| } 27| 64|} oqs_kem_efrodokem_640_aes_sample_n: 8| 32|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 32| unsigned int i, j; 12| 32| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 32|#define CDF_TABLE {4643, 13363, 20579, 25843, 29227, 31145, 32103, 32525, 32689, 32745, 32762, 32766, 32767} ------------------ 13| | 14| 123k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 123k, False: 32] ------------------ 15| 123k| uint16_t sample = 0; 16| 123k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 123k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 1.60M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 1.60M|#define CDF_TABLE_LEN 13 ------------------ | Branch (20:21): [True: 1.48M, False: 123k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 1.48M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 1.48M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 123k| s[i] = ((-sign) ^ sample) + sign; 26| 123k| } 27| 32|} oqs_kem_efrodokem_640_shake_sample_n: 8| 24|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 24| unsigned int i, j; 12| 24| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 24|#define CDF_TABLE {4643, 13363, 20579, 25843, 29227, 31145, 32103, 32525, 32689, 32745, 32762, 32766, 32767} ------------------ 13| | 14| 92.5k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 92.5k, False: 24] ------------------ 15| 92.5k| uint16_t sample = 0; 16| 92.5k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 92.5k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 1.20M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 1.20M|#define CDF_TABLE_LEN 13 ------------------ | Branch (20:21): [True: 1.11M, False: 92.5k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 1.11M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 1.11M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 92.5k| s[i] = ((-sign) ^ sample) + sign; 26| 92.5k| } 27| 24|} oqs_kem_efrodokem_976_aes_sample_n: 8| 64|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 64| unsigned int i, j; 12| 64| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 64|#define CDF_TABLE {5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767} ------------------ 13| | 14| 375k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 375k, False: 64] ------------------ 15| 375k| uint16_t sample = 0; 16| 375k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 375k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 4.13M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 4.13M|#define CDF_TABLE_LEN 11 ------------------ | Branch (20:21): [True: 3.75M, False: 375k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 3.75M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 3.75M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 375k| s[i] = ((-sign) ^ sample) + sign; 26| 375k| } 27| 64|} oqs_kem_efrodokem_976_shake_sample_n: 8| 64|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 64| unsigned int i, j; 12| 64| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 64|#define CDF_TABLE {5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767} ------------------ 13| | 14| 375k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 375k, False: 64] ------------------ 15| 375k| uint16_t sample = 0; 16| 375k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 375k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 4.13M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 4.13M|#define CDF_TABLE_LEN 11 ------------------ | Branch (20:21): [True: 3.75M, False: 375k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 3.75M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 3.75M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 375k| s[i] = ((-sign) ^ sample) + sign; 26| 375k| } 27| 64|} oqs_kem_efrodokem_1344_aes_sample_n: 8| 64|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 64| unsigned int i, j; 12| 64| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 64|#define CDF_TABLE {9142, 23462, 30338, 32361, 32725, 32765, 32767} ------------------ 13| | 14| 517k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 517k, False: 64] ------------------ 15| 517k| uint16_t sample = 0; 16| 517k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 517k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 3.61M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 3.61M|#define CDF_TABLE_LEN 7 ------------------ | Branch (20:21): [True: 3.10M, False: 517k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 3.10M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 3.10M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 517k| s[i] = ((-sign) ^ sample) + sign; 26| 517k| } 27| 64|} oqs_kem_efrodokem_1344_shake_sample_n: 8| 24|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 24| unsigned int i, j; 12| 24| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 24|#define CDF_TABLE {9142, 23462, 30338, 32361, 32725, 32765, 32767} ------------------ 13| | 14| 193k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 193k, False: 24] ------------------ 15| 193k| uint16_t sample = 0; 16| 193k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 193k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 1.35M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 1.35M|#define CDF_TABLE_LEN 7 ------------------ | Branch (20:21): [True: 1.16M, False: 193k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 1.16M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 1.16M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 193k| s[i] = ((-sign) ^ sample) + sign; 26| 193k| } 27| 24|} oqs_kem_frodokem_640_aes_pack: 15| 6|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 6| memset(out, 0, outlen); 18| | 19| 6| size_t i = 0; // whole bytes already filled in 20| 6| size_t j = 0; // whole uint16_t already copied 21| 6| uint16_t w = 0; // the leftover, not yet copied 22| 6| unsigned char bits = 0; // the number of lsb in w 23| | 24| 38.6k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 38.6k, False: 6] | Branch (24:27): [True: 38.6k, False: 6] | Branch (24:41): [True: 6, False: 0] | Branch (24:57): [True: 6, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 38.6k| unsigned char b = 0; // bits in out[i] already filled in 37| 95.3k| while (b < 8) { ------------------ | Branch (37:16): [True: 56.6k, False: 38.6k] ------------------ 38| 56.6k| int nbits = min(8 - b, bits); ------------------ | | 11| 56.6k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 36.0k, False: 20.6k] | | ------------------ ------------------ 39| 56.6k| uint16_t mask = (1 << nbits) - 1; 40| 56.6k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 56.6k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 56.6k| b += nbits; 43| 56.6k| bits -= nbits; 44| 56.6k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 56.6k| if (bits == 0) { ------------------ | Branch (46:17): [True: 20.6k, False: 36.0k] ------------------ 47| 20.6k| if (j < inlen) { ------------------ | Branch (47:21): [True: 20.6k, False: 6] ------------------ 48| 20.6k| w = in[j]; 49| 20.6k| bits = lsb; 50| 20.6k| j++; 51| 20.6k| } else { 52| 6| break; // the input vector is exhausted 53| 6| } 54| 20.6k| } 55| 56.6k| } 56| 38.6k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 38.6k, False: 0] ------------------ 57| 38.6k| i++; 58| 38.6k| } 59| 38.6k| } 60| 6|} oqs_kem_frodokem_640_aes_unpack: 64| 8|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 8| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 8| size_t i = 0; // whole uint16_t already filled in 69| 8| size_t j = 0; // whole bytes already copied 70| 8| unsigned char w = 0; // the leftover, not yet copied 71| 8| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 30.8k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 30.8k, False: 8] | Branch (73:27): [True: 30.8k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 30.8k| unsigned char b = 0; // bits in out[i] already filled in 86| 115k| while (b < lsb) { ------------------ | Branch (86:16): [True: 84.8k, False: 30.8k] ------------------ 87| 84.8k| int nbits = min(lsb - b, bits); ------------------ | | 11| 84.8k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 26.9k, False: 57.8k] | | ------------------ ------------------ 88| 84.8k| uint16_t mask = (1 << nbits) - 1; 89| 84.8k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 84.8k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 84.8k| b += nbits; 92| 84.8k| bits -= nbits; 93| 84.8k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 84.8k| if (bits == 0) { ------------------ | Branch (95:17): [True: 57.8k, False: 26.9k] ------------------ 96| 57.8k| if (j < inlen) { ------------------ | Branch (96:21): [True: 57.8k, False: 8] ------------------ 97| 57.8k| w = in[j]; 98| 57.8k| bits = 8; 99| 57.8k| j++; 100| 57.8k| } else { 101| 8| break; // the input vector is exhausted 102| 8| } 103| 57.8k| } 104| 84.8k| } 105| 30.8k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 30.8k, False: 0] ------------------ 106| 30.8k| i++; 107| 30.8k| } 108| 30.8k| } 109| 8|} oqs_kem_frodokem_640_aes_ct_verify: 113| 4|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 4| uint16_t r = 0; 116| | 117| 10.3k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 10.3k, False: 4] ------------------ 118| 10.3k| r |= a[i] ^ b[i]; 119| 10.3k| } 120| | 121| 4| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 4| return (int8_t)r; 123| 4|} oqs_kem_frodokem_640_aes_ct_select: 127| 2|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 2| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 2| do { \ | | 59| 2| __asm__ volatile("" : "+r"(v) :); \ | | 60| 2| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 2] | | ------------------ ------------------ 130| 34| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 32, False: 2] ------------------ 131| 32| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 32| } 133| 2|} oqs_kem_frodokem_640_shake_pack: 15| 9|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 9| memset(out, 0, outlen); 18| | 19| 9| size_t i = 0; // whole bytes already filled in 20| 9| size_t j = 0; // whole uint16_t already copied 21| 9| uint16_t w = 0; // the leftover, not yet copied 22| 9| unsigned char bits = 0; // the number of lsb in w 23| | 24| 57.9k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 57.9k, False: 9] | Branch (24:27): [True: 57.9k, False: 9] | Branch (24:41): [True: 9, False: 0] | Branch (24:57): [True: 9, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 57.9k| unsigned char b = 0; // bits in out[i] already filled in 37| 142k| while (b < 8) { ------------------ | Branch (37:16): [True: 85.0k, False: 57.9k] ------------------ 38| 85.0k| int nbits = min(8 - b, bits); ------------------ | | 11| 85.0k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 54.0k, False: 30.9k] | | ------------------ ------------------ 39| 85.0k| uint16_t mask = (1 << nbits) - 1; 40| 85.0k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 85.0k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 85.0k| b += nbits; 43| 85.0k| bits -= nbits; 44| 85.0k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 85.0k| if (bits == 0) { ------------------ | Branch (46:17): [True: 30.9k, False: 54.0k] ------------------ 47| 30.9k| if (j < inlen) { ------------------ | Branch (47:21): [True: 30.9k, False: 9] ------------------ 48| 30.9k| w = in[j]; 49| 30.9k| bits = lsb; 50| 30.9k| j++; 51| 30.9k| } else { 52| 9| break; // the input vector is exhausted 53| 9| } 54| 30.9k| } 55| 85.0k| } 56| 57.9k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 57.9k, False: 0] ------------------ 57| 57.9k| i++; 58| 57.9k| } 59| 57.9k| } 60| 9|} oqs_kem_frodokem_640_shake_unpack: 64| 12|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 12| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 12| size_t i = 0; // whole uint16_t already filled in 69| 12| size_t j = 0; // whole bytes already copied 70| 12| unsigned char w = 0; // the leftover, not yet copied 71| 12| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 46.2k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 46.2k, False: 12] | Branch (73:27): [True: 46.2k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 46.2k| unsigned char b = 0; // bits in out[i] already filled in 86| 173k| while (b < lsb) { ------------------ | Branch (86:16): [True: 127k, False: 46.2k] ------------------ 87| 127k| int nbits = min(lsb - b, bits); ------------------ | | 11| 127k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 40.4k, False: 86.7k] | | ------------------ ------------------ 88| 127k| uint16_t mask = (1 << nbits) - 1; 89| 127k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 127k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 127k| b += nbits; 92| 127k| bits -= nbits; 93| 127k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 127k| if (bits == 0) { ------------------ | Branch (95:17): [True: 86.7k, False: 40.4k] ------------------ 96| 86.7k| if (j < inlen) { ------------------ | Branch (96:21): [True: 86.7k, False: 12] ------------------ 97| 86.7k| w = in[j]; 98| 86.7k| bits = 8; 99| 86.7k| j++; 100| 86.7k| } else { 101| 12| break; // the input vector is exhausted 102| 12| } 103| 86.7k| } 104| 127k| } 105| 46.2k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 46.2k, False: 0] ------------------ 106| 46.2k| i++; 107| 46.2k| } 108| 46.2k| } 109| 12|} oqs_kem_frodokem_640_shake_ct_verify: 113| 6|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 6| uint16_t r = 0; 116| | 117| 15.5k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 15.5k, False: 6] ------------------ 118| 15.5k| r |= a[i] ^ b[i]; 119| 15.5k| } 120| | 121| 6| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 6| return (int8_t)r; 123| 6|} oqs_kem_frodokem_640_shake_ct_select: 127| 3|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 3| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 3| do { \ | | 59| 3| __asm__ volatile("" : "+r"(v) :); \ | | 60| 3| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 3] | | ------------------ ------------------ 130| 51| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 48, False: 3] ------------------ 131| 48| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 48| } 133| 3|} oqs_kem_frodokem_976_aes_pack: 15| 27|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 27| memset(out, 0, outlen); 18| | 19| 27| size_t i = 0; // whole bytes already filled in 20| 27| size_t j = 0; // whole uint16_t already copied 21| 27| uint16_t w = 0; // the leftover, not yet copied 22| 27| unsigned char bits = 0; // the number of lsb in w 23| | 24| 282k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 282k, False: 27] | Branch (24:27): [True: 282k, False: 54] | Branch (24:41): [True: 54, False: 0] | Branch (24:57): [True: 54, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 282k| unsigned char b = 0; // bits in out[i] already filled in 37| 564k| while (b < 8) { ------------------ | Branch (37:16): [True: 282k, False: 282k] ------------------ 38| 282k| int nbits = min(8 - b, bits); ------------------ | | 11| 282k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 141k, False: 141k] | | ------------------ ------------------ 39| 282k| uint16_t mask = (1 << nbits) - 1; 40| 282k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 282k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 282k| b += nbits; 43| 282k| bits -= nbits; 44| 282k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 282k| if (bits == 0) { ------------------ | Branch (46:17): [True: 141k, False: 141k] ------------------ 47| 141k| if (j < inlen) { ------------------ | Branch (47:21): [True: 141k, False: 27] ------------------ 48| 141k| w = in[j]; 49| 141k| bits = lsb; 50| 141k| j++; 51| 141k| } else { 52| 27| break; // the input vector is exhausted 53| 27| } 54| 141k| } 55| 282k| } 56| 282k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 282k, False: 0] ------------------ 57| 282k| i++; 58| 282k| } 59| 282k| } 60| 27|} oqs_kem_frodokem_976_aes_unpack: 64| 36|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 36| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 36| size_t i = 0; // whole uint16_t already filled in 69| 36| size_t j = 0; // whole bytes already copied 70| 36| unsigned char w = 0; // the leftover, not yet copied 71| 36| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 211k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 211k, False: 36] | Branch (73:27): [True: 211k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 211k| unsigned char b = 0; // bits in out[i] already filled in 86| 634k| while (b < lsb) { ------------------ | Branch (86:16): [True: 422k, False: 211k] ------------------ 87| 422k| int nbits = min(lsb - b, bits); ------------------ | | 11| 422k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 422k] | | ------------------ ------------------ 88| 422k| uint16_t mask = (1 << nbits) - 1; 89| 422k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 422k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 422k| b += nbits; 92| 422k| bits -= nbits; 93| 422k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 422k| if (bits == 0) { ------------------ | Branch (95:17): [True: 422k, False: 0] ------------------ 96| 422k| if (j < inlen) { ------------------ | Branch (96:21): [True: 422k, False: 36] ------------------ 97| 422k| w = in[j]; 98| 422k| bits = 8; 99| 422k| j++; 100| 422k| } else { 101| 36| break; // the input vector is exhausted 102| 36| } 103| 422k| } 104| 422k| } 105| 211k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 211k, False: 0] ------------------ 106| 211k| i++; 107| 211k| } 108| 211k| } 109| 36|} oqs_kem_frodokem_976_aes_ct_verify: 113| 18|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 18| uint16_t r = 0; 116| | 117| 70.8k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 70.8k, False: 18] ------------------ 118| 70.8k| r |= a[i] ^ b[i]; 119| 70.8k| } 120| | 121| 18| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 18| return (int8_t)r; 123| 18|} oqs_kem_frodokem_976_aes_ct_select: 127| 9|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 9| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 9| do { \ | | 59| 9| __asm__ volatile("" : "+r"(v) :); \ | | 60| 9| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 9] | | ------------------ ------------------ 130| 225| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 216, False: 9] ------------------ 131| 216| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 216| } 133| 9|} oqs_kem_frodokem_976_shake_pack: 15| 39|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 39| memset(out, 0, outlen); 18| | 19| 39| size_t i = 0; // whole bytes already filled in 20| 39| size_t j = 0; // whole uint16_t already copied 21| 39| uint16_t w = 0; // the leftover, not yet copied 22| 39| unsigned char bits = 0; // the number of lsb in w 23| | 24| 407k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 407k, False: 39] | Branch (24:27): [True: 407k, False: 78] | Branch (24:41): [True: 78, False: 0] | Branch (24:57): [True: 78, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 407k| unsigned char b = 0; // bits in out[i] already filled in 37| 815k| while (b < 8) { ------------------ | Branch (37:16): [True: 407k, False: 407k] ------------------ 38| 407k| int nbits = min(8 - b, bits); ------------------ | | 11| 407k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 203k, False: 203k] | | ------------------ ------------------ 39| 407k| uint16_t mask = (1 << nbits) - 1; 40| 407k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 407k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 407k| b += nbits; 43| 407k| bits -= nbits; 44| 407k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 407k| if (bits == 0) { ------------------ | Branch (46:17): [True: 203k, False: 203k] ------------------ 47| 203k| if (j < inlen) { ------------------ | Branch (47:21): [True: 203k, False: 39] ------------------ 48| 203k| w = in[j]; 49| 203k| bits = lsb; 50| 203k| j++; 51| 203k| } else { 52| 39| break; // the input vector is exhausted 53| 39| } 54| 203k| } 55| 407k| } 56| 407k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 407k, False: 0] ------------------ 57| 407k| i++; 58| 407k| } 59| 407k| } 60| 39|} oqs_kem_frodokem_976_shake_unpack: 64| 52|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 52| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 52| size_t i = 0; // whole uint16_t already filled in 69| 52| size_t j = 0; // whole bytes already copied 70| 52| unsigned char w = 0; // the leftover, not yet copied 71| 52| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 305k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 305k, False: 52] | Branch (73:27): [True: 305k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 305k| unsigned char b = 0; // bits in out[i] already filled in 86| 916k| while (b < lsb) { ------------------ | Branch (86:16): [True: 610k, False: 305k] ------------------ 87| 610k| int nbits = min(lsb - b, bits); ------------------ | | 11| 610k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 610k] | | ------------------ ------------------ 88| 610k| uint16_t mask = (1 << nbits) - 1; 89| 610k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 610k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 610k| b += nbits; 92| 610k| bits -= nbits; 93| 610k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 610k| if (bits == 0) { ------------------ | Branch (95:17): [True: 610k, False: 0] ------------------ 96| 610k| if (j < inlen) { ------------------ | Branch (96:21): [True: 610k, False: 52] ------------------ 97| 610k| w = in[j]; 98| 610k| bits = 8; 99| 610k| j++; 100| 610k| } else { 101| 52| break; // the input vector is exhausted 102| 52| } 103| 610k| } 104| 610k| } 105| 305k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 305k, False: 0] ------------------ 106| 305k| i++; 107| 305k| } 108| 305k| } 109| 52|} oqs_kem_frodokem_976_shake_ct_verify: 113| 26|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 26| uint16_t r = 0; 116| | 117| 102k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 102k, False: 26] ------------------ 118| 102k| r |= a[i] ^ b[i]; 119| 102k| } 120| | 121| 26| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 26| return (int8_t)r; 123| 26|} oqs_kem_frodokem_976_shake_ct_select: 127| 13|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 13| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 13| do { \ | | 59| 13| __asm__ volatile("" : "+r"(v) :); \ | | 60| 13| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 13] | | ------------------ ------------------ 130| 325| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 312, False: 13] ------------------ 131| 312| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 312| } 133| 13|} oqs_kem_frodokem_1344_aes_pack: 15| 27|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 27| memset(out, 0, outlen); 18| | 19| 27| size_t i = 0; // whole bytes already filled in 20| 27| size_t j = 0; // whole uint16_t already copied 21| 27| uint16_t w = 0; // the leftover, not yet copied 22| 27| unsigned char bits = 0; // the number of lsb in w 23| | 24| 388k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 388k, False: 27] | Branch (24:27): [True: 388k, False: 54] | Branch (24:41): [True: 54, False: 0] | Branch (24:57): [True: 54, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 388k| unsigned char b = 0; // bits in out[i] already filled in 37| 776k| while (b < 8) { ------------------ | Branch (37:16): [True: 388k, False: 388k] ------------------ 38| 388k| int nbits = min(8 - b, bits); ------------------ | | 11| 388k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 194k, False: 194k] | | ------------------ ------------------ 39| 388k| uint16_t mask = (1 << nbits) - 1; 40| 388k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 388k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 388k| b += nbits; 43| 388k| bits -= nbits; 44| 388k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 388k| if (bits == 0) { ------------------ | Branch (46:17): [True: 194k, False: 194k] ------------------ 47| 194k| if (j < inlen) { ------------------ | Branch (47:21): [True: 194k, False: 27] ------------------ 48| 194k| w = in[j]; 49| 194k| bits = lsb; 50| 194k| j++; 51| 194k| } else { 52| 27| break; // the input vector is exhausted 53| 27| } 54| 194k| } 55| 388k| } 56| 388k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 388k, False: 0] ------------------ 57| 388k| i++; 58| 388k| } 59| 388k| } 60| 27|} oqs_kem_frodokem_1344_aes_unpack: 64| 36|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 36| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 36| size_t i = 0; // whole uint16_t already filled in 69| 36| size_t j = 0; // whole bytes already copied 70| 36| unsigned char w = 0; // the leftover, not yet copied 71| 36| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 290k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 290k, False: 36] | Branch (73:27): [True: 290k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 290k| unsigned char b = 0; // bits in out[i] already filled in 86| 872k| while (b < lsb) { ------------------ | Branch (86:16): [True: 581k, False: 290k] ------------------ 87| 581k| int nbits = min(lsb - b, bits); ------------------ | | 11| 581k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 581k] | | ------------------ ------------------ 88| 581k| uint16_t mask = (1 << nbits) - 1; 89| 581k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 581k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 581k| b += nbits; 92| 581k| bits -= nbits; 93| 581k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 581k| if (bits == 0) { ------------------ | Branch (95:17): [True: 581k, False: 0] ------------------ 96| 581k| if (j < inlen) { ------------------ | Branch (96:21): [True: 581k, False: 36] ------------------ 97| 581k| w = in[j]; 98| 581k| bits = 8; 99| 581k| j++; 100| 581k| } else { 101| 36| break; // the input vector is exhausted 102| 36| } 103| 581k| } 104| 581k| } 105| 290k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 290k, False: 0] ------------------ 106| 290k| i++; 107| 290k| } 108| 290k| } 109| 36|} oqs_kem_frodokem_1344_aes_ct_verify: 113| 18|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 18| uint16_t r = 0; 116| | 117| 97.3k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 97.3k, False: 18] ------------------ 118| 97.3k| r |= a[i] ^ b[i]; 119| 97.3k| } 120| | 121| 18| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 18| return (int8_t)r; 123| 18|} oqs_kem_frodokem_1344_aes_ct_select: 127| 9|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 9| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 9| do { \ | | 59| 9| __asm__ volatile("" : "+r"(v) :); \ | | 60| 9| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 9] | | ------------------ ------------------ 130| 297| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 288, False: 9] ------------------ 131| 288| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 288| } 133| 9|} oqs_kem_frodokem_1344_shake_pack: 15| 24|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 24| memset(out, 0, outlen); 18| | 19| 24| size_t i = 0; // whole bytes already filled in 20| 24| size_t j = 0; // whole uint16_t already copied 21| 24| uint16_t w = 0; // the leftover, not yet copied 22| 24| unsigned char bits = 0; // the number of lsb in w 23| | 24| 345k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 345k, False: 24] | Branch (24:27): [True: 345k, False: 48] | Branch (24:41): [True: 48, False: 0] | Branch (24:57): [True: 48, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 345k| unsigned char b = 0; // bits in out[i] already filled in 37| 690k| while (b < 8) { ------------------ | Branch (37:16): [True: 345k, False: 345k] ------------------ 38| 345k| int nbits = min(8 - b, bits); ------------------ | | 11| 345k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 172k, False: 172k] | | ------------------ ------------------ 39| 345k| uint16_t mask = (1 << nbits) - 1; 40| 345k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 345k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 345k| b += nbits; 43| 345k| bits -= nbits; 44| 345k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 345k| if (bits == 0) { ------------------ | Branch (46:17): [True: 172k, False: 172k] ------------------ 47| 172k| if (j < inlen) { ------------------ | Branch (47:21): [True: 172k, False: 24] ------------------ 48| 172k| w = in[j]; 49| 172k| bits = lsb; 50| 172k| j++; 51| 172k| } else { 52| 24| break; // the input vector is exhausted 53| 24| } 54| 172k| } 55| 345k| } 56| 345k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 345k, False: 0] ------------------ 57| 345k| i++; 58| 345k| } 59| 345k| } 60| 24|} oqs_kem_frodokem_1344_shake_unpack: 64| 32|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 32| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 32| size_t i = 0; // whole uint16_t already filled in 69| 32| size_t j = 0; // whole bytes already copied 70| 32| unsigned char w = 0; // the leftover, not yet copied 71| 32| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 258k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 258k, False: 32] | Branch (73:27): [True: 258k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 258k| unsigned char b = 0; // bits in out[i] already filled in 86| 775k| while (b < lsb) { ------------------ | Branch (86:16): [True: 517k, False: 258k] ------------------ 87| 517k| int nbits = min(lsb - b, bits); ------------------ | | 11| 517k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 517k] | | ------------------ ------------------ 88| 517k| uint16_t mask = (1 << nbits) - 1; 89| 517k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 517k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 517k| b += nbits; 92| 517k| bits -= nbits; 93| 517k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 517k| if (bits == 0) { ------------------ | Branch (95:17): [True: 517k, False: 0] ------------------ 96| 517k| if (j < inlen) { ------------------ | Branch (96:21): [True: 517k, False: 32] ------------------ 97| 517k| w = in[j]; 98| 517k| bits = 8; 99| 517k| j++; 100| 517k| } else { 101| 32| break; // the input vector is exhausted 102| 32| } 103| 517k| } 104| 517k| } 105| 258k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 258k, False: 0] ------------------ 106| 258k| i++; 107| 258k| } 108| 258k| } 109| 32|} oqs_kem_frodokem_1344_shake_ct_verify: 113| 16|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 16| uint16_t r = 0; 116| | 117| 86.5k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 86.5k, False: 16] ------------------ 118| 86.5k| r |= a[i] ^ b[i]; 119| 86.5k| } 120| | 121| 16| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 16| return (int8_t)r; 123| 16|} oqs_kem_frodokem_1344_shake_ct_select: 127| 8|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 8| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 8| do { \ | | 59| 8| __asm__ volatile("" : "+r"(v) :); \ | | 60| 8| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 8] | | ------------------ ------------------ 130| 264| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 256, False: 8] ------------------ 131| 256| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 256| } 133| 8|} oqs_kem_efrodokem_640_aes_pack: 15| 12|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 12| memset(out, 0, outlen); 18| | 19| 12| size_t i = 0; // whole bytes already filled in 20| 12| size_t j = 0; // whole uint16_t already copied 21| 12| uint16_t w = 0; // the leftover, not yet copied 22| 12| unsigned char bits = 0; // the number of lsb in w 23| | 24| 77.2k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 77.2k, False: 12] | Branch (24:27): [True: 77.2k, False: 12] | Branch (24:41): [True: 12, False: 0] | Branch (24:57): [True: 12, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 77.2k| unsigned char b = 0; // bits in out[i] already filled in 37| 190k| while (b < 8) { ------------------ | Branch (37:16): [True: 113k, False: 77.2k] ------------------ 38| 113k| int nbits = min(8 - b, bits); ------------------ | | 11| 113k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 72.1k, False: 41.2k] | | ------------------ ------------------ 39| 113k| uint16_t mask = (1 << nbits) - 1; 40| 113k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 113k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 113k| b += nbits; 43| 113k| bits -= nbits; 44| 113k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 113k| if (bits == 0) { ------------------ | Branch (46:17): [True: 41.2k, False: 72.1k] ------------------ 47| 41.2k| if (j < inlen) { ------------------ | Branch (47:21): [True: 41.2k, False: 12] ------------------ 48| 41.2k| w = in[j]; 49| 41.2k| bits = lsb; 50| 41.2k| j++; 51| 41.2k| } else { 52| 12| break; // the input vector is exhausted 53| 12| } 54| 41.2k| } 55| 113k| } 56| 77.2k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 77.2k, False: 0] ------------------ 57| 77.2k| i++; 58| 77.2k| } 59| 77.2k| } 60| 12|} oqs_kem_efrodokem_640_aes_unpack: 64| 16|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 16| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 16| size_t i = 0; // whole uint16_t already filled in 69| 16| size_t j = 0; // whole bytes already copied 70| 16| unsigned char w = 0; // the leftover, not yet copied 71| 16| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 61.7k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 61.6k, False: 16] | Branch (73:27): [True: 61.6k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 61.6k| unsigned char b = 0; // bits in out[i] already filled in 86| 231k| while (b < lsb) { ------------------ | Branch (86:16): [True: 169k, False: 61.6k] ------------------ 87| 169k| int nbits = min(lsb - b, bits); ------------------ | | 11| 169k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 53.9k, False: 115k] | | ------------------ ------------------ 88| 169k| uint16_t mask = (1 << nbits) - 1; 89| 169k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 169k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 169k| b += nbits; 92| 169k| bits -= nbits; 93| 169k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 169k| if (bits == 0) { ------------------ | Branch (95:17): [True: 115k, False: 53.9k] ------------------ 96| 115k| if (j < inlen) { ------------------ | Branch (96:21): [True: 115k, False: 16] ------------------ 97| 115k| w = in[j]; 98| 115k| bits = 8; 99| 115k| j++; 100| 115k| } else { 101| 16| break; // the input vector is exhausted 102| 16| } 103| 115k| } 104| 169k| } 105| 61.6k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 61.6k, False: 0] ------------------ 106| 61.6k| i++; 107| 61.6k| } 108| 61.6k| } 109| 16|} oqs_kem_efrodokem_640_aes_ct_verify: 113| 8|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 8| uint16_t r = 0; 116| | 117| 20.7k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 20.7k, False: 8] ------------------ 118| 20.7k| r |= a[i] ^ b[i]; 119| 20.7k| } 120| | 121| 8| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 8| return (int8_t)r; 123| 8|} oqs_kem_efrodokem_640_aes_ct_select: 127| 4|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 4| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 4| do { \ | | 59| 4| __asm__ volatile("" : "+r"(v) :); \ | | 60| 4| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 4] | | ------------------ ------------------ 130| 68| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 64, False: 4] ------------------ 131| 64| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 64| } 133| 4|} oqs_kem_efrodokem_640_shake_pack: 15| 9|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 9| memset(out, 0, outlen); 18| | 19| 9| size_t i = 0; // whole bytes already filled in 20| 9| size_t j = 0; // whole uint16_t already copied 21| 9| uint16_t w = 0; // the leftover, not yet copied 22| 9| unsigned char bits = 0; // the number of lsb in w 23| | 24| 57.9k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 57.9k, False: 9] | Branch (24:27): [True: 57.9k, False: 9] | Branch (24:41): [True: 9, False: 0] | Branch (24:57): [True: 9, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 57.9k| unsigned char b = 0; // bits in out[i] already filled in 37| 142k| while (b < 8) { ------------------ | Branch (37:16): [True: 85.0k, False: 57.9k] ------------------ 38| 85.0k| int nbits = min(8 - b, bits); ------------------ | | 11| 85.0k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 54.0k, False: 30.9k] | | ------------------ ------------------ 39| 85.0k| uint16_t mask = (1 << nbits) - 1; 40| 85.0k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 85.0k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 85.0k| b += nbits; 43| 85.0k| bits -= nbits; 44| 85.0k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 85.0k| if (bits == 0) { ------------------ | Branch (46:17): [True: 30.9k, False: 54.0k] ------------------ 47| 30.9k| if (j < inlen) { ------------------ | Branch (47:21): [True: 30.9k, False: 9] ------------------ 48| 30.9k| w = in[j]; 49| 30.9k| bits = lsb; 50| 30.9k| j++; 51| 30.9k| } else { 52| 9| break; // the input vector is exhausted 53| 9| } 54| 30.9k| } 55| 85.0k| } 56| 57.9k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 57.9k, False: 0] ------------------ 57| 57.9k| i++; 58| 57.9k| } 59| 57.9k| } 60| 9|} oqs_kem_efrodokem_640_shake_unpack: 64| 12|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 12| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 12| size_t i = 0; // whole uint16_t already filled in 69| 12| size_t j = 0; // whole bytes already copied 70| 12| unsigned char w = 0; // the leftover, not yet copied 71| 12| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 46.2k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 46.2k, False: 12] | Branch (73:27): [True: 46.2k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 46.2k| unsigned char b = 0; // bits in out[i] already filled in 86| 173k| while (b < lsb) { ------------------ | Branch (86:16): [True: 127k, False: 46.2k] ------------------ 87| 127k| int nbits = min(lsb - b, bits); ------------------ | | 11| 127k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 40.4k, False: 86.7k] | | ------------------ ------------------ 88| 127k| uint16_t mask = (1 << nbits) - 1; 89| 127k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 127k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 127k| b += nbits; 92| 127k| bits -= nbits; 93| 127k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 127k| if (bits == 0) { ------------------ | Branch (95:17): [True: 86.7k, False: 40.4k] ------------------ 96| 86.7k| if (j < inlen) { ------------------ | Branch (96:21): [True: 86.7k, False: 12] ------------------ 97| 86.7k| w = in[j]; 98| 86.7k| bits = 8; 99| 86.7k| j++; 100| 86.7k| } else { 101| 12| break; // the input vector is exhausted 102| 12| } 103| 86.7k| } 104| 127k| } 105| 46.2k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 46.2k, False: 0] ------------------ 106| 46.2k| i++; 107| 46.2k| } 108| 46.2k| } 109| 12|} oqs_kem_efrodokem_640_shake_ct_verify: 113| 6|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 6| uint16_t r = 0; 116| | 117| 15.5k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 15.5k, False: 6] ------------------ 118| 15.5k| r |= a[i] ^ b[i]; 119| 15.5k| } 120| | 121| 6| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 6| return (int8_t)r; 123| 6|} oqs_kem_efrodokem_640_shake_ct_select: 127| 3|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 3| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 3| do { \ | | 59| 3| __asm__ volatile("" : "+r"(v) :); \ | | 60| 3| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 3] | | ------------------ ------------------ 130| 51| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 48, False: 3] ------------------ 131| 48| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 48| } 133| 3|} oqs_kem_efrodokem_976_aes_pack: 15| 24|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 24| memset(out, 0, outlen); 18| | 19| 24| size_t i = 0; // whole bytes already filled in 20| 24| size_t j = 0; // whole uint16_t already copied 21| 24| uint16_t w = 0; // the leftover, not yet copied 22| 24| unsigned char bits = 0; // the number of lsb in w 23| | 24| 250k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 250k, False: 24] | Branch (24:27): [True: 250k, False: 48] | Branch (24:41): [True: 48, False: 0] | Branch (24:57): [True: 48, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 250k| unsigned char b = 0; // bits in out[i] already filled in 37| 501k| while (b < 8) { ------------------ | Branch (37:16): [True: 250k, False: 250k] ------------------ 38| 250k| int nbits = min(8 - b, bits); ------------------ | | 11| 250k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 125k, False: 125k] | | ------------------ ------------------ 39| 250k| uint16_t mask = (1 << nbits) - 1; 40| 250k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 250k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 250k| b += nbits; 43| 250k| bits -= nbits; 44| 250k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 250k| if (bits == 0) { ------------------ | Branch (46:17): [True: 125k, False: 125k] ------------------ 47| 125k| if (j < inlen) { ------------------ | Branch (47:21): [True: 125k, False: 24] ------------------ 48| 125k| w = in[j]; 49| 125k| bits = lsb; 50| 125k| j++; 51| 125k| } else { 52| 24| break; // the input vector is exhausted 53| 24| } 54| 125k| } 55| 250k| } 56| 250k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 250k, False: 0] ------------------ 57| 250k| i++; 58| 250k| } 59| 250k| } 60| 24|} oqs_kem_efrodokem_976_aes_unpack: 64| 32|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 32| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 32| size_t i = 0; // whole uint16_t already filled in 69| 32| size_t j = 0; // whole bytes already copied 70| 32| unsigned char w = 0; // the leftover, not yet copied 71| 32| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 187k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 187k, False: 32] | Branch (73:27): [True: 187k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 187k| unsigned char b = 0; // bits in out[i] already filled in 86| 563k| while (b < lsb) { ------------------ | Branch (86:16): [True: 375k, False: 187k] ------------------ 87| 375k| int nbits = min(lsb - b, bits); ------------------ | | 11| 375k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 375k] | | ------------------ ------------------ 88| 375k| uint16_t mask = (1 << nbits) - 1; 89| 375k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 375k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 375k| b += nbits; 92| 375k| bits -= nbits; 93| 375k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 375k| if (bits == 0) { ------------------ | Branch (95:17): [True: 375k, False: 0] ------------------ 96| 375k| if (j < inlen) { ------------------ | Branch (96:21): [True: 375k, False: 32] ------------------ 97| 375k| w = in[j]; 98| 375k| bits = 8; 99| 375k| j++; 100| 375k| } else { 101| 32| break; // the input vector is exhausted 102| 32| } 103| 375k| } 104| 375k| } 105| 187k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 187k, False: 0] ------------------ 106| 187k| i++; 107| 187k| } 108| 187k| } 109| 32|} oqs_kem_efrodokem_976_aes_ct_verify: 113| 16|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 16| uint16_t r = 0; 116| | 117| 62.9k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 62.9k, False: 16] ------------------ 118| 62.9k| r |= a[i] ^ b[i]; 119| 62.9k| } 120| | 121| 16| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 16| return (int8_t)r; 123| 16|} oqs_kem_efrodokem_976_aes_ct_select: 127| 8|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 8| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 8| do { \ | | 59| 8| __asm__ volatile("" : "+r"(v) :); \ | | 60| 8| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 8] | | ------------------ ------------------ 130| 200| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 192, False: 8] ------------------ 131| 192| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 192| } 133| 8|} oqs_kem_efrodokem_976_shake_pack: 15| 24|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 24| memset(out, 0, outlen); 18| | 19| 24| size_t i = 0; // whole bytes already filled in 20| 24| size_t j = 0; // whole uint16_t already copied 21| 24| uint16_t w = 0; // the leftover, not yet copied 22| 24| unsigned char bits = 0; // the number of lsb in w 23| | 24| 250k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 250k, False: 24] | Branch (24:27): [True: 250k, False: 48] | Branch (24:41): [True: 48, False: 0] | Branch (24:57): [True: 48, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 250k| unsigned char b = 0; // bits in out[i] already filled in 37| 501k| while (b < 8) { ------------------ | Branch (37:16): [True: 250k, False: 250k] ------------------ 38| 250k| int nbits = min(8 - b, bits); ------------------ | | 11| 250k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 125k, False: 125k] | | ------------------ ------------------ 39| 250k| uint16_t mask = (1 << nbits) - 1; 40| 250k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 250k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 250k| b += nbits; 43| 250k| bits -= nbits; 44| 250k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 250k| if (bits == 0) { ------------------ | Branch (46:17): [True: 125k, False: 125k] ------------------ 47| 125k| if (j < inlen) { ------------------ | Branch (47:21): [True: 125k, False: 24] ------------------ 48| 125k| w = in[j]; 49| 125k| bits = lsb; 50| 125k| j++; 51| 125k| } else { 52| 24| break; // the input vector is exhausted 53| 24| } 54| 125k| } 55| 250k| } 56| 250k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 250k, False: 0] ------------------ 57| 250k| i++; 58| 250k| } 59| 250k| } 60| 24|} oqs_kem_efrodokem_976_shake_unpack: 64| 32|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 32| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 32| size_t i = 0; // whole uint16_t already filled in 69| 32| size_t j = 0; // whole bytes already copied 70| 32| unsigned char w = 0; // the leftover, not yet copied 71| 32| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 187k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 187k, False: 32] | Branch (73:27): [True: 187k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 187k| unsigned char b = 0; // bits in out[i] already filled in 86| 563k| while (b < lsb) { ------------------ | Branch (86:16): [True: 375k, False: 187k] ------------------ 87| 375k| int nbits = min(lsb - b, bits); ------------------ | | 11| 375k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 375k] | | ------------------ ------------------ 88| 375k| uint16_t mask = (1 << nbits) - 1; 89| 375k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 375k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 375k| b += nbits; 92| 375k| bits -= nbits; 93| 375k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 375k| if (bits == 0) { ------------------ | Branch (95:17): [True: 375k, False: 0] ------------------ 96| 375k| if (j < inlen) { ------------------ | Branch (96:21): [True: 375k, False: 32] ------------------ 97| 375k| w = in[j]; 98| 375k| bits = 8; 99| 375k| j++; 100| 375k| } else { 101| 32| break; // the input vector is exhausted 102| 32| } 103| 375k| } 104| 375k| } 105| 187k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 187k, False: 0] ------------------ 106| 187k| i++; 107| 187k| } 108| 187k| } 109| 32|} oqs_kem_efrodokem_976_shake_ct_verify: 113| 16|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 16| uint16_t r = 0; 116| | 117| 62.9k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 62.9k, False: 16] ------------------ 118| 62.9k| r |= a[i] ^ b[i]; 119| 62.9k| } 120| | 121| 16| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 16| return (int8_t)r; 123| 16|} oqs_kem_efrodokem_976_shake_ct_select: 127| 8|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 8| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 8| do { \ | | 59| 8| __asm__ volatile("" : "+r"(v) :); \ | | 60| 8| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 8] | | ------------------ ------------------ 130| 200| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 192, False: 8] ------------------ 131| 192| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 192| } 133| 8|} oqs_kem_efrodokem_1344_aes_pack: 15| 24|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 24| memset(out, 0, outlen); 18| | 19| 24| size_t i = 0; // whole bytes already filled in 20| 24| size_t j = 0; // whole uint16_t already copied 21| 24| uint16_t w = 0; // the leftover, not yet copied 22| 24| unsigned char bits = 0; // the number of lsb in w 23| | 24| 345k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 345k, False: 24] | Branch (24:27): [True: 345k, False: 48] | Branch (24:41): [True: 48, False: 0] | Branch (24:57): [True: 48, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 345k| unsigned char b = 0; // bits in out[i] already filled in 37| 690k| while (b < 8) { ------------------ | Branch (37:16): [True: 345k, False: 345k] ------------------ 38| 345k| int nbits = min(8 - b, bits); ------------------ | | 11| 345k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 172k, False: 172k] | | ------------------ ------------------ 39| 345k| uint16_t mask = (1 << nbits) - 1; 40| 345k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 345k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 345k| b += nbits; 43| 345k| bits -= nbits; 44| 345k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 345k| if (bits == 0) { ------------------ | Branch (46:17): [True: 172k, False: 172k] ------------------ 47| 172k| if (j < inlen) { ------------------ | Branch (47:21): [True: 172k, False: 24] ------------------ 48| 172k| w = in[j]; 49| 172k| bits = lsb; 50| 172k| j++; 51| 172k| } else { 52| 24| break; // the input vector is exhausted 53| 24| } 54| 172k| } 55| 345k| } 56| 345k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 345k, False: 0] ------------------ 57| 345k| i++; 58| 345k| } 59| 345k| } 60| 24|} oqs_kem_efrodokem_1344_aes_unpack: 64| 32|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 32| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 32| size_t i = 0; // whole uint16_t already filled in 69| 32| size_t j = 0; // whole bytes already copied 70| 32| unsigned char w = 0; // the leftover, not yet copied 71| 32| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 258k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 258k, False: 32] | Branch (73:27): [True: 258k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 258k| unsigned char b = 0; // bits in out[i] already filled in 86| 775k| while (b < lsb) { ------------------ | Branch (86:16): [True: 517k, False: 258k] ------------------ 87| 517k| int nbits = min(lsb - b, bits); ------------------ | | 11| 517k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 517k] | | ------------------ ------------------ 88| 517k| uint16_t mask = (1 << nbits) - 1; 89| 517k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 517k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 517k| b += nbits; 92| 517k| bits -= nbits; 93| 517k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 517k| if (bits == 0) { ------------------ | Branch (95:17): [True: 517k, False: 0] ------------------ 96| 517k| if (j < inlen) { ------------------ | Branch (96:21): [True: 517k, False: 32] ------------------ 97| 517k| w = in[j]; 98| 517k| bits = 8; 99| 517k| j++; 100| 517k| } else { 101| 32| break; // the input vector is exhausted 102| 32| } 103| 517k| } 104| 517k| } 105| 258k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 258k, False: 0] ------------------ 106| 258k| i++; 107| 258k| } 108| 258k| } 109| 32|} oqs_kem_efrodokem_1344_aes_ct_verify: 113| 16|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 16| uint16_t r = 0; 116| | 117| 86.5k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 86.5k, False: 16] ------------------ 118| 86.5k| r |= a[i] ^ b[i]; 119| 86.5k| } 120| | 121| 16| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 16| return (int8_t)r; 123| 16|} oqs_kem_efrodokem_1344_aes_ct_select: 127| 8|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 8| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 8| do { \ | | 59| 8| __asm__ volatile("" : "+r"(v) :); \ | | 60| 8| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 8] | | ------------------ ------------------ 130| 264| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 256, False: 8] ------------------ 131| 256| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 256| } 133| 8|} oqs_kem_efrodokem_1344_shake_pack: 15| 9|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 9| memset(out, 0, outlen); 18| | 19| 9| size_t i = 0; // whole bytes already filled in 20| 9| size_t j = 0; // whole uint16_t already copied 21| 9| uint16_t w = 0; // the leftover, not yet copied 22| 9| unsigned char bits = 0; // the number of lsb in w 23| | 24| 129k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 129k, False: 9] | Branch (24:27): [True: 129k, False: 18] | Branch (24:41): [True: 18, False: 0] | Branch (24:57): [True: 18, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 129k| unsigned char b = 0; // bits in out[i] already filled in 37| 258k| while (b < 8) { ------------------ | Branch (37:16): [True: 129k, False: 129k] ------------------ 38| 129k| int nbits = min(8 - b, bits); ------------------ | | 11| 129k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 64.7k, False: 64.7k] | | ------------------ ------------------ 39| 129k| uint16_t mask = (1 << nbits) - 1; 40| 129k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 129k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 129k| b += nbits; 43| 129k| bits -= nbits; 44| 129k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 129k| if (bits == 0) { ------------------ | Branch (46:17): [True: 64.7k, False: 64.7k] ------------------ 47| 64.7k| if (j < inlen) { ------------------ | Branch (47:21): [True: 64.7k, False: 9] ------------------ 48| 64.7k| w = in[j]; 49| 64.7k| bits = lsb; 50| 64.7k| j++; 51| 64.7k| } else { 52| 9| break; // the input vector is exhausted 53| 9| } 54| 64.7k| } 55| 129k| } 56| 129k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 129k, False: 0] ------------------ 57| 129k| i++; 58| 129k| } 59| 129k| } 60| 9|} oqs_kem_efrodokem_1344_shake_unpack: 64| 12|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 12| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 12| size_t i = 0; // whole uint16_t already filled in 69| 12| size_t j = 0; // whole bytes already copied 70| 12| unsigned char w = 0; // the leftover, not yet copied 71| 12| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 96.9k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 96.9k, False: 12] | Branch (73:27): [True: 96.9k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 96.9k| unsigned char b = 0; // bits in out[i] already filled in 86| 290k| while (b < lsb) { ------------------ | Branch (86:16): [True: 193k, False: 96.9k] ------------------ 87| 193k| int nbits = min(lsb - b, bits); ------------------ | | 11| 193k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 193k] | | ------------------ ------------------ 88| 193k| uint16_t mask = (1 << nbits) - 1; 89| 193k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 193k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 193k| b += nbits; 92| 193k| bits -= nbits; 93| 193k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 193k| if (bits == 0) { ------------------ | Branch (95:17): [True: 193k, False: 0] ------------------ 96| 193k| if (j < inlen) { ------------------ | Branch (96:21): [True: 193k, False: 12] ------------------ 97| 193k| w = in[j]; 98| 193k| bits = 8; 99| 193k| j++; 100| 193k| } else { 101| 12| break; // the input vector is exhausted 102| 12| } 103| 193k| } 104| 193k| } 105| 96.9k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 96.9k, False: 0] ------------------ 106| 96.9k| i++; 107| 96.9k| } 108| 96.9k| } 109| 12|} oqs_kem_efrodokem_1344_shake_ct_verify: 113| 6|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 6| uint16_t r = 0; 116| | 117| 32.4k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 32.4k, False: 6] ------------------ 118| 32.4k| r |= a[i] ^ b[i]; 119| 32.4k| } 120| | 121| 6| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 6| return (int8_t)r; 123| 6|} oqs_kem_efrodokem_1344_shake_ct_select: 127| 3|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 3| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 3| do { \ | | 59| 3| __asm__ volatile("" : "+r"(v) :); \ | | 60| 3| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 3] | | ------------------ ------------------ 130| 99| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 96, False: 3] ------------------ 131| 96| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 96| } 133| 3|} OQS_KEM_efrodokem_1344_aes_new: 9| 8|OQS_KEM *OQS_KEM_efrodokem_1344_aes_new(void) { 10| | 11| 8| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 8| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 8] ------------------ 13| 0| return NULL; 14| 0| } 15| 8| kem->method_name = OQS_KEM_alg_efrodokem_1344_aes; ------------------ | | 115| 8|#define OQS_KEM_alg_efrodokem_1344_aes "eFrodoKEM-1344-AES" ------------------ 16| 8| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 8| kem->claimed_nist_level = 5; 19| 8| kem->ind_cca = true; 20| | 21| 8| kem->length_public_key = OQS_KEM_efrodokem_1344_aes_length_public_key; ------------------ | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 ------------------ 22| 8| kem->length_secret_key = OQS_KEM_efrodokem_1344_aes_length_secret_key; ------------------ | | 160| 8|#define OQS_KEM_efrodokem_1344_aes_length_secret_key 43088 ------------------ 23| 8| kem->length_ciphertext = OQS_KEM_efrodokem_1344_aes_length_ciphertext; ------------------ | | 161| 8|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 ------------------ 24| 8| kem->length_shared_secret = OQS_KEM_efrodokem_1344_aes_length_shared_secret; ------------------ | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 ------------------ 25| 8| kem->length_keypair_seed = OQS_KEM_efrodokem_1344_aes_length_keypair_seed; ------------------ | | 163| 8|#define OQS_KEM_efrodokem_1344_aes_length_keypair_seed 0 ------------------ 26| 8| kem->length_encaps_seed = OQS_KEM_efrodokem_1344_aes_length_encaps_seed; ------------------ | | 164| 8|#define OQS_KEM_efrodokem_1344_aes_length_encaps_seed 0 ------------------ 27| | 28| 8| kem->keypair = OQS_KEM_efrodokem_1344_aes_keypair; 29| 8| kem->keypair_derand = OQS_KEM_efrodokem_1344_aes_keypair_derand; 30| 8| kem->encaps = OQS_KEM_efrodokem_1344_aes_encaps; 31| 8| kem->encaps_derand = OQS_KEM_efrodokem_1344_aes_encaps_derand; 32| 8| kem->decaps = OQS_KEM_efrodokem_1344_aes_decaps; 33| | 34| 8| return kem; 35| 8|} OQS_KEM_efrodokem_1344_shake_new: 9| 3|OQS_KEM *OQS_KEM_efrodokem_1344_shake_new(void) { 10| | 11| 3| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 3| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 3] ------------------ 13| 0| return NULL; 14| 0| } 15| 3| kem->method_name = OQS_KEM_alg_efrodokem_1344_shake; ------------------ | | 117| 3|#define OQS_KEM_alg_efrodokem_1344_shake "eFrodoKEM-1344-SHAKE" ------------------ 16| 3| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 3| kem->claimed_nist_level = 5; 19| 3| kem->ind_cca = true; 20| | 21| 3| kem->length_public_key = OQS_KEM_efrodokem_1344_shake_length_public_key; ------------------ | | 174| 3|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 ------------------ 22| 3| kem->length_secret_key = OQS_KEM_efrodokem_1344_shake_length_secret_key; ------------------ | | 175| 3|#define OQS_KEM_efrodokem_1344_shake_length_secret_key 43088 ------------------ 23| 3| kem->length_ciphertext = OQS_KEM_efrodokem_1344_shake_length_ciphertext; ------------------ | | 176| 3|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 ------------------ 24| 3| kem->length_shared_secret = OQS_KEM_efrodokem_1344_shake_length_shared_secret; ------------------ | | 177| 3|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 ------------------ 25| 3| kem->length_keypair_seed = OQS_KEM_efrodokem_1344_shake_length_keypair_seed; ------------------ | | 178| 3|#define OQS_KEM_efrodokem_1344_shake_length_keypair_seed 0 ------------------ 26| 3| kem->length_encaps_seed = OQS_KEM_efrodokem_1344_shake_length_encaps_seed; ------------------ | | 179| 3|#define OQS_KEM_efrodokem_1344_shake_length_encaps_seed 0 ------------------ 27| | 28| 3| kem->keypair = OQS_KEM_efrodokem_1344_shake_keypair; 29| 3| kem->keypair_derand = OQS_KEM_efrodokem_1344_shake_keypair_derand; 30| 3| kem->encaps = OQS_KEM_efrodokem_1344_shake_encaps; 31| 3| kem->encaps_derand = OQS_KEM_efrodokem_1344_shake_encaps_derand; 32| 3| kem->decaps = OQS_KEM_efrodokem_1344_shake_decaps; 33| | 34| 3| return kem; 35| 3|} OQS_KEM_efrodokem_640_aes_new: 9| 4|OQS_KEM *OQS_KEM_efrodokem_640_aes_new(void) { 10| | 11| 4| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 4| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 4] ------------------ 13| 0| return NULL; 14| 0| } 15| 4| kem->method_name = OQS_KEM_alg_efrodokem_640_aes; ------------------ | | 107| 4|#define OQS_KEM_alg_efrodokem_640_aes "eFrodoKEM-640-AES" ------------------ 16| 4| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 4| kem->claimed_nist_level = 1; 19| 4| kem->ind_cca = true; 20| | 21| 4| kem->length_public_key = OQS_KEM_efrodokem_640_aes_length_public_key; ------------------ | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 ------------------ 22| 4| kem->length_secret_key = OQS_KEM_efrodokem_640_aes_length_secret_key; ------------------ | | 100| 4|#define OQS_KEM_efrodokem_640_aes_length_secret_key 19888 ------------------ 23| 4| kem->length_ciphertext = OQS_KEM_efrodokem_640_aes_length_ciphertext; ------------------ | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 ------------------ 24| 4| kem->length_shared_secret = OQS_KEM_efrodokem_640_aes_length_shared_secret; ------------------ | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 ------------------ 25| 4| kem->length_keypair_seed = OQS_KEM_efrodokem_640_aes_length_keypair_seed; ------------------ | | 103| 4|#define OQS_KEM_efrodokem_640_aes_length_keypair_seed 0 ------------------ 26| 4| kem->length_encaps_seed = OQS_KEM_efrodokem_640_aes_length_encaps_seed; ------------------ | | 104| 4|#define OQS_KEM_efrodokem_640_aes_length_encaps_seed 0 ------------------ 27| | 28| 4| kem->keypair = OQS_KEM_efrodokem_640_aes_keypair; 29| 4| kem->keypair_derand = OQS_KEM_efrodokem_640_aes_keypair_derand; 30| 4| kem->encaps = OQS_KEM_efrodokem_640_aes_encaps; 31| 4| kem->encaps_derand = OQS_KEM_efrodokem_640_aes_encaps_derand; 32| 4| kem->decaps = OQS_KEM_efrodokem_640_aes_decaps; 33| | 34| 4| return kem; 35| 4|} OQS_KEM_efrodokem_640_shake_new: 9| 3|OQS_KEM *OQS_KEM_efrodokem_640_shake_new(void) { 10| | 11| 3| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 3| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 3] ------------------ 13| 0| return NULL; 14| 0| } 15| 3| kem->method_name = OQS_KEM_alg_efrodokem_640_shake; ------------------ | | 109| 3|#define OQS_KEM_alg_efrodokem_640_shake "eFrodoKEM-640-SHAKE" ------------------ 16| 3| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 3| kem->claimed_nist_level = 1; 19| 3| kem->ind_cca = true; 20| | 21| 3| kem->length_public_key = OQS_KEM_efrodokem_640_shake_length_public_key; ------------------ | | 114| 3|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 ------------------ 22| 3| kem->length_secret_key = OQS_KEM_efrodokem_640_shake_length_secret_key; ------------------ | | 115| 3|#define OQS_KEM_efrodokem_640_shake_length_secret_key 19888 ------------------ 23| 3| kem->length_ciphertext = OQS_KEM_efrodokem_640_shake_length_ciphertext; ------------------ | | 116| 3|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 ------------------ 24| 3| kem->length_shared_secret = OQS_KEM_efrodokem_640_shake_length_shared_secret; ------------------ | | 117| 3|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 ------------------ 25| 3| kem->length_keypair_seed = OQS_KEM_efrodokem_640_shake_length_keypair_seed; ------------------ | | 118| 3|#define OQS_KEM_efrodokem_640_shake_length_keypair_seed 0 ------------------ 26| 3| kem->length_encaps_seed = OQS_KEM_efrodokem_640_shake_length_encaps_seed; ------------------ | | 119| 3|#define OQS_KEM_efrodokem_640_shake_length_encaps_seed 0 ------------------ 27| | 28| 3| kem->keypair = OQS_KEM_efrodokem_640_shake_keypair; 29| 3| kem->keypair_derand = OQS_KEM_efrodokem_640_shake_keypair_derand; 30| 3| kem->encaps = OQS_KEM_efrodokem_640_shake_encaps; 31| 3| kem->encaps_derand = OQS_KEM_efrodokem_640_shake_encaps_derand; 32| 3| kem->decaps = OQS_KEM_efrodokem_640_shake_decaps; 33| | 34| 3| return kem; 35| 3|} OQS_KEM_efrodokem_976_aes_new: 9| 8|OQS_KEM *OQS_KEM_efrodokem_976_aes_new(void) { 10| | 11| 8| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 8| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 8] ------------------ 13| 0| return NULL; 14| 0| } 15| 8| kem->method_name = OQS_KEM_alg_efrodokem_976_aes; ------------------ | | 111| 8|#define OQS_KEM_alg_efrodokem_976_aes "eFrodoKEM-976-AES" ------------------ 16| 8| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 8| kem->claimed_nist_level = 3; 19| 8| kem->ind_cca = true; 20| | 21| 8| kem->length_public_key = OQS_KEM_efrodokem_976_aes_length_public_key; ------------------ | | 129| 8|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 ------------------ 22| 8| kem->length_secret_key = OQS_KEM_efrodokem_976_aes_length_secret_key; ------------------ | | 130| 8|#define OQS_KEM_efrodokem_976_aes_length_secret_key 31296 ------------------ 23| 8| kem->length_ciphertext = OQS_KEM_efrodokem_976_aes_length_ciphertext; ------------------ | | 131| 8|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 ------------------ 24| 8| kem->length_shared_secret = OQS_KEM_efrodokem_976_aes_length_shared_secret; ------------------ | | 132| 8|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 ------------------ 25| 8| kem->length_keypair_seed = OQS_KEM_efrodokem_976_aes_length_keypair_seed; ------------------ | | 133| 8|#define OQS_KEM_efrodokem_976_aes_length_keypair_seed 0 ------------------ 26| 8| kem->length_encaps_seed = OQS_KEM_efrodokem_976_aes_length_encaps_seed; ------------------ | | 134| 8|#define OQS_KEM_efrodokem_976_aes_length_encaps_seed 0 ------------------ 27| | 28| 8| kem->keypair = OQS_KEM_efrodokem_976_aes_keypair; 29| 8| kem->keypair_derand = OQS_KEM_efrodokem_976_aes_keypair_derand; 30| 8| kem->encaps = OQS_KEM_efrodokem_976_aes_encaps; 31| 8| kem->encaps_derand = OQS_KEM_efrodokem_976_aes_encaps_derand; 32| 8| kem->decaps = OQS_KEM_efrodokem_976_aes_decaps; 33| | 34| 8| return kem; 35| 8|} OQS_KEM_efrodokem_976_shake_new: 9| 8|OQS_KEM *OQS_KEM_efrodokem_976_shake_new(void) { 10| | 11| 8| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 8| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 8] ------------------ 13| 0| return NULL; 14| 0| } 15| 8| kem->method_name = OQS_KEM_alg_efrodokem_976_shake; ------------------ | | 113| 8|#define OQS_KEM_alg_efrodokem_976_shake "eFrodoKEM-976-SHAKE" ------------------ 16| 8| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 8| kem->claimed_nist_level = 3; 19| 8| kem->ind_cca = true; 20| | 21| 8| kem->length_public_key = OQS_KEM_efrodokem_976_shake_length_public_key; ------------------ | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 ------------------ 22| 8| kem->length_secret_key = OQS_KEM_efrodokem_976_shake_length_secret_key; ------------------ | | 145| 8|#define OQS_KEM_efrodokem_976_shake_length_secret_key 31296 ------------------ 23| 8| kem->length_ciphertext = OQS_KEM_efrodokem_976_shake_length_ciphertext; ------------------ | | 146| 8|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 ------------------ 24| 8| kem->length_shared_secret = OQS_KEM_efrodokem_976_shake_length_shared_secret; ------------------ | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 ------------------ 25| 8| kem->length_keypair_seed = OQS_KEM_efrodokem_976_shake_length_keypair_seed; ------------------ | | 148| 8|#define OQS_KEM_efrodokem_976_shake_length_keypair_seed 0 ------------------ 26| 8| kem->length_encaps_seed = OQS_KEM_efrodokem_976_shake_length_encaps_seed; ------------------ | | 149| 8|#define OQS_KEM_efrodokem_976_shake_length_encaps_seed 0 ------------------ 27| | 28| 8| kem->keypair = OQS_KEM_efrodokem_976_shake_keypair; 29| 8| kem->keypair_derand = OQS_KEM_efrodokem_976_shake_keypair_derand; 30| 8| kem->encaps = OQS_KEM_efrodokem_976_shake_encaps; 31| 8| kem->encaps_derand = OQS_KEM_efrodokem_976_shake_encaps_derand; 32| 8| kem->decaps = OQS_KEM_efrodokem_976_shake_decaps; 33| | 34| 8| return kem; 35| 8|} OQS_KEM_frodokem_1344_aes_new: 9| 9|OQS_KEM *OQS_KEM_frodokem_1344_aes_new(void) { 10| | 11| 9| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 9| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 9] ------------------ 13| 0| return NULL; 14| 0| } 15| 9| kem->method_name = OQS_KEM_alg_frodokem_1344_aes; ------------------ | | 103| 9|#define OQS_KEM_alg_frodokem_1344_aes "FrodoKEM-1344-AES" ------------------ 16| 9| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 9| kem->claimed_nist_level = 5; 19| 9| kem->ind_cca = true; 20| | 21| 9| kem->length_public_key = OQS_KEM_frodokem_1344_aes_length_public_key; ------------------ | | 69| 9|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 ------------------ 22| 9| kem->length_secret_key = OQS_KEM_frodokem_1344_aes_length_secret_key; ------------------ | | 70| 9|#define OQS_KEM_frodokem_1344_aes_length_secret_key 43088 ------------------ 23| 9| kem->length_ciphertext = OQS_KEM_frodokem_1344_aes_length_ciphertext; ------------------ | | 71| 9|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 ------------------ 24| 9| kem->length_shared_secret = OQS_KEM_frodokem_1344_aes_length_shared_secret; ------------------ | | 72| 9|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 ------------------ 25| 9| kem->length_keypair_seed = OQS_KEM_frodokem_1344_aes_length_keypair_seed; ------------------ | | 73| 9|#define OQS_KEM_frodokem_1344_aes_length_keypair_seed 0 ------------------ 26| 9| kem->length_encaps_seed = OQS_KEM_frodokem_1344_aes_length_encaps_seed; ------------------ | | 74| 9|#define OQS_KEM_frodokem_1344_aes_length_encaps_seed 0 ------------------ 27| | 28| 9| kem->keypair = OQS_KEM_frodokem_1344_aes_keypair; 29| 9| kem->keypair_derand = OQS_KEM_frodokem_1344_aes_keypair_derand; 30| 9| kem->encaps = OQS_KEM_frodokem_1344_aes_encaps; 31| 9| kem->encaps_derand = OQS_KEM_frodokem_1344_aes_encaps_derand; 32| 9| kem->decaps = OQS_KEM_frodokem_1344_aes_decaps; 33| | 34| 9| return kem; 35| 9|} OQS_KEM_frodokem_1344_shake_new: 9| 8|OQS_KEM *OQS_KEM_frodokem_1344_shake_new(void) { 10| | 11| 8| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 8| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 8] ------------------ 13| 0| return NULL; 14| 0| } 15| 8| kem->method_name = OQS_KEM_alg_frodokem_1344_shake; ------------------ | | 105| 8|#define OQS_KEM_alg_frodokem_1344_shake "FrodoKEM-1344-SHAKE" ------------------ 16| 8| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 8| kem->claimed_nist_level = 5; 19| 8| kem->ind_cca = true; 20| | 21| 8| kem->length_public_key = OQS_KEM_frodokem_1344_shake_length_public_key; ------------------ | | 84| 8|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 ------------------ 22| 8| kem->length_secret_key = OQS_KEM_frodokem_1344_shake_length_secret_key; ------------------ | | 85| 8|#define OQS_KEM_frodokem_1344_shake_length_secret_key 43088 ------------------ 23| 8| kem->length_ciphertext = OQS_KEM_frodokem_1344_shake_length_ciphertext; ------------------ | | 86| 8|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 ------------------ 24| 8| kem->length_shared_secret = OQS_KEM_frodokem_1344_shake_length_shared_secret; ------------------ | | 87| 8|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 ------------------ 25| 8| kem->length_keypair_seed = OQS_KEM_frodokem_1344_shake_length_keypair_seed; ------------------ | | 88| 8|#define OQS_KEM_frodokem_1344_shake_length_keypair_seed 0 ------------------ 26| 8| kem->length_encaps_seed = OQS_KEM_frodokem_1344_shake_length_encaps_seed; ------------------ | | 89| 8|#define OQS_KEM_frodokem_1344_shake_length_encaps_seed 0 ------------------ 27| | 28| 8| kem->keypair = OQS_KEM_frodokem_1344_shake_keypair; 29| 8| kem->keypair_derand = OQS_KEM_frodokem_1344_shake_keypair_derand; 30| 8| kem->encaps = OQS_KEM_frodokem_1344_shake_encaps; 31| 8| kem->encaps_derand = OQS_KEM_frodokem_1344_shake_encaps_derand; 32| 8| kem->decaps = OQS_KEM_frodokem_1344_shake_decaps; 33| | 34| 8| return kem; 35| 8|} OQS_KEM_frodokem_640_aes_new: 9| 2|OQS_KEM *OQS_KEM_frodokem_640_aes_new(void) { 10| | 11| 2| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 2| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 2] ------------------ 13| 0| return NULL; 14| 0| } 15| 2| kem->method_name = OQS_KEM_alg_frodokem_640_aes; ------------------ | | 95| 2|#define OQS_KEM_alg_frodokem_640_aes "FrodoKEM-640-AES" ------------------ 16| 2| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 2| kem->claimed_nist_level = 1; 19| 2| kem->ind_cca = true; 20| | 21| 2| kem->length_public_key = OQS_KEM_frodokem_640_aes_length_public_key; ------------------ | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 ------------------ 22| 2| kem->length_secret_key = OQS_KEM_frodokem_640_aes_length_secret_key; ------------------ | | 10| 2|#define OQS_KEM_frodokem_640_aes_length_secret_key 19888 ------------------ 23| 2| kem->length_ciphertext = OQS_KEM_frodokem_640_aes_length_ciphertext; ------------------ | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 ------------------ 24| 2| kem->length_shared_secret = OQS_KEM_frodokem_640_aes_length_shared_secret; ------------------ | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 ------------------ 25| 2| kem->length_keypair_seed = OQS_KEM_frodokem_640_aes_length_keypair_seed; ------------------ | | 13| 2|#define OQS_KEM_frodokem_640_aes_length_keypair_seed 0 ------------------ 26| 2| kem->length_encaps_seed = OQS_KEM_frodokem_640_aes_length_encaps_seed; ------------------ | | 14| 2|#define OQS_KEM_frodokem_640_aes_length_encaps_seed 0 ------------------ 27| | 28| 2| kem->keypair = OQS_KEM_frodokem_640_aes_keypair; 29| 2| kem->keypair_derand = OQS_KEM_frodokem_640_aes_keypair_derand; 30| 2| kem->encaps = OQS_KEM_frodokem_640_aes_encaps; 31| 2| kem->encaps_derand = OQS_KEM_frodokem_640_aes_encaps_derand; 32| 2| kem->decaps = OQS_KEM_frodokem_640_aes_decaps; 33| | 34| 2| return kem; 35| 2|} OQS_KEM_frodokem_640_shake_new: 9| 3|OQS_KEM *OQS_KEM_frodokem_640_shake_new(void) { 10| | 11| 3| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 3| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 3] ------------------ 13| 0| return NULL; 14| 0| } 15| 3| kem->method_name = OQS_KEM_alg_frodokem_640_shake; ------------------ | | 97| 3|#define OQS_KEM_alg_frodokem_640_shake "FrodoKEM-640-SHAKE" ------------------ 16| 3| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 3| kem->claimed_nist_level = 1; 19| 3| kem->ind_cca = true; 20| | 21| 3| kem->length_public_key = OQS_KEM_frodokem_640_shake_length_public_key; ------------------ | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 ------------------ 22| 3| kem->length_secret_key = OQS_KEM_frodokem_640_shake_length_secret_key; ------------------ | | 25| 3|#define OQS_KEM_frodokem_640_shake_length_secret_key 19888 ------------------ 23| 3| kem->length_ciphertext = OQS_KEM_frodokem_640_shake_length_ciphertext; ------------------ | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 ------------------ 24| 3| kem->length_shared_secret = OQS_KEM_frodokem_640_shake_length_shared_secret; ------------------ | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 ------------------ 25| 3| kem->length_keypair_seed = OQS_KEM_frodokem_640_shake_length_keypair_seed; ------------------ | | 28| 3|#define OQS_KEM_frodokem_640_shake_length_keypair_seed 0 ------------------ 26| 3| kem->length_encaps_seed = OQS_KEM_frodokem_640_shake_length_encaps_seed; ------------------ | | 29| 3|#define OQS_KEM_frodokem_640_shake_length_encaps_seed 0 ------------------ 27| | 28| 3| kem->keypair = OQS_KEM_frodokem_640_shake_keypair; 29| 3| kem->keypair_derand = OQS_KEM_frodokem_640_shake_keypair_derand; 30| 3| kem->encaps = OQS_KEM_frodokem_640_shake_encaps; 31| 3| kem->encaps_derand = OQS_KEM_frodokem_640_shake_encaps_derand; 32| 3| kem->decaps = OQS_KEM_frodokem_640_shake_decaps; 33| | 34| 3| return kem; 35| 3|} OQS_KEM_frodokem_976_aes_new: 9| 9|OQS_KEM *OQS_KEM_frodokem_976_aes_new(void) { 10| | 11| 9| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 9| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 9] ------------------ 13| 0| return NULL; 14| 0| } 15| 9| kem->method_name = OQS_KEM_alg_frodokem_976_aes; ------------------ | | 99| 9|#define OQS_KEM_alg_frodokem_976_aes "FrodoKEM-976-AES" ------------------ 16| 9| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 9| kem->claimed_nist_level = 3; 19| 9| kem->ind_cca = true; 20| | 21| 9| kem->length_public_key = OQS_KEM_frodokem_976_aes_length_public_key; ------------------ | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 ------------------ 22| 9| kem->length_secret_key = OQS_KEM_frodokem_976_aes_length_secret_key; ------------------ | | 40| 9|#define OQS_KEM_frodokem_976_aes_length_secret_key 31296 ------------------ 23| 9| kem->length_ciphertext = OQS_KEM_frodokem_976_aes_length_ciphertext; ------------------ | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 ------------------ 24| 9| kem->length_shared_secret = OQS_KEM_frodokem_976_aes_length_shared_secret; ------------------ | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 ------------------ 25| 9| kem->length_keypair_seed = OQS_KEM_frodokem_976_aes_length_keypair_seed; ------------------ | | 43| 9|#define OQS_KEM_frodokem_976_aes_length_keypair_seed 0 ------------------ 26| 9| kem->length_encaps_seed = OQS_KEM_frodokem_976_aes_length_encaps_seed; ------------------ | | 44| 9|#define OQS_KEM_frodokem_976_aes_length_encaps_seed 0 ------------------ 27| | 28| 9| kem->keypair = OQS_KEM_frodokem_976_aes_keypair; 29| 9| kem->keypair_derand = OQS_KEM_frodokem_976_aes_keypair_derand; 30| 9| kem->encaps = OQS_KEM_frodokem_976_aes_encaps; 31| 9| kem->encaps_derand = OQS_KEM_frodokem_976_aes_encaps_derand; 32| 9| kem->decaps = OQS_KEM_frodokem_976_aes_decaps; 33| | 34| 9| return kem; 35| 9|} OQS_KEM_frodokem_976_shake_new: 9| 13|OQS_KEM *OQS_KEM_frodokem_976_shake_new(void) { 10| | 11| 13| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 13| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 13] ------------------ 13| 0| return NULL; 14| 0| } 15| 13| kem->method_name = OQS_KEM_alg_frodokem_976_shake; ------------------ | | 101| 13|#define OQS_KEM_alg_frodokem_976_shake "FrodoKEM-976-SHAKE" ------------------ 16| 13| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 13| kem->claimed_nist_level = 3; 19| 13| kem->ind_cca = true; 20| | 21| 13| kem->length_public_key = OQS_KEM_frodokem_976_shake_length_public_key; ------------------ | | 54| 13|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 ------------------ 22| 13| kem->length_secret_key = OQS_KEM_frodokem_976_shake_length_secret_key; ------------------ | | 55| 13|#define OQS_KEM_frodokem_976_shake_length_secret_key 31296 ------------------ 23| 13| kem->length_ciphertext = OQS_KEM_frodokem_976_shake_length_ciphertext; ------------------ | | 56| 13|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 ------------------ 24| 13| kem->length_shared_secret = OQS_KEM_frodokem_976_shake_length_shared_secret; ------------------ | | 57| 13|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 ------------------ 25| 13| kem->length_keypair_seed = OQS_KEM_frodokem_976_shake_length_keypair_seed; ------------------ | | 58| 13|#define OQS_KEM_frodokem_976_shake_length_keypair_seed 0 ------------------ 26| 13| kem->length_encaps_seed = OQS_KEM_frodokem_976_shake_length_encaps_seed; ------------------ | | 59| 13|#define OQS_KEM_frodokem_976_shake_length_encaps_seed 0 ------------------ 27| | 28| 13| kem->keypair = OQS_KEM_frodokem_976_shake_keypair; 29| 13| kem->keypair_derand = OQS_KEM_frodokem_976_shake_keypair_derand; 30| 13| kem->encaps = OQS_KEM_frodokem_976_shake_encaps; 31| 13| kem->encaps_derand = OQS_KEM_frodokem_976_shake_encaps_derand; 32| 13| kem->decaps = OQS_KEM_frodokem_976_shake_decaps; 33| | 34| 13| return kem; 35| 13|} OQS_KEM_hqc_1_new: 9| 39|OQS_KEM *OQS_KEM_hqc_1_new(void) { 10| | 11| 39| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 39| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 39] ------------------ 13| 0| return NULL; 14| 0| } 15| 39| kem->method_name = OQS_KEM_alg_hqc_1; ------------------ | | 62| 39|#define OQS_KEM_alg_hqc_1 "HQC-1" ------------------ 16| 39| kem->alg_version = "https://gitlab.com/pqc-hqc/hqc@161cd4f"; 17| | 18| 39| kem->claimed_nist_level = 1; 19| 39| kem->ind_cca = true; 20| | 21| 39| kem->length_public_key = OQS_KEM_hqc_1_length_public_key; ------------------ | | 9| 39|#define OQS_KEM_hqc_1_length_public_key 2241 ------------------ 22| 39| kem->length_secret_key = OQS_KEM_hqc_1_length_secret_key; ------------------ | | 10| 39|#define OQS_KEM_hqc_1_length_secret_key 2321 ------------------ 23| 39| kem->length_ciphertext = OQS_KEM_hqc_1_length_ciphertext; ------------------ | | 11| 39|#define OQS_KEM_hqc_1_length_ciphertext 4433 ------------------ 24| 39| kem->length_shared_secret = OQS_KEM_hqc_1_length_shared_secret; ------------------ | | 12| 39|#define OQS_KEM_hqc_1_length_shared_secret 32 ------------------ 25| 39| kem->length_keypair_seed = OQS_KEM_hqc_1_length_keypair_seed; ------------------ | | 13| 39|#define OQS_KEM_hqc_1_length_keypair_seed 0 ------------------ 26| 39| kem->length_encaps_seed = OQS_KEM_hqc_1_length_encaps_seed; ------------------ | | 14| 39|#define OQS_KEM_hqc_1_length_encaps_seed 0 ------------------ 27| | 28| 39| kem->keypair = OQS_KEM_hqc_1_keypair; 29| 39| kem->keypair_derand = OQS_KEM_hqc_1_keypair_derand; 30| 39| kem->encaps = OQS_KEM_hqc_1_encaps; 31| 39| kem->encaps_derand = OQS_KEM_hqc_1_encaps_derand; 32| 39| kem->decaps = OQS_KEM_hqc_1_decaps; 33| | 34| 39| return kem; 35| 39|} OQS_KEM_hqc_1_keypair: 48| 39|OQS_API OQS_STATUS OQS_KEM_hqc_1_keypair(uint8_t *public_key, uint8_t *secret_key) { 49| 39| return (OQS_STATUS) PQCHQC_HQC1_C_crypto_kem_keypair(public_key, secret_key); 50| 39|} OQS_KEM_hqc_1_encaps: 60| 39|OQS_API OQS_STATUS OQS_KEM_hqc_1_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 39| return (OQS_STATUS) PQCHQC_HQC1_C_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 39|} OQS_KEM_hqc_1_decaps: 64| 39|OQS_API OQS_STATUS OQS_KEM_hqc_1_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 39| return (OQS_STATUS) PQCHQC_HQC1_C_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 39|} OQS_KEM_hqc_3_new: 9| 38|OQS_KEM *OQS_KEM_hqc_3_new(void) { 10| | 11| 38| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 38| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 38] ------------------ 13| 0| return NULL; 14| 0| } 15| 38| kem->method_name = OQS_KEM_alg_hqc_3; ------------------ | | 64| 38|#define OQS_KEM_alg_hqc_3 "HQC-3" ------------------ 16| 38| kem->alg_version = "https://gitlab.com/pqc-hqc/hqc@161cd4f"; 17| | 18| 38| kem->claimed_nist_level = 3; 19| 38| kem->ind_cca = true; 20| | 21| 38| kem->length_public_key = OQS_KEM_hqc_3_length_public_key; ------------------ | | 24| 38|#define OQS_KEM_hqc_3_length_public_key 4514 ------------------ 22| 38| kem->length_secret_key = OQS_KEM_hqc_3_length_secret_key; ------------------ | | 25| 38|#define OQS_KEM_hqc_3_length_secret_key 4602 ------------------ 23| 38| kem->length_ciphertext = OQS_KEM_hqc_3_length_ciphertext; ------------------ | | 26| 38|#define OQS_KEM_hqc_3_length_ciphertext 8978 ------------------ 24| 38| kem->length_shared_secret = OQS_KEM_hqc_3_length_shared_secret; ------------------ | | 27| 38|#define OQS_KEM_hqc_3_length_shared_secret 32 ------------------ 25| 38| kem->length_keypair_seed = OQS_KEM_hqc_3_length_keypair_seed; ------------------ | | 28| 38|#define OQS_KEM_hqc_3_length_keypair_seed 0 ------------------ 26| 38| kem->length_encaps_seed = OQS_KEM_hqc_3_length_encaps_seed; ------------------ | | 29| 38|#define OQS_KEM_hqc_3_length_encaps_seed 0 ------------------ 27| | 28| 38| kem->keypair = OQS_KEM_hqc_3_keypair; 29| 38| kem->keypair_derand = OQS_KEM_hqc_3_keypair_derand; 30| 38| kem->encaps = OQS_KEM_hqc_3_encaps; 31| 38| kem->encaps_derand = OQS_KEM_hqc_3_encaps_derand; 32| 38| kem->decaps = OQS_KEM_hqc_3_decaps; 33| | 34| 38| return kem; 35| 38|} OQS_KEM_hqc_3_keypair: 48| 38|OQS_API OQS_STATUS OQS_KEM_hqc_3_keypair(uint8_t *public_key, uint8_t *secret_key) { 49| 38| return (OQS_STATUS) PQCHQC_HQC3_C_crypto_kem_keypair(public_key, secret_key); 50| 38|} OQS_KEM_hqc_3_encaps: 60| 38|OQS_API OQS_STATUS OQS_KEM_hqc_3_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 38| return (OQS_STATUS) PQCHQC_HQC3_C_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 38|} OQS_KEM_hqc_3_decaps: 64| 38|OQS_API OQS_STATUS OQS_KEM_hqc_3_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 38| return (OQS_STATUS) PQCHQC_HQC3_C_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 38|} OQS_KEM_hqc_5_new: 9| 42|OQS_KEM *OQS_KEM_hqc_5_new(void) { 10| | 11| 42| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 42| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 42] ------------------ 13| 0| return NULL; 14| 0| } 15| 42| kem->method_name = OQS_KEM_alg_hqc_5; ------------------ | | 66| 42|#define OQS_KEM_alg_hqc_5 "HQC-5" ------------------ 16| 42| kem->alg_version = "https://gitlab.com/pqc-hqc/hqc@161cd4f"; 17| | 18| 42| kem->claimed_nist_level = 5; 19| 42| kem->ind_cca = true; 20| | 21| 42| kem->length_public_key = OQS_KEM_hqc_5_length_public_key; ------------------ | | 39| 42|#define OQS_KEM_hqc_5_length_public_key 7237 ------------------ 22| 42| kem->length_secret_key = OQS_KEM_hqc_5_length_secret_key; ------------------ | | 40| 42|#define OQS_KEM_hqc_5_length_secret_key 7333 ------------------ 23| 42| kem->length_ciphertext = OQS_KEM_hqc_5_length_ciphertext; ------------------ | | 41| 42|#define OQS_KEM_hqc_5_length_ciphertext 14421 ------------------ 24| 42| kem->length_shared_secret = OQS_KEM_hqc_5_length_shared_secret; ------------------ | | 42| 42|#define OQS_KEM_hqc_5_length_shared_secret 32 ------------------ 25| 42| kem->length_keypair_seed = OQS_KEM_hqc_5_length_keypair_seed; ------------------ | | 43| 42|#define OQS_KEM_hqc_5_length_keypair_seed 0 ------------------ 26| 42| kem->length_encaps_seed = OQS_KEM_hqc_5_length_encaps_seed; ------------------ | | 44| 42|#define OQS_KEM_hqc_5_length_encaps_seed 0 ------------------ 27| | 28| 42| kem->keypair = OQS_KEM_hqc_5_keypair; 29| 42| kem->keypair_derand = OQS_KEM_hqc_5_keypair_derand; 30| 42| kem->encaps = OQS_KEM_hqc_5_encaps; 31| 42| kem->encaps_derand = OQS_KEM_hqc_5_encaps_derand; 32| 42| kem->decaps = OQS_KEM_hqc_5_decaps; 33| | 34| 42| return kem; 35| 42|} OQS_KEM_hqc_5_keypair: 48| 42|OQS_API OQS_STATUS OQS_KEM_hqc_5_keypair(uint8_t *public_key, uint8_t *secret_key) { 49| 42| return (OQS_STATUS) PQCHQC_HQC5_C_crypto_kem_keypair(public_key, secret_key); 50| 42|} OQS_KEM_hqc_5_encaps: 60| 42|OQS_API OQS_STATUS OQS_KEM_hqc_5_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 42| return (OQS_STATUS) PQCHQC_HQC5_C_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 42|} OQS_KEM_hqc_5_decaps: 64| 42|OQS_API OQS_STATUS OQS_KEM_hqc_5_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 42| return (OQS_STATUS) PQCHQC_HQC5_C_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 42|} PQCHQC_HQC1_C_code_encode: 27| 78|void code_encode(uint64_t *em, const uint64_t *m) { 28| 78| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 29| | 30| 78| reed_solomon_encode(tmp, m); ------------------ | | 84| 78|#define reed_solomon_encode PQCHQC_NAMESPACE(reed_solomon_encode) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 31| 78| reed_muller_encode(em, tmp); ------------------ | | 14| 78|#define reed_muller_encode PQCHQC_NAMESPACE(reed_muller_encode) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 32| | 33| |#ifdef VERBOSE 34| | printf("\n\nReed-Solomon code word: "); 35| | vect_print(tmp, VEC_N1_SIZE_BYTES); 36| | printf("\n\nConcatenated code word: "); 37| | vect_print(em, VEC_N1N2_SIZE_BYTES); 38| |#endif 39| | // Zeroize sensitive data 40| 78| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 78|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 78|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 78|} PQCHQC_HQC1_C_code_decode: 49| 39|void code_decode(uint64_t *m, const uint64_t *em) { 50| 39| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 51| | 52| 39| reed_muller_decode(tmp, em); ------------------ | | 15| 39|#define reed_muller_decode PQCHQC_NAMESPACE(reed_muller_decode) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 53| 39| reed_solomon_decode(m, tmp); ------------------ | | 85| 39|#define reed_solomon_decode PQCHQC_NAMESPACE(reed_solomon_decode) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| | 55| |#ifdef VERBOSE 56| | printf("\n\nReed-Muller decoding result (the input for the Reed-Solomon decoding algorithm): "); 57| | vect_print(tmp, VEC_N1_SIZE_BYTES); 58| |#endif 59| | 60| | // Zeroize sensitive data 61| 39| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 62| 39|} PQCHQC_HQC1_C_fft: 274| 39|void fft(uint16_t *w, const uint16_t *f, size_t f_coeffs) { 275| 39| uint16_t betas[PARAM_M - 1] = {0}; 276| 39| uint16_t betas_sums[1 << (PARAM_M - 1)] = {0}; 277| 39| uint16_t f0[1 << (PARAM_FFT - 1)] = {0}; 278| 39| uint16_t f1[1 << (PARAM_FFT - 1)] = {0}; 279| 39| uint16_t deltas[PARAM_M - 1] = {0}; 280| 39| uint16_t u[1 << (PARAM_M - 1)] = {0}; 281| 39| uint16_t v[1 << (PARAM_M - 1)] = {0}; 282| | 283| 39| size_t i, k; 284| | 285| | // Follows Gao and Mateer algorithm 286| 39| compute_fft_betas(betas); 287| | 288| | // Step 1: PARAM_FFT > 1, nothing to do 289| | 290| | // Compute gammas sums 291| 39| compute_subset_sums(betas_sums, betas, PARAM_M - 1); ------------------ | | 41| 39|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 292| | 293| | // Step 2: beta_m = 1, nothing to do 294| | 295| | // Step 3 296| 39| radix(f0, f1, f, PARAM_FFT); ------------------ | | 46| 39|#define PARAM_FFT 4 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 297| | 298| | // Step 4: Compute deltas 299| 312| for (i = 0; i < PARAM_M - 1; ++i) { ------------------ | | 41| 312|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (299:17): [True: 273, False: 39] ------------------ 300| 273| deltas[i] = gf_square(betas[i]) ^ betas[i]; ------------------ | | 52| 273|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 273|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 273|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 273|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 301| 273| } 302| | 303| | // Step 5 304| 39| fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 39|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 39|#define PARAM_FFT 4 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 305| 39| fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 39|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 39|#define PARAM_FFT 4 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 306| | 307| 39| k = 1 << (PARAM_M - 1); ------------------ | | 41| 39|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 308| | // Step 6, 7 and error polynomial computation 309| 39| memcpy(w + k, v, 2 * k); 310| | 311| | // Check if 0 is root 312| 39| w[0] = u[0]; 313| | 314| | // Check if 1 is root 315| 39| w[k] ^= u[0]; 316| | 317| | // Find other roots 318| 4.99k| for (i = 1; i < k; ++i) { ------------------ | Branch (318:17): [True: 4.95k, False: 39] ------------------ 319| 4.95k| w[i] = u[i] ^ gf_mul(betas_sums[i], v[i]); ------------------ | | 51| 4.95k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 4.95k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.95k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.95k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 320| 4.95k| w[k + i] ^= w[i]; 321| 4.95k| } 322| 39|} PQCHQC_HQC1_C_fft_retrieve_error_poly: 331| 39|void fft_retrieve_error_poly(uint8_t *error, const uint16_t *w) { 332| 39| uint16_t gammas[PARAM_M - 1] = {0}; 333| 39| uint16_t gammas_sums[1 << (PARAM_M - 1)] = {0}; 334| 39| uint16_t k; 335| 39| size_t i, index; 336| | 337| 39| compute_fft_betas(gammas); 338| 39| compute_subset_sums(gammas_sums, gammas, PARAM_M - 1); ------------------ | | 41| 39|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 339| | 340| 39| k = 1 << (PARAM_M - 1); ------------------ | | 41| 39|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 341| 39| error[0] ^= 1 ^ ((uint16_t)-w[0] >> 15); 342| 39| error[0] ^= 1 ^ ((uint16_t)-w[k] >> 15); 343| | 344| 4.99k| for (i = 1; i < k; ++i) { ------------------ | Branch (344:17): [True: 4.95k, False: 39] ------------------ 345| 4.95k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i]]; ------------------ | | 43| 4.95k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (2^PARAM_M−1) ------------------ 346| 4.95k| error[index] ^= 1 ^ ((uint16_t)-w[i] >> 15); 347| | 348| 4.95k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i] ^ 1]; ------------------ | | 43| 4.95k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (2^PARAM_M−1) ------------------ 349| 4.95k| error[index] ^= 1 ^ ((uint16_t)-w[k + i] >> 15); 350| 4.95k| } 351| 39|} fft.c:compute_fft_betas: 29| 238|static void compute_fft_betas(uint16_t *betas) { 30| 238| size_t i; 31| 1.90k| for (i = 0; i < PARAM_M - 1; ++i) { ------------------ | | 41| 1.90k|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (31:17): [True: 1.66k, False: 238] ------------------ 32| 1.66k| betas[i] = 1 << (PARAM_M - 1 - i); ------------------ | | 41| 1.66k|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 33| 1.66k| } 34| 238|} fft.c:compute_subset_sums: 46| 1.59k|static void compute_subset_sums(uint16_t *subset_sums, const uint16_t *set, uint16_t set_size) { 47| 1.59k| uint16_t i, j; 48| 1.59k| subset_sums[0] = 0; 49| | 50| 9.62k| for (i = 0; i < set_size; ++i) { ------------------ | Branch (50:17): [True: 8.03k, False: 1.59k] ------------------ 51| 77.6k| for (j = 0; j < (1 << i); ++j) { ------------------ | Branch (51:21): [True: 69.5k, False: 8.03k] ------------------ 52| 69.5k| subset_sums[(1 << i) + j] = set[i] ^ subset_sums[j]; 53| 69.5k| } 54| 8.03k| } 55| 1.59k|} fft.c:radix: 69| 1.63k|static void radix(uint16_t *f0, uint16_t *f1, const uint16_t *f, uint32_t m_f) { 70| 1.63k| switch (m_f) { 71| 359| case 4: ------------------ | Branch (71:9): [True: 359, False: 1.27k] ------------------ 72| 359| f0[4] = f[8] ^ f[12]; 73| 359| f0[6] = f[12] ^ f[14]; 74| 359| f0[7] = f[14] ^ f[15]; 75| 359| f1[5] = f[11] ^ f[13]; 76| 359| f1[6] = f[13] ^ f[14]; 77| 359| f1[7] = f[15]; 78| 359| f0[5] = f[10] ^ f[12] ^ f1[5]; 79| 359| f1[4] = f[9] ^ f[13] ^ f0[5]; 80| | 81| 359| f0[0] = f[0]; 82| 359| f1[3] = f[7] ^ f[11] ^ f[15]; 83| 359| f0[3] = f[6] ^ f[10] ^ f[14] ^ f1[3]; 84| 359| f0[2] = f[4] ^ f0[4] ^ f0[3] ^ f1[3]; 85| 359| f1[1] = f[3] ^ f[5] ^ f[9] ^ f[13] ^ f1[3]; 86| 359| f1[2] = f[3] ^ f1[1] ^ f0[3]; 87| 359| f0[1] = f[2] ^ f0[2] ^ f1[1]; 88| 359| f1[0] = f[1] ^ f0[1]; 89| 359| break; 90| | 91| 398| case 3: ------------------ | Branch (91:9): [True: 398, False: 1.23k] ------------------ 92| 398| f0[0] = f[0]; 93| 398| f0[2] = f[4] ^ f[6]; 94| 398| f0[3] = f[6] ^ f[7]; 95| 398| f1[1] = f[3] ^ f[5] ^ f[7]; 96| 398| f1[2] = f[5] ^ f[6]; 97| 398| f1[3] = f[7]; 98| 398| f0[1] = f[2] ^ f0[2] ^ f1[1]; 99| 398| f1[0] = f[1] ^ f0[1]; 100| 398| break; 101| | 102| 796| case 2: ------------------ | Branch (102:9): [True: 796, False: 837] ------------------ 103| 796| f0[0] = f[0]; 104| 796| f0[1] = f[2] ^ f[3]; 105| 796| f1[0] = f[1] ^ f0[1]; 106| 796| f1[1] = f[3]; 107| 796| break; 108| | 109| 0| case 1: ------------------ | Branch (109:9): [True: 0, False: 1.63k] ------------------ 110| 0| f0[0] = f[0]; 111| 0| f1[0] = f[1]; 112| 0| break; 113| | 114| 80| default: ------------------ | Branch (114:9): [True: 80, False: 1.55k] ------------------ 115| 80| radix_big(f0, f1, f, m_f); 116| 80| break; 117| 1.63k| } 118| 1.63k|} fft.c:radix_big: 131| 80|static void radix_big(uint16_t *f0, uint16_t *f1, const uint16_t *f, uint32_t m_f) { 132| 80| uint16_t Q[2 * (1 << (PARAM_FFT - 2)) + 1] = {0}; 133| 80| uint16_t R[2 * (1 << (PARAM_FFT - 2)) + 1] = {0}; 134| | 135| 80| uint16_t Q0[1 << (PARAM_FFT - 2)] = {0}; 136| 80| uint16_t Q1[1 << (PARAM_FFT - 2)] = {0}; 137| 80| uint16_t R0[1 << (PARAM_FFT - 2)] = {0}; 138| 80| uint16_t R1[1 << (PARAM_FFT - 2)] = {0}; 139| | 140| 80| size_t i, n; 141| | 142| 80| n = 1; 143| 80| n <<= (m_f - 2); 144| 80| memcpy(Q, f + 3 * n, 2 * n); 145| 80| memcpy(Q + n, f + 3 * n, 2 * n); 146| 80| memcpy(R, f, 4 * n); 147| | 148| 720| for (i = 0; i < n; ++i) { ------------------ | Branch (148:17): [True: 640, False: 80] ------------------ 149| 640| Q[i] ^= f[2 * n + i]; 150| 640| R[n + i] ^= Q[i]; 151| 640| } 152| | 153| 80| radix(Q0, Q1, Q, m_f - 1); 154| 80| radix(R0, R1, R, m_f - 1); 155| | 156| 80| memcpy(f0, R0, 2 * n); 157| 80| memcpy(f0 + n, Q0, 2 * n); 158| 80| memcpy(f1, R1, 2 * n); 159| 80| memcpy(f1 + n, Q1, 2 * n); 160| 80|} fft.c:fft_rec: 174| 2.55k|static void fft_rec(uint16_t *w, uint16_t *f, size_t f_coeffs, uint8_t m, uint32_t m_f, const uint16_t *betas) { 175| 2.55k| uint16_t f0[1 << (PARAM_FFT - 2)] = {0}; 176| 2.55k| uint16_t f1[1 << (PARAM_FFT - 2)] = {0}; 177| 2.55k| uint16_t gammas[PARAM_M - 2] = {0}; 178| 2.55k| uint16_t deltas[PARAM_M - 2] = {0}; 179| 2.55k| uint16_t gammas_sums[1 << (PARAM_M - 2)] = {0}; 180| 2.55k| uint16_t u[1 << (PARAM_M - 2)] = {0}; 181| 2.55k| uint16_t v[1 << (PARAM_M - 2)] = {0}; 182| 2.55k| uint16_t tmp[PARAM_M - (PARAM_FFT - 1)] = {0}; 183| | 184| 2.55k| uint16_t beta_m_pow; 185| 2.55k| size_t i, j, k; 186| 2.55k| size_t x; 187| | 188| | // Step 1 189| 2.55k| if (m_f == 1) { ------------------ | Branch (189:9): [True: 1.20k, False: 1.35k] ------------------ 190| 6.33k| for (i = 0; i < m; ++i) { ------------------ | Branch (190:21): [True: 5.12k, False: 1.20k] ------------------ 191| 5.12k| tmp[i] = gf_mul(betas[i], f[1]); ------------------ | | 51| 5.12k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.12k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.12k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.12k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 5.12k| } 193| | 194| 1.20k| w[0] = f[0]; 195| 1.20k| x = 1; 196| 6.33k| for (j = 0; j < m; ++j) { ------------------ | Branch (196:21): [True: 5.12k, False: 1.20k] ------------------ 197| 28.1k| for (k = 0; k < x; ++k) { ------------------ | Branch (197:25): [True: 23.0k, False: 5.12k] ------------------ 198| 23.0k| w[x + k] = w[k] ^ tmp[j]; 199| 23.0k| } 200| 5.12k| x <<= 1; 201| 5.12k| } 202| | 203| 1.20k| return; 204| 1.20k| } 205| | 206| | // Step 2: compute g 207| 1.35k| if (betas[m - 1] != 1) { ------------------ | Branch (207:9): [True: 1.35k, False: 0] ------------------ 208| 1.35k| beta_m_pow = 1; 209| 1.35k| x = 1; 210| 1.35k| x <<= m_f; 211| 8.92k| for (i = 1; i < x; ++i) { ------------------ | Branch (211:21): [True: 7.57k, False: 1.35k] ------------------ 212| 7.57k| beta_m_pow = gf_mul(beta_m_pow, betas[m - 1]); ------------------ | | 51| 7.57k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.57k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.57k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.57k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 213| 7.57k| f[i] = gf_mul(beta_m_pow, f[i]); ------------------ | | 51| 7.57k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.57k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.57k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.57k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 214| 7.57k| } 215| 1.35k| } 216| | 217| | // Step 3 218| 1.35k| radix(f0, f1, f, m_f); 219| | 220| | // Step 4: compute gammas and deltas 221| 7.72k| for (i = 0; i + 1 < m; ++i) { ------------------ | Branch (221:17): [True: 6.36k, False: 1.35k] ------------------ 222| 6.36k| gammas[i] = gf_mul(betas[i], gf_inverse(betas[m - 1])); ------------------ | | 51| 6.36k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 6.36k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 6.36k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 6.36k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ gammas[i] = gf_mul(betas[i], gf_inverse(betas[m - 1])); ------------------ | | 53| 6.36k|#define gf_inverse PQCHQC_NAMESPACE(gf_inverse) | | ------------------ | | | | 17| 6.36k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 6.36k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 6.36k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 223| 6.36k| deltas[i] = gf_square(gammas[i]) ^ gammas[i]; ------------------ | | 52| 6.36k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 6.36k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 6.36k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 6.36k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 224| 6.36k| } 225| | 226| | // Compute gammas sums 227| 1.35k| compute_subset_sums(gammas_sums, gammas, m - 1); 228| | 229| | // Step 5 230| 1.35k| fft_rec(u, f0, (f_coeffs + 1) / 2, m - 1, m_f - 1, deltas); 231| | 232| 1.35k| k = 1; 233| 1.35k| k <<= ((m - 1) & 0xf); // &0xf is to let the compiler know that m-1 is small. 234| 1.35k| if (f_coeffs <= 3) { // 3-coefficient polynomial f case: f1 is constant ------------------ | Branch (234:9): [True: 388, False: 966] ------------------ 235| 388| w[0] = u[0]; 236| 388| w[k] = u[0] ^ f1[0]; 237| 6.20k| for (i = 1; i < k; ++i) { ------------------ | Branch (237:21): [True: 5.82k, False: 388] ------------------ 238| 5.82k| w[i] = u[i] ^ gf_mul(gammas_sums[i], f1[0]); ------------------ | | 51| 5.82k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.82k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.82k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.82k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 239| 5.82k| w[k + i] = w[i] ^ f1[0]; 240| 5.82k| } 241| 966| } else { 242| 966| fft_rec(v, f1, f_coeffs / 2, m - 1, m_f - 1, deltas); 243| | 244| | // Step 6 245| 966| memcpy(w + k, v, 2 * k); 246| 966| w[0] = u[0]; 247| 966| w[k] ^= u[0]; 248| 34.4k| for (i = 1; i < k; ++i) { ------------------ | Branch (248:21): [True: 33.5k, False: 966] ------------------ 249| 33.5k| w[i] = u[i] ^ gf_mul(gammas_sums[i], v[i]); ------------------ | | 51| 33.5k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 33.5k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 33.5k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 33.5k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 250| 33.5k| w[k + i] ^= w[i]; 251| 33.5k| } 252| 966| } 253| 1.35k|} PQCHQC_HQC1_C_gf_mul: 153| 194k|uint16_t gf_mul(uint16_t a, uint16_t b) { 154| 194k| uint8_t c[2] = {0}; 155| 194k| gf_carryless_mul(c, (uint8_t)a, (uint8_t)b); 156| 194k| uint16_t tmp = (uint16_t)(c[0] ^ (c[1] << 8)); 157| 194k| return gf_reduce(tmp); 158| 194k|} PQCHQC_HQC1_C_gf_square: 165| 23.0k|uint16_t gf_square(uint16_t a) { 166| 23.0k| uint32_t b = a; 167| 23.0k| uint32_t s = b & 1; 168| 184k| for (size_t i = 1; i < PARAM_M; ++i) { ------------------ | | 41| 184k|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (168:24): [True: 161k, False: 23.0k] ------------------ 169| 161k| b <<= 1; 170| 161k| s ^= b & (1 << 2 * i); 171| 161k| } 172| | 173| 23.0k| return gf_reduce(s); 174| 23.0k|} PQCHQC_HQC1_C_gf_inverse: 182| 3.58k|uint16_t gf_inverse(uint16_t a) { 183| 3.58k| uint16_t inv = a; 184| 3.58k| uint16_t tmp1, tmp2; 185| | 186| 3.58k| inv = gf_square(a); /* a^2 */ ------------------ | | 52| 3.58k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.58k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.58k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.58k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 187| 3.58k| tmp1 = gf_mul(inv, a); /* a^3 */ ------------------ | | 51| 3.58k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 3.58k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.58k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.58k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 188| 3.58k| inv = gf_square(inv); /* a^4 */ ------------------ | | 52| 3.58k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.58k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.58k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.58k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 189| 3.58k| tmp2 = gf_mul(inv, tmp1); /* a^7 */ ------------------ | | 51| 3.58k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 3.58k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.58k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.58k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| 3.58k| tmp1 = gf_mul(inv, tmp2); /* a^11 */ ------------------ | | 51| 3.58k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 3.58k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.58k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.58k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 3.58k| inv = gf_mul(tmp1, inv); /* a^15 */ ------------------ | | 51| 3.58k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 3.58k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.58k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.58k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 3.58k| inv = gf_square(inv); /* a^30 */ ------------------ | | 52| 3.58k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.58k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.58k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.58k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| 3.58k| inv = gf_square(inv); /* a^60 */ ------------------ | | 52| 3.58k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.58k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.58k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.58k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 194| 3.58k| inv = gf_square(inv); /* a^120 */ ------------------ | | 52| 3.58k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.58k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.58k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.58k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 195| 3.58k| inv = gf_mul(inv, tmp2); /* a^127 */ ------------------ | | 51| 3.58k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 3.58k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.58k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.58k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 3.58k| inv = gf_square(inv); /* a^254 */ ------------------ | | 52| 3.58k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.58k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.58k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.58k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 3.58k| return inv; 198| 3.58k|} gf.c:gf_carryless_mul: 109| 1.15M|static void gf_carryless_mul(uint8_t *c, uint8_t a, uint8_t b) { 110| 1.15M| uint16_t h = 0, l = 0, g, u[4]; 111| 1.15M| u[0] = 0; 112| 1.15M| u[1] = b & ((1UL << 7) - 1UL); 113| 1.15M| u[2] = u[1] << 1; 114| 1.15M| u[3] = u[2] ^ u[1]; 115| | 116| 1.15M| g = 0; 117| 1.15M| uint16_t tmp1 = a & 3; 118| | 119| 5.79M| for (int i = 0; i < 4; i++) { ------------------ | Branch (119:21): [True: 4.63M, False: 1.15M] ------------------ 120| 4.63M| uint32_t tmp2 = tmp1 - i; 121| 4.63M| g ^= (u[i] & -(1 - ((tmp2 | -tmp2) >> 31))); 122| 4.63M| } 123| | 124| 1.15M| l = g; 125| 1.15M| h = 0; 126| | 127| 4.63M| for (uint8_t i = 2; i < 8; i += 2) { ------------------ | Branch (127:25): [True: 3.47M, False: 1.15M] ------------------ 128| 3.47M| g = 0; 129| 3.47M| uint16_t tmp3 = (a >> i) & 3; 130| 17.3M| for (int j = 0; j < 4; ++j) { ------------------ | Branch (130:25): [True: 13.9M, False: 3.47M] ------------------ 131| 13.9M| uint32_t tmp2 = tmp3 - j; 132| 13.9M| g ^= (u[j] & -(1 - ((tmp2 | -tmp2) >> 31))); 133| 13.9M| } 134| | 135| 3.47M| l ^= g << i; 136| 3.47M| h ^= g >> (8 - i); 137| 3.47M| } 138| | 139| 1.15M| uint16_t mask = (-((b >> 7) & 1)); 140| 1.15M| l ^= ((a << 7) & mask); 141| 1.15M| h ^= ((a >> (1)) & mask); 142| | 143| 1.15M| c[0] = l; 144| 1.15M| c[1] = h; 145| 1.15M|} gf.c:gf_reduce: 76| 1.26M|uint16_t gf_reduce(uint16_t x) { 77| 1.26M| uint64_t mod; 78| 1.26M| const int reduction_steps = 2; // For deg(x) = 2 * (8 - 1) = 14, reduce twice to bring degree < 8 79| 1.26M| const size_t gf_reduction_tap_count = 3; // Number of feedback positions 80| | 81| 3.78M| for (int i = 0; i < reduction_steps; ++i) { ------------------ | Branch (81:21): [True: 2.52M, False: 1.26M] ------------------ 82| 2.52M| mod = x >> PARAM_M; // Extract upper bits ------------------ | | 41| 2.52M|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 83| 2.52M| x &= (1 << PARAM_M) - 1; // Keep lower bits ------------------ | | 41| 2.52M|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 84| 2.52M| x ^= mod; // Pre-XOR with no shift 85| | 86| 2.52M| uint16_t z1 = 0; 87| 10.1M| for (size_t j = gf_reduction_tap_count; j; --j) { ------------------ | Branch (87:49): [True: 7.57M, False: 2.52M] ------------------ 88| 7.57M| uint16_t z2 = gf_reduction_taps[j - 1]; 89| 7.57M| uint16_t dist = z2 - z1; 90| 7.57M| mod <<= dist; 91| 7.57M| x ^= mod; 92| 7.57M| z1 = z2; 93| 7.57M| } 94| 2.52M| } 95| | 96| 1.26M| return x; 97| 1.26M|} PQCHQC_HQC1_C_vect_mul: 151| 234|void vect_mul(uint64_t *o, const uint64_t *a1, const uint64_t *a2) { 152| 234| uint64_t unreduced[2 * VEC_N_SIZE_64]; 153| 234| uint64_t tmp_buffer[TMP_BUFFER_WORDS]; 154| | 155| | /* multiply via Karatsuba into unreduced */ 156| 234| karatsuba_mul(unreduced, a1, a2, VEC_N_SIZE_64, tmp_buffer); ------------------ | | 36| 234|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 234|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 234] | | | | ------------------ | | ------------------ ------------------ 157| | 158| | /* reduce modulo X^n - 1 */ 159| 234| reduce(o, unreduced); 160| 234|} gf2x.c:karatsuba_mul: 74| 609k|static void karatsuba_mul(uint64_t *r, const uint64_t *a, const uint64_t *b, size_t n, uint64_t *tmp_buffer) { 75| 609k| if (n <= KARATSUBA_THRESHOLD) { ------------------ | | 22| 609k|#define KARATSUBA_THRESHOLD 16 ------------------ | Branch (75:9): [True: 406k, False: 203k] ------------------ 76| 406k| schoolbook_mul(r, a, b, n); 77| 406k| return; 78| 406k| } 79| | 80| 203k| size_t m = n >> 1; 81| 203k| size_t n0 = m; 82| 203k| size_t n1 = n - m; 83| | 84| | /* take successive chunks of tmp_buffer for each intermediate result */ 85| 203k| uint64_t *z0 = tmp_buffer; /* low-half product, size 2*n words */ 86| 203k| uint64_t *z2 = z0 + 2 * n; /* high-half product, size 2*n words */ 87| 203k| uint64_t *zmid = z2 + 2 * n; /* middle product, size 2*n words */ 88| | 89| | /* ta and tb hold the sums of low and high halves: */ 90| | /* ta[i] = a0[i] XOR a1[i], tb[i] = b0[i] XOR b1[i] for i < n1 */ 91| 203k| uint64_t *ta = zmid + 2 * n; 92| 203k| uint64_t *tb = ta + n; 93| | 94| | /* buffer for child recursions */ 95| 203k| uint64_t *child_buffer = tmp_buffer + 8 * n; 96| | 97| | /* 1) low * low */ 98| 203k| karatsuba_mul(z0, a, b, n0, child_buffer); 99| | 100| | /* 2) high * high */ 101| 203k| karatsuba_mul(z2, a + m, b + m, n1, child_buffer); 102| | 103| | /* 3) (a0+a1)*(b0+b1) */ 104| 4.38M| for (size_t i = 0; i < n1; i++) { ------------------ | Branch (104:24): [True: 4.18M, False: 203k] ------------------ 105| 4.18M| uint64_t loa = (i < n0 ? a[i] : 0); ------------------ | Branch (105:25): [True: 4.09M, False: 89.5k] ------------------ 106| 4.18M| uint64_t lob = (i < n0 ? b[i] : 0); ------------------ | Branch (106:25): [True: 4.09M, False: 89.5k] ------------------ 107| 4.18M| ta[i] = loa ^ a[m + i]; 108| 4.18M| tb[i] = lob ^ b[m + i]; 109| 4.18M| } 110| 203k| karatsuba_mul(zmid, ta, tb, n1, child_buffer); 111| | 112| | /* 4) assemble into r */ 113| 203k| memset(r, 0, 2 * n * sizeof(uint64_t)); 114| 8.38M| for (size_t i = 0; i < 2 * n0; i++) r[i] ^= z0[i]; ------------------ | Branch (114:24): [True: 8.18M, False: 203k] ------------------ 115| 8.56M| for (size_t i = 0; i < 2 * n1; i++) r[2 * m + i] ^= z2[i]; ------------------ | Branch (115:24): [True: 8.36M, False: 203k] ------------------ 116| 8.56M| for (size_t i = 0; i < 2 * n1; i++) { ------------------ | Branch (116:24): [True: 8.36M, False: 203k] ------------------ 117| 8.36M| uint64_t z0i = (i < 2 * n0 ? z0[i] : 0); ------------------ | Branch (117:25): [True: 8.18M, False: 179k] ------------------ 118| 8.36M| uint64_t z2i = (i < 2 * n1 ? z2[i] : 0); ------------------ | Branch (118:25): [True: 8.36M, False: 0] ------------------ 119| 8.36M| uint64_t mid = zmid[i] ^ z0i ^ z2i; 120| 8.36M| r[m + i] ^= mid; 121| 8.36M| } 122| 203k|} gf2x.c:schoolbook_mul: 39| 406k|static void schoolbook_mul(uint64_t *r, const uint64_t *a, const uint64_t *b, size_t n) { 40| 406k| memset(r, 0, 2 * n * sizeof(uint64_t)); 41| 5.00M| for (size_t i = 0; i < n; i++) { ------------------ | Branch (41:24): [True: 4.60M, False: 406k] ------------------ 42| 4.60M| uint64_t ai = a[i]; 43| 299M| for (int bit = 0; bit < 64; bit++) { ------------------ | Branch (43:27): [True: 294M, False: 4.60M] ------------------ 44| 294M| uint64_t mask = -((ai >> bit) & 1ULL); 45| 294M| size_t base = i; 46| 294M| int sh = bit; 47| 294M| int inv = 64 - sh; 48| 294M| if (sh == 0) { ------------------ | Branch (48:17): [True: 4.60M, False: 289M] ------------------ 49| 59.5M| for (size_t j = 0; j < n; j++) { ------------------ | Branch (49:36): [True: 54.9M, False: 4.60M] ------------------ 50| 54.9M| r[base + j] ^= b[j] & mask; 51| 54.9M| } 52| 289M| } else { 53| 3.75G| for (size_t j = 0; j < n; j++) { ------------------ | Branch (53:36): [True: 3.46G, False: 289M] ------------------ 54| 3.46G| r[base + j] ^= (b[j] << sh) & mask; 55| 3.46G| r[base + j + 1] ^= (b[j] >> inv) & mask; 56| 3.46G| } 57| 289M| } 58| 294M| } 59| 4.60M| } 60| 406k|} gf2x.c:reduce: 133| 714|static void reduce(uint64_t *o, const uint64_t *a) { 134| 420k| for (size_t i = 0; i < VEC_N_SIZE_64; i++) { ------------------ | | 36| 420k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 420k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 420k] | | | | ------------------ | | ------------------ ------------------ | Branch (134:24): [True: 419k, False: 714] ------------------ 135| 419k| uint64_t r = a[i + VEC_N_SIZE_64 - 1] >> (PARAM_N & 0x3F); ------------------ | | 36| 419k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 419k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 419k] | | | | ------------------ | | ------------------ ------------------ uint64_t r = a[i + VEC_N_SIZE_64 - 1] >> (PARAM_N & 0x3F); ------------------ | | 15| 419k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 136| 419k| uint64_t carry = a[i + VEC_N_SIZE_64] << (64 - (PARAM_N & 0x3F)); ------------------ | | 36| 419k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 419k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 419k] | | | | ------------------ | | ------------------ ------------------ uint64_t carry = a[i + VEC_N_SIZE_64] << (64 - (PARAM_N & 0x3F)); ------------------ | | 15| 419k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 137| 419k| o[i] = a[i] ^ r ^ carry; 138| 419k| } 139| 714| o[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 36| 714|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 714|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 714] | | | | ------------------ | | ------------------ ------------------ o[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 13| 714|#define BITMASK(a, size) ((((uint64_t) 1UL) << (a % size)) - 1) /*!< Create a mask*/ ------------------ 140| 714|} PQCHQC_HQC1_C_hqc_pke_keygen: 30| 39|void hqc_pke_keygen(uint8_t *ek_pke, uint8_t *dk_pke, uint8_t *seed) { 31| 39| uint8_t keypair_seed[2 * SEED_BYTES] = {0}; 32| 39| uint8_t *seed_dk = keypair_seed; 33| 39| uint8_t *seed_ek = keypair_seed + SEED_BYTES; ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 34| 39| shake256_xof_ctx dk_xof_ctx = {0}; 35| 39| shake256_xof_ctx ek_xof_ctx = {0}; 36| | 37| 39| uint64_t x[VEC_N_SIZE_64] = {0}; 38| 39| uint64_t y[VEC_N_SIZE_64] = {0}; 39| 39| uint64_t h[VEC_N_SIZE_64] = {0}; 40| 39| uint64_t s[VEC_N_SIZE_64] = {0}; 41| | 42| | // Derive keypair seeds 43| 39| hash_i(keypair_seed, seed); ------------------ | | 79| 39|#define hash_i PQCHQC_NAMESPACE(hash_i) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| | 45| | // Compute decryption key 46| 39| xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 74| 39|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 47| 39| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 39|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 39|#define PARAM_OMEGA 66 ///< Define the parameter omega of the scheme ------------------ 48| 39| vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 16| 39|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 19| 39|#define PARAM_OMEGA 66 ///< Define the parameter omega of the scheme ------------------ 49| 39| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 39|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | // Compute encryption key 52| 39| xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 74| 39|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 53| 39| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 39|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 39| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 39|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 55| 39| vect_mul(s, y, h); ------------------ | | 12| 39|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 56| 39| vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 19| 39|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 36| 39|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 39] | | | | ------------------ | | ------------------ ------------------ 57| | 58| | // Parse encryption key to string 59| 39| memcpy(ek_pke, seed_ek, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 60| 39| memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 31| 39|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 39] | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Parse decryption key to string 63| 39| memcpy(dk_pke, seed_dk, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 64| | 65| |#ifdef VERBOSE 66| | printf("\n\nseed_dk: "); 67| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_dk[i]); 68| | printf("\n\nseed_ek: "); 69| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_ek[i]); 70| | printf("\n\ny: "); 71| | vect_print(y, VEC_N_SIZE_BYTES); 72| | printf("\n\nx: "); 73| | vect_print(x, VEC_N_SIZE_BYTES); 74| | printf("\n\nh: "); 75| | vect_print(h, VEC_N_SIZE_BYTES); 76| | printf("\n\ns: "); 77| | vect_print(s, VEC_N_SIZE_BYTES); 78| |#endif 79| | 80| | // Zeroize sensitive data 81| 39| memset_zero(keypair_seed, sizeof keypair_seed); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 39| memset_zero(x, sizeof x); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 39| memset_zero(y, sizeof y); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 39| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 39|} PQCHQC_HQC1_C_hqc_pke_encrypt: 99| 78|void hqc_pke_encrypt(ciphertext_pke_t *c_pke, const uint8_t *ek_pke, const uint64_t *m, const uint8_t *theta) { 100| 78| shake256_xof_ctx theta_xof_ctx = {0}; 101| 78| uint64_t h[VEC_N_SIZE_64] = {0}; 102| 78| uint64_t s[VEC_N_SIZE_64] = {0}; 103| 78| uint64_t r1[VEC_N_SIZE_64] = {0}; 104| 78| uint64_t r2[VEC_N_SIZE_64] = {0}; 105| 78| uint64_t e[VEC_N_SIZE_64] = {0}; 106| 78| uint64_t tmp[VEC_N_SIZE_64] = {0}; 107| | 108| | // Initialize Xof using theta 109| 78| xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 74| 78|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 52| 78|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 110| | 111| | // Retrieve h and s from public key 112| 78| hqc_ek_pke_from_string(h, s, ek_pke); ------------------ | | 15| 78|#define hqc_ek_pke_from_string PQCHQC_NAMESPACE(hqc_ek_pke_from_string) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| | 114| | // Generate re, e and r1 115| 78| vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 17| 78|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 21| 78|#define PARAM_OMEGA_R 75 ///< Define the parameter omega_r of the scheme ------------------ 116| 78| vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 17| 78|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 20| 78|#define PARAM_OMEGA_E 75 ///< Define the parameter omega_e of the scheme ------------------ 117| 78| vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 17| 78|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 21| 78|#define PARAM_OMEGA_R 75 ///< Define the parameter omega_r of the scheme ------------------ 118| 78| xof_ctx_release(&theta_xof_ctx); ------------------ | | 76| 78|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 119| | 120| | // Compute u = r1 + r2.h 121| 78| vect_mul(c_pke->u, r2, h); ------------------ | | 12| 78|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 78| vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 19| 78|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 36| 78|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 78|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 78] | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Compute v = C.encode(m) 125| 78| code_encode(c_pke->v, m); ------------------ | | 14| 78|#define code_encode PQCHQC_NAMESPACE(code_encode) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 126| | 127| | // Compute v = C.encode(m) + Truncate(s.r2 + e) 128| 78| vect_mul(tmp, r2, s); ------------------ | | 12| 78|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 129| 78| vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 19| 78|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 36| 78|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 78|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 78] | | | | ------------------ | | ------------------ ------------------ 130| 78| vect_truncate(tmp); ------------------ | | 21| 78|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 131| 78| vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 19| 78|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 38| 78|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 78|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 78, Folded] | | | | ------------------ | | ------------------ ------------------ 132| | 133| |#ifdef VERBOSE 134| | printf("\n\nh: "); 135| | vect_print(h, VEC_N_SIZE_BYTES); 136| | printf("\n\ns: "); 137| | vect_print(s, VEC_N_SIZE_BYTES); 138| | printf("\n\nr1: "); 139| | vect_print(r1, VEC_N_SIZE_BYTES); 140| | printf("\n\nr2: "); 141| | vect_print(r2, VEC_N_SIZE_BYTES); 142| | printf("\n\ne: "); 143| | vect_print(e, VEC_N_SIZE_BYTES); 144| | printf("\n\nTruncate(s.r2 + e): "); 145| | vect_print(tmp, VEC_N1N2_SIZE_BYTES); 146| | printf("\n\nc_pke->u: "); 147| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 148| | printf("\n\nc_pke->v: "); 149| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 150| |#endif 151| | 152| | // Zeroize sensitive data 153| 78| memset_zero(r1, sizeof r1); ------------------ | | 22| 78|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 78|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 154| 78| memset_zero(r2, sizeof r2); ------------------ | | 22| 78|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 78|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 78| memset_zero(e, sizeof e); ------------------ | | 22| 78|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 78|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 78| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 78|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 78|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 78| memset_zero(&theta_xof_ctx, sizeof theta_xof_ctx); ------------------ | | 22| 78|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 78|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 78|} PQCHQC_HQC1_C_hqc_pke_decrypt: 173| 39|uint8_t hqc_pke_decrypt(uint64_t *m, const uint8_t *dk_pke, const ciphertext_pke_t *c_pke) { 174| 39| uint64_t y[VEC_N_SIZE_64] = {0}; 175| 39| uint64_t tmp1[VEC_N_SIZE_64] = {0}; 176| 39| uint64_t tmp2[VEC_N_SIZE_64] = {0}; 177| | 178| | // Parse decryption key dk_pke 179| 39| hqc_dk_pke_from_string(y, dk_pke); ------------------ | | 14| 39|#define hqc_dk_pke_from_string PQCHQC_NAMESPACE(hqc_dk_pke_from_string) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| | 181| | // Compute u.y 182| 39| vect_mul(tmp1, y, c_pke->u); ------------------ | | 12| 39|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 183| | // Truncate(u.y) 184| 39| vect_truncate(tmp1); ------------------ | | 21| 39|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 185| | // Compute v - Truncate(u.y) 186| 39| vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 19| 39|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 38| 39|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 39, Folded] | | | | ------------------ | | ------------------ ------------------ 187| | 188| |#ifdef VERBOSE 189| | printf("\n\nc_pke.u: "); 190| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 191| | printf("\n\nc_pke.v: "); 192| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 193| | printf("\n\ny: "); 194| | vect_print(y, VEC_N_SIZE_BYTES); 195| | printf("\n\nTruncate(u.y): "); 196| | vect_print(tmp1, VEC_N1N2_SIZE_BYTES); 197| | printf("\n\nv - Truncate(u.y): "); 198| | vect_print(tmp2, VEC_N1N2_SIZE_BYTES); 199| |#endif 200| | 201| | // Compute plaintext m 202| 39| code_decode(m, tmp2); ------------------ | | 15| 39|#define code_decode PQCHQC_NAMESPACE(code_decode) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 203| | 204| | // Zeroize sensitive data 205| 39| memset_zero(y, sizeof y); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 206| 39| memset_zero(tmp1, sizeof tmp1); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 207| 39| memset_zero(tmp2, sizeof tmp2); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 208| | 209| 39| return 0; 210| 39|} PQCHQC_HQC1_C_crypto_kem_keypair: 39| 39|int crypto_kem_keypair(uint8_t *ek_kem, uint8_t *dk_kem) { 40| |#ifdef VERBOSE 41| | printf("\n\n\n### KEYGEN ###"); 42| |#endif 43| 39| uint8_t seed_kem[SEED_BYTES] = {0}; 44| 39| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 45| 39| uint8_t seed_pke[SEED_BYTES] = {0}; 46| 39| shake256_xof_ctx ctx_kem; 47| | 48| 39| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 49| 39| uint8_t dk_pke[SEED_BYTES] = {0}; 50| | 51| 39| prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 73| 39|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 52| | 53| | // Compute seed_pke and randomness sigma 54| 39| xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 74| 39|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 55| 39| xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 75| 39|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 56| 39| xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 75| 39|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 39|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 57| 39| xof_ctx_release(&ctx_kem); ------------------ | | 76| 39|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| | 59| | // Compute HQC-PKE keypair 60| 39| hqc_pke_keygen(ek_pke, dk_pke, seed_pke); ------------------ | | 14| 39|#define hqc_pke_keygen PQCHQC_NAMESPACE(hqc_pke_keygen) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Compute HQC-KEM keypair 63| 39| memcpy(ek_kem, ek_pke, PUBLIC_KEY_BYTES); ------------------ | | 27| 39|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 39|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ 64| 39| memcpy(dk_kem, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 39|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 39|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ 65| 39| memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 27| 39|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 39|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 66| 39| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 27| 39|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 39|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 39|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 67| 39| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 27| 39|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 39|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 23| 39|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 68| | 69| |#ifdef VERBOSE 70| | printf("\n\nseed_kem: "); 71| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_kem[i]); 72| | printf("\n\nseed_pke: "); 73| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_pke[i]); 74| | printf("\n\nsigma: "); 75| | for (int i = 0; i < PARAM_SECURITY_BYTES; ++i) printf("%02x", sigma[i]); 76| |#endif 77| | 78| | // Zeroize sensitive data 79| 39| memset_zero(seed_kem, sizeof seed_kem); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 80| 39| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 81| 39| memset_zero(seed_pke, sizeof seed_pke); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 39| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| | 84| 39| return 0; 85| 39|} PQCHQC_HQC1_C_crypto_kem_enc: 105| 39|int crypto_kem_enc(uint8_t *c_kem, uint8_t *K, const uint8_t *ek_kem) { 106| |#ifdef VERBOSE 107| | printf("\n\n\n\n### ENCAPS ###"); 108| |#endif 109| | 110| 39| uint8_t m[PARAM_SECURITY_BYTES] = {0}; 111| 39| uint8_t K_theta[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 112| 39| uint8_t theta[SEED_BYTES] = {0}; 113| 39| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 114| 39| ciphertext_kem_t c_kem_t = {0}; 115| | 116| | // Sample message m and salt 117| 39| prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 73| 39|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 23| 39|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 118| 39| prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 73| 39|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 39|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 119| | 120| | // Compute shared key K and ciphertext c_kem 121| 39| hash_h(hash_ek_kem, ek_kem); ------------------ | | 78| 39|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 39| hash_g(K_theta, hash_ek_kem, m, c_kem_t.salt); ------------------ | | 77| 39|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| 39| memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 124| 39| hqc_pke_encrypt(&c_kem_t.c_pke, ek_kem, (uint64_t *)m, theta); ------------------ | | 15| 39|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 39| hqc_c_kem_to_string(c_kem, &c_kem_t); ------------------ | | 16| 39|#define hqc_c_kem_to_string PQCHQC_NAMESPACE(hqc_c_kem_to_string) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 127| 39| memcpy(K, K_theta, SHARED_SECRET_BYTES); ------------------ | | 28| 39|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 39|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 128| | 129| |#ifdef VERBOSE 130| | printf("\n\nek_kem: "); 131| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_kem[i]); 132| | printf("\n\nm: "); 133| | vect_print((uint64_t *)m, PARAM_SECURITY_BYTES); 134| | printf("\n\nsalt: "); 135| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_t.salt[i]); 136| | printf("\n\nH(ek_kem): "); 137| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 138| | printf("\n\ntheta: "); 139| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta[i]); 140| | printf("\n\nc_kem: "); 141| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 142| | printf("\n\nK: "); 143| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K[i]); 144| |#endif 145| | 146| | // Zeroize sensitive data 147| 39| memset_zero(m, sizeof m); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 39| memset_zero(K_theta, sizeof K_theta); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 39| memset_zero(theta, sizeof theta); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| | 151| 39| return 0; 152| 39|} PQCHQC_HQC1_C_crypto_kem_dec: 166| 39|int crypto_kem_dec(uint8_t *K_prime, const uint8_t *c_kem, const uint8_t *dk_kem) { 167| |#ifdef VERBOSE 168| | printf("\n\n\n\n### DECAPS ###"); 169| |#endif 170| | 171| 39| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 172| 39| uint8_t dk_pke[SEED_BYTES] = {0}; 173| 39| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 174| 39| uint8_t m_prime[PARAM_SECURITY_BYTES] = {0}; 175| 39| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 176| 39| uint8_t K_theta_prime[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 177| 39| uint8_t K_bar[SHARED_SECRET_BYTES] = {0}; 178| 39| uint8_t theta_prime[SEED_BYTES] = {0}; 179| 39| ciphertext_kem_t c_kem_t = {0}; 180| 39| ciphertext_kem_t c_kem_prime_t = {0}; 181| 39| uint8_t result; 182| | 183| | // Parse decapsulation key dk_kem 184| 39| memcpy(ek_pke, dk_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 39|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 39|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ 185| 39| memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 27| 39|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 39|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 186| 39| memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 27| 39|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 39|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 23| 39|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 187| | 188| | // Parse ciphertext c_kem 189| 39| hqc_c_kem_from_string(&c_kem_t.c_pke, c_kem_t.salt, c_kem); ------------------ | | 17| 39|#define hqc_c_kem_from_string PQCHQC_NAMESPACE(hqc_c_kem_from_string) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| | 191| | // Compute message m_prime 192| 39| result = hqc_pke_decrypt((uint64_t *)m_prime, dk_pke, &c_kem_t.c_pke); ------------------ | | 16| 39|#define hqc_pke_decrypt PQCHQC_NAMESPACE(hqc_pke_decrypt) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| | 194| | // Compute shared key K_prime and ciphertext c_kem_prime 195| 39| hash_h(hash_ek_kem, ek_pke); ------------------ | | 78| 39|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 39| hash_g(K_theta_prime, hash_ek_kem, m_prime, c_kem_t.salt); ------------------ | | 77| 39|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 39| memcpy(K_prime, K_theta_prime, SHARED_SECRET_BYTES); ------------------ | | 28| 39|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 39|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 198| 39| memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 28| 39|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 39|#define CRYPTO_BYTES 32 | | ------------------ ------------------ memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 199| | 200| 39| hqc_pke_encrypt(&c_kem_prime_t.c_pke, ek_pke, (uint64_t *)m_prime, theta_prime); ------------------ | | 15| 39|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 201| 39| memcpy(c_kem_prime_t.salt, c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 39|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 202| | 203| | // Compute rejection key K_bar 204| 39| hash_j(K_bar, hash_ek_kem, sigma, &c_kem_t); ------------------ | | 80| 39|#define hash_j PQCHQC_NAMESPACE(hash_j) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 205| 39| result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 20| 39|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 39|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 39] | | | | ------------------ | | ------------------ ------------------ 206| 39| result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 20| 39|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 39|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 39, Folded] | | | | ------------------ | | ------------------ ------------------ 207| 39| result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 20| 39|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 53| 39|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 208| 39| result -= 1; 209| 1.28k| for (size_t i = 0; i < SHARED_SECRET_BYTES; ++i) { ------------------ | | 28| 1.28k|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 1.28k|#define CRYPTO_BYTES 32 | | ------------------ ------------------ | Branch (209:24): [True: 1.24k, False: 39] ------------------ 210| 1.24k| K_prime[i] = (K_prime[i] & result) ^ (K_bar[i] & ~result); 211| 1.24k| } 212| | 213| |#ifdef VERBOSE 214| | printf("\n\nek_pke: "); 215| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_pke[i]); 216| | printf("\n\ndk_pke: "); 217| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", dk_pke[i]); 218| | printf("\n\nc_kem: "); 219| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 220| | printf("\n\nm_prime: "); 221| | vect_print((uint64_t *)m_prime, PARAM_SECURITY_BYTES); 222| | printf("\n\nH(ek_kem): "); 223| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 224| | printf("\n\ntheta_prime: "); 225| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta_prime[i]); 226| | printf("\n\n\n# Checking Ciphertext - Begin #"); 227| | printf("\n\nc_kem_prime_t.c_pke.u: "); 228| | vect_print(c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); 229| | printf("\n\nc_kem_prime_t.c_pke.v: "); 230| | vect_print(c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); 231| | printf("\n\nsalt: "); 232| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_prime_t.salt[i]); 233| | printf("\n\n# Checking Ciphertext - End #\n"); 234| | printf("\n\nK_prime: "); 235| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K_prime[i]); 236| |#endif 237| | 238| | // Zeroize sensitive data 239| 39| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 240| 39| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| 39| memset_zero(m_prime, sizeof m_prime); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 242| 39| memset_zero(K_theta_prime, sizeof K_theta_prime); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 243| 39| memset_zero(K_bar, sizeof K_bar); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| 39| memset_zero(theta_prime, sizeof theta_prime); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 245| | 246| 39| return 0; 247| 39|} PQCHQC_HQC1_C_hqc_dk_pke_from_string: 19| 39|void hqc_dk_pke_from_string(uint64_t *y, const uint8_t *dk_pke) { 20| 39| shake256_xof_ctx dk_xof_ctx = {0}; 21| 39| xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 74| 39|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 22| 39| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 39|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 39|#define PARAM_OMEGA 66 ///< Define the parameter omega of the scheme ------------------ 23| 39| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 39|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 24| | 25| | // Zeroize sensitive data 26| 39| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 27| 39|} PQCHQC_HQC1_C_hqc_ek_pke_from_string: 36| 78|void hqc_ek_pke_from_string(uint64_t *h, uint64_t *s, const uint8_t *ek_pke) { 37| 78| shake256_xof_ctx ek_xof_ctx = {0}; 38| | 39| 78| xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 74| 78|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 52| 78|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 40| 78| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 78|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 78| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 78|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 78|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 42| | 43| 78| memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 52| 78|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 31| 78|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 78|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 78] | | | | ------------------ | | ------------------ ------------------ 44| 78|} PQCHQC_HQC1_C_hqc_c_kem_to_string: 52| 39|void hqc_c_kem_to_string(uint8_t *ct, const ciphertext_kem_t *c_kem) { 53| 39| memcpy(ct, c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 39|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 39] | | | | ------------------ | | ------------------ ------------------ 54| 39| memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 39|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 39] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 39|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 39, Folded] | | | | ------------------ | | ------------------ ------------------ 55| 39| memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 31| 39|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 39] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 34| 39|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 39, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 53| 39|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 56| 39|} PQCHQC_HQC1_C_hqc_c_kem_from_string: 65| 39|void hqc_c_kem_from_string(ciphertext_pke_t *c_pke, uint8_t *salt, const uint8_t *ct) { 66| 39| memcpy(c_pke->u, ct, VEC_N_SIZE_BYTES); ------------------ | | 31| 39|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 39] | | | | ------------------ | | ------------------ ------------------ 67| 39| memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 39|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 39] | | | | ------------------ | | ------------------ ------------------ memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 39|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 39, Folded] | | | | ------------------ | | ------------------ ------------------ 68| 39| memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 31| 39|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 39] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 34| 39|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 39, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 53| 39|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 69| 39|} PQCHQC_HQC1_C_reed_muller_encode: 174| 78|void reed_muller_encode(uint64_t *cdw, const uint64_t *msg) { 175| 78| uint8_t *message_array = (uint8_t *)msg; 176| 78| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 177| 3.66k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 3.66k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 3.66k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) | | ------------------ ------------------ | Branch (177:24): [True: 3.58k, False: 78] ------------------ 178| | // fill entries i * MULTIPLICITY to (i+1) * MULTIPLICITY 179| 3.58k| int32_t pos = i * MULTIPLICITY; ------------------ | | 18| 3.58k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 3.58k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 3.58k, Folded] | | | | ------------------ | | ------------------ ------------------ 180| | // encode first word 181| 3.58k| encode(&codeArray[pos], message_array[i]); 182| | // copy to other identical codewords 183| 10.7k| for (size_t copy = 1; copy < MULTIPLICITY; copy++) { ------------------ | | 18| 10.7k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 10.7k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 10.7k, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (183:31): [True: 7.17k, False: 3.58k] ------------------ 184| 7.17k| memcpy(&codeArray[pos + copy], &codeArray[pos], sizeof(rm_codeword_t)); 185| 7.17k| } 186| 3.58k| } 187| 78|} PQCHQC_HQC1_C_reed_muller_decode: 198| 39|void reed_muller_decode(uint64_t *msg, const uint64_t *cdw) { 199| 39| uint8_t *message_array = (uint8_t *)msg; 200| 39| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 201| 39| rm_expanded_cdw expanded; 202| 1.83k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 1.83k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 1.83k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) | | ------------------ ------------------ | Branch (202:24): [True: 1.79k, False: 39] ------------------ 203| | // collect the codewords 204| 1.79k| expand_and_sum(&expanded, &codeArray[i * MULTIPLICITY]); ------------------ | | 18| 1.79k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 1.79k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 1.79k, Folded] | | | | ------------------ | | ------------------ ------------------ 205| | // apply hadamard transform 206| 1.79k| rm_expanded_cdw transform; 207| 1.79k| hadamard(&expanded, &transform); 208| | // fix the first entry to get the half Hadamard transform 209| 1.79k| transform[0] -= 64 * MULTIPLICITY; ------------------ | | 18| 1.79k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 1.79k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 1.79k, Folded] | | | | ------------------ | | ------------------ ------------------ 210| | // finish the decoding 211| 1.79k| message_array[i] = find_peaks(&transform); 212| 1.79k| } 213| 39|} reed_muller.c:encode: 59| 15.4k|static void encode(rm_codeword_t *word, int32_t message) { 60| 15.4k| int32_t first_word; 61| | 62| 15.4k| first_word = BIT0MASK(message >> 7); ------------------ | | 34| 15.4k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 63| | 64| 15.4k| first_word ^= BIT0MASK(message >> 0) & 0xaaaaaaaa; ------------------ | | 34| 15.4k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 65| 15.4k| first_word ^= BIT0MASK(message >> 1) & 0xcccccccc; ------------------ | | 34| 15.4k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 66| 15.4k| first_word ^= BIT0MASK(message >> 2) & 0xf0f0f0f0; ------------------ | | 34| 15.4k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 67| 15.4k| first_word ^= BIT0MASK(message >> 3) & 0xff00ff00; ------------------ | | 34| 15.4k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 68| 15.4k| first_word ^= BIT0MASK(message >> 4) & 0xffff0000; ------------------ | | 34| 15.4k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 69| | 70| 15.4k| word->u32[0] = first_word; 71| | 72| 15.4k| first_word ^= BIT0MASK(message >> 5); ------------------ | | 34| 15.4k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 73| 15.4k| word->u32[1] = first_word; 74| 15.4k| first_word ^= BIT0MASK(message >> 6); ------------------ | | 34| 15.4k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 75| 15.4k| word->u32[3] = first_word; 76| 15.4k| first_word ^= BIT0MASK(message >> 5); ------------------ | | 34| 15.4k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 77| 15.4k| word->u32[2] = first_word; 78| 15.4k| return; 79| 15.4k|} reed_muller.c:expand_and_sum: 121| 7.70k|static void expand_and_sum(rm_expanded_cdw *dest, rm_codeword_t src[]) { 122| | // start with the first copy 123| 38.5k| for (int32_t part = 0; part < 4; part++) { ------------------ | Branch (123:28): [True: 30.8k, False: 7.70k] ------------------ 124| 1.01M| for (int32_t bit = 0; bit < 32; bit++) { ------------------ | Branch (124:31): [True: 985k, False: 30.8k] ------------------ 125| 985k| (*dest)[part * 32 + bit] = src[0].u32[part] >> bit & 1; 126| 985k| } 127| 30.8k| } 128| | // sum the rest of the copies 129| 34.9k| for (int32_t copy = 1; copy < MULTIPLICITY; copy++) { ------------------ | | 18| 34.9k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 34.9k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 34.9k, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (129:28): [True: 27.2k, False: 7.70k] ------------------ 130| 136k| for (int32_t part = 0; part < 4; part++) { ------------------ | Branch (130:32): [True: 108k, False: 27.2k] ------------------ 131| 3.59M| for (int32_t bit = 0; bit < 32; bit++) { ------------------ | Branch (131:35): [True: 3.48M, False: 108k] ------------------ 132| 3.48M| (*dest)[part * 32 + bit] += src[copy].u32[part] >> bit & 1; 133| 3.48M| } 134| 108k| } 135| 27.2k| } 136| 7.70k|} reed_muller.c:hadamard: 90| 7.70k|static void hadamard(rm_expanded_cdw *src, rm_expanded_cdw *dst) { 91| | // the passes move data: 92| | // src -> dst -> src -> dst -> src -> dst -> src -> dst 93| | // using p1 and p2 alternately 94| 7.70k| rm_expanded_cdw *p1 = src; 95| 7.70k| rm_expanded_cdw *p2 = dst; 96| 61.6k| for (int32_t pass = 0; pass < 7; pass++) { ------------------ | Branch (96:28): [True: 53.9k, False: 7.70k] ------------------ 97| 3.50M| for (int32_t i = 0; i < 64; i++) { ------------------ | Branch (97:29): [True: 3.45M, False: 53.9k] ------------------ 98| 3.45M| (*p2)[i] = (*p1)[2 * i] + (*p1)[2 * i + 1]; 99| 3.45M| (*p2)[i + 64] = (*p1)[2 * i] - (*p1)[2 * i + 1]; 100| 3.45M| } 101| | // swap p1, p2 for next round 102| 53.9k| rm_expanded_cdw *p3 = p1; 103| 53.9k| p1 = p2; 104| 53.9k| p2 = p3; 105| 53.9k| } 106| 7.70k|} reed_muller.c:find_peaks: 147| 7.70k|static int32_t find_peaks(rm_expanded_cdw *transform) { 148| 7.70k| int32_t peak_abs_value = 0; 149| 7.70k| int32_t peak_value = 0; 150| 7.70k| int32_t peak_pos = 0; 151| 993k| for (int32_t i = 0; i < 128; i++) { ------------------ | Branch (151:25): [True: 985k, False: 7.70k] ------------------ 152| | // get absolute value 153| 985k| int32_t t = (*transform)[i]; 154| 985k| int32_t pos_mask = -(t > 0); 155| 985k| int32_t absolute = (pos_mask & t) | (~pos_mask & -t); 156| 985k| peak_value = absolute > peak_abs_value ? t : peak_value; ------------------ | Branch (156:22): [True: 38.0k, False: 947k] ------------------ 157| 985k| peak_pos = absolute > peak_abs_value ? i : peak_pos; ------------------ | Branch (157:20): [True: 38.0k, False: 947k] ------------------ 158| 985k| peak_abs_value = absolute > peak_abs_value ? absolute : peak_abs_value; ------------------ | Branch (158:26): [True: 38.0k, False: 947k] ------------------ 159| 985k| } 160| | // set bit 7 161| 7.70k| peak_pos |= 128 * (peak_value > 0); 162| 7.70k| return peak_pos; 163| 7.70k|} PQCHQC_HQC1_C_reed_solomon_encode: 84| 78|void reed_solomon_encode(uint64_t *cdw, const uint64_t *msg) { 85| 78| size_t i, j, k; 86| 78| uint8_t gate_value = 0; 87| | 88| 78| uint16_t tmp[PARAM_G] = {0}; 89| 78| uint16_t PARAM_RS_POLY[] = {RS_POLY_COEFS}; ------------------ | | 49| 78| 89, 69, 153, 116, 176, 117, 111, 75, 73, 233, 242, 233, 65, 210, 21, 139, 103, 173, 67, 118, \ | | 50| 78| 105, 210, 174, 110, 74, 69, 228, 82, 255, 181, 1 ///< Coefficients of the Reed–Solomon generator polynomial ------------------ 90| | 91| 78| uint8_t msg_bytes[PARAM_K] = {0}; 92| 78| uint8_t cdw_bytes[PARAM_N1] = {0}; 93| | 94| 78| memcpy(msg_bytes, msg, PARAM_K); ------------------ | | 44| 78|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ 95| | 96| 1.32k| for (i = 0; i < PARAM_K; ++i) { ------------------ | | 44| 1.32k|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ | Branch (96:17): [True: 1.24k, False: 78] ------------------ 97| 1.24k| gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 1.24k|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 16| 1.24k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 1.24k|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ 98| | 99| 39.9k| for (j = 0; j < PARAM_G; ++j) { ------------------ | | 45| 39.9k|#define PARAM_G 31 ///< Define the size of the generator polynomial of the Reed–Solomon code ------------------ | Branch (99:21): [True: 38.6k, False: 1.24k] ------------------ 100| 38.6k| tmp[j] = gf_mul(gate_value, PARAM_RS_POLY[j]); ------------------ | | 51| 38.6k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 38.6k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38.6k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38.6k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 101| 38.6k| } 102| | 103| 37.4k| for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 16| 1.24k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 44| 1.24k|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ | Branch (103:42): [True: 36.1k, False: 1.24k] ------------------ 104| 36.1k| cdw_bytes[k] = cdw_bytes[k - 1] ^ tmp[k]; 105| 36.1k| } 106| | 107| 1.24k| cdw_bytes[0] = tmp[0]; 108| 1.24k| } 109| | 110| 78| memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 16| 78|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 78|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 78|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ 111| 78| memcpy(cdw, cdw_bytes, PARAM_N1); ------------------ | | 16| 78|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ 112| 78|} PQCHQC_HQC1_C_reed_solomon_decode: 353| 39|void reed_solomon_decode(uint64_t *msg, uint64_t *cdw) { 354| 39| uint8_t cdw_bytes[PARAM_N1] = {0}; 355| 39| uint16_t syndromes[2 * PARAM_DELTA] = {0}; 356| 39| uint16_t sigma[1 << PARAM_FFT] = {0}; 357| 39| uint8_t error[1 << PARAM_M] = {0}; 358| 39| uint16_t z[PARAM_N1] = {0}; 359| 39| uint16_t error_values[PARAM_N1] = {0}; 360| 39| uint16_t deg; 361| | 362| | // Copy the vector in an array of bytes 363| 39| memcpy(cdw_bytes, cdw, PARAM_N1); ------------------ | | 16| 39|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ 364| | 365| | // Calculate the 2*PARAM_DELTA syndromes 366| 39| compute_syndromes(syndromes, cdw_bytes); 367| | 368| | // Compute the error locator polynomial sigma 369| | // Sigma's degree is at most PARAM_DELTA but the FFT requires the extra room 370| 39| deg = compute_elp(sigma, syndromes); 371| | 372| | // Compute the error polynomial error 373| 39| compute_roots(error, sigma); 374| | 375| | // Compute the polynomial z(x) 376| 39| compute_z_poly(z, sigma, deg, syndromes); 377| | 378| | // Compute the error values 379| 39| compute_error_values(error_values, z, error); 380| | 381| | // Correct the errors 382| 39| correct_errors(cdw_bytes, error_values); 383| | 384| | // Retrieve the message from the decoded codeword 385| 39| memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 45| 39|#define PARAM_G 31 ///< Define the size of the generator polynomial of the Reed–Solomon code ------------------ memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 44| 39|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ 386| | 387| |#ifdef VERBOSE 388| | printf("\n\nThe syndromes: "); 389| | for (size_t i = 0; i < 2 * PARAM_DELTA; ++i) { 390| | printf("%u ", syndromes[i]); 391| | } 392| | printf("\n\nThe error locator polynomial: sigma(x) = "); 393| | bool first_coeff = true; 394| | if (sigma[0]) { 395| | printf("%u", sigma[0]); 396| | first_coeff = false; 397| | } 398| | for (size_t i = 1; i < (1 << PARAM_FFT); ++i) { 399| | if (sigma[i] == 0) 400| | continue; 401| | if (!first_coeff) 402| | printf(" + "); 403| | first_coeff = false; 404| | if (sigma[i] != 1) 405| | printf("%u ", sigma[i]); 406| | if (i == 1) 407| | printf("x"); 408| | else 409| | printf("x^%zu", i); 410| | } 411| | if (first_coeff) 412| | printf("0"); 413| | 414| | printf("\n\nThe polynomial: z(x) = "); 415| | bool first_coeff_1 = true; 416| | if (z[0]) { 417| | printf("%u", z[0]); 418| | first_coeff_1 = false; 419| | } 420| | for (size_t i = 1; i < (PARAM_DELTA + 1); ++i) { 421| | if (z[i] == 0) 422| | continue; 423| | if (!first_coeff_1) 424| | printf(" + "); 425| | first_coeff_1 = false; 426| | if (z[i] != 1) 427| | printf("%u ", z[i]); 428| | if (i == 1) 429| | printf("x"); 430| | else 431| | printf("x^%zu", i); 432| | } 433| | if (first_coeff_1) 434| | printf("0"); 435| | 436| | printf("\n\nThe pairs of (error locator numbers, error values): "); 437| | size_t j = 0; 438| | for (size_t i = 0; i < PARAM_N1; ++i) { 439| | if (error[i]) { 440| | printf("(%zu, %d) ", i, error_values[j]); 441| | j++; 442| | } 443| | } 444| | printf("\n"); 445| |#endif 446| | 447| | // Zeroize sensitive data 448| 39| memset_zero(cdw_bytes, sizeof cdw_bytes); ------------------ | | 22| 39|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 39|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 39|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 39|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 39|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 449| 39|} reed_solomon.c:compute_syndromes: 120| 119|void compute_syndromes(uint16_t *syndromes, uint8_t *cdw) { 121| 4.94k| for (size_t i = 0; i < 2 * PARAM_DELTA; ++i) { ------------------ | | 40| 4.94k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (121:24): [True: 4.82k, False: 119] ------------------ 122| 341k| for (size_t j = 1; j < PARAM_N1; ++j) { ------------------ | | 16| 341k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ | Branch (122:28): [True: 336k, False: 4.82k] ------------------ 123| 336k| syndromes[i] ^= gf_mul(cdw[j], alpha_ij_pow[i][j - 1]); ------------------ | | 51| 336k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 336k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 336k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 336k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 124| 336k| } 125| 4.82k| syndromes[i] ^= cdw[0]; 126| 4.82k| } 127| 119|} reed_solomon.c:compute_elp: 143| 119|static uint16_t compute_elp(uint16_t *sigma, const uint16_t *syndromes) { 144| 119| uint16_t deg_sigma = 0; 145| 119| uint16_t deg_sigma_p = 0; 146| 119| uint16_t deg_sigma_copy = 0; 147| 119| uint16_t sigma_copy[PARAM_DELTA + 1] = {0}; 148| 119| uint16_t X_sigma_p[PARAM_DELTA + 1] = {0, 1}; 149| 119| uint16_t pp = (uint16_t)-1; // 2*rho 150| 119| uint16_t d_p = 1; 151| 119| uint16_t d = syndromes[0]; 152| | 153| 119| uint16_t mask1, mask2, mask12; 154| 119| uint16_t deg_X, deg_X_sigma_p; 155| 119| uint16_t dd; 156| 119| uint16_t mu; 157| | 158| 119| uint16_t i; 159| | 160| 119| sigma[0] = 1; 161| 4.82k| for (mu = 0; (mu < (2 * PARAM_DELTA)); ++mu) { ------------------ | | 40| 4.82k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (161:18): [True: 4.82k, False: 0] ------------------ 162| | // Save sigma in case we need it to update X_sigma_p 163| 4.82k| memcpy(sigma_copy, sigma, 2 * (PARAM_DELTA)); ------------------ | | 40| 4.82k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ 164| 4.82k| deg_sigma_copy = deg_sigma; 165| | 166| 4.82k| dd = gf_mul(d, gf_inverse(d_p)); ------------------ | | 51| 4.82k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 4.82k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.82k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.82k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ dd = gf_mul(d, gf_inverse(d_p)); ------------------ | | 53| 4.82k|#define gf_inverse PQCHQC_NAMESPACE(gf_inverse) | | ------------------ | | | | 17| 4.82k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.82k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.82k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 167| | 168| 86.7k| for (i = 1; (i <= mu + 1) && (i <= PARAM_DELTA); ++i) { ------------------ | | 40| 84.3k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (168:21): [True: 84.3k, False: 2.41k] | Branch (168:38): [True: 81.9k, False: 2.41k] ------------------ 169| 81.9k| sigma[i] ^= gf_mul(dd, X_sigma_p[i]); ------------------ | | 51| 81.9k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 81.9k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 81.9k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 81.9k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 170| 81.9k| } 171| | 172| 4.82k| deg_X = mu - pp; 173| 4.82k| deg_X_sigma_p = deg_X + deg_sigma_p; 174| | 175| | // mask1 = 0xffff if(d != 0) and 0 otherwise 176| 4.82k| mask1 = -((uint16_t)-d >> 15); 177| | 178| | // mask2 = 0xffff if(deg_X_sigma_p > deg_sigma) and 0 otherwise 179| 4.82k| mask2 = -((uint16_t)(deg_sigma - deg_X_sigma_p) >> 15); 180| | 181| | // mask12 = 0xffff if the deg_sigma increased and 0 otherwise 182| 4.82k| volatile uint16_t mask12__ = mask1 & mask2; 183| 4.82k| mask12 = mask12__; 184| 4.82k| deg_sigma ^= mask12 & (deg_X_sigma_p ^ deg_sigma); 185| | 186| 4.82k| if (mu == (2 * PARAM_DELTA - 1)) { ------------------ | | 40| 4.82k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (186:13): [True: 119, False: 4.70k] ------------------ 187| 119| break; 188| 119| } 189| | 190| 4.70k| pp ^= mask12 & (mu ^ pp); 191| 4.70k| d_p ^= mask12 & (d ^ d_p); 192| 109k| for (i = PARAM_DELTA; i; --i) { ------------------ | | 40| 4.70k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (192:31): [True: 105k, False: 4.70k] ------------------ 193| 105k| X_sigma_p[i] = (mask12 & sigma_copy[i - 1]) ^ (~mask12 & X_sigma_p[i - 1]); 194| 105k| } 195| | 196| 4.70k| deg_sigma_p ^= mask12 & (deg_sigma_copy ^ deg_sigma_p); 197| 4.70k| d = syndromes[mu + 1]; 198| | 199| 84.2k| for (i = 1; (i <= mu + 1) && (i <= PARAM_DELTA); ++i) { ------------------ | | 40| 81.8k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (199:21): [True: 81.8k, False: 2.41k] | Branch (199:38): [True: 79.5k, False: 2.29k] ------------------ 200| 79.5k| d ^= gf_mul(sigma[i], syndromes[mu + 1 - i]); ------------------ | | 51| 79.5k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 79.5k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 79.5k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 79.5k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 201| 79.5k| } 202| 4.70k| } 203| | 204| 119| return deg_sigma; 205| 119|} reed_solomon.c:compute_roots: 215| 119|static void compute_roots(uint8_t *error, uint16_t *sigma) { 216| 119| uint16_t w[1 << PARAM_M] = {0}; 217| | 218| 119| fft(w, sigma, PARAM_DELTA + 1); ------------------ | | 13| 119|#define fft PQCHQC_NAMESPACE(fft) | | ------------------ | | | | 17| 119|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 119|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 119|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ fft(w, sigma, PARAM_DELTA + 1); ------------------ | | 40| 119|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ 219| 119| fft_retrieve_error_poly(error, w); ------------------ | | 14| 119|#define fft_retrieve_error_poly PQCHQC_NAMESPACE(fft_retrieve_error_poly) | | ------------------ | | | | 17| 119|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 119|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 119|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 220| 119|} reed_solomon.c:compute_z_poly: 232| 119|static void compute_z_poly(uint16_t *z, const uint16_t *sigma, const uint16_t degree, const uint16_t *syndromes) { 233| 119| size_t i, j; 234| 119| uint16_t mask; 235| | 236| 119| z[0] = 1; 237| | 238| 2.53k| for (i = 1; i < PARAM_DELTA + 1; ++i) { ------------------ | | 40| 2.53k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (238:17): [True: 2.41k, False: 119] ------------------ 239| 2.41k| mask = -((uint16_t)(i - degree - 1) >> 15); 240| 2.41k| z[i] = mask & sigma[i]; 241| 2.41k| } 242| | 243| 119| z[1] ^= syndromes[0]; 244| | 245| 2.41k| for (i = 2; i <= PARAM_DELTA; ++i) { ------------------ | | 40| 2.41k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (245:17): [True: 2.29k, False: 119] ------------------ 246| 2.29k| mask = -((uint16_t)(i - degree - 1) >> 15); 247| 2.29k| z[i] ^= mask & syndromes[i - 1]; 248| | 249| 27.9k| for (j = 1; j < i; ++j) { ------------------ | Branch (249:21): [True: 25.7k, False: 2.29k] ------------------ 250| 25.7k| z[i] ^= mask & gf_mul(sigma[j], syndromes[i - j - 1]); ------------------ | | 51| 25.7k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 25.7k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 25.7k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 25.7k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 251| 25.7k| } 252| 2.29k| } 253| 119|} reed_solomon.c:compute_error_values: 264| 119|static void compute_error_values(uint16_t *error_values, const uint16_t *z, const uint8_t *error) { 265| 119| uint16_t beta_j[PARAM_DELTA] = {0}; 266| 119| uint16_t e_j[PARAM_DELTA] = {0}; 267| | 268| 119| uint16_t delta_counter; 269| 119| uint16_t delta_real_value; 270| 119| uint16_t found; 271| 119| uint16_t mask1; 272| 119| uint16_t mask2; 273| 119| uint16_t tmp1; 274| 119| uint16_t tmp2; 275| 119| uint16_t inverse; 276| 119| uint16_t inverse_power_j; 277| | 278| | // Compute the beta_{j_i} page 31 of the documentation 279| 119| delta_counter = 0; 280| 7.82k| for (size_t i = 0; i < PARAM_N1; i++) { ------------------ | | 16| 7.82k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ | Branch (280:24): [True: 7.70k, False: 119] ------------------ 281| 7.70k| found = 0; 282| 7.70k| mask1 = (uint16_t)(-((int32_t)error[i]) >> 31); // error[i] != 0 283| 178k| for (size_t j = 0; j < PARAM_DELTA; j++) { ------------------ | | 40| 178k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (283:28): [True: 170k, False: 7.70k] ------------------ 284| 170k| mask2 = ~((uint16_t)(-((int32_t)j ^ delta_counter) >> 31)); // j == delta_counter 285| 170k| beta_j[j] += mask1 & mask2 & gf_exp[i]; 286| 170k| found += mask1 & mask2 & 1; 287| 170k| } 288| 7.70k| delta_counter += found; 289| 7.70k| } 290| 119| delta_real_value = delta_counter; 291| | 292| | // Compute the e_{j_i} page 31 of the documentation 293| 2.53k| for (size_t i = 0; i < PARAM_DELTA; ++i) { ------------------ | | 40| 2.53k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (293:24): [True: 2.41k, False: 119] ------------------ 294| 2.41k| tmp1 = 1; 295| 2.41k| tmp2 = 1; 296| 2.41k| inverse = gf_inverse(beta_j[i]); ------------------ | | 53| 2.41k|#define gf_inverse PQCHQC_NAMESPACE(gf_inverse) | | ------------------ | | | | 17| 2.41k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 2.41k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 2.41k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 297| 2.41k| inverse_power_j = 1; 298| | 299| 56.2k| for (size_t j = 1; j <= PARAM_DELTA; ++j) { ------------------ | | 40| 56.2k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (299:28): [True: 53.8k, False: 2.41k] ------------------ 300| 53.8k| inverse_power_j = gf_mul(inverse_power_j, inverse); ------------------ | | 51| 53.8k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 53.8k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 53.8k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 53.8k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 301| 53.8k| tmp1 ^= gf_mul(inverse_power_j, z[j]); ------------------ | | 51| 53.8k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 53.8k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 53.8k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 53.8k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 302| 53.8k| } 303| 53.8k| for (size_t k = 1; k < PARAM_DELTA; ++k) { ------------------ | | 40| 53.8k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (303:28): [True: 51.4k, False: 2.41k] ------------------ 304| 51.4k| tmp2 = gf_mul(tmp2, (1 ^ gf_mul(inverse, beta_j[(i + k) % PARAM_DELTA]))); ------------------ | | 51| 51.4k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 51.4k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 51.4k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 51.4k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ tmp2 = gf_mul(tmp2, (1 ^ gf_mul(inverse, beta_j[(i + k) % PARAM_DELTA]))); ------------------ | | 51| 51.4k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 51.4k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 51.4k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 51.4k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ tmp2 = gf_mul(tmp2, (1 ^ gf_mul(inverse, beta_j[(i + k) % PARAM_DELTA]))); ------------------ | | 40| 51.4k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ 305| 51.4k| } 306| 2.41k| mask1 = (uint16_t)(((int16_t)i - delta_real_value) >> 15); // i < delta_real_value 307| 2.41k| e_j[i] = mask1 & gf_mul(tmp1, gf_inverse(tmp2)); ------------------ | | 51| 2.41k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 2.41k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 2.41k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 2.41k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ e_j[i] = mask1 & gf_mul(tmp1, gf_inverse(tmp2)); ------------------ | | 53| 2.41k|#define gf_inverse PQCHQC_NAMESPACE(gf_inverse) | | ------------------ | | | | 17| 2.41k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 2.41k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 2.41k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 308| 2.41k| } 309| | 310| | // Place the delta e_{j_i} values at the right coordinates of the output vector 311| 119| delta_counter = 0; 312| 7.82k| for (size_t i = 0; i < PARAM_N1; ++i) { ------------------ | | 16| 7.82k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ | Branch (312:24): [True: 7.70k, False: 119] ------------------ 313| 7.70k| found = 0; 314| 7.70k| mask1 = (uint16_t)(-((int32_t)error[i]) >> 31); // error[i] != 0 315| 178k| for (size_t j = 0; j < PARAM_DELTA; j++) { ------------------ | | 40| 178k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (315:28): [True: 170k, False: 7.70k] ------------------ 316| 170k| mask2 = ~((uint16_t)(-((int32_t)j ^ delta_counter) >> 31)); // j == delta_counter 317| 170k| error_values[i] += mask1 & mask2 & e_j[j]; 318| 170k| found += mask1 & mask2 & 1; 319| 170k| } 320| 7.70k| delta_counter += found; 321| 7.70k| } 322| 119|} reed_solomon.c:correct_errors: 330| 119|static void correct_errors(uint8_t *cdw, const uint16_t *error_values) { 331| 7.82k| for (size_t i = 0; i < PARAM_N1; ++i) { ------------------ | | 16| 7.82k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ | Branch (331:24): [True: 7.70k, False: 119] ------------------ 332| 7.70k| cdw[i] ^= error_values[i]; 333| 7.70k| } 334| 119|} PQCHQC_HQC1_C_prng_get_bytes: 20| 117|void prng_get_bytes(uint8_t *output, uint32_t outlen) { 21| 117| OQS_randombytes(output, outlen); 22| 117|} PQCHQC_HQC1_C_xof_init: 70| 312|void xof_init(shake256_xof_ctx *xof_ctx, const uint8_t *seed, uint32_t seed_size) { 71| 312| uint8_t xof_domain = HQC_XOF_DOMAIN; ------------------ | | 50| 312|#define HQC_XOF_DOMAIN 1 ------------------ 72| 312| OQS_SHA3_shake256_inc_init(xof_ctx); 73| 312| OQS_SHA3_shake256_inc_absorb(xof_ctx, seed, seed_size); 74| 312| OQS_SHA3_shake256_inc_absorb(xof_ctx, &xof_domain, 1); 75| 312| OQS_SHA3_shake256_inc_finalize(xof_ctx); 76| 312|} PQCHQC_HQC1_C_xof_get_bytes: 89| 8.20k|void xof_get_bytes(shake256_xof_ctx *xof_ctx, uint8_t *output, uint32_t output_size) { 90| 8.20k| OQS_SHA3_shake256_inc_squeeze(output, output_size, xof_ctx); 91| 8.20k|} PQCHQC_HQC1_C_xof_ctx_release: 96| 312|void xof_ctx_release(shake256_xof_ctx *xof_ctx) { 97| 312| OQS_SHA3_shake256_inc_ctx_release(xof_ctx); 98| 312|} PQCHQC_HQC1_C_hash_i: 109| 39|void hash_i(uint8_t *output, const uint8_t *seed) { 110| 39| sha3_512_ctx i_hash_ctx = {0}; 111| 39| uint8_t i_domain = HQC_I_FCT_DOMAIN; ------------------ | | 65| 39|#define HQC_I_FCT_DOMAIN 2 ------------------ 112| 39| OQS_SHA3_sha3_512_inc_init(&i_hash_ctx); 113| 39| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, seed, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 114| 39| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, &i_domain, 1); 115| 39| OQS_SHA3_sha3_512_inc_finalize(output, &i_hash_ctx); 116| 39| OQS_SHA3_sha3_512_inc_ctx_release(&i_hash_ctx); 117| 39|} PQCHQC_HQC1_C_hash_h: 125| 78|void hash_h(uint8_t *output, const uint8_t ek_kem[PUBLIC_KEY_BYTES]) { 126| 78| sha3_256_ctx h_hash_ctx = {0}; 127| 78| uint8_t h_domain = HQC_H_FCT_DOMAIN; ------------------ | | 60| 78|#define HQC_H_FCT_DOMAIN 1 ------------------ 128| 78| OQS_SHA3_sha3_256_inc_init(&h_hash_ctx); 129| 78| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 78|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 78|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ 130| 78| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, &h_domain, 1); 131| 78| OQS_SHA3_sha3_256_inc_finalize(output, &h_hash_ctx); 132| 78| OQS_SHA3_sha3_256_inc_ctx_release(&h_hash_ctx); 133| 78|} PQCHQC_HQC1_C_hash_g: 144| 78| const uint8_t salt[SALT_BYTES]) { 145| 78| sha3_512_ctx g_hash_ctx = {0}; 146| 78| uint8_t i_domain = HQC_G_FCT_DOMAIN; ------------------ | | 55| 78|#define HQC_G_FCT_DOMAIN 0 ------------------ 147| 78| OQS_SHA3_sha3_512_inc_init(&g_hash_ctx); 148| 78| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 78|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 149| 78| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, m, PARAM_SECURITY_BYTES); ------------------ | | 23| 78|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 150| 78| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, salt, SALT_BYTES); ------------------ | | 53| 78|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 151| 78| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, &i_domain, 1); 152| 78| OQS_SHA3_sha3_512_inc_finalize(output, &g_hash_ctx); 153| 78| OQS_SHA3_sha3_512_inc_ctx_release(&g_hash_ctx); 154| 78|} PQCHQC_HQC1_C_hash_j: 165| 39| const ciphertext_kem_t *c_kem) { 166| 39| sha3_256_ctx k_hash_ctx = {0}; 167| 39| uint8_t k_domain = HQC_J_FCT_DOMAIN; ------------------ | | 70| 39|#define HQC_J_FCT_DOMAIN 3 ------------------ 168| 39| OQS_SHA3_sha3_256_inc_init(&k_hash_ctx); 169| 39| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 39|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 170| 39| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 39|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 171| 39| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 39|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 39] | | | | ------------------ | | ------------------ ------------------ 172| 39| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 39|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 39|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 39, Folded] | | | | ------------------ | | ------------------ ------------------ 173| 39| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, c_kem->salt, SALT_BYTES); ------------------ | | 53| 39|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 174| 39| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, &k_domain, 1); 175| 39| OQS_SHA3_sha3_256_inc_finalize(output, &k_hash_ctx); 176| 39| OQS_SHA3_sha3_256_inc_ctx_release(&k_hash_ctx); 177| 39|} PQCHQC_HQC1_C_vect_generate_random_support1: 62| 117|void vect_generate_random_support1(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 63| 117| uint8_t rand_bytes[3] = {0}; 64| 117| uint32_t candidate = 0; 65| | 66| 7.89k| for (size_t i = 0; i < weight;) { ------------------ | Branch (66:24): [True: 7.78k, False: 117] ------------------ 67| 7.78k| xof_get_bytes(ctx, rand_bytes, 3); ------------------ | | 75| 7.78k|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 7.78k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.78k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.78k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 7.78k| candidate = rand_bytes[0] | (rand_bytes[1] << 8) | (rand_bytes[2] << 16); 69| | 70| 7.78k| if (candidate >= UTILS_REJECTION_THRESHOLD) { ------------------ | | 56| 7.78k|#define UTILS_REJECTION_THRESHOLD 16767881 ///< Rejection threshold for uniform sampling in [0, PARAM_N) ------------------ | Branch (70:13): [True: 11, False: 7.76k] ------------------ 71| 11| continue; 72| 11| } 73| 7.76k| candidate = barrett_reduce(candidate); 74| | 75| 7.76k| int is_position_available = 1; 76| 260k| for (size_t j = 0; j < i; j++) { ------------------ | Branch (76:28): [True: 252k, False: 7.72k] ------------------ 77| 252k| if (candidate == support[j]) { ------------------ | Branch (77:17): [True: 47, False: 252k] ------------------ 78| 47| is_position_available = 0; 79| 47| break; 80| 47| } 81| 252k| } 82| | 83| 7.76k| if (is_position_available == 1) { ------------------ | Branch (83:13): [True: 7.72k, False: 47] ------------------ 84| 7.72k| support[i] = candidate; 85| 7.72k| i++; 86| 7.72k| } 87| 7.76k| } 88| 117|} PQCHQC_HQC1_C_vect_generate_random_support2: 99| 234|void vect_generate_random_support2(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 100| 234| uint32_t rand_u32[PARAM_OMEGA_R] = {0}; 101| | 102| 234| xof_get_bytes(ctx, (uint8_t *)&rand_u32, 4 * weight); ------------------ | | 75| 234|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 234|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 234|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 234|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 103| | 104| 17.7k| for (size_t i = 0; i < weight; ++i) { ------------------ | Branch (104:24): [True: 17.5k, False: 234] ------------------ 105| 17.5k| uint64_t buff = rand_u32[i]; 106| 17.5k| support[i] = i + ((buff * (PARAM_N - i)) >> 32); ------------------ | | 15| 17.5k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 107| 17.5k| } 108| | 109| 17.5k| for (int32_t i = (weight - 1); i-- > 0;) { ------------------ | Branch (109:36): [True: 17.3k, False: 234] ------------------ 110| 17.3k| uint32_t found = 0; 111| | 112| 666k| for (size_t j = i + 1; j < weight; ++j) { ------------------ | Branch (112:32): [True: 649k, False: 17.3k] ------------------ 113| 649k| found |= compare_u32(support[j], support[i]); 114| 649k| } 115| | 116| 17.3k| uint32_t mask = -found; 117| 17.3k| support[i] = (mask & i) ^ (~mask & support[i]); 118| 17.3k| } 119| 234|} PQCHQC_HQC1_C_vect_write_support_to_vector: 131| 351|void vect_write_support_to_vector(uint64_t *v, uint32_t *support, uint16_t weight) { 132| 351| uint32_t index_tab[PARAM_OMEGA_R] = {0}; 133| 351| uint64_t bit_tab[PARAM_OMEGA_R] = {0}; 134| | 135| 25.6k| for (size_t i = 0; i < weight; i++) { ------------------ | Branch (135:24): [True: 25.2k, False: 351] ------------------ 136| 25.2k| index_tab[i] = support[i] >> 6; 137| 25.2k| int32_t pos = support[i] & 0x3f; 138| 25.2k| bit_tab[i] = ((uint64_t)1) << pos; 139| 25.2k| } 140| | 141| 351| uint64_t val = 0; 142| 97.5k| for (uint32_t i = 0; i < VEC_N_SIZE_64; i++) { ------------------ | | 36| 97.5k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 97.5k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 97.5k] | | | | ------------------ | | ------------------ ------------------ | Branch (142:26): [True: 97.2k, False: 351] ------------------ 143| 97.2k| val = 0; 144| 7.09M| for (uint32_t j = 0; j < weight; j++) { ------------------ | Branch (144:30): [True: 7.00M, False: 97.2k] ------------------ 145| 7.00M| uint32_t tmp = i - index_tab[j]; 146| 7.00M| int val1 = 1 ^ ((tmp | -tmp) >> 31); 147| 7.00M| uint64_t mask = -val1; 148| 7.00M| val |= (bit_tab[j] & mask); 149| 7.00M| } 150| 97.2k| v[i] |= val; 151| 97.2k| } 152| 351|} PQCHQC_HQC1_C_vect_sample_fixed_weight1: 169| 117|void vect_sample_fixed_weight1(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 170| 117| uint32_t support[PARAM_OMEGA_R] = {0}; 171| 117| vect_generate_random_support1(ctx, support, weight); ------------------ | | 13| 117|#define vect_generate_random_support1 PQCHQC_NAMESPACE(vect_generate_random_support1) | | ------------------ | | | | 17| 117|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 117|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 117|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 172| 117| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 117|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 117|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 117|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 117|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 117|} PQCHQC_HQC1_C_vect_sample_fixed_weight2: 188| 234|void vect_sample_fixed_weight2(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 189| 234| uint32_t support[PARAM_OMEGA_R] = {0}; 190| 234| vect_generate_random_support2(ctx, support, weight); ------------------ | | 14| 234|#define vect_generate_random_support2 PQCHQC_NAMESPACE(vect_generate_random_support2) | | ------------------ | | | | 17| 234|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 234|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 234|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 234| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 234|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 234|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 234|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 234|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 234|} PQCHQC_HQC1_C_vect_set_random: 203| 117|void vect_set_random(shake256_xof_ctx *ctx, uint64_t *v) { 204| 117| xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 75| 117|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 117|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 117|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 117|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 31| 117|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 117|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 117] | | | | ------------------ | | ------------------ ------------------ 205| 117| v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 36| 117|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 117|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 117] | | | | ------------------ | | ------------------ ------------------ v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 13| 117|#define BITMASK(a, size) ((((uint64_t) 1UL) << (a % size)) - 1) /*!< Create a mask*/ ------------------ 206| 117|} PQCHQC_HQC1_C_vect_add: 216| 312|void vect_add(uint64_t *o, const uint64_t *v1, const uint64_t *v2, uint32_t size) { 217| 86.6k| for (uint32_t i = 0; i < size; ++i) { ------------------ | Branch (217:26): [True: 86.3k, False: 312] ------------------ 218| 86.3k| o[i] = v1[i] ^ v2[i]; 219| 86.3k| } 220| 312|} PQCHQC_HQC1_C_vect_compare: 233| 117|uint8_t vect_compare(const uint8_t *v1, const uint8_t *v2, uint32_t size) { 234| 117| uint16_t r = 0x0100; 235| | 236| 173k| for (size_t i = 0; i < size; i++) { ------------------ | Branch (236:24): [True: 172k, False: 117] ------------------ 237| 172k| r |= v1[i] ^ v2[i]; 238| 172k| } 239| | 240| 117| return (r - 1) >> 8; 241| 117|} PQCHQC_HQC1_C_vect_truncate: 249| 117|void vect_truncate(uint64_t *v) { 250| 117| size_t orig_words = (PARAM_N + 63) / 64; ------------------ | | 15| 117|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 251| 117| size_t new_full_words = PARAM_N1N2 / 64; ------------------ | | 18| 117|#define PARAM_N1N2 17664 ///< Define the length in bits of the concatenated code ------------------ 252| 117| size_t remaining_bits = PARAM_N1N2 % 64; ------------------ | | 18| 117|#define PARAM_N1N2 17664 ///< Define the length in bits of the concatenated code ------------------ 253| | 254| | // Mask the last word if there's a partial word 255| 117| if (remaining_bits > 0) { ------------------ | Branch (255:9): [True: 0, False: 117] ------------------ 256| 0| uint64_t mask = (UINT64_C(1) << remaining_bits) - 1; 257| 0| v[new_full_words] &= mask; 258| 0| new_full_words++; // keep that partial word 259| 0| } 260| | 261| | // Zero out all subsequent words up to the original length 262| 234| for (size_t i = new_full_words; i < orig_words; i++) { ------------------ | Branch (262:37): [True: 117, False: 117] ------------------ 263| 117| v[i] = 0; 264| 117| } 265| 117|} vector.c:barrett_reduce: 35| 35.7k|static inline uint32_t barrett_reduce(uint32_t x) { 36| 35.7k| uint64_t q = ((uint64_t)x * PARAM_N_MU) >> 32; ------------------ | | 55| 35.7k|#define PARAM_N_MU 243079ULL ///< Define a precomputed multiplier for Barrett reduction mu = floor(2^32 / PARAM_N) ------------------ 37| 35.7k| uint32_t r = x - (uint32_t)(q * PARAM_N); ------------------ | | 15| 35.7k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 38| | 39| 35.7k| uint32_t reduce_flag = (((r - PARAM_N) >> 31) ^ 1); ------------------ | | 15| 35.7k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 40| 35.7k| uint32_t mask = -reduce_flag; 41| 35.7k| r -= mask & PARAM_N; ------------------ | | 15| 35.7k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 42| 35.7k| return r; 43| 35.7k|} vector.c:compare_u32: 23| 4.89M|static inline uint32_t compare_u32(const uint32_t v1, const uint32_t v2) { 24| 4.89M| return 1 ^ (((v1 - v2) | (v2 - v1)) >> 31); 25| 4.89M|} PQCHQC_HQC3_C_code_encode: 27| 76|void code_encode(uint64_t *em, const uint64_t *m) { 28| 76| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 29| | 30| 76| reed_solomon_encode(tmp, m); ------------------ | | 119| 76|#define reed_solomon_encode PQCHQC_NAMESPACE(reed_solomon_encode) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 31| 76| reed_muller_encode(em, tmp); ------------------ | | 14| 76|#define reed_muller_encode PQCHQC_NAMESPACE(reed_muller_encode) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 32| | 33| |#ifdef VERBOSE 34| | printf("\n\nReed-Solomon code word: "); 35| | vect_print(tmp, VEC_N1_SIZE_BYTES); 36| | printf("\n\nConcatenated code word: "); 37| | vect_print(em, VEC_N1N2_SIZE_BYTES); 38| |#endif 39| | // Zeroize sensitive data 40| 76| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 76|} PQCHQC_HQC3_C_code_decode: 49| 38|void code_decode(uint64_t *m, const uint64_t *em) { 50| 38| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 51| | 52| 38| reed_muller_decode(tmp, em); ------------------ | | 15| 38|#define reed_muller_decode PQCHQC_NAMESPACE(reed_muller_decode) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 53| 38| reed_solomon_decode(m, tmp); ------------------ | | 120| 38|#define reed_solomon_decode PQCHQC_NAMESPACE(reed_solomon_decode) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| | 55| |#ifdef VERBOSE 56| | printf("\n\nReed-Muller decoding result (the input for the Reed-Solomon decoding algorithm): "); 57| | vect_print(tmp, VEC_N1_SIZE_BYTES); 58| |#endif 59| | 60| | // Zeroize sensitive data 61| 38| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 62| 38|} PQCHQC_HQC3_C_fft: 274| 38|void fft(uint16_t *w, const uint16_t *f, size_t f_coeffs) { 275| 38| uint16_t betas[PARAM_M - 1] = {0}; 276| 38| uint16_t betas_sums[1 << (PARAM_M - 1)] = {0}; 277| 38| uint16_t f0[1 << (PARAM_FFT - 1)] = {0}; 278| 38| uint16_t f1[1 << (PARAM_FFT - 1)] = {0}; 279| 38| uint16_t deltas[PARAM_M - 1] = {0}; 280| 38| uint16_t u[1 << (PARAM_M - 1)] = {0}; 281| 38| uint16_t v[1 << (PARAM_M - 1)] = {0}; 282| | 283| 38| size_t i, k; 284| | 285| | // Follows Gao and Mateer algorithm 286| 38| compute_fft_betas(betas); 287| | 288| | // Step 1: PARAM_FFT > 1, nothing to do 289| | 290| | // Compute gammas sums 291| 38| compute_subset_sums(betas_sums, betas, PARAM_M - 1); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 292| | 293| | // Step 2: beta_m = 1, nothing to do 294| | 295| | // Step 3 296| 38| radix(f0, f1, f, PARAM_FFT); ------------------ | | 46| 38|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 297| | 298| | // Step 4: Compute deltas 299| 304| for (i = 0; i < PARAM_M - 1; ++i) { ------------------ | | 41| 304|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (299:17): [True: 266, False: 38] ------------------ 300| 266| deltas[i] = gf_square(betas[i]) ^ betas[i]; ------------------ | | 52| 266|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 266|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 266|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 266|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 301| 266| } 302| | 303| | // Step 5 304| 38| fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 38|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 305| 38| fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 38|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 306| | 307| 38| k = 1 << (PARAM_M - 1); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 308| | // Step 6, 7 and error polynomial computation 309| 38| memcpy(w + k, v, 2 * k); 310| | 311| | // Check if 0 is root 312| 38| w[0] = u[0]; 313| | 314| | // Check if 1 is root 315| 38| w[k] ^= u[0]; 316| | 317| | // Find other roots 318| 4.86k| for (i = 1; i < k; ++i) { ------------------ | Branch (318:17): [True: 4.82k, False: 38] ------------------ 319| 4.82k| w[i] = u[i] ^ gf_mul(betas_sums[i], v[i]); ------------------ | | 51| 4.82k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 4.82k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.82k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.82k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 320| 4.82k| w[k + i] ^= w[i]; 321| 4.82k| } 322| 38|} PQCHQC_HQC3_C_fft_retrieve_error_poly: 331| 38|void fft_retrieve_error_poly(uint8_t *error, const uint16_t *w) { 332| 38| uint16_t gammas[PARAM_M - 1] = {0}; 333| 38| uint16_t gammas_sums[1 << (PARAM_M - 1)] = {0}; 334| 38| uint16_t k; 335| 38| size_t i, index; 336| | 337| 38| compute_fft_betas(gammas); 338| 38| compute_subset_sums(gammas_sums, gammas, PARAM_M - 1); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 339| | 340| 38| k = 1 << (PARAM_M - 1); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 341| 38| error[0] ^= 1 ^ ((uint16_t)-w[0] >> 15); 342| 38| error[0] ^= 1 ^ ((uint16_t)-w[k] >> 15); 343| | 344| 4.86k| for (i = 1; i < k; ++i) { ------------------ | Branch (344:17): [True: 4.82k, False: 38] ------------------ 345| 4.82k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i]]; ------------------ | | 43| 4.82k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (i.e., 2^PARAM_M−1) ------------------ 346| 4.82k| error[index] ^= 1 ^ ((uint16_t)-w[i] >> 15); 347| | 348| 4.82k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i] ^ 1]; ------------------ | | 43| 4.82k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (i.e., 2^PARAM_M−1) ------------------ 349| 4.82k| error[index] ^= 1 ^ ((uint16_t)-w[k + i] >> 15); 350| 4.82k| } 351| 38|} PQCHQC_HQC3_C_gf_mul: 153| 253k|uint16_t gf_mul(uint16_t a, uint16_t b) { 154| 253k| uint8_t c[2] = {0}; 155| 253k| gf_carryless_mul(c, (uint8_t)a, (uint8_t)b); 156| 253k| uint16_t tmp = (uint16_t)(c[0] ^ (c[1] << 8)); 157| 253k| return gf_reduce(tmp); 158| 253k|} PQCHQC_HQC3_C_gf_square: 165| 31.8k|uint16_t gf_square(uint16_t a) { 166| 31.8k| uint32_t b = a; 167| 31.8k| uint32_t s = b & 1; 168| 255k| for (size_t i = 1; i < PARAM_M; ++i) { ------------------ | | 41| 255k|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (168:24): [True: 223k, False: 31.8k] ------------------ 169| 223k| b <<= 1; 170| 223k| s ^= b & (1 << 2 * i); 171| 223k| } 172| | 173| 31.8k| return gf_reduce(s); 174| 31.8k|} PQCHQC_HQC3_C_gf_inverse: 182| 4.86k|uint16_t gf_inverse(uint16_t a) { 183| 4.86k| uint16_t inv = a; 184| 4.86k| uint16_t tmp1, tmp2; 185| | 186| 4.86k| inv = gf_square(a); /* a^2 */ ------------------ | | 52| 4.86k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 4.86k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.86k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.86k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 187| 4.86k| tmp1 = gf_mul(inv, a); /* a^3 */ ------------------ | | 51| 4.86k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 4.86k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.86k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.86k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 188| 4.86k| inv = gf_square(inv); /* a^4 */ ------------------ | | 52| 4.86k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 4.86k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.86k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.86k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 189| 4.86k| tmp2 = gf_mul(inv, tmp1); /* a^7 */ ------------------ | | 51| 4.86k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 4.86k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.86k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.86k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| 4.86k| tmp1 = gf_mul(inv, tmp2); /* a^11 */ ------------------ | | 51| 4.86k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 4.86k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.86k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.86k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 4.86k| inv = gf_mul(tmp1, inv); /* a^15 */ ------------------ | | 51| 4.86k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 4.86k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.86k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.86k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 4.86k| inv = gf_square(inv); /* a^30 */ ------------------ | | 52| 4.86k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 4.86k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.86k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.86k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| 4.86k| inv = gf_square(inv); /* a^60 */ ------------------ | | 52| 4.86k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 4.86k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.86k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.86k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 194| 4.86k| inv = gf_square(inv); /* a^120 */ ------------------ | | 52| 4.86k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 4.86k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.86k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.86k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 195| 4.86k| inv = gf_mul(inv, tmp2); /* a^127 */ ------------------ | | 51| 4.86k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 4.86k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.86k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.86k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 4.86k| inv = gf_square(inv); /* a^254 */ ------------------ | | 52| 4.86k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 4.86k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.86k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.86k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 4.86k| return inv; 198| 4.86k|} PQCHQC_HQC3_C_vect_mul: 151| 228|void vect_mul(uint64_t *o, const uint64_t *a1, const uint64_t *a2) { 152| 228| uint64_t unreduced[2 * VEC_N_SIZE_64]; 153| 228| uint64_t tmp_buffer[TMP_BUFFER_WORDS]; 154| | 155| | /* multiply via Karatsuba into unreduced */ 156| 228| karatsuba_mul(unreduced, a1, a2, VEC_N_SIZE_64, tmp_buffer); ------------------ | | 36| 228|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 228|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 228] | | | | ------------------ | | ------------------ ------------------ 157| | 158| | /* reduce modulo X^n - 1 */ 159| 228| reduce(o, unreduced); 160| 228|} PQCHQC_HQC3_C_hqc_pke_keygen: 30| 38|void hqc_pke_keygen(uint8_t *ek_pke, uint8_t *dk_pke, uint8_t *seed) { 31| 38| uint8_t keypair_seed[2 * SEED_BYTES] = {0}; 32| 38| uint8_t *seed_dk = keypair_seed; 33| 38| uint8_t *seed_ek = keypair_seed + SEED_BYTES; ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 34| 38| shake256_xof_ctx dk_xof_ctx = {0}; 35| 38| shake256_xof_ctx ek_xof_ctx = {0}; 36| | 37| 38| uint64_t x[VEC_N_SIZE_64] = {0}; 38| 38| uint64_t y[VEC_N_SIZE_64] = {0}; 39| 38| uint64_t h[VEC_N_SIZE_64] = {0}; 40| 38| uint64_t s[VEC_N_SIZE_64] = {0}; 41| | 42| | // Derive keypair seeds 43| 38| hash_i(keypair_seed, seed); ------------------ | | 79| 38|#define hash_i PQCHQC_NAMESPACE(hash_i) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| | 45| | // Compute decryption key 46| 38| xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 74| 38|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 47| 38| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 38|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 38|#define PARAM_OMEGA 100 ///< Define the parameter omega of the scheme ------------------ 48| 38| vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 16| 38|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 19| 38|#define PARAM_OMEGA 100 ///< Define the parameter omega of the scheme ------------------ 49| 38| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 38|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | // Compute encryption key 52| 38| xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 74| 38|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 53| 38| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 38|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 38| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 38|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 55| 38| vect_mul(s, y, h); ------------------ | | 12| 38|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 56| 38| vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 19| 38|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 36| 38|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 57| | 58| | // Parse encryption key to string 59| 38| memcpy(ek_pke, seed_ek, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 60| 38| memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Parse decryption key to string 63| 38| memcpy(dk_pke, seed_dk, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 64| | 65| |#ifdef VERBOSE 66| | printf("\n\nseed_dk: "); 67| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_dk[i]); 68| | printf("\n\nseed_ek: "); 69| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_ek[i]); 70| | printf("\n\ny: "); 71| | vect_print(y, VEC_N_SIZE_BYTES); 72| | printf("\n\nx: "); 73| | vect_print(x, VEC_N_SIZE_BYTES); 74| | printf("\n\nh: "); 75| | vect_print(h, VEC_N_SIZE_BYTES); 76| | printf("\n\ns: "); 77| | vect_print(s, VEC_N_SIZE_BYTES); 78| |#endif 79| | 80| | // Zeroize sensitive data 81| 38| memset_zero(keypair_seed, sizeof keypair_seed); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 38| memset_zero(x, sizeof x); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 38| memset_zero(y, sizeof y); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 38| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 38|} PQCHQC_HQC3_C_hqc_pke_encrypt: 99| 76|void hqc_pke_encrypt(ciphertext_pke_t *c_pke, const uint8_t *ek_pke, const uint64_t *m, const uint8_t *theta) { 100| 76| shake256_xof_ctx theta_xof_ctx = {0}; 101| 76| uint64_t h[VEC_N_SIZE_64] = {0}; 102| 76| uint64_t s[VEC_N_SIZE_64] = {0}; 103| 76| uint64_t r1[VEC_N_SIZE_64] = {0}; 104| 76| uint64_t r2[VEC_N_SIZE_64] = {0}; 105| 76| uint64_t e[VEC_N_SIZE_64] = {0}; 106| 76| uint64_t tmp[VEC_N_SIZE_64] = {0}; 107| | 108| | // Initialize Xof using theta 109| 76| xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 74| 76|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 52| 76|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 110| | 111| | // Retrieve h and s from public key 112| 76| hqc_ek_pke_from_string(h, s, ek_pke); ------------------ | | 15| 76|#define hqc_ek_pke_from_string PQCHQC_NAMESPACE(hqc_ek_pke_from_string) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| | 114| | // Generate re, e and r1 115| 76| vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 17| 76|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 21| 76|#define PARAM_OMEGA_R 114 ///< Define the parameter omega_r of the scheme ------------------ 116| 76| vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 17| 76|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 20| 76|#define PARAM_OMEGA_E 114 ///< Define the parameter omega_e of the scheme ------------------ 117| 76| vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 17| 76|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 21| 76|#define PARAM_OMEGA_R 114 ///< Define the parameter omega_r of the scheme ------------------ 118| 76| xof_ctx_release(&theta_xof_ctx); ------------------ | | 76| 76|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 119| | 120| | // Compute u = r1 + r2.h 121| 76| vect_mul(c_pke->u, r2, h); ------------------ | | 12| 76|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 76| vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 19| 76|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 36| 76|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 76|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 76] | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Compute v = C.encode(m) 125| 76| code_encode(c_pke->v, m); ------------------ | | 14| 76|#define code_encode PQCHQC_NAMESPACE(code_encode) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 126| | 127| | // Compute v = C.encode(m) + Truncate(s.r2 + e) 128| 76| vect_mul(tmp, r2, s); ------------------ | | 12| 76|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 129| 76| vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 19| 76|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 36| 76|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 76|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 76] | | | | ------------------ | | ------------------ ------------------ 130| 76| vect_truncate(tmp); ------------------ | | 21| 76|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 131| 76| vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 19| 76|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 38| 76|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 76|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 76, Folded] | | | | ------------------ | | ------------------ ------------------ 132| | 133| |#ifdef VERBOSE 134| | printf("\n\nh: "); 135| | vect_print(h, VEC_N_SIZE_BYTES); 136| | printf("\n\ns: "); 137| | vect_print(s, VEC_N_SIZE_BYTES); 138| | printf("\n\nr1: "); 139| | vect_print(r1, VEC_N_SIZE_BYTES); 140| | printf("\n\nr2: "); 141| | vect_print(r2, VEC_N_SIZE_BYTES); 142| | printf("\n\ne: "); 143| | vect_print(e, VEC_N_SIZE_BYTES); 144| | printf("\n\nTruncate(s.r2 + e): "); 145| | vect_print(tmp, VEC_N1N2_SIZE_BYTES); 146| | printf("\n\nc_pke->u: "); 147| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 148| | printf("\n\nc_pke->v: "); 149| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 150| |#endif 151| | 152| | // Zeroize sensitive data 153| 76| memset_zero(r1, sizeof r1); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 154| 76| memset_zero(r2, sizeof r2); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 76| memset_zero(e, sizeof e); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 76| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 76| memset_zero(&theta_xof_ctx, sizeof theta_xof_ctx); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 76|} PQCHQC_HQC3_C_hqc_pke_decrypt: 173| 38|uint8_t hqc_pke_decrypt(uint64_t *m, const uint8_t *dk_pke, const ciphertext_pke_t *c_pke) { 174| 38| uint64_t y[VEC_N_SIZE_64] = {0}; 175| 38| uint64_t tmp1[VEC_N_SIZE_64] = {0}; 176| 38| uint64_t tmp2[VEC_N_SIZE_64] = {0}; 177| | 178| | // Parse decryption key dk_pke 179| 38| hqc_dk_pke_from_string(y, dk_pke); ------------------ | | 14| 38|#define hqc_dk_pke_from_string PQCHQC_NAMESPACE(hqc_dk_pke_from_string) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| | 181| | // Compute u.y 182| 38| vect_mul(tmp1, y, c_pke->u); ------------------ | | 12| 38|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 183| | // Truncate(u.y) 184| 38| vect_truncate(tmp1); ------------------ | | 21| 38|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 185| | // Compute v - Truncate(u.y) 186| 38| vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 19| 38|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 38| 38|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ 187| | 188| |#ifdef VERBOSE 189| | printf("\n\nc_pke.u: "); 190| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 191| | printf("\n\nc_pke.v: "); 192| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 193| | printf("\n\ny: "); 194| | vect_print(y, VEC_N_SIZE_BYTES); 195| | printf("\n\nTruncate(u.y): "); 196| | vect_print(tmp1, VEC_N1N2_SIZE_BYTES); 197| | printf("\n\nv - Truncate(u.y): "); 198| | vect_print(tmp2, VEC_N1N2_SIZE_BYTES); 199| |#endif 200| | 201| | // Compute plaintext m 202| 38| code_decode(m, tmp2); ------------------ | | 15| 38|#define code_decode PQCHQC_NAMESPACE(code_decode) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 203| | 204| | // Zeroize sensitive data 205| 38| memset_zero(y, sizeof y); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 206| 38| memset_zero(tmp1, sizeof tmp1); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 207| 38| memset_zero(tmp2, sizeof tmp2); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 208| | 209| 38| return 0; 210| 38|} PQCHQC_HQC3_C_crypto_kem_keypair: 39| 38|int crypto_kem_keypair(uint8_t *ek_kem, uint8_t *dk_kem) { 40| |#ifdef VERBOSE 41| | printf("\n\n\n### KEYGEN ###"); 42| |#endif 43| 38| uint8_t seed_kem[SEED_BYTES] = {0}; 44| 38| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 45| 38| uint8_t seed_pke[SEED_BYTES] = {0}; 46| 38| shake256_xof_ctx ctx_kem; 47| | 48| 38| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 49| 38| uint8_t dk_pke[SEED_BYTES] = {0}; 50| | 51| 38| prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 73| 38|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 52| | 53| | // Compute seed_pke and randomness sigma 54| 38| xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 74| 38|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 55| 38| xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 75| 38|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 56| 38| xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 75| 38|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 57| 38| xof_ctx_release(&ctx_kem); ------------------ | | 76| 38|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| | 59| | // Compute HQC-PKE keypair 60| 38| hqc_pke_keygen(ek_pke, dk_pke, seed_pke); ------------------ | | 14| 38|#define hqc_pke_keygen PQCHQC_NAMESPACE(hqc_pke_keygen) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Compute HQC-KEM keypair 63| 38| memcpy(ek_kem, ek_pke, PUBLIC_KEY_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ 64| 38| memcpy(dk_kem, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ 65| 38| memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 66| 38| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 67| 38| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 68| | 69| |#ifdef VERBOSE 70| | printf("\n\nseed_kem: "); 71| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_kem[i]); 72| | printf("\n\nseed_pke: "); 73| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_pke[i]); 74| | printf("\n\nsigma: "); 75| | for (int i = 0; i < PARAM_SECURITY_BYTES; ++i) printf("%02x", sigma[i]); 76| |#endif 77| | 78| | // Zeroize sensitive data 79| 38| memset_zero(seed_kem, sizeof seed_kem); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 80| 38| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 81| 38| memset_zero(seed_pke, sizeof seed_pke); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 38| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| | 84| 38| return 0; 85| 38|} PQCHQC_HQC3_C_crypto_kem_enc: 105| 38|int crypto_kem_enc(uint8_t *c_kem, uint8_t *K, const uint8_t *ek_kem) { 106| |#ifdef VERBOSE 107| | printf("\n\n\n\n### ENCAPS ###"); 108| |#endif 109| | 110| 38| uint8_t m[PARAM_SECURITY_BYTES] = {0}; 111| 38| uint8_t K_theta[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 112| 38| uint8_t theta[SEED_BYTES] = {0}; 113| 38| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 114| 38| ciphertext_kem_t c_kem_t = {0}; 115| | 116| | // Sample message m and salt 117| 38| prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 73| 38|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 118| 38| prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 73| 38|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 119| | 120| | // Compute shared key K and ciphertext c_kem 121| 38| hash_h(hash_ek_kem, ek_kem); ------------------ | | 78| 38|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 38| hash_g(K_theta, hash_ek_kem, m, c_kem_t.salt); ------------------ | | 77| 38|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| 38| memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 124| 38| hqc_pke_encrypt(&c_kem_t.c_pke, ek_kem, (uint64_t *)m, theta); ------------------ | | 15| 38|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 38| hqc_c_kem_to_string(c_kem, &c_kem_t); ------------------ | | 16| 38|#define hqc_c_kem_to_string PQCHQC_NAMESPACE(hqc_c_kem_to_string) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 127| 38| memcpy(K, K_theta, SHARED_SECRET_BYTES); ------------------ | | 28| 38|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 38|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 128| | 129| |#ifdef VERBOSE 130| | printf("\n\nek_kem: "); 131| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_kem[i]); 132| | printf("\n\nm: "); 133| | vect_print((uint64_t *)m, PARAM_SECURITY_BYTES); 134| | printf("\n\nsalt: "); 135| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_t.salt[i]); 136| | printf("\n\nH(ek_kem): "); 137| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 138| | printf("\n\ntheta: "); 139| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta[i]); 140| | printf("\n\nc_kem: "); 141| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 142| | printf("\n\nK: "); 143| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K[i]); 144| |#endif 145| | 146| | // Zeroize sensitive data 147| 38| memset_zero(m, sizeof m); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 38| memset_zero(K_theta, sizeof K_theta); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 38| memset_zero(theta, sizeof theta); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| | 151| 38| return 0; 152| 38|} PQCHQC_HQC3_C_crypto_kem_dec: 166| 38|int crypto_kem_dec(uint8_t *K_prime, const uint8_t *c_kem, const uint8_t *dk_kem) { 167| |#ifdef VERBOSE 168| | printf("\n\n\n\n### DECAPS ###"); 169| |#endif 170| | 171| 38| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 172| 38| uint8_t dk_pke[SEED_BYTES] = {0}; 173| 38| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 174| 38| uint8_t m_prime[PARAM_SECURITY_BYTES] = {0}; 175| 38| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 176| 38| uint8_t K_theta_prime[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 177| 38| uint8_t K_bar[SHARED_SECRET_BYTES] = {0}; 178| 38| uint8_t theta_prime[SEED_BYTES] = {0}; 179| 38| ciphertext_kem_t c_kem_t = {0}; 180| 38| ciphertext_kem_t c_kem_prime_t = {0}; 181| 38| uint8_t result; 182| | 183| | // Parse decapsulation key dk_kem 184| 38| memcpy(ek_pke, dk_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ 185| 38| memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 186| 38| memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 187| | 188| | // Parse ciphertext c_kem 189| 38| hqc_c_kem_from_string(&c_kem_t.c_pke, c_kem_t.salt, c_kem); ------------------ | | 17| 38|#define hqc_c_kem_from_string PQCHQC_NAMESPACE(hqc_c_kem_from_string) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| | 191| | // Compute message m_prime 192| 38| result = hqc_pke_decrypt((uint64_t *)m_prime, dk_pke, &c_kem_t.c_pke); ------------------ | | 16| 38|#define hqc_pke_decrypt PQCHQC_NAMESPACE(hqc_pke_decrypt) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| | 194| | // Compute shared key K_prime and ciphertext c_kem_prime 195| 38| hash_h(hash_ek_kem, ek_pke); ------------------ | | 78| 38|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 38| hash_g(K_theta_prime, hash_ek_kem, m_prime, c_kem_t.salt); ------------------ | | 77| 38|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 38| memcpy(K_prime, K_theta_prime, SHARED_SECRET_BYTES); ------------------ | | 28| 38|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 38|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 198| 38| memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 28| 38|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 38|#define CRYPTO_BYTES 32 | | ------------------ ------------------ memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 199| | 200| 38| hqc_pke_encrypt(&c_kem_prime_t.c_pke, ek_pke, (uint64_t *)m_prime, theta_prime); ------------------ | | 15| 38|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 201| 38| memcpy(c_kem_prime_t.salt, c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 202| | 203| | // Compute rejection key K_bar 204| 38| hash_j(K_bar, hash_ek_kem, sigma, &c_kem_t); ------------------ | | 80| 38|#define hash_j PQCHQC_NAMESPACE(hash_j) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 205| 38| result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 20| 38|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 206| 38| result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 20| 38|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ 207| 38| result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 20| 38|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 208| 38| result -= 1; 209| 1.25k| for (size_t i = 0; i < SHARED_SECRET_BYTES; ++i) { ------------------ | | 28| 1.25k|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 1.25k|#define CRYPTO_BYTES 32 | | ------------------ ------------------ | Branch (209:24): [True: 1.21k, False: 38] ------------------ 210| 1.21k| K_prime[i] = (K_prime[i] & result) ^ (K_bar[i] & ~result); 211| 1.21k| } 212| | 213| |#ifdef VERBOSE 214| | printf("\n\nek_pke: "); 215| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_pke[i]); 216| | printf("\n\ndk_pke: "); 217| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", dk_pke[i]); 218| | printf("\n\nc_kem: "); 219| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 220| | printf("\n\nm_prime: "); 221| | vect_print((uint64_t *)m_prime, PARAM_SECURITY_BYTES); 222| | printf("\n\nH(ek_kem): "); 223| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 224| | printf("\n\ntheta_prime: "); 225| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta_prime[i]); 226| | printf("\n\n\n# Checking Ciphertext - Begin #"); 227| | printf("\n\nc_kem_prime_t.c_pke.u: "); 228| | vect_print(c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); 229| | printf("\n\nc_kem_prime_t.c_pke.v: "); 230| | vect_print(c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); 231| | printf("\n\nsalt: "); 232| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_prime_t.salt[i]); 233| | printf("\n\n# Checking Ciphertext - End #\n"); 234| | printf("\n\nK_prime: "); 235| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K_prime[i]); 236| |#endif 237| | 238| | // Zeroize sensitive data 239| 38| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 240| 38| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| 38| memset_zero(m_prime, sizeof m_prime); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 242| 38| memset_zero(K_theta_prime, sizeof K_theta_prime); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 243| 38| memset_zero(K_bar, sizeof K_bar); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| 38| memset_zero(theta_prime, sizeof theta_prime); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 245| | 246| 38| return 0; 247| 38|} PQCHQC_HQC3_C_hqc_dk_pke_from_string: 19| 38|void hqc_dk_pke_from_string(uint64_t *y, const uint8_t *dk_pke) { 20| 38| shake256_xof_ctx dk_xof_ctx = {0}; 21| 38| xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 74| 38|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 22| 38| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 38|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 38|#define PARAM_OMEGA 100 ///< Define the parameter omega of the scheme ------------------ 23| 38| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 38|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 24| | 25| | // Zeroize sensitive data 26| 38| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 27| 38|} PQCHQC_HQC3_C_hqc_ek_pke_from_string: 36| 76|void hqc_ek_pke_from_string(uint64_t *h, uint64_t *s, const uint8_t *ek_pke) { 37| 76| shake256_xof_ctx ek_xof_ctx = {0}; 38| | 39| 76| xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 74| 76|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 52| 76|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 40| 76| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 76|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 76| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 76|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 42| | 43| 76| memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 52| 76|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 31| 76|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 76|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 76] | | | | ------------------ | | ------------------ ------------------ 44| 76|} PQCHQC_HQC3_C_hqc_c_kem_to_string: 52| 38|void hqc_c_kem_to_string(uint8_t *ct, const ciphertext_kem_t *c_kem) { 53| 38| memcpy(ct, c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 54| 38| memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ 55| 38| memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 56| 38|} PQCHQC_HQC3_C_hqc_c_kem_from_string: 65| 38|void hqc_c_kem_from_string(ciphertext_pke_t *c_pke, uint8_t *salt, const uint8_t *ct) { 66| 38| memcpy(c_pke->u, ct, VEC_N_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 67| 38| memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ 68| 38| memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 69| 38|} PQCHQC_HQC3_C_reed_muller_encode: 174| 76|void reed_muller_encode(uint64_t *cdw, const uint64_t *msg) { 175| 76| uint8_t *message_array = (uint8_t *)msg; 176| 76| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 177| 4.33k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 4.33k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 4.33k|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) | | ------------------ ------------------ | Branch (177:24): [True: 4.25k, False: 76] ------------------ 178| | // fill entries i * MULTIPLICITY to (i+1) * MULTIPLICITY 179| 4.25k| int32_t pos = i * MULTIPLICITY; ------------------ | | 18| 4.25k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 4.25k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 4.25k, Folded] | | | | ------------------ | | ------------------ ------------------ 180| | // encode first word 181| 4.25k| encode(&codeArray[pos], message_array[i]); 182| | // copy to other identical codewords 183| 21.2k| for (size_t copy = 1; copy < MULTIPLICITY; copy++) { ------------------ | | 18| 21.2k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 21.2k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 21.2k, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (183:31): [True: 17.0k, False: 4.25k] ------------------ 184| 17.0k| memcpy(&codeArray[pos + copy], &codeArray[pos], sizeof(rm_codeword_t)); 185| 17.0k| } 186| 4.25k| } 187| 76|} PQCHQC_HQC3_C_reed_muller_decode: 198| 38|void reed_muller_decode(uint64_t *msg, const uint64_t *cdw) { 199| 38| uint8_t *message_array = (uint8_t *)msg; 200| 38| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 201| 38| rm_expanded_cdw expanded; 202| 2.16k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 2.16k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 2.16k|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) | | ------------------ ------------------ | Branch (202:24): [True: 2.12k, False: 38] ------------------ 203| | // collect the codewords 204| 2.12k| expand_and_sum(&expanded, &codeArray[i * MULTIPLICITY]); ------------------ | | 18| 2.12k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 2.12k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 2.12k, Folded] | | | | ------------------ | | ------------------ ------------------ 205| | // apply hadamard transform 206| 2.12k| rm_expanded_cdw transform; 207| 2.12k| hadamard(&expanded, &transform); 208| | // fix the first entry to get the half Hadamard transform 209| 2.12k| transform[0] -= 64 * MULTIPLICITY; ------------------ | | 18| 2.12k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 2.12k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 2.12k, Folded] | | | | ------------------ | | ------------------ ------------------ 210| | // finish the decoding 211| 2.12k| message_array[i] = find_peaks(&transform); 212| 2.12k| } 213| 38|} PQCHQC_HQC3_C_reed_solomon_encode: 84| 76|void reed_solomon_encode(uint64_t *cdw, const uint64_t *msg) { 85| 76| size_t i, j, k; 86| 76| uint8_t gate_value = 0; 87| | 88| 76| uint16_t tmp[PARAM_G] = {0}; 89| 76| uint16_t PARAM_RS_POLY[] = {RS_POLY_COEFS}; ------------------ | | 49| 76| 45, 216, 239, 24, 253, 104, 27, 40, 107, 50, 163, 210, 227, 134, 224, 158, 119, 13, 158, 1, 238, 164, 82, 43, 15, \ | | 50| 76| 232, 246, 142, 50, 189, 29, 232, 1 ///< Coefficients of the Reed-Solomon generator polynomial ------------------ 90| | 91| 76| uint8_t msg_bytes[PARAM_K] = {0}; 92| 76| uint8_t cdw_bytes[PARAM_N1] = {0}; 93| | 94| 76| memcpy(msg_bytes, msg, PARAM_K); ------------------ | | 44| 76|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 95| | 96| 1.90k| for (i = 0; i < PARAM_K; ++i) { ------------------ | | 44| 1.90k|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ | Branch (96:17): [True: 1.82k, False: 76] ------------------ 97| 1.82k| gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 1.82k|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 16| 1.82k|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 1.82k|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 98| | 99| 62.0k| for (j = 0; j < PARAM_G; ++j) { ------------------ | | 45| 62.0k|#define PARAM_G 33 ///< Define the size of the generator polynomial of the Reed-Solomon code ------------------ | Branch (99:21): [True: 60.1k, False: 1.82k] ------------------ 100| 60.1k| tmp[j] = gf_mul(gate_value, PARAM_RS_POLY[j]); ------------------ | | 51| 60.1k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 60.1k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 60.1k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 60.1k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 101| 60.1k| } 102| | 103| 58.3k| for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 16| 1.82k|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 44| 1.82k|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ | Branch (103:42): [True: 56.5k, False: 1.82k] ------------------ 104| 56.5k| cdw_bytes[k] = cdw_bytes[k - 1] ^ tmp[k]; 105| 56.5k| } 106| | 107| 1.82k| cdw_bytes[0] = tmp[0]; 108| 1.82k| } 109| | 110| 76| memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 16| 76|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 76|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 76|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 111| 76| memcpy(cdw, cdw_bytes, PARAM_N1); ------------------ | | 16| 76|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ 112| 76|} PQCHQC_HQC3_C_reed_solomon_decode: 353| 38|void reed_solomon_decode(uint64_t *msg, uint64_t *cdw) { 354| 38| uint8_t cdw_bytes[PARAM_N1] = {0}; 355| 38| uint16_t syndromes[2 * PARAM_DELTA] = {0}; 356| 38| uint16_t sigma[1 << PARAM_FFT] = {0}; 357| 38| uint8_t error[1 << PARAM_M] = {0}; 358| 38| uint16_t z[PARAM_N1] = {0}; 359| 38| uint16_t error_values[PARAM_N1] = {0}; 360| 38| uint16_t deg; 361| | 362| | // Copy the vector in an array of bytes 363| 38| memcpy(cdw_bytes, cdw, PARAM_N1); ------------------ | | 16| 38|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ 364| | 365| | // Calculate the 2*PARAM_DELTA syndromes 366| 38| compute_syndromes(syndromes, cdw_bytes); 367| | 368| | // Compute the error locator polynomial sigma 369| | // Sigma's degree is at most PARAM_DELTA but the FFT requires the extra room 370| 38| deg = compute_elp(sigma, syndromes); 371| | 372| | // Compute the error polynomial error 373| 38| compute_roots(error, sigma); 374| | 375| | // Compute the polynomial z(x) 376| 38| compute_z_poly(z, sigma, deg, syndromes); 377| | 378| | // Compute the error values 379| 38| compute_error_values(error_values, z, error); 380| | 381| | // Correct the errors 382| 38| correct_errors(cdw_bytes, error_values); 383| | 384| | // Retrieve the message from the decoded codeword 385| 38| memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 45| 38|#define PARAM_G 33 ///< Define the size of the generator polynomial of the Reed-Solomon code ------------------ memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 44| 38|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 386| | 387| |#ifdef VERBOSE 388| | printf("\n\nThe syndromes: "); 389| | for (size_t i = 0; i < 2 * PARAM_DELTA; ++i) { 390| | printf("%u ", syndromes[i]); 391| | } 392| | printf("\n\nThe error locator polynomial: sigma(x) = "); 393| | bool first_coeff = true; 394| | if (sigma[0]) { 395| | printf("%u", sigma[0]); 396| | first_coeff = false; 397| | } 398| | for (size_t i = 1; i < (1 << PARAM_FFT); ++i) { 399| | if (sigma[i] == 0) 400| | continue; 401| | if (!first_coeff) 402| | printf(" + "); 403| | first_coeff = false; 404| | if (sigma[i] != 1) 405| | printf("%u ", sigma[i]); 406| | if (i == 1) 407| | printf("x"); 408| | else 409| | printf("x^%zu", i); 410| | } 411| | if (first_coeff) 412| | printf("0"); 413| | 414| | printf("\n\nThe polynomial: z(x) = "); 415| | bool first_coeff_1 = true; 416| | if (z[0]) { 417| | printf("%u", z[0]); 418| | first_coeff_1 = false; 419| | } 420| | for (size_t i = 1; i < (PARAM_DELTA + 1); ++i) { 421| | if (z[i] == 0) 422| | continue; 423| | if (!first_coeff_1) 424| | printf(" + "); 425| | first_coeff_1 = false; 426| | if (z[i] != 1) 427| | printf("%u ", z[i]); 428| | if (i == 1) 429| | printf("x"); 430| | else 431| | printf("x^%zu", i); 432| | } 433| | if (first_coeff_1) 434| | printf("0"); 435| | 436| | printf("\n\nThe pairs of (error locator numbers, error values): "); 437| | size_t j = 0; 438| | for (size_t i = 0; i < PARAM_N1; ++i) { 439| | if (error[i]) { 440| | printf("(%zu, %d) ", i, error_values[j]); 441| | j++; 442| | } 443| | } 444| | printf("\n"); 445| |#endif 446| | 447| | // Zeroize sensitive data 448| 38| memset_zero(cdw_bytes, sizeof cdw_bytes); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 449| 38|} PQCHQC_HQC3_C_prng_get_bytes: 20| 114|void prng_get_bytes(uint8_t *output, uint32_t outlen) { 21| 114| OQS_randombytes(output, outlen); 22| 114|} PQCHQC_HQC3_C_xof_init: 70| 304|void xof_init(shake256_xof_ctx *xof_ctx, const uint8_t *seed, uint32_t seed_size) { 71| 304| uint8_t xof_domain = HQC_XOF_DOMAIN; ------------------ | | 50| 304|#define HQC_XOF_DOMAIN 1 ------------------ 72| 304| OQS_SHA3_shake256_inc_init(xof_ctx); 73| 304| OQS_SHA3_shake256_inc_absorb(xof_ctx, seed, seed_size); 74| 304| OQS_SHA3_shake256_inc_absorb(xof_ctx, &xof_domain, 1); 75| 304| OQS_SHA3_shake256_inc_finalize(xof_ctx); 76| 304|} PQCHQC_HQC3_C_xof_get_bytes: 89| 11.8k|void xof_get_bytes(shake256_xof_ctx *xof_ctx, uint8_t *output, uint32_t output_size) { 90| 11.8k| OQS_SHA3_shake256_inc_squeeze(output, output_size, xof_ctx); 91| 11.8k|} PQCHQC_HQC3_C_xof_ctx_release: 96| 304|void xof_ctx_release(shake256_xof_ctx *xof_ctx) { 97| 304| OQS_SHA3_shake256_inc_ctx_release(xof_ctx); 98| 304|} PQCHQC_HQC3_C_hash_i: 109| 38|void hash_i(uint8_t *output, const uint8_t *seed) { 110| 38| sha3_512_ctx i_hash_ctx = {0}; 111| 38| uint8_t i_domain = HQC_I_FCT_DOMAIN; ------------------ | | 65| 38|#define HQC_I_FCT_DOMAIN 2 ------------------ 112| 38| OQS_SHA3_sha3_512_inc_init(&i_hash_ctx); 113| 38| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, seed, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 114| 38| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, &i_domain, 1); 115| 38| OQS_SHA3_sha3_512_inc_finalize(output, &i_hash_ctx); 116| 38| OQS_SHA3_sha3_512_inc_ctx_release(&i_hash_ctx); 117| 38|} PQCHQC_HQC3_C_hash_h: 125| 76|void hash_h(uint8_t *output, const uint8_t ek_kem[PUBLIC_KEY_BYTES]) { 126| 76| sha3_256_ctx h_hash_ctx = {0}; 127| 76| uint8_t h_domain = HQC_H_FCT_DOMAIN; ------------------ | | 60| 76|#define HQC_H_FCT_DOMAIN 1 ------------------ 128| 76| OQS_SHA3_sha3_256_inc_init(&h_hash_ctx); 129| 76| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 76|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 76|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ 130| 76| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, &h_domain, 1); 131| 76| OQS_SHA3_sha3_256_inc_finalize(output, &h_hash_ctx); 132| 76| OQS_SHA3_sha3_256_inc_ctx_release(&h_hash_ctx); 133| 76|} PQCHQC_HQC3_C_hash_g: 144| 76| const uint8_t salt[SALT_BYTES]) { 145| 76| sha3_512_ctx g_hash_ctx = {0}; 146| 76| uint8_t i_domain = HQC_G_FCT_DOMAIN; ------------------ | | 55| 76|#define HQC_G_FCT_DOMAIN 0 ------------------ 147| 76| OQS_SHA3_sha3_512_inc_init(&g_hash_ctx); 148| 76| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 76|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 149| 76| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, m, PARAM_SECURITY_BYTES); ------------------ | | 23| 76|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 150| 76| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, salt, SALT_BYTES); ------------------ | | 53| 76|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 151| 76| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, &i_domain, 1); 152| 76| OQS_SHA3_sha3_512_inc_finalize(output, &g_hash_ctx); 153| 76| OQS_SHA3_sha3_512_inc_ctx_release(&g_hash_ctx); 154| 76|} PQCHQC_HQC3_C_hash_j: 165| 38| const ciphertext_kem_t *c_kem) { 166| 38| sha3_256_ctx k_hash_ctx = {0}; 167| 38| uint8_t k_domain = HQC_J_FCT_DOMAIN; ------------------ | | 70| 38|#define HQC_J_FCT_DOMAIN 3 ------------------ 168| 38| OQS_SHA3_sha3_256_inc_init(&k_hash_ctx); 169| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 170| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 171| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 172| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ 173| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, c_kem->salt, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 174| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, &k_domain, 1); 175| 38| OQS_SHA3_sha3_256_inc_finalize(output, &k_hash_ctx); 176| 38| OQS_SHA3_sha3_256_inc_ctx_release(&k_hash_ctx); 177| 38|} PQCHQC_HQC3_C_vect_generate_random_support1: 62| 114|void vect_generate_random_support1(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 63| 114| uint8_t rand_bytes[3] = {0}; 64| 114| uint32_t candidate = 0; 65| | 66| 11.5k| for (size_t i = 0; i < weight;) { ------------------ | Branch (66:24): [True: 11.4k, False: 114] ------------------ 67| 11.4k| xof_get_bytes(ctx, rand_bytes, 3); ------------------ | | 75| 11.4k|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 11.4k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 11.4k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 11.4k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 11.4k| candidate = rand_bytes[0] | (rand_bytes[1] << 8) | (rand_bytes[2] << 16); 69| | 70| 11.4k| if (candidate >= UTILS_REJECTION_THRESHOLD) { ------------------ | | 56| 11.4k|#define UTILS_REJECTION_THRESHOLD 16742417 ///< Rejection threshold for uniform sampling in [0, PARAM_N) ------------------ | Branch (70:13): [True: 30, False: 11.4k] ------------------ 71| 30| continue; 72| 30| } 73| 11.4k| candidate = barrett_reduce(candidate); 74| | 75| 11.4k| int is_position_available = 1; 76| 576k| for (size_t j = 0; j < i; j++) { ------------------ | Branch (76:28): [True: 565k, False: 11.4k] ------------------ 77| 565k| if (candidate == support[j]) { ------------------ | Branch (77:17): [True: 37, False: 565k] ------------------ 78| 37| is_position_available = 0; 79| 37| break; 80| 37| } 81| 565k| } 82| | 83| 11.4k| if (is_position_available == 1) { ------------------ | Branch (83:13): [True: 11.4k, False: 37] ------------------ 84| 11.4k| support[i] = candidate; 85| 11.4k| i++; 86| 11.4k| } 87| 11.4k| } 88| 114|} PQCHQC_HQC3_C_vect_generate_random_support2: 99| 228|void vect_generate_random_support2(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 100| 228| uint32_t rand_u32[PARAM_OMEGA_R] = {0}; 101| | 102| 228| xof_get_bytes(ctx, (uint8_t *)&rand_u32, 4 * weight); ------------------ | | 75| 228|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 228|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 228|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 228|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 103| | 104| 26.2k| for (size_t i = 0; i < weight; ++i) { ------------------ | Branch (104:24): [True: 25.9k, False: 228] ------------------ 105| 25.9k| uint64_t buff = rand_u32[i]; 106| 25.9k| support[i] = i + ((buff * (PARAM_N - i)) >> 32); ------------------ | | 15| 25.9k|#define PARAM_N 35851 ///< Define the parameter n of the scheme ------------------ 107| 25.9k| } 108| | 109| 25.9k| for (int32_t i = (weight - 1); i-- > 0;) { ------------------ | Branch (109:36): [True: 25.7k, False: 228] ------------------ 110| 25.7k| uint32_t found = 0; 111| | 112| 1.49M| for (size_t j = i + 1; j < weight; ++j) { ------------------ | Branch (112:32): [True: 1.46M, False: 25.7k] ------------------ 113| 1.46M| found |= compare_u32(support[j], support[i]); 114| 1.46M| } 115| | 116| 25.7k| uint32_t mask = -found; 117| 25.7k| support[i] = (mask & i) ^ (~mask & support[i]); 118| 25.7k| } 119| 228|} PQCHQC_HQC3_C_vect_write_support_to_vector: 131| 342|void vect_write_support_to_vector(uint64_t *v, uint32_t *support, uint16_t weight) { 132| 342| uint32_t index_tab[PARAM_OMEGA_R] = {0}; 133| 342| uint64_t bit_tab[PARAM_OMEGA_R] = {0}; 134| | 135| 37.7k| for (size_t i = 0; i < weight; i++) { ------------------ | Branch (135:24): [True: 37.3k, False: 342] ------------------ 136| 37.3k| index_tab[i] = support[i] >> 6; 137| 37.3k| int32_t pos = support[i] & 0x3f; 138| 37.3k| bit_tab[i] = ((uint64_t)1) << pos; 139| 37.3k| } 140| | 141| 342| uint64_t val = 0; 142| 192k| for (uint32_t i = 0; i < VEC_N_SIZE_64; i++) { ------------------ | | 36| 192k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 192k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 192k] | | | | ------------------ | | ------------------ ------------------ | Branch (142:26): [True: 191k, False: 342] ------------------ 143| 191k| val = 0; 144| 21.1M| for (uint32_t j = 0; j < weight; j++) { ------------------ | Branch (144:30): [True: 20.9M, False: 191k] ------------------ 145| 20.9M| uint32_t tmp = i - index_tab[j]; 146| 20.9M| int val1 = 1 ^ ((tmp | -tmp) >> 31); 147| 20.9M| uint64_t mask = -val1; 148| 20.9M| val |= (bit_tab[j] & mask); 149| 20.9M| } 150| 191k| v[i] |= val; 151| 191k| } 152| 342|} PQCHQC_HQC3_C_vect_sample_fixed_weight1: 169| 114|void vect_sample_fixed_weight1(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 170| 114| uint32_t support[PARAM_OMEGA_R] = {0}; 171| 114| vect_generate_random_support1(ctx, support, weight); ------------------ | | 13| 114|#define vect_generate_random_support1 PQCHQC_NAMESPACE(vect_generate_random_support1) | | ------------------ | | | | 17| 114|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 114|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 114|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 172| 114| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 114|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 114|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 114|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 114|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 114|} PQCHQC_HQC3_C_vect_sample_fixed_weight2: 188| 228|void vect_sample_fixed_weight2(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 189| 228| uint32_t support[PARAM_OMEGA_R] = {0}; 190| 228| vect_generate_random_support2(ctx, support, weight); ------------------ | | 14| 228|#define vect_generate_random_support2 PQCHQC_NAMESPACE(vect_generate_random_support2) | | ------------------ | | | | 17| 228|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 228|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 228|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 228| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 228|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 228|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 228|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 228|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 228|} PQCHQC_HQC3_C_vect_set_random: 203| 114|void vect_set_random(shake256_xof_ctx *ctx, uint64_t *v) { 204| 114| xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 75| 114|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 114|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 114|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 114|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 31| 114|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 114|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 114] | | | | ------------------ | | ------------------ ------------------ 205| 114| v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 36| 114|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 114|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 114] | | | | ------------------ | | ------------------ ------------------ v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 13| 114|#define BITMASK(a, size) ((((uint64_t) 1UL) << (a % size)) - 1) /*!< Create a mask*/ ------------------ 206| 114|} PQCHQC_HQC3_C_vect_add: 216| 304|void vect_add(uint64_t *o, const uint64_t *v1, const uint64_t *v2, uint32_t size) { 217| 170k| for (uint32_t i = 0; i < size; ++i) { ------------------ | Branch (217:26): [True: 170k, False: 304] ------------------ 218| 170k| o[i] = v1[i] ^ v2[i]; 219| 170k| } 220| 304|} PQCHQC_HQC3_C_vect_compare: 233| 114|uint8_t vect_compare(const uint8_t *v1, const uint8_t *v2, uint32_t size) { 234| 114| uint16_t r = 0x0100; 235| | 236| 341k| for (size_t i = 0; i < size; i++) { ------------------ | Branch (236:24): [True: 341k, False: 114] ------------------ 237| 341k| r |= v1[i] ^ v2[i]; 238| 341k| } 239| | 240| 114| return (r - 1) >> 8; 241| 114|} PQCHQC_HQC3_C_vect_truncate: 249| 114|void vect_truncate(uint64_t *v) { 250| 114| size_t orig_words = (PARAM_N + 63) / 64; ------------------ | | 15| 114|#define PARAM_N 35851 ///< Define the parameter n of the scheme ------------------ 251| 114| size_t new_full_words = PARAM_N1N2 / 64; ------------------ | | 18| 114|#define PARAM_N1N2 35840 ///< Define the length in bits of the concatenated code ------------------ 252| 114| size_t remaining_bits = PARAM_N1N2 % 64; ------------------ | | 18| 114|#define PARAM_N1N2 35840 ///< Define the length in bits of the concatenated code ------------------ 253| | 254| | // Mask the last word if there's a partial word 255| 114| if (remaining_bits > 0) { ------------------ | Branch (255:9): [True: 0, False: 114] ------------------ 256| 0| uint64_t mask = (UINT64_C(1) << remaining_bits) - 1; 257| 0| v[new_full_words] &= mask; 258| 0| new_full_words++; // keep that partial word 259| 0| } 260| | 261| | // Zero out all subsequent words up to the original length 262| 228| for (size_t i = new_full_words; i < orig_words; i++) { ------------------ | Branch (262:37): [True: 114, False: 114] ------------------ 263| 114| v[i] = 0; 264| 114| } 265| 114|} PQCHQC_HQC5_C_code_encode: 27| 84|void code_encode(uint64_t *em, const uint64_t *m) { 28| 84| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 29| | 30| 84| reed_solomon_encode(tmp, m); ------------------ | | 255| 84|#define reed_solomon_encode PQCHQC_NAMESPACE(reed_solomon_encode) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 31| 84| reed_muller_encode(em, tmp); ------------------ | | 14| 84|#define reed_muller_encode PQCHQC_NAMESPACE(reed_muller_encode) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 32| | 33| |#ifdef VERBOSE 34| | printf("\n\nReed-Solomon code word: "); 35| | vect_print(tmp, VEC_N1_SIZE_BYTES); 36| | printf("\n\nConcatenated code word: "); 37| | vect_print(em, VEC_N1N2_SIZE_BYTES); 38| |#endif 39| | // Zeroize sensitive data 40| 84| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 84|} PQCHQC_HQC5_C_code_decode: 49| 42|void code_decode(uint64_t *m, const uint64_t *em) { 50| 42| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 51| | 52| 42| reed_muller_decode(tmp, em); ------------------ | | 15| 42|#define reed_muller_decode PQCHQC_NAMESPACE(reed_muller_decode) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 53| 42| reed_solomon_decode(m, tmp); ------------------ | | 256| 42|#define reed_solomon_decode PQCHQC_NAMESPACE(reed_solomon_decode) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| | 55| |#ifdef VERBOSE 56| | printf("\n\nReed-Muller decoding result (the input for the Reed-Solomon decoding algorithm): "); 57| | vect_print(tmp, VEC_N1_SIZE_BYTES); 58| |#endif 59| | 60| | // Zeroize sensitive data 61| 42| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 62| 42|} PQCHQC_HQC5_C_fft: 274| 42|void fft(uint16_t *w, const uint16_t *f, size_t f_coeffs) { 275| 42| uint16_t betas[PARAM_M - 1] = {0}; 276| 42| uint16_t betas_sums[1 << (PARAM_M - 1)] = {0}; 277| 42| uint16_t f0[1 << (PARAM_FFT - 1)] = {0}; 278| 42| uint16_t f1[1 << (PARAM_FFT - 1)] = {0}; 279| 42| uint16_t deltas[PARAM_M - 1] = {0}; 280| 42| uint16_t u[1 << (PARAM_M - 1)] = {0}; 281| 42| uint16_t v[1 << (PARAM_M - 1)] = {0}; 282| | 283| 42| size_t i, k; 284| | 285| | // Follows Gao and Mateer algorithm 286| 42| compute_fft_betas(betas); 287| | 288| | // Step 1: PARAM_FFT > 1, nothing to do 289| | 290| | // Compute gammas sums 291| 42| compute_subset_sums(betas_sums, betas, PARAM_M - 1); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 292| | 293| | // Step 2: beta_m = 1, nothing to do 294| | 295| | // Step 3 296| 42| radix(f0, f1, f, PARAM_FFT); ------------------ | | 46| 42|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 297| | 298| | // Step 4: Compute deltas 299| 336| for (i = 0; i < PARAM_M - 1; ++i) { ------------------ | | 41| 336|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (299:17): [True: 294, False: 42] ------------------ 300| 294| deltas[i] = gf_square(betas[i]) ^ betas[i]; ------------------ | | 52| 294|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 294|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 294|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 294|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 301| 294| } 302| | 303| | // Step 5 304| 42| fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 42|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 305| 42| fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 42|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 306| | 307| 42| k = 1 << (PARAM_M - 1); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 308| | // Step 6, 7 and error polynomial computation 309| 42| memcpy(w + k, v, 2 * k); 310| | 311| | // Check if 0 is root 312| 42| w[0] = u[0]; 313| | 314| | // Check if 1 is root 315| 42| w[k] ^= u[0]; 316| | 317| | // Find other roots 318| 5.37k| for (i = 1; i < k; ++i) { ------------------ | Branch (318:17): [True: 5.33k, False: 42] ------------------ 319| 5.33k| w[i] = u[i] ^ gf_mul(betas_sums[i], v[i]); ------------------ | | 51| 5.33k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.33k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.33k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.33k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 320| 5.33k| w[k + i] ^= w[i]; 321| 5.33k| } 322| 42|} PQCHQC_HQC5_C_fft_retrieve_error_poly: 331| 42|void fft_retrieve_error_poly(uint8_t *error, const uint16_t *w) { 332| 42| uint16_t gammas[PARAM_M - 1] = {0}; 333| 42| uint16_t gammas_sums[1 << (PARAM_M - 1)] = {0}; 334| 42| uint16_t k; 335| 42| size_t i, index; 336| | 337| 42| compute_fft_betas(gammas); 338| 42| compute_subset_sums(gammas_sums, gammas, PARAM_M - 1); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 339| | 340| 42| k = 1 << (PARAM_M - 1); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 341| 42| error[0] ^= 1 ^ ((uint16_t)-w[0] >> 15); 342| 42| error[0] ^= 1 ^ ((uint16_t)-w[k] >> 15); 343| | 344| 5.37k| for (i = 1; i < k; ++i) { ------------------ | Branch (344:17): [True: 5.33k, False: 42] ------------------ 345| 5.33k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i]]; ------------------ | | 43| 5.33k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (2^PARAM_M−1) ------------------ 346| 5.33k| error[index] ^= 1 ^ ((uint16_t)-w[i] >> 15); 347| | 348| 5.33k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i] ^ 1]; ------------------ | | 43| 5.33k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (2^PARAM_M−1) ------------------ 349| 5.33k| error[index] ^= 1 ^ ((uint16_t)-w[k + i] >> 15); 350| 5.33k| } 351| 42|} PQCHQC_HQC5_C_gf_mul: 153| 711k|uint16_t gf_mul(uint16_t a, uint16_t b) { 154| 711k| uint8_t c[2] = {0}; 155| 711k| gf_carryless_mul(c, (uint8_t)a, (uint8_t)b); 156| 711k| uint16_t tmp = (uint16_t)(c[0] ^ (c[1] << 8)); 157| 711k| return gf_reduce(tmp); 158| 711k|} PQCHQC_HQC5_C_gf_square: 165| 48.3k|uint16_t gf_square(uint16_t a) { 166| 48.3k| uint32_t b = a; 167| 48.3k| uint32_t s = b & 1; 168| 386k| for (size_t i = 1; i < PARAM_M; ++i) { ------------------ | | 41| 386k|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (168:24): [True: 338k, False: 48.3k] ------------------ 169| 338k| b <<= 1; 170| 338k| s ^= b & (1 << 2 * i); 171| 338k| } 172| | 173| 48.3k| return gf_reduce(s); 174| 48.3k|} PQCHQC_HQC5_C_gf_inverse: 182| 7.56k|uint16_t gf_inverse(uint16_t a) { 183| 7.56k| uint16_t inv = a; 184| 7.56k| uint16_t tmp1, tmp2; 185| | 186| 7.56k| inv = gf_square(a); /* a^2 */ ------------------ | | 52| 7.56k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 187| 7.56k| tmp1 = gf_mul(inv, a); /* a^3 */ ------------------ | | 51| 7.56k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 188| 7.56k| inv = gf_square(inv); /* a^4 */ ------------------ | | 52| 7.56k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 189| 7.56k| tmp2 = gf_mul(inv, tmp1); /* a^7 */ ------------------ | | 51| 7.56k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| 7.56k| tmp1 = gf_mul(inv, tmp2); /* a^11 */ ------------------ | | 51| 7.56k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 7.56k| inv = gf_mul(tmp1, inv); /* a^15 */ ------------------ | | 51| 7.56k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 7.56k| inv = gf_square(inv); /* a^30 */ ------------------ | | 52| 7.56k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| 7.56k| inv = gf_square(inv); /* a^60 */ ------------------ | | 52| 7.56k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 194| 7.56k| inv = gf_square(inv); /* a^120 */ ------------------ | | 52| 7.56k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 195| 7.56k| inv = gf_mul(inv, tmp2); /* a^127 */ ------------------ | | 51| 7.56k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 7.56k| inv = gf_square(inv); /* a^254 */ ------------------ | | 52| 7.56k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 7.56k| return inv; 198| 7.56k|} PQCHQC_HQC5_C_vect_mul: 151| 252|void vect_mul(uint64_t *o, const uint64_t *a1, const uint64_t *a2) { 152| 252| uint64_t unreduced[2 * VEC_N_SIZE_64]; 153| 252| uint64_t tmp_buffer[TMP_BUFFER_WORDS]; 154| | 155| | /* multiply via Karatsuba into unreduced */ 156| 252| karatsuba_mul(unreduced, a1, a2, VEC_N_SIZE_64, tmp_buffer); ------------------ | | 36| 252|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 252|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 252] | | | | ------------------ | | ------------------ ------------------ 157| | 158| | /* reduce modulo X^n - 1 */ 159| 252| reduce(o, unreduced); 160| 252|} PQCHQC_HQC5_C_hqc_pke_keygen: 30| 42|void hqc_pke_keygen(uint8_t *ek_pke, uint8_t *dk_pke, uint8_t *seed) { 31| 42| uint8_t keypair_seed[2 * SEED_BYTES] = {0}; 32| 42| uint8_t *seed_dk = keypair_seed; 33| 42| uint8_t *seed_ek = keypair_seed + SEED_BYTES; ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 34| 42| shake256_xof_ctx dk_xof_ctx = {0}; 35| 42| shake256_xof_ctx ek_xof_ctx = {0}; 36| | 37| 42| uint64_t x[VEC_N_SIZE_64] = {0}; 38| 42| uint64_t y[VEC_N_SIZE_64] = {0}; 39| 42| uint64_t h[VEC_N_SIZE_64] = {0}; 40| 42| uint64_t s[VEC_N_SIZE_64] = {0}; 41| | 42| | // Derive keypair seeds 43| 42| hash_i(keypair_seed, seed); ------------------ | | 79| 42|#define hash_i PQCHQC_NAMESPACE(hash_i) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| | 45| | // Compute decryption key 46| 42| xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 74| 42|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 47| 42| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 42|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 42|#define PARAM_OMEGA 131 ///< Define the parameter omega of the scheme ------------------ 48| 42| vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 16| 42|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 19| 42|#define PARAM_OMEGA 131 ///< Define the parameter omega of the scheme ------------------ 49| 42| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 42|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | // Compute encryption key 52| 42| xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 74| 42|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 53| 42| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 42|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 42| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 42|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 55| 42| vect_mul(s, y, h); ------------------ | | 12| 42|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 56| 42| vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 19| 42|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 36| 42|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 57| | 58| | // Parse encryption key to string 59| 42| memcpy(ek_pke, seed_ek, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 60| 42| memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Parse decryption key to string 63| 42| memcpy(dk_pke, seed_dk, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 64| | 65| |#ifdef VERBOSE 66| | printf("\n\nseed_dk: "); 67| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_dk[i]); 68| | printf("\n\nseed_ek: "); 69| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_ek[i]); 70| | printf("\n\ny: "); 71| | vect_print(y, VEC_N_SIZE_BYTES); 72| | printf("\n\nx: "); 73| | vect_print(x, VEC_N_SIZE_BYTES); 74| | printf("\n\nh: "); 75| | vect_print(h, VEC_N_SIZE_BYTES); 76| | printf("\n\ns: "); 77| | vect_print(s, VEC_N_SIZE_BYTES); 78| |#endif 79| | 80| | // Zeroize sensitive data 81| 42| memset_zero(keypair_seed, sizeof keypair_seed); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 42| memset_zero(x, sizeof x); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 42| memset_zero(y, sizeof y); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 42| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 42|} PQCHQC_HQC5_C_hqc_pke_encrypt: 99| 84|void hqc_pke_encrypt(ciphertext_pke_t *c_pke, const uint8_t *ek_pke, const uint64_t *m, const uint8_t *theta) { 100| 84| shake256_xof_ctx theta_xof_ctx = {0}; 101| 84| uint64_t h[VEC_N_SIZE_64] = {0}; 102| 84| uint64_t s[VEC_N_SIZE_64] = {0}; 103| 84| uint64_t r1[VEC_N_SIZE_64] = {0}; 104| 84| uint64_t r2[VEC_N_SIZE_64] = {0}; 105| 84| uint64_t e[VEC_N_SIZE_64] = {0}; 106| 84| uint64_t tmp[VEC_N_SIZE_64] = {0}; 107| | 108| | // Initialize Xof using theta 109| 84| xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 74| 84|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 52| 84|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 110| | 111| | // Retrieve h and s from public key 112| 84| hqc_ek_pke_from_string(h, s, ek_pke); ------------------ | | 15| 84|#define hqc_ek_pke_from_string PQCHQC_NAMESPACE(hqc_ek_pke_from_string) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| | 114| | // Generate re, e and r1 115| 84| vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 17| 84|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 21| 84|#define PARAM_OMEGA_R 149 ///< Define the parameter omega_r of the scheme ------------------ 116| 84| vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 17| 84|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 20| 84|#define PARAM_OMEGA_E 149 ///< Define the parameter omega_e of the scheme ------------------ 117| 84| vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 17| 84|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 21| 84|#define PARAM_OMEGA_R 149 ///< Define the parameter omega_r of the scheme ------------------ 118| 84| xof_ctx_release(&theta_xof_ctx); ------------------ | | 76| 84|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 119| | 120| | // Compute u = r1 + r2.h 121| 84| vect_mul(c_pke->u, r2, h); ------------------ | | 12| 84|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 84| vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 19| 84|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 36| 84|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 84|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 84] | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Compute v = C.encode(m) 125| 84| code_encode(c_pke->v, m); ------------------ | | 14| 84|#define code_encode PQCHQC_NAMESPACE(code_encode) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 126| | 127| | // Compute v = C.encode(m) + Truncate(s.r2 + e) 128| 84| vect_mul(tmp, r2, s); ------------------ | | 12| 84|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 129| 84| vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 19| 84|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 36| 84|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 84|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 84] | | | | ------------------ | | ------------------ ------------------ 130| 84| vect_truncate(tmp); ------------------ | | 21| 84|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 131| 84| vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 19| 84|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 38| 84|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 84|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 84, Folded] | | | | ------------------ | | ------------------ ------------------ 132| | 133| |#ifdef VERBOSE 134| | printf("\n\nh: "); 135| | vect_print(h, VEC_N_SIZE_BYTES); 136| | printf("\n\ns: "); 137| | vect_print(s, VEC_N_SIZE_BYTES); 138| | printf("\n\nr1: "); 139| | vect_print(r1, VEC_N_SIZE_BYTES); 140| | printf("\n\nr2: "); 141| | vect_print(r2, VEC_N_SIZE_BYTES); 142| | printf("\n\ne: "); 143| | vect_print(e, VEC_N_SIZE_BYTES); 144| | printf("\n\nTruncate(s.r2 + e): "); 145| | vect_print(tmp, VEC_N1N2_SIZE_BYTES); 146| | printf("\n\nc_pke->u: "); 147| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 148| | printf("\n\nc_pke->v: "); 149| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 150| |#endif 151| | 152| | // Zeroize sensitive data 153| 84| memset_zero(r1, sizeof r1); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 154| 84| memset_zero(r2, sizeof r2); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 84| memset_zero(e, sizeof e); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 84| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 84| memset_zero(&theta_xof_ctx, sizeof theta_xof_ctx); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 84|} PQCHQC_HQC5_C_hqc_pke_decrypt: 173| 42|uint8_t hqc_pke_decrypt(uint64_t *m, const uint8_t *dk_pke, const ciphertext_pke_t *c_pke) { 174| 42| uint64_t y[VEC_N_SIZE_64] = {0}; 175| 42| uint64_t tmp1[VEC_N_SIZE_64] = {0}; 176| 42| uint64_t tmp2[VEC_N_SIZE_64] = {0}; 177| | 178| | // Parse decryption key dk_pke 179| 42| hqc_dk_pke_from_string(y, dk_pke); ------------------ | | 14| 42|#define hqc_dk_pke_from_string PQCHQC_NAMESPACE(hqc_dk_pke_from_string) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| | 181| | // Compute u.y 182| 42| vect_mul(tmp1, y, c_pke->u); ------------------ | | 12| 42|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 183| | // Truncate(u.y) 184| 42| vect_truncate(tmp1); ------------------ | | 21| 42|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 185| | // Compute v - Truncate(u.y) 186| 42| vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 19| 42|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 38| 42|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ 187| | 188| |#ifdef VERBOSE 189| | printf("\n\nc_pke.u: "); 190| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 191| | printf("\n\nc_pke.v: "); 192| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 193| | printf("\n\ny: "); 194| | vect_print(y, VEC_N_SIZE_BYTES); 195| | printf("\n\nTruncate(u.y): "); 196| | vect_print(tmp1, VEC_N1N2_SIZE_BYTES); 197| | printf("\n\nv - Truncate(u.y): "); 198| | vect_print(tmp2, VEC_N1N2_SIZE_BYTES); 199| |#endif 200| | 201| | // Compute plaintext m 202| 42| code_decode(m, tmp2); ------------------ | | 15| 42|#define code_decode PQCHQC_NAMESPACE(code_decode) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 203| | 204| | // Zeroize sensitive data 205| 42| memset_zero(y, sizeof y); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 206| 42| memset_zero(tmp1, sizeof tmp1); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 207| 42| memset_zero(tmp2, sizeof tmp2); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 208| | 209| 42| return 0; 210| 42|} PQCHQC_HQC5_C_crypto_kem_keypair: 39| 42|int crypto_kem_keypair(uint8_t *ek_kem, uint8_t *dk_kem) { 40| |#ifdef VERBOSE 41| | printf("\n\n\n### KEYGEN ###"); 42| |#endif 43| 42| uint8_t seed_kem[SEED_BYTES] = {0}; 44| 42| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 45| 42| uint8_t seed_pke[SEED_BYTES] = {0}; 46| 42| shake256_xof_ctx ctx_kem; 47| | 48| 42| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 49| 42| uint8_t dk_pke[SEED_BYTES] = {0}; 50| | 51| 42| prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 73| 42|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 52| | 53| | // Compute seed_pke and randomness sigma 54| 42| xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 74| 42|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 55| 42| xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 75| 42|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 56| 42| xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 75| 42|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 57| 42| xof_ctx_release(&ctx_kem); ------------------ | | 76| 42|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| | 59| | // Compute HQC-PKE keypair 60| 42| hqc_pke_keygen(ek_pke, dk_pke, seed_pke); ------------------ | | 14| 42|#define hqc_pke_keygen PQCHQC_NAMESPACE(hqc_pke_keygen) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Compute HQC-KEM keypair 63| 42| memcpy(ek_kem, ek_pke, PUBLIC_KEY_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ 64| 42| memcpy(dk_kem, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ 65| 42| memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 66| 42| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 67| 42| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 68| | 69| |#ifdef VERBOSE 70| | printf("\n\nseed_kem: "); 71| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_kem[i]); 72| | printf("\n\nseed_pke: "); 73| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_pke[i]); 74| | printf("\n\nsigma: "); 75| | for (int i = 0; i < PARAM_SECURITY_BYTES; ++i) printf("%02x", sigma[i]); 76| |#endif 77| | 78| | // Zeroize sensitive data 79| 42| memset_zero(seed_kem, sizeof seed_kem); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 80| 42| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 81| 42| memset_zero(seed_pke, sizeof seed_pke); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 42| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| | 84| 42| return 0; 85| 42|} PQCHQC_HQC5_C_crypto_kem_enc: 105| 42|int crypto_kem_enc(uint8_t *c_kem, uint8_t *K, const uint8_t *ek_kem) { 106| |#ifdef VERBOSE 107| | printf("\n\n\n\n### ENCAPS ###"); 108| |#endif 109| | 110| 42| uint8_t m[PARAM_SECURITY_BYTES] = {0}; 111| 42| uint8_t K_theta[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 112| 42| uint8_t theta[SEED_BYTES] = {0}; 113| 42| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 114| 42| ciphertext_kem_t c_kem_t = {0}; 115| | 116| | // Sample message m and salt 117| 42| prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 73| 42|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 118| 42| prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 73| 42|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 119| | 120| | // Compute shared key K and ciphertext c_kem 121| 42| hash_h(hash_ek_kem, ek_kem); ------------------ | | 78| 42|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 42| hash_g(K_theta, hash_ek_kem, m, c_kem_t.salt); ------------------ | | 77| 42|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| 42| memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 124| 42| hqc_pke_encrypt(&c_kem_t.c_pke, ek_kem, (uint64_t *)m, theta); ------------------ | | 15| 42|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 42| hqc_c_kem_to_string(c_kem, &c_kem_t); ------------------ | | 16| 42|#define hqc_c_kem_to_string PQCHQC_NAMESPACE(hqc_c_kem_to_string) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 127| 42| memcpy(K, K_theta, SHARED_SECRET_BYTES); ------------------ | | 28| 42|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 42|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 128| | 129| |#ifdef VERBOSE 130| | printf("\n\nek_kem: "); 131| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_kem[i]); 132| | printf("\n\nm: "); 133| | vect_print((uint64_t *)m, PARAM_SECURITY_BYTES); 134| | printf("\n\nsalt: "); 135| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_t.salt[i]); 136| | printf("\n\nH(ek_kem): "); 137| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 138| | printf("\n\ntheta: "); 139| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta[i]); 140| | printf("\n\nc_kem: "); 141| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 142| | printf("\n\nK: "); 143| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K[i]); 144| |#endif 145| | 146| | // Zeroize sensitive data 147| 42| memset_zero(m, sizeof m); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 42| memset_zero(K_theta, sizeof K_theta); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 42| memset_zero(theta, sizeof theta); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| | 151| 42| return 0; 152| 42|} PQCHQC_HQC5_C_crypto_kem_dec: 166| 42|int crypto_kem_dec(uint8_t *K_prime, const uint8_t *c_kem, const uint8_t *dk_kem) { 167| |#ifdef VERBOSE 168| | printf("\n\n\n\n### DECAPS ###"); 169| |#endif 170| | 171| 42| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 172| 42| uint8_t dk_pke[SEED_BYTES] = {0}; 173| 42| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 174| 42| uint8_t m_prime[PARAM_SECURITY_BYTES] = {0}; 175| 42| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 176| 42| uint8_t K_theta_prime[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 177| 42| uint8_t K_bar[SHARED_SECRET_BYTES] = {0}; 178| 42| uint8_t theta_prime[SEED_BYTES] = {0}; 179| 42| ciphertext_kem_t c_kem_t = {0}; 180| 42| ciphertext_kem_t c_kem_prime_t = {0}; 181| 42| uint8_t result; 182| | 183| | // Parse decapsulation key dk_kem 184| 42| memcpy(ek_pke, dk_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ 185| 42| memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 186| 42| memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 187| | 188| | // Parse ciphertext c_kem 189| 42| hqc_c_kem_from_string(&c_kem_t.c_pke, c_kem_t.salt, c_kem); ------------------ | | 17| 42|#define hqc_c_kem_from_string PQCHQC_NAMESPACE(hqc_c_kem_from_string) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| | 191| | // Compute message m_prime 192| 42| result = hqc_pke_decrypt((uint64_t *)m_prime, dk_pke, &c_kem_t.c_pke); ------------------ | | 16| 42|#define hqc_pke_decrypt PQCHQC_NAMESPACE(hqc_pke_decrypt) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| | 194| | // Compute shared key K_prime and ciphertext c_kem_prime 195| 42| hash_h(hash_ek_kem, ek_pke); ------------------ | | 78| 42|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 42| hash_g(K_theta_prime, hash_ek_kem, m_prime, c_kem_t.salt); ------------------ | | 77| 42|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 42| memcpy(K_prime, K_theta_prime, SHARED_SECRET_BYTES); ------------------ | | 28| 42|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 42|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 198| 42| memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 28| 42|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 42|#define CRYPTO_BYTES 32 | | ------------------ ------------------ memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 199| | 200| 42| hqc_pke_encrypt(&c_kem_prime_t.c_pke, ek_pke, (uint64_t *)m_prime, theta_prime); ------------------ | | 15| 42|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 201| 42| memcpy(c_kem_prime_t.salt, c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 202| | 203| | // Compute rejection key K_bar 204| 42| hash_j(K_bar, hash_ek_kem, sigma, &c_kem_t); ------------------ | | 80| 42|#define hash_j PQCHQC_NAMESPACE(hash_j) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 205| 42| result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 20| 42|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 206| 42| result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 20| 42|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ 207| 42| result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 20| 42|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 208| 42| result -= 1; 209| 1.38k| for (size_t i = 0; i < SHARED_SECRET_BYTES; ++i) { ------------------ | | 28| 1.38k|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 1.38k|#define CRYPTO_BYTES 32 | | ------------------ ------------------ | Branch (209:24): [True: 1.34k, False: 42] ------------------ 210| 1.34k| K_prime[i] = (K_prime[i] & result) ^ (K_bar[i] & ~result); 211| 1.34k| } 212| | 213| |#ifdef VERBOSE 214| | printf("\n\nek_pke: "); 215| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_pke[i]); 216| | printf("\n\ndk_pke: "); 217| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", dk_pke[i]); 218| | printf("\n\nc_kem: "); 219| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 220| | printf("\n\nm_prime: "); 221| | vect_print((uint64_t *)m_prime, PARAM_SECURITY_BYTES); 222| | printf("\n\nH(ek_kem): "); 223| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 224| | printf("\n\ntheta_prime: "); 225| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta_prime[i]); 226| | printf("\n\n\n# Checking Ciphertext - Begin #"); 227| | printf("\n\nc_kem_prime_t.c_pke.u: "); 228| | vect_print(c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); 229| | printf("\n\nc_kem_prime_t.c_pke.v: "); 230| | vect_print(c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); 231| | printf("\n\nsalt: "); 232| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_prime_t.salt[i]); 233| | printf("\n\n# Checking Ciphertext - End #\n"); 234| | printf("\n\nK_prime: "); 235| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K_prime[i]); 236| |#endif 237| | 238| | // Zeroize sensitive data 239| 42| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 240| 42| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| 42| memset_zero(m_prime, sizeof m_prime); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 242| 42| memset_zero(K_theta_prime, sizeof K_theta_prime); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 243| 42| memset_zero(K_bar, sizeof K_bar); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| 42| memset_zero(theta_prime, sizeof theta_prime); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 245| | 246| 42| return 0; 247| 42|} PQCHQC_HQC5_C_hqc_dk_pke_from_string: 19| 42|void hqc_dk_pke_from_string(uint64_t *y, const uint8_t *dk_pke) { 20| 42| shake256_xof_ctx dk_xof_ctx = {0}; 21| 42| xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 74| 42|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 22| 42| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 42|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 42|#define PARAM_OMEGA 131 ///< Define the parameter omega of the scheme ------------------ 23| 42| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 42|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 24| | 25| | // Zeroize sensitive data 26| 42| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 27| 42|} PQCHQC_HQC5_C_hqc_ek_pke_from_string: 36| 84|void hqc_ek_pke_from_string(uint64_t *h, uint64_t *s, const uint8_t *ek_pke) { 37| 84| shake256_xof_ctx ek_xof_ctx = {0}; 38| | 39| 84| xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 74| 84|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 52| 84|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 40| 84| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 84|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 84| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 84|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 42| | 43| 84| memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 52| 84|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 31| 84|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 84|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 84] | | | | ------------------ | | ------------------ ------------------ 44| 84|} PQCHQC_HQC5_C_hqc_c_kem_to_string: 52| 42|void hqc_c_kem_to_string(uint8_t *ct, const ciphertext_kem_t *c_kem) { 53| 42| memcpy(ct, c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 54| 42| memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ 55| 42| memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 56| 42|} PQCHQC_HQC5_C_hqc_c_kem_from_string: 65| 42|void hqc_c_kem_from_string(ciphertext_pke_t *c_pke, uint8_t *salt, const uint8_t *ct) { 66| 42| memcpy(c_pke->u, ct, VEC_N_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 67| 42| memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ 68| 42| memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 69| 42|} PQCHQC_HQC5_C_reed_muller_encode: 174| 84|void reed_muller_encode(uint64_t *cdw, const uint64_t *msg) { 175| 84| uint8_t *message_array = (uint8_t *)msg; 176| 84| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 177| 7.64k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 7.64k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 7.64k|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) | | ------------------ ------------------ | Branch (177:24): [True: 7.56k, False: 84] ------------------ 178| | // fill entries i * MULTIPLICITY to (i+1) * MULTIPLICITY 179| 7.56k| int32_t pos = i * MULTIPLICITY; ------------------ | | 18| 7.56k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 7.56k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 7.56k, Folded] | | | | ------------------ | | ------------------ ------------------ 180| | // encode first word 181| 7.56k| encode(&codeArray[pos], message_array[i]); 182| | // copy to other identical codewords 183| 37.8k| for (size_t copy = 1; copy < MULTIPLICITY; copy++) { ------------------ | | 18| 37.8k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 37.8k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 37.8k, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (183:31): [True: 30.2k, False: 7.56k] ------------------ 184| 30.2k| memcpy(&codeArray[pos + copy], &codeArray[pos], sizeof(rm_codeword_t)); 185| 30.2k| } 186| 7.56k| } 187| 84|} PQCHQC_HQC5_C_reed_muller_decode: 198| 42|void reed_muller_decode(uint64_t *msg, const uint64_t *cdw) { 199| 42| uint8_t *message_array = (uint8_t *)msg; 200| 42| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 201| 42| rm_expanded_cdw expanded; 202| 3.82k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 3.82k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 3.82k|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) | | ------------------ ------------------ | Branch (202:24): [True: 3.78k, False: 42] ------------------ 203| | // collect the codewords 204| 3.78k| expand_and_sum(&expanded, &codeArray[i * MULTIPLICITY]); ------------------ | | 18| 3.78k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 3.78k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 3.78k, Folded] | | | | ------------------ | | ------------------ ------------------ 205| | // apply hadamard transform 206| 3.78k| rm_expanded_cdw transform; 207| 3.78k| hadamard(&expanded, &transform); 208| | // fix the first entry to get the half Hadamard transform 209| 3.78k| transform[0] -= 64 * MULTIPLICITY; ------------------ | | 18| 3.78k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 3.78k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 3.78k, Folded] | | | | ------------------ | | ------------------ ------------------ 210| | // finish the decoding 211| 3.78k| message_array[i] = find_peaks(&transform); 212| 3.78k| } 213| 42|} PQCHQC_HQC5_C_reed_solomon_encode: 84| 84|void reed_solomon_encode(uint64_t *cdw, const uint64_t *msg) { 85| 84| size_t i, j, k; 86| 84| uint8_t gate_value = 0; 87| | 88| 84| uint16_t tmp[PARAM_G] = {0}; 89| 84| uint16_t PARAM_RS_POLY[] = {RS_POLY_COEFS}; ------------------ | | 49| 84| 49,167,49,39,200,121,124,91,240,63,148,71,150,123,87,101,32,215,159,71,201,115,97,210,186,183,141,217,123,12,31, \ | | 50| 84| 243,180,219,152,239,99,141,4,246,191,144,8,232,47,27,141,178,130,64,124,47,39,188,216,48,199,187,1 ///< Coefficients of the Reed-Solomon generator polynomial ------------------ 90| | 91| 84| uint8_t msg_bytes[PARAM_K] = {0}; 92| 84| uint8_t cdw_bytes[PARAM_N1] = {0}; 93| | 94| 84| memcpy(msg_bytes, msg, PARAM_K); ------------------ | | 44| 84|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 95| | 96| 2.77k| for (i = 0; i < PARAM_K; ++i) { ------------------ | | 44| 2.77k|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ | Branch (96:17): [True: 2.68k, False: 84] ------------------ 97| 2.68k| gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 2.68k|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 16| 2.68k|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 2.68k|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 98| | 99| 161k| for (j = 0; j < PARAM_G; ++j) { ------------------ | | 45| 161k|#define PARAM_G 59 ///< Define the size of the generator polynomial of the Reed-Solomon code ------------------ | Branch (99:21): [True: 158k, False: 2.68k] ------------------ 100| 158k| tmp[j] = gf_mul(gate_value, PARAM_RS_POLY[j]); ------------------ | | 51| 158k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 158k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 158k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 158k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 101| 158k| } 102| | 103| 155k| for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 16| 2.68k|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 44| 2.68k|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ | Branch (103:42): [True: 153k, False: 2.68k] ------------------ 104| 153k| cdw_bytes[k] = cdw_bytes[k - 1] ^ tmp[k]; 105| 153k| } 106| | 107| 2.68k| cdw_bytes[0] = tmp[0]; 108| 2.68k| } 109| | 110| 84| memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 16| 84|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 84|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 84|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 111| 84| memcpy(cdw, cdw_bytes, PARAM_N1); ------------------ | | 16| 84|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ 112| 84|} PQCHQC_HQC5_C_reed_solomon_decode: 353| 42|void reed_solomon_decode(uint64_t *msg, uint64_t *cdw) { 354| 42| uint8_t cdw_bytes[PARAM_N1] = {0}; 355| 42| uint16_t syndromes[2 * PARAM_DELTA] = {0}; 356| 42| uint16_t sigma[1 << PARAM_FFT] = {0}; 357| 42| uint8_t error[1 << PARAM_M] = {0}; 358| 42| uint16_t z[PARAM_N1] = {0}; 359| 42| uint16_t error_values[PARAM_N1] = {0}; 360| 42| uint16_t deg; 361| | 362| | // Copy the vector in an array of bytes 363| 42| memcpy(cdw_bytes, cdw, PARAM_N1); ------------------ | | 16| 42|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ 364| | 365| | // Calculate the 2*PARAM_DELTA syndromes 366| 42| compute_syndromes(syndromes, cdw_bytes); 367| | 368| | // Compute the error locator polynomial sigma 369| | // Sigma's degree is at most PARAM_DELTA but the FFT requires the extra room 370| 42| deg = compute_elp(sigma, syndromes); 371| | 372| | // Compute the error polynomial error 373| 42| compute_roots(error, sigma); 374| | 375| | // Compute the polynomial z(x) 376| 42| compute_z_poly(z, sigma, deg, syndromes); 377| | 378| | // Compute the error values 379| 42| compute_error_values(error_values, z, error); 380| | 381| | // Correct the errors 382| 42| correct_errors(cdw_bytes, error_values); 383| | 384| | // Retrieve the message from the decoded codeword 385| 42| memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 45| 42|#define PARAM_G 59 ///< Define the size of the generator polynomial of the Reed-Solomon code ------------------ memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 44| 42|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 386| | 387| |#ifdef VERBOSE 388| | printf("\n\nThe syndromes: "); 389| | for (size_t i = 0; i < 2 * PARAM_DELTA; ++i) { 390| | printf("%u ", syndromes[i]); 391| | } 392| | printf("\n\nThe error locator polynomial: sigma(x) = "); 393| | bool first_coeff = true; 394| | if (sigma[0]) { 395| | printf("%u", sigma[0]); 396| | first_coeff = false; 397| | } 398| | for (size_t i = 1; i < (1 << PARAM_FFT); ++i) { 399| | if (sigma[i] == 0) 400| | continue; 401| | if (!first_coeff) 402| | printf(" + "); 403| | first_coeff = false; 404| | if (sigma[i] != 1) 405| | printf("%u ", sigma[i]); 406| | if (i == 1) 407| | printf("x"); 408| | else 409| | printf("x^%zu", i); 410| | } 411| | if (first_coeff) 412| | printf("0"); 413| | 414| | printf("\n\nThe polynomial: z(x) = "); 415| | bool first_coeff_1 = true; 416| | if (z[0]) { 417| | printf("%u", z[0]); 418| | first_coeff_1 = false; 419| | } 420| | for (size_t i = 1; i < (PARAM_DELTA + 1); ++i) { 421| | if (z[i] == 0) 422| | continue; 423| | if (!first_coeff_1) 424| | printf(" + "); 425| | first_coeff_1 = false; 426| | if (z[i] != 1) 427| | printf("%u ", z[i]); 428| | if (i == 1) 429| | printf("x"); 430| | else 431| | printf("x^%zu", i); 432| | } 433| | if (first_coeff_1) 434| | printf("0"); 435| | 436| | printf("\n\nThe pairs of (error locator numbers, error values): "); 437| | size_t j = 0; 438| | for (size_t i = 0; i < PARAM_N1; ++i) { 439| | if (error[i]) { 440| | printf("(%zu, %d) ", i, error_values[j]); 441| | j++; 442| | } 443| | } 444| | printf("\n"); 445| |#endif 446| | 447| | // Zeroize sensitive data 448| 42| memset_zero(cdw_bytes, sizeof cdw_bytes); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 449| 42|} PQCHQC_HQC5_C_prng_get_bytes: 20| 126|void prng_get_bytes(uint8_t *output, uint32_t outlen) { 21| 126| OQS_randombytes(output, outlen); 22| 126|} PQCHQC_HQC5_C_xof_init: 70| 336|void xof_init(shake256_xof_ctx *xof_ctx, const uint8_t *seed, uint32_t seed_size) { 71| 336| uint8_t xof_domain = HQC_XOF_DOMAIN; ------------------ | | 50| 336|#define HQC_XOF_DOMAIN 1 ------------------ 72| 336| OQS_SHA3_shake256_inc_init(xof_ctx); 73| 336| OQS_SHA3_shake256_inc_absorb(xof_ctx, seed, seed_size); 74| 336| OQS_SHA3_shake256_inc_absorb(xof_ctx, &xof_domain, 1); 75| 336| OQS_SHA3_shake256_inc_finalize(xof_ctx); 76| 336|} PQCHQC_HQC5_C_xof_get_bytes: 89| 17.0k|void xof_get_bytes(shake256_xof_ctx *xof_ctx, uint8_t *output, uint32_t output_size) { 90| 17.0k| OQS_SHA3_shake256_inc_squeeze(output, output_size, xof_ctx); 91| 17.0k|} PQCHQC_HQC5_C_xof_ctx_release: 96| 336|void xof_ctx_release(shake256_xof_ctx *xof_ctx) { 97| 336| OQS_SHA3_shake256_inc_ctx_release(xof_ctx); 98| 336|} PQCHQC_HQC5_C_hash_i: 109| 42|void hash_i(uint8_t *output, const uint8_t *seed) { 110| 42| sha3_512_ctx i_hash_ctx = {0}; 111| 42| uint8_t i_domain = HQC_I_FCT_DOMAIN; ------------------ | | 65| 42|#define HQC_I_FCT_DOMAIN 2 ------------------ 112| 42| OQS_SHA3_sha3_512_inc_init(&i_hash_ctx); 113| 42| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, seed, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 114| 42| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, &i_domain, 1); 115| 42| OQS_SHA3_sha3_512_inc_finalize(output, &i_hash_ctx); 116| 42| OQS_SHA3_sha3_512_inc_ctx_release(&i_hash_ctx); 117| 42|} PQCHQC_HQC5_C_hash_h: 125| 84|void hash_h(uint8_t *output, const uint8_t ek_kem[PUBLIC_KEY_BYTES]) { 126| 84| sha3_256_ctx h_hash_ctx = {0}; 127| 84| uint8_t h_domain = HQC_H_FCT_DOMAIN; ------------------ | | 60| 84|#define HQC_H_FCT_DOMAIN 1 ------------------ 128| 84| OQS_SHA3_sha3_256_inc_init(&h_hash_ctx); 129| 84| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 84|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 84|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ 130| 84| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, &h_domain, 1); 131| 84| OQS_SHA3_sha3_256_inc_finalize(output, &h_hash_ctx); 132| 84| OQS_SHA3_sha3_256_inc_ctx_release(&h_hash_ctx); 133| 84|} PQCHQC_HQC5_C_hash_g: 144| 84| const uint8_t salt[SALT_BYTES]) { 145| 84| sha3_512_ctx g_hash_ctx = {0}; 146| 84| uint8_t i_domain = HQC_G_FCT_DOMAIN; ------------------ | | 55| 84|#define HQC_G_FCT_DOMAIN 0 ------------------ 147| 84| OQS_SHA3_sha3_512_inc_init(&g_hash_ctx); 148| 84| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 84|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 149| 84| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, m, PARAM_SECURITY_BYTES); ------------------ | | 23| 84|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 150| 84| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, salt, SALT_BYTES); ------------------ | | 53| 84|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 151| 84| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, &i_domain, 1); 152| 84| OQS_SHA3_sha3_512_inc_finalize(output, &g_hash_ctx); 153| 84| OQS_SHA3_sha3_512_inc_ctx_release(&g_hash_ctx); 154| 84|} PQCHQC_HQC5_C_hash_j: 165| 42| const ciphertext_kem_t *c_kem) { 166| 42| sha3_256_ctx k_hash_ctx = {0}; 167| 42| uint8_t k_domain = HQC_J_FCT_DOMAIN; ------------------ | | 70| 42|#define HQC_J_FCT_DOMAIN 3 ------------------ 168| 42| OQS_SHA3_sha3_256_inc_init(&k_hash_ctx); 169| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 170| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 171| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 172| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ 173| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, c_kem->salt, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 174| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, &k_domain, 1); 175| 42| OQS_SHA3_sha3_256_inc_finalize(output, &k_hash_ctx); 176| 42| OQS_SHA3_sha3_256_inc_ctx_release(&k_hash_ctx); 177| 42|} PQCHQC_HQC5_C_vect_generate_random_support1: 62| 126|void vect_generate_random_support1(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 63| 126| uint8_t rand_bytes[3] = {0}; 64| 126| uint32_t candidate = 0; 65| | 66| 16.6k| for (size_t i = 0; i < weight;) { ------------------ | Branch (66:24): [True: 16.5k, False: 126] ------------------ 67| 16.5k| xof_get_bytes(ctx, rand_bytes, 3); ------------------ | | 75| 16.5k|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 16.5k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 16.5k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 16.5k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 16.5k| candidate = rand_bytes[0] | (rand_bytes[1] << 8) | (rand_bytes[2] << 16); 69| | 70| 16.5k| if (candidate >= UTILS_REJECTION_THRESHOLD) { ------------------ | | 56| 16.5k|#define UTILS_REJECTION_THRESHOLD 16772367 ///< Rejection threshold for uniform sampling in [0, PARAM_N) ------------------ | Branch (70:13): [True: 19, False: 16.5k] ------------------ 71| 19| continue; 72| 19| } 73| 16.5k| candidate = barrett_reduce(candidate); 74| | 75| 16.5k| int is_position_available = 1; 76| 1.09M| for (size_t j = 0; j < i; j++) { ------------------ | Branch (76:28): [True: 1.07M, False: 16.5k] ------------------ 77| 1.07M| if (candidate == support[j]) { ------------------ | Branch (77:17): [True: 47, False: 1.07M] ------------------ 78| 47| is_position_available = 0; 79| 47| break; 80| 47| } 81| 1.07M| } 82| | 83| 16.5k| if (is_position_available == 1) { ------------------ | Branch (83:13): [True: 16.5k, False: 47] ------------------ 84| 16.5k| support[i] = candidate; 85| 16.5k| i++; 86| 16.5k| } 87| 16.5k| } 88| 126|} PQCHQC_HQC5_C_vect_generate_random_support2: 99| 252|void vect_generate_random_support2(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 100| 252| uint32_t rand_u32[PARAM_OMEGA_R] = {0}; 101| | 102| 252| xof_get_bytes(ctx, (uint8_t *)&rand_u32, 4 * weight); ------------------ | | 75| 252|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 252|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 252|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 252|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 103| | 104| 37.8k| for (size_t i = 0; i < weight; ++i) { ------------------ | Branch (104:24): [True: 37.5k, False: 252] ------------------ 105| 37.5k| uint64_t buff = rand_u32[i]; 106| 37.5k| support[i] = i + ((buff * (PARAM_N - i)) >> 32); ------------------ | | 15| 37.5k|#define PARAM_N 57637 ///< Define the parameter n of the scheme ------------------ 107| 37.5k| } 108| | 109| 37.5k| for (int32_t i = (weight - 1); i-- > 0;) { ------------------ | Branch (109:36): [True: 37.2k, False: 252] ------------------ 110| 37.2k| uint32_t found = 0; 111| | 112| 2.81M| for (size_t j = i + 1; j < weight; ++j) { ------------------ | Branch (112:32): [True: 2.77M, False: 37.2k] ------------------ 113| 2.77M| found |= compare_u32(support[j], support[i]); 114| 2.77M| } 115| | 116| 37.2k| uint32_t mask = -found; 117| 37.2k| support[i] = (mask & i) ^ (~mask & support[i]); 118| 37.2k| } 119| 252|} PQCHQC_HQC5_C_vect_write_support_to_vector: 131| 378|void vect_write_support_to_vector(uint64_t *v, uint32_t *support, uint16_t weight) { 132| 378| uint32_t index_tab[PARAM_OMEGA_R] = {0}; 133| 378| uint64_t bit_tab[PARAM_OMEGA_R] = {0}; 134| | 135| 54.4k| for (size_t i = 0; i < weight; i++) { ------------------ | Branch (135:24): [True: 54.0k, False: 378] ------------------ 136| 54.0k| index_tab[i] = support[i] >> 6; 137| 54.0k| int32_t pos = support[i] & 0x3f; 138| 54.0k| bit_tab[i] = ((uint64_t)1) << pos; 139| 54.0k| } 140| | 141| 378| uint64_t val = 0; 142| 340k| for (uint32_t i = 0; i < VEC_N_SIZE_64; i++) { ------------------ | | 36| 340k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 340k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 340k] | | | | ------------------ | | ------------------ ------------------ | Branch (142:26): [True: 340k, False: 378] ------------------ 143| 340k| val = 0; 144| 49.0M| for (uint32_t j = 0; j < weight; j++) { ------------------ | Branch (144:30): [True: 48.7M, False: 340k] ------------------ 145| 48.7M| uint32_t tmp = i - index_tab[j]; 146| 48.7M| int val1 = 1 ^ ((tmp | -tmp) >> 31); 147| 48.7M| uint64_t mask = -val1; 148| 48.7M| val |= (bit_tab[j] & mask); 149| 48.7M| } 150| 340k| v[i] |= val; 151| 340k| } 152| 378|} PQCHQC_HQC5_C_vect_sample_fixed_weight1: 169| 126|void vect_sample_fixed_weight1(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 170| 126| uint32_t support[PARAM_OMEGA_R] = {0}; 171| 126| vect_generate_random_support1(ctx, support, weight); ------------------ | | 13| 126|#define vect_generate_random_support1 PQCHQC_NAMESPACE(vect_generate_random_support1) | | ------------------ | | | | 17| 126|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 126|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 126|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 172| 126| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 126|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 126|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 126|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 126|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 126|} PQCHQC_HQC5_C_vect_sample_fixed_weight2: 188| 252|void vect_sample_fixed_weight2(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 189| 252| uint32_t support[PARAM_OMEGA_R] = {0}; 190| 252| vect_generate_random_support2(ctx, support, weight); ------------------ | | 14| 252|#define vect_generate_random_support2 PQCHQC_NAMESPACE(vect_generate_random_support2) | | ------------------ | | | | 17| 252|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 252|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 252|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 252| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 252|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 252|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 252|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 252|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 252|} PQCHQC_HQC5_C_vect_set_random: 203| 126|void vect_set_random(shake256_xof_ctx *ctx, uint64_t *v) { 204| 126| xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 75| 126|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 126|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 126|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 126|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 31| 126|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 126|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 126] | | | | ------------------ | | ------------------ ------------------ 205| 126| v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 36| 126|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 126|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 126] | | | | ------------------ | | ------------------ ------------------ v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 13| 126|#define BITMASK(a, size) ((((uint64_t) 1UL) << (a % size)) - 1) /*!< Create a mask*/ ------------------ 206| 126|} PQCHQC_HQC5_C_vect_add: 216| 336|void vect_add(uint64_t *o, const uint64_t *v1, const uint64_t *v2, uint32_t size) { 217| 302k| for (uint32_t i = 0; i < size; ++i) { ------------------ | Branch (217:26): [True: 302k, False: 336] ------------------ 218| 302k| o[i] = v1[i] ^ v2[i]; 219| 302k| } 220| 336|} PQCHQC_HQC5_C_vect_compare: 233| 126|uint8_t vect_compare(const uint8_t *v1, const uint8_t *v2, uint32_t size) { 234| 126| uint16_t r = 0x0100; 235| | 236| 605k| for (size_t i = 0; i < size; i++) { ------------------ | Branch (236:24): [True: 605k, False: 126] ------------------ 237| 605k| r |= v1[i] ^ v2[i]; 238| 605k| } 239| | 240| 126| return (r - 1) >> 8; 241| 126|} PQCHQC_HQC5_C_vect_truncate: 249| 126|void vect_truncate(uint64_t *v) { 250| 126| size_t orig_words = (PARAM_N + 63) / 64; ------------------ | | 15| 126|#define PARAM_N 57637 ///< Define the parameter n of the scheme ------------------ 251| 126| size_t new_full_words = PARAM_N1N2 / 64; ------------------ | | 18| 126|#define PARAM_N1N2 57600 ///< Define the length in bits of the concatenated code ------------------ 252| 126| size_t remaining_bits = PARAM_N1N2 % 64; ------------------ | | 18| 126|#define PARAM_N1N2 57600 ///< Define the length in bits of the concatenated code ------------------ 253| | 254| | // Mask the last word if there's a partial word 255| 126| if (remaining_bits > 0) { ------------------ | Branch (255:9): [True: 0, False: 126] ------------------ 256| 0| uint64_t mask = (UINT64_C(1) << remaining_bits) - 1; 257| 0| v[new_full_words] &= mask; 258| 0| new_full_words++; // keep that partial word 259| 0| } 260| | 261| | // Zero out all subsequent words up to the original length 262| 252| for (size_t i = new_full_words; i < orig_words; i++) { ------------------ | Branch (262:37): [True: 126, False: 126] ------------------ 263| 126| v[i] = 0; 264| 126| } 265| 126|} OQS_KEM_alg_identifier: 14| 1.78k|OQS_API const char *OQS_KEM_alg_identifier(size_t i) { 15| | // EDIT-WHEN-ADDING-KEM 16| 1.78k| const char *a[OQS_KEM_algs_length] = { 17| 1.78k| OQS_KEM_alg_bike_l1, ------------------ | | 35| 1.78k|#define OQS_KEM_alg_bike_l1 "BIKE-L1" ------------------ 18| 1.78k| OQS_KEM_alg_bike_l3, ------------------ | | 37| 1.78k|#define OQS_KEM_alg_bike_l3 "BIKE-L3" ------------------ 19| 1.78k| OQS_KEM_alg_bike_l5, ------------------ | | 39| 1.78k|#define OQS_KEM_alg_bike_l5 "BIKE-L5" ------------------ 20| | ///// OQS_COPY_FROM_UPSTREAM_FRAGMENT_ALG_IDENTIFIER_START 21| 1.78k| OQS_KEM_alg_classic_mceliece_348864, ------------------ | | 42| 1.78k|#define OQS_KEM_alg_classic_mceliece_348864 "Classic-McEliece-348864" ------------------ 22| 1.78k| OQS_KEM_alg_classic_mceliece_348864f, ------------------ | | 44| 1.78k|#define OQS_KEM_alg_classic_mceliece_348864f "Classic-McEliece-348864f" ------------------ 23| 1.78k| OQS_KEM_alg_classic_mceliece_460896, ------------------ | | 46| 1.78k|#define OQS_KEM_alg_classic_mceliece_460896 "Classic-McEliece-460896" ------------------ 24| 1.78k| OQS_KEM_alg_classic_mceliece_460896f, ------------------ | | 48| 1.78k|#define OQS_KEM_alg_classic_mceliece_460896f "Classic-McEliece-460896f" ------------------ 25| 1.78k| OQS_KEM_alg_classic_mceliece_6688128, ------------------ | | 50| 1.78k|#define OQS_KEM_alg_classic_mceliece_6688128 "Classic-McEliece-6688128" ------------------ 26| 1.78k| OQS_KEM_alg_classic_mceliece_6688128f, ------------------ | | 52| 1.78k|#define OQS_KEM_alg_classic_mceliece_6688128f "Classic-McEliece-6688128f" ------------------ 27| 1.78k| OQS_KEM_alg_classic_mceliece_6960119, ------------------ | | 54| 1.78k|#define OQS_KEM_alg_classic_mceliece_6960119 "Classic-McEliece-6960119" ------------------ 28| 1.78k| OQS_KEM_alg_classic_mceliece_6960119f, ------------------ | | 56| 1.78k|#define OQS_KEM_alg_classic_mceliece_6960119f "Classic-McEliece-6960119f" ------------------ 29| 1.78k| OQS_KEM_alg_classic_mceliece_8192128, ------------------ | | 58| 1.78k|#define OQS_KEM_alg_classic_mceliece_8192128 "Classic-McEliece-8192128" ------------------ 30| 1.78k| OQS_KEM_alg_classic_mceliece_8192128f, ------------------ | | 60| 1.78k|#define OQS_KEM_alg_classic_mceliece_8192128f "Classic-McEliece-8192128f" ------------------ 31| 1.78k| OQS_KEM_alg_hqc_1, ------------------ | | 62| 1.78k|#define OQS_KEM_alg_hqc_1 "HQC-1" ------------------ 32| 1.78k| OQS_KEM_alg_hqc_3, ------------------ | | 64| 1.78k|#define OQS_KEM_alg_hqc_3 "HQC-3" ------------------ 33| 1.78k| OQS_KEM_alg_hqc_5, ------------------ | | 66| 1.78k|#define OQS_KEM_alg_hqc_5 "HQC-5" ------------------ 34| 1.78k| OQS_KEM_alg_kyber_512, ------------------ | | 68| 1.78k|#define OQS_KEM_alg_kyber_512 "Kyber512" ------------------ 35| 1.78k| OQS_KEM_alg_kyber_768, ------------------ | | 70| 1.78k|#define OQS_KEM_alg_kyber_768 "Kyber768" ------------------ 36| 1.78k| OQS_KEM_alg_kyber_1024, ------------------ | | 72| 1.78k|#define OQS_KEM_alg_kyber_1024 "Kyber1024" ------------------ 37| 1.78k| OQS_KEM_alg_ml_kem_512, ------------------ | | 74| 1.78k|#define OQS_KEM_alg_ml_kem_512 "ML-KEM-512" ------------------ 38| 1.78k| OQS_KEM_alg_ml_kem_768, ------------------ | | 76| 1.78k|#define OQS_KEM_alg_ml_kem_768 "ML-KEM-768" ------------------ 39| 1.78k| OQS_KEM_alg_ml_kem_1024, ------------------ | | 78| 1.78k|#define OQS_KEM_alg_ml_kem_1024 "ML-KEM-1024" ------------------ 40| | ///// OQS_COPY_FROM_UPSTREAM_FRAGMENT_ALG_IDENTIFIER_END 41| 1.78k| OQS_KEM_alg_ntru_hps2048509, ------------------ | | 81| 1.78k|#define OQS_KEM_alg_ntru_hps2048509 "NTRU-HPS-2048-509" ------------------ 42| 1.78k| OQS_KEM_alg_ntru_hps2048677, ------------------ | | 83| 1.78k|#define OQS_KEM_alg_ntru_hps2048677 "NTRU-HPS-2048-677" ------------------ 43| 1.78k| OQS_KEM_alg_ntru_hps4096821, ------------------ | | 85| 1.78k|#define OQS_KEM_alg_ntru_hps4096821 "NTRU-HPS-4096-821" ------------------ 44| 1.78k| OQS_KEM_alg_ntru_hps40961229, ------------------ | | 87| 1.78k|#define OQS_KEM_alg_ntru_hps40961229 "NTRU-HPS-4096-1229" ------------------ 45| 1.78k| OQS_KEM_alg_ntru_hrss701, ------------------ | | 89| 1.78k|#define OQS_KEM_alg_ntru_hrss701 "NTRU-HRSS-701" ------------------ 46| 1.78k| OQS_KEM_alg_ntru_hrss1373, ------------------ | | 91| 1.78k|#define OQS_KEM_alg_ntru_hrss1373 "NTRU-HRSS-1373" ------------------ 47| 1.78k| OQS_KEM_alg_ntruprime_sntrup761, ------------------ | | 93| 1.78k|#define OQS_KEM_alg_ntruprime_sntrup761 "sntrup761" ------------------ 48| 1.78k| OQS_KEM_alg_frodokem_640_aes, ------------------ | | 95| 1.78k|#define OQS_KEM_alg_frodokem_640_aes "FrodoKEM-640-AES" ------------------ 49| 1.78k| OQS_KEM_alg_frodokem_640_shake, ------------------ | | 97| 1.78k|#define OQS_KEM_alg_frodokem_640_shake "FrodoKEM-640-SHAKE" ------------------ 50| 1.78k| OQS_KEM_alg_frodokem_976_aes, ------------------ | | 99| 1.78k|#define OQS_KEM_alg_frodokem_976_aes "FrodoKEM-976-AES" ------------------ 51| 1.78k| OQS_KEM_alg_frodokem_976_shake, ------------------ | | 101| 1.78k|#define OQS_KEM_alg_frodokem_976_shake "FrodoKEM-976-SHAKE" ------------------ 52| 1.78k| OQS_KEM_alg_frodokem_1344_aes, ------------------ | | 103| 1.78k|#define OQS_KEM_alg_frodokem_1344_aes "FrodoKEM-1344-AES" ------------------ 53| 1.78k| OQS_KEM_alg_frodokem_1344_shake, ------------------ | | 105| 1.78k|#define OQS_KEM_alg_frodokem_1344_shake "FrodoKEM-1344-SHAKE" ------------------ 54| 1.78k| OQS_KEM_alg_efrodokem_640_aes, ------------------ | | 107| 1.78k|#define OQS_KEM_alg_efrodokem_640_aes "eFrodoKEM-640-AES" ------------------ 55| 1.78k| OQS_KEM_alg_efrodokem_640_shake, ------------------ | | 109| 1.78k|#define OQS_KEM_alg_efrodokem_640_shake "eFrodoKEM-640-SHAKE" ------------------ 56| 1.78k| OQS_KEM_alg_efrodokem_976_aes, ------------------ | | 111| 1.78k|#define OQS_KEM_alg_efrodokem_976_aes "eFrodoKEM-976-AES" ------------------ 57| 1.78k| OQS_KEM_alg_efrodokem_976_shake, ------------------ | | 113| 1.78k|#define OQS_KEM_alg_efrodokem_976_shake "eFrodoKEM-976-SHAKE" ------------------ 58| 1.78k| OQS_KEM_alg_efrodokem_1344_aes, ------------------ | | 115| 1.78k|#define OQS_KEM_alg_efrodokem_1344_aes "eFrodoKEM-1344-AES" ------------------ 59| 1.78k| OQS_KEM_alg_efrodokem_1344_shake, ------------------ | | 117| 1.78k|#define OQS_KEM_alg_efrodokem_1344_shake "eFrodoKEM-1344-SHAKE" ------------------ 60| 1.78k| }; 61| 1.78k| if (i >= OQS_KEM_algs_length) { ------------------ | | 122| 1.78k|#define OQS_KEM_algs_length 41 ------------------ | Branch (61:6): [True: 0, False: 1.78k] ------------------ 62| 0| return NULL; 63| 1.78k| } else { 64| 1.78k| return a[i]; 65| 1.78k| } 66| 1.78k|} OQS_KEM_new: 348| 1.78k|OQS_API OQS_KEM *OQS_KEM_new(const char *method_name) { 349| 1.78k| if (method_name == NULL) { ------------------ | Branch (349:6): [True: 0, False: 1.78k] ------------------ 350| 0| return NULL; 351| 0| } 352| 1.78k| if (0 == strcasecmp(method_name, OQS_KEM_alg_bike_l1)) { ------------------ | | 35| 1.78k|#define OQS_KEM_alg_bike_l1 "BIKE-L1" ------------------ | Branch (352:6): [True: 5, False: 1.78k] ------------------ 353| 5|#ifdef OQS_ENABLE_KEM_bike_l1 354| 5| return OQS_KEM_bike_l1_new(); 355| |#else 356| | return NULL; 357| |#endif 358| 1.78k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_bike_l3)) { ------------------ | | 37| 1.78k|#define OQS_KEM_alg_bike_l3 "BIKE-L3" ------------------ | Branch (358:13): [True: 1, False: 1.78k] ------------------ 359| 1|#ifdef OQS_ENABLE_KEM_bike_l3 360| 1| return OQS_KEM_bike_l3_new(); 361| |#else 362| | return NULL; 363| |#endif 364| 1.78k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_bike_l5)) { ------------------ | | 39| 1.78k|#define OQS_KEM_alg_bike_l5 "BIKE-L5" ------------------ | Branch (364:13): [True: 1, False: 1.78k] ------------------ 365| 1|#ifdef OQS_ENABLE_KEM_bike_l5 366| 1| return OQS_KEM_bike_l5_new(); 367| |#else 368| | return NULL; 369| |#endif 370| | ///// OQS_COPY_FROM_UPSTREAM_FRAGMENT_NEW_CASE_START 371| 1.78k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_348864)) { ------------------ | | 42| 1.78k|#define OQS_KEM_alg_classic_mceliece_348864 "Classic-McEliece-348864" ------------------ | Branch (371:13): [True: 103, False: 1.67k] ------------------ 372| 103|#ifdef OQS_ENABLE_KEM_classic_mceliece_348864 373| 103| return OQS_KEM_classic_mceliece_348864_new(); 374| |#else 375| | return NULL; 376| |#endif 377| | 378| 1.67k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_348864f)) { ------------------ | | 44| 1.67k|#define OQS_KEM_alg_classic_mceliece_348864f "Classic-McEliece-348864f" ------------------ | Branch (378:13): [True: 80, False: 1.59k] ------------------ 379| 80|#ifdef OQS_ENABLE_KEM_classic_mceliece_348864f 380| 80| return OQS_KEM_classic_mceliece_348864f_new(); 381| |#else 382| | return NULL; 383| |#endif 384| | 385| 1.59k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_460896)) { ------------------ | | 46| 1.59k|#define OQS_KEM_alg_classic_mceliece_460896 "Classic-McEliece-460896" ------------------ | Branch (385:13): [True: 110, False: 1.48k] ------------------ 386| 110|#ifdef OQS_ENABLE_KEM_classic_mceliece_460896 387| 110| return OQS_KEM_classic_mceliece_460896_new(); 388| |#else 389| | return NULL; 390| |#endif 391| | 392| 1.48k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_460896f)) { ------------------ | | 48| 1.48k|#define OQS_KEM_alg_classic_mceliece_460896f "Classic-McEliece-460896f" ------------------ | Branch (392:13): [True: 85, False: 1.40k] ------------------ 393| 85|#ifdef OQS_ENABLE_KEM_classic_mceliece_460896f 394| 85| return OQS_KEM_classic_mceliece_460896f_new(); 395| |#else 396| | return NULL; 397| |#endif 398| | 399| 1.40k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_6688128)) { ------------------ | | 50| 1.40k|#define OQS_KEM_alg_classic_mceliece_6688128 "Classic-McEliece-6688128" ------------------ | Branch (399:13): [True: 99, False: 1.30k] ------------------ 400| 99|#ifdef OQS_ENABLE_KEM_classic_mceliece_6688128 401| 99| return OQS_KEM_classic_mceliece_6688128_new(); 402| |#else 403| | return NULL; 404| |#endif 405| | 406| 1.30k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_6688128f)) { ------------------ | | 52| 1.30k|#define OQS_KEM_alg_classic_mceliece_6688128f "Classic-McEliece-6688128f" ------------------ | Branch (406:13): [True: 91, False: 1.21k] ------------------ 407| 91|#ifdef OQS_ENABLE_KEM_classic_mceliece_6688128f 408| 91| return OQS_KEM_classic_mceliece_6688128f_new(); 409| |#else 410| | return NULL; 411| |#endif 412| | 413| 1.21k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_6960119)) { ------------------ | | 54| 1.21k|#define OQS_KEM_alg_classic_mceliece_6960119 "Classic-McEliece-6960119" ------------------ | Branch (413:13): [True: 109, False: 1.10k] ------------------ 414| 109|#ifdef OQS_ENABLE_KEM_classic_mceliece_6960119 415| 109| return OQS_KEM_classic_mceliece_6960119_new(); 416| |#else 417| | return NULL; 418| |#endif 419| | 420| 1.10k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_6960119f)) { ------------------ | | 56| 1.10k|#define OQS_KEM_alg_classic_mceliece_6960119f "Classic-McEliece-6960119f" ------------------ | Branch (420:13): [True: 90, False: 1.01k] ------------------ 421| 90|#ifdef OQS_ENABLE_KEM_classic_mceliece_6960119f 422| 90| return OQS_KEM_classic_mceliece_6960119f_new(); 423| |#else 424| | return NULL; 425| |#endif 426| | 427| 1.01k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_8192128)) { ------------------ | | 58| 1.01k|#define OQS_KEM_alg_classic_mceliece_8192128 "Classic-McEliece-8192128" ------------------ | Branch (427:13): [True: 85, False: 930] ------------------ 428| 85|#ifdef OQS_ENABLE_KEM_classic_mceliece_8192128 429| 85| return OQS_KEM_classic_mceliece_8192128_new(); 430| |#else 431| | return NULL; 432| |#endif 433| | 434| 930| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_8192128f)) { ------------------ | | 60| 930|#define OQS_KEM_alg_classic_mceliece_8192128f "Classic-McEliece-8192128f" ------------------ | Branch (434:13): [True: 66, False: 864] ------------------ 435| 66|#ifdef OQS_ENABLE_KEM_classic_mceliece_8192128f 436| 66| return OQS_KEM_classic_mceliece_8192128f_new(); 437| |#else 438| | return NULL; 439| |#endif 440| | 441| 864| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_hqc_1)) { ------------------ | | 62| 864|#define OQS_KEM_alg_hqc_1 "HQC-1" ------------------ | Branch (441:13): [True: 39, False: 825] ------------------ 442| 39|#ifdef OQS_ENABLE_KEM_hqc_1 443| 39| return OQS_KEM_hqc_1_new(); 444| |#else 445| | return NULL; 446| |#endif 447| | 448| 825| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_hqc_3)) { ------------------ | | 64| 825|#define OQS_KEM_alg_hqc_3 "HQC-3" ------------------ | Branch (448:13): [True: 38, False: 787] ------------------ 449| 38|#ifdef OQS_ENABLE_KEM_hqc_3 450| 38| return OQS_KEM_hqc_3_new(); 451| |#else 452| | return NULL; 453| |#endif 454| | 455| 787| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_hqc_5)) { ------------------ | | 66| 787|#define OQS_KEM_alg_hqc_5 "HQC-5" ------------------ | Branch (455:13): [True: 42, False: 745] ------------------ 456| 42|#ifdef OQS_ENABLE_KEM_hqc_5 457| 42| return OQS_KEM_hqc_5_new(); 458| |#else 459| | return NULL; 460| |#endif 461| | 462| 745| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_kyber_512)) { ------------------ | | 68| 745|#define OQS_KEM_alg_kyber_512 "Kyber512" ------------------ | Branch (462:13): [True: 57, False: 688] ------------------ 463| 57|#ifdef OQS_ENABLE_KEM_kyber_512 464| 57| return OQS_KEM_kyber_512_new(); 465| |#else 466| | return NULL; 467| |#endif 468| | 469| 688| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_kyber_768)) { ------------------ | | 70| 688|#define OQS_KEM_alg_kyber_768 "Kyber768" ------------------ | Branch (469:13): [True: 126, False: 562] ------------------ 470| 126|#ifdef OQS_ENABLE_KEM_kyber_768 471| 126| return OQS_KEM_kyber_768_new(); 472| |#else 473| | return NULL; 474| |#endif 475| | 476| 562| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_kyber_1024)) { ------------------ | | 72| 562|#define OQS_KEM_alg_kyber_1024 "Kyber1024" ------------------ | Branch (476:13): [True: 78, False: 484] ------------------ 477| 78|#ifdef OQS_ENABLE_KEM_kyber_1024 478| 78| return OQS_KEM_kyber_1024_new(); 479| |#else 480| | return NULL; 481| |#endif 482| | 483| 484| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ml_kem_512)) { ------------------ | | 74| 484|#define OQS_KEM_alg_ml_kem_512 "ML-KEM-512" ------------------ | Branch (483:13): [True: 27, False: 457] ------------------ 484| 27|#ifdef OQS_ENABLE_KEM_ml_kem_512 485| 27| return OQS_KEM_ml_kem_512_new(); 486| |#else 487| | return NULL; 488| |#endif 489| | 490| 457| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ml_kem_768)) { ------------------ | | 76| 457|#define OQS_KEM_alg_ml_kem_768 "ML-KEM-768" ------------------ | Branch (490:13): [True: 28, False: 429] ------------------ 491| 28|#ifdef OQS_ENABLE_KEM_ml_kem_768 492| 28| return OQS_KEM_ml_kem_768_new(); 493| |#else 494| | return NULL; 495| |#endif 496| | 497| 429| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ml_kem_1024)) { ------------------ | | 78| 429|#define OQS_KEM_alg_ml_kem_1024 "ML-KEM-1024" ------------------ | Branch (497:13): [True: 25, False: 404] ------------------ 498| 25|#ifdef OQS_ENABLE_KEM_ml_kem_1024 499| 25| return OQS_KEM_ml_kem_1024_new(); 500| |#else 501| | return NULL; 502| |#endif 503| | 504| | ///// OQS_COPY_FROM_UPSTREAM_FRAGMENT_NEW_CASE_END 505| 404| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hps2048509)) { ------------------ | | 81| 404|#define OQS_KEM_alg_ntru_hps2048509 "NTRU-HPS-2048-509" ------------------ | Branch (505:13): [True: 174, False: 230] ------------------ 506| 174|#ifdef OQS_ENABLE_KEM_ntru_hps2048509 507| 174| return OQS_KEM_ntru_hps2048509_new(); 508| |#else 509| | return NULL; 510| |#endif 511| 230| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hps2048677)) { ------------------ | | 83| 230|#define OQS_KEM_alg_ntru_hps2048677 "NTRU-HPS-2048-677" ------------------ | Branch (511:13): [True: 15, False: 215] ------------------ 512| 15|#ifdef OQS_ENABLE_KEM_ntru_hps2048677 513| 15| return OQS_KEM_ntru_hps2048677_new(); 514| |#else 515| | return NULL; 516| |#endif 517| 215| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hps4096821)) { ------------------ | | 85| 215|#define OQS_KEM_alg_ntru_hps4096821 "NTRU-HPS-4096-821" ------------------ | Branch (517:13): [True: 84, False: 131] ------------------ 518| 84|#ifdef OQS_ENABLE_KEM_ntru_hps4096821 519| 84| return OQS_KEM_ntru_hps4096821_new(); 520| |#else 521| | return NULL; 522| |#endif 523| 131| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hps40961229)) { ------------------ | | 87| 131|#define OQS_KEM_alg_ntru_hps40961229 "NTRU-HPS-4096-1229" ------------------ | Branch (523:13): [True: 34, False: 97] ------------------ 524| 34|#ifdef OQS_ENABLE_KEM_ntru_hps40961229 525| 34| return OQS_KEM_ntru_hps40961229_new(); 526| |#else 527| | return NULL; 528| |#endif 529| 97| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hrss701)) { ------------------ | | 89| 97|#define OQS_KEM_alg_ntru_hrss701 "NTRU-HRSS-701" ------------------ | Branch (529:13): [True: 8, False: 89] ------------------ 530| 8|#ifdef OQS_ENABLE_KEM_ntru_hrss701 531| 8| return OQS_KEM_ntru_hrss701_new(); 532| |#else 533| | return NULL; 534| |#endif 535| 89| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hrss1373)) { ------------------ | | 91| 89|#define OQS_KEM_alg_ntru_hrss1373 "NTRU-HRSS-1373" ------------------ | Branch (535:13): [True: 2, False: 87] ------------------ 536| 2|#ifdef OQS_ENABLE_KEM_ntru_hrss1373 537| 2| return OQS_KEM_ntru_hrss1373_new(); 538| |#else 539| | return NULL; 540| |#endif 541| 87| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntruprime_sntrup761)) { ------------------ | | 93| 87|#define OQS_KEM_alg_ntruprime_sntrup761 "sntrup761" ------------------ | Branch (541:13): [True: 9, False: 78] ------------------ 542| 9|#ifdef OQS_ENABLE_KEM_ntruprime_sntrup761 543| 9| return OQS_KEM_ntruprime_sntrup761_new(); 544| |#else 545| | return NULL; 546| |#endif 547| 78| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_640_aes)) { ------------------ | | 95| 78|#define OQS_KEM_alg_frodokem_640_aes "FrodoKEM-640-AES" ------------------ | Branch (547:13): [True: 2, False: 76] ------------------ 548| 2|#ifdef OQS_ENABLE_KEM_frodokem_640_aes 549| 2| return OQS_KEM_frodokem_640_aes_new(); 550| |#else 551| | return NULL; 552| |#endif 553| 76| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_640_shake)) { ------------------ | | 97| 76|#define OQS_KEM_alg_frodokem_640_shake "FrodoKEM-640-SHAKE" ------------------ | Branch (553:13): [True: 3, False: 73] ------------------ 554| 3|#ifdef OQS_ENABLE_KEM_frodokem_640_shake 555| 3| return OQS_KEM_frodokem_640_shake_new(); 556| |#else 557| | return NULL; 558| |#endif 559| 73| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_976_aes)) { ------------------ | | 99| 73|#define OQS_KEM_alg_frodokem_976_aes "FrodoKEM-976-AES" ------------------ | Branch (559:13): [True: 9, False: 64] ------------------ 560| 9|#ifdef OQS_ENABLE_KEM_frodokem_976_aes 561| 9| return OQS_KEM_frodokem_976_aes_new(); 562| |#else 563| | return NULL; 564| |#endif 565| 64| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_976_shake)) { ------------------ | | 101| 64|#define OQS_KEM_alg_frodokem_976_shake "FrodoKEM-976-SHAKE" ------------------ | Branch (565:13): [True: 13, False: 51] ------------------ 566| 13|#ifdef OQS_ENABLE_KEM_frodokem_976_shake 567| 13| return OQS_KEM_frodokem_976_shake_new(); 568| |#else 569| | return NULL; 570| |#endif 571| 51| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_1344_aes)) { ------------------ | | 103| 51|#define OQS_KEM_alg_frodokem_1344_aes "FrodoKEM-1344-AES" ------------------ | Branch (571:13): [True: 9, False: 42] ------------------ 572| 9|#ifdef OQS_ENABLE_KEM_frodokem_1344_aes 573| 9| return OQS_KEM_frodokem_1344_aes_new(); 574| |#else 575| | return NULL; 576| |#endif 577| 42| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_1344_shake)) { ------------------ | | 105| 42|#define OQS_KEM_alg_frodokem_1344_shake "FrodoKEM-1344-SHAKE" ------------------ | Branch (577:13): [True: 8, False: 34] ------------------ 578| 8|#ifdef OQS_ENABLE_KEM_frodokem_1344_shake 579| 8| return OQS_KEM_frodokem_1344_shake_new(); 580| |#else 581| | return NULL; 582| |#endif 583| 34| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_640_aes)) { ------------------ | | 107| 34|#define OQS_KEM_alg_efrodokem_640_aes "eFrodoKEM-640-AES" ------------------ | Branch (583:13): [True: 4, False: 30] ------------------ 584| 4|#ifdef OQS_ENABLE_KEM_efrodokem_640_aes 585| 4| return OQS_KEM_efrodokem_640_aes_new(); 586| |#else 587| | return NULL; 588| |#endif 589| 30| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_640_shake)) { ------------------ | | 109| 30|#define OQS_KEM_alg_efrodokem_640_shake "eFrodoKEM-640-SHAKE" ------------------ | Branch (589:13): [True: 3, False: 27] ------------------ 590| 3|#ifdef OQS_ENABLE_KEM_efrodokem_640_shake 591| 3| return OQS_KEM_efrodokem_640_shake_new(); 592| |#else 593| | return NULL; 594| |#endif 595| 27| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_976_aes)) { ------------------ | | 111| 27|#define OQS_KEM_alg_efrodokem_976_aes "eFrodoKEM-976-AES" ------------------ | Branch (595:13): [True: 8, False: 19] ------------------ 596| 8|#ifdef OQS_ENABLE_KEM_efrodokem_976_aes 597| 8| return OQS_KEM_efrodokem_976_aes_new(); 598| |#else 599| | return NULL; 600| |#endif 601| 19| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_976_shake)) { ------------------ | | 113| 19|#define OQS_KEM_alg_efrodokem_976_shake "eFrodoKEM-976-SHAKE" ------------------ | Branch (601:13): [True: 8, False: 11] ------------------ 602| 8|#ifdef OQS_ENABLE_KEM_efrodokem_976_shake 603| 8| return OQS_KEM_efrodokem_976_shake_new(); 604| |#else 605| | return NULL; 606| |#endif 607| 11| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_1344_aes)) { ------------------ | | 115| 11|#define OQS_KEM_alg_efrodokem_1344_aes "eFrodoKEM-1344-AES" ------------------ | Branch (607:13): [True: 8, False: 3] ------------------ 608| 8|#ifdef OQS_ENABLE_KEM_efrodokem_1344_aes 609| 8| return OQS_KEM_efrodokem_1344_aes_new(); 610| |#else 611| | return NULL; 612| |#endif 613| 8| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_1344_shake)) { ------------------ | | 117| 3|#define OQS_KEM_alg_efrodokem_1344_shake "eFrodoKEM-1344-SHAKE" ------------------ | Branch (613:13): [True: 3, False: 0] ------------------ 614| 3|#ifdef OQS_ENABLE_KEM_efrodokem_1344_shake 615| 3| return OQS_KEM_efrodokem_1344_shake_new(); 616| |#else 617| | return NULL; 618| |#endif 619| | // EDIT-WHEN-ADDING-KEM 620| 3| } else { 621| | return NULL; 622| 0| } 623| 1.78k|} OQS_KEM_keypair: 633| 1.78k|OQS_API OQS_STATUS OQS_KEM_keypair(const OQS_KEM *kem, uint8_t *public_key, uint8_t *secret_key) { 634| 1.78k| if (kem == NULL || kem->keypair == NULL) { ------------------ | Branch (634:6): [True: 0, False: 1.78k] | Branch (634:21): [True: 0, False: 1.78k] ------------------ 635| 0| return OQS_ERROR; 636| 1.78k| } else { 637| 1.78k| return kem->keypair(public_key, secret_key); 638| 1.78k| } 639| 1.78k|} OQS_KEM_encaps: 649| 1.78k|OQS_API OQS_STATUS OQS_KEM_encaps(const OQS_KEM *kem, uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 650| 1.78k| if (kem == NULL || kem->encaps == NULL) { ------------------ | Branch (650:6): [True: 0, False: 1.78k] | Branch (650:21): [True: 0, False: 1.78k] ------------------ 651| 0| return OQS_ERROR; 652| 1.78k| } else { 653| 1.78k| return kem->encaps(ciphertext, shared_secret, public_key); 654| 1.78k| } 655| 1.78k|} OQS_KEM_decaps: 657| 1.78k|OQS_API OQS_STATUS OQS_KEM_decaps(const OQS_KEM *kem, uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 658| 1.78k| if (kem == NULL || kem->decaps == NULL) { ------------------ | Branch (658:6): [True: 0, False: 1.78k] | Branch (658:21): [True: 0, False: 1.78k] ------------------ 659| 0| return OQS_ERROR; 660| 1.78k| } else { 661| 1.78k| return kem->decaps(shared_secret, ciphertext, secret_key); 662| 1.78k| } 663| 1.78k|} OQS_KEM_free: 665| 1.78k|OQS_API void OQS_KEM_free(OQS_KEM *kem) { 666| 1.78k| OQS_MEM_insecure_free(kem); 667| 1.78k|} OQS_KEM_kyber_1024_new: 9| 78|OQS_KEM *OQS_KEM_kyber_1024_new(void) { 10| | 11| 78| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 78| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 78] ------------------ 13| 0| return NULL; 14| 0| } 15| 78| kem->method_name = OQS_KEM_alg_kyber_1024; ------------------ | | 72| 78|#define OQS_KEM_alg_kyber_1024 "Kyber1024" ------------------ 16| 78| kem->alg_version = "https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff"; 17| | 18| 78| kem->claimed_nist_level = 5; 19| 78| kem->ind_cca = true; 20| | 21| 78| kem->length_public_key = OQS_KEM_kyber_1024_length_public_key; ------------------ | | 39| 78|#define OQS_KEM_kyber_1024_length_public_key 1568 ------------------ 22| 78| kem->length_secret_key = OQS_KEM_kyber_1024_length_secret_key; ------------------ | | 40| 78|#define OQS_KEM_kyber_1024_length_secret_key 3168 ------------------ 23| 78| kem->length_ciphertext = OQS_KEM_kyber_1024_length_ciphertext; ------------------ | | 41| 78|#define OQS_KEM_kyber_1024_length_ciphertext 1568 ------------------ 24| 78| kem->length_shared_secret = OQS_KEM_kyber_1024_length_shared_secret; ------------------ | | 42| 78|#define OQS_KEM_kyber_1024_length_shared_secret 32 ------------------ 25| 78| kem->length_keypair_seed = OQS_KEM_kyber_1024_length_keypair_seed; ------------------ | | 43| 78|#define OQS_KEM_kyber_1024_length_keypair_seed 0 ------------------ 26| 78| kem->length_encaps_seed = OQS_KEM_kyber_1024_length_encaps_seed; ------------------ | | 44| 78|#define OQS_KEM_kyber_1024_length_encaps_seed 0 ------------------ 27| | 28| 78| kem->keypair = OQS_KEM_kyber_1024_keypair; 29| 78| kem->keypair_derand = OQS_KEM_kyber_1024_keypair_derand; 30| 78| kem->encaps = OQS_KEM_kyber_1024_encaps; 31| 78| kem->encaps_derand = OQS_KEM_kyber_1024_encaps_derand; 32| 78| kem->decaps = OQS_KEM_kyber_1024_decaps; 33| | 34| 78| return kem; 35| 78|} OQS_KEM_kyber_1024_keypair: 60| 78|OQS_API OQS_STATUS OQS_KEM_kyber_1024_keypair(uint8_t *public_key, uint8_t *secret_key) { 61| 78|#if defined(OQS_ENABLE_KEM_kyber_1024_avx2) 62| 78|#if defined(OQS_DIST_BUILD) 63| 78| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (63:6): [True: 78, False: 0] | Branch (63:49): [True: 78, False: 0] | Branch (63:92): [True: 78, False: 0] ------------------ 64| 78|#endif /* OQS_DIST_BUILD */ 65| 78| return (OQS_STATUS) pqcrystals_kyber1024_avx2_keypair(public_key, secret_key); 66| 78|#if defined(OQS_DIST_BUILD) 67| 78| } else { 68| 0| return (OQS_STATUS) pqcrystals_kyber1024_ref_keypair(public_key, secret_key); 69| 0| } 70| 78|#endif /* OQS_DIST_BUILD */ 71| |#elif defined(OQS_ENABLE_KEM_kyber_1024_aarch64) 72| |#if defined(OQS_DIST_BUILD) 73| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 74| |#endif /* OQS_DIST_BUILD */ 75| | return (OQS_STATUS) PQCLEAN_KYBER1024_AARCH64_crypto_kem_keypair(public_key, secret_key); 76| |#if defined(OQS_DIST_BUILD) 77| | } else { 78| | return (OQS_STATUS) pqcrystals_kyber1024_ref_keypair(public_key, secret_key); 79| | } 80| |#endif /* OQS_DIST_BUILD */ 81| |#else 82| | return (OQS_STATUS) pqcrystals_kyber1024_ref_keypair(public_key, secret_key); 83| |#endif 84| 78|} OQS_KEM_kyber_1024_encaps: 94| 78|OQS_API OQS_STATUS OQS_KEM_kyber_1024_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 95| 78|#if defined(OQS_ENABLE_KEM_kyber_1024_avx2) 96| 78|#if defined(OQS_DIST_BUILD) 97| 78| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 78, False: 0] | Branch (97:49): [True: 78, False: 0] | Branch (97:92): [True: 78, False: 0] ------------------ 98| 78|#endif /* OQS_DIST_BUILD */ 99| 78| return (OQS_STATUS) pqcrystals_kyber1024_avx2_enc(ciphertext, shared_secret, public_key); 100| 78|#if defined(OQS_DIST_BUILD) 101| 78| } else { 102| 0| return (OQS_STATUS) pqcrystals_kyber1024_ref_enc(ciphertext, shared_secret, public_key); 103| 0| } 104| 78|#endif /* OQS_DIST_BUILD */ 105| |#elif defined(OQS_ENABLE_KEM_kyber_1024_aarch64) 106| |#if defined(OQS_DIST_BUILD) 107| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 108| |#endif /* OQS_DIST_BUILD */ 109| | return (OQS_STATUS) PQCLEAN_KYBER1024_AARCH64_crypto_kem_enc(ciphertext, shared_secret, public_key); 110| |#if defined(OQS_DIST_BUILD) 111| | } else { 112| | return (OQS_STATUS) pqcrystals_kyber1024_ref_enc(ciphertext, shared_secret, public_key); 113| | } 114| |#endif /* OQS_DIST_BUILD */ 115| |#else 116| | return (OQS_STATUS) pqcrystals_kyber1024_ref_enc(ciphertext, shared_secret, public_key); 117| |#endif 118| 78|} OQS_KEM_kyber_1024_decaps: 120| 78|OQS_API OQS_STATUS OQS_KEM_kyber_1024_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 121| 78|#if defined(OQS_ENABLE_KEM_kyber_1024_avx2) 122| 78|#if defined(OQS_DIST_BUILD) 123| 78| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (123:6): [True: 78, False: 0] | Branch (123:49): [True: 78, False: 0] | Branch (123:92): [True: 78, False: 0] ------------------ 124| 78|#endif /* OQS_DIST_BUILD */ 125| 78| return (OQS_STATUS) pqcrystals_kyber1024_avx2_dec(shared_secret, ciphertext, secret_key); 126| 78|#if defined(OQS_DIST_BUILD) 127| 78| } else { 128| 0| return (OQS_STATUS) pqcrystals_kyber1024_ref_dec(shared_secret, ciphertext, secret_key); 129| 0| } 130| 78|#endif /* OQS_DIST_BUILD */ 131| |#elif defined(OQS_ENABLE_KEM_kyber_1024_aarch64) 132| |#if defined(OQS_DIST_BUILD) 133| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 134| |#endif /* OQS_DIST_BUILD */ 135| | return (OQS_STATUS) PQCLEAN_KYBER1024_AARCH64_crypto_kem_dec(shared_secret, ciphertext, secret_key); 136| |#if defined(OQS_DIST_BUILD) 137| | } else { 138| | return (OQS_STATUS) pqcrystals_kyber1024_ref_dec(shared_secret, ciphertext, secret_key); 139| | } 140| |#endif /* OQS_DIST_BUILD */ 141| |#else 142| | return (OQS_STATUS) pqcrystals_kyber1024_ref_dec(shared_secret, ciphertext, secret_key); 143| |#endif 144| 78|} OQS_KEM_kyber_512_new: 9| 57|OQS_KEM *OQS_KEM_kyber_512_new(void) { 10| | 11| 57| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 57| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 57] ------------------ 13| 0| return NULL; 14| 0| } 15| 57| kem->method_name = OQS_KEM_alg_kyber_512; ------------------ | | 68| 57|#define OQS_KEM_alg_kyber_512 "Kyber512" ------------------ 16| 57| kem->alg_version = "https://github.com/pq-crystals/kyber/commit/74cad307858b61e434490c75f812cb9b9ef7279b"; 17| | 18| 57| kem->claimed_nist_level = 1; 19| 57| kem->ind_cca = true; 20| | 21| 57| kem->length_public_key = OQS_KEM_kyber_512_length_public_key; ------------------ | | 9| 57|#define OQS_KEM_kyber_512_length_public_key 800 ------------------ 22| 57| kem->length_secret_key = OQS_KEM_kyber_512_length_secret_key; ------------------ | | 10| 57|#define OQS_KEM_kyber_512_length_secret_key 1632 ------------------ 23| 57| kem->length_ciphertext = OQS_KEM_kyber_512_length_ciphertext; ------------------ | | 11| 57|#define OQS_KEM_kyber_512_length_ciphertext 768 ------------------ 24| 57| kem->length_shared_secret = OQS_KEM_kyber_512_length_shared_secret; ------------------ | | 12| 57|#define OQS_KEM_kyber_512_length_shared_secret 32 ------------------ 25| 57| kem->length_keypair_seed = OQS_KEM_kyber_512_length_keypair_seed; ------------------ | | 13| 57|#define OQS_KEM_kyber_512_length_keypair_seed 0 ------------------ 26| 57| kem->length_encaps_seed = OQS_KEM_kyber_512_length_encaps_seed; ------------------ | | 14| 57|#define OQS_KEM_kyber_512_length_encaps_seed 0 ------------------ 27| | 28| 57| kem->keypair = OQS_KEM_kyber_512_keypair; 29| 57| kem->keypair_derand = OQS_KEM_kyber_512_keypair_derand; 30| 57| kem->encaps = OQS_KEM_kyber_512_encaps; 31| 57| kem->encaps_derand = OQS_KEM_kyber_512_encaps_derand; 32| 57| kem->decaps = OQS_KEM_kyber_512_decaps; 33| | 34| 57| return kem; 35| 57|} OQS_KEM_kyber_512_keypair: 73| 57|OQS_API OQS_STATUS OQS_KEM_kyber_512_keypair(uint8_t *public_key, uint8_t *secret_key) { 74| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_512)) 75| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_512_avx2) 76| |#if defined(OQS_DIST_BUILD) 77| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 78| |#endif /* OQS_DIST_BUILD */ 79| | return (OQS_STATUS) libjade_kyber512_avx2_keypair(public_key, secret_key); 80| |#if defined(OQS_DIST_BUILD) 81| | } else { 82| | return (OQS_STATUS) libjade_kyber512_ref_keypair(public_key, secret_key); 83| | } 84| |#endif /* OQS_DIST_BUILD */ 85| |#else 86| | return (OQS_STATUS) libjade_kyber512_ref_keypair(public_key, secret_key); 87| |#endif 88| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_512)*/ 89| 57|#if defined(OQS_ENABLE_KEM_kyber_512_avx2) 90| 57|#if defined(OQS_DIST_BUILD) 91| 57| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (91:6): [True: 57, False: 0] | Branch (91:49): [True: 57, False: 0] | Branch (91:92): [True: 57, False: 0] ------------------ 92| 57|#endif /* OQS_DIST_BUILD */ 93| 57| return (OQS_STATUS) pqcrystals_kyber512_avx2_keypair(public_key, secret_key); 94| 57|#if defined(OQS_DIST_BUILD) 95| 57| } else { 96| 0| return (OQS_STATUS) pqcrystals_kyber512_ref_keypair(public_key, secret_key); 97| 0| } 98| 57|#endif /* OQS_DIST_BUILD */ 99| |#elif defined(OQS_ENABLE_KEM_kyber_512_aarch64) 100| |#if defined(OQS_DIST_BUILD) 101| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 102| |#endif /* OQS_DIST_BUILD */ 103| | return (OQS_STATUS) PQCLEAN_KYBER512_AARCH64_crypto_kem_keypair(public_key, secret_key); 104| |#if defined(OQS_DIST_BUILD) 105| | } else { 106| | return (OQS_STATUS) pqcrystals_kyber512_ref_keypair(public_key, secret_key); 107| | } 108| |#endif /* OQS_DIST_BUILD */ 109| |#else 110| | return (OQS_STATUS) pqcrystals_kyber512_ref_keypair(public_key, secret_key); 111| |#endif 112| 57|#endif /* OQS_LIBJADE_BUILD */ 113| 57|} OQS_KEM_kyber_512_encaps: 123| 57|OQS_API OQS_STATUS OQS_KEM_kyber_512_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 124| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_512)) 125| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_512_avx2) 126| |#if defined(OQS_DIST_BUILD) 127| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 128| |#endif /* OQS_DIST_BUILD */ 129| | return (OQS_STATUS) libjade_kyber512_avx2_enc(ciphertext, shared_secret, public_key); 130| |#if defined(OQS_DIST_BUILD) 131| | } else { 132| | return (OQS_STATUS) libjade_kyber512_ref_enc(ciphertext, shared_secret, public_key); 133| | } 134| |#endif /* OQS_DIST_BUILD */ 135| |#else 136| | return (OQS_STATUS) libjade_kyber512_ref_enc(ciphertext, shared_secret, public_key); 137| |#endif 138| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_512)*/ 139| 57|#if defined(OQS_ENABLE_KEM_kyber_512_avx2) 140| 57|#if defined(OQS_DIST_BUILD) 141| 57| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (141:6): [True: 57, False: 0] | Branch (141:49): [True: 57, False: 0] | Branch (141:92): [True: 57, False: 0] ------------------ 142| 57|#endif /* OQS_DIST_BUILD */ 143| 57| return (OQS_STATUS) pqcrystals_kyber512_avx2_enc(ciphertext, shared_secret, public_key); 144| 57|#if defined(OQS_DIST_BUILD) 145| 57| } else { 146| 0| return (OQS_STATUS) pqcrystals_kyber512_ref_enc(ciphertext, shared_secret, public_key); 147| 0| } 148| 57|#endif /* OQS_DIST_BUILD */ 149| |#elif defined(OQS_ENABLE_KEM_kyber_512_aarch64) 150| |#if defined(OQS_DIST_BUILD) 151| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 152| |#endif /* OQS_DIST_BUILD */ 153| | return (OQS_STATUS) PQCLEAN_KYBER512_AARCH64_crypto_kem_enc(ciphertext, shared_secret, public_key); 154| |#if defined(OQS_DIST_BUILD) 155| | } else { 156| | return (OQS_STATUS) pqcrystals_kyber512_ref_enc(ciphertext, shared_secret, public_key); 157| | } 158| |#endif /* OQS_DIST_BUILD */ 159| |#else 160| | return (OQS_STATUS) pqcrystals_kyber512_ref_enc(ciphertext, shared_secret, public_key); 161| |#endif 162| 57|#endif /* OQS_LIBJADE_BUILD */ 163| 57|} OQS_KEM_kyber_512_decaps: 165| 57|OQS_API OQS_STATUS OQS_KEM_kyber_512_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 166| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_512)) 167| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_512_avx2) 168| |#if defined(OQS_DIST_BUILD) 169| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 170| |#endif /* OQS_DIST_BUILD */ 171| | return (OQS_STATUS) libjade_kyber512_avx2_dec(shared_secret, ciphertext, secret_key); 172| |#if defined(OQS_DIST_BUILD) 173| | } else { 174| | return (OQS_STATUS) libjade_kyber512_ref_dec(shared_secret, ciphertext, secret_key); 175| | } 176| |#endif /* OQS_DIST_BUILD */ 177| |#else 178| | return (OQS_STATUS) libjade_kyber512_ref_dec(shared_secret, ciphertext, secret_key); 179| |#endif 180| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_512)*/ 181| 57|#if defined(OQS_ENABLE_KEM_kyber_512_avx2) 182| 57|#if defined(OQS_DIST_BUILD) 183| 57| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (183:6): [True: 57, False: 0] | Branch (183:49): [True: 57, False: 0] | Branch (183:92): [True: 57, False: 0] ------------------ 184| 57|#endif /* OQS_DIST_BUILD */ 185| 57| return (OQS_STATUS) pqcrystals_kyber512_avx2_dec(shared_secret, ciphertext, secret_key); 186| 57|#if defined(OQS_DIST_BUILD) 187| 57| } else { 188| 0| return (OQS_STATUS) pqcrystals_kyber512_ref_dec(shared_secret, ciphertext, secret_key); 189| 0| } 190| 57|#endif /* OQS_DIST_BUILD */ 191| |#elif defined(OQS_ENABLE_KEM_kyber_512_aarch64) 192| |#if defined(OQS_DIST_BUILD) 193| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 194| |#endif /* OQS_DIST_BUILD */ 195| | return (OQS_STATUS) PQCLEAN_KYBER512_AARCH64_crypto_kem_dec(shared_secret, ciphertext, secret_key); 196| |#if defined(OQS_DIST_BUILD) 197| | } else { 198| | return (OQS_STATUS) pqcrystals_kyber512_ref_dec(shared_secret, ciphertext, secret_key); 199| | } 200| |#endif /* OQS_DIST_BUILD */ 201| |#else 202| | return (OQS_STATUS) pqcrystals_kyber512_ref_dec(shared_secret, ciphertext, secret_key); 203| |#endif 204| 57|#endif /* OQS_LIBJADE_BUILD */ 205| 57|} OQS_KEM_kyber_768_new: 9| 126|OQS_KEM *OQS_KEM_kyber_768_new(void) { 10| | 11| 126| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 126| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 126] ------------------ 13| 0| return NULL; 14| 0| } 15| 126| kem->method_name = OQS_KEM_alg_kyber_768; ------------------ | | 70| 126|#define OQS_KEM_alg_kyber_768 "Kyber768" ------------------ 16| 126| kem->alg_version = "https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff"; 17| | 18| 126| kem->claimed_nist_level = 3; 19| 126| kem->ind_cca = true; 20| | 21| 126| kem->length_public_key = OQS_KEM_kyber_768_length_public_key; ------------------ | | 24| 126|#define OQS_KEM_kyber_768_length_public_key 1184 ------------------ 22| 126| kem->length_secret_key = OQS_KEM_kyber_768_length_secret_key; ------------------ | | 25| 126|#define OQS_KEM_kyber_768_length_secret_key 2400 ------------------ 23| 126| kem->length_ciphertext = OQS_KEM_kyber_768_length_ciphertext; ------------------ | | 26| 126|#define OQS_KEM_kyber_768_length_ciphertext 1088 ------------------ 24| 126| kem->length_shared_secret = OQS_KEM_kyber_768_length_shared_secret; ------------------ | | 27| 126|#define OQS_KEM_kyber_768_length_shared_secret 32 ------------------ 25| 126| kem->length_keypair_seed = OQS_KEM_kyber_768_length_keypair_seed; ------------------ | | 28| 126|#define OQS_KEM_kyber_768_length_keypair_seed 0 ------------------ 26| 126| kem->length_encaps_seed = OQS_KEM_kyber_768_length_encaps_seed; ------------------ | | 29| 126|#define OQS_KEM_kyber_768_length_encaps_seed 0 ------------------ 27| | 28| 126| kem->keypair = OQS_KEM_kyber_768_keypair; 29| 126| kem->keypair_derand = OQS_KEM_kyber_768_keypair_derand; 30| 126| kem->encaps = OQS_KEM_kyber_768_encaps; 31| 126| kem->encaps_derand = OQS_KEM_kyber_768_encaps_derand; 32| 126| kem->decaps = OQS_KEM_kyber_768_decaps; 33| | 34| 126| return kem; 35| 126|} OQS_KEM_kyber_768_keypair: 73| 126|OQS_API OQS_STATUS OQS_KEM_kyber_768_keypair(uint8_t *public_key, uint8_t *secret_key) { 74| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_768)) 75| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_768_avx2) 76| |#if defined(OQS_DIST_BUILD) 77| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 78| |#endif /* OQS_DIST_BUILD */ 79| | return (OQS_STATUS) libjade_kyber768_avx2_keypair(public_key, secret_key); 80| |#if defined(OQS_DIST_BUILD) 81| | } else { 82| | return (OQS_STATUS) libjade_kyber768_ref_keypair(public_key, secret_key); 83| | } 84| |#endif /* OQS_DIST_BUILD */ 85| |#else 86| | return (OQS_STATUS) libjade_kyber768_ref_keypair(public_key, secret_key); 87| |#endif 88| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_768)*/ 89| 126|#if defined(OQS_ENABLE_KEM_kyber_768_avx2) 90| 126|#if defined(OQS_DIST_BUILD) 91| 126| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (91:6): [True: 126, False: 0] | Branch (91:49): [True: 126, False: 0] | Branch (91:92): [True: 126, False: 0] ------------------ 92| 126|#endif /* OQS_DIST_BUILD */ 93| 126| return (OQS_STATUS) pqcrystals_kyber768_avx2_keypair(public_key, secret_key); 94| 126|#if defined(OQS_DIST_BUILD) 95| 126| } else { 96| 0| return (OQS_STATUS) pqcrystals_kyber768_ref_keypair(public_key, secret_key); 97| 0| } 98| 126|#endif /* OQS_DIST_BUILD */ 99| |#elif defined(OQS_ENABLE_KEM_kyber_768_aarch64) 100| |#if defined(OQS_DIST_BUILD) 101| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 102| |#endif /* OQS_DIST_BUILD */ 103| | return (OQS_STATUS) PQCLEAN_KYBER768_AARCH64_crypto_kem_keypair(public_key, secret_key); 104| |#if defined(OQS_DIST_BUILD) 105| | } else { 106| | return (OQS_STATUS) pqcrystals_kyber768_ref_keypair(public_key, secret_key); 107| | } 108| |#endif /* OQS_DIST_BUILD */ 109| |#else 110| | return (OQS_STATUS) pqcrystals_kyber768_ref_keypair(public_key, secret_key); 111| |#endif 112| 126|#endif /* OQS_LIBJADE_BUILD */ 113| 126|} OQS_KEM_kyber_768_encaps: 123| 126|OQS_API OQS_STATUS OQS_KEM_kyber_768_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 124| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_768)) 125| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_768_avx2) 126| |#if defined(OQS_DIST_BUILD) 127| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 128| |#endif /* OQS_DIST_BUILD */ 129| | return (OQS_STATUS) libjade_kyber768_avx2_enc(ciphertext, shared_secret, public_key); 130| |#if defined(OQS_DIST_BUILD) 131| | } else { 132| | return (OQS_STATUS) libjade_kyber768_ref_enc(ciphertext, shared_secret, public_key); 133| | } 134| |#endif /* OQS_DIST_BUILD */ 135| |#else 136| | return (OQS_STATUS) libjade_kyber768_ref_enc(ciphertext, shared_secret, public_key); 137| |#endif 138| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_768)*/ 139| 126|#if defined(OQS_ENABLE_KEM_kyber_768_avx2) 140| 126|#if defined(OQS_DIST_BUILD) 141| 126| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (141:6): [True: 126, False: 0] | Branch (141:49): [True: 126, False: 0] | Branch (141:92): [True: 126, False: 0] ------------------ 142| 126|#endif /* OQS_DIST_BUILD */ 143| 126| return (OQS_STATUS) pqcrystals_kyber768_avx2_enc(ciphertext, shared_secret, public_key); 144| 126|#if defined(OQS_DIST_BUILD) 145| 126| } else { 146| 0| return (OQS_STATUS) pqcrystals_kyber768_ref_enc(ciphertext, shared_secret, public_key); 147| 0| } 148| 126|#endif /* OQS_DIST_BUILD */ 149| |#elif defined(OQS_ENABLE_KEM_kyber_768_aarch64) 150| |#if defined(OQS_DIST_BUILD) 151| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 152| |#endif /* OQS_DIST_BUILD */ 153| | return (OQS_STATUS) PQCLEAN_KYBER768_AARCH64_crypto_kem_enc(ciphertext, shared_secret, public_key); 154| |#if defined(OQS_DIST_BUILD) 155| | } else { 156| | return (OQS_STATUS) pqcrystals_kyber768_ref_enc(ciphertext, shared_secret, public_key); 157| | } 158| |#endif /* OQS_DIST_BUILD */ 159| |#else 160| | return (OQS_STATUS) pqcrystals_kyber768_ref_enc(ciphertext, shared_secret, public_key); 161| |#endif 162| 126|#endif /* OQS_LIBJADE_BUILD */ 163| 126|} OQS_KEM_kyber_768_decaps: 165| 126|OQS_API OQS_STATUS OQS_KEM_kyber_768_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 166| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_768)) 167| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_768_avx2) 168| |#if defined(OQS_DIST_BUILD) 169| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 170| |#endif /* OQS_DIST_BUILD */ 171| | return (OQS_STATUS) libjade_kyber768_avx2_dec(shared_secret, ciphertext, secret_key); 172| |#if defined(OQS_DIST_BUILD) 173| | } else { 174| | return (OQS_STATUS) libjade_kyber768_ref_dec(shared_secret, ciphertext, secret_key); 175| | } 176| |#endif /* OQS_DIST_BUILD */ 177| |#else 178| | return (OQS_STATUS) libjade_kyber768_ref_dec(shared_secret, ciphertext, secret_key); 179| |#endif 180| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_768)*/ 181| 126|#if defined(OQS_ENABLE_KEM_kyber_768_avx2) 182| 126|#if defined(OQS_DIST_BUILD) 183| 126| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (183:6): [True: 126, False: 0] | Branch (183:49): [True: 126, False: 0] | Branch (183:92): [True: 126, False: 0] ------------------ 184| 126|#endif /* OQS_DIST_BUILD */ 185| 126| return (OQS_STATUS) pqcrystals_kyber768_avx2_dec(shared_secret, ciphertext, secret_key); 186| 126|#if defined(OQS_DIST_BUILD) 187| 126| } else { 188| 0| return (OQS_STATUS) pqcrystals_kyber768_ref_dec(shared_secret, ciphertext, secret_key); 189| 0| } 190| 126|#endif /* OQS_DIST_BUILD */ 191| |#elif defined(OQS_ENABLE_KEM_kyber_768_aarch64) 192| |#if defined(OQS_DIST_BUILD) 193| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 194| |#endif /* OQS_DIST_BUILD */ 195| | return (OQS_STATUS) PQCLEAN_KYBER768_AARCH64_crypto_kem_dec(shared_secret, ciphertext, secret_key); 196| |#if defined(OQS_DIST_BUILD) 197| | } else { 198| | return (OQS_STATUS) pqcrystals_kyber768_ref_dec(shared_secret, ciphertext, secret_key); 199| | } 200| |#endif /* OQS_DIST_BUILD */ 201| |#else 202| | return (OQS_STATUS) pqcrystals_kyber768_ref_dec(shared_secret, ciphertext, secret_key); 203| |#endif 204| 126|#endif /* OQS_LIBJADE_BUILD */ 205| 126|} pqcrystals_kyber1024_avx2_poly_cbd_eta1: 127| 1.87k|{ 128| 1.87k|#if KYBER_ETA1 == 2 129| 1.87k| cbd2(r, buf); 130| |#elif KYBER_ETA1 == 3 131| | cbd3(r, (uint8_t *)buf); 132| |#else 133| |#error "This implementation requires eta1 in {2,3}" 134| |#endif 135| 1.87k|} pqcrystals_kyber1024_avx2_poly_cbd_eta2: 138| 156|{ 139| 156|#if KYBER_ETA2 == 2 140| 156| cbd2(r, buf); 141| |#else 142| |#error "This implementation requires eta2 = 2" 143| |#endif 144| 156|} pqcrystals_kyber1024_avx2_gen_matrix: 397| 234|{ 398| 234| unsigned int i, ctr0, ctr1, ctr2, ctr3; 399| 234| ALIGNED_UINT8(REJ_UNIFORM_AVX_NBLOCKS*SHAKE128_RATE) buf[4]; ------------------ | | 8| 234| union { \ | | 9| 234| uint8_t coeffs[N]; \ | | 10| 234| __m256i vec[(N+31)/32]; \ | | 11| 234| } ------------------ 400| 234| __m256i f; 401| 234| shake128x4incctx state; ------------------ | | 18| 234|#define shake128x4incctx OQS_SHA3_shake128_x4_inc_ctx ------------------ 402| 234| shake128x4_inc_init(&state); ------------------ | | 19| 234|#define shake128x4_inc_init OQS_SHA3_shake128_x4_inc_init ------------------ 403| | 404| 1.17k| for(i=0;i<4;i++) { ------------------ | Branch (404:11): [True: 936, False: 234] ------------------ 405| 936| f = _mm256_loadu_si256((__m256i *)seed); 406| 936| _mm256_store_si256(buf[0].vec, f); 407| 936| _mm256_store_si256(buf[1].vec, f); 408| 936| _mm256_store_si256(buf[2].vec, f); 409| 936| _mm256_store_si256(buf[3].vec, f); 410| | 411| 936| if(transposed) { ------------------ | Branch (411:8): [True: 624, False: 312] ------------------ 412| 624| buf[0].coeffs[32] = i; 413| 624| buf[0].coeffs[33] = 0; 414| 624| buf[1].coeffs[32] = i; 415| 624| buf[1].coeffs[33] = 1; 416| 624| buf[2].coeffs[32] = i; 417| 624| buf[2].coeffs[33] = 2; 418| 624| buf[3].coeffs[32] = i; 419| 624| buf[3].coeffs[33] = 3; 420| 624| } 421| 312| else { 422| 312| buf[0].coeffs[32] = 0; 423| 312| buf[0].coeffs[33] = i; 424| 312| buf[1].coeffs[32] = 1; 425| 312| buf[1].coeffs[33] = i; 426| 312| buf[2].coeffs[32] = 2; 427| 312| buf[2].coeffs[33] = i; 428| 312| buf[3].coeffs[32] = 3; 429| 312| buf[3].coeffs[33] = i; 430| 312| } 431| | 432| 936| shake128x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 34); ------------------ | | 39| 936|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once ------------------ 433| 936| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, REJ_UNIFORM_AVX_NBLOCKS, &state); ------------------ | | 46| 936| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 936|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 434| | 435| 936| ctr0 = rej_uniform_avx(a[i].vec[0].coeffs, buf[0].coeffs); ------------------ | | 11| 936|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 27| 936|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 436| 936| ctr1 = rej_uniform_avx(a[i].vec[1].coeffs, buf[1].coeffs); ------------------ | | 11| 936|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 27| 936|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 437| 936| ctr2 = rej_uniform_avx(a[i].vec[2].coeffs, buf[2].coeffs); ------------------ | | 11| 936|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 27| 936|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 438| 936| ctr3 = rej_uniform_avx(a[i].vec[3].coeffs, buf[3].coeffs); ------------------ | | 11| 936|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 27| 936|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 439| | 440| 1.18k| while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 2.36k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 2.29k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 2.23k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 995|#define KYBER_N 256 ------------------ | Branch (440:11): [True: 71, False: 1.11k] | Branch (440:29): [True: 66, False: 1.04k] | Branch (440:47): [True: 52, False: 995] | Branch (440:65): [True: 59, False: 936] ------------------ 441| 248| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 1, &state); ------------------ | | 46| 248| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 248|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 442| | 443| 248| ctr0 += rej_uniform(a[i].vec[0].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 33| 248|#define KYBER_N 256 ------------------ ctr0 += rej_uniform(a[i].vec[0].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 8| 248|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 248|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 444| 248| ctr1 += rej_uniform(a[i].vec[1].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 33| 248|#define KYBER_N 256 ------------------ ctr1 += rej_uniform(a[i].vec[1].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 8| 248|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 248|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 445| 248| ctr2 += rej_uniform(a[i].vec[2].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 33| 248|#define KYBER_N 256 ------------------ ctr2 += rej_uniform(a[i].vec[2].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 8| 248|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 248|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 446| 248| ctr3 += rej_uniform(a[i].vec[3].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 33| 248|#define KYBER_N 256 ------------------ ctr3 += rej_uniform(a[i].vec[3].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 8| 248|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 248|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 447| 248| } 448| | 449| 936| poly_nttunpack(&a[i].vec[0]); ------------------ | | 62| 936|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 27| 936|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 450| 936| poly_nttunpack(&a[i].vec[1]); ------------------ | | 62| 936|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 27| 936|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 451| 936| poly_nttunpack(&a[i].vec[2]); ------------------ | | 62| 936|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 27| 936|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 452| 936| poly_nttunpack(&a[i].vec[3]); ------------------ | | 62| 936|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 27| 936|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 453| 936| } 454| 234| shake128x4_inc_ctx_release(&state); ------------------ | | 23| 234|#define shake128x4_inc_ctx_release OQS_SHA3_shake128_x4_inc_ctx_release ------------------ 455| 234|} pqcrystals_kyber1024_avx2_indcpa_keypair: 472| 78|{ 473| 78| unsigned int i; 474| 78| uint8_t buf[2*KYBER_SYMBYTES]; 475| 78| const uint8_t *publicseed = buf; 476| 78| const uint8_t *noiseseed = buf + KYBER_SYMBYTES; ------------------ | | 36| 78|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 477| 78| polyvec a[KYBER_K], e, pkpv, skpv; 478| | 479| 78| randombytes(buf, KYBER_SYMBYTES); ------------------ | | 8| 78|#define randombytes OQS_randombytes ------------------ randombytes(buf, KYBER_SYMBYTES); ------------------ | | 36| 78|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 480| 78| hash_g(buf, buf, KYBER_SYMBYTES); ------------------ | | 53| 78|#define hash_g(OUT, IN, INBYTES) sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 31| 78|#define sha3_512 OQS_SHA3_sha3_512 | | ------------------ ------------------ 481| | 482| 78| gen_a(a, publicseed); ------------------ | | 157| 78|#define gen_a(A,B) gen_matrix(A,B,0) | | ------------------ | | | | 8| 78|#define gen_matrix KYBER_NAMESPACE(gen_matrix) | | | | ------------------ | | | | | | 27| 78|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | | | ------------------ | | ------------------ ------------------ 483| | 484| |#ifdef KYBER_90S 485| |#define NOISE_NBLOCKS ((KYBER_ETA1*KYBER_N/4)/AES256CTR_BLOCKBYTES) /* Assumes divisibility */ 486| | uint64_t nonce = 0; 487| | ALIGNED_UINT8(NOISE_NBLOCKS*AES256CTR_BLOCKBYTES+32) coins; // +32 bytes as required by poly_cbd_eta1 488| | aes256ctr_ctx state; 489| | aes256ctr_init_u64(&state, noiseseed, nonce++); 490| | for(i=0;ivec[2*i+0]); 190| 1.24k| f1 = _mm256_load_si256(&a->vec[2*i+1]); 191| 1.24k| f0 = _mm256_mulhi_epi16(f0,v); 192| 1.24k| f1 = _mm256_mulhi_epi16(f1,v); 193| 1.24k| f0 = _mm256_mulhrs_epi16(f0,shift1); 194| 1.24k| f1 = _mm256_mulhrs_epi16(f1,shift1); 195| 1.24k| f0 = _mm256_and_si256(f0,mask); 196| 1.24k| f1 = _mm256_and_si256(f1,mask); 197| 1.24k| f0 = _mm256_packus_epi16(f0,f1); 198| 1.24k| f0 = _mm256_maddubs_epi16(f0,shift2); // a0 a1 a2 a3 b0 b1 b2 b3 a4 a5 a6 a7 b4 b5 b6 b7 199| 1.24k| f0 = _mm256_madd_epi16(f0,shift3); // a0 a1 b0 b1 a2 a3 b2 b3 200| 1.24k| f0 = _mm256_sllv_epi32(f0,sllvdidx); 201| 1.24k| f0 = _mm256_srlv_epi64(f0,sllvdidx); 202| 1.24k| f0 = _mm256_shuffle_epi8(f0,shufbidx); 203| 1.24k| t0 = _mm256_castsi256_si128(f0); 204| | t1 = _mm256_extracti128_si256(f0,1); 205| 1.24k| t0 = _mm_blendv_epi8(t0,t1,_mm256_castsi256_si128(shufbidx)); 206| 1.24k| _mm_storeu_si128((__m128i *)&r[20*i+ 0],t0); 207| 1.24k| memcpy(&r[20*i+16],&t1,4); 208| 1.24k| } 209| 156|} pqcrystals_kyber1024_avx2_poly_decompress: 212| 78|{ 213| 78| unsigned int i; 214| 78| __m128i t; 215| 78| __m256i f; 216| 78| int16_t ti; 217| 78| const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 78|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 78|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 78|#define _16XQ 0 ------------------ 218| 78| const __m256i shufbidx = _mm256_set_epi8(9,9,9,8,8,8,8,7,7,6,6,6,6,5,5,5, 219| 78| 4,4,4,3,3,3,3,2,2,1,1,1,1,0,0,0); 220| 78| const __m256i mask = _mm256_set_epi16(248,1984,62,496,3968,124,992,31, 221| 78| 248,1984,62,496,3968,124,992,31); 222| 78| const __m256i shift = _mm256_set_epi16(128,16,512,64,8,256,32,1024, 223| 78| 128,16,512,64,8,256,32,1024); 224| | 225| 1.32k| for(i=0;ivec[i],f); 235| 1.24k| } 236| 78|} pqcrystals_kyber1024_avx2_poly_tobytes: 255| 624|{ 256| 624| ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 23| 624|#define ntttobytes_avx KYBER_NAMESPACE(ntttobytes_avx) | | ------------------ | | | | 27| 624|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 39| 624|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 624|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 257| 624|} pqcrystals_kyber1024_avx2_poly_frombytes: 270| 936|{ 271| 936| nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 25| 936|#define nttfrombytes_avx KYBER_NAMESPACE(nttfrombytes_avx) | | ------------------ | | | | 27| 936|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 39| 936|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 936|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 272| 936|} pqcrystals_kyber1024_avx2_poly_frommsg: 283| 156|{ 284| |#if (KYBER_INDCPA_MSGBYTES != 32) 285| |#error "KYBER_INDCPA_MSGBYTES must be equal to 32!" 286| |#endif 287| 156| __m256i f, g0, g1, g2, g3, h0, h1, h2, h3; 288| 156| const __m256i shift = _mm256_broadcastsi128_si256(_mm_set_epi32(0,1,2,3)); 289| 156| const __m256i idx = _mm256_broadcastsi128_si256(_mm_set_epi8(15,14,11,10,7,6,3,2,13,12,9,8,5,4,1,0)); 290| 156| const __m256i hqs = _mm256_set1_epi16((KYBER_Q+1)/2); ------------------ | | 34| 156|#define KYBER_Q 3329 ------------------ 291| | 292| 156|#define FROMMSG64(i) \ 293| 156| g3 = _mm256_shuffle_epi32(f,0x55*i); \ 294| 156| g3 = _mm256_sllv_epi32(g3,shift); \ 295| 156| g3 = _mm256_shuffle_epi8(g3,idx); \ 296| 156| g0 = _mm256_slli_epi16(g3,12); \ 297| 156| g1 = _mm256_slli_epi16(g3,8); \ 298| 156| g2 = _mm256_slli_epi16(g3,4); \ 299| 156| g0 = _mm256_srai_epi16(g0,15); \ 300| 156| g1 = _mm256_srai_epi16(g1,15); \ 301| 156| g2 = _mm256_srai_epi16(g2,15); \ 302| 156| g3 = _mm256_srai_epi16(g3,15); \ 303| 156| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ 304| 156| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ 305| 156| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ 306| 156| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ 307| 156| h0 = _mm256_unpacklo_epi64(g0,g1); \ 308| 156| h2 = _mm256_unpackhi_epi64(g0,g1); \ 309| 156| h1 = _mm256_unpacklo_epi64(g2,g3); \ 310| 156| h3 = _mm256_unpackhi_epi64(g2,g3); \ 311| 156| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ 312| 156| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ 313| 156| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ 314| 156| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ 315| 156| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ 316| 156| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ 317| 156| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ 318| 156| _mm256_store_si256(&r->vec[8+2*i+1],g3) 319| | 320| 156| f = _mm256_loadu_si256((__m256i *)msg); 321| 156| FROMMSG64(0); ------------------ | | 293| 156| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 156| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 156| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 156| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 156| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 156| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 156| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 156| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 156| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 156| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 156| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 156| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 156| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 156| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 156| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 156| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 156| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 156| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 156| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 156| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 156| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 156| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 156| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 156| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 156| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 156| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 322| 156| FROMMSG64(1); ------------------ | | 293| 156| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 156| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 156| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 156| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 156| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 156| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 156| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 156| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 156| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 156| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 156| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 156| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 156| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 156| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 156| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 156| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 156| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 156| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 156| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 156| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 156| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 156| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 156| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 156| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 156| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 156| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 323| 156| FROMMSG64(2); ------------------ | | 293| 156| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 156| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 156| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 156| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 156| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 156| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 156| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 156| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 156| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 156| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 156| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 156| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 156| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 156| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 156| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 156| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 156| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 156| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 156| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 156| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 156| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 156| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 156| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 156| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 156| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 156| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 324| | FROMMSG64(3); ------------------ | | 293| 156| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 156| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 156| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 156| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 156| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 156| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 156| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 156| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 156| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 156| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 156| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 156| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 156| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 156| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 156| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 156| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 156| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 156| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 156| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 156| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 156| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 156| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 156| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 156| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 156| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 156| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 325| 156|} pqcrystals_kyber1024_avx2_poly_tomsg: 339| 78|{ 340| 78| unsigned int i; 341| 78| uint32_t small; 342| 78| __m256i f0, f1, g0, g1; 343| 78| const __m256i hq = _mm256_set1_epi16((KYBER_Q - 1)/2); ------------------ | | 34| 78|#define KYBER_Q 3329 ------------------ 344| 78| const __m256i hhq = _mm256_set1_epi16((KYBER_Q - 1)/4); ------------------ | | 34| 78|#define KYBER_Q 3329 ------------------ 345| | 346| 702| for(i=0;ivec[2*i+0]); 348| 624| f1 = _mm256_load_si256(&a->vec[2*i+1]); 349| 624| f0 = _mm256_sub_epi16(hq, f0); 350| 624| f1 = _mm256_sub_epi16(hq, f1); 351| 624| g0 = _mm256_srai_epi16(f0, 15); 352| 624| g1 = _mm256_srai_epi16(f1, 15); 353| 624| f0 = _mm256_xor_si256(f0, g0); 354| 624| f1 = _mm256_xor_si256(f1, g1); 355| 624| f0 = _mm256_sub_epi16(f0, hhq); 356| 624| f1 = _mm256_sub_epi16(f1, hhq); 357| 624| f0 = _mm256_packs_epi16(f0, f1); 358| | f0 = _mm256_permute4x64_epi64(f0, 0xD8); 359| 624| small = _mm256_movemask_epi8(f0); 360| 624| memcpy(&msg[4*i], &small, 4); 361| 624| } 362| 78|} pqcrystals_kyber1024_avx2_poly_getnoise_eta2: 397| 156|{ 398| 156| ALIGNED_UINT8(KYBER_ETA2*KYBER_N/4) buf; ------------------ | | 8| 156| union { \ | | 9| 156| uint8_t coeffs[N]; \ | | 10| 156| __m256i vec[(N+31)/32]; \ | | 11| 156| } ------------------ 399| 156| prf(buf.coeffs, KYBER_ETA2*KYBER_N/4, seed, nonce); ------------------ | | 58| 156| kyber_shake256_prf(OUT, OUTBYTES, KEY, NONCE) | | ------------------ | | | | 44| 156|#define kyber_shake256_prf KYBER_NAMESPACE(kyber_shake256_prf) | | | | ------------------ | | | | | | 27| 156|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | | | ------------------ | | ------------------ ------------------ 400| 156| poly_cbd_eta2(r, buf.vec); ------------------ | | 12| 156|#define poly_cbd_eta2 KYBER_NAMESPACE(poly_cbd_eta2) | | ------------------ | | | | 27| 156|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 401| 156|} pqcrystals_kyber1024_avx2_poly_getnoise_eta2_4x: 415| 468|{ 416| 468| ALIGNED_UINT8(NOISE_NBLOCKS*SHAKE256_RATE) buf[4]; ------------------ | | 8| 468| union { \ | | 9| 468| uint8_t coeffs[N]; \ | | 10| 468| __m256i vec[(N+31)/32]; \ | | 11| 468| } ------------------ 417| 468| __m256i f; 418| 468| shake256x4incctx state; ------------------ | | 27| 468|#define shake256x4incctx OQS_SHA3_shake256_x4_inc_ctx ------------------ 419| | 420| 468| f = _mm256_loadu_si256((__m256i *)seed); 421| 468| _mm256_store_si256(buf[0].vec, f); 422| 468| _mm256_store_si256(buf[1].vec, f); 423| 468| _mm256_store_si256(buf[2].vec, f); 424| 468| _mm256_store_si256(buf[3].vec, f); 425| | 426| 468| buf[0].coeffs[32] = nonce0; 427| 468| buf[1].coeffs[32] = nonce1; 428| 468| buf[2].coeffs[32] = nonce2; 429| 468| buf[3].coeffs[32] = nonce3; 430| | 431| 468| shake256x4_inc_init(&state); ------------------ | | 28| 468|#define shake256x4_inc_init OQS_SHA3_shake256_x4_inc_init ------------------ 432| 468| shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 33); ------------------ | | 42| 468|#define shake256x4_absorb_once OQS_SHA3_shake256_x4_absorb_once ------------------ 433| 468| shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, NOISE_NBLOCKS, &state); ------------------ | | 49| 468| OQS_SHA3_shake256_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE256_RATE, STATE) | | ------------------ | | | | 320| 468|#define OQS_SHA3_SHAKE256_RATE 136 | | ------------------ ------------------ 434| 468| shake256x4_inc_ctx_release(&state); ------------------ | | 32| 468|#define shake256x4_inc_ctx_release OQS_SHA3_shake256_x4_inc_ctx_release ------------------ 435| | 436| 468| poly_cbd_eta1(r0, buf[0].vec); ------------------ | | 9| 468|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 27| 468|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 437| 468| poly_cbd_eta1(r1, buf[1].vec); ------------------ | | 9| 468|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 27| 468|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 438| 468| poly_cbd_eta1(r2, buf[2].vec); ------------------ | | 9| 468|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 27| 468|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 439| 468| poly_cbd_eta1(r3, buf[3].vec); ------------------ | | 9| 468|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 27| 468|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 440| 468|} pqcrystals_kyber1024_avx2_poly_ntt: 495| 1.56k|{ 496| 1.56k| ntt_avx(r->vec, qdata.vec); ------------------ | | 7| 1.56k|#define ntt_avx KYBER_NAMESPACE(ntt_avx) | | ------------------ | | | | 27| 1.56k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ ntt_avx(r->vec, qdata.vec); ------------------ | | 39| 1.56k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 1.56k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 497| 1.56k|} pqcrystals_kyber1024_avx2_poly_invntt_tomont: 512| 858|{ 513| 858| invntt_avx(r->vec, qdata.vec); ------------------ | | 9| 858|#define invntt_avx KYBER_NAMESPACE(invntt_avx) | | ------------------ | | | | 27| 858|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ invntt_avx(r->vec, qdata.vec); ------------------ | | 39| 858|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 858|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 514| 858|} pqcrystals_kyber1024_avx2_poly_nttunpack: 517| 3.74k|{ 518| 3.74k| nttunpack_avx(r->vec, qdata.vec); ------------------ | | 14| 3.74k|#define nttunpack_avx KYBER_NAMESPACE(nttunpack_avx) | | ------------------ | | | | 27| 3.74k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ nttunpack_avx(r->vec, qdata.vec); ------------------ | | 39| 3.74k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 3.74k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 519| 3.74k|} pqcrystals_kyber1024_avx2_poly_basemul_montgomery: 534| 4.68k|{ 535| 4.68k| basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 17| 4.68k|#define basemul_avx KYBER_NAMESPACE(basemul_avx) | | ------------------ | | | | 27| 4.68k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 39| 4.68k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 4.68k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 536| 4.68k|} pqcrystals_kyber1024_avx2_poly_tomont: 547| 312|{ 548| 312| tomont_avx(r->vec, qdata.vec); ------------------ | | 9| 312|#define tomont_avx KYBER_NAMESPACE(tomont_avx) | | ------------------ | | | | 27| 312|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ tomont_avx(r->vec, qdata.vec); ------------------ | | 39| 312|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 312|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 549| 312|} pqcrystals_kyber1024_avx2_poly_reduce: 560| 1.48k|{ 561| 1.48k| reduce_avx(r->vec, qdata.vec); ------------------ | | 7| 1.48k|#define reduce_avx KYBER_NAMESPACE(reduce_avx) | | ------------------ | | | | 27| 1.48k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ reduce_avx(r->vec, qdata.vec); ------------------ | | 39| 1.48k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 1.48k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 562| 1.48k|} pqcrystals_kyber1024_avx2_poly_add: 575| 4.75k|{ 576| 4.75k| unsigned int i; 577| 4.75k| __m256i f0, f1; 578| | 579| 80.8k| for(i=0;ivec[i]); 581| 76.1k| f1 = _mm256_load_si256(&b->vec[i]); 582| 76.1k| f0 = _mm256_add_epi16(f0, f1); 583| 76.1k| _mm256_store_si256(&r->vec[i], f0); 584| 76.1k| } 585| 4.75k|} pqcrystals_kyber1024_avx2_poly_sub: 598| 78|{ 599| 78| unsigned int i; 600| 78| __m256i f0, f1; 601| | 602| 1.32k| for(i=0;ivec[i]); 604| 1.24k| f1 = _mm256_load_si256(&b->vec[i]); 605| 1.24k| f0 = _mm256_sub_epi16(f0, f1); 606| 1.24k| _mm256_store_si256(&r->vec[i], f0); 607| 1.24k| } 608| 78|} pqcrystals_kyber1024_avx2_polyvec_compress: 158| 156|{ 159| 156| unsigned int i; 160| | 161| |#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 162| | for(i=0;ivec[i]); 164| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 165| 780| for(i=0;ivec[i]); 167| 156|#endif 168| 156|} pqcrystals_kyber1024_avx2_polyvec_decompress: 181| 78|{ 182| 78| unsigned int i; 183| | 184| |#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 185| | for(i=0;ivec[i],&a[320*i]); 187| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 188| 390| for(i=0;ivec[i],&a[352*i]); 190| 78|#endif 191| 78|} pqcrystals_kyber1024_avx2_polyvec_tobytes: 203| 156|{ 204| 156| unsigned int i; 205| 780| for(i=0;ivec[i]); ------------------ | | 15| 624|#define poly_tobytes KYBER_NAMESPACE(poly_tobytes) | | ------------------ | | | | 27| 624|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ poly_tobytes(r+i*KYBER_POLYBYTES, &a->vec[i]); ------------------ | | 39| 624|#define KYBER_POLYBYTES 384 ------------------ 207| 156|} pqcrystals_kyber1024_avx2_polyvec_frombytes: 220| 234|{ 221| 234| unsigned int i; 222| 1.17k| for(i=0;ivec[i], a+i*KYBER_POLYBYTES); ------------------ | | 17| 936|#define poly_frombytes KYBER_NAMESPACE(poly_frombytes) | | ------------------ | | | | 27| 936|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ poly_frombytes(&r->vec[i], a+i*KYBER_POLYBYTES); ------------------ | | 39| 936|#define KYBER_POLYBYTES 384 ------------------ 224| 234|} pqcrystals_kyber1024_avx2_polyvec_ntt: 234| 390|{ 235| 390| unsigned int i; 236| 1.95k| for(i=0;ivec[i]); ------------------ | | 58| 1.56k|#define poly_ntt KYBER_NAMESPACE(poly_ntt) | | ------------------ | | | | 27| 1.56k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 238| 390|} pqcrystals_kyber1024_avx2_polyvec_invntt_tomont: 249| 156|{ 250| 156| unsigned int i; 251| 780| for(i=0;ivec[i]); ------------------ | | 60| 624|#define poly_invntt_tomont KYBER_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 27| 624|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 253| 156|} pqcrystals_kyber1024_avx2_polyvec_basemul_acc_montgomery: 266| 1.17k|{ 267| 1.17k| unsigned int i; 268| 1.17k| poly tmp; 269| | 270| 1.17k| poly_basemul_montgomery(r,&a->vec[0],&b->vec[0]); ------------------ | | 64| 1.17k|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 27| 1.17k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 271| 4.68k| for(i=1;ivec[i],&b->vec[i]); ------------------ | | 64| 3.51k|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 27| 3.51k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 273| 3.51k| poly_add(r,r,&tmp); ------------------ | | 72| 3.51k|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 27| 3.51k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 274| 3.51k| } 275| 1.17k|} pqcrystals_kyber1024_avx2_polyvec_reduce: 287| 312|{ 288| 312| unsigned int i; 289| 1.56k| for(i=0;ivec[i]); ------------------ | | 69| 1.24k|#define poly_reduce KYBER_NAMESPACE(poly_reduce) | | ------------------ | | | | 27| 1.24k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 291| 312|} pqcrystals_kyber1024_avx2_polyvec_add: 303| 234|{ 304| 234| unsigned int i; 305| 1.17k| for(i=0;ivec[i], &a->vec[i], &b->vec[i]); ------------------ | | 72| 936|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 27| 936|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 307| 234|} polyvec.c:poly_compress11: 76| 624|{ 77| 624| unsigned int i; 78| 624| __m256i f0, f1, f2; 79| 624| __m128i t0, t1; 80| 624| const __m256i v = _mm256_load_si256(&qdata.vec[_16XV/16]); ------------------ | | 39| 624|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 624|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ const __m256i v = _mm256_load_si256(&qdata.vec[_16XV/16]); ------------------ | | 8| 624|#define _16XV 32 ------------------ 81| 624| const __m256i v8 = _mm256_slli_epi16(v,3); 82| 624| const __m256i off = _mm256_set1_epi16(36); 83| 624| const __m256i shift1 = _mm256_set1_epi16(1 << 13); 84| 624| const __m256i mask = _mm256_set1_epi16(2047); 85| 624| const __m256i shift2 = _mm256_set1_epi64x((2048LL << 48) + (1LL << 32) + (2048 << 16) + 1); 86| 624| const __m256i sllvdidx = _mm256_set1_epi64x(10); 87| 624| const __m256i srlvqidx = _mm256_set_epi64x(30,10,30,10); 88| 624| const __m256i shufbidx = _mm256_set_epi8( 4, 3, 2, 1, 0, 0,-1,-1,-1,-1,10, 9, 8, 7, 6, 5, 89| 624| -1,-1,-1,-1,-1,10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0); 90| | 91| 10.6k| for(i=0;ivec[i]); 93| 9.98k| f1 = _mm256_mullo_epi16(f0,v8); 94| 9.98k| f2 = _mm256_add_epi16(f0,off); 95| 9.98k| f0 = _mm256_slli_epi16(f0,3); 96| 9.98k| f0 = _mm256_mulhi_epi16(f0,v); 97| 9.98k| f2 = _mm256_sub_epi16(f1,f2); 98| 9.98k| f1 = _mm256_andnot_si256(f1,f2); 99| 9.98k| f1 = _mm256_srli_epi16(f1,15); 100| 9.98k| f0 = _mm256_sub_epi16(f0,f1); 101| 9.98k| f0 = _mm256_mulhrs_epi16(f0,shift1); 102| 9.98k| f0 = _mm256_and_si256(f0,mask); 103| 9.98k| f0 = _mm256_madd_epi16(f0,shift2); 104| 9.98k| f0 = _mm256_sllv_epi32(f0,sllvdidx); 105| 9.98k| f1 = _mm256_bsrli_epi128(f0,8); 106| 9.98k| f0 = _mm256_srlv_epi64(f0,srlvqidx); 107| 9.98k| f1 = _mm256_slli_epi64(f1,34); 108| 9.98k| f0 = _mm256_add_epi64(f0,f1); 109| 9.98k| f0 = _mm256_shuffle_epi8(f0,shufbidx); 110| 9.98k| t0 = _mm256_castsi256_si128(f0); 111| | t1 = _mm256_extracti128_si256(f0,1); 112| 9.98k| t0 = _mm_blendv_epi8(t0,t1,_mm256_castsi256_si128(shufbidx)); 113| 9.98k| _mm_storeu_si128((__m128i *)&r[22*i+ 0],t0); 114| 9.98k| _mm_storel_epi64((__m128i *)&r[22*i+16],t1); 115| 9.98k| } 116| 624|} polyvec.c:poly_decompress11: 119| 312|{ 120| 312| unsigned int i; 121| 312| __m256i f; 122| 312| const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 312|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 312|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 312|#define _16XQ 0 ------------------ 123| 312| const __m256i shufbidx = _mm256_set_epi8(13,12,12,11,10, 9, 9, 8, 124| 312| 8, 7, 6, 5, 5, 4, 4, 3, 125| 312| 10, 9, 9, 8, 7, 6, 6, 5, 126| 312| 5, 4, 3, 2, 2, 1, 1, 0); 127| 312| const __m256i srlvdidx = _mm256_set_epi32(0,0,1,0,0,0,1,0); 128| 312| const __m256i srlvqidx = _mm256_set_epi64x(2,0,2,0); 129| 312| const __m256i shift = _mm256_set_epi16(4,32,1,8,32,1,4,32,4,32,1,8,32,1,4,32); 130| 312| const __m256i mask = _mm256_set1_epi16(32752); 131| | 132| 5.30k| for(i=0;ivec[i],f); 143| 4.99k| } 144| 312|} pqcrystals_kyber1024_avx2_rej_uniform_avx: 275| 3.74k|{ 276| 3.74k| unsigned int ctr, pos; 277| 3.74k| uint16_t val0, val1; 278| 3.74k| uint32_t good; 279| |#ifdef BMI 280| | uint64_t idx0, idx1, idx2, idx3; 281| |#endif 282| 3.74k| const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 3.74k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 3.74k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 3.74k|#define _16XQ 0 ------------------ 283| 3.74k| const __m256i ones = _mm256_set1_epi8(1); 284| 3.74k| const __m256i mask = _mm256_set1_epi16(0xFFF); 285| 3.74k| const __m256i idx8 = _mm256_set_epi8(15,14,14,13,12,11,11,10, 286| 3.74k| 9, 8, 8, 7, 6, 5, 5, 4, 287| 3.74k| 11,10,10, 9, 8, 7, 7, 6, 288| 3.74k| 5, 4, 4, 3, 2, 1, 1, 0); 289| 3.74k| __m256i f0, f1, g0, g1, g2, g3; 290| 3.74k| __m128i f, t, pilo, pihi; 291| | 292| 3.74k| ctr = pos = 0; 293| 37.9k| while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 33| 37.9k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 9| 34.2k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 34.2k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 34.2k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 34.2k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 34.2k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 34.2k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 34.2k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 34.2k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 34.2k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 34.2k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 34.2k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 34.2k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 34.2k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (293:9): [True: 34.2k, False: 3.73k] | Branch (293:32): [True: 34.2k, False: 12] ------------------ 294| 34.2k| f0 = _mm256_loadu_si256((__m256i *)&buf[pos]); 295| 34.2k| f1 = _mm256_loadu_si256((__m256i *)&buf[pos+24]); 296| 34.2k| f0 = _mm256_permute4x64_epi64(f0, 0x94); 297| 34.2k| f1 = _mm256_permute4x64_epi64(f1, 0x94); 298| 34.2k| f0 = _mm256_shuffle_epi8(f0, idx8); 299| 34.2k| f1 = _mm256_shuffle_epi8(f1, idx8); 300| 34.2k| g0 = _mm256_srli_epi16(f0, 4); 301| 34.2k| g1 = _mm256_srli_epi16(f1, 4); 302| 34.2k| f0 = _mm256_blend_epi16(f0, g0, 0xAA); 303| 34.2k| f1 = _mm256_blend_epi16(f1, g1, 0xAA); 304| 34.2k| f0 = _mm256_and_si256(f0, mask); 305| 34.2k| f1 = _mm256_and_si256(f1, mask); 306| 34.2k| pos += 48; 307| | 308| 34.2k| g0 = _mm256_cmpgt_epi16(bound, f0); 309| 34.2k| g1 = _mm256_cmpgt_epi16(bound, f1); 310| | 311| 34.2k| g0 = _mm256_packs_epi16(g0, g1); 312| 34.2k| good = _mm256_movemask_epi8(g0); 313| | 314| |#ifdef BMI 315| | idx0 = _pdep_u64(good >> 0, 0x0101010101010101); 316| | idx1 = _pdep_u64(good >> 8, 0x0101010101010101); 317| | idx2 = _pdep_u64(good >> 16, 0x0101010101010101); 318| | idx3 = _pdep_u64(good >> 24, 0x0101010101010101); 319| | idx0 = (idx0 << 8) - idx0; 320| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 321| | idx1 = (idx1 << 8) - idx1; 322| | idx1 = _pext_u64(0x0E0C0A0806040200, idx1); 323| | idx2 = (idx2 << 8) - idx2; 324| | idx2 = _pext_u64(0x0E0C0A0806040200, idx2); 325| | idx3 = (idx3 << 8) - idx3; 326| | idx3 = _pext_u64(0x0E0C0A0806040200, idx3); 327| | 328| | g0 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx0)); 329| | g1 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx1)); 330| | g0 = _mm256_inserti128_si256(g0, _mm_cvtsi64_si128(idx2), 1); 331| | g1 = _mm256_inserti128_si256(g1, _mm_cvtsi64_si128(idx3), 1); 332| |#else 333| 34.2k| g0 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 0) & 0xFF])); 334| 34.2k| g1 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 8) & 0xFF])); 335| 34.2k| g0 = _mm256_inserti128_si256(g0, _mm_loadl_epi64((__m128i *)&idx[(good >> 16) & 0xFF]), 1); 336| 34.2k| g1 = _mm256_inserti128_si256(g1, _mm_loadl_epi64((__m128i *)&idx[(good >> 24) & 0xFF]), 1); 337| 34.2k|#endif 338| | 339| 34.2k| g2 = _mm256_add_epi8(g0, ones); 340| 34.2k| g3 = _mm256_add_epi8(g1, ones); 341| 34.2k| g0 = _mm256_unpacklo_epi8(g0, g2); 342| 34.2k| g1 = _mm256_unpacklo_epi8(g1, g3); 343| | 344| 34.2k| f0 = _mm256_shuffle_epi8(f0, g0); 345| 34.2k| f1 = _mm256_shuffle_epi8(f1, g1); 346| | 347| 34.2k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f0)); 348| 34.2k| ctr += _mm_popcnt_u32((good >> 0) & 0xFF); 349| 34.2k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f0, 1)); 350| 34.2k| ctr += _mm_popcnt_u32((good >> 16) & 0xFF); 351| 34.2k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f1)); 352| 34.2k| ctr += _mm_popcnt_u32((good >> 8) & 0xFF); 353| 34.2k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f1, 1)); 354| 34.2k| ctr += _mm_popcnt_u32((good >> 24) & 0xFF); 355| 34.2k| } 356| | 357| 12.5k| while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 33| 12.5k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 9| 8.89k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 8.89k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 8.89k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 8.89k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 8.89k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 8.89k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 8.89k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 8.89k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 8.89k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 8.89k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 8.89k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 8.89k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 8.89k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (357:9): [True: 8.89k, False: 3.67k] | Branch (357:31): [True: 8.82k, False: 66] ------------------ 358| 8.82k| f = _mm_loadu_si128((__m128i *)&buf[pos]); 359| 8.82k| f = _mm_shuffle_epi8(f, _mm256_castsi256_si128(idx8)); 360| 8.82k| t = _mm_srli_epi16(f, 4); 361| 8.82k| f = _mm_blend_epi16(f, t, 0xAA); 362| 8.82k| f = _mm_and_si128(f, _mm256_castsi256_si128(mask)); 363| 8.82k| pos += 12; 364| | 365| 8.82k| t = _mm_cmpgt_epi16(_mm256_castsi256_si128(bound), f); 366| 8.82k| good = _mm_movemask_epi8(t); 367| | 368| |#ifdef BMI 369| | good &= 0x5555; 370| | idx0 = _pdep_u64(good, 0x1111111111111111); 371| | idx0 = (idx0 << 8) - idx0; 372| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 373| | pilo = _mm_cvtsi64_si128(idx0); 374| |#else 375| 8.82k| good = _pext_u32(good, 0x5555); 376| 8.82k| pilo = _mm_loadl_epi64((__m128i *)&idx[good]); 377| 8.82k|#endif 378| | 379| 8.82k| pihi = _mm_add_epi8(pilo, _mm256_castsi256_si128(ones)); 380| 8.82k| pilo = _mm_unpacklo_epi8(pilo, pihi); 381| 8.82k| f = _mm_shuffle_epi8(f, pilo); 382| 8.82k| _mm_storeu_si128((__m128i *)&r[ctr], f); 383| 8.82k| ctr += _mm_popcnt_u32(good); 384| 8.82k| } 385| | 386| 13.3k| while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 33| 26.7k|#define KYBER_N 256 ------------------ while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 9| 9.92k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 9.92k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 9.92k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 9.92k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 9.92k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 9.92k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 9.92k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 9.92k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 9.92k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 9.92k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 9.92k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 9.92k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 9.92k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (386:9): [True: 9.92k, False: 3.47k] | Branch (386:26): [True: 9.65k, False: 270] ------------------ 387| 9.65k| val0 = ((buf[pos+0] >> 0) | ((uint16_t)buf[pos+1] << 8)) & 0xFFF; 388| 9.65k| val1 = ((buf[pos+1] >> 4) | ((uint16_t)buf[pos+2] << 4)); 389| 9.65k| pos += 3; 390| | 391| 9.65k| if(val0 < KYBER_Q) ------------------ | | 34| 9.65k|#define KYBER_Q 3329 ------------------ | Branch (391:8): [True: 7.86k, False: 1.78k] ------------------ 392| 7.86k| r[ctr++] = val0; 393| 9.65k| if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 34| 19.3k|#define KYBER_Q 3329 ------------------ if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 33| 7.90k|#define KYBER_N 256 ------------------ | Branch (393:8): [True: 7.90k, False: 1.74k] | Branch (393:26): [True: 6.43k, False: 1.46k] ------------------ 394| 6.43k| r[ctr++] = val1; 395| 9.65k| } 396| | 397| 3.74k| return ctr; 398| 3.74k|} pqcrystals_kyber1024_avx2_kyber_shake256_prf: 44| 156|{ 45| 156| uint8_t extkey[KYBER_SYMBYTES+1]; 46| | 47| 156| memcpy(extkey, key, KYBER_SYMBYTES); ------------------ | | 36| 156|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 48| 156| extkey[KYBER_SYMBYTES] = nonce; ------------------ | | 36| 156|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 49| | 50| 156| shake256(out, outlen, extkey, sizeof(extkey)); ------------------ | | 12| 156|#define shake256 OQS_SHA3_shake256 ------------------ 51| 156|} pqcrystals_kyber1024_avx2_verify: 18| 78|{ 19| 78| size_t i; 20| 78| uint64_t r; 21| 78| __m256i f, g, h; 22| | 23| 78| h = _mm256_setzero_si256(); 24| 3.90k| for(i=0;i> 63; 39| 78| return r; 40| 78|} pqcrystals_kyber1024_avx2_cmov: 56| 78|{ 57| 78| size_t i; 58| 78| __m256i xvec, rvec, bvec; 59| | 60| 78|#if defined(__GNUC__) || defined(__clang__) 61| | // Prevent the compiler from 62| | // 1) inferring that b is 0/1-valued, and 63| | // 2) handling the two cases with a branch. 64| | // This is not necessary when verify.c and kem.c are separate translation 65| | // units, but we expect that downstream consumers will copy this code and/or 66| | // change how it is built. 67| 78| __asm__("" : "+r"(b) : /* no inputs */); 68| 78|#endif 69| | 70| 78| bvec = _mm256_set1_epi64x(-(uint64_t)b); 71| 156| for(i=0;ivec[4*i+0]); 126| 456| f1 = _mm256_load_si256(&a->vec[4*i+1]); 127| 456| f2 = _mm256_load_si256(&a->vec[4*i+2]); 128| 456| f3 = _mm256_load_si256(&a->vec[4*i+3]); 129| 456| f0 = _mm256_mulhi_epi16(f0,v); 130| 456| f1 = _mm256_mulhi_epi16(f1,v); 131| 456| f2 = _mm256_mulhi_epi16(f2,v); 132| 456| f3 = _mm256_mulhi_epi16(f3,v); 133| 456| f0 = _mm256_mulhrs_epi16(f0,shift1); 134| 456| f1 = _mm256_mulhrs_epi16(f1,shift1); 135| 456| f2 = _mm256_mulhrs_epi16(f2,shift1); 136| 456| f3 = _mm256_mulhrs_epi16(f3,shift1); 137| 456| f0 = _mm256_and_si256(f0,mask); 138| 456| f1 = _mm256_and_si256(f1,mask); 139| 456| f2 = _mm256_and_si256(f2,mask); 140| 456| f3 = _mm256_and_si256(f3,mask); 141| 456| f0 = _mm256_packus_epi16(f0,f1); 142| 456| f2 = _mm256_packus_epi16(f2,f3); 143| 456| f0 = _mm256_maddubs_epi16(f0,shift2); 144| 456| f2 = _mm256_maddubs_epi16(f2,shift2); 145| 456| f0 = _mm256_packus_epi16(f0,f2); 146| 456| f0 = _mm256_permutevar8x32_epi32(f0,permdidx); 147| 456| _mm256_storeu_si256((__m256i *)&r[32*i],f0); 148| 456| } 149| 114|} pqcrystals_kyber512_avx2_poly_decompress: 152| 57|{ 153| 57| unsigned int i; 154| 57| __m128i t; 155| 57| __m256i f; 156| 57| const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 57|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 57|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 57|#define _16XQ 0 ------------------ 157| 57| const __m256i shufbidx = _mm256_set_epi8(7,7,7,7,6,6,6,6,5,5,5,5,4,4,4,4, 158| 57| 3,3,3,3,2,2,2,2,1,1,1,1,0,0,0,0); 159| 57| const __m256i mask = _mm256_set1_epi32(0x00F0000F); 160| 57| const __m256i shift = _mm256_set1_epi32((128 << 16) + 2048); 161| | 162| 969| for(i=0;ivec[i],f); 170| 912| } 171| 57|} pqcrystals_kyber512_avx2_poly_tobytes: 255| 228|{ 256| 228| ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 23| 228|#define ntttobytes_avx KYBER_NAMESPACE(ntttobytes_avx) | | ------------------ | | | | 15| 228|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 39| 228|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 228|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 257| 228|} pqcrystals_kyber512_avx2_poly_frombytes: 270| 342|{ 271| 342| nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 25| 342|#define nttfrombytes_avx KYBER_NAMESPACE(nttfrombytes_avx) | | ------------------ | | | | 15| 342|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 39| 342|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 342|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 272| 342|} pqcrystals_kyber512_avx2_poly_frommsg: 283| 114|{ 284| |#if (KYBER_INDCPA_MSGBYTES != 32) 285| |#error "KYBER_INDCPA_MSGBYTES must be equal to 32!" 286| |#endif 287| 114| __m256i f, g0, g1, g2, g3, h0, h1, h2, h3; 288| 114| const __m256i shift = _mm256_broadcastsi128_si256(_mm_set_epi32(0,1,2,3)); 289| 114| const __m256i idx = _mm256_broadcastsi128_si256(_mm_set_epi8(15,14,11,10,7,6,3,2,13,12,9,8,5,4,1,0)); 290| 114| const __m256i hqs = _mm256_set1_epi16((KYBER_Q+1)/2); ------------------ | | 34| 114|#define KYBER_Q 3329 ------------------ 291| | 292| 114|#define FROMMSG64(i) \ 293| 114| g3 = _mm256_shuffle_epi32(f,0x55*i); \ 294| 114| g3 = _mm256_sllv_epi32(g3,shift); \ 295| 114| g3 = _mm256_shuffle_epi8(g3,idx); \ 296| 114| g0 = _mm256_slli_epi16(g3,12); \ 297| 114| g1 = _mm256_slli_epi16(g3,8); \ 298| 114| g2 = _mm256_slli_epi16(g3,4); \ 299| 114| g0 = _mm256_srai_epi16(g0,15); \ 300| 114| g1 = _mm256_srai_epi16(g1,15); \ 301| 114| g2 = _mm256_srai_epi16(g2,15); \ 302| 114| g3 = _mm256_srai_epi16(g3,15); \ 303| 114| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ 304| 114| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ 305| 114| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ 306| 114| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ 307| 114| h0 = _mm256_unpacklo_epi64(g0,g1); \ 308| 114| h2 = _mm256_unpackhi_epi64(g0,g1); \ 309| 114| h1 = _mm256_unpacklo_epi64(g2,g3); \ 310| 114| h3 = _mm256_unpackhi_epi64(g2,g3); \ 311| 114| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ 312| 114| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ 313| 114| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ 314| 114| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ 315| 114| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ 316| 114| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ 317| 114| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ 318| 114| _mm256_store_si256(&r->vec[8+2*i+1],g3) 319| | 320| 114| f = _mm256_loadu_si256((__m256i *)msg); 321| 114| FROMMSG64(0); ------------------ | | 293| 114| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 114| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 114| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 114| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 114| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 114| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 114| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 114| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 114| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 114| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 114| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 114| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 114| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 114| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 114| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 114| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 114| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 114| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 114| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 114| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 114| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 114| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 114| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 114| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 114| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 114| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 322| 114| FROMMSG64(1); ------------------ | | 293| 114| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 114| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 114| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 114| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 114| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 114| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 114| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 114| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 114| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 114| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 114| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 114| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 114| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 114| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 114| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 114| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 114| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 114| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 114| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 114| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 114| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 114| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 114| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 114| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 114| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 114| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 323| 114| FROMMSG64(2); ------------------ | | 293| 114| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 114| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 114| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 114| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 114| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 114| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 114| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 114| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 114| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 114| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 114| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 114| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 114| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 114| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 114| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 114| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 114| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 114| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 114| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 114| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 114| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 114| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 114| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 114| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 114| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 114| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 324| | FROMMSG64(3); ------------------ | | 293| 114| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 114| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 114| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 114| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 114| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 114| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 114| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 114| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 114| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 114| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 114| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 114| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 114| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 114| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 114| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 114| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 114| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 114| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 114| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 114| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 114| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 114| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 114| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 114| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 114| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 114| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 325| 114|} pqcrystals_kyber512_avx2_poly_tomsg: 339| 57|{ 340| 57| unsigned int i; 341| 57| uint32_t small; 342| 57| __m256i f0, f1, g0, g1; 343| 57| const __m256i hq = _mm256_set1_epi16((KYBER_Q - 1)/2); ------------------ | | 34| 57|#define KYBER_Q 3329 ------------------ 344| 57| const __m256i hhq = _mm256_set1_epi16((KYBER_Q - 1)/4); ------------------ | | 34| 57|#define KYBER_Q 3329 ------------------ 345| | 346| 513| for(i=0;ivec[2*i+0]); 348| 456| f1 = _mm256_load_si256(&a->vec[2*i+1]); 349| 456| f0 = _mm256_sub_epi16(hq, f0); 350| 456| f1 = _mm256_sub_epi16(hq, f1); 351| 456| g0 = _mm256_srai_epi16(f0, 15); 352| 456| g1 = _mm256_srai_epi16(f1, 15); 353| 456| f0 = _mm256_xor_si256(f0, g0); 354| 456| f1 = _mm256_xor_si256(f1, g1); 355| 456| f0 = _mm256_sub_epi16(f0, hhq); 356| 456| f1 = _mm256_sub_epi16(f1, hhq); 357| 456| f0 = _mm256_packs_epi16(f0, f1); 358| | f0 = _mm256_permute4x64_epi64(f0, 0xD8); 359| 456| small = _mm256_movemask_epi8(f0); 360| 456| memcpy(&msg[4*i], &small, 4); 361| 456| } 362| 57|} pqcrystals_kyber512_avx2_poly_getnoise_eta2: 397| 114|{ 398| 114| ALIGNED_UINT8(KYBER_ETA2*KYBER_N/4) buf; ------------------ | | 8| 114| union { \ | | 9| 114| uint8_t coeffs[N]; \ | | 10| 114| __m256i vec[(N+31)/32]; \ | | 11| 114| } ------------------ 399| 114| prf(buf.coeffs, KYBER_ETA2*KYBER_N/4, seed, nonce); ------------------ | | 58| 114| kyber_shake256_prf(OUT, OUTBYTES, KEY, NONCE) | | ------------------ | | | | 44| 114|#define kyber_shake256_prf KYBER_NAMESPACE(kyber_shake256_prf) | | | | ------------------ | | | | | | 15| 114|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | | | ------------------ | | ------------------ ------------------ 400| 114| poly_cbd_eta2(r, buf.vec); ------------------ | | 12| 114|#define poly_cbd_eta2 KYBER_NAMESPACE(poly_cbd_eta2) | | ------------------ | | | | 15| 114|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 401| 114|} pqcrystals_kyber512_avx2_poly_getnoise_eta2_4x: 415| 57|{ 416| 57| ALIGNED_UINT8(NOISE_NBLOCKS*SHAKE256_RATE) buf[4]; ------------------ | | 8| 57| union { \ | | 9| 57| uint8_t coeffs[N]; \ | | 10| 57| __m256i vec[(N+31)/32]; \ | | 11| 57| } ------------------ 417| 57| __m256i f; 418| 57| shake256x4incctx state; ------------------ | | 27| 57|#define shake256x4incctx OQS_SHA3_shake256_x4_inc_ctx ------------------ 419| | 420| 57| f = _mm256_loadu_si256((__m256i *)seed); 421| 57| _mm256_store_si256(buf[0].vec, f); 422| 57| _mm256_store_si256(buf[1].vec, f); 423| 57| _mm256_store_si256(buf[2].vec, f); 424| 57| _mm256_store_si256(buf[3].vec, f); 425| | 426| 57| buf[0].coeffs[32] = nonce0; 427| 57| buf[1].coeffs[32] = nonce1; 428| 57| buf[2].coeffs[32] = nonce2; 429| 57| buf[3].coeffs[32] = nonce3; 430| | 431| 57| shake256x4_inc_init(&state); ------------------ | | 28| 57|#define shake256x4_inc_init OQS_SHA3_shake256_x4_inc_init ------------------ 432| 57| shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 33); ------------------ | | 42| 57|#define shake256x4_absorb_once OQS_SHA3_shake256_x4_absorb_once ------------------ 433| 57| shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, NOISE_NBLOCKS, &state); ------------------ | | 49| 57| OQS_SHA3_shake256_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE256_RATE, STATE) | | ------------------ | | | | 320| 57|#define OQS_SHA3_SHAKE256_RATE 136 | | ------------------ ------------------ 434| 57| shake256x4_inc_ctx_release(&state); ------------------ | | 32| 57|#define shake256x4_inc_ctx_release OQS_SHA3_shake256_x4_inc_ctx_release ------------------ 435| | 436| 57| poly_cbd_eta1(r0, buf[0].vec); ------------------ | | 9| 57|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 57|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 437| 57| poly_cbd_eta1(r1, buf[1].vec); ------------------ | | 9| 57|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 57|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 438| 57| poly_cbd_eta1(r2, buf[2].vec); ------------------ | | 9| 57|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 57|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 439| 57| poly_cbd_eta1(r3, buf[3].vec); ------------------ | | 9| 57|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 57|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 440| 57|} pqcrystals_kyber512_avx2_poly_getnoise_eta1122_4x: 452| 114|{ 453| 114| ALIGNED_UINT8(NOISE_NBLOCKS*SHAKE256_RATE) buf[4]; ------------------ | | 8| 114| union { \ | | 9| 114| uint8_t coeffs[N]; \ | | 10| 114| __m256i vec[(N+31)/32]; \ | | 11| 114| } ------------------ 454| 114| __m256i f; 455| 114| shake256x4incctx state; ------------------ | | 27| 114|#define shake256x4incctx OQS_SHA3_shake256_x4_inc_ctx ------------------ 456| | 457| 114| f = _mm256_loadu_si256((__m256i *)seed); 458| 114| _mm256_store_si256(buf[0].vec, f); 459| 114| _mm256_store_si256(buf[1].vec, f); 460| 114| _mm256_store_si256(buf[2].vec, f); 461| 114| _mm256_store_si256(buf[3].vec, f); 462| | 463| 114| buf[0].coeffs[32] = nonce0; 464| 114| buf[1].coeffs[32] = nonce1; 465| 114| buf[2].coeffs[32] = nonce2; 466| 114| buf[3].coeffs[32] = nonce3; 467| | 468| 114| shake256x4_inc_init(&state); ------------------ | | 28| 114|#define shake256x4_inc_init OQS_SHA3_shake256_x4_inc_init ------------------ 469| 114| shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 33); ------------------ | | 42| 114|#define shake256x4_absorb_once OQS_SHA3_shake256_x4_absorb_once ------------------ 470| 114| shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, NOISE_NBLOCKS, &state); ------------------ | | 49| 114| OQS_SHA3_shake256_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE256_RATE, STATE) | | ------------------ | | | | 320| 114|#define OQS_SHA3_SHAKE256_RATE 136 | | ------------------ ------------------ 471| 114| shake256x4_inc_ctx_release(&state); ------------------ | | 32| 114|#define shake256x4_inc_ctx_release OQS_SHA3_shake256_x4_inc_ctx_release ------------------ 472| | 473| 114| poly_cbd_eta1(r0, buf[0].vec); ------------------ | | 9| 114|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 114|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 474| 114| poly_cbd_eta1(r1, buf[1].vec); ------------------ | | 9| 114|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 114|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 475| 114| poly_cbd_eta2(r2, buf[2].vec); ------------------ | | 12| 114|#define poly_cbd_eta2 KYBER_NAMESPACE(poly_cbd_eta2) | | ------------------ | | | | 15| 114|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 476| 114| poly_cbd_eta2(r3, buf[3].vec); ------------------ | | 12| 114|#define poly_cbd_eta2 KYBER_NAMESPACE(poly_cbd_eta2) | | ------------------ | | | | 15| 114|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 477| 114|} pqcrystals_kyber512_avx2_poly_ntt: 495| 570|{ 496| 570| ntt_avx(r->vec, qdata.vec); ------------------ | | 7| 570|#define ntt_avx KYBER_NAMESPACE(ntt_avx) | | ------------------ | | | | 15| 570|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ ntt_avx(r->vec, qdata.vec); ------------------ | | 39| 570|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 570|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 497| 570|} pqcrystals_kyber512_avx2_poly_invntt_tomont: 512| 399|{ 513| 399| invntt_avx(r->vec, qdata.vec); ------------------ | | 9| 399|#define invntt_avx KYBER_NAMESPACE(invntt_avx) | | ------------------ | | | | 15| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ invntt_avx(r->vec, qdata.vec); ------------------ | | 39| 399|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 514| 399|} pqcrystals_kyber512_avx2_poly_nttunpack: 517| 684|{ 518| 684| nttunpack_avx(r->vec, qdata.vec); ------------------ | | 14| 684|#define nttunpack_avx KYBER_NAMESPACE(nttunpack_avx) | | ------------------ | | | | 15| 684|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ nttunpack_avx(r->vec, qdata.vec); ------------------ | | 39| 684|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 684|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 519| 684|} pqcrystals_kyber512_avx2_poly_basemul_montgomery: 534| 1.02k|{ 535| 1.02k| basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 17| 1.02k|#define basemul_avx KYBER_NAMESPACE(basemul_avx) | | ------------------ | | | | 15| 1.02k|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 39| 1.02k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 1.02k|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 536| 1.02k|} pqcrystals_kyber512_avx2_poly_tomont: 547| 114|{ 548| 114| tomont_avx(r->vec, qdata.vec); ------------------ | | 9| 114|#define tomont_avx KYBER_NAMESPACE(tomont_avx) | | ------------------ | | | | 15| 114|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ tomont_avx(r->vec, qdata.vec); ------------------ | | 39| 114|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 114|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 549| 114|} pqcrystals_kyber512_avx2_poly_reduce: 560| 627|{ 561| 627| reduce_avx(r->vec, qdata.vec); ------------------ | | 7| 627|#define reduce_avx KYBER_NAMESPACE(reduce_avx) | | ------------------ | | | | 15| 627|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ reduce_avx(r->vec, qdata.vec); ------------------ | | 39| 627|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 627|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 562| 627|} pqcrystals_kyber512_avx2_poly_add: 575| 1.08k|{ 576| 1.08k| unsigned int i; 577| 1.08k| __m256i f0, f1; 578| | 579| 18.4k| for(i=0;ivec[i]); 581| 17.3k| f1 = _mm256_load_si256(&b->vec[i]); 582| 17.3k| f0 = _mm256_add_epi16(f0, f1); 583| 17.3k| _mm256_store_si256(&r->vec[i], f0); 584| 17.3k| } 585| 1.08k|} pqcrystals_kyber512_avx2_poly_sub: 598| 57|{ 599| 57| unsigned int i; 600| 57| __m256i f0, f1; 601| | 602| 969| for(i=0;ivec[i]); 604| 912| f1 = _mm256_load_si256(&b->vec[i]); 605| 912| f0 = _mm256_sub_epi16(f0, f1); 606| 912| _mm256_store_si256(&r->vec[i], f0); 607| 912| } 608| 57|} pqcrystals_kyber512_avx2_polyvec_compress: 158| 114|{ 159| 114| unsigned int i; 160| | 161| 114|#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 162| 342| for(i=0;ivec[i]); 164| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 165| | for(i=0;ivec[i]); 167| |#endif 168| 114|} pqcrystals_kyber512_avx2_polyvec_decompress: 181| 57|{ 182| 57| unsigned int i; 183| | 184| 57|#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 185| 171| for(i=0;ivec[i],&a[320*i]); 187| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 188| | for(i=0;ivec[i],&a[352*i]); 190| |#endif 191| 57|} pqcrystals_kyber512_avx2_polyvec_tobytes: 203| 114|{ 204| 114| unsigned int i; 205| 342| for(i=0;ivec[i]); ------------------ | | 15| 228|#define poly_tobytes KYBER_NAMESPACE(poly_tobytes) | | ------------------ | | | | 15| 228|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ poly_tobytes(r+i*KYBER_POLYBYTES, &a->vec[i]); ------------------ | | 39| 228|#define KYBER_POLYBYTES 384 ------------------ 207| 114|} pqcrystals_kyber512_avx2_polyvec_frombytes: 220| 171|{ 221| 171| unsigned int i; 222| 513| for(i=0;ivec[i], a+i*KYBER_POLYBYTES); ------------------ | | 17| 342|#define poly_frombytes KYBER_NAMESPACE(poly_frombytes) | | ------------------ | | | | 15| 342|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ poly_frombytes(&r->vec[i], a+i*KYBER_POLYBYTES); ------------------ | | 39| 342|#define KYBER_POLYBYTES 384 ------------------ 224| 171|} pqcrystals_kyber512_avx2_polyvec_ntt: 234| 285|{ 235| 285| unsigned int i; 236| 855| for(i=0;ivec[i]); ------------------ | | 58| 570|#define poly_ntt KYBER_NAMESPACE(poly_ntt) | | ------------------ | | | | 15| 570|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 238| 285|} pqcrystals_kyber512_avx2_polyvec_invntt_tomont: 249| 114|{ 250| 114| unsigned int i; 251| 342| for(i=0;ivec[i]); ------------------ | | 60| 228|#define poly_invntt_tomont KYBER_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 15| 228|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 253| 114|} pqcrystals_kyber512_avx2_polyvec_basemul_acc_montgomery: 266| 513|{ 267| 513| unsigned int i; 268| 513| poly tmp; 269| | 270| 513| poly_basemul_montgomery(r,&a->vec[0],&b->vec[0]); ------------------ | | 64| 513|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 15| 513|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 271| 1.02k| for(i=1;ivec[i],&b->vec[i]); ------------------ | | 64| 513|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 15| 513|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 273| 513| poly_add(r,r,&tmp); ------------------ | | 72| 513|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 15| 513|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 274| 513| } 275| 513|} pqcrystals_kyber512_avx2_polyvec_reduce: 287| 228|{ 288| 228| unsigned int i; 289| 684| for(i=0;ivec[i]); ------------------ | | 69| 456|#define poly_reduce KYBER_NAMESPACE(poly_reduce) | | ------------------ | | | | 15| 456|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 291| 228|} pqcrystals_kyber512_avx2_polyvec_add: 303| 171|{ 304| 171| unsigned int i; 305| 513| for(i=0;ivec[i], &a->vec[i], &b->vec[i]); ------------------ | | 72| 342|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 15| 342|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 307| 171|} polyvec.c:poly_compress10: 12| 984|{ 13| 984| unsigned int i; 14| 984| __m256i f0, f1, f2; 15| 984| __m128i t0, t1; 16| 984| const __m256i v = _mm256_load_si256(&qdata.vec[_16XV/16]); ------------------ | | 39| 984|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 984|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ const __m256i v = _mm256_load_si256(&qdata.vec[_16XV/16]); ------------------ | | 8| 984|#define _16XV 32 ------------------ 17| 984| const __m256i v8 = _mm256_slli_epi16(v,3); 18| 984| const __m256i off = _mm256_set1_epi16(15); 19| 984| const __m256i shift1 = _mm256_set1_epi16(1 << 12); 20| 984| const __m256i mask = _mm256_set1_epi16(1023); 21| 984| const __m256i shift2 = _mm256_set1_epi64x((1024LL << 48) + (1LL << 32) + (1024 << 16) + 1); 22| 984| const __m256i sllvdidx = _mm256_set1_epi64x(12); 23| 984| const __m256i shufbidx = _mm256_set_epi8( 8, 4, 3, 2, 1, 0,-1,-1,-1,-1,-1,-1,12,11,10, 9, 24| 984| -1,-1,-1,-1,-1,-1,12,11,10, 9, 8, 4, 3, 2, 1, 0); 25| | 26| 16.7k| for(i=0;ivec[i]); 28| 15.7k| f1 = _mm256_mullo_epi16(f0,v8); 29| 15.7k| f2 = _mm256_add_epi16(f0,off); 30| 15.7k| f0 = _mm256_slli_epi16(f0,3); 31| 15.7k| f0 = _mm256_mulhi_epi16(f0,v); 32| 15.7k| f2 = _mm256_sub_epi16(f1,f2); 33| 15.7k| f1 = _mm256_andnot_si256(f1,f2); 34| 15.7k| f1 = _mm256_srli_epi16(f1,15); 35| 15.7k| f0 = _mm256_sub_epi16(f0,f1); 36| 15.7k| f0 = _mm256_mulhrs_epi16(f0,shift1); 37| 15.7k| f0 = _mm256_and_si256(f0,mask); 38| 15.7k| f0 = _mm256_madd_epi16(f0,shift2); 39| 15.7k| f0 = _mm256_sllv_epi32(f0,sllvdidx); 40| 15.7k| f0 = _mm256_srli_epi64(f0,12); 41| 15.7k| f0 = _mm256_shuffle_epi8(f0,shufbidx); 42| 15.7k| t0 = _mm256_castsi256_si128(f0); 43| 15.7k| t1 = _mm256_extracti128_si256(f0,1); 44| | t0 = _mm_blend_epi16(t0,t1,0xE0); 45| 15.7k| _mm_storeu_si128((__m128i *)&r[20*i+ 0],t0); 46| 15.7k| memcpy(&r[20*i+16],&t1,4); 47| 15.7k| } 48| 984|} polyvec.c:poly_decompress10: 51| 492|{ 52| 492| unsigned int i; 53| 492| __m256i f; 54| 492| const __m256i q = _mm256_set1_epi32((KYBER_Q << 16) + 4*KYBER_Q); ------------------ | | 34| 492|#define KYBER_Q 3329 ------------------ const __m256i q = _mm256_set1_epi32((KYBER_Q << 16) + 4*KYBER_Q); ------------------ | | 34| 492|#define KYBER_Q 3329 ------------------ 55| 492| const __m256i shufbidx = _mm256_set_epi8(11,10,10, 9, 9, 8, 8, 7, 56| 492| 6, 5, 5, 4, 4, 3, 3, 2, 57| 492| 9, 8, 8, 7, 7, 6, 6, 5, 58| 492| 4, 3, 3, 2, 2, 1, 1, 0); 59| 492| const __m256i sllvdidx = _mm256_set1_epi64x(4); 60| 492| const __m256i mask = _mm256_set1_epi32((32736 << 16) + 8184); 61| | 62| 8.36k| for(i=0;ivec[i],f); 71| 7.87k| } 72| 492|} pqcrystals_kyber512_avx2_rej_uniform_avx: 275| 684|{ 276| 684| unsigned int ctr, pos; 277| 684| uint16_t val0, val1; 278| 684| uint32_t good; 279| |#ifdef BMI 280| | uint64_t idx0, idx1, idx2, idx3; 281| |#endif 282| 684| const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 684|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 684|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 684|#define _16XQ 0 ------------------ 283| 684| const __m256i ones = _mm256_set1_epi8(1); 284| 684| const __m256i mask = _mm256_set1_epi16(0xFFF); 285| 684| const __m256i idx8 = _mm256_set_epi8(15,14,14,13,12,11,11,10, 286| 684| 9, 8, 8, 7, 6, 5, 5, 4, 287| 684| 11,10,10, 9, 8, 7, 7, 6, 288| 684| 5, 4, 4, 3, 2, 1, 1, 0); 289| 684| __m256i f0, f1, g0, g1, g2, g3; 290| 684| __m128i f, t, pilo, pihi; 291| | 292| 684| ctr = pos = 0; 293| 7.04k| while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 33| 7.04k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 9| 6.36k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 6.36k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 6.36k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 6.36k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 6.36k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 6.36k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 6.36k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 6.36k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 6.36k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 6.36k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 6.36k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 6.36k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 6.36k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (293:9): [True: 6.36k, False: 678] | Branch (293:32): [True: 6.36k, False: 6] ------------------ 294| 6.36k| f0 = _mm256_loadu_si256((__m256i *)&buf[pos]); 295| 6.36k| f1 = _mm256_loadu_si256((__m256i *)&buf[pos+24]); 296| 6.36k| f0 = _mm256_permute4x64_epi64(f0, 0x94); 297| 6.36k| f1 = _mm256_permute4x64_epi64(f1, 0x94); 298| 6.36k| f0 = _mm256_shuffle_epi8(f0, idx8); 299| 6.36k| f1 = _mm256_shuffle_epi8(f1, idx8); 300| 6.36k| g0 = _mm256_srli_epi16(f0, 4); 301| 6.36k| g1 = _mm256_srli_epi16(f1, 4); 302| 6.36k| f0 = _mm256_blend_epi16(f0, g0, 0xAA); 303| 6.36k| f1 = _mm256_blend_epi16(f1, g1, 0xAA); 304| 6.36k| f0 = _mm256_and_si256(f0, mask); 305| 6.36k| f1 = _mm256_and_si256(f1, mask); 306| 6.36k| pos += 48; 307| | 308| 6.36k| g0 = _mm256_cmpgt_epi16(bound, f0); 309| 6.36k| g1 = _mm256_cmpgt_epi16(bound, f1); 310| | 311| 6.36k| g0 = _mm256_packs_epi16(g0, g1); 312| 6.36k| good = _mm256_movemask_epi8(g0); 313| | 314| |#ifdef BMI 315| | idx0 = _pdep_u64(good >> 0, 0x0101010101010101); 316| | idx1 = _pdep_u64(good >> 8, 0x0101010101010101); 317| | idx2 = _pdep_u64(good >> 16, 0x0101010101010101); 318| | idx3 = _pdep_u64(good >> 24, 0x0101010101010101); 319| | idx0 = (idx0 << 8) - idx0; 320| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 321| | idx1 = (idx1 << 8) - idx1; 322| | idx1 = _pext_u64(0x0E0C0A0806040200, idx1); 323| | idx2 = (idx2 << 8) - idx2; 324| | idx2 = _pext_u64(0x0E0C0A0806040200, idx2); 325| | idx3 = (idx3 << 8) - idx3; 326| | idx3 = _pext_u64(0x0E0C0A0806040200, idx3); 327| | 328| | g0 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx0)); 329| | g1 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx1)); 330| | g0 = _mm256_inserti128_si256(g0, _mm_cvtsi64_si128(idx2), 1); 331| | g1 = _mm256_inserti128_si256(g1, _mm_cvtsi64_si128(idx3), 1); 332| |#else 333| 6.36k| g0 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 0) & 0xFF])); 334| 6.36k| g1 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 8) & 0xFF])); 335| 6.36k| g0 = _mm256_inserti128_si256(g0, _mm_loadl_epi64((__m128i *)&idx[(good >> 16) & 0xFF]), 1); 336| 6.36k| g1 = _mm256_inserti128_si256(g1, _mm_loadl_epi64((__m128i *)&idx[(good >> 24) & 0xFF]), 1); 337| 6.36k|#endif 338| | 339| 6.36k| g2 = _mm256_add_epi8(g0, ones); 340| 6.36k| g3 = _mm256_add_epi8(g1, ones); 341| 6.36k| g0 = _mm256_unpacklo_epi8(g0, g2); 342| 6.36k| g1 = _mm256_unpacklo_epi8(g1, g3); 343| | 344| 6.36k| f0 = _mm256_shuffle_epi8(f0, g0); 345| 6.36k| f1 = _mm256_shuffle_epi8(f1, g1); 346| | 347| 6.36k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f0)); 348| 6.36k| ctr += _mm_popcnt_u32((good >> 0) & 0xFF); 349| 6.36k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f0, 1)); 350| 6.36k| ctr += _mm_popcnt_u32((good >> 16) & 0xFF); 351| 6.36k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f1)); 352| 6.36k| ctr += _mm_popcnt_u32((good >> 8) & 0xFF); 353| 6.36k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f1, 1)); 354| 6.36k| ctr += _mm_popcnt_u32((good >> 24) & 0xFF); 355| 6.36k| } 356| | 357| 2.29k| while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 33| 2.29k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 9| 1.65k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 1.65k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 1.65k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 1.65k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 1.65k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 1.65k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 1.65k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 1.65k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 1.65k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 1.65k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 1.65k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 1.65k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 1.65k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (357:9): [True: 1.65k, False: 639] | Branch (357:31): [True: 1.60k, False: 45] ------------------ 358| 1.60k| f = _mm_loadu_si128((__m128i *)&buf[pos]); 359| 1.60k| f = _mm_shuffle_epi8(f, _mm256_castsi256_si128(idx8)); 360| 1.60k| t = _mm_srli_epi16(f, 4); 361| 1.60k| f = _mm_blend_epi16(f, t, 0xAA); 362| 1.60k| f = _mm_and_si128(f, _mm256_castsi256_si128(mask)); 363| 1.60k| pos += 12; 364| | 365| 1.60k| t = _mm_cmpgt_epi16(_mm256_castsi256_si128(bound), f); 366| 1.60k| good = _mm_movemask_epi8(t); 367| | 368| |#ifdef BMI 369| | good &= 0x5555; 370| | idx0 = _pdep_u64(good, 0x1111111111111111); 371| | idx0 = (idx0 << 8) - idx0; 372| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 373| | pilo = _mm_cvtsi64_si128(idx0); 374| |#else 375| 1.60k| good = _pext_u32(good, 0x5555); 376| 1.60k| pilo = _mm_loadl_epi64((__m128i *)&idx[good]); 377| 1.60k|#endif 378| | 379| 1.60k| pihi = _mm_add_epi8(pilo, _mm256_castsi256_si128(ones)); 380| 1.60k| pilo = _mm_unpacklo_epi8(pilo, pihi); 381| 1.60k| f = _mm_shuffle_epi8(f, pilo); 382| 1.60k| _mm_storeu_si128((__m128i *)&r[ctr], f); 383| 1.60k| ctr += _mm_popcnt_u32(good); 384| 1.60k| } 385| | 386| 2.27k| while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 33| 4.54k|#define KYBER_N 256 ------------------ while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 9| 1.74k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 1.74k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 1.74k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 1.74k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 1.74k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 1.74k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 1.74k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 1.74k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 1.74k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 1.74k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 1.74k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 1.74k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 1.74k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (386:9): [True: 1.74k, False: 531] | Branch (386:26): [True: 1.58k, False: 153] ------------------ 387| 1.58k| val0 = ((buf[pos+0] >> 0) | ((uint16_t)buf[pos+1] << 8)) & 0xFFF; 388| 1.58k| val1 = ((buf[pos+1] >> 4) | ((uint16_t)buf[pos+2] << 4)); 389| 1.58k| pos += 3; 390| | 391| 1.58k| if(val0 < KYBER_Q) ------------------ | | 34| 1.58k|#define KYBER_Q 3329 ------------------ | Branch (391:8): [True: 1.21k, False: 369] ------------------ 392| 1.21k| r[ctr++] = val0; 393| 1.58k| if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 34| 3.17k|#define KYBER_Q 3329 ------------------ if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 33| 1.26k|#define KYBER_N 256 ------------------ | Branch (393:8): [True: 1.26k, False: 321] | Branch (393:26): [True: 1.06k, False: 204] ------------------ 394| 1.06k| r[ctr++] = val1; 395| 1.58k| } 396| | 397| 684| return ctr; 398| 684|} pqcrystals_kyber512_avx2_kyber_shake256_prf: 44| 114|{ 45| 114| uint8_t extkey[KYBER_SYMBYTES+1]; 46| | 47| 114| memcpy(extkey, key, KYBER_SYMBYTES); ------------------ | | 36| 114|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 48| 114| extkey[KYBER_SYMBYTES] = nonce; ------------------ | | 36| 114|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 49| | 50| 114| shake256(out, outlen, extkey, sizeof(extkey)); ------------------ | | 12| 114|#define shake256 OQS_SHA3_shake256 ------------------ 51| 114|} pqcrystals_kyber512_avx2_verify: 18| 57|{ 19| 57| size_t i; 20| 57| uint64_t r; 21| 57| __m256i f, g, h; 22| | 23| 57| h = _mm256_setzero_si256(); 24| 1.42k| for(i=0;i> 63; 39| 57| return r; 40| 57|} pqcrystals_kyber512_avx2_cmov: 56| 57|{ 57| 57| size_t i; 58| 57| __m256i xvec, rvec, bvec; 59| | 60| 57|#if defined(__GNUC__) || defined(__clang__) 61| | // Prevent the compiler from 62| | // 1) inferring that b is 0/1-valued, and 63| | // 2) handling the two cases with a branch. 64| | // This is not necessary when verify.c and kem.c are separate translation 65| | // units, but we expect that downstream consumers will copy this code and/or 66| | // change how it is built. 67| 57| __asm__("" : "+r"(b) : /* no inputs */); 68| 57|#endif 69| | 70| 57| bvec = _mm256_set1_epi64x(-(uint64_t)b); 71| 114| for(i=0;i> 0) | ((uint16_t)buf[pos+1] << 8)) & 0xFFF; 135| 3.81k| val1 = ((buf[pos+1] >> 4) | ((uint16_t)buf[pos+2] << 4)) & 0xFFF; 136| 3.81k| pos += 3; 137| | 138| 3.81k| if(val0 < KYBER_Q) ------------------ | | 34| 3.81k|#define KYBER_Q 3329 ------------------ | Branch (138:8): [True: 2.79k, False: 1.01k] ------------------ 139| 2.79k| r[ctr++] = val0; 140| 3.81k| if(ctr < len && val1 < KYBER_Q) ------------------ | | 34| 3.32k|#define KYBER_Q 3329 ------------------ | Branch (140:8): [True: 3.32k, False: 489] | Branch (140:21): [True: 2.39k, False: 930] ------------------ 141| 2.39k| r[ctr++] = val1; 142| 3.81k| } 143| | 144| 2.95k| return ctr; 145| 2.95k|} indcpa.c:pack_sk: 61| 261|{ 62| 261| polyvec_tobytes(r, sk); ------------------ | | 17| 261|#define polyvec_tobytes KYBER_NAMESPACE(polyvec_tobytes) | | ------------------ | | | | 15| 261|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ 63| 261|} indcpa.c:pack_ciphertext: 90| 522|{ 91| 522| polyvec_compress(r, b); ------------------ | | 12| 522|#define polyvec_compress KYBER_NAMESPACE(polyvec_compress) | | ------------------ | | | | 15| 522|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ 92| 522| poly_compress(r+KYBER_POLYVECCOMPRESSEDBYTES, v); ------------------ | | 15| 522|#define poly_compress KYBER_NAMESPACE(poly_compress) | | ------------------ | | | | 15| 522|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ poly_compress(r+KYBER_POLYVECCOMPRESSEDBYTES, v); ------------------ | | 45| 522|#define KYBER_POLYVECCOMPRESSEDBYTES (KYBER_K * 320) ------------------ 93| 522|} indcpa.c:unpack_ciphertext: 106| 261|{ 107| 261| polyvec_decompress(b, c); ------------------ | | 14| 261|#define polyvec_decompress KYBER_NAMESPACE(polyvec_decompress) | | ------------------ | | | | 15| 261|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ 108| 261| poly_decompress(v, c+KYBER_POLYVECCOMPRESSEDBYTES); ------------------ | | 17| 261|#define poly_decompress KYBER_NAMESPACE(poly_decompress) | | ------------------ | | | | 15| 261|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ poly_decompress(v, c+KYBER_POLYVECCOMPRESSEDBYTES); ------------------ | | 45| 261|#define KYBER_POLYVECCOMPRESSEDBYTES (KYBER_K * 320) ------------------ 109| 261|} indcpa.c:unpack_sk: 74| 261|{ 75| 261| polyvec_frombytes(sk, packedsk); ------------------ | | 19| 261|#define polyvec_frombytes KYBER_NAMESPACE(polyvec_frombytes) | | ------------------ | | | | 15| 261|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ 76| 261|} pqcrystals_kyber768_avx2_poly_cbd_eta1: 127| 3.02k|{ 128| 3.02k|#if KYBER_ETA1 == 2 129| 3.02k| cbd2(r, buf); 130| |#elif KYBER_ETA1 == 3 131| | cbd3(r, (uint8_t *)buf); 132| |#else 133| |#error "This implementation requires eta1 in {2,3}" 134| |#endif 135| 3.02k|} pqcrystals_kyber768_avx2_gen_matrix: 271| 378|{ 272| 378| unsigned int ctr0, ctr1, ctr2, ctr3; 273| 378| ALIGNED_UINT8(REJ_UNIFORM_AVX_NBLOCKS*SHAKE128_RATE) buf[4]; ------------------ | | 8| 378| union { \ | | 9| 378| uint8_t coeffs[N]; \ | | 10| 378| __m256i vec[(N+31)/32]; \ | | 11| 378| } ------------------ 274| 378| __m256i f; 275| 378| shake128x4incctx state; ------------------ | | 18| 378|#define shake128x4incctx OQS_SHA3_shake128_x4_inc_ctx ------------------ 276| 378| shake128incctx state1x; ------------------ | | 38| 378|#define shake128incctx OQS_SHA3_shake128_inc_ctx ------------------ 277| | 278| 378| f = _mm256_loadu_si256((__m256i *)seed); 279| 378| _mm256_store_si256(buf[0].vec, f); 280| 378| _mm256_store_si256(buf[1].vec, f); 281| 378| _mm256_store_si256(buf[2].vec, f); 282| 378| _mm256_store_si256(buf[3].vec, f); 283| | 284| 378| if(transposed) { ------------------ | Branch (284:6): [True: 252, False: 126] ------------------ 285| 252| buf[0].coeffs[32] = 0; 286| 252| buf[0].coeffs[33] = 0; 287| 252| buf[1].coeffs[32] = 0; 288| 252| buf[1].coeffs[33] = 1; 289| 252| buf[2].coeffs[32] = 0; 290| 252| buf[2].coeffs[33] = 2; 291| 252| buf[3].coeffs[32] = 1; 292| 252| buf[3].coeffs[33] = 0; 293| 252| } 294| 126| else { 295| 126| buf[0].coeffs[32] = 0; 296| 126| buf[0].coeffs[33] = 0; 297| 126| buf[1].coeffs[32] = 1; 298| 126| buf[1].coeffs[33] = 0; 299| 126| buf[2].coeffs[32] = 2; 300| 126| buf[2].coeffs[33] = 0; 301| 126| buf[3].coeffs[32] = 0; 302| 126| buf[3].coeffs[33] = 1; 303| 126| } 304| | 305| 378| shake128x4_inc_init(&state); ------------------ | | 19| 378|#define shake128x4_inc_init OQS_SHA3_shake128_x4_inc_init ------------------ 306| 378| shake128x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 34); ------------------ | | 39| 378|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once ------------------ 307| 378| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, REJ_UNIFORM_AVX_NBLOCKS, &state); ------------------ | | 46| 378| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 378|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 308| | 309| 378| ctr0 = rej_uniform_avx(a[0].vec[0].coeffs, buf[0].coeffs); ------------------ | | 11| 378|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 310| 378| ctr1 = rej_uniform_avx(a[0].vec[1].coeffs, buf[1].coeffs); ------------------ | | 11| 378|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 311| 378| ctr2 = rej_uniform_avx(a[0].vec[2].coeffs, buf[2].coeffs); ------------------ | | 11| 378|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 312| 378| ctr3 = rej_uniform_avx(a[1].vec[0].coeffs, buf[3].coeffs); ------------------ | | 11| 378|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 313| | 314| 537| while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.07k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.03k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 992|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 416|#define KYBER_N 256 ------------------ | Branch (314:9): [True: 39, False: 498] | Branch (314:27): [True: 43, False: 455] | Branch (314:45): [True: 39, False: 416] | Branch (314:63): [True: 38, False: 378] ------------------ 315| 159| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 1, &state); ------------------ | | 46| 159| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 159|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 316| | 317| 159| ctr0 += rej_uniform(a[0].vec[0].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 33| 159|#define KYBER_N 256 ------------------ ctr0 += rej_uniform(a[0].vec[0].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 8| 159|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 159|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 318| 159| ctr1 += rej_uniform(a[0].vec[1].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 33| 159|#define KYBER_N 256 ------------------ ctr1 += rej_uniform(a[0].vec[1].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 8| 159|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 159|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 319| 159| ctr2 += rej_uniform(a[0].vec[2].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 33| 159|#define KYBER_N 256 ------------------ ctr2 += rej_uniform(a[0].vec[2].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 8| 159|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 159|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 320| 159| ctr3 += rej_uniform(a[1].vec[0].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 33| 159|#define KYBER_N 256 ------------------ ctr3 += rej_uniform(a[1].vec[0].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 8| 159|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 159|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 321| 159| } 322| | 323| 378| poly_nttunpack(&a[0].vec[0]); ------------------ | | 62| 378|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 324| 378| poly_nttunpack(&a[0].vec[1]); ------------------ | | 62| 378|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 325| 378| poly_nttunpack(&a[0].vec[2]); ------------------ | | 62| 378|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 326| 378| poly_nttunpack(&a[1].vec[0]); ------------------ | | 62| 378|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 327| | 328| 378| f = _mm256_loadu_si256((__m256i *)seed); 329| 378| _mm256_store_si256(buf[0].vec, f); 330| 378| _mm256_store_si256(buf[1].vec, f); 331| 378| _mm256_store_si256(buf[2].vec, f); 332| 378| _mm256_store_si256(buf[3].vec, f); 333| | 334| 378| if(transposed) { ------------------ | Branch (334:6): [True: 252, False: 126] ------------------ 335| 252| buf[0].coeffs[32] = 1; 336| 252| buf[0].coeffs[33] = 1; 337| 252| buf[1].coeffs[32] = 1; 338| 252| buf[1].coeffs[33] = 2; 339| 252| buf[2].coeffs[32] = 2; 340| 252| buf[2].coeffs[33] = 0; 341| 252| buf[3].coeffs[32] = 2; 342| 252| buf[3].coeffs[33] = 1; 343| 252| } 344| 126| else { 345| 126| buf[0].coeffs[32] = 1; 346| 126| buf[0].coeffs[33] = 1; 347| 126| buf[1].coeffs[32] = 2; 348| 126| buf[1].coeffs[33] = 1; 349| 126| buf[2].coeffs[32] = 0; 350| 126| buf[2].coeffs[33] = 2; 351| 126| buf[3].coeffs[32] = 1; 352| 126| buf[3].coeffs[33] = 2; 353| 126| } 354| | 355| 378| shake128x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 34); ------------------ | | 39| 378|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once ------------------ 356| 378| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, REJ_UNIFORM_AVX_NBLOCKS, &state); ------------------ | | 46| 378| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 378|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 357| | 358| 378| ctr0 = rej_uniform_avx(a[1].vec[1].coeffs, buf[0].coeffs); ------------------ | | 11| 378|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 359| 378| ctr1 = rej_uniform_avx(a[1].vec[2].coeffs, buf[1].coeffs); ------------------ | | 11| 378|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 360| 378| ctr2 = rej_uniform_avx(a[2].vec[0].coeffs, buf[2].coeffs); ------------------ | | 11| 378|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 361| 378| ctr3 = rej_uniform_avx(a[2].vec[1].coeffs, buf[3].coeffs); ------------------ | | 11| 378|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 362| | 363| 557| while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.11k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.07k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.02k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 424|#define KYBER_N 256 ------------------ | Branch (363:9): [True: 42, False: 515] | Branch (363:27): [True: 51, False: 464] | Branch (363:45): [True: 40, False: 424] | Branch (363:63): [True: 46, False: 378] ------------------ 364| 179| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 1, &state); ------------------ | | 46| 179| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 179|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 365| | 366| 179| ctr0 += rej_uniform(a[1].vec[1].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 33| 179|#define KYBER_N 256 ------------------ ctr0 += rej_uniform(a[1].vec[1].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 8| 179|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 179|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 367| 179| ctr1 += rej_uniform(a[1].vec[2].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 33| 179|#define KYBER_N 256 ------------------ ctr1 += rej_uniform(a[1].vec[2].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 8| 179|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 179|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 368| 179| ctr2 += rej_uniform(a[2].vec[0].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 33| 179|#define KYBER_N 256 ------------------ ctr2 += rej_uniform(a[2].vec[0].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 8| 179|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 179|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 369| 179| ctr3 += rej_uniform(a[2].vec[1].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 33| 179|#define KYBER_N 256 ------------------ ctr3 += rej_uniform(a[2].vec[1].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 8| 179|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 179|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 370| 179| } 371| 378| shake128x4_inc_ctx_release(&state); ------------------ | | 23| 378|#define shake128x4_inc_ctx_release OQS_SHA3_shake128_x4_inc_ctx_release ------------------ 372| | 373| 378| poly_nttunpack(&a[1].vec[1]); ------------------ | | 62| 378|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 374| 378| poly_nttunpack(&a[1].vec[2]); ------------------ | | 62| 378|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 375| 378| poly_nttunpack(&a[2].vec[0]); ------------------ | | 62| 378|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 376| 378| poly_nttunpack(&a[2].vec[1]); ------------------ | | 62| 378|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 377| | 378| 378| f = _mm256_loadu_si256((__m256i *)seed); 379| 378| _mm256_store_si256(buf[0].vec, f); 380| 378| buf[0].coeffs[32] = 2; 381| 378| buf[0].coeffs[33] = 2; 382| | 383| 378| shake128_inc_init(&state1x); ------------------ | | 39| 378|#define shake128_inc_init OQS_SHA3_shake128_inc_init ------------------ 384| 378| shake128_absorb_once(&state1x, buf[0].coeffs, 34); ------------------ | | 57| 378|#define shake128_absorb_once OQS_SHA3_shake128_absorb_once ------------------ 385| 378| shake128_squeezeblocks(buf[0].coeffs, REJ_UNIFORM_AVX_NBLOCKS, &state1x); ------------------ | | 64| 378| OQS_SHA3_shake128_inc_squeeze(OUT, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 378|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 386| 378| ctr0 = rej_uniform_avx(a[2].vec[2].coeffs, buf[0].coeffs); ------------------ | | 11| 378|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 387| 423| while(ctr0 < KYBER_N) { ------------------ | | 33| 423|#define KYBER_N 256 ------------------ | Branch (387:9): [True: 45, False: 378] ------------------ 388| 45| shake128_squeezeblocks(buf[0].coeffs, 1, &state1x); ------------------ | | 64| 45| OQS_SHA3_shake128_inc_squeeze(OUT, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 45|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 389| 45| ctr0 += rej_uniform(a[2].vec[2].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 33| 45|#define KYBER_N 256 ------------------ ctr0 += rej_uniform(a[2].vec[2].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 8| 45|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 45|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 390| 45| } 391| 378| shake128_inc_ctx_release(&state1x); ------------------ | | 43| 378|#define shake128_inc_ctx_release OQS_SHA3_shake128_inc_ctx_release ------------------ 392| | 393| 378| poly_nttunpack(&a[2].vec[2]); ------------------ | | 62| 378|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 394| 378|} pqcrystals_kyber768_avx2_indcpa_keypair: 472| 126|{ 473| 126| unsigned int i; 474| 126| uint8_t buf[2*KYBER_SYMBYTES]; 475| 126| const uint8_t *publicseed = buf; 476| 126| const uint8_t *noiseseed = buf + KYBER_SYMBYTES; ------------------ | | 36| 126|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 477| 126| polyvec a[KYBER_K], e, pkpv, skpv; 478| | 479| 126| randombytes(buf, KYBER_SYMBYTES); ------------------ | | 8| 126|#define randombytes OQS_randombytes ------------------ randombytes(buf, KYBER_SYMBYTES); ------------------ | | 36| 126|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 480| 126| hash_g(buf, buf, KYBER_SYMBYTES); ------------------ | | 53| 126|#define hash_g(OUT, IN, INBYTES) sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 31| 126|#define sha3_512 OQS_SHA3_sha3_512 | | ------------------ ------------------ 481| | 482| 126| gen_a(a, publicseed); ------------------ | | 157| 126|#define gen_a(A,B) gen_matrix(A,B,0) | | ------------------ | | | | 8| 126|#define gen_matrix KYBER_NAMESPACE(gen_matrix) | | | | ------------------ | | | | | | 21| 126|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | | | ------------------ | | ------------------ ------------------ 483| | 484| |#ifdef KYBER_90S 485| |#define NOISE_NBLOCKS ((KYBER_ETA1*KYBER_N/4)/AES256CTR_BLOCKBYTES) /* Assumes divisibility */ 486| | uint64_t nonce = 0; 487| | ALIGNED_UINT8(NOISE_NBLOCKS*AES256CTR_BLOCKBYTES+32) coins; // +32 bytes as required by poly_cbd_eta1 488| | aes256ctr_ctx state; 489| | aes256ctr_init_u64(&state, noiseseed, nonce++); 490| | for(i=0;ivec[4*i+0]); 126| 1.00k| f1 = _mm256_load_si256(&a->vec[4*i+1]); 127| 1.00k| f2 = _mm256_load_si256(&a->vec[4*i+2]); 128| 1.00k| f3 = _mm256_load_si256(&a->vec[4*i+3]); 129| 1.00k| f0 = _mm256_mulhi_epi16(f0,v); 130| 1.00k| f1 = _mm256_mulhi_epi16(f1,v); 131| 1.00k| f2 = _mm256_mulhi_epi16(f2,v); 132| 1.00k| f3 = _mm256_mulhi_epi16(f3,v); 133| 1.00k| f0 = _mm256_mulhrs_epi16(f0,shift1); 134| 1.00k| f1 = _mm256_mulhrs_epi16(f1,shift1); 135| 1.00k| f2 = _mm256_mulhrs_epi16(f2,shift1); 136| 1.00k| f3 = _mm256_mulhrs_epi16(f3,shift1); 137| 1.00k| f0 = _mm256_and_si256(f0,mask); 138| 1.00k| f1 = _mm256_and_si256(f1,mask); 139| 1.00k| f2 = _mm256_and_si256(f2,mask); 140| 1.00k| f3 = _mm256_and_si256(f3,mask); 141| 1.00k| f0 = _mm256_packus_epi16(f0,f1); 142| 1.00k| f2 = _mm256_packus_epi16(f2,f3); 143| 1.00k| f0 = _mm256_maddubs_epi16(f0,shift2); 144| 1.00k| f2 = _mm256_maddubs_epi16(f2,shift2); 145| 1.00k| f0 = _mm256_packus_epi16(f0,f2); 146| 1.00k| f0 = _mm256_permutevar8x32_epi32(f0,permdidx); 147| 1.00k| _mm256_storeu_si256((__m256i *)&r[32*i],f0); 148| 1.00k| } 149| 252|} pqcrystals_kyber768_avx2_poly_decompress: 152| 126|{ 153| 126| unsigned int i; 154| 126| __m128i t; 155| 126| __m256i f; 156| 126| const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 126|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 126|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 126|#define _16XQ 0 ------------------ 157| 126| const __m256i shufbidx = _mm256_set_epi8(7,7,7,7,6,6,6,6,5,5,5,5,4,4,4,4, 158| 126| 3,3,3,3,2,2,2,2,1,1,1,1,0,0,0,0); 159| 126| const __m256i mask = _mm256_set1_epi32(0x00F0000F); 160| 126| const __m256i shift = _mm256_set1_epi32((128 << 16) + 2048); 161| | 162| 2.14k| for(i=0;ivec[i],f); 170| 2.01k| } 171| 126|} pqcrystals_kyber768_avx2_poly_tobytes: 255| 756|{ 256| 756| ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 23| 756|#define ntttobytes_avx KYBER_NAMESPACE(ntttobytes_avx) | | ------------------ | | | | 21| 756|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 39| 756|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 756|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 257| 756|} pqcrystals_kyber768_avx2_poly_frombytes: 270| 1.13k|{ 271| 1.13k| nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 25| 1.13k|#define nttfrombytes_avx KYBER_NAMESPACE(nttfrombytes_avx) | | ------------------ | | | | 21| 1.13k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 39| 1.13k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 1.13k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 272| 1.13k|} pqcrystals_kyber768_avx2_poly_frommsg: 283| 252|{ 284| |#if (KYBER_INDCPA_MSGBYTES != 32) 285| |#error "KYBER_INDCPA_MSGBYTES must be equal to 32!" 286| |#endif 287| 252| __m256i f, g0, g1, g2, g3, h0, h1, h2, h3; 288| 252| const __m256i shift = _mm256_broadcastsi128_si256(_mm_set_epi32(0,1,2,3)); 289| 252| const __m256i idx = _mm256_broadcastsi128_si256(_mm_set_epi8(15,14,11,10,7,6,3,2,13,12,9,8,5,4,1,0)); 290| 252| const __m256i hqs = _mm256_set1_epi16((KYBER_Q+1)/2); ------------------ | | 34| 252|#define KYBER_Q 3329 ------------------ 291| | 292| 252|#define FROMMSG64(i) \ 293| 252| g3 = _mm256_shuffle_epi32(f,0x55*i); \ 294| 252| g3 = _mm256_sllv_epi32(g3,shift); \ 295| 252| g3 = _mm256_shuffle_epi8(g3,idx); \ 296| 252| g0 = _mm256_slli_epi16(g3,12); \ 297| 252| g1 = _mm256_slli_epi16(g3,8); \ 298| 252| g2 = _mm256_slli_epi16(g3,4); \ 299| 252| g0 = _mm256_srai_epi16(g0,15); \ 300| 252| g1 = _mm256_srai_epi16(g1,15); \ 301| 252| g2 = _mm256_srai_epi16(g2,15); \ 302| 252| g3 = _mm256_srai_epi16(g3,15); \ 303| 252| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ 304| 252| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ 305| 252| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ 306| 252| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ 307| 252| h0 = _mm256_unpacklo_epi64(g0,g1); \ 308| 252| h2 = _mm256_unpackhi_epi64(g0,g1); \ 309| 252| h1 = _mm256_unpacklo_epi64(g2,g3); \ 310| 252| h3 = _mm256_unpackhi_epi64(g2,g3); \ 311| 252| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ 312| 252| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ 313| 252| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ 314| 252| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ 315| 252| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ 316| 252| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ 317| 252| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ 318| 252| _mm256_store_si256(&r->vec[8+2*i+1],g3) 319| | 320| 252| f = _mm256_loadu_si256((__m256i *)msg); 321| 252| FROMMSG64(0); ------------------ | | 293| 252| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 252| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 252| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 252| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 252| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 252| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 252| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 252| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 252| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 252| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 252| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 252| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 252| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 252| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 252| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 252| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 252| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 252| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 252| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 252| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 252| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 252| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 252| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 252| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 252| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 252| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 322| 252| FROMMSG64(1); ------------------ | | 293| 252| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 252| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 252| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 252| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 252| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 252| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 252| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 252| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 252| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 252| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 252| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 252| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 252| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 252| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 252| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 252| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 252| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 252| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 252| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 252| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 252| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 252| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 252| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 252| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 252| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 252| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 323| 252| FROMMSG64(2); ------------------ | | 293| 252| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 252| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 252| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 252| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 252| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 252| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 252| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 252| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 252| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 252| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 252| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 252| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 252| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 252| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 252| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 252| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 252| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 252| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 252| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 252| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 252| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 252| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 252| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 252| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 252| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 252| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 324| | FROMMSG64(3); ------------------ | | 293| 252| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 252| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 252| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 252| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 252| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 252| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 252| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 252| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 252| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 252| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 252| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 252| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 252| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 252| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 252| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 252| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 252| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 252| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 252| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 252| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 252| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 252| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 252| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 252| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 252| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 252| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 325| 252|} pqcrystals_kyber768_avx2_poly_tomsg: 339| 126|{ 340| 126| unsigned int i; 341| 126| uint32_t small; 342| 126| __m256i f0, f1, g0, g1; 343| 126| const __m256i hq = _mm256_set1_epi16((KYBER_Q - 1)/2); ------------------ | | 34| 126|#define KYBER_Q 3329 ------------------ 344| 126| const __m256i hhq = _mm256_set1_epi16((KYBER_Q - 1)/4); ------------------ | | 34| 126|#define KYBER_Q 3329 ------------------ 345| | 346| 1.13k| for(i=0;ivec[2*i+0]); 348| 1.00k| f1 = _mm256_load_si256(&a->vec[2*i+1]); 349| 1.00k| f0 = _mm256_sub_epi16(hq, f0); 350| 1.00k| f1 = _mm256_sub_epi16(hq, f1); 351| 1.00k| g0 = _mm256_srai_epi16(f0, 15); 352| 1.00k| g1 = _mm256_srai_epi16(f1, 15); 353| 1.00k| f0 = _mm256_xor_si256(f0, g0); 354| 1.00k| f1 = _mm256_xor_si256(f1, g1); 355| 1.00k| f0 = _mm256_sub_epi16(f0, hhq); 356| 1.00k| f1 = _mm256_sub_epi16(f1, hhq); 357| 1.00k| f0 = _mm256_packs_epi16(f0, f1); 358| | f0 = _mm256_permute4x64_epi64(f0, 0xD8); 359| 1.00k| small = _mm256_movemask_epi8(f0); 360| 1.00k| memcpy(&msg[4*i], &small, 4); 361| 1.00k| } 362| 126|} pqcrystals_kyber768_avx2_poly_getnoise_eta2_4x: 415| 756|{ 416| 756| ALIGNED_UINT8(NOISE_NBLOCKS*SHAKE256_RATE) buf[4]; ------------------ | | 8| 756| union { \ | | 9| 756| uint8_t coeffs[N]; \ | | 10| 756| __m256i vec[(N+31)/32]; \ | | 11| 756| } ------------------ 417| 756| __m256i f; 418| 756| shake256x4incctx state; ------------------ | | 27| 756|#define shake256x4incctx OQS_SHA3_shake256_x4_inc_ctx ------------------ 419| | 420| 756| f = _mm256_loadu_si256((__m256i *)seed); 421| 756| _mm256_store_si256(buf[0].vec, f); 422| 756| _mm256_store_si256(buf[1].vec, f); 423| 756| _mm256_store_si256(buf[2].vec, f); 424| 756| _mm256_store_si256(buf[3].vec, f); 425| | 426| 756| buf[0].coeffs[32] = nonce0; 427| 756| buf[1].coeffs[32] = nonce1; 428| 756| buf[2].coeffs[32] = nonce2; 429| 756| buf[3].coeffs[32] = nonce3; 430| | 431| 756| shake256x4_inc_init(&state); ------------------ | | 28| 756|#define shake256x4_inc_init OQS_SHA3_shake256_x4_inc_init ------------------ 432| 756| shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 33); ------------------ | | 42| 756|#define shake256x4_absorb_once OQS_SHA3_shake256_x4_absorb_once ------------------ 433| 756| shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, NOISE_NBLOCKS, &state); ------------------ | | 49| 756| OQS_SHA3_shake256_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE256_RATE, STATE) | | ------------------ | | | | 320| 756|#define OQS_SHA3_SHAKE256_RATE 136 | | ------------------ ------------------ 434| 756| shake256x4_inc_ctx_release(&state); ------------------ | | 32| 756|#define shake256x4_inc_ctx_release OQS_SHA3_shake256_x4_inc_ctx_release ------------------ 435| | 436| 756| poly_cbd_eta1(r0, buf[0].vec); ------------------ | | 9| 756|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 21| 756|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 437| 756| poly_cbd_eta1(r1, buf[1].vec); ------------------ | | 9| 756|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 21| 756|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 438| 756| poly_cbd_eta1(r2, buf[2].vec); ------------------ | | 9| 756|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 21| 756|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 439| 756| poly_cbd_eta1(r3, buf[3].vec); ------------------ | | 9| 756|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 21| 756|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 440| 756|} pqcrystals_kyber768_avx2_poly_ntt: 495| 1.89k|{ 496| 1.89k| ntt_avx(r->vec, qdata.vec); ------------------ | | 7| 1.89k|#define ntt_avx KYBER_NAMESPACE(ntt_avx) | | ------------------ | | | | 21| 1.89k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ ntt_avx(r->vec, qdata.vec); ------------------ | | 39| 1.89k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 1.89k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 497| 1.89k|} pqcrystals_kyber768_avx2_poly_invntt_tomont: 512| 1.13k|{ 513| 1.13k| invntt_avx(r->vec, qdata.vec); ------------------ | | 9| 1.13k|#define invntt_avx KYBER_NAMESPACE(invntt_avx) | | ------------------ | | | | 21| 1.13k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ invntt_avx(r->vec, qdata.vec); ------------------ | | 39| 1.13k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 1.13k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 514| 1.13k|} pqcrystals_kyber768_avx2_poly_nttunpack: 517| 3.40k|{ 518| 3.40k| nttunpack_avx(r->vec, qdata.vec); ------------------ | | 14| 3.40k|#define nttunpack_avx KYBER_NAMESPACE(nttunpack_avx) | | ------------------ | | | | 21| 3.40k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ nttunpack_avx(r->vec, qdata.vec); ------------------ | | 39| 3.40k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 3.40k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 519| 3.40k|} pqcrystals_kyber768_avx2_poly_basemul_montgomery: 534| 4.53k|{ 535| 4.53k| basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 17| 4.53k|#define basemul_avx KYBER_NAMESPACE(basemul_avx) | | ------------------ | | | | 21| 4.53k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 39| 4.53k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 4.53k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 536| 4.53k|} pqcrystals_kyber768_avx2_poly_tomont: 547| 378|{ 548| 378| tomont_avx(r->vec, qdata.vec); ------------------ | | 9| 378|#define tomont_avx KYBER_NAMESPACE(tomont_avx) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ tomont_avx(r->vec, qdata.vec); ------------------ | | 39| 378|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 378|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 549| 378|} pqcrystals_kyber768_avx2_poly_reduce: 560| 1.89k|{ 561| 1.89k| reduce_avx(r->vec, qdata.vec); ------------------ | | 7| 1.89k|#define reduce_avx KYBER_NAMESPACE(reduce_avx) | | ------------------ | | | | 21| 1.89k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ reduce_avx(r->vec, qdata.vec); ------------------ | | 39| 1.89k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 1.89k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 562| 1.89k|} pqcrystals_kyber768_avx2_poly_add: 575| 4.66k|{ 576| 4.66k| unsigned int i; 577| 4.66k| __m256i f0, f1; 578| | 579| 79.2k| for(i=0;ivec[i]); 581| 74.5k| f1 = _mm256_load_si256(&b->vec[i]); 582| 74.5k| f0 = _mm256_add_epi16(f0, f1); 583| 74.5k| _mm256_store_si256(&r->vec[i], f0); 584| 74.5k| } 585| 4.66k|} pqcrystals_kyber768_avx2_poly_sub: 598| 126|{ 599| 126| unsigned int i; 600| 126| __m256i f0, f1; 601| | 602| 2.14k| for(i=0;ivec[i]); 604| 2.01k| f1 = _mm256_load_si256(&b->vec[i]); 605| 2.01k| f0 = _mm256_sub_epi16(f0, f1); 606| 2.01k| _mm256_store_si256(&r->vec[i], f0); 607| 2.01k| } 608| 126|} pqcrystals_kyber768_avx2_polyvec_compress: 158| 252|{ 159| 252| unsigned int i; 160| | 161| 252|#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 162| 1.00k| for(i=0;ivec[i]); 164| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 165| | for(i=0;ivec[i]); 167| |#endif 168| 252|} pqcrystals_kyber768_avx2_polyvec_decompress: 181| 126|{ 182| 126| unsigned int i; 183| | 184| 126|#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 185| 504| for(i=0;ivec[i],&a[320*i]); 187| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 188| | for(i=0;ivec[i],&a[352*i]); 190| |#endif 191| 126|} pqcrystals_kyber768_avx2_polyvec_tobytes: 203| 252|{ 204| 252| unsigned int i; 205| 1.00k| for(i=0;ivec[i]); ------------------ | | 15| 756|#define poly_tobytes KYBER_NAMESPACE(poly_tobytes) | | ------------------ | | | | 21| 756|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ poly_tobytes(r+i*KYBER_POLYBYTES, &a->vec[i]); ------------------ | | 39| 756|#define KYBER_POLYBYTES 384 ------------------ 207| 252|} pqcrystals_kyber768_avx2_polyvec_frombytes: 220| 378|{ 221| 378| unsigned int i; 222| 1.51k| for(i=0;ivec[i], a+i*KYBER_POLYBYTES); ------------------ | | 17| 1.13k|#define poly_frombytes KYBER_NAMESPACE(poly_frombytes) | | ------------------ | | | | 21| 1.13k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ poly_frombytes(&r->vec[i], a+i*KYBER_POLYBYTES); ------------------ | | 39| 1.13k|#define KYBER_POLYBYTES 384 ------------------ 224| 378|} pqcrystals_kyber768_avx2_polyvec_ntt: 234| 630|{ 235| 630| unsigned int i; 236| 2.52k| for(i=0;ivec[i]); ------------------ | | 58| 1.89k|#define poly_ntt KYBER_NAMESPACE(poly_ntt) | | ------------------ | | | | 21| 1.89k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 238| 630|} pqcrystals_kyber768_avx2_polyvec_invntt_tomont: 249| 252|{ 250| 252| unsigned int i; 251| 1.00k| for(i=0;ivec[i]); ------------------ | | 60| 756|#define poly_invntt_tomont KYBER_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 21| 756|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 253| 252|} pqcrystals_kyber768_avx2_polyvec_basemul_acc_montgomery: 266| 1.51k|{ 267| 1.51k| unsigned int i; 268| 1.51k| poly tmp; 269| | 270| 1.51k| poly_basemul_montgomery(r,&a->vec[0],&b->vec[0]); ------------------ | | 64| 1.51k|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 21| 1.51k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 271| 4.53k| for(i=1;ivec[i],&b->vec[i]); ------------------ | | 64| 3.02k|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 21| 3.02k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 273| 3.02k| poly_add(r,r,&tmp); ------------------ | | 72| 3.02k|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 21| 3.02k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 274| 3.02k| } 275| 1.51k|} pqcrystals_kyber768_avx2_polyvec_reduce: 287| 504|{ 288| 504| unsigned int i; 289| 2.01k| for(i=0;ivec[i]); ------------------ | | 69| 1.51k|#define poly_reduce KYBER_NAMESPACE(poly_reduce) | | ------------------ | | | | 21| 1.51k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 291| 504|} pqcrystals_kyber768_avx2_polyvec_add: 303| 378|{ 304| 378| unsigned int i; 305| 1.51k| for(i=0;ivec[i], &a->vec[i], &b->vec[i]); ------------------ | | 72| 1.13k|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 21| 1.13k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 307| 378|} pqcrystals_kyber768_avx2_rej_uniform_avx: 275| 3.40k|{ 276| 3.40k| unsigned int ctr, pos; 277| 3.40k| uint16_t val0, val1; 278| 3.40k| uint32_t good; 279| |#ifdef BMI 280| | uint64_t idx0, idx1, idx2, idx3; 281| |#endif 282| 3.40k| const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 3.40k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 3.40k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 3.40k|#define _16XQ 0 ------------------ 283| 3.40k| const __m256i ones = _mm256_set1_epi8(1); 284| 3.40k| const __m256i mask = _mm256_set1_epi16(0xFFF); 285| 3.40k| const __m256i idx8 = _mm256_set_epi8(15,14,14,13,12,11,11,10, 286| 3.40k| 9, 8, 8, 7, 6, 5, 5, 4, 287| 3.40k| 11,10,10, 9, 8, 7, 7, 6, 288| 3.40k| 5, 4, 4, 3, 2, 1, 1, 0); 289| 3.40k| __m256i f0, f1, g0, g1, g2, g3; 290| 3.40k| __m128i f, t, pilo, pihi; 291| | 292| 3.40k| ctr = pos = 0; 293| 34.6k| while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 33| 34.6k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 9| 31.2k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 31.2k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 31.2k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 31.2k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 31.2k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 31.2k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 31.2k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 31.2k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 31.2k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 31.2k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 31.2k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 31.2k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 31.2k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (293:9): [True: 31.2k, False: 3.39k] | Branch (293:32): [True: 31.2k, False: 9] ------------------ 294| 31.2k| f0 = _mm256_loadu_si256((__m256i *)&buf[pos]); 295| 31.2k| f1 = _mm256_loadu_si256((__m256i *)&buf[pos+24]); 296| 31.2k| f0 = _mm256_permute4x64_epi64(f0, 0x94); 297| 31.2k| f1 = _mm256_permute4x64_epi64(f1, 0x94); 298| 31.2k| f0 = _mm256_shuffle_epi8(f0, idx8); 299| 31.2k| f1 = _mm256_shuffle_epi8(f1, idx8); 300| 31.2k| g0 = _mm256_srli_epi16(f0, 4); 301| 31.2k| g1 = _mm256_srli_epi16(f1, 4); 302| 31.2k| f0 = _mm256_blend_epi16(f0, g0, 0xAA); 303| 31.2k| f1 = _mm256_blend_epi16(f1, g1, 0xAA); 304| 31.2k| f0 = _mm256_and_si256(f0, mask); 305| 31.2k| f1 = _mm256_and_si256(f1, mask); 306| 31.2k| pos += 48; 307| | 308| 31.2k| g0 = _mm256_cmpgt_epi16(bound, f0); 309| 31.2k| g1 = _mm256_cmpgt_epi16(bound, f1); 310| | 311| 31.2k| g0 = _mm256_packs_epi16(g0, g1); 312| 31.2k| good = _mm256_movemask_epi8(g0); 313| | 314| |#ifdef BMI 315| | idx0 = _pdep_u64(good >> 0, 0x0101010101010101); 316| | idx1 = _pdep_u64(good >> 8, 0x0101010101010101); 317| | idx2 = _pdep_u64(good >> 16, 0x0101010101010101); 318| | idx3 = _pdep_u64(good >> 24, 0x0101010101010101); 319| | idx0 = (idx0 << 8) - idx0; 320| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 321| | idx1 = (idx1 << 8) - idx1; 322| | idx1 = _pext_u64(0x0E0C0A0806040200, idx1); 323| | idx2 = (idx2 << 8) - idx2; 324| | idx2 = _pext_u64(0x0E0C0A0806040200, idx2); 325| | idx3 = (idx3 << 8) - idx3; 326| | idx3 = _pext_u64(0x0E0C0A0806040200, idx3); 327| | 328| | g0 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx0)); 329| | g1 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx1)); 330| | g0 = _mm256_inserti128_si256(g0, _mm_cvtsi64_si128(idx2), 1); 331| | g1 = _mm256_inserti128_si256(g1, _mm_cvtsi64_si128(idx3), 1); 332| |#else 333| 31.2k| g0 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 0) & 0xFF])); 334| 31.2k| g1 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 8) & 0xFF])); 335| 31.2k| g0 = _mm256_inserti128_si256(g0, _mm_loadl_epi64((__m128i *)&idx[(good >> 16) & 0xFF]), 1); 336| 31.2k| g1 = _mm256_inserti128_si256(g1, _mm_loadl_epi64((__m128i *)&idx[(good >> 24) & 0xFF]), 1); 337| 31.2k|#endif 338| | 339| 31.2k| g2 = _mm256_add_epi8(g0, ones); 340| 31.2k| g3 = _mm256_add_epi8(g1, ones); 341| 31.2k| g0 = _mm256_unpacklo_epi8(g0, g2); 342| 31.2k| g1 = _mm256_unpacklo_epi8(g1, g3); 343| | 344| 31.2k| f0 = _mm256_shuffle_epi8(f0, g0); 345| 31.2k| f1 = _mm256_shuffle_epi8(f1, g1); 346| | 347| 31.2k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f0)); 348| 31.2k| ctr += _mm_popcnt_u32((good >> 0) & 0xFF); 349| 31.2k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f0, 1)); 350| 31.2k| ctr += _mm_popcnt_u32((good >> 16) & 0xFF); 351| 31.2k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f1)); 352| 31.2k| ctr += _mm_popcnt_u32((good >> 8) & 0xFF); 353| 31.2k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f1, 1)); 354| 31.2k| ctr += _mm_popcnt_u32((good >> 24) & 0xFF); 355| 31.2k| } 356| | 357| 11.3k| while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 33| 11.3k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 9| 8.00k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 8.00k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 8.00k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 8.00k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 8.00k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 8.00k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 8.00k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 8.00k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 8.00k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 8.00k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 8.00k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 8.00k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 8.00k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (357:9): [True: 8.00k, False: 3.29k] | Branch (357:31): [True: 7.89k, False: 108] ------------------ 358| 7.89k| f = _mm_loadu_si128((__m128i *)&buf[pos]); 359| 7.89k| f = _mm_shuffle_epi8(f, _mm256_castsi256_si128(idx8)); 360| 7.89k| t = _mm_srli_epi16(f, 4); 361| 7.89k| f = _mm_blend_epi16(f, t, 0xAA); 362| 7.89k| f = _mm_and_si128(f, _mm256_castsi256_si128(mask)); 363| 7.89k| pos += 12; 364| | 365| 7.89k| t = _mm_cmpgt_epi16(_mm256_castsi256_si128(bound), f); 366| 7.89k| good = _mm_movemask_epi8(t); 367| | 368| |#ifdef BMI 369| | good &= 0x5555; 370| | idx0 = _pdep_u64(good, 0x1111111111111111); 371| | idx0 = (idx0 << 8) - idx0; 372| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 373| | pilo = _mm_cvtsi64_si128(idx0); 374| |#else 375| 7.89k| good = _pext_u32(good, 0x5555); 376| 7.89k| pilo = _mm_loadl_epi64((__m128i *)&idx[good]); 377| 7.89k|#endif 378| | 379| 7.89k| pihi = _mm_add_epi8(pilo, _mm256_castsi256_si128(ones)); 380| 7.89k| pilo = _mm_unpacklo_epi8(pilo, pihi); 381| 7.89k| f = _mm_shuffle_epi8(f, pilo); 382| 7.89k| _mm_storeu_si128((__m128i *)&r[ctr], f); 383| 7.89k| ctr += _mm_popcnt_u32(good); 384| 7.89k| } 385| | 386| 11.6k| while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 33| 23.3k|#define KYBER_N 256 ------------------ while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 9| 8.67k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 8.67k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 8.67k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 8.67k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 8.67k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 8.67k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 8.67k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 8.67k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 8.67k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 8.67k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 8.67k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 8.67k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 8.67k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (386:9): [True: 8.67k, False: 2.99k] | Branch (386:26): [True: 8.26k, False: 408] ------------------ 387| 8.26k| val0 = ((buf[pos+0] >> 0) | ((uint16_t)buf[pos+1] << 8)) & 0xFFF; 388| 8.26k| val1 = ((buf[pos+1] >> 4) | ((uint16_t)buf[pos+2] << 4)); 389| 8.26k| pos += 3; 390| | 391| 8.26k| if(val0 < KYBER_Q) ------------------ | | 34| 8.26k|#define KYBER_Q 3329 ------------------ | Branch (391:8): [True: 6.66k, False: 1.60k] ------------------ 392| 6.66k| r[ctr++] = val0; 393| 8.26k| if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 34| 16.5k|#define KYBER_Q 3329 ------------------ if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 33| 6.64k|#define KYBER_N 256 ------------------ | Branch (393:8): [True: 6.64k, False: 1.62k] | Branch (393:26): [True: 5.42k, False: 1.21k] ------------------ 394| 5.42k| r[ctr++] = val1; 395| 8.26k| } 396| | 397| 3.40k| return ctr; 398| 3.40k|} pqcrystals_kyber768_avx2_verify: 18| 126|{ 19| 126| size_t i; 20| 126| uint64_t r; 21| 126| __m256i f, g, h; 22| | 23| 126| h = _mm256_setzero_si256(); 24| 4.41k| for(i=0;i> 63; 39| 126| return r; 40| 126|} pqcrystals_kyber768_avx2_cmov: 56| 126|{ 57| 126| size_t i; 58| 126| __m256i xvec, rvec, bvec; 59| | 60| 126|#if defined(__GNUC__) || defined(__clang__) 61| | // Prevent the compiler from 62| | // 1) inferring that b is 0/1-valued, and 63| | // 2) handling the two cases with a branch. 64| | // This is not necessary when verify.c and kem.c are separate translation 65| | // units, but we expect that downstream consumers will copy this code and/or 66| | // change how it is built. 67| 126| __asm__("" : "+r"(b) : /* no inputs */); 68| 126|#endif 69| | 70| 126| bvec = _mm256_set1_epi64x(-(uint64_t)b); 71| 252| for(i=0;imethod_name = OQS_KEM_alg_ml_kem_1024; ------------------ | | 78| 25|#define OQS_KEM_alg_ml_kem_1024 "ML-KEM-1024" ------------------ 16| 25| kem->alg_version = "FIPS203"; 17| | 18| 25| kem->claimed_nist_level = 5; 19| 25| kem->ind_cca = true; 20| | 21| 25| kem->length_public_key = OQS_KEM_ml_kem_1024_length_public_key; ------------------ | | 39| 25|#define OQS_KEM_ml_kem_1024_length_public_key 1568 ------------------ 22| 25| kem->length_secret_key = OQS_KEM_ml_kem_1024_length_secret_key; ------------------ | | 40| 25|#define OQS_KEM_ml_kem_1024_length_secret_key 3168 ------------------ 23| 25| kem->length_ciphertext = OQS_KEM_ml_kem_1024_length_ciphertext; ------------------ | | 41| 25|#define OQS_KEM_ml_kem_1024_length_ciphertext 1568 ------------------ 24| 25| kem->length_shared_secret = OQS_KEM_ml_kem_1024_length_shared_secret; ------------------ | | 42| 25|#define OQS_KEM_ml_kem_1024_length_shared_secret 32 ------------------ 25| 25| kem->length_keypair_seed = OQS_KEM_ml_kem_1024_length_keypair_seed; ------------------ | | 43| 25|#define OQS_KEM_ml_kem_1024_length_keypair_seed 64 ------------------ 26| 25| kem->length_encaps_seed = OQS_KEM_ml_kem_1024_length_encaps_seed; ------------------ | | 44| 25|#define OQS_KEM_ml_kem_1024_length_encaps_seed 32 ------------------ 27| | 28| 25| kem->keypair = OQS_KEM_ml_kem_1024_keypair; 29| 25| kem->keypair_derand = OQS_KEM_ml_kem_1024_keypair_derand; 30| 25| kem->encaps = OQS_KEM_ml_kem_1024_encaps; 31| 25| kem->encaps_derand = OQS_KEM_ml_kem_1024_encaps_derand; 32| 25| kem->decaps = OQS_KEM_ml_kem_1024_decaps; 33| | 34| 25| return kem; 35| 25|} OQS_KEM_ml_kem_1024_keypair: 102| 25|OQS_API OQS_STATUS OQS_KEM_ml_kem_1024_keypair(uint8_t *public_key, uint8_t *secret_key) { 103| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_1024_cuda) 104| | return (OQS_STATUS) cupqc_ml_kem_1024_keypair(public_key, secret_key); 105| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_1024_icicle_cuda) 106| | return (OQS_STATUS) icicle_ml_kem_1024_keypair(public_key, secret_key); 107| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_x86_64) 108| |#if defined(OQS_DIST_BUILD) 109| 25| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (109:6): [True: 25, False: 0] | Branch (109:49): [True: 25, False: 0] | Branch (109:92): [True: 25, False: 0] ------------------ 110| 25|#endif /* OQS_DIST_BUILD */ 111| 25| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_keypair(public_key, secret_key); 112| 25|#if defined(OQS_DIST_BUILD) 113| 25| } else { 114| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_keypair(public_key, secret_key); 115| 0| } 116| 25|#endif /* OQS_DIST_BUILD */ 117| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_aarch64) 118| |#if defined(OQS_DIST_BUILD) 119| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 120| |#endif /* OQS_DIST_BUILD */ 121| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_AARCH64_keypair(public_key, secret_key); 122| |#if defined(OQS_DIST_BUILD) 123| | } else { 124| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_keypair(public_key, secret_key); 125| | } 126| |#endif /* OQS_DIST_BUILD */ 127| |#else 128| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_keypair(public_key, secret_key); 129| |#endif 130| 25|} OQS_KEM_ml_kem_1024_encaps: 160| 25|OQS_API OQS_STATUS OQS_KEM_ml_kem_1024_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 161| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_1024_cuda) 162| | return (OQS_STATUS) cupqc_ml_kem_1024_enc(ciphertext, shared_secret, public_key); 163| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_1024_icicle_cuda) 164| | return (OQS_STATUS) icicle_ml_kem_1024_enc(ciphertext, shared_secret, public_key); 165| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_x86_64) 166| |#if defined(OQS_DIST_BUILD) 167| 25| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (167:6): [True: 25, False: 0] | Branch (167:49): [True: 25, False: 0] | Branch (167:92): [True: 25, False: 0] ------------------ 168| 25|#endif /* OQS_DIST_BUILD */ 169| 25| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_enc(ciphertext, shared_secret, public_key); 170| 25|#if defined(OQS_DIST_BUILD) 171| 25| } else { 172| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_enc(ciphertext, shared_secret, public_key); 173| 0| } 174| 25|#endif /* OQS_DIST_BUILD */ 175| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_aarch64) 176| |#if defined(OQS_DIST_BUILD) 177| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 178| |#endif /* OQS_DIST_BUILD */ 179| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_AARCH64_enc(ciphertext, shared_secret, public_key); 180| |#if defined(OQS_DIST_BUILD) 181| | } else { 182| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_enc(ciphertext, shared_secret, public_key); 183| | } 184| |#endif /* OQS_DIST_BUILD */ 185| |#else 186| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_enc(ciphertext, shared_secret, public_key); 187| |#endif 188| 25|} OQS_KEM_ml_kem_1024_decaps: 190| 25|OQS_API OQS_STATUS OQS_KEM_ml_kem_1024_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 191| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_1024_cuda) 192| | return (OQS_STATUS) cupqc_ml_kem_1024_dec(shared_secret, ciphertext, secret_key); 193| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_1024_icicle_cuda) 194| | return (OQS_STATUS) icicle_ml_kem_1024_dec(shared_secret, ciphertext, secret_key); 195| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_x86_64) 196| |#if defined(OQS_DIST_BUILD) 197| 25| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (197:6): [True: 25, False: 0] | Branch (197:49): [True: 25, False: 0] | Branch (197:92): [True: 25, False: 0] ------------------ 198| 25|#endif /* OQS_DIST_BUILD */ 199| 25| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_dec(shared_secret, ciphertext, secret_key); 200| 25|#if defined(OQS_DIST_BUILD) 201| 25| } else { 202| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_dec(shared_secret, ciphertext, secret_key); 203| 0| } 204| 25|#endif /* OQS_DIST_BUILD */ 205| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_aarch64) 206| |#if defined(OQS_DIST_BUILD) 207| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 208| |#endif /* OQS_DIST_BUILD */ 209| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_AARCH64_dec(shared_secret, ciphertext, secret_key); 210| |#if defined(OQS_DIST_BUILD) 211| | } else { 212| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_dec(shared_secret, ciphertext, secret_key); 213| | } 214| |#endif /* OQS_DIST_BUILD */ 215| |#else 216| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_dec(shared_secret, ciphertext, secret_key); 217| |#endif 218| 25|} OQS_KEM_ml_kem_512_new: 9| 27|OQS_KEM *OQS_KEM_ml_kem_512_new(void) { 10| | 11| 27| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 27| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 27] ------------------ 13| 0| return NULL; 14| 0| } 15| 27| kem->method_name = OQS_KEM_alg_ml_kem_512; ------------------ | | 74| 27|#define OQS_KEM_alg_ml_kem_512 "ML-KEM-512" ------------------ 16| 27| kem->alg_version = "FIPS203"; 17| | 18| 27| kem->claimed_nist_level = 1; 19| 27| kem->ind_cca = true; 20| | 21| 27| kem->length_public_key = OQS_KEM_ml_kem_512_length_public_key; ------------------ | | 9| 27|#define OQS_KEM_ml_kem_512_length_public_key 800 ------------------ 22| 27| kem->length_secret_key = OQS_KEM_ml_kem_512_length_secret_key; ------------------ | | 10| 27|#define OQS_KEM_ml_kem_512_length_secret_key 1632 ------------------ 23| 27| kem->length_ciphertext = OQS_KEM_ml_kem_512_length_ciphertext; ------------------ | | 11| 27|#define OQS_KEM_ml_kem_512_length_ciphertext 768 ------------------ 24| 27| kem->length_shared_secret = OQS_KEM_ml_kem_512_length_shared_secret; ------------------ | | 12| 27|#define OQS_KEM_ml_kem_512_length_shared_secret 32 ------------------ 25| 27| kem->length_keypair_seed = OQS_KEM_ml_kem_512_length_keypair_seed; ------------------ | | 13| 27|#define OQS_KEM_ml_kem_512_length_keypair_seed 64 ------------------ 26| 27| kem->length_encaps_seed = OQS_KEM_ml_kem_512_length_encaps_seed; ------------------ | | 14| 27|#define OQS_KEM_ml_kem_512_length_encaps_seed 32 ------------------ 27| | 28| 27| kem->keypair = OQS_KEM_ml_kem_512_keypair; 29| 27| kem->keypair_derand = OQS_KEM_ml_kem_512_keypair_derand; 30| 27| kem->encaps = OQS_KEM_ml_kem_512_encaps; 31| 27| kem->encaps_derand = OQS_KEM_ml_kem_512_encaps_derand; 32| 27| kem->decaps = OQS_KEM_ml_kem_512_decaps; 33| | 34| 27| return kem; 35| 27|} OQS_KEM_ml_kem_512_keypair: 102| 27|OQS_API OQS_STATUS OQS_KEM_ml_kem_512_keypair(uint8_t *public_key, uint8_t *secret_key) { 103| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_512_cuda) 104| | return (OQS_STATUS) cupqc_ml_kem_512_keypair(public_key, secret_key); 105| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_512_icicle_cuda) 106| | return (OQS_STATUS) icicle_ml_kem_512_keypair(public_key, secret_key); 107| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_x86_64) 108| |#if defined(OQS_DIST_BUILD) 109| 27| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (109:6): [True: 27, False: 0] | Branch (109:49): [True: 27, False: 0] | Branch (109:92): [True: 27, False: 0] ------------------ 110| 27|#endif /* OQS_DIST_BUILD */ 111| 27| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_X86_64_keypair(public_key, secret_key); 112| 27|#if defined(OQS_DIST_BUILD) 113| 27| } else { 114| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_keypair(public_key, secret_key); 115| 0| } 116| 27|#endif /* OQS_DIST_BUILD */ 117| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_aarch64) 118| |#if defined(OQS_DIST_BUILD) 119| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 120| |#endif /* OQS_DIST_BUILD */ 121| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_AARCH64_keypair(public_key, secret_key); 122| |#if defined(OQS_DIST_BUILD) 123| | } else { 124| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_keypair(public_key, secret_key); 125| | } 126| |#endif /* OQS_DIST_BUILD */ 127| |#else 128| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_keypair(public_key, secret_key); 129| |#endif 130| 27|} OQS_KEM_ml_kem_512_encaps: 160| 27|OQS_API OQS_STATUS OQS_KEM_ml_kem_512_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 161| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_512_cuda) 162| | return (OQS_STATUS) cupqc_ml_kem_512_enc(ciphertext, shared_secret, public_key); 163| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_512_icicle_cuda) 164| | return (OQS_STATUS) icicle_ml_kem_512_enc(ciphertext, shared_secret, public_key); 165| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_x86_64) 166| |#if defined(OQS_DIST_BUILD) 167| 27| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (167:6): [True: 27, False: 0] | Branch (167:49): [True: 27, False: 0] | Branch (167:92): [True: 27, False: 0] ------------------ 168| 27|#endif /* OQS_DIST_BUILD */ 169| 27| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_X86_64_enc(ciphertext, shared_secret, public_key); 170| 27|#if defined(OQS_DIST_BUILD) 171| 27| } else { 172| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_enc(ciphertext, shared_secret, public_key); 173| 0| } 174| 27|#endif /* OQS_DIST_BUILD */ 175| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_aarch64) 176| |#if defined(OQS_DIST_BUILD) 177| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 178| |#endif /* OQS_DIST_BUILD */ 179| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_AARCH64_enc(ciphertext, shared_secret, public_key); 180| |#if defined(OQS_DIST_BUILD) 181| | } else { 182| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_enc(ciphertext, shared_secret, public_key); 183| | } 184| |#endif /* OQS_DIST_BUILD */ 185| |#else 186| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_enc(ciphertext, shared_secret, public_key); 187| |#endif 188| 27|} OQS_KEM_ml_kem_512_decaps: 190| 27|OQS_API OQS_STATUS OQS_KEM_ml_kem_512_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 191| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_512_cuda) 192| | return (OQS_STATUS) cupqc_ml_kem_512_dec(shared_secret, ciphertext, secret_key); 193| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_512_icicle_cuda) 194| | return (OQS_STATUS) icicle_ml_kem_512_dec(shared_secret, ciphertext, secret_key); 195| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_x86_64) 196| |#if defined(OQS_DIST_BUILD) 197| 27| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (197:6): [True: 27, False: 0] | Branch (197:49): [True: 27, False: 0] | Branch (197:92): [True: 27, False: 0] ------------------ 198| 27|#endif /* OQS_DIST_BUILD */ 199| 27| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_X86_64_dec(shared_secret, ciphertext, secret_key); 200| 27|#if defined(OQS_DIST_BUILD) 201| 27| } else { 202| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_dec(shared_secret, ciphertext, secret_key); 203| 0| } 204| 27|#endif /* OQS_DIST_BUILD */ 205| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_aarch64) 206| |#if defined(OQS_DIST_BUILD) 207| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 208| |#endif /* OQS_DIST_BUILD */ 209| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_AARCH64_dec(shared_secret, ciphertext, secret_key); 210| |#if defined(OQS_DIST_BUILD) 211| | } else { 212| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_dec(shared_secret, ciphertext, secret_key); 213| | } 214| |#endif /* OQS_DIST_BUILD */ 215| |#else 216| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_dec(shared_secret, ciphertext, secret_key); 217| |#endif 218| 27|} OQS_KEM_ml_kem_768_new: 9| 28|OQS_KEM *OQS_KEM_ml_kem_768_new(void) { 10| | 11| 28| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 28| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 28] ------------------ 13| 0| return NULL; 14| 0| } 15| 28| kem->method_name = OQS_KEM_alg_ml_kem_768; ------------------ | | 76| 28|#define OQS_KEM_alg_ml_kem_768 "ML-KEM-768" ------------------ 16| 28| kem->alg_version = "FIPS203"; 17| | 18| 28| kem->claimed_nist_level = 3; 19| 28| kem->ind_cca = true; 20| | 21| 28| kem->length_public_key = OQS_KEM_ml_kem_768_length_public_key; ------------------ | | 24| 28|#define OQS_KEM_ml_kem_768_length_public_key 1184 ------------------ 22| 28| kem->length_secret_key = OQS_KEM_ml_kem_768_length_secret_key; ------------------ | | 25| 28|#define OQS_KEM_ml_kem_768_length_secret_key 2400 ------------------ 23| 28| kem->length_ciphertext = OQS_KEM_ml_kem_768_length_ciphertext; ------------------ | | 26| 28|#define OQS_KEM_ml_kem_768_length_ciphertext 1088 ------------------ 24| 28| kem->length_shared_secret = OQS_KEM_ml_kem_768_length_shared_secret; ------------------ | | 27| 28|#define OQS_KEM_ml_kem_768_length_shared_secret 32 ------------------ 25| 28| kem->length_keypair_seed = OQS_KEM_ml_kem_768_length_keypair_seed; ------------------ | | 28| 28|#define OQS_KEM_ml_kem_768_length_keypair_seed 64 ------------------ 26| 28| kem->length_encaps_seed = OQS_KEM_ml_kem_768_length_encaps_seed; ------------------ | | 29| 28|#define OQS_KEM_ml_kem_768_length_encaps_seed 32 ------------------ 27| | 28| 28| kem->keypair = OQS_KEM_ml_kem_768_keypair; 29| 28| kem->keypair_derand = OQS_KEM_ml_kem_768_keypair_derand; 30| 28| kem->encaps = OQS_KEM_ml_kem_768_encaps; 31| 28| kem->encaps_derand = OQS_KEM_ml_kem_768_encaps_derand; 32| 28| kem->decaps = OQS_KEM_ml_kem_768_decaps; 33| | 34| 28| return kem; 35| 28|} OQS_KEM_ml_kem_768_keypair: 102| 28|OQS_API OQS_STATUS OQS_KEM_ml_kem_768_keypair(uint8_t *public_key, uint8_t *secret_key) { 103| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_768_cuda) 104| | return (OQS_STATUS) cupqc_ml_kem_768_keypair(public_key, secret_key); 105| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_768_icicle_cuda) 106| | return (OQS_STATUS) icicle_ml_kem_768_keypair(public_key, secret_key); 107| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_x86_64) 108| |#if defined(OQS_DIST_BUILD) 109| 28| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (109:6): [True: 28, False: 0] | Branch (109:49): [True: 28, False: 0] | Branch (109:92): [True: 28, False: 0] ------------------ 110| 28|#endif /* OQS_DIST_BUILD */ 111| 28| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_X86_64_keypair(public_key, secret_key); 112| 28|#if defined(OQS_DIST_BUILD) 113| 28| } else { 114| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_keypair(public_key, secret_key); 115| 0| } 116| 28|#endif /* OQS_DIST_BUILD */ 117| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_aarch64) 118| |#if defined(OQS_DIST_BUILD) 119| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 120| |#endif /* OQS_DIST_BUILD */ 121| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_AARCH64_keypair(public_key, secret_key); 122| |#if defined(OQS_DIST_BUILD) 123| | } else { 124| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_keypair(public_key, secret_key); 125| | } 126| |#endif /* OQS_DIST_BUILD */ 127| |#else 128| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_keypair(public_key, secret_key); 129| |#endif 130| 28|} OQS_KEM_ml_kem_768_encaps: 160| 28|OQS_API OQS_STATUS OQS_KEM_ml_kem_768_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 161| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_768_cuda) 162| | return (OQS_STATUS) cupqc_ml_kem_768_enc(ciphertext, shared_secret, public_key); 163| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_768_icicle_cuda) 164| | return (OQS_STATUS) icicle_ml_kem_768_enc(ciphertext, shared_secret, public_key); 165| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_x86_64) 166| |#if defined(OQS_DIST_BUILD) 167| 28| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (167:6): [True: 28, False: 0] | Branch (167:49): [True: 28, False: 0] | Branch (167:92): [True: 28, False: 0] ------------------ 168| 28|#endif /* OQS_DIST_BUILD */ 169| 28| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_X86_64_enc(ciphertext, shared_secret, public_key); 170| 28|#if defined(OQS_DIST_BUILD) 171| 28| } else { 172| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_enc(ciphertext, shared_secret, public_key); 173| 0| } 174| 28|#endif /* OQS_DIST_BUILD */ 175| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_aarch64) 176| |#if defined(OQS_DIST_BUILD) 177| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 178| |#endif /* OQS_DIST_BUILD */ 179| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_AARCH64_enc(ciphertext, shared_secret, public_key); 180| |#if defined(OQS_DIST_BUILD) 181| | } else { 182| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_enc(ciphertext, shared_secret, public_key); 183| | } 184| |#endif /* OQS_DIST_BUILD */ 185| |#else 186| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_enc(ciphertext, shared_secret, public_key); 187| |#endif 188| 28|} OQS_KEM_ml_kem_768_decaps: 190| 28|OQS_API OQS_STATUS OQS_KEM_ml_kem_768_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 191| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_768_cuda) 192| | return (OQS_STATUS) cupqc_ml_kem_768_dec(shared_secret, ciphertext, secret_key); 193| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_768_icicle_cuda) 194| | return (OQS_STATUS) icicle_ml_kem_768_dec(shared_secret, ciphertext, secret_key); 195| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_x86_64) 196| |#if defined(OQS_DIST_BUILD) 197| 28| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (197:6): [True: 28, False: 0] | Branch (197:49): [True: 28, False: 0] | Branch (197:92): [True: 28, False: 0] ------------------ 198| 28|#endif /* OQS_DIST_BUILD */ 199| 28| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_X86_64_dec(shared_secret, ciphertext, secret_key); 200| 28|#if defined(OQS_DIST_BUILD) 201| 28| } else { 202| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_dec(shared_secret, ciphertext, secret_key); 203| 0| } 204| 28|#endif /* OQS_DIST_BUILD */ 205| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_aarch64) 206| |#if defined(OQS_DIST_BUILD) 207| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 208| |#endif /* OQS_DIST_BUILD */ 209| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_AARCH64_dec(shared_secret, ciphertext, secret_key); 210| |#if defined(OQS_DIST_BUILD) 211| | } else { 212| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_dec(shared_secret, ciphertext, secret_key); 213| | } 214| |#endif /* OQS_DIST_BUILD */ 215| |#else 216| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_dec(shared_secret, ciphertext, secret_key); 217| |#endif 218| 28|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_compress_d5: 324| 50|{ 325| 50|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D5) 326| 50| int ret; 327| 50| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 50| do \ | | 102| 50| { \ | | 103| 50| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 50] | | ------------------ ------------------ 328| 50| ret = mlk_poly_compress_d5_native(r, a->coeffs); 329| 50| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 50|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (329:7): [True: 50, False: 0] ------------------ 330| 50| { 331| 50| return; 332| 50| } 333| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D5 */ 334| | 335| 0| mlk_poly_compress_d5_c(r, a); 336| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_compress_d11: 398| 200|{ 399| 200|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D11) 400| 200| int ret; 401| 200| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 200| do \ | | 102| 200| { \ | | 103| 200| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 200] | | ------------------ ------------------ 402| 200| ret = mlk_poly_compress_d11_native(r, a->coeffs); 403| 200| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 200|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (403:7): [True: 200, False: 0] ------------------ 404| 200| { 405| 200| return; 406| 200| } 407| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D11 */ 408| | 409| 0| mlk_poly_compress_d11_c(r, a); 410| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_decompress_d5: 475| 25|{ 476| 25|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D5) 477| 25| int ret; 478| 25| ret = mlk_poly_decompress_d5_native(r->coeffs, a); 479| 25| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 25|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (479:7): [True: 25, False: 0] ------------------ 480| 25| { 481| 25| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 25| do \ | | 102| 25| { \ | | 103| 25| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 25] | | ------------------ ------------------ 482| 25| return; 483| 25| } 484| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D5 */ 485| | 486| 0| mlk_poly_decompress_d5_c(r, a); 487| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_decompress_d11: 543| 100|{ 544| 100|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D11) 545| 100| int ret; 546| 100| ret = mlk_poly_decompress_d11_native(r->coeffs, a); 547| 100| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 100|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (547:7): [True: 100, False: 0] ------------------ 548| 100| { 549| 100| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 100| do \ | | 102| 100| { \ | | 103| 100| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 100] | | ------------------ ------------------ 550| 100| return; 551| 100| } 552| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D11 */ 553| | 554| 0| mlk_poly_decompress_d11_c(r, a); 555| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_tobytes: 610| 300|{ 611| 300|#if defined(MLK_USE_NATIVE_POLY_TOBYTES) 612| 300| int ret; 613| 300| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 300| do \ | | 102| 300| { \ | | 103| 300| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 300] | | ------------------ ------------------ 614| 300| ret = mlk_poly_tobytes_native(r, a->coeffs); 615| 300| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 300|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (615:7): [True: 300, False: 0] ------------------ 616| 300| { 617| 300| return; 618| 300| } 619| 0|#endif /* MLK_USE_NATIVE_POLY_TOBYTES */ 620| | 621| 0| mlk_poly_tobytes_c(r, a); 622| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_frombytes: 659| 400|{ 660| 400|#if defined(MLK_USE_NATIVE_POLY_FROMBYTES) 661| 400| int ret; 662| 400| ret = mlk_poly_frombytes_native(r->coeffs, a); 663| 400| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 400|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (663:7): [True: 400, False: 0] ------------------ 664| 400| { 665| 400| return; 666| 400| } 667| 0|#endif /* MLK_USE_NATIVE_POLY_FROMBYTES */ 668| | 669| 0| mlk_poly_frombytes_c(r, a); 670| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_frommsg: 680| 50|{ 681| 50| unsigned i; 682| |#if (MLKEM_INDCPA_MSGBYTES != MLKEM_N / 8) 683| |#error "MLKEM_INDCPA_MSGBYTES must be equal to MLKEM_N/8 bytes!" 684| |#endif 685| | 686| 1.65k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 1.65k|#define MLKEM_N 256 ------------------ | Branch (686:15): [True: 1.60k, False: 50] ------------------ 687| 1.60k| __loop__( 688| 1.60k| invariant(i <= MLKEM_N / 8) 689| 1.60k| invariant(array_bound(r->coeffs, 0, 8 * i, 0, MLKEM_Q)) 690| 1.60k| decreases(MLKEM_N / 8 - i)) 691| 1.60k| { 692| 1.60k| unsigned j; 693| 14.4k| for (j = 0; j < 8; j++) ------------------ | Branch (693:17): [True: 12.8k, False: 1.60k] ------------------ 694| 12.8k| __loop__( 695| 12.8k| invariant(i < MLKEM_N / 8 && j <= 8) 696| 12.8k| invariant(array_bound(r->coeffs, 0, 8 * i + j, 0, MLKEM_Q)) 697| 12.8k| decreases(8 - j)) 698| 12.8k| { 699| | /* mlk_ct_sel_int16(MLKEM_Q_HALF, 0, b) is `Decompress_1(b != 0)` 700| | * as per @[FIPS203, Eq (4.8)]. */ 701| | 702| | /* Prevent the compiler from recognizing this as a bit selection */ 703| 12.8k| uint8_t mask = mlk_value_barrier_u8((uint8_t)(1u << j)); 704| 12.8k| r->coeffs[8 * i + j] = mlk_ct_sel_int16(MLKEM_Q_HALF, 0, msg[i] & mask); ------------------ | | 24| 12.8k|#define MLKEM_Q_HALF ((MLKEM_Q + 1) / 2) /* 1665 */ | | ------------------ | | | | 23| 12.8k|#define MLKEM_Q 3329 | | ------------------ ------------------ 705| 12.8k| } 706| 1.60k| } 707| 50| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 50| do \ | | 106| 50| { \ | | 107| 50| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 50] | | ------------------ ------------------ 708| 50|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_tomsg: 718| 25|{ 719| 25| unsigned i; 720| 25| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 25| do \ | | 102| 25| { \ | | 103| 25| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 25] | | ------------------ ------------------ 721| | 722| 825| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 825|#define MLKEM_N 256 ------------------ | Branch (722:15): [True: 800, False: 25] ------------------ 723| 800| __loop__(invariant(i <= MLKEM_N / 8) 724| 800| decreases(MLKEM_N / 8 - i)) 725| 800| { 726| 800| unsigned j; 727| 800| msg[i] = 0; 728| 7.20k| for (j = 0; j < 8; j++) ------------------ | Branch (728:17): [True: 6.40k, False: 800] ------------------ 729| 6.40k| __loop__( 730| 6.40k| invariant(i <= MLKEM_N / 8 && j <= 8) 731| 6.40k| decreases(8 - j)) 732| 6.40k| { 733| 6.40k| uint32_t t = mlk_scalar_compress_d1(r->coeffs[8 * i + j]); 734| 6.40k| msg[i] |= (uint8_t)(t << j); 735| 6.40k| } 736| 800| } 737| 25|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_gen_matrix: 223| 75|{ 224| 75| unsigned i, j; 225| 75| MLK_ALIGN uint8_t seed_ext[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 2)]; ------------------ | | 190| 75|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 226| | 227| 375| for (j = 0; j < 4; j++) ------------------ | Branch (227:15): [True: 300, False: 75] ------------------ 228| 300| { 229| 300| mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 168| 300|#define mlk_memcpy memcpy ------------------ mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 27| 300|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 230| 300| } 231| | 232| 75|#if !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 233| | /* Sample 4 matrix entries a time. */ 234| 375| for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 17| 375|#define MLKEM_K 4 ------------------ for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 17| 375|#define MLKEM_K 4 ------------------ | Branch (234:15): [True: 300, False: 75] ------------------ 235| 300| { 236| 1.50k| for (j = 0; j < 4; j++) ------------------ | Branch (236:17): [True: 1.20k, False: 300] ------------------ 237| 1.20k| { 238| 1.20k| uint8_t x, y; 239| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 240| 1.20k| x = (uint8_t)((i + j) / MLKEM_K); ------------------ | | 17| 1.20k|#define MLKEM_K 4 ------------------ 241| 1.20k| y = (uint8_t)((i + j) % MLKEM_K); ------------------ | | 17| 1.20k|#define MLKEM_K 4 ------------------ 242| 1.20k| if (transposed) ------------------ | Branch (242:11): [True: 800, False: 400] ------------------ 243| 800| { 244| 800| seed_ext[j][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 800|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 245| 800| seed_ext[j][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 800|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 246| 800| } 247| 400| else 248| 400| { 249| 400| seed_ext[j][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 400|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 250| 400| seed_ext[j][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 400|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 251| 400| } 252| 1.20k| } 253| | 254| 300| mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 55| 300|#define mlk_poly_rej_uniform_x4 MLK_NAMESPACE(poly_rej_uniform_x4) | | ------------------ | | | | 63| 300|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 300|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 300|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 17| 300|#define MLKEM_K 4 ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 17| 300|#define MLKEM_K 4 ------------------ 255| 300| &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 17| 300|#define MLKEM_K 4 ------------------ &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 17| 300|#define MLKEM_K 4 ------------------ 256| 300| &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 17| 300|#define MLKEM_K 4 ------------------ &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 17| 300|#define MLKEM_K 4 ------------------ 257| 300| &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 17| 300|#define MLKEM_K 4 ------------------ &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 17| 300|#define MLKEM_K 4 ------------------ 258| 300| seed_ext); 259| 300| } 260| |#else /* !MLK_CONFIG_SERIAL_FIPS202_ONLY */ 261| | /* When using serial FIPS202, sample all entries individually. */ 262| | i = 0; 263| |#endif /* MLK_CONFIG_SERIAL_FIPS202_ONLY */ 264| | 265| | /* For MLKEM_K == 3, sample the last entry individually. 266| | * When MLK_CONFIG_SERIAL_FIPS202_ONLY is set, sample all entries 267| | * individually. */ 268| 75| for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 17| 75|#define MLKEM_K 4 ------------------ for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 17| 75|#define MLKEM_K 4 ------------------ | Branch (268:10): [True: 0, False: 75] ------------------ 269| 0| { 270| 0| uint8_t x, y; 271| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 272| 0| x = (uint8_t)(i / MLKEM_K); ------------------ | | 17| 0|#define MLKEM_K 4 ------------------ 273| 0| y = (uint8_t)(i % MLKEM_K); ------------------ | | 17| 0|#define MLKEM_K 4 ------------------ 274| | 275| 0| if (transposed) ------------------ | Branch (275:9): [True: 0, False: 0] ------------------ 276| 0| { 277| 0| seed_ext[0][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 278| 0| seed_ext[0][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 279| 0| } 280| 0| else 281| 0| { 282| 0| seed_ext[0][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 283| 0| seed_ext[0][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 284| 0| } 285| | 286| 0| mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 89| 0|#define mlk_poly_rej_uniform MLK_NAMESPACE(poly_rej_uniform) | | ------------------ | | | | 63| 0|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 0|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 0|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 17| 0|#define MLKEM_K 4 ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 17| 0|#define MLKEM_K 4 ------------------ 287| 0| } 288| | 289| 75| mlk_assert(i == MLKEM_K * MLKEM_K); ------------------ | | 97| 75| do \ | | 98| 75| { \ | | 99| 75| } while (0) | | ------------------ | | | Branch (99:12): [Folded, False: 75] | | ------------------ ------------------ 290| | 291| | /* 292| | * The public matrix is generated in NTT domain. If the native backend 293| | * uses a custom order in NTT domain, permute A accordingly. 294| | */ 295| 75| mlk_polymat_permute_bitrev_to_custom(a); ------------------ | | 42| 75| MLK_ADD_PARAM_SET(mlk_polymat_permute_bitrev_to_custom) | | ------------------ | | | | 48| 75|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 296| | 297| | /* Specification: Partially implements 298| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 299| 75| mlk_zeroize(seed_ext, sizeof(seed_ext)); 300| 75|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_indcpa_keypair_derand: 445| 25|{ 446| 25| int ret = 0; 447| 25| const uint8_t *publicseed; 448| 25| const uint8_t *noiseseed; 449| 25| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 450| 25| MLK_ALLOC(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 451| 25| MLK_ALLOC(a, mlk_polymat, 1, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 452| 25| MLK_ALLOC(e, mlk_polyvec, 1, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 453| 25| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 454| 25| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 455| 25| MLK_ALLOC(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 456| | 457| 25| if (buf == NULL || coins_with_domain_separator == NULL || a == NULL || ------------------ | Branch (457:7): [True: 0, False: 25] | Branch (457:22): [True: 0, False: 25] | Branch (457:61): [True: 0, False: 25] ------------------ 458| 25| e == NULL || pkpv == NULL || skpv == NULL || skpv_cache == NULL) ------------------ | Branch (458:7): [True: 0, False: 25] | Branch (458:20): [True: 0, False: 25] | Branch (458:36): [True: 0, False: 25] | Branch (458:52): [True: 0, False: 25] ------------------ 459| 0| { 460| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 461| 0| goto cleanup; 462| 0| } 463| | 464| 25| publicseed = buf; 465| 25| noiseseed = buf + MLKEM_SYMBYTES; ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 466| | 467| | /* Concatenate coins with MLKEM_K for domain separation of security levels */ 468| 25| mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 168| 25|#define mlk_memcpy memcpy ------------------ mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 469| 25| coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 17| 25|#define MLKEM_K 4 ------------------ 470| | 471| 25| mlk_hash_g(buf, coins_with_domain_separator, MLKEM_SYMBYTES + 1); ------------------ | | 32| 25|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 25|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 25|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 472| | 473| | /* 474| | * Declassify the public seed. 475| | * Required to use it in conditional-branches in rejection sampling. 476| | * This is needed because all output of randombytes is marked as secret 477| | * (=undefined) 478| | */ 479| 25| MLK_CT_TESTING_DECLASSIFY(publicseed, MLKEM_SYMBYTES); ------------------ | | 235| 25| do \ | | 236| 25| { \ | | 237| 25| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 25] | | ------------------ ------------------ 480| | 481| 25| mlk_gen_matrix(a, publicseed, 0 /* no transpose */); ------------------ | | 22| 25|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 482| | 483| 25| mlk_keypair_getnoise_eta1(skpv, e, noiseseed); ------------------ | | 43| 25|#define mlk_keypair_getnoise_eta1 MLK_ADD_PARAM_SET(mlk_keypair_getnoise_eta1) | | ------------------ | | | | 48| 25|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 484| | 485| 25| mlk_polyvec_ntt(skpv); ------------------ | | 269| 25|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 486| 25| mlk_polyvec_ntt(e); ------------------ | | 269| 25|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 487| | 488| 25| mlk_polyvec_mulcache_compute(skpv_cache, skpv); ------------------ | | 353| 25|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 489| 25| mlk_matvec_mul(pkpv, a, skpv, skpv_cache); ------------------ | | 38| 25|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 25|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 490| 25| mlk_polyvec_tomont(pkpv); ------------------ | | 445| 25|#define mlk_polyvec_tomont MLK_NAMESPACE_K(polyvec_tomont) | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 491| | 492| 25| mlk_polyvec_add(pkpv, e); ------------------ | | 414| 25|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 493| 25| mlk_polyvec_reduce(pkpv); ------------------ | | 387| 25|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 494| 25| mlk_polyvec_reduce(skpv); ------------------ | | 387| 25|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 495| | 496| 25| mlk_pack_sk(sk, skpv); ------------------ | | 34| 25|#define mlk_pack_sk MLK_ADD_PARAM_SET(mlk_pack_sk) | | ------------------ | | | | 48| 25|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 497| 25| mlk_pack_pk(pk, pkpv, publicseed); ------------------ | | 32| 25|#define mlk_pack_pk MLK_ADD_PARAM_SET(mlk_pack_pk) | | ------------------ | | | | 48| 25|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 498| | 499| 25|cleanup: 500| | /* Specification: Partially implements 501| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 502| 25| MLK_FREE(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 503| 25| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 504| 25| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 505| 25| MLK_FREE(e, mlk_polyvec, 1, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 506| 25| MLK_FREE(a, mlk_polymat, 1, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 507| 25| MLK_FREE(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 508| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 509| 25| return ret; 510| 25|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_indcpa_enc: 526| 50|{ 527| 50| int ret = 0; 528| 50| MLK_ALLOC(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 50| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 50|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 50| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 529| 50| MLK_ALLOC(at, mlk_polymat, 1, context); ------------------ | | 229| 50| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 50|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 50| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 530| 50| MLK_ALLOC(sp, mlk_polyvec, 1, context); ------------------ | | 229| 50| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 50|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 50| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 531| 50| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 50| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 50|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 50| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 532| 50| MLK_ALLOC(ep, mlk_polyvec, 1, context); ------------------ | | 229| 50| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 50|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 50| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 533| 50| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 50| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 50|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 50| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 534| 50| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 50| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 50|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 50| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 535| 50| MLK_ALLOC(k, mlk_poly, 1, context); ------------------ | | 229| 50| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 50|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 50| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 536| 50| MLK_ALLOC(epp, mlk_poly, 1, context); ------------------ | | 229| 50| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 50|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 50| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 537| 50| MLK_ALLOC(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 50| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 50|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 50| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 538| | 539| 50| if (seed == NULL || at == NULL || sp == NULL || pkpv == NULL || ep == NULL || ------------------ | Branch (539:7): [True: 0, False: 50] | Branch (539:23): [True: 0, False: 50] | Branch (539:37): [True: 0, False: 50] | Branch (539:51): [True: 0, False: 50] | Branch (539:67): [True: 0, False: 50] ------------------ 540| 50| b == NULL || v == NULL || k == NULL || epp == NULL || sp_cache == NULL) ------------------ | Branch (540:7): [True: 0, False: 50] | Branch (540:20): [True: 0, False: 50] | Branch (540:33): [True: 0, False: 50] | Branch (540:46): [True: 0, False: 50] | Branch (540:61): [True: 0, False: 50] ------------------ 541| 0| { 542| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 543| 0| goto cleanup; 544| 0| } 545| | 546| 50| mlk_unpack_pk(pkpv, seed, pk); ------------------ | | 33| 50|#define mlk_unpack_pk MLK_ADD_PARAM_SET(mlk_unpack_pk) | | ------------------ | | | | 48| 50|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 547| 50| mlk_poly_frommsg(k, m); ------------------ | | 555| 50|#define mlk_poly_frommsg MLK_NAMESPACE(poly_frommsg) | | ------------------ | | | | 63| 50|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 50|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 50|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 548| | 549| | /* 550| | * Declassify the public seed. 551| | * Required to use it in conditional-branches in rejection sampling. 552| | * This is needed because in re-encryption the publicseed originated from sk 553| | * which is marked undefined. 554| | */ 555| 50| MLK_CT_TESTING_DECLASSIFY(seed, MLKEM_SYMBYTES); ------------------ | | 235| 50| do \ | | 236| 50| { \ | | 237| 50| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 50] | | ------------------ ------------------ 556| | 557| 50| mlk_gen_matrix(at, seed, 1 /* transpose */); ------------------ | | 22| 50|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 50|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 50|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 50|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 558| | 559| 50| mlk_enc_getnoise_eta1_eta2(sp, ep, epp, coins); ------------------ | | 44| 50|#define mlk_enc_getnoise_eta1_eta2 MLK_ADD_PARAM_SET(mlk_enc_getnoise_eta1_eta2) | | ------------------ | | | | 48| 50|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 560| | 561| 50| mlk_polyvec_ntt(sp); ------------------ | | 269| 50|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 50|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 50|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 50|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 562| | 563| 50| mlk_polyvec_mulcache_compute(sp_cache, sp); ------------------ | | 353| 50|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 50|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 50|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 50|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 564| 50| mlk_matvec_mul(b, at, sp, sp_cache); ------------------ | | 38| 50|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 50|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 565| 50| mlk_polyvec_basemul_acc_montgomery_cached(v, pkpv, sp, sp_cache); ------------------ | | 321| 50| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 50|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 50|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 50|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 566| | 567| 50| mlk_polyvec_invntt_tomont(b); ------------------ | | 295| 50|#define mlk_polyvec_invntt_tomont MLK_NAMESPACE_K(polyvec_invntt_tomont) | | ------------------ | | | | 64| 50|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 50|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 50|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 568| 50| mlk_poly_invntt_tomont(v); ------------------ | | 263| 50|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 50|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 50|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 50|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 569| | 570| 50| mlk_polyvec_add(b, ep); ------------------ | | 414| 50|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 50|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 50|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 50|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 571| 50| mlk_poly_add(v, epp); ------------------ | | 181| 50|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 50|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 50|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 50|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 572| 50| mlk_poly_add(v, k); ------------------ | | 181| 50|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 50|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 50|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 50|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 573| | 574| 50| mlk_polyvec_reduce(b); ------------------ | | 387| 50|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 50|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 50|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 50|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 575| 50| mlk_poly_reduce(v); ------------------ | | 154| 50|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 50|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 50|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 50|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 576| | 577| 50| mlk_pack_ciphertext(c, b, v); ------------------ | | 36| 50|#define mlk_pack_ciphertext MLK_ADD_PARAM_SET(mlk_pack_ciphertext) | | ------------------ | | | | 48| 50|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 578| | 579| 50|cleanup: 580| | /* Specification: Partially implements 581| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 582| 50| MLK_FREE(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 50| do \ | | 239| 50| { \ | | 240| 50| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 50| (v) = NULL; \ | | 242| 50| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 50] | | ------------------ ------------------ 583| 50| MLK_FREE(epp, mlk_poly, 1, context); ------------------ | | 238| 50| do \ | | 239| 50| { \ | | 240| 50| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 50| (v) = NULL; \ | | 242| 50| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 50] | | ------------------ ------------------ 584| 50| MLK_FREE(k, mlk_poly, 1, context); ------------------ | | 238| 50| do \ | | 239| 50| { \ | | 240| 50| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 50| (v) = NULL; \ | | 242| 50| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 50] | | ------------------ ------------------ 585| 50| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 50| do \ | | 239| 50| { \ | | 240| 50| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 50| (v) = NULL; \ | | 242| 50| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 50] | | ------------------ ------------------ 586| 50| MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 50| do \ | | 239| 50| { \ | | 240| 50| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 50| (v) = NULL; \ | | 242| 50| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 50] | | ------------------ ------------------ 587| 50| MLK_FREE(ep, mlk_polyvec, 1, context); ------------------ | | 238| 50| do \ | | 239| 50| { \ | | 240| 50| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 50| (v) = NULL; \ | | 242| 50| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 50] | | ------------------ ------------------ 588| 50| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 50| do \ | | 239| 50| { \ | | 240| 50| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 50| (v) = NULL; \ | | 242| 50| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 50] | | ------------------ ------------------ 589| 50| MLK_FREE(sp, mlk_polyvec, 1, context); ------------------ | | 238| 50| do \ | | 239| 50| { \ | | 240| 50| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 50| (v) = NULL; \ | | 242| 50| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 50] | | ------------------ ------------------ 590| 50| MLK_FREE(at, mlk_polymat, 1, context); ------------------ | | 238| 50| do \ | | 239| 50| { \ | | 240| 50| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 50| (v) = NULL; \ | | 242| 50| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 50] | | ------------------ ------------------ 591| | MLK_FREE(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 50| do \ | | 239| 50| { \ | | 240| 50| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 50| (v) = NULL; \ | | 242| 50| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 50] | | ------------------ ------------------ 592| 50| return ret; 593| 50|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_indcpa_dec: 603| 25|{ 604| 25| int ret = 0; 605| 25| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 606| 25| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 607| 25| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 608| 25| MLK_ALLOC(sb, mlk_poly, 1, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 609| 25| MLK_ALLOC(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 610| | 611| 25| if (b == NULL || skpv == NULL || v == NULL || sb == NULL || b_cache == NULL) ------------------ | Branch (611:7): [True: 0, False: 25] | Branch (611:20): [True: 0, False: 25] | Branch (611:36): [True: 0, False: 25] | Branch (611:49): [True: 0, False: 25] | Branch (611:63): [True: 0, False: 25] ------------------ 612| 0| { 613| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 614| 0| goto cleanup; 615| 0| } 616| | 617| 25| mlk_unpack_ciphertext(b, v, c); ------------------ | | 37| 25|#define mlk_unpack_ciphertext MLK_ADD_PARAM_SET(mlk_unpack_ciphertext) | | ------------------ | | | | 48| 25|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 618| 25| mlk_unpack_sk(skpv, sk); ------------------ | | 35| 25|#define mlk_unpack_sk MLK_ADD_PARAM_SET(mlk_unpack_sk) | | ------------------ | | | | 48| 25|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 619| | 620| 25| mlk_polyvec_ntt(b); ------------------ | | 269| 25|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 621| 25| mlk_polyvec_mulcache_compute(b_cache, b); ------------------ | | 353| 25|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 622| 25| mlk_polyvec_basemul_acc_montgomery_cached(sb, skpv, b, b_cache); ------------------ | | 321| 25| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 623| 25| mlk_poly_invntt_tomont(sb); ------------------ | | 263| 25|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 25|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 624| | 625| 25| mlk_poly_sub(v, sb); ------------------ | | 210| 25|#define mlk_poly_sub MLK_NAMESPACE(poly_sub) | | ------------------ | | | | 63| 25|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 626| 25| mlk_poly_reduce(v); ------------------ | | 154| 25|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 25|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 627| | 628| 25| mlk_poly_tomsg(m, v); ------------------ | | 577| 25|#define mlk_poly_tomsg MLK_NAMESPACE(poly_tomsg) | | ------------------ | | | | 63| 25|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 629| | 630| 25|cleanup: 631| | /* Specification: Partially implements 632| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 633| 25| MLK_FREE(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 634| 25| MLK_FREE(sb, mlk_poly, 1, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 635| 25| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 636| 25| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 637| | MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 638| 25| return ret; 639| 25|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_check_pk: 45| 25|{ 46| 25| int ret = 0; 47| 25| MLK_ALLOC(p, mlk_polyvec, 1, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 48| 25| MLK_ALLOC(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 49| | 50| 25| if (p == NULL || p_reencoded == NULL) ------------------ | Branch (50:7): [True: 0, False: 25] | Branch (50:20): [True: 0, False: 25] ------------------ 51| 0| { 52| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 53| 0| goto cleanup; 54| 0| } 55| | 56| 25| mlk_polyvec_frombytes(p, pk); ------------------ | | 247| 25|#define mlk_polyvec_frombytes MLK_NAMESPACE_K(polyvec_frombytes) | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 57| 25| mlk_polyvec_reduce(p); ------------------ | | 387| 25|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| 25| mlk_polyvec_tobytes(p_reencoded, p); ------------------ | | 225| 25|#define mlk_polyvec_tobytes MLK_NAMESPACE_K(polyvec_tobytes) | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| | /* We use a constant-time memcmp here to avoid having to 61| | * declassify the PK before the PCT has succeeded. */ 62| 25| ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 31| 25|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 17| 25|#define MLKEM_K 4 | | ------------------ | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 30| 25|#define MLKEM_POLYBYTES 384 | | ------------------ ------------------ ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ | Branch (62:9): [True: 0, False: 25] ------------------ 63| | 64| 25|cleanup: 65| | /* Specification: Partially implements 66| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 67| 25| MLK_FREE(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 68| | MLK_FREE(p, mlk_polyvec, 1, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 69| 25| return ret; 70| 25|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_check_sk: 78| 25|{ 79| 25| int ret = 0; 80| 25| MLK_ALLOC(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 81| | 82| 25| if (test == NULL) ------------------ | Branch (82:7): [True: 0, False: 25] ------------------ 83| 0| { 84| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 85| 0| goto cleanup; 86| 0| } 87| | 88| | /* 89| | * The parts of `sk` being hashed and compared here are public, so 90| | * no public information is leaked through the runtime or the return value 91| | * of this function. 92| | */ 93| | 94| | /* Declassify the public part of the secret key */ 95| 25| MLK_CT_TESTING_DECLASSIFY(sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 235| 25| do \ | | 236| 25| { \ | | 237| 25| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 25] | | ------------------ ------------------ 96| 25| MLKEM_INDCCA_PUBLICKEYBYTES); 97| 25| MLK_CT_TESTING_DECLASSIFY( ------------------ | | 235| 25| do \ | | 236| 25| { \ | | 237| 25| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 25] | | ------------------ ------------------ 98| 25| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, MLKEM_SYMBYTES); 99| | 100| 25| mlk_hash_h(test, sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 29| 25|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 25|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 25|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 101| 25| MLKEM_INDCCA_PUBLICKEYBYTES); 102| | /* This doesn't have to be a constant-time memcmp, but it's the only place 103| | * in the library where a normal memcmp would be used otherwise, so for sake 104| | * of minimizing stdlib dependency, we use our constant-time one anyway. */ 105| 25| ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 25| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 25|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 25|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 25|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 25|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 25|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 25|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 25|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 25|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 25| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (105:9): [True: 0, False: 25] ------------------ 106| 25| test, MLKEM_SYMBYTES) ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 107| 25| ? MLK_ERR_FAIL ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ 108| 25| : 0; 109| | 110| 25|cleanup: 111| | /* Specification: Partially implements 112| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 113| | MLK_FREE(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 114| 25| return ret; 115| 25|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_keypair_derand: 214| 25|{ 215| 25| int ret; 216| | 217| 25| ret = mlk_indcpa_keypair_derand(pk, sk, coins, context); ------------------ | | 49| 25| MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 25|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 218| 25| if (ret != 0) ------------------ | Branch (218:7): [True: 0, False: 25] ------------------ 219| 0| { 220| 0| goto cleanup; 221| 0| } 222| | 223| 25| mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 168| 25|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 65| 25|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 25|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 17| 25|#define MLKEM_K 4 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 25|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 25|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 25|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 25|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 25|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 25|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 224| 25| mlk_hash_h(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, pk, ------------------ | | 29| 25|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 25|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 25|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 225| 25| MLKEM_INDCCA_PUBLICKEYBYTES); 226| | /* Value z for pseudo-random output on reject */ 227| 25| mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 25|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 25| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 25|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 25|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 25|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 25|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 25|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 25|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 25|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 25|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 25| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 228| 25| coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 229| | 230| | /* Declassify public key */ 231| 25| MLK_CT_TESTING_DECLASSIFY(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 235| 25| do \ | | 236| 25| { \ | | 237| 25| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 25] | | ------------------ ------------------ 232| | 233| | /* Pairwise Consistency Test (PCT) @[FIPS140_3_IG, p.87] */ 234| 25| ret = mlk_check_pct(pk, sk, context); ------------------ | | 37| 25|#define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 48| 25|#define MLK_ADD_PARAM_SET(s) s | | ------------------ | | #define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 211| 25|#define MLK_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1) | | ------------------ ------------------ 235| 25| if (ret != 0) ------------------ | Branch (235:7): [True: 0, False: 25] ------------------ 236| 0| { 237| 0| goto cleanup; 238| 0| } 239| | 240| 25|cleanup: 241| 25| if (ret != 0) ------------------ | Branch (241:7): [True: 0, False: 25] ------------------ 242| 0| { 243| 0| mlk_zeroize(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 0|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 0|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 244| 0| mlk_zeroize(sk, MLKEM_INDCCA_SECRETKEYBYTES); ------------------ | | 72| 0| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 0|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 0|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 0|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 0| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 245| 0| } 246| | 247| 25| return ret; 248| 25|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_keypair: 257| 25|{ 258| 25| int ret = 0; 259| 25| MLK_ALLOC(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 260| | 261| 25| if (coins == NULL) ------------------ | Branch (261:7): [True: 0, False: 25] ------------------ 262| 0| { 263| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 264| 0| goto cleanup; 265| 0| } 266| | 267| | /* Acquire necessary randomness, and mark it as secret. */ 268| 25| if (mlk_randombytes(coins, 2 * MLKEM_SYMBYTES) != 0) ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (268:7): [True: 0, False: 25] ------------------ 269| 0| { 270| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 271| 0| goto cleanup; 272| 0| } 273| | 274| 25| MLK_CT_TESTING_SECRET(coins, 2 * MLKEM_SYMBYTES); ------------------ | | 231| 25| do \ | | 232| 25| { \ | | 233| 25| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 25] | | ------------------ ------------------ 275| | 276| 25| ret = mlk_kem_keypair_derand(pk, sk, coins, context); ------------------ | | 50| 25| MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 25|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 277| | 278| 25|cleanup: 279| | /* Specification: Partially implements 280| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 281| | MLK_FREE(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 282| 25| return ret; 283| 25|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_enc_derand: 295| 25|{ 296| 25| int ret = 0; 297| 25| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 298| 25| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 299| | 300| 25| if (buf == NULL || kr == NULL) ------------------ | Branch (300:7): [True: 0, False: 25] | Branch (300:22): [True: 0, False: 25] ------------------ 301| 0| { 302| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 303| 0| goto cleanup; 304| 0| } 305| | 306| | /* Specification: Implements @[FIPS203, Section 7.2, Modulus check] */ 307| 25| ret = mlk_kem_check_pk(pk, context); ------------------ | | 55| 25|#define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 25|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 308| 25| if (ret != 0) ------------------ | Branch (308:7): [True: 0, False: 25] ------------------ 309| 0| { 310| 0| goto cleanup; 311| 0| } 312| | 313| 25| mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 168| 25|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 314| | 315| | /* Multitarget countermeasure for coins + contributory KEM */ 316| 25| mlk_hash_h(buf + MLKEM_SYMBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 29| 25|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 25|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 25|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 317| 25| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 25|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 25|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 25|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 318| | 319| | /* coins are in kr+MLKEM_SYMBYTES */ 320| 25| ret = mlk_indcpa_enc(ct, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 25|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 25| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 321| 25| if (ret != 0) ------------------ | Branch (321:7): [True: 0, False: 25] ------------------ 322| 0| { 323| 0| goto cleanup; 324| 0| } 325| | 326| 25| mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 168| 25|#define mlk_memcpy memcpy ------------------ mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 327| | 328| 25|cleanup: 329| | /* Specification: Partially implements 330| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 331| 25| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 332| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 333| 25| return ret; 334| 25|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_enc: 344| 25|{ 345| 25| int ret = 0; 346| 25| MLK_ALLOC(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 347| | 348| 25| if (coins == NULL) ------------------ | Branch (348:7): [True: 0, False: 25] ------------------ 349| 0| { 350| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 351| 0| goto cleanup; 352| 0| } 353| | 354| 25| if (mlk_randombytes(coins, MLKEM_SYMBYTES) != 0) ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (354:7): [True: 0, False: 25] ------------------ 355| 0| { 356| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 357| 0| goto cleanup; 358| 0| } 359| | 360| 25| MLK_CT_TESTING_SECRET(coins, MLKEM_SYMBYTES); ------------------ | | 231| 25| do \ | | 232| 25| { \ | | 233| 25| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 25] | | ------------------ ------------------ 361| | 362| 25| ret = mlk_kem_enc_derand(ct, ss, pk, coins, context); ------------------ | | 52| 25|#define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 25| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 363| | 364| 25|cleanup: 365| | /* Specification: Partially implements 366| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 367| | MLK_FREE(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 368| 25| return ret; 369| 25|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_dec: 380| 25|{ 381| 25| int ret = 0; 382| 25| uint8_t fail; 383| 25| const uint8_t *pk = sk + MLKEM_INDCPA_SECRETKEYBYTES; ------------------ | | 65| 25|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 25|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 17| 25|#define MLKEM_K 4 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 25|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ 384| 25| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 385| 25| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 386| 25| MLK_ALLOC(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 229| 25| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 25|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 25| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 387| 25| context); 388| | 389| 25| if (buf == NULL || kr == NULL || tmp == NULL) ------------------ | Branch (389:7): [True: 0, False: 25] | Branch (389:22): [True: 0, False: 25] | Branch (389:36): [True: 0, False: 25] ------------------ 390| 0| { 391| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 392| 0| goto cleanup; 393| 0| } 394| | 395| | /* Specification: Implements @[FIPS203, Section 7.3, Hash check] */ 396| 25| ret = mlk_kem_check_sk(sk, context); ------------------ | | 56| 25|#define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 25|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 397| 25| if (ret != 0) ------------------ | Branch (397:7): [True: 0, False: 25] ------------------ 398| 0| { 399| 0| goto cleanup; 400| 0| } 401| | 402| 25| ret = mlk_indcpa_dec(buf, ct, sk, context); ------------------ | | 127| 25|#define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 25|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 403| 25| if (ret != 0) ------------------ | Branch (403:7): [True: 0, False: 25] ------------------ 404| 0| { 405| 0| goto cleanup; 406| 0| } 407| | 408| | /* Multitarget countermeasure for coins + contributory KEM */ 409| 25| mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 168| 25|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 410| 25| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 25| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 25|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 25|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 25|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 25|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 25|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 25|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 25|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 25|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 25| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 411| 25| MLKEM_SYMBYTES); ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 412| 25| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 25|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 25|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 25|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 413| | 414| | /* Recompute and compare ciphertext */ 415| | /* coins are in kr+MLKEM_SYMBYTES */ 416| 25| ret = mlk_indcpa_enc(tmp, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 25|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 25|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 25| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 417| 25| if (ret != 0) ------------------ | Branch (417:7): [True: 0, False: 25] ------------------ 418| 0| { 419| 0| goto cleanup; 420| 0| } 421| | 422| 25| fail = mlk_ct_memcmp(ct, tmp, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 25|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 25| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 58| 25|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 17| 25|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 57| 25|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D11 | | | | | | | | ------------------ | | | | | | | | | | 36| 25|#define MLKEM_POLYCOMPRESSEDBYTES_D11 352 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 56| 25|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D5 | | | | | | ------------------ | | | | | | | | 34| 25|#define MLKEM_POLYCOMPRESSEDBYTES_D5 160 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 423| | 424| | /* Compute rejection key */ 425| 25| mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 25|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 25| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 25|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 25|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 25|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 25|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 25|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 25|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 25|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 25|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 25| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 426| 25| MLKEM_SYMBYTES); ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 427| 25| mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 168| 25|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 25|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 25| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 58| 25|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 17| 25|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 57| 25|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D11 | | | | | | | | ------------------ | | | | | | | | | | 36| 25|#define MLKEM_POLYCOMPRESSEDBYTES_D11 352 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 56| 25|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D5 | | | | | | ------------------ | | | | | | | | 34| 25|#define MLKEM_POLYCOMPRESSEDBYTES_D5 160 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 428| 25| mlk_hash_j(ss, tmp, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 36| 25| mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 18| 25|#define mlk_shake256 shake256 | | | | ------------------ | | | | | | 12| 25|#define shake256 OQS_SHA3_shake256 | | | | ------------------ | | ------------------ | | mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 429| | 430| | /* Copy true key to return buffer if fail is 0 */ 431| 25| mlk_ct_cmov_zero(ss, kr, MLKEM_SYMBYTES, fail); ------------------ | | 27| 25|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 432| | 433| 25|cleanup: 434| | /* Specification: Partially implements 435| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 436| 25| MLK_FREE(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 437| 25| context); 438| 25| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 439| 25| MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 25| do \ | | 239| 25| { \ | | 240| 25| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 25| (v) = NULL; \ | | 242| 25| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 25] | | ------------------ ------------------ 440| | 441| 25| return ret; 442| 25|} poly_k.c:mlk_polyvec_basemul_acc_montgomery_cached_k4_native: 157| 375|{ 158| 375| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (158:7): [True: 0, False: 375] ------------------ 159| 0| { 160| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 161| 0| } 162| | 163| 375| mlk_polyvec_basemul_acc_montgomery_cached_k4_avx2_asm(r, a, b, b_cache); ------------------ | | 141| 375| MLK_NAMESPACE(polyvec_basemul_acc_montgomery_cached_k4_avx2_asm) | | ------------------ | | | | 63| 375|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 375|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 375|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 164| 375| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 375|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 165| 375|} compress.c:mlk_poly_compress_d5_native: 252| 50|{ 253| 50| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (253:7): [True: 0, False: 50] ------------------ 254| 0| { 255| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 256| 0| } 257| | 258| 50| mlk_poly_compress_d5_avx2_asm(r, a, mlk_compress_d5_data); ------------------ | | 261| 50|#define mlk_poly_compress_d5_avx2_asm MLK_NAMESPACE(poly_compress_d5_avx2_asm) | | ------------------ | | | | 63| 50|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 50|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 50|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_d5_avx2_asm(r, a, mlk_compress_d5_data); ------------------ | | 31| 50|#define mlk_compress_d5_data MLK_NAMESPACE(compress_d5_data) | | ------------------ | | | | 63| 50|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 50|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 50|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 259| 50| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 50|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 260| 50|} compress.c:mlk_poly_compress_d11_native: 265| 200|{ 266| 200| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (266:7): [True: 0, False: 200] ------------------ 267| 0| { 268| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 269| 0| } 270| | 271| 200| mlk_poly_compress_d11_avx2_asm(r, a, mlk_compress_d11_data); ------------------ | | 294| 200|#define mlk_poly_compress_d11_avx2_asm MLK_NAMESPACE(poly_compress_d11_avx2_asm) | | ------------------ | | | | 63| 200|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 200|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 200|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_d11_avx2_asm(r, a, mlk_compress_d11_data); ------------------ | | 37| 200|#define mlk_compress_d11_data MLK_NAMESPACE(compress_d11_data) | | ------------------ | | | | 63| 200|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 200|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 200|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 272| 200| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 200|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 273| 200|} compress.c:mlk_poly_decompress_d5_native: 278| 25|{ 279| 25| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (279:7): [True: 0, False: 25] ------------------ 280| 0| { 281| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 282| 0| } 283| | 284| 25| mlk_poly_decompress_d5_avx2_asm(r, a, mlk_decompress_d5_data); ------------------ | | 278| 25| MLK_NAMESPACE(poly_decompress_d5_avx2_asm) | | ------------------ | | | | 63| 25|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_d5_avx2_asm(r, a, mlk_decompress_d5_data); ------------------ | | 34| 25|#define mlk_decompress_d5_data MLK_NAMESPACE(decompress_d5_data) | | ------------------ | | | | 63| 25|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 285| 25| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 25|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 286| 25|} compress.c:mlk_poly_decompress_d11_native: 291| 100|{ 292| 100| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (292:7): [True: 0, False: 100] ------------------ 293| 0| { 294| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 295| 0| } 296| | 297| 100| mlk_poly_decompress_d11_avx2_asm(r, a, mlk_decompress_d11_data); ------------------ | | 311| 100| MLK_NAMESPACE(poly_decompress_d11_avx2_asm) | | ------------------ | | | | 63| 100|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 100|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 100|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_d11_avx2_asm(r, a, mlk_decompress_d11_data); ------------------ | | 40| 100|#define mlk_decompress_d11_data MLK_NAMESPACE(decompress_d11_data) | | ------------------ | | | | 63| 100|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 100|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 100|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 298| 100| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 100|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 299| 100|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_tomont: 132| 100|{ 133| 100|#if defined(MLK_USE_NATIVE_POLY_TOMONT) 134| 100| int ret; 135| 100| ret = mlk_poly_tomont_native(r->coeffs); 136| 100| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 100|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (136:7): [True: 100, False: 0] ------------------ 137| 100| { 138| 100| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 100| do \ | | 106| 100| { \ | | 107| 100| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 100] | | ------------------ ------------------ 139| 100| return; 140| 100| } 141| 0|#endif /* MLK_USE_NATIVE_POLY_TOMONT */ 142| | 143| 0| mlk_poly_tomont_c(r); 144| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_reduce: 211| 575|{ 212| 575|#if defined(MLK_USE_NATIVE_POLY_REDUCE) 213| 575| int ret; 214| 575| ret = mlk_poly_reduce_native(r->coeffs); 215| 575| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 575|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (215:7): [True: 575, False: 0] ------------------ 216| 575| { 217| 575| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 575| do \ | | 102| 575| { \ | | 103| 575| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 575] | | ------------------ ------------------ 218| 575| return; 219| 575| } 220| 0|#endif /* MLK_USE_NATIVE_POLY_REDUCE */ 221| | 222| 0| mlk_poly_reduce_c(r); 223| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_add: 230| 400|{ 231| 400| unsigned i; 232| 102k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 102k|#define MLKEM_N 256 ------------------ | Branch (232:15): [True: 102k, False: 400] ------------------ 233| 102k| __loop__( 234| 102k| invariant(i <= MLKEM_N) 235| 102k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 236| 102k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] + b->coeffs[k1])) 237| 102k| decreases(MLKEM_N - i)) 238| 102k| { 239| | /* The preconditions imply that the addition stays within int16_t. */ 240| 102k| r->coeffs[i] = (int16_t)(r->coeffs[i] + b->coeffs[i]); 241| 102k| } 242| 400|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_sub: 249| 25|{ 250| 25| unsigned i; 251| 6.42k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 6.42k|#define MLKEM_N 256 ------------------ | Branch (251:15): [True: 6.40k, False: 25] ------------------ 252| 6.40k| __loop__( 253| 6.40k| invariant(i <= MLKEM_N) 254| 6.40k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 255| 6.40k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] - b->coeffs[k1])) 256| 6.40k| decreases(MLKEM_N - i)) 257| 6.40k| { 258| | /* The preconditions imply that the subtraction stays within int16_t. */ 259| 6.40k| r->coeffs[i] = (int16_t)(r->coeffs[i] - b->coeffs[i]); 260| 6.40k| } 261| 25|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_mulcache_compute: 302| 400|{ 303| 400|#if defined(MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE) 304| 400| int ret; 305| 400| ret = mlk_poly_mulcache_compute_native(x->coeffs, a->coeffs); 306| 400| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 400|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (306:7): [True: 400, False: 0] ------------------ 307| 400| { 308| 400| return; 309| 400| } 310| 0|#endif /* MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE */ 311| | 312| 0| mlk_poly_mulcache_compute_c(x, a); 313| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_ntt: 457| 500|{ 458| 500|#if defined(MLK_USE_NATIVE_NTT) 459| 500| int ret; 460| 500| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 500| do \ | | 106| 500| { \ | | 107| 500| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 500] | | ------------------ ------------------ 461| 500| ret = mlk_ntt_native(r->coeffs); 462| 500| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 500|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (462:7): [True: 500, False: 0] ------------------ 463| 500| { 464| 500| mlk_assert_abs_bound(r, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 105| 500| do \ | | 106| 500| { \ | | 107| 500| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 500] | | ------------------ ------------------ 465| 500| return; 466| 500| } 467| 0|#endif /* MLK_USE_NATIVE_NTT */ 468| | 469| 0| mlk_poly_ntt_c(r); 470| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_invntt_tomont: 558| 275|{ 559| 275|#if defined(MLK_USE_NATIVE_INTT) 560| 275| int ret; 561| 275| ret = mlk_intt_native(r->coeffs); 562| 275| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 275|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (562:7): [True: 275, False: 0] ------------------ 563| 275| { 564| 275| mlk_assert_abs_bound(r, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 105| 275| do \ | | 106| 275| { \ | | 107| 275| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 275] | | ------------------ ------------------ 565| 275| return; 566| 275| } 567| 0|#endif /* MLK_USE_NATIVE_INTT */ 568| | 569| 0| mlk_poly_invntt_tomont_c(r); 570| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_compress_du: 50| 50|{ 51| 50| unsigned i; 52| 50| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 50| do \ | | 111| 50| { \ | | 112| 50| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 50] | | ------------------ ------------------ 53| | 54| 250| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 250|#define MLKEM_K 4 ------------------ | Branch (54:15): [True: 200, False: 50] ------------------ 55| 200| { 56| 200| mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 49| 200|#define mlk_poly_compress_du MLK_NAMESPACE_K(poly_compress_du) | | ------------------ | | | | 64| 200|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 200|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 200|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 57| 200|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D11 | | ------------------ | | | | 36| 200|#define MLKEM_POLYCOMPRESSEDBYTES_D11 352 | | ------------------ ------------------ 57| 200| } 58| 50|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_decompress_du: 64| 25|{ 65| 25| unsigned i; 66| 125| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 125|#define MLKEM_K 4 ------------------ | Branch (66:15): [True: 100, False: 25] ------------------ 67| 100| { 68| 100| mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 79| 100|#define mlk_poly_decompress_du MLK_NAMESPACE_K(poly_decompress_du) | | ------------------ | | | | 64| 100|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 100|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 100|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 57| 100|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D11 | | ------------------ | | | | 36| 100|#define MLKEM_POLYCOMPRESSEDBYTES_D11 352 | | ------------------ ------------------ 69| 100| } 70| | 71| 25| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 25| do \ | | 111| 25| { \ | | 112| 25| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 25] | | ------------------ ------------------ 72| 25|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_tobytes: 81| 75|{ 82| 75| unsigned i; 83| 75| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 75| do \ | | 111| 75| { \ | | 112| 75| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 75] | | ------------------ ------------------ 84| | 85| 375| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 375|#define MLKEM_K 4 ------------------ | Branch (85:15): [True: 300, False: 75] ------------------ 86| 300| __loop__( 87| 300| assigns(i, memory_slice(r, MLKEM_POLYVECBYTES)) 88| 300| invariant(i <= MLKEM_K) 89| 300| decreases(MLKEM_K - i) 90| 300| ) 91| 300| { 92| 300| mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 512| 300|#define mlk_poly_tobytes MLK_NAMESPACE(poly_tobytes) | | ------------------ | | | | 63| 300|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 300|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 300|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 30| 300|#define MLKEM_POLYBYTES 384 ------------------ 93| 300| } 94| 75|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_frombytes: 99| 100|{ 100| 100| unsigned i; 101| 500| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 500|#define MLKEM_K 4 ------------------ | Branch (101:15): [True: 400, False: 100] ------------------ 102| 400| { 103| 400| mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 534| 400|#define mlk_poly_frombytes MLK_NAMESPACE(poly_frombytes) | | ------------------ | | | | 63| 400|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 400|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 400|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 30| 400|#define MLKEM_POLYBYTES 384 ------------------ 104| 400| } 105| | 106| 100| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 100| do \ | | 111| 100| { \ | | 112| 100| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 100] | | ------------------ ------------------ 107| 100|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_ntt: 112| 125|{ 113| 125| unsigned i; 114| 625| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 625|#define MLKEM_K 4 ------------------ | Branch (114:15): [True: 500, False: 125] ------------------ 115| 500| { 116| 500| mlk_poly_ntt(&r->vec[i]); ------------------ | | 235| 500|#define mlk_poly_ntt MLK_NAMESPACE(poly_ntt) | | ------------------ | | | | 63| 500|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 500|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 500|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 117| 500| } 118| | 119| 125| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 115| 125| do \ | | 116| 125| { \ | | 117| 125| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 125] | | ------------------ ------------------ 120| 125|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_invntt_tomont: 129| 50|{ 130| 50| unsigned i; 131| 250| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 250|#define MLKEM_K 4 ------------------ | Branch (131:15): [True: 200, False: 50] ------------------ 132| 200| { 133| 200| mlk_poly_invntt_tomont(&r->vec[i]); ------------------ | | 263| 200|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 200|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 200|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 200|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 134| 200| } 135| | 136| 50| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 115| 50| do \ | | 116| 50| { \ | | 117| 50| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 50] | | ------------------ ------------------ 137| 50|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_basemul_acc_montgomery_cached: 195| 375|{ 196| 375|#if defined(MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED) 197| 375| { 198| 375| int ret; 199| 375| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 375| do \ | | 111| 375| { \ | | 112| 375| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 375] | | ------------------ ------------------ 200| |#if MLKEM_K == 2 201| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k2_native( 202| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 203| | (const int16_t *)b_cache); 204| |#elif MLKEM_K == 3 205| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k3_native( 206| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 207| | (const int16_t *)b_cache); 208| |#elif MLKEM_K == 4 209| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k4_native( 210| 375| r->coeffs, (const int16_t *)a, (const int16_t *)b, 211| 375| (const int16_t *)b_cache); 212| 375|#endif 213| 375| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 375|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (213:9): [True: 375, False: 0] ------------------ 214| 375| { 215| 375| return; 216| 375| } 217| 375| } 218| 0|#endif /* MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED */ 219| | 220| 0| mlk_polyvec_basemul_acc_montgomery_cached_c(r, a, b, b_cache); ------------------ | | 39| 0| MLK_ADD_PARAM_SET(mlk_polyvec_basemul_acc_montgomery_cached_c) | | ------------------ | | | | 48| 0|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 221| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_mulcache_compute: 229| 100|{ 230| 100| unsigned i; 231| 500| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 500|#define MLKEM_K 4 ------------------ | Branch (231:15): [True: 400, False: 100] ------------------ 232| 400| { 233| 400| mlk_poly_mulcache_compute(&x->vec[i], &a->vec[i]); ------------------ | | 123| 400|#define mlk_poly_mulcache_compute MLK_NAMESPACE(poly_mulcache_compute) | | ------------------ | | | | 63| 400|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 400|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 400|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 234| 400| } 235| 100|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_reduce: 246| 125|{ 247| 125| unsigned i; 248| 625| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 625|#define MLKEM_K 4 ------------------ | Branch (248:15): [True: 500, False: 125] ------------------ 249| 500| { 250| 500| mlk_poly_reduce(&r->vec[i]); ------------------ | | 154| 500|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 500|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 500|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 500|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 251| 500| } 252| | 253| 125| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 125| do \ | | 111| 125| { \ | | 112| 125| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 125] | | ------------------ ------------------ 254| 125|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_add: 261| 75|{ 262| 75| unsigned i; 263| 375| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 375|#define MLKEM_K 4 ------------------ | Branch (263:15): [True: 300, False: 75] ------------------ 264| 300| __loop__( 265| 300| assigns(i, memory_slice(r, sizeof(mlk_polyvec))) 266| 300| invariant(i <= MLKEM_K) 267| 300| invariant(forall(j0, i, MLKEM_K, 268| 300| forall(k0, 0, MLKEM_N, 269| 300| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] <= INT16_MAX) && 270| 300| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] >= INT16_MIN)))) 271| 300| invariant(forall(j2, 0, i, 272| 300| forall(k2, 0, MLKEM_N, 273| 300| (r->vec[j2].coeffs[k2] <= INT16_MAX) && 274| 300| (r->vec[j2].coeffs[k2] >= INT16_MIN)))) 275| 300| decreases(MLKEM_K - i) 276| 300| ) 277| 300| { 278| 300| mlk_poly_add(&r->vec[i], &b->vec[i]); ------------------ | | 181| 300|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 300|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 300|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 300|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 279| 300| } 280| 75|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_tomont: 285| 25|{ 286| 25| unsigned i; 287| 125| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 125|#define MLKEM_K 4 ------------------ | Branch (287:15): [True: 100, False: 25] ------------------ 288| 100| { 289| 100| mlk_poly_tomont(&r->vec[i]); ------------------ | | 102| 100|#define mlk_poly_tomont MLK_NAMESPACE(poly_tomont) | | ------------------ | | | | 63| 100|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 100|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 100|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 100| } 291| | 292| 25| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLKEM_Q); ------------------ | | 115| 25| do \ | | 116| 25| { \ | | 117| 25| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 25] | | ------------------ ------------------ 293| 25|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_getnoise_eta1_4x: 337| 150|{ 338| 150| MLK_ALIGN uint8_t buf[4][MLK_ALIGN_UP(MLKEM_ETA1 * MLKEM_N / 4)]; ------------------ | | 190| 150|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 339| 150| MLK_ALIGN uint8_t extkey[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 1)]; ------------------ | | 190| 150|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 340| 150| mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 168| 150|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 27| 150|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 341| 150| mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 168| 150|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 27| 150|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 342| 150| mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 168| 150|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 27| 150|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 343| 150| mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 168| 150|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 27| 150|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 344| 150| extkey[0][MLKEM_SYMBYTES] = nonce0; ------------------ | | 27| 150|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 345| 150| extkey[1][MLKEM_SYMBYTES] = nonce1; ------------------ | | 27| 150|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 346| 150| extkey[2][MLKEM_SYMBYTES] = nonce2; ------------------ | | 27| 150|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 347| 150| extkey[3][MLKEM_SYMBYTES] = nonce3; ------------------ | | 27| 150|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 348| | 349| 150|#if !defined(FIPS202_X4_DEFAULT_IMPLEMENTATION) && \ 350| 150| !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 351| 150| mlk_prf_eta1_x4(buf, extkey); ------------------ | | 45| 150| mlk_shake256x4((OUT)[0], (OUT)[1], (OUT)[2], (OUT)[3], \ | | ------------------ | | | | 18| 150|#define mlk_shake256x4 shake256x4 | | | | ------------------ | | | | | | 36| 150|#define shake256x4 OQS_SHA3_shake256_x4 | | | | ------------------ | | ------------------ | | 46| 150| (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 53| 150|#define MLKEM_ETA1 2 | | ------------------ | | (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 22| 150|#define MLKEM_N 256 | | ------------------ | | 47| 150| (IN)[3], MLKEM_SYMBYTES + 1) | | ------------------ | | | | 27| 150|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 352| |#else 353| | mlk_prf_eta1(buf[0], extkey[0]); 354| | mlk_prf_eta1(buf[1], extkey[1]); 355| | mlk_prf_eta1(buf[2], extkey[2]); 356| | if (r3 != NULL) 357| | { 358| | mlk_prf_eta1(buf[3], extkey[3]); 359| | } 360| |#endif /* !(!FIPS202_X4_DEFAULT_IMPLEMENTATION && \ 361| | !MLK_CONFIG_SERIAL_FIPS202_ONLY) */ 362| | 363| 150| mlk_poly_cbd_eta1(r0, buf[0]); ------------------ | | 36| 150|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 150|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 364| 150| mlk_poly_cbd_eta1(r1, buf[1]); ------------------ | | 36| 150|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 150|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 365| 150| mlk_poly_cbd_eta1(r2, buf[2]); ------------------ | | 36| 150|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 150|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 366| 150| if (r3 != NULL) ------------------ | Branch (366:7): [True: 150, False: 0] ------------------ 367| 150| { 368| 150| mlk_poly_cbd_eta1(r3, buf[3]); ------------------ | | 36| 150|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 150|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 369| 150| mlk_assert_abs_bound(r3, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 150| do \ | | 106| 150| { \ | | 107| 150| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 150] | | ------------------ ------------------ 370| 150| } 371| | 372| 150| mlk_assert_abs_bound(r0, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 150| do \ | | 106| 150| { \ | | 107| 150| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 150] | | ------------------ ------------------ 373| 150| mlk_assert_abs_bound(r1, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 150| do \ | | 106| 150| { \ | | 107| 150| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 150] | | ------------------ ------------------ 374| 150| mlk_assert_abs_bound(r2, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 150| do \ | | 106| 150| { \ | | 107| 150| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 150] | | ------------------ ------------------ 375| | 376| | /* Specification: Partially implements 377| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 378| 150| mlk_zeroize(buf, sizeof(buf)); 379| 150| mlk_zeroize(extkey, sizeof(extkey)); 380| 150|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_getnoise_eta2: 417| 50|{ 418| 50| MLK_ALIGN uint8_t buf[MLKEM_ETA2 * MLKEM_N / 4]; ------------------ | | 190| 50|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 419| 50| MLK_ALIGN uint8_t extkey[MLKEM_SYMBYTES + 1]; ------------------ | | 190| 50|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 420| | 421| 50| mlk_memcpy(extkey, seed, MLKEM_SYMBYTES); ------------------ | | 168| 50|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey, seed, MLKEM_SYMBYTES); ------------------ | | 27| 50|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 422| 50| extkey[MLKEM_SYMBYTES] = nonce; ------------------ | | 27| 50|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 423| 50| mlk_prf_eta2(buf, extkey); ------------------ | | 43| 50|#define mlk_prf_eta2(OUT, IN) mlk_prf_eta(MLKEM_ETA2, OUT, IN) | | ------------------ | | | | 41| 50| mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 18| 50|#define mlk_shake256 shake256 | | | | | | ------------------ | | | | | | | | 12| 50|#define shake256 OQS_SHA3_shake256 | | | | | | ------------------ | | | | ------------------ | | | | mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 22| 50|#define MLKEM_N 256 | | | | ------------------ | | | | mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 27| 50|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 424| | 425| 50| mlk_poly_cbd_eta2(r, buf); ------------------ | | 37| 50|#define mlk_poly_cbd_eta2 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta2) | | ------------------ | | | | 48| 50|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 426| | 427| 50| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_ETA2 + 1); ------------------ | | 105| 50| do \ | | 106| 50| { \ | | 107| 50| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 50] | | ------------------ ------------------ 428| | 429| | /* Specification: Partially implements 430| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 431| 50| mlk_zeroize(buf, sizeof(buf)); 432| 50| mlk_zeroize(extkey, sizeof(extkey)); 433| 50|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_compress_du: 69| 200|{ 70| |#if MLKEM_DU == 10 71| | mlk_poly_compress_d10(r, a); 72| |#elif MLKEM_DU == 11 73| 200| mlk_poly_compress_d11(r, a); ------------------ | | 445| 200|#define mlk_poly_compress_d11 MLK_NAMESPACE(poly_compress_d11) | | ------------------ | | | | 63| 200|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 200|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 200|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 74| |#else 75| |#error "Invalid value of MLKEM_DU" 76| |#endif 77| 200|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_decompress_du: 102| 100|{ 103| |#if MLKEM_DU == 10 104| | mlk_poly_decompress_d10(r, a); 105| |#elif MLKEM_DU == 11 106| 100| mlk_poly_decompress_d11(r, a); ------------------ | | 488| 100|#define mlk_poly_decompress_d11 MLK_NAMESPACE(poly_decompress_d11) | | ------------------ | | | | 63| 100|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 100|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 100|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 107| |#else 108| |#error "Invalid value of MLKEM_DU" 109| |#endif 110| 100|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_compress_dv: 132| 50|{ 133| |#if MLKEM_DV == 4 134| | mlk_poly_compress_d4(r, a); 135| |#elif MLKEM_DV == 5 136| 50| mlk_poly_compress_d5(r, a); ------------------ | | 425| 50|#define mlk_poly_compress_d5 MLK_NAMESPACE(poly_compress_d5) | | ------------------ | | | | 63| 50|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 50|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 50|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| |#else 138| |#error "Invalid value of MLKEM_DV" 139| |#endif 140| 50|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_decompress_dv: 166| 25|{ 167| |#if MLKEM_DV == 4 168| | mlk_poly_decompress_d4(r, a); 169| |#elif MLKEM_DV == 5 170| 25| mlk_poly_decompress_d5(r, a); ------------------ | | 465| 25|#define mlk_poly_decompress_d5 MLK_NAMESPACE(poly_decompress_d5) | | ------------------ | | | | 63| 25|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 25|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 25|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 171| |#else 172| |#error "Invalid value of MLKEM_DV" 173| |#endif 174| 25|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_rej_uniform_x4: 158| 300|{ 159| | /* Temporary buffers for XOF output before rejection sampling */ 160| 300| MLK_ALIGN uint8_t ------------------ | | 190| 300|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 161| 300| buf[4][MLK_ALIGN_UP(MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE)]; 162| | 163| | /* Tracks the number of coefficients we have already sampled */ 164| 300| unsigned ctr[4]; 165| 300| mlk_xof_x4_ctx statex; ------------------ | | 51| 300|#define mlk_xof_x4_ctx mlk_shake128x4ctx | | ------------------ | | | | 13| 300|#define mlk_shake128x4ctx shake128x4ctx | | | | ------------------ | | | | | | 51| 300|#define shake128x4ctx shake128x4incctx | | | | | | ------------------ | | | | | | | | 18| 300|#define shake128x4incctx OQS_SHA3_shake128_x4_inc_ctx | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 166| 300| unsigned buflen; 167| | 168| 300| mlk_xof_x4_init(&statex); ------------------ | | 59| 300|#define mlk_xof_x4_init(CTX) mlk_shake128x4_init((CTX)) | | ------------------ | | | | 16| 300|#define mlk_shake128x4_init shake128x4_init | | | | ------------------ | | | | | | 52| 300|#define shake128x4_init shake128x4_inc_init | | | | | | ------------------ | | | | | | | | 19| 300|#define shake128x4_inc_init OQS_SHA3_shake128_x4_inc_init | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 169| 300| mlk_xof_x4_absorb(&statex, seed, MLKEM_SYMBYTES + 2); ------------------ | | 61| 300| mlk_shake128x4_absorb_once((CTX), (IN)[0], (IN)[1], (IN)[2], (IN)[3], \ | | ------------------ | | | | 14| 300|#define mlk_shake128x4_absorb_once shake128x4_absorb_once | | | | ------------------ | | | | | | 39| 300|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once | | | | ------------------ | | ------------------ | | 62| 300| (INBYTES)) ------------------ 170| | 171| | /* 172| | * Initially, squeeze heuristic number of MLKEM_GEN_MATRIX_NBLOCKS. 173| | * This should generate the matrix entries with high probability. 174| | */ 175| 300| mlk_xof_x4_squeezeblocks(buf, MLKEM_GEN_MATRIX_NBLOCKS, &statex); ------------------ | | 64| 300| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 300|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 300| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 300|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 300| (NBLOCKS), (CTX)) ------------------ 176| 300| buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 146| 300| ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 22| 300|#define MLKEM_N 256 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 23| 300|#define MLKEM_Q 3329 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 68| 300|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 300|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 300|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 147| 300| MLK_XOF_RATE) | | ------------------ | | | | 68| 300|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 300|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 300|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 68| 300|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 300|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 300|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 177| 300| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, 0, buf[0], buflen); ------------------ | | 22| 300|#define MLKEM_N 256 ------------------ 178| 300| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, 0, buf[1], buflen); ------------------ | | 22| 300|#define MLKEM_N 256 ------------------ 179| 300| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, 0, buf[2], buflen); ------------------ | | 22| 300|#define MLKEM_N 256 ------------------ 180| 300| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, 0, buf[3], buflen); ------------------ | | 22| 300|#define MLKEM_N 256 ------------------ 181| | 182| | /* 183| | * So long as not all matrix entries have been generated, squeeze 184| | * one more block a time until we're done. 185| | */ 186| 300| buflen = MLK_XOF_RATE; ------------------ | | 68| 300|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 300|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 300|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 187| 403| while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 806|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 779|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 753|#define MLKEM_N 256 ------------------ | Branch (187:10): [True: 27, False: 376] | Branch (187:30): [True: 26, False: 350] | Branch (187:50): [True: 27, False: 323] ------------------ 188| 323| ctr[3] < MLKEM_N) ------------------ | | 22| 323|#define MLKEM_N 256 ------------------ | Branch (188:10): [True: 23, False: 300] ------------------ 189| 103| __loop__( 190| 103| assigns(ctr, statex, 191| 103| memory_slice(vec0, sizeof(mlk_poly)), 192| 103| memory_slice(vec1, sizeof(mlk_poly)), 193| 103| memory_slice(vec2, sizeof(mlk_poly)), 194| 103| memory_slice(vec3, sizeof(mlk_poly)), 195| 103| object_whole(buf)) 196| 103| invariant(ctr[0] <= MLKEM_N && ctr[1] <= MLKEM_N) 197| 103| invariant(ctr[2] <= MLKEM_N && ctr[3] <= MLKEM_N) 198| 103| invariant(array_bound(vec0->coeffs, 0, ctr[0], 0, MLKEM_Q)) 199| 103| invariant(array_bound(vec1->coeffs, 0, ctr[1], 0, MLKEM_Q)) 200| 103| invariant(array_bound(vec2->coeffs, 0, ctr[2], 0, MLKEM_Q)) 201| 103| invariant(array_bound(vec3->coeffs, 0, ctr[3], 0, MLKEM_Q))) 202| 103| { 203| 103| mlk_xof_x4_squeezeblocks(buf, 1, &statex); ------------------ | | 64| 103| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 103|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 103| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 103|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 103| (NBLOCKS), (CTX)) ------------------ 204| 103| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, ctr[0], buf[0], buflen); ------------------ | | 22| 103|#define MLKEM_N 256 ------------------ 205| 103| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, ctr[1], buf[1], buflen); ------------------ | | 22| 103|#define MLKEM_N 256 ------------------ 206| 103| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, ctr[2], buf[2], buflen); ------------------ | | 22| 103|#define MLKEM_N 256 ------------------ 207| 103| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, ctr[3], buf[3], buflen); ------------------ | | 22| 103|#define MLKEM_N 256 ------------------ 208| 103| } 209| | 210| 300| mlk_xof_x4_release(&statex); ------------------ | | 66| 300|#define mlk_xof_x4_release(CTX) mlk_shake128x4_release((CTX)) | | ------------------ | | | | 17| 300|#define mlk_shake128x4_release shake128x4_release | | | | ------------------ | | | | | | 53| 300|#define shake128x4_release shake128x4_inc_ctx_release | | | | | | ------------------ | | | | | | | | 23| 300|#define shake128x4_inc_ctx_release OQS_SHA3_shake128_x4_inc_ctx_release | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 211| | 212| | /* Specification: Partially implements 213| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 214| 300| mlk_zeroize(buf, sizeof(buf)); 215| 300|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_cbd2: 276| 650|{ 277| 650| unsigned i; 278| 21.4k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 21.4k|#define MLKEM_N 256 ------------------ | Branch (278:15): [True: 20.8k, False: 650] ------------------ 279| 20.8k| __loop__( 280| 20.8k| invariant(i <= MLKEM_N / 8) 281| 20.8k| invariant(array_abs_bound(r->coeffs, 0, 8 * i, 3)) 282| 20.8k| decreases(MLKEM_N / 8 - i)) 283| 20.8k| { 284| 20.8k| unsigned j; 285| 20.8k| uint32_t t = mlk_load32_littleendian(buf + 4 * i); 286| 20.8k| uint32_t d = t & 0x55555555; 287| 20.8k| d += (t >> 1) & 0x55555555; 288| | 289| 187k| for (j = 0; j < 8; j++) ------------------ | Branch (289:17): [True: 166k, False: 20.8k] ------------------ 290| 166k| __loop__( 291| 166k| invariant(i <= MLKEM_N / 8 && j <= 8) 292| 166k| invariant(array_abs_bound(r->coeffs, 0, 8 * i + j, 3)) 293| 166k| decreases(8 - j)) 294| 166k| { 295| | /* Safety: The & 0x3 masks each value to 2 bits (range [0, 3]), so the 296| | * truncation and subsequent subtraction in int16_t is lossless. */ 297| 166k| const int16_t a = (int16_t)((d >> (4 * j + 0)) & 0x3); 298| 166k| const int16_t b = (int16_t)((d >> (4 * j + 2)) & 0x3); 299| 166k| r->coeffs[8 * i + j] = (int16_t)(a - b); 300| 166k| } 301| 20.8k| } 302| 650|} kem.c:mlk_randombytes: 178| 160|{ 179| 160| OQS_randombytes(ptr, len); 180| 160| return 0; 181| 160|} compress.c:mlk_scalar_compress_d1: 55| 20.4k|{ 56| | /* Compute as follows: 57| | * ``` 58| | * round(u * 2 / MLKEM_Q) 59| | * = round(u * 2 * (2^31 / MLKEM_Q) / 2^31) 60| | * ~= round(u * 2 * round(2^31 / MLKEM_Q) / 2^31) 61| | * ``` 62| | */ 63| | /* check-magic: 1290168 == 2*round(2^31 / MLKEM_Q) */ 64| 20.4k| uint32_t d0 = (uint32_t)u * 1290168; 65| | /* Unsigned shifting by 31 positions leaves only the top bit. */ 66| 20.4k| return (uint8_t)((d0 + ((uint32_t)1u << 30)) >> 31); 67| 20.4k|} indcpa.c:mlk_polymat_permute_bitrev_to_custom: 199| 240|{ 200| 240| unsigned i; 201| 954| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 954|#define MLKEM_K 2 ------------------ | Branch (201:15): [True: 714, False: 240] ------------------ 202| 714| __loop__( 203| 714| assigns(i, memory_slice(a, sizeof(mlk_polymat))) 204| 714| invariant(i <= MLKEM_K) 205| 714| invariant(forall(x, 0, MLKEM_K, forall(y, 0, MLKEM_K, 206| 714| array_bound(a->vec[x].vec[y].coeffs, 0, MLKEM_N, 0, MLKEM_Q)))) 207| 714| decreases(MLKEM_K - i)) 208| 714| { 209| 714| mlk_polyvec_permute_bitrev_to_custom(&a->vec[i]); ------------------ | | 40| 714| MLK_ADD_PARAM_SET(mlk_polyvec_permute_bitrev_to_custom) | | ------------------ | | | | 48| 714|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 210| 714| } 211| 240|} indcpa.c:mlk_keypair_getnoise_eta1: 359| 80|{ 360| 80|#if MLKEM_K == 2 361| 80| mlk_poly_getnoise_eta1_4x(&pv->vec[0], &pv->vec[1], /* Fill elements of pv */ ------------------ | | 467| 80|#define mlk_poly_getnoise_eta1_4x MLK_NAMESPACE_K(poly_getnoise_eta1_4x) | | ------------------ | | | | 64| 80|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 80|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 80|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 362| 80| &e->vec[0], &e->vec[1], /* and two elements of e */ 363| 80| seed, 0, 1, 2, 3); 364| |#elif MLKEM_K == 3 365| | /* 366| | * Only the first three output buffers are needed, so we pass NULL as 367| | * the fourth parameter, and 0xFF as its dummy nonce. 368| | */ 369| | mlk_poly_getnoise_eta1_4x(&pv->vec[0], &pv->vec[1], &pv->vec[2], NULL, seed, 370| | 0, 1, 2, 0xFF); 371| | /* Same here */ 372| | mlk_poly_getnoise_eta1_4x(&e->vec[0], &e->vec[1], &e->vec[2], NULL, seed, 3, 373| | 4, 5, 0xFF); 374| |#elif MLKEM_K == 4 375| | mlk_poly_getnoise_eta1_4x(&pv->vec[0], &pv->vec[1], &pv->vec[2], &pv->vec[3], 376| | seed, 0, 1, 2, 3); 377| | mlk_poly_getnoise_eta1_4x(&e->vec[0], &e->vec[1], &e->vec[2], &e->vec[3], 378| | seed, 4, 5, 6, 7); 379| |#endif /* MLKEM_K == 4 */ 380| 80|} indcpa.c:mlk_matvec_mul: 325| 240|{ 326| 240| unsigned i; 327| 954| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 954|#define MLKEM_K 2 ------------------ | Branch (327:15): [True: 714, False: 240] ------------------ 328| 714| __loop__( 329| 714| assigns(i, memory_slice(out, sizeof(mlk_polyvec))) 330| 714| invariant(i <= MLKEM_K) 331| 714| decreases(MLKEM_K - i)) 332| 714| { 333| 714| mlk_polyvec_basemul_acc_montgomery_cached(&out->vec[i], &a->vec[i], v, vc); ------------------ | | 321| 714| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 714|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 714|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 714|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 334| 714| } 335| 240|} indcpa.c:mlk_pack_sk: 100| 80|{ 101| 80| mlk_assert_bound_2d(sk->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 80| do \ | | 111| 80| { \ | | 112| 80| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 80] | | ------------------ ------------------ 102| 80| mlk_polyvec_tobytes(r, sk); ------------------ | | 225| 80|#define mlk_polyvec_tobytes MLK_NAMESPACE_K(polyvec_tobytes) | | ------------------ | | | | 64| 80|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 80|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 80|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 103| 80|} indcpa.c:mlk_pack_pk: 61| 80|{ 62| 80| mlk_assert_bound_2d(pk->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 80| do \ | | 111| 80| { \ | | 112| 80| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 80] | | ------------------ ------------------ 63| 80| mlk_polyvec_tobytes(r, pk); ------------------ | | 225| 80|#define mlk_polyvec_tobytes MLK_NAMESPACE_K(polyvec_tobytes) | | ------------------ | | | | 64| 80|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 80|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 80|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 64| 80| mlk_memcpy(r + MLKEM_POLYVECBYTES, seed, MLKEM_SYMBYTES); ------------------ | | 168| 80|#define mlk_memcpy memcpy ------------------ mlk_memcpy(r + MLKEM_POLYVECBYTES, seed, MLKEM_SYMBYTES); ------------------ | | 31| 80|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 13| 80|#define MLKEM_K 2 | | ------------------ | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 30| 80|#define MLKEM_POLYBYTES 384 | | ------------------ ------------------ mlk_memcpy(r + MLKEM_POLYVECBYTES, seed, MLKEM_SYMBYTES); ------------------ | | 27| 80|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 65| 80|} indcpa.c:mlk_unpack_pk: 80| 160|{ 81| 160| mlk_polyvec_frombytes(pk, packedpk); ------------------ | | 247| 160|#define mlk_polyvec_frombytes MLK_NAMESPACE_K(polyvec_frombytes) | | ------------------ | | | | 64| 160|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 160|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 160|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 160| mlk_memcpy(seed, packedpk + MLKEM_POLYVECBYTES, MLKEM_SYMBYTES); ------------------ | | 168| 160|#define mlk_memcpy memcpy ------------------ mlk_memcpy(seed, packedpk + MLKEM_POLYVECBYTES, MLKEM_SYMBYTES); ------------------ | | 31| 160|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 13| 160|#define MLKEM_K 2 | | ------------------ | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 30| 160|#define MLKEM_POLYBYTES 384 | | ------------------ ------------------ mlk_memcpy(seed, packedpk + MLKEM_POLYVECBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 160|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 83| | 84| | /* NOTE: If a modulus check was conducted on the PK, we know at this 85| | * point that the coefficients of `pk` are unsigned canonical. The 86| | * specifications and proofs, however, do _not_ assume this, and instead 87| | * work with the easily provable bound by MLKEM_UINT12_LIMIT. */ 88| 160|} indcpa.c:mlk_enc_getnoise_eta1_eta2: 409| 160|{ 410| 160|#if MLKEM_K == 2 411| 160| mlk_poly_getnoise_eta1122_4x(&sp->vec[0], &sp->vec[1], &ep->vec[0], ------------------ | | 547| 160|#define mlk_poly_getnoise_eta1122_4x MLK_NAMESPACE_K(poly_getnoise_eta1122_4x) | | ------------------ | | | | 64| 160|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 160|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 160|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 412| 160| &ep->vec[1], coins, 0, 1, 2, 3); 413| 160| mlk_poly_getnoise_eta2(epp, coins, 4); ------------------ | | 520| 160|#define mlk_poly_getnoise_eta2 MLK_NAMESPACE_K(poly_getnoise_eta2) | | ------------------ | | | | 64| 160|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 160|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 160|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 414| |#elif MLKEM_K == 3 415| | /* 416| | * In this call, only the first three output buffers are needed, 417| | * so we pass NULL as the fourth parameter, and 0xFF as its dummy nonce. 418| | */ 419| | mlk_poly_getnoise_eta1_4x(&sp->vec[0], &sp->vec[1], &sp->vec[2], NULL, coins, 420| | 0, 1, 2, 0xFF /* irrelevant */); 421| | /* The fourth output buffer in this call _is_ used. */ 422| | mlk_poly_getnoise_eta2_4x(&ep->vec[0], &ep->vec[1], &ep->vec[2], epp, coins, 423| | 3, 4, 5, 6); 424| |#elif MLKEM_K == 4 425| | mlk_poly_getnoise_eta1_4x(&sp->vec[0], &sp->vec[1], &sp->vec[2], &sp->vec[3], 426| | coins, 0, 1, 2, 3); 427| | mlk_poly_getnoise_eta2_4x(&ep->vec[0], &ep->vec[1], &ep->vec[2], &ep->vec[3], 428| | coins, 4, 5, 6, 7); 429| | mlk_poly_getnoise_eta2(epp, coins, 8); 430| |#endif /* MLKEM_K == 4 */ 431| 160|} indcpa.c:mlk_pack_ciphertext: 132| 160|{ 133| 160| mlk_polyvec_compress_du(r, b); ------------------ | | 176| 160|#define mlk_polyvec_compress_du MLK_NAMESPACE_K(polyvec_compress_du) | | ------------------ | | | | 64| 160|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 160|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 160|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 134| 160| mlk_poly_compress_dv(r + MLKEM_POLYVECCOMPRESSEDBYTES_DU, v); ------------------ | | 112| 160|#define mlk_poly_compress_dv MLK_NAMESPACE_K(poly_compress_dv) | | ------------------ | | | | 64| 160|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 160|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 160|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_dv(r + MLKEM_POLYVECCOMPRESSEDBYTES_DU, v); ------------------ | | 44| 160|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | ------------------ | | | | 13| 160|#define MLKEM_K 2 | | ------------------ | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | ------------------ | | | | 43| 160|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | ------------------ | | | | | | 35| 160|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | ------------------ | | ------------------ ------------------ 135| 160|} indcpa.c:mlk_unpack_ciphertext: 149| 80|{ 150| 80| mlk_polyvec_decompress_du(b, c); ------------------ | | 200| 80|#define mlk_polyvec_decompress_du MLK_NAMESPACE_K(polyvec_decompress_du) | | ------------------ | | | | 64| 80|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 80|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 80|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 151| 80| mlk_poly_decompress_dv(v, c + MLKEM_POLYVECCOMPRESSEDBYTES_DU); ------------------ | | 143| 80|#define mlk_poly_decompress_dv MLK_NAMESPACE_K(poly_decompress_dv) | | ------------------ | | | | 64| 80|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 80|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 80|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_dv(v, c + MLKEM_POLYVECCOMPRESSEDBYTES_DU); ------------------ | | 44| 80|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | ------------------ | | | | 13| 80|#define MLKEM_K 2 | | ------------------ | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | ------------------ | | | | 43| 80|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | ------------------ | | | | | | 35| 80|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | ------------------ | | ------------------ ------------------ 152| 80|} indcpa.c:mlk_unpack_sk: 115| 80|{ 116| 80| mlk_polyvec_frombytes(sk, packedsk); ------------------ | | 247| 80|#define mlk_polyvec_frombytes MLK_NAMESPACE_K(polyvec_frombytes) | | ------------------ | | | | 64| 80|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 80|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 80|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 117| 80|} kem.c:mlk_check_pct: 194| 80|{ 195| | /* Skip PCT */ 196| 80| ((void)pk); 197| 80| ((void)sk); 198| |#if defined(MLK_CONFIG_CONTEXT_PARAMETER) 199| | ((void)context); 200| |#endif 201| 80| return 0; 202| 80|} poly_k.c:mlk_poly_cbd_eta1: 318| 1.37k|{ 319| |#if MLKEM_ETA1 == 2 320| | mlk_poly_cbd2(r, buf); 321| |#elif MLKEM_ETA1 == 3 322| 1.37k| mlk_poly_cbd3(r, buf); ------------------ | | 37| 1.37k|#define mlk_poly_cbd3 MLK_NAMESPACE(poly_cbd3) | | ------------------ | | | | 63| 1.37k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.37k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.37k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 323| |#else 324| |#error "Invalid value of MLKEM_ETA1" 325| |#endif 326| 1.37k|} poly_k.c:mlk_poly_cbd_eta2: 404| 212|{ 405| 212|#if MLKEM_ETA2 == 2 406| 212| mlk_poly_cbd2(r, buf); ------------------ | | 22| 212|#define mlk_poly_cbd2 MLK_NAMESPACE(poly_cbd2) | | ------------------ | | | | 63| 212|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 212|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 212|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 407| |#else 408| |#error "Invalid value of MLKEM_ETA2" 409| |#endif 410| 212|} sampling.c:mlk_rej_uniform_c: 45| 1.06k|{ 46| 1.06k| unsigned ctr, pos; 47| 1.06k| int16_t val0, val1; 48| | 49| 1.06k| mlk_assert_bound(r, offset, 0, MLKEM_Q); ------------------ | | 101| 1.06k| do \ | | 102| 1.06k| { \ | | 103| 1.06k| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 1.06k] | | ------------------ ------------------ 50| | 51| 1.06k| ctr = offset; 52| 1.06k| pos = 0; 53| | /* pos + 3 cannot overflow due to the assumption buflen <= 4096 */ 54| 2.43k| while (ctr < target && pos + 3 <= buflen) ------------------ | Branch (54:10): [True: 1.37k, False: 1.06k] | Branch (54:26): [True: 1.37k, False: 0] ------------------ 55| 1.37k| __loop__( 56| 1.37k| invariant(offset <= ctr && ctr <= target && pos <= buflen) 57| 1.37k| invariant(array_bound(r, 0, ctr, 0, MLKEM_Q)) 58| 1.37k| decreases(buflen - pos)) 59| 1.37k| { 60| | /* Safety: 61| | * - The explicit cast to uint16_t ensures that << 8 does 62| | * not signed-overflow even on a 16-bit system. 63| | * - The conversion to int16_t is safe due to the explicit 0xFFF 64| | * truncation. 65| | */ 66| 1.37k| val0 = (int16_t)(((buf[pos + 0] >> 0) | ((uint16_t)buf[pos + 1] << 8)) & 67| 1.37k| 0xFFF); 68| 1.37k| val1 = (int16_t)(((buf[pos + 1] >> 4) | (buf[pos + 2] << 4)) & 0xFFF); 69| 1.37k| pos += 3; 70| | 71| 1.37k| if (val0 < MLKEM_Q) ------------------ | | 23| 1.37k|#define MLKEM_Q 3329 ------------------ | Branch (71:9): [True: 1.03k, False: 342] ------------------ 72| 1.03k| { 73| 1.03k| r[ctr++] = val0; 74| 1.03k| } 75| 1.37k| if (ctr < target && val1 < MLKEM_Q) ------------------ | | 23| 1.21k|#define MLKEM_Q 3329 ------------------ | Branch (75:9): [True: 1.21k, False: 162] | Branch (75:25): [True: 930, False: 282] ------------------ 76| 930| { 77| 930| r[ctr++] = val1; 78| 930| } 79| 1.37k| } 80| | 81| 1.06k| mlk_assert_bound(r, ctr, 0, MLKEM_Q); ------------------ | | 101| 1.06k| do \ | | 102| 1.06k| { \ | | 103| 1.06k| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 1.06k] | | ------------------ ------------------ 82| 1.06k| return ctr; 83| 1.06k|} sampling.c:mlk_load32_littleendian: 264| 43.9k|{ 265| 43.9k| uint32_t r; 266| 43.9k| r = (uint32_t)x[0]; 267| 43.9k| r |= (uint32_t)x[1] << 8; 268| 43.9k| r |= (uint32_t)x[2] << 16; 269| 43.9k| r |= (uint32_t)x[3] << 24; 270| 43.9k| return r; 271| 43.9k|} sampling.c:mlk_load24_littleendian: 318| 13.8k|{ 319| 13.8k| uint32_t r; 320| 13.8k| r = (uint32_t)x[0]; 321| 13.8k| r |= (uint32_t)x[1] << 8; 322| 13.8k| r |= (uint32_t)x[2] << 16; 323| 13.8k| return r; 324| 13.8k|} kem.c:mlk_ct_memcmp: 346| 240|{ 347| 240| uint8_t r = 0, s = 0; 348| 240| unsigned i; 349| | 350| 184k| for (i = 0; i < len; i++) ------------------ | Branch (350:15): [True: 184k, False: 240] ------------------ 351| 184k| __loop__( 352| 184k| invariant(i <= len) 353| 184k| invariant((r == 0) == (forall(k, 0, i, (a[k] == b[k])))) 354| 184k| decreases(len - i)) 355| 184k| { 356| 184k| r |= a[i] ^ b[i]; 357| | /* s is useless, but prevents the loop from being aborted once r=0xff. */ 358| 184k| s ^= a[i] ^ b[i]; 359| 184k| } 360| | 361| | /* 362| | * - Convert r into a mask; this may not be necessary, but is an additional 363| | * safeguard 364| | * towards leaking information about a and b. 365| | * - XOR twice with s, separated by a value barrier, to prevent the compile 366| | * from dropping the s computation in the loop. 367| | */ 368| 240| return (mlk_value_barrier_u8(mlk_ct_cmask_nonzero_u8(r) ^ s) ^ s); 369| 240|} kem.c:mlk_value_barrier_u8: 129| 240|{ 130| 240| __asm__ volatile("" : "+r"(b)); 131| 240| return b; 132| 240|} kem.c:mlk_ct_cmask_nonzero_u8: 257| 2.80k|{ 258| 2.80k| uint16_t mask = mlk_ct_cmask_nonzero_u16((uint16_t)x); 259| 2.80k| return (uint8_t)(mask & 0xFF); 260| 2.80k|} kem.c:mlk_ct_cmask_nonzero_u16: 231| 2.80k|{ 232| 2.80k| int32_t tmp = mlk_value_barrier_i32(-((int32_t)x)); 233| | /* 234| | * PORTABILITY: Right-shift on a signed integer is 235| | * implementation-defined for negative left argument. 236| | * Here, we assume it's sign-preserving "arithmetic" shift right. 237| | * See (C99 6.5.7 (5)) 238| | */ 239| 2.80k| tmp >>= 16; 240| 2.80k| return mlk_cast_int32_to_uint16(tmp); 241| 2.80k|} kem.c:mlk_value_barrier_i32: 122| 2.80k|{ 123| 2.80k| __asm__ volatile("" : "+r"(b)); 124| 2.80k| return b; 125| 2.80k|} kem.c:mlk_cast_int32_to_uint16: 173| 2.80k|{ 174| | return (uint16_t)(x & (int32_t)UINT16_MAX); 175| 2.80k|} kem.c:mlk_zeroize: 432| 800|{ 433| 800| mlk_memset(ptr, 0, len); ------------------ | | 173| 800|#define mlk_memset memset ------------------ 434| | /* This follows OpenSSL and seems sufficient to prevent the compiler 435| | * from optimizing away the memset. 436| | * 437| | * If there was a reliable way to detect availability of memset_s(), 438| | * that would be preferred. */ 439| 800| __asm__ volatile("" : : "r"(ptr) : "memory"); 440| 800|} kem.c:mlk_ct_cmov_zero: 396| 80|{ 397| 80| size_t i; 398| 2.64k| for (i = 0; i < len; i++) ------------------ | Branch (398:15): [True: 2.56k, False: 80] ------------------ 399| 2.56k| __loop__( 400| 2.56k| invariant(i <= len) 401| 2.56k| invariant(forall(k, 0, i, r[k] == (b == 0 ? x[k] : loop_entry(r)[k]))) 402| 2.56k| decreases(len - i)) 403| 2.56k| { 404| 2.56k| r[i] = mlk_ct_sel_uint8(r[i], x[i], b); 405| 2.56k| } 406| 80|} kem.c:mlk_ct_sel_uint8: 313| 2.56k|{ 314| 2.56k| return b ^ (mlk_ct_cmask_nonzero_u8(cond) & (a ^ b)); 315| 2.56k|} poly_k.c:mlk_zeroize: 432| 1.00k|{ 433| 1.00k| mlk_memset(ptr, 0, len); ------------------ | | 173| 1.00k|#define mlk_memset memset ------------------ 434| | /* This follows OpenSSL and seems sufficient to prevent the compiler 435| | * from optimizing away the memset. 436| | * 437| | * If there was a reliable way to detect availability of memset_s(), 438| | * that would be preferred. */ 439| 1.00k| __asm__ volatile("" : : "r"(ptr) : "memory"); 440| 1.00k|} sampling.c:mlk_zeroize: 432| 633|{ 433| 633| mlk_memset(ptr, 0, len); ------------------ | | 173| 633|#define mlk_memset memset ------------------ 434| | /* This follows OpenSSL and seems sufficient to prevent the compiler 435| | * from optimizing away the memset. 436| | * 437| | * If there was a reliable way to detect availability of memset_s(), 438| | * that would be preferred. */ 439| 633| __asm__ volatile("" : : "r"(ptr) : "memory"); 440| 633|} compress.c:mlk_value_barrier_u8: 129| 40.9k|{ 130| 40.9k| __asm__ volatile("" : "+r"(b)); 131| 40.9k| return b; 132| 40.9k|} compress.c:mlk_ct_sel_int16: 291| 40.9k|{ 292| 40.9k| uint16_t au = mlk_cast_int16_to_uint16(a); 293| 40.9k| uint16_t bu = mlk_cast_int16_to_uint16(b); 294| 40.9k| uint16_t res = bu ^ (mlk_ct_cmask_nonzero_u16(cond) & (au ^ bu)); 295| 40.9k| return mlk_cast_uint16_to_int16(res); 296| 40.9k|} compress.c:mlk_cast_int16_to_uint16: 185| 81.9k|{ 186| 81.9k| return mlk_cast_int32_to_uint16(x); 187| 81.9k|} compress.c:mlk_cast_int32_to_uint16: 173| 122k|{ 174| | return (uint16_t)(x & (int32_t)UINT16_MAX); 175| 122k|} compress.c:mlk_ct_cmask_nonzero_u16: 231| 40.9k|{ 232| 40.9k| int32_t tmp = mlk_value_barrier_i32(-((int32_t)x)); 233| | /* 234| | * PORTABILITY: Right-shift on a signed integer is 235| | * implementation-defined for negative left argument. 236| | * Here, we assume it's sign-preserving "arithmetic" shift right. 237| | * See (C99 6.5.7 (5)) 238| | */ 239| 40.9k| tmp >>= 16; 240| 40.9k| return mlk_cast_int32_to_uint16(tmp); 241| 40.9k|} compress.c:mlk_value_barrier_i32: 122| 40.9k|{ 123| 40.9k| __asm__ volatile("" : "+r"(b)); 124| 40.9k| return b; 125| 40.9k|} compress.c:mlk_cast_uint16_to_int16: 151| 40.9k|{ 152| | /* 153| | * PORTABILITY: This relies on uint16_t -> int16_t 154| | * being implemented as the inverse of int16_t -> uint16_t, 155| | * which is implementation-defined (C99 6.3.1.3 (3)) 156| | * CBMC (correctly) fails to prove this conversion is OK, 157| | * so we have to suppress that check here 158| | */ 159| 40.9k| return (int16_t)x; 160| 40.9k|} indcpa.c:mlk_zeroize: 432| 2.80k|{ 433| 2.80k| mlk_memset(ptr, 0, len); ------------------ | | 173| 2.80k|#define mlk_memset memset ------------------ 434| | /* This follows OpenSSL and seems sufficient to prevent the compiler 435| | * from optimizing away the memset. 436| | * 437| | * If there was a reliable way to detect availability of memset_s(), 438| | * that would be preferred. */ 439| 2.80k| __asm__ volatile("" : : "r"(ptr) : "memory"); 440| 2.80k|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_compress_d4: 80| 54|{ 81| 54|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D4) 82| 54| int ret; 83| 54| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 54| do \ | | 102| 54| { \ | | 103| 54| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 54] | | ------------------ ------------------ 84| 54| ret = mlk_poly_compress_d4_native(r, a->coeffs); 85| 54| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 54|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (85:7): [True: 54, False: 0] ------------------ 86| 54| { 87| 54| return; 88| 54| } 89| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D4 */ 90| | 91| 0| mlk_poly_compress_d4_c(r, a); 92| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_compress_d10: 147| 108|{ 148| 108|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D10) 149| 108| int ret; 150| 108| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 108| do \ | | 102| 108| { \ | | 103| 108| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 108] | | ------------------ ------------------ 151| 108| ret = mlk_poly_compress_d10_native(r, a->coeffs); 152| 108| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 108|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (152:7): [True: 108, False: 0] ------------------ 153| 108| { 154| 108| return; 155| 108| } 156| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D10 */ 157| | 158| 0| mlk_poly_compress_d10_c(r, a); 159| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_decompress_d4: 195| 27|{ 196| 27|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D4) 197| 27| int ret; 198| 27| ret = mlk_poly_decompress_d4_native(r->coeffs, a); 199| 27| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 27|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (199:7): [True: 27, False: 0] ------------------ 200| 27| { 201| 27| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 27| do \ | | 102| 27| { \ | | 103| 27| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 27] | | ------------------ ------------------ 202| 27| return; 203| 27| } 204| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D4 */ 205| | 206| 0| mlk_poly_decompress_d4_c(r, a); 207| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_decompress_d10: 258| 54|{ 259| 54|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D10) 260| 54| int ret; 261| 54| ret = mlk_poly_decompress_d10_native(r->coeffs, a); 262| 54| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 54|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (262:7): [True: 54, False: 0] ------------------ 263| 54| { 264| 54| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 54| do \ | | 102| 54| { \ | | 103| 54| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 54] | | ------------------ ------------------ 265| 54| return; 266| 54| } 267| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D10 */ 268| | 269| 0| mlk_poly_decompress_d10_c(r, a); 270| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_tobytes: 610| 162|{ 611| 162|#if defined(MLK_USE_NATIVE_POLY_TOBYTES) 612| 162| int ret; 613| 162| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 162| do \ | | 102| 162| { \ | | 103| 162| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 162] | | ------------------ ------------------ 614| 162| ret = mlk_poly_tobytes_native(r, a->coeffs); 615| 162| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 162|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (615:7): [True: 162, False: 0] ------------------ 616| 162| { 617| 162| return; 618| 162| } 619| 0|#endif /* MLK_USE_NATIVE_POLY_TOBYTES */ 620| | 621| 0| mlk_poly_tobytes_c(r, a); 622| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_frombytes: 659| 216|{ 660| 216|#if defined(MLK_USE_NATIVE_POLY_FROMBYTES) 661| 216| int ret; 662| 216| ret = mlk_poly_frombytes_native(r->coeffs, a); 663| 216| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 216|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (663:7): [True: 216, False: 0] ------------------ 664| 216| { 665| 216| return; 666| 216| } 667| 0|#endif /* MLK_USE_NATIVE_POLY_FROMBYTES */ 668| | 669| 0| mlk_poly_frombytes_c(r, a); 670| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_frommsg: 680| 54|{ 681| 54| unsigned i; 682| |#if (MLKEM_INDCPA_MSGBYTES != MLKEM_N / 8) 683| |#error "MLKEM_INDCPA_MSGBYTES must be equal to MLKEM_N/8 bytes!" 684| |#endif 685| | 686| 1.78k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 1.78k|#define MLKEM_N 256 ------------------ | Branch (686:15): [True: 1.72k, False: 54] ------------------ 687| 1.72k| __loop__( 688| 1.72k| invariant(i <= MLKEM_N / 8) 689| 1.72k| invariant(array_bound(r->coeffs, 0, 8 * i, 0, MLKEM_Q)) 690| 1.72k| decreases(MLKEM_N / 8 - i)) 691| 1.72k| { 692| 1.72k| unsigned j; 693| 15.5k| for (j = 0; j < 8; j++) ------------------ | Branch (693:17): [True: 13.8k, False: 1.72k] ------------------ 694| 13.8k| __loop__( 695| 13.8k| invariant(i < MLKEM_N / 8 && j <= 8) 696| 13.8k| invariant(array_bound(r->coeffs, 0, 8 * i + j, 0, MLKEM_Q)) 697| 13.8k| decreases(8 - j)) 698| 13.8k| { 699| | /* mlk_ct_sel_int16(MLKEM_Q_HALF, 0, b) is `Decompress_1(b != 0)` 700| | * as per @[FIPS203, Eq (4.8)]. */ 701| | 702| | /* Prevent the compiler from recognizing this as a bit selection */ 703| 13.8k| uint8_t mask = mlk_value_barrier_u8((uint8_t)(1u << j)); 704| 13.8k| r->coeffs[8 * i + j] = mlk_ct_sel_int16(MLKEM_Q_HALF, 0, msg[i] & mask); ------------------ | | 24| 13.8k|#define MLKEM_Q_HALF ((MLKEM_Q + 1) / 2) /* 1665 */ | | ------------------ | | | | 23| 13.8k|#define MLKEM_Q 3329 | | ------------------ ------------------ 705| 13.8k| } 706| 1.72k| } 707| 54| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 54| do \ | | 106| 54| { \ | | 107| 54| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 54] | | ------------------ ------------------ 708| 54|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_tomsg: 718| 27|{ 719| 27| unsigned i; 720| 27| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 27| do \ | | 102| 27| { \ | | 103| 27| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 27] | | ------------------ ------------------ 721| | 722| 891| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 891|#define MLKEM_N 256 ------------------ | Branch (722:15): [True: 864, False: 27] ------------------ 723| 864| __loop__(invariant(i <= MLKEM_N / 8) 724| 864| decreases(MLKEM_N / 8 - i)) 725| 864| { 726| 864| unsigned j; 727| 864| msg[i] = 0; 728| 7.77k| for (j = 0; j < 8; j++) ------------------ | Branch (728:17): [True: 6.91k, False: 864] ------------------ 729| 6.91k| __loop__( 730| 6.91k| invariant(i <= MLKEM_N / 8 && j <= 8) 731| 6.91k| decreases(8 - j)) 732| 6.91k| { 733| 6.91k| uint32_t t = mlk_scalar_compress_d1(r->coeffs[8 * i + j]); 734| 6.91k| msg[i] |= (uint8_t)(t << j); 735| 6.91k| } 736| 864| } 737| 27|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_gen_matrix: 223| 81|{ 224| 81| unsigned i, j; 225| 81| MLK_ALIGN uint8_t seed_ext[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 2)]; ------------------ | | 190| 81|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 226| | 227| 405| for (j = 0; j < 4; j++) ------------------ | Branch (227:15): [True: 324, False: 81] ------------------ 228| 324| { 229| 324| mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 168| 324|#define mlk_memcpy memcpy ------------------ mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 27| 324|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 230| 324| } 231| | 232| 81|#if !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 233| | /* Sample 4 matrix entries a time. */ 234| 162| for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 13| 162|#define MLKEM_K 2 ------------------ for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 13| 162|#define MLKEM_K 2 ------------------ | Branch (234:15): [True: 81, False: 81] ------------------ 235| 81| { 236| 405| for (j = 0; j < 4; j++) ------------------ | Branch (236:17): [True: 324, False: 81] ------------------ 237| 324| { 238| 324| uint8_t x, y; 239| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 240| 324| x = (uint8_t)((i + j) / MLKEM_K); ------------------ | | 13| 324|#define MLKEM_K 2 ------------------ 241| 324| y = (uint8_t)((i + j) % MLKEM_K); ------------------ | | 13| 324|#define MLKEM_K 2 ------------------ 242| 324| if (transposed) ------------------ | Branch (242:11): [True: 216, False: 108] ------------------ 243| 216| { 244| 216| seed_ext[j][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 216|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 245| 216| seed_ext[j][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 216|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 246| 216| } 247| 108| else 248| 108| { 249| 108| seed_ext[j][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 108|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 250| 108| seed_ext[j][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 108|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 251| 108| } 252| 324| } 253| | 254| 81| mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 55| 81|#define mlk_poly_rej_uniform_x4 MLK_NAMESPACE(poly_rej_uniform_x4) | | ------------------ | | | | 63| 81|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 81|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 81|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 13| 81|#define MLKEM_K 2 ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 13| 81|#define MLKEM_K 2 ------------------ 255| 81| &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 13| 81|#define MLKEM_K 2 ------------------ &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 13| 81|#define MLKEM_K 2 ------------------ 256| 81| &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 13| 81|#define MLKEM_K 2 ------------------ &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 13| 81|#define MLKEM_K 2 ------------------ 257| 81| &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 13| 81|#define MLKEM_K 2 ------------------ &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 13| 81|#define MLKEM_K 2 ------------------ 258| 81| seed_ext); 259| 81| } 260| |#else /* !MLK_CONFIG_SERIAL_FIPS202_ONLY */ 261| | /* When using serial FIPS202, sample all entries individually. */ 262| | i = 0; 263| |#endif /* MLK_CONFIG_SERIAL_FIPS202_ONLY */ 264| | 265| | /* For MLKEM_K == 3, sample the last entry individually. 266| | * When MLK_CONFIG_SERIAL_FIPS202_ONLY is set, sample all entries 267| | * individually. */ 268| 81| for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 13| 81|#define MLKEM_K 2 ------------------ for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 13| 81|#define MLKEM_K 2 ------------------ | Branch (268:10): [True: 0, False: 81] ------------------ 269| 0| { 270| 0| uint8_t x, y; 271| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 272| 0| x = (uint8_t)(i / MLKEM_K); ------------------ | | 13| 0|#define MLKEM_K 2 ------------------ 273| 0| y = (uint8_t)(i % MLKEM_K); ------------------ | | 13| 0|#define MLKEM_K 2 ------------------ 274| | 275| 0| if (transposed) ------------------ | Branch (275:9): [True: 0, False: 0] ------------------ 276| 0| { 277| 0| seed_ext[0][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 278| 0| seed_ext[0][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 279| 0| } 280| 0| else 281| 0| { 282| 0| seed_ext[0][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 283| 0| seed_ext[0][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 284| 0| } 285| | 286| 0| mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 89| 0|#define mlk_poly_rej_uniform MLK_NAMESPACE(poly_rej_uniform) | | ------------------ | | | | 63| 0|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 0|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 0|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 13| 0|#define MLKEM_K 2 ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 13| 0|#define MLKEM_K 2 ------------------ 287| 0| } 288| | 289| 81| mlk_assert(i == MLKEM_K * MLKEM_K); ------------------ | | 97| 81| do \ | | 98| 81| { \ | | 99| 81| } while (0) | | ------------------ | | | Branch (99:12): [Folded, False: 81] | | ------------------ ------------------ 290| | 291| | /* 292| | * The public matrix is generated in NTT domain. If the native backend 293| | * uses a custom order in NTT domain, permute A accordingly. 294| | */ 295| 81| mlk_polymat_permute_bitrev_to_custom(a); ------------------ | | 42| 81| MLK_ADD_PARAM_SET(mlk_polymat_permute_bitrev_to_custom) | | ------------------ | | | | 48| 81|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 296| | 297| | /* Specification: Partially implements 298| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 299| 81| mlk_zeroize(seed_ext, sizeof(seed_ext)); 300| 81|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_indcpa_keypair_derand: 445| 27|{ 446| 27| int ret = 0; 447| 27| const uint8_t *publicseed; 448| 27| const uint8_t *noiseseed; 449| 27| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 450| 27| MLK_ALLOC(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 451| 27| MLK_ALLOC(a, mlk_polymat, 1, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 452| 27| MLK_ALLOC(e, mlk_polyvec, 1, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 453| 27| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 454| 27| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 455| 27| MLK_ALLOC(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 456| | 457| 27| if (buf == NULL || coins_with_domain_separator == NULL || a == NULL || ------------------ | Branch (457:7): [True: 0, False: 27] | Branch (457:22): [True: 0, False: 27] | Branch (457:61): [True: 0, False: 27] ------------------ 458| 27| e == NULL || pkpv == NULL || skpv == NULL || skpv_cache == NULL) ------------------ | Branch (458:7): [True: 0, False: 27] | Branch (458:20): [True: 0, False: 27] | Branch (458:36): [True: 0, False: 27] | Branch (458:52): [True: 0, False: 27] ------------------ 459| 0| { 460| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 461| 0| goto cleanup; 462| 0| } 463| | 464| 27| publicseed = buf; 465| 27| noiseseed = buf + MLKEM_SYMBYTES; ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 466| | 467| | /* Concatenate coins with MLKEM_K for domain separation of security levels */ 468| 27| mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 168| 27|#define mlk_memcpy memcpy ------------------ mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 469| 27| coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 13| 27|#define MLKEM_K 2 ------------------ 470| | 471| 27| mlk_hash_g(buf, coins_with_domain_separator, MLKEM_SYMBYTES + 1); ------------------ | | 32| 27|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 27|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 27|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 472| | 473| | /* 474| | * Declassify the public seed. 475| | * Required to use it in conditional-branches in rejection sampling. 476| | * This is needed because all output of randombytes is marked as secret 477| | * (=undefined) 478| | */ 479| 27| MLK_CT_TESTING_DECLASSIFY(publicseed, MLKEM_SYMBYTES); ------------------ | | 235| 27| do \ | | 236| 27| { \ | | 237| 27| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 27] | | ------------------ ------------------ 480| | 481| 27| mlk_gen_matrix(a, publicseed, 0 /* no transpose */); ------------------ | | 22| 27|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 482| | 483| 27| mlk_keypair_getnoise_eta1(skpv, e, noiseseed); ------------------ | | 43| 27|#define mlk_keypair_getnoise_eta1 MLK_ADD_PARAM_SET(mlk_keypair_getnoise_eta1) | | ------------------ | | | | 48| 27|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 484| | 485| 27| mlk_polyvec_ntt(skpv); ------------------ | | 269| 27|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 486| 27| mlk_polyvec_ntt(e); ------------------ | | 269| 27|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 487| | 488| 27| mlk_polyvec_mulcache_compute(skpv_cache, skpv); ------------------ | | 353| 27|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 489| 27| mlk_matvec_mul(pkpv, a, skpv, skpv_cache); ------------------ | | 38| 27|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 27|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 490| 27| mlk_polyvec_tomont(pkpv); ------------------ | | 445| 27|#define mlk_polyvec_tomont MLK_NAMESPACE_K(polyvec_tomont) | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 491| | 492| 27| mlk_polyvec_add(pkpv, e); ------------------ | | 414| 27|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 493| 27| mlk_polyvec_reduce(pkpv); ------------------ | | 387| 27|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 494| 27| mlk_polyvec_reduce(skpv); ------------------ | | 387| 27|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 495| | 496| 27| mlk_pack_sk(sk, skpv); ------------------ | | 34| 27|#define mlk_pack_sk MLK_ADD_PARAM_SET(mlk_pack_sk) | | ------------------ | | | | 48| 27|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 497| 27| mlk_pack_pk(pk, pkpv, publicseed); ------------------ | | 32| 27|#define mlk_pack_pk MLK_ADD_PARAM_SET(mlk_pack_pk) | | ------------------ | | | | 48| 27|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 498| | 499| 27|cleanup: 500| | /* Specification: Partially implements 501| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 502| 27| MLK_FREE(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 503| 27| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 504| 27| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 505| 27| MLK_FREE(e, mlk_polyvec, 1, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 506| 27| MLK_FREE(a, mlk_polymat, 1, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 507| 27| MLK_FREE(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 508| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 509| 27| return ret; 510| 27|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_indcpa_enc: 526| 54|{ 527| 54| int ret = 0; 528| 54| MLK_ALLOC(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 54| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 54|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 54| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 529| 54| MLK_ALLOC(at, mlk_polymat, 1, context); ------------------ | | 229| 54| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 54|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 54| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 530| 54| MLK_ALLOC(sp, mlk_polyvec, 1, context); ------------------ | | 229| 54| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 54|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 54| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 531| 54| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 54| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 54|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 54| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 532| 54| MLK_ALLOC(ep, mlk_polyvec, 1, context); ------------------ | | 229| 54| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 54|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 54| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 533| 54| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 54| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 54|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 54| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 534| 54| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 54| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 54|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 54| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 535| 54| MLK_ALLOC(k, mlk_poly, 1, context); ------------------ | | 229| 54| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 54|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 54| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 536| 54| MLK_ALLOC(epp, mlk_poly, 1, context); ------------------ | | 229| 54| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 54|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 54| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 537| 54| MLK_ALLOC(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 54| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 54|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 54| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 538| | 539| 54| if (seed == NULL || at == NULL || sp == NULL || pkpv == NULL || ep == NULL || ------------------ | Branch (539:7): [True: 0, False: 54] | Branch (539:23): [True: 0, False: 54] | Branch (539:37): [True: 0, False: 54] | Branch (539:51): [True: 0, False: 54] | Branch (539:67): [True: 0, False: 54] ------------------ 540| 54| b == NULL || v == NULL || k == NULL || epp == NULL || sp_cache == NULL) ------------------ | Branch (540:7): [True: 0, False: 54] | Branch (540:20): [True: 0, False: 54] | Branch (540:33): [True: 0, False: 54] | Branch (540:46): [True: 0, False: 54] | Branch (540:61): [True: 0, False: 54] ------------------ 541| 0| { 542| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 543| 0| goto cleanup; 544| 0| } 545| | 546| 54| mlk_unpack_pk(pkpv, seed, pk); ------------------ | | 33| 54|#define mlk_unpack_pk MLK_ADD_PARAM_SET(mlk_unpack_pk) | | ------------------ | | | | 48| 54|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 547| 54| mlk_poly_frommsg(k, m); ------------------ | | 555| 54|#define mlk_poly_frommsg MLK_NAMESPACE(poly_frommsg) | | ------------------ | | | | 63| 54|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 54|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 54|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 548| | 549| | /* 550| | * Declassify the public seed. 551| | * Required to use it in conditional-branches in rejection sampling. 552| | * This is needed because in re-encryption the publicseed originated from sk 553| | * which is marked undefined. 554| | */ 555| 54| MLK_CT_TESTING_DECLASSIFY(seed, MLKEM_SYMBYTES); ------------------ | | 235| 54| do \ | | 236| 54| { \ | | 237| 54| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 54] | | ------------------ ------------------ 556| | 557| 54| mlk_gen_matrix(at, seed, 1 /* transpose */); ------------------ | | 22| 54|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 54|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 54|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 54|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 558| | 559| 54| mlk_enc_getnoise_eta1_eta2(sp, ep, epp, coins); ------------------ | | 44| 54|#define mlk_enc_getnoise_eta1_eta2 MLK_ADD_PARAM_SET(mlk_enc_getnoise_eta1_eta2) | | ------------------ | | | | 48| 54|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 560| | 561| 54| mlk_polyvec_ntt(sp); ------------------ | | 269| 54|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 54|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 54|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 54|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 562| | 563| 54| mlk_polyvec_mulcache_compute(sp_cache, sp); ------------------ | | 353| 54|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 54|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 54|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 54|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 564| 54| mlk_matvec_mul(b, at, sp, sp_cache); ------------------ | | 38| 54|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 54|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 565| 54| mlk_polyvec_basemul_acc_montgomery_cached(v, pkpv, sp, sp_cache); ------------------ | | 321| 54| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 54|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 54|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 54|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 566| | 567| 54| mlk_polyvec_invntt_tomont(b); ------------------ | | 295| 54|#define mlk_polyvec_invntt_tomont MLK_NAMESPACE_K(polyvec_invntt_tomont) | | ------------------ | | | | 64| 54|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 54|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 54|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 568| 54| mlk_poly_invntt_tomont(v); ------------------ | | 263| 54|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 54|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 54|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 54|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 569| | 570| 54| mlk_polyvec_add(b, ep); ------------------ | | 414| 54|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 54|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 54|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 54|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 571| 54| mlk_poly_add(v, epp); ------------------ | | 181| 54|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 54|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 54|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 54|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 572| 54| mlk_poly_add(v, k); ------------------ | | 181| 54|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 54|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 54|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 54|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 573| | 574| 54| mlk_polyvec_reduce(b); ------------------ | | 387| 54|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 54|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 54|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 54|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 575| 54| mlk_poly_reduce(v); ------------------ | | 154| 54|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 54|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 54|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 54|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 576| | 577| 54| mlk_pack_ciphertext(c, b, v); ------------------ | | 36| 54|#define mlk_pack_ciphertext MLK_ADD_PARAM_SET(mlk_pack_ciphertext) | | ------------------ | | | | 48| 54|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 578| | 579| 54|cleanup: 580| | /* Specification: Partially implements 581| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 582| 54| MLK_FREE(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 54| do \ | | 239| 54| { \ | | 240| 54| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 54| (v) = NULL; \ | | 242| 54| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 54] | | ------------------ ------------------ 583| 54| MLK_FREE(epp, mlk_poly, 1, context); ------------------ | | 238| 54| do \ | | 239| 54| { \ | | 240| 54| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 54| (v) = NULL; \ | | 242| 54| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 54] | | ------------------ ------------------ 584| 54| MLK_FREE(k, mlk_poly, 1, context); ------------------ | | 238| 54| do \ | | 239| 54| { \ | | 240| 54| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 54| (v) = NULL; \ | | 242| 54| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 54] | | ------------------ ------------------ 585| 54| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 54| do \ | | 239| 54| { \ | | 240| 54| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 54| (v) = NULL; \ | | 242| 54| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 54] | | ------------------ ------------------ 586| 54| MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 54| do \ | | 239| 54| { \ | | 240| 54| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 54| (v) = NULL; \ | | 242| 54| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 54] | | ------------------ ------------------ 587| 54| MLK_FREE(ep, mlk_polyvec, 1, context); ------------------ | | 238| 54| do \ | | 239| 54| { \ | | 240| 54| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 54| (v) = NULL; \ | | 242| 54| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 54] | | ------------------ ------------------ 588| 54| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 54| do \ | | 239| 54| { \ | | 240| 54| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 54| (v) = NULL; \ | | 242| 54| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 54] | | ------------------ ------------------ 589| 54| MLK_FREE(sp, mlk_polyvec, 1, context); ------------------ | | 238| 54| do \ | | 239| 54| { \ | | 240| 54| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 54| (v) = NULL; \ | | 242| 54| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 54] | | ------------------ ------------------ 590| 54| MLK_FREE(at, mlk_polymat, 1, context); ------------------ | | 238| 54| do \ | | 239| 54| { \ | | 240| 54| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 54| (v) = NULL; \ | | 242| 54| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 54] | | ------------------ ------------------ 591| | MLK_FREE(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 54| do \ | | 239| 54| { \ | | 240| 54| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 54| (v) = NULL; \ | | 242| 54| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 54] | | ------------------ ------------------ 592| 54| return ret; 593| 54|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_indcpa_dec: 603| 27|{ 604| 27| int ret = 0; 605| 27| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 606| 27| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 607| 27| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 608| 27| MLK_ALLOC(sb, mlk_poly, 1, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 609| 27| MLK_ALLOC(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 610| | 611| 27| if (b == NULL || skpv == NULL || v == NULL || sb == NULL || b_cache == NULL) ------------------ | Branch (611:7): [True: 0, False: 27] | Branch (611:20): [True: 0, False: 27] | Branch (611:36): [True: 0, False: 27] | Branch (611:49): [True: 0, False: 27] | Branch (611:63): [True: 0, False: 27] ------------------ 612| 0| { 613| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 614| 0| goto cleanup; 615| 0| } 616| | 617| 27| mlk_unpack_ciphertext(b, v, c); ------------------ | | 37| 27|#define mlk_unpack_ciphertext MLK_ADD_PARAM_SET(mlk_unpack_ciphertext) | | ------------------ | | | | 48| 27|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 618| 27| mlk_unpack_sk(skpv, sk); ------------------ | | 35| 27|#define mlk_unpack_sk MLK_ADD_PARAM_SET(mlk_unpack_sk) | | ------------------ | | | | 48| 27|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 619| | 620| 27| mlk_polyvec_ntt(b); ------------------ | | 269| 27|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 621| 27| mlk_polyvec_mulcache_compute(b_cache, b); ------------------ | | 353| 27|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 622| 27| mlk_polyvec_basemul_acc_montgomery_cached(sb, skpv, b, b_cache); ------------------ | | 321| 27| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 623| 27| mlk_poly_invntt_tomont(sb); ------------------ | | 263| 27|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 27|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 624| | 625| 27| mlk_poly_sub(v, sb); ------------------ | | 210| 27|#define mlk_poly_sub MLK_NAMESPACE(poly_sub) | | ------------------ | | | | 63| 27|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 626| 27| mlk_poly_reduce(v); ------------------ | | 154| 27|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 27|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 627| | 628| 27| mlk_poly_tomsg(m, v); ------------------ | | 577| 27|#define mlk_poly_tomsg MLK_NAMESPACE(poly_tomsg) | | ------------------ | | | | 63| 27|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 629| | 630| 27|cleanup: 631| | /* Specification: Partially implements 632| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 633| 27| MLK_FREE(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 634| 27| MLK_FREE(sb, mlk_poly, 1, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 635| 27| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 636| 27| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 637| | MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 638| 27| return ret; 639| 27|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_check_pk: 45| 27|{ 46| 27| int ret = 0; 47| 27| MLK_ALLOC(p, mlk_polyvec, 1, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 48| 27| MLK_ALLOC(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 49| | 50| 27| if (p == NULL || p_reencoded == NULL) ------------------ | Branch (50:7): [True: 0, False: 27] | Branch (50:20): [True: 0, False: 27] ------------------ 51| 0| { 52| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 53| 0| goto cleanup; 54| 0| } 55| | 56| 27| mlk_polyvec_frombytes(p, pk); ------------------ | | 247| 27|#define mlk_polyvec_frombytes MLK_NAMESPACE_K(polyvec_frombytes) | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 57| 27| mlk_polyvec_reduce(p); ------------------ | | 387| 27|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| 27| mlk_polyvec_tobytes(p_reencoded, p); ------------------ | | 225| 27|#define mlk_polyvec_tobytes MLK_NAMESPACE_K(polyvec_tobytes) | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| | /* We use a constant-time memcmp here to avoid having to 61| | * declassify the PK before the PCT has succeeded. */ 62| 27| ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 31| 27|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 13| 27|#define MLKEM_K 2 | | ------------------ | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 30| 27|#define MLKEM_POLYBYTES 384 | | ------------------ ------------------ ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ | Branch (62:9): [True: 0, False: 27] ------------------ 63| | 64| 27|cleanup: 65| | /* Specification: Partially implements 66| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 67| 27| MLK_FREE(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 68| | MLK_FREE(p, mlk_polyvec, 1, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 69| 27| return ret; 70| 27|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_check_sk: 78| 27|{ 79| 27| int ret = 0; 80| 27| MLK_ALLOC(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 81| | 82| 27| if (test == NULL) ------------------ | Branch (82:7): [True: 0, False: 27] ------------------ 83| 0| { 84| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 85| 0| goto cleanup; 86| 0| } 87| | 88| | /* 89| | * The parts of `sk` being hashed and compared here are public, so 90| | * no public information is leaked through the runtime or the return value 91| | * of this function. 92| | */ 93| | 94| | /* Declassify the public part of the secret key */ 95| 27| MLK_CT_TESTING_DECLASSIFY(sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 235| 27| do \ | | 236| 27| { \ | | 237| 27| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 27] | | ------------------ ------------------ 96| 27| MLKEM_INDCCA_PUBLICKEYBYTES); 97| 27| MLK_CT_TESTING_DECLASSIFY( ------------------ | | 235| 27| do \ | | 236| 27| { \ | | 237| 27| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 27] | | ------------------ ------------------ 98| 27| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, MLKEM_SYMBYTES); 99| | 100| 27| mlk_hash_h(test, sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 29| 27|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 27|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 27|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 101| 27| MLKEM_INDCCA_PUBLICKEYBYTES); 102| | /* This doesn't have to be a constant-time memcmp, but it's the only place 103| | * in the library where a normal memcmp would be used otherwise, so for sake 104| | * of minimizing stdlib dependency, we use our constant-time one anyway. */ 105| 27| ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 27| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 27|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 27|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 27|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 27|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 27|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 27|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 27|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 27|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 27| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (105:9): [True: 0, False: 27] ------------------ 106| 27| test, MLKEM_SYMBYTES) ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 107| 27| ? MLK_ERR_FAIL ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ 108| 27| : 0; 109| | 110| 27|cleanup: 111| | /* Specification: Partially implements 112| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 113| | MLK_FREE(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 114| 27| return ret; 115| 27|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_keypair_derand: 214| 27|{ 215| 27| int ret; 216| | 217| 27| ret = mlk_indcpa_keypair_derand(pk, sk, coins, context); ------------------ | | 49| 27| MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 27|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 218| 27| if (ret != 0) ------------------ | Branch (218:7): [True: 0, False: 27] ------------------ 219| 0| { 220| 0| goto cleanup; 221| 0| } 222| | 223| 27| mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 168| 27|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 65| 27|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 27|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 13| 27|#define MLKEM_K 2 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 27|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 27|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 27|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 27|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 27|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 27|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 224| 27| mlk_hash_h(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, pk, ------------------ | | 29| 27|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 27|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 27|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 225| 27| MLKEM_INDCCA_PUBLICKEYBYTES); 226| | /* Value z for pseudo-random output on reject */ 227| 27| mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 27|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 27| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 27|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 27|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 27|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 27|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 27|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 27|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 27|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 27|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 27| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 228| 27| coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 229| | 230| | /* Declassify public key */ 231| 27| MLK_CT_TESTING_DECLASSIFY(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 235| 27| do \ | | 236| 27| { \ | | 237| 27| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 27] | | ------------------ ------------------ 232| | 233| | /* Pairwise Consistency Test (PCT) @[FIPS140_3_IG, p.87] */ 234| 27| ret = mlk_check_pct(pk, sk, context); ------------------ | | 37| 27|#define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 48| 27|#define MLK_ADD_PARAM_SET(s) s | | ------------------ | | #define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 211| 27|#define MLK_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1) | | ------------------ ------------------ 235| 27| if (ret != 0) ------------------ | Branch (235:7): [True: 0, False: 27] ------------------ 236| 0| { 237| 0| goto cleanup; 238| 0| } 239| | 240| 27|cleanup: 241| 27| if (ret != 0) ------------------ | Branch (241:7): [True: 0, False: 27] ------------------ 242| 0| { 243| 0| mlk_zeroize(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 0|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 0|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 244| 0| mlk_zeroize(sk, MLKEM_INDCCA_SECRETKEYBYTES); ------------------ | | 72| 0| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 0|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 0|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 0|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 0| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 245| 0| } 246| | 247| 27| return ret; 248| 27|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_keypair: 257| 27|{ 258| 27| int ret = 0; 259| 27| MLK_ALLOC(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 260| | 261| 27| if (coins == NULL) ------------------ | Branch (261:7): [True: 0, False: 27] ------------------ 262| 0| { 263| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 264| 0| goto cleanup; 265| 0| } 266| | 267| | /* Acquire necessary randomness, and mark it as secret. */ 268| 27| if (mlk_randombytes(coins, 2 * MLKEM_SYMBYTES) != 0) ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (268:7): [True: 0, False: 27] ------------------ 269| 0| { 270| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 271| 0| goto cleanup; 272| 0| } 273| | 274| 27| MLK_CT_TESTING_SECRET(coins, 2 * MLKEM_SYMBYTES); ------------------ | | 231| 27| do \ | | 232| 27| { \ | | 233| 27| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 27] | | ------------------ ------------------ 275| | 276| 27| ret = mlk_kem_keypair_derand(pk, sk, coins, context); ------------------ | | 50| 27| MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 27|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 277| | 278| 27|cleanup: 279| | /* Specification: Partially implements 280| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 281| | MLK_FREE(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 282| 27| return ret; 283| 27|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_enc_derand: 295| 27|{ 296| 27| int ret = 0; 297| 27| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 298| 27| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 299| | 300| 27| if (buf == NULL || kr == NULL) ------------------ | Branch (300:7): [True: 0, False: 27] | Branch (300:22): [True: 0, False: 27] ------------------ 301| 0| { 302| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 303| 0| goto cleanup; 304| 0| } 305| | 306| | /* Specification: Implements @[FIPS203, Section 7.2, Modulus check] */ 307| 27| ret = mlk_kem_check_pk(pk, context); ------------------ | | 55| 27|#define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 27|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 308| 27| if (ret != 0) ------------------ | Branch (308:7): [True: 0, False: 27] ------------------ 309| 0| { 310| 0| goto cleanup; 311| 0| } 312| | 313| 27| mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 168| 27|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 314| | 315| | /* Multitarget countermeasure for coins + contributory KEM */ 316| 27| mlk_hash_h(buf + MLKEM_SYMBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 29| 27|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 27|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 27|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 317| 27| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 27|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 27|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 27|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 318| | 319| | /* coins are in kr+MLKEM_SYMBYTES */ 320| 27| ret = mlk_indcpa_enc(ct, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 27|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 27| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 321| 27| if (ret != 0) ------------------ | Branch (321:7): [True: 0, False: 27] ------------------ 322| 0| { 323| 0| goto cleanup; 324| 0| } 325| | 326| 27| mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 168| 27|#define mlk_memcpy memcpy ------------------ mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 327| | 328| 27|cleanup: 329| | /* Specification: Partially implements 330| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 331| 27| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 332| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 333| 27| return ret; 334| 27|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_enc: 344| 27|{ 345| 27| int ret = 0; 346| 27| MLK_ALLOC(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 347| | 348| 27| if (coins == NULL) ------------------ | Branch (348:7): [True: 0, False: 27] ------------------ 349| 0| { 350| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 351| 0| goto cleanup; 352| 0| } 353| | 354| 27| if (mlk_randombytes(coins, MLKEM_SYMBYTES) != 0) ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (354:7): [True: 0, False: 27] ------------------ 355| 0| { 356| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 357| 0| goto cleanup; 358| 0| } 359| | 360| 27| MLK_CT_TESTING_SECRET(coins, MLKEM_SYMBYTES); ------------------ | | 231| 27| do \ | | 232| 27| { \ | | 233| 27| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 27] | | ------------------ ------------------ 361| | 362| 27| ret = mlk_kem_enc_derand(ct, ss, pk, coins, context); ------------------ | | 52| 27|#define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 27| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 363| | 364| 27|cleanup: 365| | /* Specification: Partially implements 366| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 367| | MLK_FREE(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 368| 27| return ret; 369| 27|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_dec: 380| 27|{ 381| 27| int ret = 0; 382| 27| uint8_t fail; 383| 27| const uint8_t *pk = sk + MLKEM_INDCPA_SECRETKEYBYTES; ------------------ | | 65| 27|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 27|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 13| 27|#define MLKEM_K 2 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 27|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ 384| 27| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 385| 27| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 386| 27| MLK_ALLOC(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 229| 27| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 27| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 387| 27| context); 388| | 389| 27| if (buf == NULL || kr == NULL || tmp == NULL) ------------------ | Branch (389:7): [True: 0, False: 27] | Branch (389:22): [True: 0, False: 27] | Branch (389:36): [True: 0, False: 27] ------------------ 390| 0| { 391| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 392| 0| goto cleanup; 393| 0| } 394| | 395| | /* Specification: Implements @[FIPS203, Section 7.3, Hash check] */ 396| 27| ret = mlk_kem_check_sk(sk, context); ------------------ | | 56| 27|#define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 27|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 397| 27| if (ret != 0) ------------------ | Branch (397:7): [True: 0, False: 27] ------------------ 398| 0| { 399| 0| goto cleanup; 400| 0| } 401| | 402| 27| ret = mlk_indcpa_dec(buf, ct, sk, context); ------------------ | | 127| 27|#define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 27|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 403| 27| if (ret != 0) ------------------ | Branch (403:7): [True: 0, False: 27] ------------------ 404| 0| { 405| 0| goto cleanup; 406| 0| } 407| | 408| | /* Multitarget countermeasure for coins + contributory KEM */ 409| 27| mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 168| 27|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 410| 27| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 27| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 27|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 27|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 27|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 27|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 27|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 27|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 27|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 27|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 27| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 411| 27| MLKEM_SYMBYTES); ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 412| 27| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 27|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 27|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 27|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 413| | 414| | /* Recompute and compare ciphertext */ 415| | /* coins are in kr+MLKEM_SYMBYTES */ 416| 27| ret = mlk_indcpa_enc(tmp, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 27|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 27|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 27| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 417| 27| if (ret != 0) ------------------ | Branch (417:7): [True: 0, False: 27] ------------------ 418| 0| { 419| 0| goto cleanup; 420| 0| } 421| | 422| 27| fail = mlk_ct_memcmp(ct, tmp, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 27|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 27| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 44| 27|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 13| 27|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 43| 27|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | | | | | ------------------ | | | | | | | | | | 35| 27|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 42| 27|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D4 | | | | | | ------------------ | | | | | | | | 33| 27|#define MLKEM_POLYCOMPRESSEDBYTES_D4 128 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 423| | 424| | /* Compute rejection key */ 425| 27| mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 27|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 27| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 27|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 27|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 27|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 27|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 27|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 27|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 27|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 27|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 27| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 426| 27| MLKEM_SYMBYTES); ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 427| 27| mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 168| 27|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 27|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 27| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 44| 27|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 13| 27|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 43| 27|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | | | | | ------------------ | | | | | | | | | | 35| 27|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 42| 27|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D4 | | | | | | ------------------ | | | | | | | | 33| 27|#define MLKEM_POLYCOMPRESSEDBYTES_D4 128 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 428| 27| mlk_hash_j(ss, tmp, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 36| 27| mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 18| 27|#define mlk_shake256 shake256 | | | | ------------------ | | | | | | 12| 27|#define shake256 OQS_SHA3_shake256 | | | | ------------------ | | ------------------ | | mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 429| | 430| | /* Copy true key to return buffer if fail is 0 */ 431| 27| mlk_ct_cmov_zero(ss, kr, MLKEM_SYMBYTES, fail); ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 432| | 433| 27|cleanup: 434| | /* Specification: Partially implements 435| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 436| 27| MLK_FREE(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 437| 27| context); 438| 27| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 439| 27| MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 27| do \ | | 239| 27| { \ | | 240| 27| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 27| (v) = NULL; \ | | 242| 27| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 27] | | ------------------ ------------------ 440| | 441| 27| return ret; 442| 27|} poly_k.c:mlk_polyvec_basemul_acc_montgomery_cached_k2_native: 125| 243|{ 126| 243| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (126:7): [True: 0, False: 243] ------------------ 127| 0| { 128| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 129| 0| } 130| | 131| 243| mlk_polyvec_basemul_acc_montgomery_cached_k2_avx2_asm(r, a, b, b_cache); ------------------ | | 107| 243| MLK_NAMESPACE(polyvec_basemul_acc_montgomery_cached_k2_avx2_asm) | | ------------------ | | | | 63| 243|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 243|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 243|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 132| 243| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 243|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 133| 243|} sampling.c:mlk_rej_uniform_native: 50| 2.28k|{ 51| 2.28k| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2) || len != MLKEM_N || ------------------ | | 22| 4.56k|#define MLKEM_N 256 ------------------ | Branch (51:7): [True: 0, False: 2.28k] | Branch (51:54): [True: 0, False: 2.28k] ------------------ 52| 2.28k| buflen % 12 != 0) ------------------ | Branch (52:7): [True: 0, False: 2.28k] ------------------ 53| 0| { 54| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 55| 0| } 56| 2.28k| return (int)mlk_rej_uniform_avx2_asm(r, buf, buflen, mlk_rej_uniform_table); ------------------ | | 20| 2.28k|#define mlk_rej_uniform_avx2_asm MLK_NAMESPACE(rej_uniform_avx2_asm) | | ------------------ | | | | 63| 2.28k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 2.28k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 2.28k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ return (int)mlk_rej_uniform_avx2_asm(r, buf, buflen, mlk_rej_uniform_table); ------------------ | | 17| 2.28k|#define mlk_rej_uniform_table MLK_NAMESPACE(rej_uniform_table) | | ------------------ | | | | 63| 2.28k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 2.28k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 2.28k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 57| 2.28k|} compress.c:mlk_poly_compress_d4_native: 198| 110|{ 199| 110| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (199:7): [True: 0, False: 110] ------------------ 200| 0| { 201| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 202| 0| } 203| | 204| 110| mlk_poly_compress_d4_avx2_asm(r, a, mlk_compress_d4_data); ------------------ | | 195| 110|#define mlk_poly_compress_d4_avx2_asm MLK_NAMESPACE(poly_compress_d4_avx2_asm) | | ------------------ | | | | 63| 110|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 110|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 110|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_d4_avx2_asm(r, a, mlk_compress_d4_data); ------------------ | | 19| 110|#define mlk_compress_d4_data MLK_NAMESPACE(compress_d4_data) | | ------------------ | | | | 63| 110|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 110|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 110|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 205| 110| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 110|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 206| 110|} compress.c:mlk_poly_compress_d10_native: 211| 276|{ 212| 276| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (212:7): [True: 0, False: 276] ------------------ 213| 0| { 214| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 215| 0| } 216| | 217| 276| mlk_poly_compress_d10_avx2_asm(r, a, mlk_compress_d10_data); ------------------ | | 228| 276|#define mlk_poly_compress_d10_avx2_asm MLK_NAMESPACE(poly_compress_d10_avx2_asm) | | ------------------ | | | | 63| 276|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 276|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 276|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_d10_avx2_asm(r, a, mlk_compress_d10_data); ------------------ | | 25| 276|#define mlk_compress_d10_data MLK_NAMESPACE(compress_d10_data) | | ------------------ | | | | 63| 276|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 276|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 276|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 218| 276| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 276|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 219| 276|} compress.c:mlk_poly_decompress_d4_native: 224| 55|{ 225| 55| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (225:7): [True: 0, False: 55] ------------------ 226| 0| { 227| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 228| 0| } 229| | 230| 55| mlk_poly_decompress_d4_avx2_asm(r, a, mlk_decompress_d4_data); ------------------ | | 212| 55| MLK_NAMESPACE(poly_decompress_d4_avx2_asm) | | ------------------ | | | | 63| 55|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 55|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 55|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_d4_avx2_asm(r, a, mlk_decompress_d4_data); ------------------ | | 22| 55|#define mlk_decompress_d4_data MLK_NAMESPACE(decompress_d4_data) | | ------------------ | | | | 63| 55|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 55|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 55|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 231| 55| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 55|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 232| 55|} compress.c:mlk_poly_decompress_d10_native: 237| 138|{ 238| 138| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (238:7): [True: 0, False: 138] ------------------ 239| 0| { 240| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 241| 0| } 242| | 243| 138| mlk_poly_decompress_d10_avx2_asm(r, a, mlk_decompress_d10_data); ------------------ | | 245| 138| MLK_NAMESPACE(poly_decompress_d10_avx2_asm) | | ------------------ | | | | 63| 138|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 138|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 138|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_d10_avx2_asm(r, a, mlk_decompress_d10_data); ------------------ | | 28| 138|#define mlk_decompress_d10_data MLK_NAMESPACE(decompress_d10_data) | | ------------------ | | | | 63| 138|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 138|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 138|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| 138| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 138|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 245| 138|} compress.c:mlk_poly_tobytes_native: 171| 714|{ 172| 714| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (172:7): [True: 0, False: 714] ------------------ 173| 0| { 174| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 175| 0| } 176| | 177| 714| mlk_ntttobytes_avx2_asm(r, a); ------------------ | | 157| 714|#define mlk_ntttobytes_avx2_asm MLK_NAMESPACE(ntttobytes_avx2_asm) | | ------------------ | | | | 63| 714|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 714|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 714|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 178| 714| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 714|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 179| 714|} compress.c:mlk_poly_frombytes_native: 184| 952|{ 185| 952| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (185:7): [True: 0, False: 952] ------------------ 186| 0| { 187| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 188| 0| } 189| | 190| 952| mlk_nttfrombytes_avx2_asm(r, a); ------------------ | | 170| 952|#define mlk_nttfrombytes_avx2_asm MLK_NAMESPACE(nttfrombytes_avx2_asm) | | ------------------ | | | | 63| 952|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 952|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 952|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 952| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 952|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 192| 952|} indcpa.c:mlk_poly_permute_bitrev_to_custom: 39| 2.28k|{ 40| 2.28k| if (mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (40:7): [True: 2.28k, False: 0] ------------------ 41| 2.28k| { 42| 2.28k| mlk_nttunpack_avx2_asm(data); ------------------ | | 65| 2.28k|#define mlk_nttunpack_avx2_asm MLK_NAMESPACE(nttunpack_avx2_asm) | | ------------------ | | | | 63| 2.28k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 2.28k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 2.28k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 43| 2.28k| } 44| 2.28k|} poly.c:mlk_poly_tomont_native: 97| 238|{ 98| 238| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (98:7): [True: 0, False: 238] ------------------ 99| 0| { 100| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 101| 0| } 102| | 103| 238| mlk_tomont_avx2_asm(data); ------------------ | | 183| 238|#define mlk_tomont_avx2_asm MLK_NAMESPACE(tomont_avx2_asm) | | ------------------ | | | | 63| 238|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 238|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 238|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 104| 238| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 238|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 105| 238|} poly.c:mlk_poly_reduce_native: 85| 1.43k|{ 86| 1.43k| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (86:7): [True: 0, False: 1.43k] ------------------ 87| 0| { 88| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 89| 0| } 90| | 91| 1.43k| mlk_reduce_avx2_asm(data); ------------------ | | 80| 1.43k|#define mlk_reduce_avx2_asm MLK_NAMESPACE(reduce_avx2_asm) | | ------------------ | | | | 63| 1.43k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.43k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.43k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 92| 1.43k| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 1.43k|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 93| 1.43k|} poly.c:mlk_poly_mulcache_compute_native: 110| 952|{ 111| 952| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (111:7): [True: 0, False: 952] ------------------ 112| 0| { 113| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 114| 0| } 115| | 116| 952| mlk_poly_mulcache_compute_avx2_asm(x, y, mlk_qdata); ------------------ | | 92| 952| MLK_NAMESPACE(poly_mulcache_compute_avx2_asm) | | ------------------ | | | | 63| 952|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 952|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 952|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_mulcache_compute_avx2_asm(x, y, mlk_qdata); ------------------ | | 21| 952|#define mlk_qdata MLK_NAMESPACE(qdata) | | ------------------ | | | | 63| 952|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 952|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 952|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 117| 952| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 952|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 118| 952|} poly.c:mlk_ntt_native: 61| 1.19k|{ 62| 1.19k| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (62:7): [True: 0, False: 1.19k] ------------------ 63| 0| { 64| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 65| 0| } 66| | 67| 1.19k| mlk_ntt_avx2_asm(data, mlk_qdata); ------------------ | | 36| 1.19k|#define mlk_ntt_avx2_asm MLK_NAMESPACE(ntt_avx2_asm) | | ------------------ | | | | 63| 1.19k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.19k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.19k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_ntt_avx2_asm(data, mlk_qdata); ------------------ | | 21| 1.19k|#define mlk_qdata MLK_NAMESPACE(qdata) | | ------------------ | | | | 63| 1.19k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.19k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.19k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 1.19k| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 1.19k|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 69| 1.19k|} poly.c:mlk_intt_native: 73| 716|{ 74| 716| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (74:7): [True: 0, False: 716] ------------------ 75| 0| { 76| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 77| 0| } 78| | 79| 716| mlk_invntt_avx2_asm(data, mlk_qdata); ------------------ | | 51| 716|#define mlk_invntt_avx2_asm MLK_NAMESPACE(invntt_avx2_asm) | | ------------------ | | | | 63| 716|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 716|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 716|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_invntt_avx2_asm(data, mlk_qdata); ------------------ | | 21| 716|#define mlk_qdata MLK_NAMESPACE(qdata) | | ------------------ | | | | 63| 716|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 716|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 716|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 80| 716| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 716|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 81| 716|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_tomont: 132| 54|{ 133| 54|#if defined(MLK_USE_NATIVE_POLY_TOMONT) 134| 54| int ret; 135| 54| ret = mlk_poly_tomont_native(r->coeffs); 136| 54| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 54|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (136:7): [True: 54, False: 0] ------------------ 137| 54| { 138| 54| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 54| do \ | | 106| 54| { \ | | 107| 54| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 54] | | ------------------ ------------------ 139| 54| return; 140| 54| } 141| 0|#endif /* MLK_USE_NATIVE_POLY_TOMONT */ 142| | 143| 0| mlk_poly_tomont_c(r); 144| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_reduce: 211| 351|{ 212| 351|#if defined(MLK_USE_NATIVE_POLY_REDUCE) 213| 351| int ret; 214| 351| ret = mlk_poly_reduce_native(r->coeffs); 215| 351| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 351|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (215:7): [True: 351, False: 0] ------------------ 216| 351| { 217| 351| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 351| do \ | | 102| 351| { \ | | 103| 351| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 351] | | ------------------ ------------------ 218| 351| return; 219| 351| } 220| 0|#endif /* MLK_USE_NATIVE_POLY_REDUCE */ 221| | 222| 0| mlk_poly_reduce_c(r); 223| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_add: 230| 270|{ 231| 270| unsigned i; 232| 69.3k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 69.3k|#define MLKEM_N 256 ------------------ | Branch (232:15): [True: 69.1k, False: 270] ------------------ 233| 69.1k| __loop__( 234| 69.1k| invariant(i <= MLKEM_N) 235| 69.1k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 236| 69.1k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] + b->coeffs[k1])) 237| 69.1k| decreases(MLKEM_N - i)) 238| 69.1k| { 239| | /* The preconditions imply that the addition stays within int16_t. */ 240| 69.1k| r->coeffs[i] = (int16_t)(r->coeffs[i] + b->coeffs[i]); 241| 69.1k| } 242| 270|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_sub: 249| 27|{ 250| 27| unsigned i; 251| 6.93k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 6.93k|#define MLKEM_N 256 ------------------ | Branch (251:15): [True: 6.91k, False: 27] ------------------ 252| 6.91k| __loop__( 253| 6.91k| invariant(i <= MLKEM_N) 254| 6.91k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 255| 6.91k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] - b->coeffs[k1])) 256| 6.91k| decreases(MLKEM_N - i)) 257| 6.91k| { 258| | /* The preconditions imply that the subtraction stays within int16_t. */ 259| 6.91k| r->coeffs[i] = (int16_t)(r->coeffs[i] - b->coeffs[i]); 260| 6.91k| } 261| 27|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_mulcache_compute: 302| 216|{ 303| 216|#if defined(MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE) 304| 216| int ret; 305| 216| ret = mlk_poly_mulcache_compute_native(x->coeffs, a->coeffs); 306| 216| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 216|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (306:7): [True: 216, False: 0] ------------------ 307| 216| { 308| 216| return; 309| 216| } 310| 0|#endif /* MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE */ 311| | 312| 0| mlk_poly_mulcache_compute_c(x, a); 313| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_ntt: 457| 270|{ 458| 270|#if defined(MLK_USE_NATIVE_NTT) 459| 270| int ret; 460| 270| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 270| do \ | | 106| 270| { \ | | 107| 270| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 270] | | ------------------ ------------------ 461| 270| ret = mlk_ntt_native(r->coeffs); 462| 270| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 270|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (462:7): [True: 270, False: 0] ------------------ 463| 270| { 464| 270| mlk_assert_abs_bound(r, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 105| 270| do \ | | 106| 270| { \ | | 107| 270| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 270] | | ------------------ ------------------ 465| 270| return; 466| 270| } 467| 0|#endif /* MLK_USE_NATIVE_NTT */ 468| | 469| 0| mlk_poly_ntt_c(r); 470| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_invntt_tomont: 558| 189|{ 559| 189|#if defined(MLK_USE_NATIVE_INTT) 560| 189| int ret; 561| 189| ret = mlk_intt_native(r->coeffs); 562| 189| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 189|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (562:7): [True: 189, False: 0] ------------------ 563| 189| { 564| 189| mlk_assert_abs_bound(r, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 105| 189| do \ | | 106| 189| { \ | | 107| 189| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 189] | | ------------------ ------------------ 565| 189| return; 566| 189| } 567| 0|#endif /* MLK_USE_NATIVE_INTT */ 568| | 569| 0| mlk_poly_invntt_tomont_c(r); 570| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_compress_du: 50| 54|{ 51| 54| unsigned i; 52| 54| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 54| do \ | | 111| 54| { \ | | 112| 54| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 54] | | ------------------ ------------------ 53| | 54| 162| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 162|#define MLKEM_K 2 ------------------ | Branch (54:15): [True: 108, False: 54] ------------------ 55| 108| { 56| 108| mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 49| 108|#define mlk_poly_compress_du MLK_NAMESPACE_K(poly_compress_du) | | ------------------ | | | | 64| 108|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 108|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 108|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 43| 108|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | ------------------ | | | | 35| 108|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | ------------------ ------------------ 57| 108| } 58| 54|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_decompress_du: 64| 27|{ 65| 27| unsigned i; 66| 81| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 81|#define MLKEM_K 2 ------------------ | Branch (66:15): [True: 54, False: 27] ------------------ 67| 54| { 68| 54| mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 79| 54|#define mlk_poly_decompress_du MLK_NAMESPACE_K(poly_decompress_du) | | ------------------ | | | | 64| 54|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 54|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 54|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 43| 54|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | ------------------ | | | | 35| 54|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | ------------------ ------------------ 69| 54| } 70| | 71| 27| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 27| do \ | | 111| 27| { \ | | 112| 27| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 27] | | ------------------ ------------------ 72| 27|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_tobytes: 81| 81|{ 82| 81| unsigned i; 83| 81| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 81| do \ | | 111| 81| { \ | | 112| 81| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 81] | | ------------------ ------------------ 84| | 85| 243| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 243|#define MLKEM_K 2 ------------------ | Branch (85:15): [True: 162, False: 81] ------------------ 86| 162| __loop__( 87| 162| assigns(i, memory_slice(r, MLKEM_POLYVECBYTES)) 88| 162| invariant(i <= MLKEM_K) 89| 162| decreases(MLKEM_K - i) 90| 162| ) 91| 162| { 92| 162| mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 512| 162|#define mlk_poly_tobytes MLK_NAMESPACE(poly_tobytes) | | ------------------ | | | | 63| 162|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 162|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 162|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 30| 162|#define MLKEM_POLYBYTES 384 ------------------ 93| 162| } 94| 81|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_frombytes: 99| 108|{ 100| 108| unsigned i; 101| 324| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 324|#define MLKEM_K 2 ------------------ | Branch (101:15): [True: 216, False: 108] ------------------ 102| 216| { 103| 216| mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 534| 216|#define mlk_poly_frombytes MLK_NAMESPACE(poly_frombytes) | | ------------------ | | | | 63| 216|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 216|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 216|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 30| 216|#define MLKEM_POLYBYTES 384 ------------------ 104| 216| } 105| | 106| 108| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 108| do \ | | 111| 108| { \ | | 112| 108| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 108] | | ------------------ ------------------ 107| 108|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_ntt: 112| 135|{ 113| 135| unsigned i; 114| 405| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 405|#define MLKEM_K 2 ------------------ | Branch (114:15): [True: 270, False: 135] ------------------ 115| 270| { 116| 270| mlk_poly_ntt(&r->vec[i]); ------------------ | | 235| 270|#define mlk_poly_ntt MLK_NAMESPACE(poly_ntt) | | ------------------ | | | | 63| 270|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 270|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 270|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 117| 270| } 118| | 119| 135| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 115| 135| do \ | | 116| 135| { \ | | 117| 135| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 135] | | ------------------ ------------------ 120| 135|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_invntt_tomont: 129| 54|{ 130| 54| unsigned i; 131| 162| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 162|#define MLKEM_K 2 ------------------ | Branch (131:15): [True: 108, False: 54] ------------------ 132| 108| { 133| 108| mlk_poly_invntt_tomont(&r->vec[i]); ------------------ | | 263| 108|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 108|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 108|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 108|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 134| 108| } 135| | 136| 54| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 115| 54| do \ | | 116| 54| { \ | | 117| 54| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 54] | | ------------------ ------------------ 137| 54|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_basemul_acc_montgomery_cached: 195| 243|{ 196| 243|#if defined(MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED) 197| 243| { 198| 243| int ret; 199| 243| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 243| do \ | | 111| 243| { \ | | 112| 243| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 243] | | ------------------ ------------------ 200| 243|#if MLKEM_K == 2 201| 243| ret = mlk_polyvec_basemul_acc_montgomery_cached_k2_native( 202| 243| r->coeffs, (const int16_t *)a, (const int16_t *)b, 203| 243| (const int16_t *)b_cache); 204| |#elif MLKEM_K == 3 205| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k3_native( 206| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 207| | (const int16_t *)b_cache); 208| |#elif MLKEM_K == 4 209| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k4_native( 210| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 211| | (const int16_t *)b_cache); 212| |#endif 213| 243| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 243|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (213:9): [True: 243, False: 0] ------------------ 214| 243| { 215| 243| return; 216| 243| } 217| 243| } 218| 0|#endif /* MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED */ 219| | 220| 0| mlk_polyvec_basemul_acc_montgomery_cached_c(r, a, b, b_cache); ------------------ | | 39| 0| MLK_ADD_PARAM_SET(mlk_polyvec_basemul_acc_montgomery_cached_c) | | ------------------ | | | | 48| 0|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 221| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_mulcache_compute: 229| 108|{ 230| 108| unsigned i; 231| 324| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 324|#define MLKEM_K 2 ------------------ | Branch (231:15): [True: 216, False: 108] ------------------ 232| 216| { 233| 216| mlk_poly_mulcache_compute(&x->vec[i], &a->vec[i]); ------------------ | | 123| 216|#define mlk_poly_mulcache_compute MLK_NAMESPACE(poly_mulcache_compute) | | ------------------ | | | | 63| 216|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 216|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 216|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 234| 216| } 235| 108|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_reduce: 246| 135|{ 247| 135| unsigned i; 248| 405| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 405|#define MLKEM_K 2 ------------------ | Branch (248:15): [True: 270, False: 135] ------------------ 249| 270| { 250| 270| mlk_poly_reduce(&r->vec[i]); ------------------ | | 154| 270|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 270|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 270|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 270|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 251| 270| } 252| | 253| 135| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 135| do \ | | 111| 135| { \ | | 112| 135| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 135] | | ------------------ ------------------ 254| 135|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_add: 261| 81|{ 262| 81| unsigned i; 263| 243| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 243|#define MLKEM_K 2 ------------------ | Branch (263:15): [True: 162, False: 81] ------------------ 264| 162| __loop__( 265| 162| assigns(i, memory_slice(r, sizeof(mlk_polyvec))) 266| 162| invariant(i <= MLKEM_K) 267| 162| invariant(forall(j0, i, MLKEM_K, 268| 162| forall(k0, 0, MLKEM_N, 269| 162| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] <= INT16_MAX) && 270| 162| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] >= INT16_MIN)))) 271| 162| invariant(forall(j2, 0, i, 272| 162| forall(k2, 0, MLKEM_N, 273| 162| (r->vec[j2].coeffs[k2] <= INT16_MAX) && 274| 162| (r->vec[j2].coeffs[k2] >= INT16_MIN)))) 275| 162| decreases(MLKEM_K - i) 276| 162| ) 277| 162| { 278| 162| mlk_poly_add(&r->vec[i], &b->vec[i]); ------------------ | | 181| 162|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 162|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 162|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 162|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 279| 162| } 280| 81|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_tomont: 285| 27|{ 286| 27| unsigned i; 287| 81| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 81|#define MLKEM_K 2 ------------------ | Branch (287:15): [True: 54, False: 27] ------------------ 288| 54| { 289| 54| mlk_poly_tomont(&r->vec[i]); ------------------ | | 102| 54|#define mlk_poly_tomont MLK_NAMESPACE(poly_tomont) | | ------------------ | | | | 63| 54|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 54|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 54|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 54| } 291| | 292| 27| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLKEM_Q); ------------------ | | 115| 27| do \ | | 116| 27| { \ | | 117| 27| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 27] | | ------------------ ------------------ 293| 27|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_getnoise_eta1_4x: 337| 27|{ 338| 27| MLK_ALIGN uint8_t buf[4][MLK_ALIGN_UP(MLKEM_ETA1 * MLKEM_N / 4)]; ------------------ | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 339| 27| MLK_ALIGN uint8_t extkey[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 1)]; ------------------ | | 190| 27|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 340| 27| mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 168| 27|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 341| 27| mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 168| 27|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 342| 27| mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 168| 27|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 343| 27| mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 168| 27|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 344| 27| extkey[0][MLKEM_SYMBYTES] = nonce0; ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 345| 27| extkey[1][MLKEM_SYMBYTES] = nonce1; ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 346| 27| extkey[2][MLKEM_SYMBYTES] = nonce2; ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 347| 27| extkey[3][MLKEM_SYMBYTES] = nonce3; ------------------ | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 348| | 349| 27|#if !defined(FIPS202_X4_DEFAULT_IMPLEMENTATION) && \ 350| 27| !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 351| 27| mlk_prf_eta1_x4(buf, extkey); ------------------ | | 45| 27| mlk_shake256x4((OUT)[0], (OUT)[1], (OUT)[2], (OUT)[3], \ | | ------------------ | | | | 18| 27|#define mlk_shake256x4 shake256x4 | | | | ------------------ | | | | | | 36| 27|#define shake256x4 OQS_SHA3_shake256_x4 | | | | ------------------ | | ------------------ | | 46| 27| (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 39| 27|#define MLKEM_ETA1 3 | | ------------------ | | (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 22| 27|#define MLKEM_N 256 | | ------------------ | | 47| 27| (IN)[3], MLKEM_SYMBYTES + 1) | | ------------------ | | | | 27| 27|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 352| |#else 353| | mlk_prf_eta1(buf[0], extkey[0]); 354| | mlk_prf_eta1(buf[1], extkey[1]); 355| | mlk_prf_eta1(buf[2], extkey[2]); 356| | if (r3 != NULL) 357| | { 358| | mlk_prf_eta1(buf[3], extkey[3]); 359| | } 360| |#endif /* !(!FIPS202_X4_DEFAULT_IMPLEMENTATION && \ 361| | !MLK_CONFIG_SERIAL_FIPS202_ONLY) */ 362| | 363| 27| mlk_poly_cbd_eta1(r0, buf[0]); ------------------ | | 36| 27|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 27|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 364| 27| mlk_poly_cbd_eta1(r1, buf[1]); ------------------ | | 36| 27|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 27|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 365| 27| mlk_poly_cbd_eta1(r2, buf[2]); ------------------ | | 36| 27|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 27|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 366| 27| if (r3 != NULL) ------------------ | Branch (366:7): [True: 27, False: 0] ------------------ 367| 27| { 368| 27| mlk_poly_cbd_eta1(r3, buf[3]); ------------------ | | 36| 27|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 27|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 369| 27| mlk_assert_abs_bound(r3, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 27| do \ | | 106| 27| { \ | | 107| 27| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 27] | | ------------------ ------------------ 370| 27| } 371| | 372| 27| mlk_assert_abs_bound(r0, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 27| do \ | | 106| 27| { \ | | 107| 27| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 27] | | ------------------ ------------------ 373| 27| mlk_assert_abs_bound(r1, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 27| do \ | | 106| 27| { \ | | 107| 27| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 27] | | ------------------ ------------------ 374| 27| mlk_assert_abs_bound(r2, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 27| do \ | | 106| 27| { \ | | 107| 27| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 27] | | ------------------ ------------------ 375| | 376| | /* Specification: Partially implements 377| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 378| 27| mlk_zeroize(buf, sizeof(buf)); 379| 27| mlk_zeroize(extkey, sizeof(extkey)); 380| 27|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_getnoise_eta2: 417| 54|{ 418| 54| MLK_ALIGN uint8_t buf[MLKEM_ETA2 * MLKEM_N / 4]; ------------------ | | 190| 54|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 419| 54| MLK_ALIGN uint8_t extkey[MLKEM_SYMBYTES + 1]; ------------------ | | 190| 54|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 420| | 421| 54| mlk_memcpy(extkey, seed, MLKEM_SYMBYTES); ------------------ | | 168| 54|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey, seed, MLKEM_SYMBYTES); ------------------ | | 27| 54|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 422| 54| extkey[MLKEM_SYMBYTES] = nonce; ------------------ | | 27| 54|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 423| 54| mlk_prf_eta2(buf, extkey); ------------------ | | 43| 54|#define mlk_prf_eta2(OUT, IN) mlk_prf_eta(MLKEM_ETA2, OUT, IN) | | ------------------ | | | | 41| 54| mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 18| 54|#define mlk_shake256 shake256 | | | | | | ------------------ | | | | | | | | 12| 54|#define shake256 OQS_SHA3_shake256 | | | | | | ------------------ | | | | ------------------ | | | | mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 22| 54|#define MLKEM_N 256 | | | | ------------------ | | | | mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 27| 54|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 424| | 425| 54| mlk_poly_cbd_eta2(r, buf); ------------------ | | 37| 54|#define mlk_poly_cbd_eta2 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta2) | | ------------------ | | | | 48| 54|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 426| | 427| 54| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_ETA2 + 1); ------------------ | | 105| 54| do \ | | 106| 54| { \ | | 107| 54| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 54] | | ------------------ ------------------ 428| | 429| | /* Specification: Partially implements 430| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 431| 54| mlk_zeroize(buf, sizeof(buf)); 432| 54| mlk_zeroize(extkey, sizeof(extkey)); 433| 54|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_getnoise_eta1122_4x: 450| 54|{ 451| |#if MLKEM_ETA2 >= MLKEM_ETA1 452| |#error mlk_poly_getnoise_eta1122_4x assumes MLKEM_ETA1 > MLKEM_ETA2 453| |#endif 454| 54| MLK_ALIGN uint8_t buf[4][MLK_ALIGN_UP(MLKEM_ETA1 * MLKEM_N / 4)]; ------------------ | | 190| 54|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 455| 54| MLK_ALIGN uint8_t extkey[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 1)]; ------------------ | | 190| 54|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 456| | 457| 54| mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 168| 54|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 27| 54|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 458| 54| mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 168| 54|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 27| 54|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 459| 54| mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 168| 54|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 27| 54|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 460| 54| mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 168| 54|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 27| 54|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 461| 54| extkey[0][MLKEM_SYMBYTES] = nonce0; ------------------ | | 27| 54|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 462| 54| extkey[1][MLKEM_SYMBYTES] = nonce1; ------------------ | | 27| 54|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 463| 54| extkey[2][MLKEM_SYMBYTES] = nonce2; ------------------ | | 27| 54|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 464| 54| extkey[3][MLKEM_SYMBYTES] = nonce3; ------------------ | | 27| 54|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 465| | 466| | /* On systems with fast batched Keccak, we use 4-fold batched PRF, 467| | * even though that means generating more random data in buf[2] and buf[3] 468| | * than necessary. */ 469| 54|#if !defined(FIPS202_X4_DEFAULT_IMPLEMENTATION) && \ 470| 54| !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 471| 54| mlk_prf_eta1_x4(buf, extkey); ------------------ | | 45| 54| mlk_shake256x4((OUT)[0], (OUT)[1], (OUT)[2], (OUT)[3], \ | | ------------------ | | | | 18| 54|#define mlk_shake256x4 shake256x4 | | | | ------------------ | | | | | | 36| 54|#define shake256x4 OQS_SHA3_shake256_x4 | | | | ------------------ | | ------------------ | | 46| 54| (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 39| 54|#define MLKEM_ETA1 3 | | ------------------ | | (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 22| 54|#define MLKEM_N 256 | | ------------------ | | 47| 54| (IN)[3], MLKEM_SYMBYTES + 1) | | ------------------ | | | | 27| 54|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 472| |#else 473| | mlk_prf_eta1(buf[0], extkey[0]); 474| | mlk_prf_eta1(buf[1], extkey[1]); 475| | mlk_prf_eta2(buf[2], extkey[2]); 476| | mlk_prf_eta2(buf[3], extkey[3]); 477| |#endif /* !(!FIPS202_X4_DEFAULT_IMPLEMENTATION && \ 478| | !MLK_CONFIG_SERIAL_FIPS202_ONLY) */ 479| | 480| 54| mlk_poly_cbd_eta1(r0, buf[0]); ------------------ | | 36| 54|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 54|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 481| 54| mlk_poly_cbd_eta1(r1, buf[1]); ------------------ | | 36| 54|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 54|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 482| 54| mlk_poly_cbd_eta2(r2, buf[2]); ------------------ | | 37| 54|#define mlk_poly_cbd_eta2 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta2) | | ------------------ | | | | 48| 54|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 483| 54| mlk_poly_cbd_eta2(r3, buf[3]); ------------------ | | 37| 54|#define mlk_poly_cbd_eta2 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta2) | | ------------------ | | | | 48| 54|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 484| | 485| 54| mlk_assert_abs_bound(r0, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 54| do \ | | 106| 54| { \ | | 107| 54| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 54] | | ------------------ ------------------ 486| 54| mlk_assert_abs_bound(r1, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 54| do \ | | 106| 54| { \ | | 107| 54| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 54] | | ------------------ ------------------ 487| 54| mlk_assert_abs_bound(r2, MLKEM_N, MLKEM_ETA2 + 1); ------------------ | | 105| 54| do \ | | 106| 54| { \ | | 107| 54| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 54] | | ------------------ ------------------ 488| 54| mlk_assert_abs_bound(r3, MLKEM_N, MLKEM_ETA2 + 1); ------------------ | | 105| 54| do \ | | 106| 54| { \ | | 107| 54| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 54] | | ------------------ ------------------ 489| | 490| | /* Specification: Partially implements 491| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 492| 54| mlk_zeroize(buf, sizeof(buf)); 493| 54| mlk_zeroize(extkey, sizeof(extkey)); 494| 54|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_compress_du: 69| 108|{ 70| 108|#if MLKEM_DU == 10 71| 108| mlk_poly_compress_d10(r, a); ------------------ | | 357| 108|#define mlk_poly_compress_d10 MLK_NAMESPACE(poly_compress_d10) | | ------------------ | | | | 63| 108|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 108|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 108|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 72| |#elif MLKEM_DU == 11 73| | mlk_poly_compress_d11(r, a); 74| |#else 75| |#error "Invalid value of MLKEM_DU" 76| |#endif 77| 108|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_decompress_du: 102| 54|{ 103| 54|#if MLKEM_DU == 10 104| 54| mlk_poly_decompress_d10(r, a); ------------------ | | 400| 54|#define mlk_poly_decompress_d10 MLK_NAMESPACE(poly_decompress_d10) | | ------------------ | | | | 63| 54|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 54|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 54|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 105| |#elif MLKEM_DU == 11 106| | mlk_poly_decompress_d11(r, a); 107| |#else 108| |#error "Invalid value of MLKEM_DU" 109| |#endif 110| 54|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_compress_dv: 132| 54|{ 133| 54|#if MLKEM_DV == 4 134| 54| mlk_poly_compress_d4(r, a); ------------------ | | 337| 54|#define mlk_poly_compress_d4 MLK_NAMESPACE(poly_compress_d4) | | ------------------ | | | | 63| 54|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 54|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 54|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 135| |#elif MLKEM_DV == 5 136| | mlk_poly_compress_d5(r, a); 137| |#else 138| |#error "Invalid value of MLKEM_DV" 139| |#endif 140| 54|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_decompress_dv: 166| 27|{ 167| 27|#if MLKEM_DV == 4 168| 27| mlk_poly_decompress_d4(r, a); ------------------ | | 377| 27|#define mlk_poly_decompress_d4 MLK_NAMESPACE(poly_decompress_d4) | | ------------------ | | | | 63| 27|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 27|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 27|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 169| |#elif MLKEM_DV == 5 170| | mlk_poly_decompress_d5(r, a); 171| |#else 172| |#error "Invalid value of MLKEM_DV" 173| |#endif 174| 27|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_rej_uniform_x4: 158| 81|{ 159| | /* Temporary buffers for XOF output before rejection sampling */ 160| 81| MLK_ALIGN uint8_t ------------------ | | 190| 81|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 161| 81| buf[4][MLK_ALIGN_UP(MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE)]; 162| | 163| | /* Tracks the number of coefficients we have already sampled */ 164| 81| unsigned ctr[4]; 165| 81| mlk_xof_x4_ctx statex; ------------------ | | 51| 81|#define mlk_xof_x4_ctx mlk_shake128x4ctx | | ------------------ | | | | 13| 81|#define mlk_shake128x4ctx shake128x4ctx | | | | ------------------ | | | | | | 51| 81|#define shake128x4ctx shake128x4incctx | | | | | | ------------------ | | | | | | | | 18| 81|#define shake128x4incctx OQS_SHA3_shake128_x4_inc_ctx | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 166| 81| unsigned buflen; 167| | 168| 81| mlk_xof_x4_init(&statex); ------------------ | | 59| 81|#define mlk_xof_x4_init(CTX) mlk_shake128x4_init((CTX)) | | ------------------ | | | | 16| 81|#define mlk_shake128x4_init shake128x4_init | | | | ------------------ | | | | | | 52| 81|#define shake128x4_init shake128x4_inc_init | | | | | | ------------------ | | | | | | | | 19| 81|#define shake128x4_inc_init OQS_SHA3_shake128_x4_inc_init | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 169| 81| mlk_xof_x4_absorb(&statex, seed, MLKEM_SYMBYTES + 2); ------------------ | | 61| 81| mlk_shake128x4_absorb_once((CTX), (IN)[0], (IN)[1], (IN)[2], (IN)[3], \ | | ------------------ | | | | 14| 81|#define mlk_shake128x4_absorb_once shake128x4_absorb_once | | | | ------------------ | | | | | | 39| 81|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once | | | | ------------------ | | ------------------ | | 62| 81| (INBYTES)) ------------------ 170| | 171| | /* 172| | * Initially, squeeze heuristic number of MLKEM_GEN_MATRIX_NBLOCKS. 173| | * This should generate the matrix entries with high probability. 174| | */ 175| 81| mlk_xof_x4_squeezeblocks(buf, MLKEM_GEN_MATRIX_NBLOCKS, &statex); ------------------ | | 64| 81| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 81|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 81| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 81|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 81| (NBLOCKS), (CTX)) ------------------ 176| 81| buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 146| 81| ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 22| 81|#define MLKEM_N 256 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 23| 81|#define MLKEM_Q 3329 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 68| 81|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 81|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 81|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 147| 81| MLK_XOF_RATE) | | ------------------ | | | | 68| 81|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 81|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 81|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 68| 81|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 81|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 81|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 177| 81| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, 0, buf[0], buflen); ------------------ | | 22| 81|#define MLKEM_N 256 ------------------ 178| 81| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, 0, buf[1], buflen); ------------------ | | 22| 81|#define MLKEM_N 256 ------------------ 179| 81| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, 0, buf[2], buflen); ------------------ | | 22| 81|#define MLKEM_N 256 ------------------ 180| 81| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, 0, buf[3], buflen); ------------------ | | 22| 81|#define MLKEM_N 256 ------------------ 181| | 182| | /* 183| | * So long as not all matrix entries have been generated, squeeze 184| | * one more block a time until we're done. 185| | */ 186| 81| buflen = MLK_XOF_RATE; ------------------ | | 68| 81|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 81|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 81|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 187| 162| while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 324|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 306|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 286|#define MLKEM_N 256 ------------------ | Branch (187:10): [True: 18, False: 144] | Branch (187:30): [True: 20, False: 124] | Branch (187:50): [True: 22, False: 102] ------------------ 188| 102| ctr[3] < MLKEM_N) ------------------ | | 22| 102|#define MLKEM_N 256 ------------------ | Branch (188:10): [True: 21, False: 81] ------------------ 189| 81| __loop__( 190| 81| assigns(ctr, statex, 191| 81| memory_slice(vec0, sizeof(mlk_poly)), 192| 81| memory_slice(vec1, sizeof(mlk_poly)), 193| 81| memory_slice(vec2, sizeof(mlk_poly)), 194| 81| memory_slice(vec3, sizeof(mlk_poly)), 195| 81| object_whole(buf)) 196| 81| invariant(ctr[0] <= MLKEM_N && ctr[1] <= MLKEM_N) 197| 81| invariant(ctr[2] <= MLKEM_N && ctr[3] <= MLKEM_N) 198| 81| invariant(array_bound(vec0->coeffs, 0, ctr[0], 0, MLKEM_Q)) 199| 81| invariant(array_bound(vec1->coeffs, 0, ctr[1], 0, MLKEM_Q)) 200| 81| invariant(array_bound(vec2->coeffs, 0, ctr[2], 0, MLKEM_Q)) 201| 81| invariant(array_bound(vec3->coeffs, 0, ctr[3], 0, MLKEM_Q))) 202| 81| { 203| 81| mlk_xof_x4_squeezeblocks(buf, 1, &statex); ------------------ | | 64| 81| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 81|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 81| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 81|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 81| (NBLOCKS), (CTX)) ------------------ 204| 81| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, ctr[0], buf[0], buflen); ------------------ | | 22| 81|#define MLKEM_N 256 ------------------ 205| 81| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, ctr[1], buf[1], buflen); ------------------ | | 22| 81|#define MLKEM_N 256 ------------------ 206| 81| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, ctr[2], buf[2], buflen); ------------------ | | 22| 81|#define MLKEM_N 256 ------------------ 207| 81| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, ctr[3], buf[3], buflen); ------------------ | | 22| 81|#define MLKEM_N 256 ------------------ 208| 81| } 209| | 210| 81| mlk_xof_x4_release(&statex); ------------------ | | 66| 81|#define mlk_xof_x4_release(CTX) mlk_shake128x4_release((CTX)) | | ------------------ | | | | 17| 81|#define mlk_shake128x4_release shake128x4_release | | | | ------------------ | | | | | | 53| 81|#define shake128x4_release shake128x4_inc_ctx_release | | | | | | ------------------ | | | | | | | | 23| 81|#define shake128x4_inc_ctx_release OQS_SHA3_shake128_x4_inc_ctx_release | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 211| | 212| | /* Specification: Partially implements 213| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 214| 81| mlk_zeroize(buf, sizeof(buf)); 215| 81|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_cbd2: 276| 162|{ 277| 162| unsigned i; 278| 5.34k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 5.34k|#define MLKEM_N 256 ------------------ | Branch (278:15): [True: 5.18k, False: 162] ------------------ 279| 5.18k| __loop__( 280| 5.18k| invariant(i <= MLKEM_N / 8) 281| 5.18k| invariant(array_abs_bound(r->coeffs, 0, 8 * i, 3)) 282| 5.18k| decreases(MLKEM_N / 8 - i)) 283| 5.18k| { 284| 5.18k| unsigned j; 285| 5.18k| uint32_t t = mlk_load32_littleendian(buf + 4 * i); 286| 5.18k| uint32_t d = t & 0x55555555; 287| 5.18k| d += (t >> 1) & 0x55555555; 288| | 289| 46.6k| for (j = 0; j < 8; j++) ------------------ | Branch (289:17): [True: 41.4k, False: 5.18k] ------------------ 290| 41.4k| __loop__( 291| 41.4k| invariant(i <= MLKEM_N / 8 && j <= 8) 292| 41.4k| invariant(array_abs_bound(r->coeffs, 0, 8 * i + j, 3)) 293| 41.4k| decreases(8 - j)) 294| 41.4k| { 295| | /* Safety: The & 0x3 masks each value to 2 bits (range [0, 3]), so the 296| | * truncation and subsequent subtraction in int16_t is lossless. */ 297| 41.4k| const int16_t a = (int16_t)((d >> (4 * j + 0)) & 0x3); 298| 41.4k| const int16_t b = (int16_t)((d >> (4 * j + 2)) & 0x3); 299| 41.4k| r->coeffs[8 * i + j] = (int16_t)(a - b); 300| 41.4k| } 301| 5.18k| } 302| 162|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_cbd3: 329| 216|{ 330| 216| unsigned i; 331| 14.0k| for (i = 0; i < MLKEM_N / 4; i++) ------------------ | | 22| 14.0k|#define MLKEM_N 256 ------------------ | Branch (331:15): [True: 13.8k, False: 216] ------------------ 332| 13.8k| __loop__( 333| 13.8k| invariant(i <= MLKEM_N / 4) 334| 13.8k| invariant(array_abs_bound(r->coeffs, 0, 4 * i, 4)) 335| 13.8k| decreases(MLKEM_N / 4 - i)) 336| 13.8k| { 337| 13.8k| unsigned j; 338| 13.8k| const uint32_t t = mlk_load24_littleendian(buf + 3 * i); 339| 13.8k| uint32_t d = t & 0x00249249; 340| 13.8k| d += (t >> 1) & 0x00249249; 341| 13.8k| d += (t >> 2) & 0x00249249; 342| | 343| 69.1k| for (j = 0; j < 4; j++) ------------------ | Branch (343:17): [True: 55.2k, False: 13.8k] ------------------ 344| 55.2k| __loop__( 345| 55.2k| invariant(i <= MLKEM_N / 4 && j <= 4) 346| 55.2k| invariant(array_abs_bound(r->coeffs, 0, 4 * i + j, 4)) 347| 55.2k| decreases(4 - j)) 348| 55.2k| { 349| | /* Safety: The & 0x7 masks each value to 3 bits (range [0, 7]), so the 350| | * truncation and subsequent subtraction in int16_t is lossless. */ 351| 55.2k| const int16_t a = (int16_t)((d >> (6 * j + 0)) & 0x7); 352| 55.2k| const int16_t b = (int16_t)((d >> (6 * j + 3)) & 0x7); 353| 55.2k| r->coeffs[4 * i + j] = (int16_t)(a - b); 354| 55.2k| } 355| 13.8k| } 356| 216|} poly_k.c:mlk_sys_check_capability: 289| 954|{ 290| | /* By default, we rely on compile-time feature detection/specification: 291| | * If a feature is enabled at compile-time, we assume it is supported by 292| | * the host that the resulting library/binary will be built on. 293| | * If this assumption is not true, you MUST overwrite this function. 294| | * See the documentation of MLK_CONFIG_CUSTOM_CAPABILITY_FUNC in 295| | * mlkem_native_config.h for more information. */ 296| 954| (void)cap; 297| 954| return 1; 298| 954|} sampling.c:mlk_sys_check_capability: 289| 2.28k|{ 290| | /* By default, we rely on compile-time feature detection/specification: 291| | * If a feature is enabled at compile-time, we assume it is supported by 292| | * the host that the resulting library/binary will be built on. 293| | * If this assumption is not true, you MUST overwrite this function. 294| | * See the documentation of MLK_CONFIG_CUSTOM_CAPABILITY_FUNC in 295| | * mlkem_native_config.h for more information. */ 296| 2.28k| (void)cap; 297| 2.28k| return 1; 298| 2.28k|} compress.c:mlk_sys_check_capability: 289| 2.62k|{ 290| | /* By default, we rely on compile-time feature detection/specification: 291| | * If a feature is enabled at compile-time, we assume it is supported by 292| | * the host that the resulting library/binary will be built on. 293| | * If this assumption is not true, you MUST overwrite this function. 294| | * See the documentation of MLK_CONFIG_CUSTOM_CAPABILITY_FUNC in 295| | * mlkem_native_config.h for more information. */ 296| 2.62k| (void)cap; 297| 2.62k| return 1; 298| 2.62k|} indcpa.c:mlk_sys_check_capability: 289| 2.28k|{ 290| | /* By default, we rely on compile-time feature detection/specification: 291| | * If a feature is enabled at compile-time, we assume it is supported by 292| | * the host that the resulting library/binary will be built on. 293| | * If this assumption is not true, you MUST overwrite this function. 294| | * See the documentation of MLK_CONFIG_CUSTOM_CAPABILITY_FUNC in 295| | * mlkem_native_config.h for more information. */ 296| 2.28k| (void)cap; 297| 2.28k| return 1; 298| 2.28k|} poly.c:mlk_sys_check_capability: 289| 4.52k|{ 290| | /* By default, we rely on compile-time feature detection/specification: 291| | * If a feature is enabled at compile-time, we assume it is supported by 292| | * the host that the resulting library/binary will be built on. 293| | * If this assumption is not true, you MUST overwrite this function. 294| | * See the documentation of MLK_CONFIG_CUSTOM_CAPABILITY_FUNC in 295| | * mlkem_native_config.h for more information. */ 296| 4.52k| (void)cap; 297| 4.52k| return 1; 298| 4.52k|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_compress_d4: 80| 56|{ 81| 56|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D4) 82| 56| int ret; 83| 56| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 56| do \ | | 102| 56| { \ | | 103| 56| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 56] | | ------------------ ------------------ 84| 56| ret = mlk_poly_compress_d4_native(r, a->coeffs); 85| 56| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 56|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (85:7): [True: 56, False: 0] ------------------ 86| 56| { 87| 56| return; 88| 56| } 89| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D4 */ 90| | 91| 0| mlk_poly_compress_d4_c(r, a); 92| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_compress_d10: 147| 168|{ 148| 168|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D10) 149| 168| int ret; 150| 168| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 168| do \ | | 102| 168| { \ | | 103| 168| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 168] | | ------------------ ------------------ 151| 168| ret = mlk_poly_compress_d10_native(r, a->coeffs); 152| 168| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 168|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (152:7): [True: 168, False: 0] ------------------ 153| 168| { 154| 168| return; 155| 168| } 156| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D10 */ 157| | 158| 0| mlk_poly_compress_d10_c(r, a); 159| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_decompress_d4: 195| 28|{ 196| 28|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D4) 197| 28| int ret; 198| 28| ret = mlk_poly_decompress_d4_native(r->coeffs, a); 199| 28| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 28|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (199:7): [True: 28, False: 0] ------------------ 200| 28| { 201| 28| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 28| do \ | | 102| 28| { \ | | 103| 28| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 28] | | ------------------ ------------------ 202| 28| return; 203| 28| } 204| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D4 */ 205| | 206| 0| mlk_poly_decompress_d4_c(r, a); 207| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_decompress_d10: 258| 84|{ 259| 84|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D10) 260| 84| int ret; 261| 84| ret = mlk_poly_decompress_d10_native(r->coeffs, a); 262| 84| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 84|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (262:7): [True: 84, False: 0] ------------------ 263| 84| { 264| 84| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 84| do \ | | 102| 84| { \ | | 103| 84| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 84] | | ------------------ ------------------ 265| 84| return; 266| 84| } 267| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D10 */ 268| | 269| 0| mlk_poly_decompress_d10_c(r, a); 270| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_tobytes: 610| 252|{ 611| 252|#if defined(MLK_USE_NATIVE_POLY_TOBYTES) 612| 252| int ret; 613| 252| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 252| do \ | | 102| 252| { \ | | 103| 252| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 252] | | ------------------ ------------------ 614| 252| ret = mlk_poly_tobytes_native(r, a->coeffs); 615| 252| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 252|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (615:7): [True: 252, False: 0] ------------------ 616| 252| { 617| 252| return; 618| 252| } 619| 0|#endif /* MLK_USE_NATIVE_POLY_TOBYTES */ 620| | 621| 0| mlk_poly_tobytes_c(r, a); 622| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_frombytes: 659| 336|{ 660| 336|#if defined(MLK_USE_NATIVE_POLY_FROMBYTES) 661| 336| int ret; 662| 336| ret = mlk_poly_frombytes_native(r->coeffs, a); 663| 336| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 336|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (663:7): [True: 336, False: 0] ------------------ 664| 336| { 665| 336| return; 666| 336| } 667| 0|#endif /* MLK_USE_NATIVE_POLY_FROMBYTES */ 668| | 669| 0| mlk_poly_frombytes_c(r, a); 670| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_frommsg: 680| 56|{ 681| 56| unsigned i; 682| |#if (MLKEM_INDCPA_MSGBYTES != MLKEM_N / 8) 683| |#error "MLKEM_INDCPA_MSGBYTES must be equal to MLKEM_N/8 bytes!" 684| |#endif 685| | 686| 1.84k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 1.84k|#define MLKEM_N 256 ------------------ | Branch (686:15): [True: 1.79k, False: 56] ------------------ 687| 1.79k| __loop__( 688| 1.79k| invariant(i <= MLKEM_N / 8) 689| 1.79k| invariant(array_bound(r->coeffs, 0, 8 * i, 0, MLKEM_Q)) 690| 1.79k| decreases(MLKEM_N / 8 - i)) 691| 1.79k| { 692| 1.79k| unsigned j; 693| 16.1k| for (j = 0; j < 8; j++) ------------------ | Branch (693:17): [True: 14.3k, False: 1.79k] ------------------ 694| 14.3k| __loop__( 695| 14.3k| invariant(i < MLKEM_N / 8 && j <= 8) 696| 14.3k| invariant(array_bound(r->coeffs, 0, 8 * i + j, 0, MLKEM_Q)) 697| 14.3k| decreases(8 - j)) 698| 14.3k| { 699| | /* mlk_ct_sel_int16(MLKEM_Q_HALF, 0, b) is `Decompress_1(b != 0)` 700| | * as per @[FIPS203, Eq (4.8)]. */ 701| | 702| | /* Prevent the compiler from recognizing this as a bit selection */ 703| 14.3k| uint8_t mask = mlk_value_barrier_u8((uint8_t)(1u << j)); 704| 14.3k| r->coeffs[8 * i + j] = mlk_ct_sel_int16(MLKEM_Q_HALF, 0, msg[i] & mask); ------------------ | | 24| 14.3k|#define MLKEM_Q_HALF ((MLKEM_Q + 1) / 2) /* 1665 */ | | ------------------ | | | | 23| 14.3k|#define MLKEM_Q 3329 | | ------------------ ------------------ 705| 14.3k| } 706| 1.79k| } 707| 56| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 56| do \ | | 106| 56| { \ | | 107| 56| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 56] | | ------------------ ------------------ 708| 56|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_tomsg: 718| 28|{ 719| 28| unsigned i; 720| 28| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 28| do \ | | 102| 28| { \ | | 103| 28| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 28] | | ------------------ ------------------ 721| | 722| 924| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 924|#define MLKEM_N 256 ------------------ | Branch (722:15): [True: 896, False: 28] ------------------ 723| 896| __loop__(invariant(i <= MLKEM_N / 8) 724| 896| decreases(MLKEM_N / 8 - i)) 725| 896| { 726| 896| unsigned j; 727| 896| msg[i] = 0; 728| 8.06k| for (j = 0; j < 8; j++) ------------------ | Branch (728:17): [True: 7.16k, False: 896] ------------------ 729| 7.16k| __loop__( 730| 7.16k| invariant(i <= MLKEM_N / 8 && j <= 8) 731| 7.16k| decreases(8 - j)) 732| 7.16k| { 733| 7.16k| uint32_t t = mlk_scalar_compress_d1(r->coeffs[8 * i + j]); 734| 7.16k| msg[i] |= (uint8_t)(t << j); 735| 7.16k| } 736| 896| } 737| 28|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_gen_matrix: 223| 84|{ 224| 84| unsigned i, j; 225| 84| MLK_ALIGN uint8_t seed_ext[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 2)]; ------------------ | | 190| 84|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 226| | 227| 420| for (j = 0; j < 4; j++) ------------------ | Branch (227:15): [True: 336, False: 84] ------------------ 228| 336| { 229| 336| mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 168| 336|#define mlk_memcpy memcpy ------------------ mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 27| 336|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 230| 336| } 231| | 232| 84|#if !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 233| | /* Sample 4 matrix entries a time. */ 234| 252| for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 15| 252|#define MLKEM_K 3 ------------------ for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 15| 252|#define MLKEM_K 3 ------------------ | Branch (234:15): [True: 168, False: 84] ------------------ 235| 168| { 236| 840| for (j = 0; j < 4; j++) ------------------ | Branch (236:17): [True: 672, False: 168] ------------------ 237| 672| { 238| 672| uint8_t x, y; 239| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 240| 672| x = (uint8_t)((i + j) / MLKEM_K); ------------------ | | 15| 672|#define MLKEM_K 3 ------------------ 241| 672| y = (uint8_t)((i + j) % MLKEM_K); ------------------ | | 15| 672|#define MLKEM_K 3 ------------------ 242| 672| if (transposed) ------------------ | Branch (242:11): [True: 448, False: 224] ------------------ 243| 448| { 244| 448| seed_ext[j][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 448|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 245| 448| seed_ext[j][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 448|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 246| 448| } 247| 224| else 248| 224| { 249| 224| seed_ext[j][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 224|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 250| 224| seed_ext[j][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 224|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 251| 224| } 252| 672| } 253| | 254| 168| mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 55| 168|#define mlk_poly_rej_uniform_x4 MLK_NAMESPACE(poly_rej_uniform_x4) | | ------------------ | | | | 63| 168|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 168|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 168|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 15| 168|#define MLKEM_K 3 ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 15| 168|#define MLKEM_K 3 ------------------ 255| 168| &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 15| 168|#define MLKEM_K 3 ------------------ &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 15| 168|#define MLKEM_K 3 ------------------ 256| 168| &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 15| 168|#define MLKEM_K 3 ------------------ &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 15| 168|#define MLKEM_K 3 ------------------ 257| 168| &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 15| 168|#define MLKEM_K 3 ------------------ &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 15| 168|#define MLKEM_K 3 ------------------ 258| 168| seed_ext); 259| 168| } 260| |#else /* !MLK_CONFIG_SERIAL_FIPS202_ONLY */ 261| | /* When using serial FIPS202, sample all entries individually. */ 262| | i = 0; 263| |#endif /* MLK_CONFIG_SERIAL_FIPS202_ONLY */ 264| | 265| | /* For MLKEM_K == 3, sample the last entry individually. 266| | * When MLK_CONFIG_SERIAL_FIPS202_ONLY is set, sample all entries 267| | * individually. */ 268| 168| for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 15| 168|#define MLKEM_K 3 ------------------ for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 15| 168|#define MLKEM_K 3 ------------------ | Branch (268:10): [True: 84, False: 84] ------------------ 269| 84| { 270| 84| uint8_t x, y; 271| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 272| 84| x = (uint8_t)(i / MLKEM_K); ------------------ | | 15| 84|#define MLKEM_K 3 ------------------ 273| 84| y = (uint8_t)(i % MLKEM_K); ------------------ | | 15| 84|#define MLKEM_K 3 ------------------ 274| | 275| 84| if (transposed) ------------------ | Branch (275:9): [True: 56, False: 28] ------------------ 276| 56| { 277| 56| seed_ext[0][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 278| 56| seed_ext[0][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 279| 56| } 280| 28| else 281| 28| { 282| 28| seed_ext[0][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 283| 28| seed_ext[0][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 284| 28| } 285| | 286| 84| mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 89| 84|#define mlk_poly_rej_uniform MLK_NAMESPACE(poly_rej_uniform) | | ------------------ | | | | 63| 84|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 84|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 84|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 15| 84|#define MLKEM_K 3 ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 15| 84|#define MLKEM_K 3 ------------------ 287| 84| } 288| | 289| 84| mlk_assert(i == MLKEM_K * MLKEM_K); ------------------ | | 97| 84| do \ | | 98| 84| { \ | | 99| 84| } while (0) | | ------------------ | | | Branch (99:12): [Folded, False: 84] | | ------------------ ------------------ 290| | 291| | /* 292| | * The public matrix is generated in NTT domain. If the native backend 293| | * uses a custom order in NTT domain, permute A accordingly. 294| | */ 295| 84| mlk_polymat_permute_bitrev_to_custom(a); ------------------ | | 42| 84| MLK_ADD_PARAM_SET(mlk_polymat_permute_bitrev_to_custom) | | ------------------ | | | | 48| 84|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 296| | 297| | /* Specification: Partially implements 298| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 299| 84| mlk_zeroize(seed_ext, sizeof(seed_ext)); 300| 84|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_indcpa_keypair_derand: 445| 28|{ 446| 28| int ret = 0; 447| 28| const uint8_t *publicseed; 448| 28| const uint8_t *noiseseed; 449| 28| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 450| 28| MLK_ALLOC(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 451| 28| MLK_ALLOC(a, mlk_polymat, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 452| 28| MLK_ALLOC(e, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 453| 28| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 454| 28| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 455| 28| MLK_ALLOC(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 456| | 457| 28| if (buf == NULL || coins_with_domain_separator == NULL || a == NULL || ------------------ | Branch (457:7): [True: 0, False: 28] | Branch (457:22): [True: 0, False: 28] | Branch (457:61): [True: 0, False: 28] ------------------ 458| 28| e == NULL || pkpv == NULL || skpv == NULL || skpv_cache == NULL) ------------------ | Branch (458:7): [True: 0, False: 28] | Branch (458:20): [True: 0, False: 28] | Branch (458:36): [True: 0, False: 28] | Branch (458:52): [True: 0, False: 28] ------------------ 459| 0| { 460| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 461| 0| goto cleanup; 462| 0| } 463| | 464| 28| publicseed = buf; 465| 28| noiseseed = buf + MLKEM_SYMBYTES; ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 466| | 467| | /* Concatenate coins with MLKEM_K for domain separation of security levels */ 468| 28| mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 469| 28| coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 15| 28|#define MLKEM_K 3 ------------------ 470| | 471| 28| mlk_hash_g(buf, coins_with_domain_separator, MLKEM_SYMBYTES + 1); ------------------ | | 32| 28|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 28|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 28|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 472| | 473| | /* 474| | * Declassify the public seed. 475| | * Required to use it in conditional-branches in rejection sampling. 476| | * This is needed because all output of randombytes is marked as secret 477| | * (=undefined) 478| | */ 479| 28| MLK_CT_TESTING_DECLASSIFY(publicseed, MLKEM_SYMBYTES); ------------------ | | 235| 28| do \ | | 236| 28| { \ | | 237| 28| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 28] | | ------------------ ------------------ 480| | 481| 28| mlk_gen_matrix(a, publicseed, 0 /* no transpose */); ------------------ | | 22| 28|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 482| | 483| 28| mlk_keypair_getnoise_eta1(skpv, e, noiseseed); ------------------ | | 43| 28|#define mlk_keypair_getnoise_eta1 MLK_ADD_PARAM_SET(mlk_keypair_getnoise_eta1) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 484| | 485| 28| mlk_polyvec_ntt(skpv); ------------------ | | 269| 28|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 486| 28| mlk_polyvec_ntt(e); ------------------ | | 269| 28|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 487| | 488| 28| mlk_polyvec_mulcache_compute(skpv_cache, skpv); ------------------ | | 353| 28|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 489| 28| mlk_matvec_mul(pkpv, a, skpv, skpv_cache); ------------------ | | 38| 28|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 490| 28| mlk_polyvec_tomont(pkpv); ------------------ | | 445| 28|#define mlk_polyvec_tomont MLK_NAMESPACE_K(polyvec_tomont) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 491| | 492| 28| mlk_polyvec_add(pkpv, e); ------------------ | | 414| 28|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 493| 28| mlk_polyvec_reduce(pkpv); ------------------ | | 387| 28|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 494| 28| mlk_polyvec_reduce(skpv); ------------------ | | 387| 28|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 495| | 496| 28| mlk_pack_sk(sk, skpv); ------------------ | | 34| 28|#define mlk_pack_sk MLK_ADD_PARAM_SET(mlk_pack_sk) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 497| 28| mlk_pack_pk(pk, pkpv, publicseed); ------------------ | | 32| 28|#define mlk_pack_pk MLK_ADD_PARAM_SET(mlk_pack_pk) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 498| | 499| 28|cleanup: 500| | /* Specification: Partially implements 501| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 502| 28| MLK_FREE(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 503| 28| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 504| 28| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 505| 28| MLK_FREE(e, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 506| 28| MLK_FREE(a, mlk_polymat, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 507| 28| MLK_FREE(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 508| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 509| 28| return ret; 510| 28|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_indcpa_enc: 526| 56|{ 527| 56| int ret = 0; 528| 56| MLK_ALLOC(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 529| 56| MLK_ALLOC(at, mlk_polymat, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 530| 56| MLK_ALLOC(sp, mlk_polyvec, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 531| 56| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 532| 56| MLK_ALLOC(ep, mlk_polyvec, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 533| 56| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 534| 56| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 535| 56| MLK_ALLOC(k, mlk_poly, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 536| 56| MLK_ALLOC(epp, mlk_poly, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 537| 56| MLK_ALLOC(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 538| | 539| 56| if (seed == NULL || at == NULL || sp == NULL || pkpv == NULL || ep == NULL || ------------------ | Branch (539:7): [True: 0, False: 56] | Branch (539:23): [True: 0, False: 56] | Branch (539:37): [True: 0, False: 56] | Branch (539:51): [True: 0, False: 56] | Branch (539:67): [True: 0, False: 56] ------------------ 540| 56| b == NULL || v == NULL || k == NULL || epp == NULL || sp_cache == NULL) ------------------ | Branch (540:7): [True: 0, False: 56] | Branch (540:20): [True: 0, False: 56] | Branch (540:33): [True: 0, False: 56] | Branch (540:46): [True: 0, False: 56] | Branch (540:61): [True: 0, False: 56] ------------------ 541| 0| { 542| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 543| 0| goto cleanup; 544| 0| } 545| | 546| 56| mlk_unpack_pk(pkpv, seed, pk); ------------------ | | 33| 56|#define mlk_unpack_pk MLK_ADD_PARAM_SET(mlk_unpack_pk) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 547| 56| mlk_poly_frommsg(k, m); ------------------ | | 555| 56|#define mlk_poly_frommsg MLK_NAMESPACE(poly_frommsg) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 548| | 549| | /* 550| | * Declassify the public seed. 551| | * Required to use it in conditional-branches in rejection sampling. 552| | * This is needed because in re-encryption the publicseed originated from sk 553| | * which is marked undefined. 554| | */ 555| 56| MLK_CT_TESTING_DECLASSIFY(seed, MLKEM_SYMBYTES); ------------------ | | 235| 56| do \ | | 236| 56| { \ | | 237| 56| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 56] | | ------------------ ------------------ 556| | 557| 56| mlk_gen_matrix(at, seed, 1 /* transpose */); ------------------ | | 22| 56|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 558| | 559| 56| mlk_enc_getnoise_eta1_eta2(sp, ep, epp, coins); ------------------ | | 44| 56|#define mlk_enc_getnoise_eta1_eta2 MLK_ADD_PARAM_SET(mlk_enc_getnoise_eta1_eta2) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 560| | 561| 56| mlk_polyvec_ntt(sp); ------------------ | | 269| 56|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 562| | 563| 56| mlk_polyvec_mulcache_compute(sp_cache, sp); ------------------ | | 353| 56|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 564| 56| mlk_matvec_mul(b, at, sp, sp_cache); ------------------ | | 38| 56|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 565| 56| mlk_polyvec_basemul_acc_montgomery_cached(v, pkpv, sp, sp_cache); ------------------ | | 321| 56| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 566| | 567| 56| mlk_polyvec_invntt_tomont(b); ------------------ | | 295| 56|#define mlk_polyvec_invntt_tomont MLK_NAMESPACE_K(polyvec_invntt_tomont) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 568| 56| mlk_poly_invntt_tomont(v); ------------------ | | 263| 56|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 569| | 570| 56| mlk_polyvec_add(b, ep); ------------------ | | 414| 56|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 571| 56| mlk_poly_add(v, epp); ------------------ | | 181| 56|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 572| 56| mlk_poly_add(v, k); ------------------ | | 181| 56|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 573| | 574| 56| mlk_polyvec_reduce(b); ------------------ | | 387| 56|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 575| 56| mlk_poly_reduce(v); ------------------ | | 154| 56|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 576| | 577| 56| mlk_pack_ciphertext(c, b, v); ------------------ | | 36| 56|#define mlk_pack_ciphertext MLK_ADD_PARAM_SET(mlk_pack_ciphertext) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 578| | 579| 56|cleanup: 580| | /* Specification: Partially implements 581| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 582| 56| MLK_FREE(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 583| 56| MLK_FREE(epp, mlk_poly, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 584| 56| MLK_FREE(k, mlk_poly, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 585| 56| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 586| 56| MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 587| 56| MLK_FREE(ep, mlk_polyvec, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 588| 56| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 589| 56| MLK_FREE(sp, mlk_polyvec, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 590| 56| MLK_FREE(at, mlk_polymat, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 591| | MLK_FREE(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 592| 56| return ret; 593| 56|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_indcpa_dec: 603| 28|{ 604| 28| int ret = 0; 605| 28| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 606| 28| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 607| 28| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 608| 28| MLK_ALLOC(sb, mlk_poly, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 609| 28| MLK_ALLOC(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 610| | 611| 28| if (b == NULL || skpv == NULL || v == NULL || sb == NULL || b_cache == NULL) ------------------ | Branch (611:7): [True: 0, False: 28] | Branch (611:20): [True: 0, False: 28] | Branch (611:36): [True: 0, False: 28] | Branch (611:49): [True: 0, False: 28] | Branch (611:63): [True: 0, False: 28] ------------------ 612| 0| { 613| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 614| 0| goto cleanup; 615| 0| } 616| | 617| 28| mlk_unpack_ciphertext(b, v, c); ------------------ | | 37| 28|#define mlk_unpack_ciphertext MLK_ADD_PARAM_SET(mlk_unpack_ciphertext) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 618| 28| mlk_unpack_sk(skpv, sk); ------------------ | | 35| 28|#define mlk_unpack_sk MLK_ADD_PARAM_SET(mlk_unpack_sk) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 619| | 620| 28| mlk_polyvec_ntt(b); ------------------ | | 269| 28|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 621| 28| mlk_polyvec_mulcache_compute(b_cache, b); ------------------ | | 353| 28|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 622| 28| mlk_polyvec_basemul_acc_montgomery_cached(sb, skpv, b, b_cache); ------------------ | | 321| 28| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 623| 28| mlk_poly_invntt_tomont(sb); ------------------ | | 263| 28|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 624| | 625| 28| mlk_poly_sub(v, sb); ------------------ | | 210| 28|#define mlk_poly_sub MLK_NAMESPACE(poly_sub) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 626| 28| mlk_poly_reduce(v); ------------------ | | 154| 28|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 627| | 628| 28| mlk_poly_tomsg(m, v); ------------------ | | 577| 28|#define mlk_poly_tomsg MLK_NAMESPACE(poly_tomsg) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 629| | 630| 28|cleanup: 631| | /* Specification: Partially implements 632| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 633| 28| MLK_FREE(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 634| 28| MLK_FREE(sb, mlk_poly, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 635| 28| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 636| 28| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 637| | MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 638| 28| return ret; 639| 28|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_check_pk: 45| 28|{ 46| 28| int ret = 0; 47| 28| MLK_ALLOC(p, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 48| 28| MLK_ALLOC(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 49| | 50| 28| if (p == NULL || p_reencoded == NULL) ------------------ | Branch (50:7): [True: 0, False: 28] | Branch (50:20): [True: 0, False: 28] ------------------ 51| 0| { 52| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 53| 0| goto cleanup; 54| 0| } 55| | 56| 28| mlk_polyvec_frombytes(p, pk); ------------------ | | 247| 28|#define mlk_polyvec_frombytes MLK_NAMESPACE_K(polyvec_frombytes) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 57| 28| mlk_polyvec_reduce(p); ------------------ | | 387| 28|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| 28| mlk_polyvec_tobytes(p_reencoded, p); ------------------ | | 225| 28|#define mlk_polyvec_tobytes MLK_NAMESPACE_K(polyvec_tobytes) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| | /* We use a constant-time memcmp here to avoid having to 61| | * declassify the PK before the PCT has succeeded. */ 62| 28| ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 15| 28|#define MLKEM_K 3 | | ------------------ | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | ------------------ ------------------ ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ | Branch (62:9): [True: 0, False: 28] ------------------ 63| | 64| 28|cleanup: 65| | /* Specification: Partially implements 66| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 67| 28| MLK_FREE(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 68| | MLK_FREE(p, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 69| 28| return ret; 70| 28|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_check_sk: 78| 28|{ 79| 28| int ret = 0; 80| 28| MLK_ALLOC(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 81| | 82| 28| if (test == NULL) ------------------ | Branch (82:7): [True: 0, False: 28] ------------------ 83| 0| { 84| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 85| 0| goto cleanup; 86| 0| } 87| | 88| | /* 89| | * The parts of `sk` being hashed and compared here are public, so 90| | * no public information is leaked through the runtime or the return value 91| | * of this function. 92| | */ 93| | 94| | /* Declassify the public part of the secret key */ 95| 28| MLK_CT_TESTING_DECLASSIFY(sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 235| 28| do \ | | 236| 28| { \ | | 237| 28| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 28] | | ------------------ ------------------ 96| 28| MLKEM_INDCCA_PUBLICKEYBYTES); 97| 28| MLK_CT_TESTING_DECLASSIFY( ------------------ | | 235| 28| do \ | | 236| 28| { \ | | 237| 28| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 28] | | ------------------ ------------------ 98| 28| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, MLKEM_SYMBYTES); 99| | 100| 28| mlk_hash_h(test, sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 29| 28|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 28|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 28|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 101| 28| MLKEM_INDCCA_PUBLICKEYBYTES); 102| | /* This doesn't have to be a constant-time memcmp, but it's the only place 103| | * in the library where a normal memcmp would be used otherwise, so for sake 104| | * of minimizing stdlib dependency, we use our constant-time one anyway. */ 105| 28| ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 28| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 28|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 28|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 28|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 28| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (105:9): [True: 0, False: 28] ------------------ 106| 28| test, MLKEM_SYMBYTES) ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 107| 28| ? MLK_ERR_FAIL ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ 108| 28| : 0; 109| | 110| 28|cleanup: 111| | /* Specification: Partially implements 112| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 113| | MLK_FREE(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 114| 28| return ret; 115| 28|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_keypair_derand: 214| 28|{ 215| 28| int ret; 216| | 217| 28| ret = mlk_indcpa_keypair_derand(pk, sk, coins, context); ------------------ | | 49| 28| MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 28|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 218| 28| if (ret != 0) ------------------ | Branch (218:7): [True: 0, False: 28] ------------------ 219| 0| { 220| 0| goto cleanup; 221| 0| } 222| | 223| 28| mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 15| 28|#define MLKEM_K 3 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 28|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 28|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 28|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 224| 28| mlk_hash_h(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, pk, ------------------ | | 29| 28|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 28|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 28|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 225| 28| MLKEM_INDCCA_PUBLICKEYBYTES); 226| | /* Value z for pseudo-random output on reject */ 227| 28| mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 28| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 28|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 28|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 28|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 28| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 228| 28| coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 229| | 230| | /* Declassify public key */ 231| 28| MLK_CT_TESTING_DECLASSIFY(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 235| 28| do \ | | 236| 28| { \ | | 237| 28| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 28] | | ------------------ ------------------ 232| | 233| | /* Pairwise Consistency Test (PCT) @[FIPS140_3_IG, p.87] */ 234| 28| ret = mlk_check_pct(pk, sk, context); ------------------ | | 37| 28|#define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ | | #define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 211| 28|#define MLK_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1) | | ------------------ ------------------ 235| 28| if (ret != 0) ------------------ | Branch (235:7): [True: 0, False: 28] ------------------ 236| 0| { 237| 0| goto cleanup; 238| 0| } 239| | 240| 28|cleanup: 241| 28| if (ret != 0) ------------------ | Branch (241:7): [True: 0, False: 28] ------------------ 242| 0| { 243| 0| mlk_zeroize(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 0|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 0|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 244| 0| mlk_zeroize(sk, MLKEM_INDCCA_SECRETKEYBYTES); ------------------ | | 72| 0| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 0|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 0|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 0|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 0| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 245| 0| } 246| | 247| 28| return ret; 248| 28|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_keypair: 257| 28|{ 258| 28| int ret = 0; 259| 28| MLK_ALLOC(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 260| | 261| 28| if (coins == NULL) ------------------ | Branch (261:7): [True: 0, False: 28] ------------------ 262| 0| { 263| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 264| 0| goto cleanup; 265| 0| } 266| | 267| | /* Acquire necessary randomness, and mark it as secret. */ 268| 28| if (mlk_randombytes(coins, 2 * MLKEM_SYMBYTES) != 0) ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (268:7): [True: 0, False: 28] ------------------ 269| 0| { 270| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 271| 0| goto cleanup; 272| 0| } 273| | 274| 28| MLK_CT_TESTING_SECRET(coins, 2 * MLKEM_SYMBYTES); ------------------ | | 231| 28| do \ | | 232| 28| { \ | | 233| 28| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 28] | | ------------------ ------------------ 275| | 276| 28| ret = mlk_kem_keypair_derand(pk, sk, coins, context); ------------------ | | 50| 28| MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 28|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 277| | 278| 28|cleanup: 279| | /* Specification: Partially implements 280| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 281| | MLK_FREE(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 282| 28| return ret; 283| 28|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_enc_derand: 295| 28|{ 296| 28| int ret = 0; 297| 28| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 298| 28| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 299| | 300| 28| if (buf == NULL || kr == NULL) ------------------ | Branch (300:7): [True: 0, False: 28] | Branch (300:22): [True: 0, False: 28] ------------------ 301| 0| { 302| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 303| 0| goto cleanup; 304| 0| } 305| | 306| | /* Specification: Implements @[FIPS203, Section 7.2, Modulus check] */ 307| 28| ret = mlk_kem_check_pk(pk, context); ------------------ | | 55| 28|#define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 28|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 308| 28| if (ret != 0) ------------------ | Branch (308:7): [True: 0, False: 28] ------------------ 309| 0| { 310| 0| goto cleanup; 311| 0| } 312| | 313| 28| mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 314| | 315| | /* Multitarget countermeasure for coins + contributory KEM */ 316| 28| mlk_hash_h(buf + MLKEM_SYMBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 29| 28|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 28|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 28|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 317| 28| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 28|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 28|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 28|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 318| | 319| | /* coins are in kr+MLKEM_SYMBYTES */ 320| 28| ret = mlk_indcpa_enc(ct, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 28|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 28| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 321| 28| if (ret != 0) ------------------ | Branch (321:7): [True: 0, False: 28] ------------------ 322| 0| { 323| 0| goto cleanup; 324| 0| } 325| | 326| 28| mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 327| | 328| 28|cleanup: 329| | /* Specification: Partially implements 330| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 331| 28| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 332| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 333| 28| return ret; 334| 28|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_enc: 344| 28|{ 345| 28| int ret = 0; 346| 28| MLK_ALLOC(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 347| | 348| 28| if (coins == NULL) ------------------ | Branch (348:7): [True: 0, False: 28] ------------------ 349| 0| { 350| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 351| 0| goto cleanup; 352| 0| } 353| | 354| 28| if (mlk_randombytes(coins, MLKEM_SYMBYTES) != 0) ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (354:7): [True: 0, False: 28] ------------------ 355| 0| { 356| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 357| 0| goto cleanup; 358| 0| } 359| | 360| 28| MLK_CT_TESTING_SECRET(coins, MLKEM_SYMBYTES); ------------------ | | 231| 28| do \ | | 232| 28| { \ | | 233| 28| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 28] | | ------------------ ------------------ 361| | 362| 28| ret = mlk_kem_enc_derand(ct, ss, pk, coins, context); ------------------ | | 52| 28|#define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 28| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 363| | 364| 28|cleanup: 365| | /* Specification: Partially implements 366| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 367| | MLK_FREE(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 368| 28| return ret; 369| 28|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_dec: 380| 28|{ 381| 28| int ret = 0; 382| 28| uint8_t fail; 383| 28| const uint8_t *pk = sk + MLKEM_INDCPA_SECRETKEYBYTES; ------------------ | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 15| 28|#define MLKEM_K 3 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ 384| 28| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 385| 28| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 386| 28| MLK_ALLOC(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 387| 28| context); 388| | 389| 28| if (buf == NULL || kr == NULL || tmp == NULL) ------------------ | Branch (389:7): [True: 0, False: 28] | Branch (389:22): [True: 0, False: 28] | Branch (389:36): [True: 0, False: 28] ------------------ 390| 0| { 391| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 392| 0| goto cleanup; 393| 0| } 394| | 395| | /* Specification: Implements @[FIPS203, Section 7.3, Hash check] */ 396| 28| ret = mlk_kem_check_sk(sk, context); ------------------ | | 56| 28|#define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 28|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 397| 28| if (ret != 0) ------------------ | Branch (397:7): [True: 0, False: 28] ------------------ 398| 0| { 399| 0| goto cleanup; 400| 0| } 401| | 402| 28| ret = mlk_indcpa_dec(buf, ct, sk, context); ------------------ | | 127| 28|#define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 28|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 403| 28| if (ret != 0) ------------------ | Branch (403:7): [True: 0, False: 28] ------------------ 404| 0| { 405| 0| goto cleanup; 406| 0| } 407| | 408| | /* Multitarget countermeasure for coins + contributory KEM */ 409| 28| mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 410| 28| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 28| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 28|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 28|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 28|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 28| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 411| 28| MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 412| 28| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 28|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 28|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 28|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 413| | 414| | /* Recompute and compare ciphertext */ 415| | /* coins are in kr+MLKEM_SYMBYTES */ 416| 28| ret = mlk_indcpa_enc(tmp, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 28|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 28| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 417| 28| if (ret != 0) ------------------ | Branch (417:7): [True: 0, False: 28] ------------------ 418| 0| { 419| 0| goto cleanup; 420| 0| } 421| | 422| 28| fail = mlk_ct_memcmp(ct, tmp, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 28|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 28| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 51| 28|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 15| 28|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 50| 28|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | | | | | ------------------ | | | | | | | | | | 35| 28|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 49| 28|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D4 | | | | | | ------------------ | | | | | | | | 33| 28|#define MLKEM_POLYCOMPRESSEDBYTES_D4 128 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 423| | 424| | /* Compute rejection key */ 425| 28| mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 28| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 28|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 28|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 28|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 28| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 426| 28| MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 427| 28| mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 28|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 28| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 51| 28|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 15| 28|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 50| 28|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | | | | | ------------------ | | | | | | | | | | 35| 28|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 49| 28|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D4 | | | | | | ------------------ | | | | | | | | 33| 28|#define MLKEM_POLYCOMPRESSEDBYTES_D4 128 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 428| 28| mlk_hash_j(ss, tmp, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 36| 28| mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 18| 28|#define mlk_shake256 shake256 | | | | ------------------ | | | | | | 12| 28|#define shake256 OQS_SHA3_shake256 | | | | ------------------ | | ------------------ | | mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 429| | 430| | /* Copy true key to return buffer if fail is 0 */ 431| 28| mlk_ct_cmov_zero(ss, kr, MLKEM_SYMBYTES, fail); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 432| | 433| 28|cleanup: 434| | /* Specification: Partially implements 435| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 436| 28| MLK_FREE(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 437| 28| context); 438| 28| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 439| 28| MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 440| | 441| 28| return ret; 442| 28|} poly_k.c:mlk_polyvec_basemul_acc_montgomery_cached_k3_native: 141| 336|{ 142| 336| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (142:7): [True: 0, False: 336] ------------------ 143| 0| { 144| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 145| 0| } 146| | 147| 336| mlk_polyvec_basemul_acc_montgomery_cached_k3_avx2_asm(r, a, b, b_cache); ------------------ | | 124| 336| MLK_NAMESPACE(polyvec_basemul_acc_montgomery_cached_k3_avx2_asm) | | ------------------ | | | | 63| 336|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 336|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 336|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 336| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 336|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 149| 336|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_tomont: 132| 84|{ 133| 84|#if defined(MLK_USE_NATIVE_POLY_TOMONT) 134| 84| int ret; 135| 84| ret = mlk_poly_tomont_native(r->coeffs); 136| 84| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 84|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (136:7): [True: 84, False: 0] ------------------ 137| 84| { 138| 84| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 84| do \ | | 106| 84| { \ | | 107| 84| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 84] | | ------------------ ------------------ 139| 84| return; 140| 84| } 141| 0|#endif /* MLK_USE_NATIVE_POLY_TOMONT */ 142| | 143| 0| mlk_poly_tomont_c(r); 144| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_reduce: 211| 504|{ 212| 504|#if defined(MLK_USE_NATIVE_POLY_REDUCE) 213| 504| int ret; 214| 504| ret = mlk_poly_reduce_native(r->coeffs); 215| 504| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 504|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (215:7): [True: 504, False: 0] ------------------ 216| 504| { 217| 504| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 504| do \ | | 102| 504| { \ | | 103| 504| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 504] | | ------------------ ------------------ 218| 504| return; 219| 504| } 220| 0|#endif /* MLK_USE_NATIVE_POLY_REDUCE */ 221| | 222| 0| mlk_poly_reduce_c(r); 223| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_add: 230| 364|{ 231| 364| unsigned i; 232| 93.5k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 93.5k|#define MLKEM_N 256 ------------------ | Branch (232:15): [True: 93.1k, False: 364] ------------------ 233| 93.1k| __loop__( 234| 93.1k| invariant(i <= MLKEM_N) 235| 93.1k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 236| 93.1k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] + b->coeffs[k1])) 237| 93.1k| decreases(MLKEM_N - i)) 238| 93.1k| { 239| | /* The preconditions imply that the addition stays within int16_t. */ 240| 93.1k| r->coeffs[i] = (int16_t)(r->coeffs[i] + b->coeffs[i]); 241| 93.1k| } 242| 364|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_sub: 249| 28|{ 250| 28| unsigned i; 251| 7.19k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 7.19k|#define MLKEM_N 256 ------------------ | Branch (251:15): [True: 7.16k, False: 28] ------------------ 252| 7.16k| __loop__( 253| 7.16k| invariant(i <= MLKEM_N) 254| 7.16k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 255| 7.16k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] - b->coeffs[k1])) 256| 7.16k| decreases(MLKEM_N - i)) 257| 7.16k| { 258| | /* The preconditions imply that the subtraction stays within int16_t. */ 259| 7.16k| r->coeffs[i] = (int16_t)(r->coeffs[i] - b->coeffs[i]); 260| 7.16k| } 261| 28|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_mulcache_compute: 302| 336|{ 303| 336|#if defined(MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE) 304| 336| int ret; 305| 336| ret = mlk_poly_mulcache_compute_native(x->coeffs, a->coeffs); 306| 336| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 336|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (306:7): [True: 336, False: 0] ------------------ 307| 336| { 308| 336| return; 309| 336| } 310| 0|#endif /* MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE */ 311| | 312| 0| mlk_poly_mulcache_compute_c(x, a); 313| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_ntt: 457| 420|{ 458| 420|#if defined(MLK_USE_NATIVE_NTT) 459| 420| int ret; 460| 420| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 420| do \ | | 106| 420| { \ | | 107| 420| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 420] | | ------------------ ------------------ 461| 420| ret = mlk_ntt_native(r->coeffs); 462| 420| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 420|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (462:7): [True: 420, False: 0] ------------------ 463| 420| { 464| 420| mlk_assert_abs_bound(r, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 105| 420| do \ | | 106| 420| { \ | | 107| 420| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 420] | | ------------------ ------------------ 465| 420| return; 466| 420| } 467| 0|#endif /* MLK_USE_NATIVE_NTT */ 468| | 469| 0| mlk_poly_ntt_c(r); 470| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_invntt_tomont: 558| 252|{ 559| 252|#if defined(MLK_USE_NATIVE_INTT) 560| 252| int ret; 561| 252| ret = mlk_intt_native(r->coeffs); 562| 252| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 252|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (562:7): [True: 252, False: 0] ------------------ 563| 252| { 564| 252| mlk_assert_abs_bound(r, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 105| 252| do \ | | 106| 252| { \ | | 107| 252| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 252] | | ------------------ ------------------ 565| 252| return; 566| 252| } 567| 0|#endif /* MLK_USE_NATIVE_INTT */ 568| | 569| 0| mlk_poly_invntt_tomont_c(r); 570| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_compress_du: 50| 56|{ 51| 56| unsigned i; 52| 56| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 56| do \ | | 111| 56| { \ | | 112| 56| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 56] | | ------------------ ------------------ 53| | 54| 224| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 224|#define MLKEM_K 3 ------------------ | Branch (54:15): [True: 168, False: 56] ------------------ 55| 168| { 56| 168| mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 49| 168|#define mlk_poly_compress_du MLK_NAMESPACE_K(poly_compress_du) | | ------------------ | | | | 64| 168|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 168|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 168|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 50| 168|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | ------------------ | | | | 35| 168|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | ------------------ ------------------ 57| 168| } 58| 56|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_decompress_du: 64| 28|{ 65| 28| unsigned i; 66| 112| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 112|#define MLKEM_K 3 ------------------ | Branch (66:15): [True: 84, False: 28] ------------------ 67| 84| { 68| 84| mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 79| 84|#define mlk_poly_decompress_du MLK_NAMESPACE_K(poly_decompress_du) | | ------------------ | | | | 64| 84|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 84|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 84|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 50| 84|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | ------------------ | | | | 35| 84|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | ------------------ ------------------ 69| 84| } 70| | 71| 28| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 28| do \ | | 111| 28| { \ | | 112| 28| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 28] | | ------------------ ------------------ 72| 28|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_tobytes: 81| 84|{ 82| 84| unsigned i; 83| 84| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 84| do \ | | 111| 84| { \ | | 112| 84| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 84] | | ------------------ ------------------ 84| | 85| 336| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 336|#define MLKEM_K 3 ------------------ | Branch (85:15): [True: 252, False: 84] ------------------ 86| 252| __loop__( 87| 252| assigns(i, memory_slice(r, MLKEM_POLYVECBYTES)) 88| 252| invariant(i <= MLKEM_K) 89| 252| decreases(MLKEM_K - i) 90| 252| ) 91| 252| { 92| 252| mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 512| 252|#define mlk_poly_tobytes MLK_NAMESPACE(poly_tobytes) | | ------------------ | | | | 63| 252|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 252|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 252|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 30| 252|#define MLKEM_POLYBYTES 384 ------------------ 93| 252| } 94| 84|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_frombytes: 99| 112|{ 100| 112| unsigned i; 101| 448| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 448|#define MLKEM_K 3 ------------------ | Branch (101:15): [True: 336, False: 112] ------------------ 102| 336| { 103| 336| mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 534| 336|#define mlk_poly_frombytes MLK_NAMESPACE(poly_frombytes) | | ------------------ | | | | 63| 336|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 336|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 336|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 30| 336|#define MLKEM_POLYBYTES 384 ------------------ 104| 336| } 105| | 106| 112| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 112| do \ | | 111| 112| { \ | | 112| 112| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 112] | | ------------------ ------------------ 107| 112|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_ntt: 112| 140|{ 113| 140| unsigned i; 114| 560| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 560|#define MLKEM_K 3 ------------------ | Branch (114:15): [True: 420, False: 140] ------------------ 115| 420| { 116| 420| mlk_poly_ntt(&r->vec[i]); ------------------ | | 235| 420|#define mlk_poly_ntt MLK_NAMESPACE(poly_ntt) | | ------------------ | | | | 63| 420|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 420|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 420|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 117| 420| } 118| | 119| 140| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 115| 140| do \ | | 116| 140| { \ | | 117| 140| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 140] | | ------------------ ------------------ 120| 140|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_invntt_tomont: 129| 56|{ 130| 56| unsigned i; 131| 224| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 224|#define MLKEM_K 3 ------------------ | Branch (131:15): [True: 168, False: 56] ------------------ 132| 168| { 133| 168| mlk_poly_invntt_tomont(&r->vec[i]); ------------------ | | 263| 168|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 168|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 168|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 168|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 134| 168| } 135| | 136| 56| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 115| 56| do \ | | 116| 56| { \ | | 117| 56| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 56] | | ------------------ ------------------ 137| 56|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_basemul_acc_montgomery_cached: 195| 336|{ 196| 336|#if defined(MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED) 197| 336| { 198| 336| int ret; 199| 336| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 336| do \ | | 111| 336| { \ | | 112| 336| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 336] | | ------------------ ------------------ 200| |#if MLKEM_K == 2 201| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k2_native( 202| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 203| | (const int16_t *)b_cache); 204| |#elif MLKEM_K == 3 205| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k3_native( 206| 336| r->coeffs, (const int16_t *)a, (const int16_t *)b, 207| 336| (const int16_t *)b_cache); 208| |#elif MLKEM_K == 4 209| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k4_native( 210| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 211| | (const int16_t *)b_cache); 212| |#endif 213| 336| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 336|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (213:9): [True: 336, False: 0] ------------------ 214| 336| { 215| 336| return; 216| 336| } 217| 336| } 218| 0|#endif /* MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED */ 219| | 220| 0| mlk_polyvec_basemul_acc_montgomery_cached_c(r, a, b, b_cache); ------------------ | | 39| 0| MLK_ADD_PARAM_SET(mlk_polyvec_basemul_acc_montgomery_cached_c) | | ------------------ | | | | 48| 0|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 221| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_mulcache_compute: 229| 112|{ 230| 112| unsigned i; 231| 448| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 448|#define MLKEM_K 3 ------------------ | Branch (231:15): [True: 336, False: 112] ------------------ 232| 336| { 233| 336| mlk_poly_mulcache_compute(&x->vec[i], &a->vec[i]); ------------------ | | 123| 336|#define mlk_poly_mulcache_compute MLK_NAMESPACE(poly_mulcache_compute) | | ------------------ | | | | 63| 336|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 336|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 336|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 234| 336| } 235| 112|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_reduce: 246| 140|{ 247| 140| unsigned i; 248| 560| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 560|#define MLKEM_K 3 ------------------ | Branch (248:15): [True: 420, False: 140] ------------------ 249| 420| { 250| 420| mlk_poly_reduce(&r->vec[i]); ------------------ | | 154| 420|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 420|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 420|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 420|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 251| 420| } 252| | 253| 140| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 140| do \ | | 111| 140| { \ | | 112| 140| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 140] | | ------------------ ------------------ 254| 140|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_add: 261| 84|{ 262| 84| unsigned i; 263| 336| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 336|#define MLKEM_K 3 ------------------ | Branch (263:15): [True: 252, False: 84] ------------------ 264| 252| __loop__( 265| 252| assigns(i, memory_slice(r, sizeof(mlk_polyvec))) 266| 252| invariant(i <= MLKEM_K) 267| 252| invariant(forall(j0, i, MLKEM_K, 268| 252| forall(k0, 0, MLKEM_N, 269| 252| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] <= INT16_MAX) && 270| 252| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] >= INT16_MIN)))) 271| 252| invariant(forall(j2, 0, i, 272| 252| forall(k2, 0, MLKEM_N, 273| 252| (r->vec[j2].coeffs[k2] <= INT16_MAX) && 274| 252| (r->vec[j2].coeffs[k2] >= INT16_MIN)))) 275| 252| decreases(MLKEM_K - i) 276| 252| ) 277| 252| { 278| 252| mlk_poly_add(&r->vec[i], &b->vec[i]); ------------------ | | 181| 252|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 252|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 252|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 252|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 279| 252| } 280| 84|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_tomont: 285| 28|{ 286| 28| unsigned i; 287| 112| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 112|#define MLKEM_K 3 ------------------ | Branch (287:15): [True: 84, False: 28] ------------------ 288| 84| { 289| 84| mlk_poly_tomont(&r->vec[i]); ------------------ | | 102| 84|#define mlk_poly_tomont MLK_NAMESPACE(poly_tomont) | | ------------------ | | | | 63| 84|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 84|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 84|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 84| } 291| | 292| 28| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLKEM_Q); ------------------ | | 115| 28| do \ | | 116| 28| { \ | | 117| 28| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 28] | | ------------------ ------------------ 293| 28|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_getnoise_eta1_4x: 337| 168|{ 338| 168| MLK_ALIGN uint8_t buf[4][MLK_ALIGN_UP(MLKEM_ETA1 * MLKEM_N / 4)]; ------------------ | | 190| 168|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 339| 168| MLK_ALIGN uint8_t extkey[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 1)]; ------------------ | | 190| 168|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 340| 168| mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 168| 168|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 341| 168| mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 168| 168|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 342| 168| mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 168| 168|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 343| 168| mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 168| 168|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 344| 168| extkey[0][MLKEM_SYMBYTES] = nonce0; ------------------ | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 345| 168| extkey[1][MLKEM_SYMBYTES] = nonce1; ------------------ | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 346| 168| extkey[2][MLKEM_SYMBYTES] = nonce2; ------------------ | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 347| 168| extkey[3][MLKEM_SYMBYTES] = nonce3; ------------------ | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 348| | 349| 168|#if !defined(FIPS202_X4_DEFAULT_IMPLEMENTATION) && \ 350| 168| !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 351| 168| mlk_prf_eta1_x4(buf, extkey); ------------------ | | 45| 168| mlk_shake256x4((OUT)[0], (OUT)[1], (OUT)[2], (OUT)[3], \ | | ------------------ | | | | 18| 168|#define mlk_shake256x4 shake256x4 | | | | ------------------ | | | | | | 36| 168|#define shake256x4 OQS_SHA3_shake256_x4 | | | | ------------------ | | ------------------ | | 46| 168| (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 46| 168|#define MLKEM_ETA1 2 | | ------------------ | | (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 22| 168|#define MLKEM_N 256 | | ------------------ | | 47| 168| (IN)[3], MLKEM_SYMBYTES + 1) | | ------------------ | | | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 352| |#else 353| | mlk_prf_eta1(buf[0], extkey[0]); 354| | mlk_prf_eta1(buf[1], extkey[1]); 355| | mlk_prf_eta1(buf[2], extkey[2]); 356| | if (r3 != NULL) 357| | { 358| | mlk_prf_eta1(buf[3], extkey[3]); 359| | } 360| |#endif /* !(!FIPS202_X4_DEFAULT_IMPLEMENTATION && \ 361| | !MLK_CONFIG_SERIAL_FIPS202_ONLY) */ 362| | 363| 168| mlk_poly_cbd_eta1(r0, buf[0]); ------------------ | | 36| 168|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 168|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 364| 168| mlk_poly_cbd_eta1(r1, buf[1]); ------------------ | | 36| 168|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 168|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 365| 168| mlk_poly_cbd_eta1(r2, buf[2]); ------------------ | | 36| 168|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 168|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 366| 168| if (r3 != NULL) ------------------ | Branch (366:7): [True: 56, False: 112] ------------------ 367| 56| { 368| 56| mlk_poly_cbd_eta1(r3, buf[3]); ------------------ | | 36| 56|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 369| 56| mlk_assert_abs_bound(r3, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 56| do \ | | 106| 56| { \ | | 107| 56| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 56] | | ------------------ ------------------ 370| 56| } 371| | 372| 168| mlk_assert_abs_bound(r0, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 168| do \ | | 106| 168| { \ | | 107| 168| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 168] | | ------------------ ------------------ 373| 168| mlk_assert_abs_bound(r1, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 168| do \ | | 106| 168| { \ | | 107| 168| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 168] | | ------------------ ------------------ 374| 168| mlk_assert_abs_bound(r2, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 168| do \ | | 106| 168| { \ | | 107| 168| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 168] | | ------------------ ------------------ 375| | 376| | /* Specification: Partially implements 377| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 378| 168| mlk_zeroize(buf, sizeof(buf)); 379| 168| mlk_zeroize(extkey, sizeof(extkey)); 380| 168|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_compress_du: 69| 168|{ 70| 168|#if MLKEM_DU == 10 71| 168| mlk_poly_compress_d10(r, a); ------------------ | | 357| 168|#define mlk_poly_compress_d10 MLK_NAMESPACE(poly_compress_d10) | | ------------------ | | | | 63| 168|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 168|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 168|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 72| |#elif MLKEM_DU == 11 73| | mlk_poly_compress_d11(r, a); 74| |#else 75| |#error "Invalid value of MLKEM_DU" 76| |#endif 77| 168|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_decompress_du: 102| 84|{ 103| 84|#if MLKEM_DU == 10 104| 84| mlk_poly_decompress_d10(r, a); ------------------ | | 400| 84|#define mlk_poly_decompress_d10 MLK_NAMESPACE(poly_decompress_d10) | | ------------------ | | | | 63| 84|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 84|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 84|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 105| |#elif MLKEM_DU == 11 106| | mlk_poly_decompress_d11(r, a); 107| |#else 108| |#error "Invalid value of MLKEM_DU" 109| |#endif 110| 84|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_compress_dv: 132| 56|{ 133| 56|#if MLKEM_DV == 4 134| 56| mlk_poly_compress_d4(r, a); ------------------ | | 337| 56|#define mlk_poly_compress_d4 MLK_NAMESPACE(poly_compress_d4) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 135| |#elif MLKEM_DV == 5 136| | mlk_poly_compress_d5(r, a); 137| |#else 138| |#error "Invalid value of MLKEM_DV" 139| |#endif 140| 56|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_decompress_dv: 166| 28|{ 167| 28|#if MLKEM_DV == 4 168| 28| mlk_poly_decompress_d4(r, a); ------------------ | | 377| 28|#define mlk_poly_decompress_d4 MLK_NAMESPACE(poly_decompress_d4) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 169| |#elif MLKEM_DV == 5 170| | mlk_poly_decompress_d5(r, a); 171| |#else 172| |#error "Invalid value of MLKEM_DV" 173| |#endif 174| 28|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_rej_uniform_x4: 158| 168|{ 159| | /* Temporary buffers for XOF output before rejection sampling */ 160| 168| MLK_ALIGN uint8_t ------------------ | | 190| 168|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 161| 168| buf[4][MLK_ALIGN_UP(MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE)]; 162| | 163| | /* Tracks the number of coefficients we have already sampled */ 164| 168| unsigned ctr[4]; 165| 168| mlk_xof_x4_ctx statex; ------------------ | | 51| 168|#define mlk_xof_x4_ctx mlk_shake128x4ctx | | ------------------ | | | | 13| 168|#define mlk_shake128x4ctx shake128x4ctx | | | | ------------------ | | | | | | 51| 168|#define shake128x4ctx shake128x4incctx | | | | | | ------------------ | | | | | | | | 18| 168|#define shake128x4incctx OQS_SHA3_shake128_x4_inc_ctx | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 166| 168| unsigned buflen; 167| | 168| 168| mlk_xof_x4_init(&statex); ------------------ | | 59| 168|#define mlk_xof_x4_init(CTX) mlk_shake128x4_init((CTX)) | | ------------------ | | | | 16| 168|#define mlk_shake128x4_init shake128x4_init | | | | ------------------ | | | | | | 52| 168|#define shake128x4_init shake128x4_inc_init | | | | | | ------------------ | | | | | | | | 19| 168|#define shake128x4_inc_init OQS_SHA3_shake128_x4_inc_init | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 169| 168| mlk_xof_x4_absorb(&statex, seed, MLKEM_SYMBYTES + 2); ------------------ | | 61| 168| mlk_shake128x4_absorb_once((CTX), (IN)[0], (IN)[1], (IN)[2], (IN)[3], \ | | ------------------ | | | | 14| 168|#define mlk_shake128x4_absorb_once shake128x4_absorb_once | | | | ------------------ | | | | | | 39| 168|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once | | | | ------------------ | | ------------------ | | 62| 168| (INBYTES)) ------------------ 170| | 171| | /* 172| | * Initially, squeeze heuristic number of MLKEM_GEN_MATRIX_NBLOCKS. 173| | * This should generate the matrix entries with high probability. 174| | */ 175| 168| mlk_xof_x4_squeezeblocks(buf, MLKEM_GEN_MATRIX_NBLOCKS, &statex); ------------------ | | 64| 168| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 168|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 168| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 168|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 168| (NBLOCKS), (CTX)) ------------------ 176| 168| buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 146| 168| ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 22| 168|#define MLKEM_N 256 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 23| 168|#define MLKEM_Q 3329 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 68| 168|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 168|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 168|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 147| 168| MLK_XOF_RATE) | | ------------------ | | | | 68| 168|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 168|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 168|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 68| 168|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 168|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 168|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 177| 168| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, 0, buf[0], buflen); ------------------ | | 22| 168|#define MLKEM_N 256 ------------------ 178| 168| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, 0, buf[1], buflen); ------------------ | | 22| 168|#define MLKEM_N 256 ------------------ 179| 168| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, 0, buf[2], buflen); ------------------ | | 22| 168|#define MLKEM_N 256 ------------------ 180| 168| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, 0, buf[3], buflen); ------------------ | | 22| 168|#define MLKEM_N 256 ------------------ 181| | 182| | /* 183| | * So long as not all matrix entries have been generated, squeeze 184| | * one more block a time until we're done. 185| | */ 186| 168| buflen = MLK_XOF_RATE; ------------------ | | 68| 168|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 168|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 168|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 187| 245| while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 490|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 466|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 442|#define MLKEM_N 256 ------------------ | Branch (187:10): [True: 24, False: 221] | Branch (187:30): [True: 24, False: 197] | Branch (187:50): [True: 14, False: 183] ------------------ 188| 183| ctr[3] < MLKEM_N) ------------------ | | 22| 183|#define MLKEM_N 256 ------------------ | Branch (188:10): [True: 15, False: 168] ------------------ 189| 77| __loop__( 190| 77| assigns(ctr, statex, 191| 77| memory_slice(vec0, sizeof(mlk_poly)), 192| 77| memory_slice(vec1, sizeof(mlk_poly)), 193| 77| memory_slice(vec2, sizeof(mlk_poly)), 194| 77| memory_slice(vec3, sizeof(mlk_poly)), 195| 77| object_whole(buf)) 196| 77| invariant(ctr[0] <= MLKEM_N && ctr[1] <= MLKEM_N) 197| 77| invariant(ctr[2] <= MLKEM_N && ctr[3] <= MLKEM_N) 198| 77| invariant(array_bound(vec0->coeffs, 0, ctr[0], 0, MLKEM_Q)) 199| 77| invariant(array_bound(vec1->coeffs, 0, ctr[1], 0, MLKEM_Q)) 200| 77| invariant(array_bound(vec2->coeffs, 0, ctr[2], 0, MLKEM_Q)) 201| 77| invariant(array_bound(vec3->coeffs, 0, ctr[3], 0, MLKEM_Q))) 202| 77| { 203| 77| mlk_xof_x4_squeezeblocks(buf, 1, &statex); ------------------ | | 64| 77| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 77|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 77| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 77|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 77| (NBLOCKS), (CTX)) ------------------ 204| 77| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, ctr[0], buf[0], buflen); ------------------ | | 22| 77|#define MLKEM_N 256 ------------------ 205| 77| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, ctr[1], buf[1], buflen); ------------------ | | 22| 77|#define MLKEM_N 256 ------------------ 206| 77| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, ctr[2], buf[2], buflen); ------------------ | | 22| 77|#define MLKEM_N 256 ------------------ 207| 77| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, ctr[3], buf[3], buflen); ------------------ | | 22| 77|#define MLKEM_N 256 ------------------ 208| 77| } 209| | 210| 168| mlk_xof_x4_release(&statex); ------------------ | | 66| 168|#define mlk_xof_x4_release(CTX) mlk_shake128x4_release((CTX)) | | ------------------ | | | | 17| 168|#define mlk_shake128x4_release shake128x4_release | | | | ------------------ | | | | | | 53| 168|#define shake128x4_release shake128x4_inc_ctx_release | | | | | | ------------------ | | | | | | | | 23| 168|#define shake128x4_inc_ctx_release OQS_SHA3_shake128_x4_inc_ctx_release | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 211| | 212| | /* Specification: Partially implements 213| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 214| 168| mlk_zeroize(buf, sizeof(buf)); 215| 168|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_rej_uniform: 220| 84|{ 221| 84| mlk_xof_ctx state; ------------------ | | 50| 84|#define mlk_xof_ctx mlk_shake128ctx | | ------------------ | | | | 13| 84|#define mlk_shake128ctx shake128ctx | | | | ------------------ | | | | | | 54| 84|#define shake128ctx shake128incctx | | | | | | ------------------ | | | | | | | | 38| 84|#define shake128incctx OQS_SHA3_shake128_inc_ctx | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 222| 84| MLK_ALIGN uint8_t buf[MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE]; ------------------ | | 190| 84|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 223| 84| unsigned ctr, buflen; 224| | 225| 84| mlk_xof_init(&state); ------------------ | | 52| 84|#define mlk_xof_init(CTX) mlk_shake128_init((CTX)) | | ------------------ | | | | 16| 84|#define mlk_shake128_init shake128_init | | | | ------------------ | | | | | | 56| 84|#define shake128_init shake128_inc_init | | | | | | ------------------ | | | | | | | | 39| 84|#define shake128_inc_init OQS_SHA3_shake128_inc_init | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 226| 84| mlk_xof_absorb(&state, seed, MLKEM_SYMBYTES + 2); ------------------ | | 54| 84| mlk_shake128_absorb_once((CTX), (IN), (INBYTES)) | | ------------------ | | | | 14| 84|#define mlk_shake128_absorb_once shake128_absorb_once | | | | ------------------ | | | | | | 57| 84|#define shake128_absorb_once OQS_SHA3_shake128_absorb_once | | | | ------------------ | | ------------------ ------------------ 227| | 228| | /* Initially, squeeze + sample heuristic number of MLKEM_GEN_MATRIX_NBLOCKS. 229| | */ 230| | /* This should generate the matrix entry with high probability. */ 231| 84| mlk_xof_squeezeblocks(buf, MLKEM_GEN_MATRIX_NBLOCKS, &state); ------------------ | | 56| 84| mlk_shake128_squeezeblocks((BUF), (NBLOCKS), (CTX)) | | ------------------ | | | | 15| 84|#define mlk_shake128_squeezeblocks shake128_squeezeblocks | | | | ------------------ | | | | | | 64| 84| OQS_SHA3_shake128_inc_squeeze(OUT, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 84|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 232| 84| buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 146| 84| ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 22| 84|#define MLKEM_N 256 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 23| 84|#define MLKEM_Q 3329 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 68| 84|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 84|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 84|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 147| 84| MLK_XOF_RATE) | | ------------------ | | | | 68| 84|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 84|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 84|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 68| 84|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 84|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 84|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 233| 84| ctr = mlk_rej_uniform(entry->coeffs, MLKEM_N, 0, buf, buflen); ------------------ | | 22| 84|#define MLKEM_N 256 ------------------ 234| | 235| | /* Squeeze + sample one more block a time until we're done */ 236| 84| buflen = MLK_XOF_RATE; ------------------ | | 68| 84|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 84|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 84|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 237| 102| while (ctr < MLKEM_N) ------------------ | | 22| 102|#define MLKEM_N 256 ------------------ | Branch (237:10): [True: 18, False: 84] ------------------ 238| 18| __loop__( 239| 18| assigns(ctr, state, memory_slice(entry, sizeof(mlk_poly)), object_whole(buf)) 240| 18| invariant(ctr <= MLKEM_N) 241| 18| invariant(array_bound(entry->coeffs, 0, ctr, 0, MLKEM_Q))) 242| 18| { 243| 18| mlk_xof_squeezeblocks(buf, 1, &state); ------------------ | | 56| 18| mlk_shake128_squeezeblocks((BUF), (NBLOCKS), (CTX)) | | ------------------ | | | | 15| 18|#define mlk_shake128_squeezeblocks shake128_squeezeblocks | | | | ------------------ | | | | | | 64| 18| OQS_SHA3_shake128_inc_squeeze(OUT, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 18|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| 18| ctr = mlk_rej_uniform(entry->coeffs, MLKEM_N, ctr, buf, buflen); ------------------ | | 22| 18|#define MLKEM_N 256 ------------------ 245| 18| } 246| | 247| 84| mlk_xof_release(&state); ------------------ | | 57| 84|#define mlk_xof_release(CTX) mlk_shake128_release((CTX)) | | ------------------ | | | | 17| 84|#define mlk_shake128_release shake128_release | | | | ------------------ | | | | | | 55| 84|#define shake128_release shake128_inc_ctx_release | | | | | | ------------------ | | | | | | | | 43| 84|#define shake128_inc_ctx_release OQS_SHA3_shake128_inc_ctx_release | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 248| | 249| | /* Specification: Partially implements 250| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 251| 84| mlk_zeroize(buf, sizeof(buf)); 252| 84|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_cbd2: 276| 560|{ 277| 560| unsigned i; 278| 18.4k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 18.4k|#define MLKEM_N 256 ------------------ | Branch (278:15): [True: 17.9k, False: 560] ------------------ 279| 17.9k| __loop__( 280| 17.9k| invariant(i <= MLKEM_N / 8) 281| 17.9k| invariant(array_abs_bound(r->coeffs, 0, 8 * i, 3)) 282| 17.9k| decreases(MLKEM_N / 8 - i)) 283| 17.9k| { 284| 17.9k| unsigned j; 285| 17.9k| uint32_t t = mlk_load32_littleendian(buf + 4 * i); 286| 17.9k| uint32_t d = t & 0x55555555; 287| 17.9k| d += (t >> 1) & 0x55555555; 288| | 289| 161k| for (j = 0; j < 8; j++) ------------------ | Branch (289:17): [True: 143k, False: 17.9k] ------------------ 290| 143k| __loop__( 291| 143k| invariant(i <= MLKEM_N / 8 && j <= 8) 292| 143k| invariant(array_abs_bound(r->coeffs, 0, 8 * i + j, 3)) 293| 143k| decreases(8 - j)) 294| 143k| { 295| | /* Safety: The & 0x3 masks each value to 2 bits (range [0, 3]), so the 296| | * truncation and subsequent subtraction in int16_t is lossless. */ 297| 143k| const int16_t a = (int16_t)((d >> (4 * j + 0)) & 0x3); 298| 143k| const int16_t b = (int16_t)((d >> (4 * j + 2)) & 0x3); 299| 143k| r->coeffs[8 * i + j] = (int16_t)(a - b); 300| 143k| } 301| 17.9k| } 302| 560|} OQS_KEM_ntru_hps2048509_new: 9| 174|OQS_KEM *OQS_KEM_ntru_hps2048509_new(void) { 10| | 11| 174| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 174| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 174] ------------------ 13| 0| return NULL; 14| 0| } 15| 174| kem->method_name = OQS_KEM_alg_ntru_hps2048509; ------------------ | | 81| 174|#define OQS_KEM_alg_ntru_hps2048509 "NTRU-HPS-2048-509" ------------------ 16| 174| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 174| kem->claimed_nist_level = 1; 19| 174| kem->ind_cca = true; 20| | 21| 174| kem->length_public_key = OQS_KEM_ntru_hps2048509_length_public_key; ------------------ | | 9| 174|#define OQS_KEM_ntru_hps2048509_length_public_key 699 ------------------ 22| 174| kem->length_secret_key = OQS_KEM_ntru_hps2048509_length_secret_key; ------------------ | | 10| 174|#define OQS_KEM_ntru_hps2048509_length_secret_key 935 ------------------ 23| 174| kem->length_ciphertext = OQS_KEM_ntru_hps2048509_length_ciphertext; ------------------ | | 11| 174|#define OQS_KEM_ntru_hps2048509_length_ciphertext 699 ------------------ 24| 174| kem->length_shared_secret = OQS_KEM_ntru_hps2048509_length_shared_secret; ------------------ | | 12| 174|#define OQS_KEM_ntru_hps2048509_length_shared_secret 32 ------------------ 25| 174| kem->length_keypair_seed = OQS_KEM_ntru_hps2048509_length_keypair_seed; ------------------ | | 13| 174|#define OQS_KEM_ntru_hps2048509_length_keypair_seed 0 ------------------ 26| 174| kem->length_encaps_seed = OQS_KEM_ntru_hps2048509_length_encaps_seed; ------------------ | | 14| 174|#define OQS_KEM_ntru_hps2048509_length_encaps_seed 0 ------------------ 27| | 28| 174| kem->keypair = OQS_KEM_ntru_hps2048509_keypair; 29| 174| kem->keypair_derand = OQS_KEM_ntru_hps2048509_keypair_derand; 30| 174| kem->encaps = OQS_KEM_ntru_hps2048509_encaps; 31| 174| kem->encaps_derand = OQS_KEM_ntru_hps2048509_encaps_derand; 32| 174| kem->decaps = OQS_KEM_ntru_hps2048509_decaps; 33| | 34| 174| return kem; 35| 174|} OQS_KEM_ntru_hps2048509_keypair: 47| 174|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048509_keypair(uint8_t *public_key, uint8_t *secret_key) { 48| 174|#if defined(OQS_ENABLE_KEM_ntru_hps2048509_avx2) 49| 174|#if defined(OQS_DIST_BUILD) 50| 174| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (50:6): [True: 174, False: 0] | Branch (50:49): [True: 174, False: 0] ------------------ 51| 174|#endif /* OQS_DIST_BUILD */ 52| 174| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_keypair(public_key, secret_key); 53| 174|#if defined(OQS_DIST_BUILD) 54| 174| } else { 55| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_keypair(public_key, secret_key); 56| 0| } 57| 174|#endif /* OQS_DIST_BUILD */ 58| |#else 59| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_keypair(public_key, secret_key); 60| |#endif 61| 174|} OQS_KEM_ntru_hps2048509_encaps: 78| 174|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048509_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 174|#if defined(OQS_ENABLE_KEM_ntru_hps2048509_avx2) 80| 174|#if defined(OQS_DIST_BUILD) 81| 174| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (81:6): [True: 174, False: 0] | Branch (81:49): [True: 174, False: 0] ------------------ 82| 174|#endif /* OQS_DIST_BUILD */ 83| 174| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 174|#if defined(OQS_DIST_BUILD) 85| 174| } else { 86| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 174|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 174|} OQS_KEM_ntru_hps2048509_decaps: 94| 174|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048509_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 174|#if defined(OQS_ENABLE_KEM_ntru_hps2048509_avx2) 96| 174|#if defined(OQS_DIST_BUILD) 97| 174| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (97:6): [True: 174, False: 0] | Branch (97:49): [True: 174, False: 0] ------------------ 98| 174|#endif /* OQS_DIST_BUILD */ 99| 174| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 174|#if defined(OQS_DIST_BUILD) 101| 174| } else { 102| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 174|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 174|} OQS_KEM_ntru_hps2048677_new: 9| 15|OQS_KEM *OQS_KEM_ntru_hps2048677_new(void) { 10| | 11| 15| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 15| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 15] ------------------ 13| 0| return NULL; 14| 0| } 15| 15| kem->method_name = OQS_KEM_alg_ntru_hps2048677; ------------------ | | 83| 15|#define OQS_KEM_alg_ntru_hps2048677 "NTRU-HPS-2048-677" ------------------ 16| 15| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 15| kem->claimed_nist_level = 3; 19| 15| kem->ind_cca = true; 20| | 21| 15| kem->length_public_key = OQS_KEM_ntru_hps2048677_length_public_key; ------------------ | | 24| 15|#define OQS_KEM_ntru_hps2048677_length_public_key 930 ------------------ 22| 15| kem->length_secret_key = OQS_KEM_ntru_hps2048677_length_secret_key; ------------------ | | 25| 15|#define OQS_KEM_ntru_hps2048677_length_secret_key 1234 ------------------ 23| 15| kem->length_ciphertext = OQS_KEM_ntru_hps2048677_length_ciphertext; ------------------ | | 26| 15|#define OQS_KEM_ntru_hps2048677_length_ciphertext 930 ------------------ 24| 15| kem->length_shared_secret = OQS_KEM_ntru_hps2048677_length_shared_secret; ------------------ | | 27| 15|#define OQS_KEM_ntru_hps2048677_length_shared_secret 32 ------------------ 25| 15| kem->length_keypair_seed = OQS_KEM_ntru_hps2048677_length_keypair_seed; ------------------ | | 28| 15|#define OQS_KEM_ntru_hps2048677_length_keypair_seed 0 ------------------ 26| 15| kem->length_encaps_seed = OQS_KEM_ntru_hps2048677_length_encaps_seed; ------------------ | | 29| 15|#define OQS_KEM_ntru_hps2048677_length_encaps_seed 0 ------------------ 27| | 28| 15| kem->keypair = OQS_KEM_ntru_hps2048677_keypair; 29| 15| kem->keypair_derand = OQS_KEM_ntru_hps2048677_keypair_derand; 30| 15| kem->encaps = OQS_KEM_ntru_hps2048677_encaps; 31| 15| kem->encaps_derand = OQS_KEM_ntru_hps2048677_encaps_derand; 32| 15| kem->decaps = OQS_KEM_ntru_hps2048677_decaps; 33| | 34| 15| return kem; 35| 15|} OQS_KEM_ntru_hps2048677_keypair: 47| 15|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048677_keypair(uint8_t *public_key, uint8_t *secret_key) { 48| 15|#if defined(OQS_ENABLE_KEM_ntru_hps2048677_avx2) 49| 15|#if defined(OQS_DIST_BUILD) 50| 15| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (50:6): [True: 15, False: 0] | Branch (50:49): [True: 15, False: 0] ------------------ 51| 15|#endif /* OQS_DIST_BUILD */ 52| 15| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_keypair(public_key, secret_key); 53| 15|#if defined(OQS_DIST_BUILD) 54| 15| } else { 55| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_keypair(public_key, secret_key); 56| 0| } 57| 15|#endif /* OQS_DIST_BUILD */ 58| |#else 59| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_keypair(public_key, secret_key); 60| |#endif 61| 15|} OQS_KEM_ntru_hps2048677_encaps: 78| 15|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048677_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 15|#if defined(OQS_ENABLE_KEM_ntru_hps2048677_avx2) 80| 15|#if defined(OQS_DIST_BUILD) 81| 15| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (81:6): [True: 15, False: 0] | Branch (81:49): [True: 15, False: 0] ------------------ 82| 15|#endif /* OQS_DIST_BUILD */ 83| 15| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 15|#if defined(OQS_DIST_BUILD) 85| 15| } else { 86| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 15|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 15|} OQS_KEM_ntru_hps2048677_decaps: 94| 15|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048677_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 15|#if defined(OQS_ENABLE_KEM_ntru_hps2048677_avx2) 96| 15|#if defined(OQS_DIST_BUILD) 97| 15| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (97:6): [True: 15, False: 0] | Branch (97:49): [True: 15, False: 0] ------------------ 98| 15|#endif /* OQS_DIST_BUILD */ 99| 15| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 15|#if defined(OQS_DIST_BUILD) 101| 15| } else { 102| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 15|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 15|} OQS_KEM_ntru_hps40961229_new: 9| 34|OQS_KEM *OQS_KEM_ntru_hps40961229_new(void) { 10| | 11| 34| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 34| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 34] ------------------ 13| 0| return NULL; 14| 0| } 15| 34| kem->method_name = OQS_KEM_alg_ntru_hps40961229; ------------------ | | 87| 34|#define OQS_KEM_alg_ntru_hps40961229 "NTRU-HPS-4096-1229" ------------------ 16| 34| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 34| kem->claimed_nist_level = 5; 19| 34| kem->ind_cca = true; 20| | 21| 34| kem->length_public_key = OQS_KEM_ntru_hps40961229_length_public_key; ------------------ | | 54| 34|#define OQS_KEM_ntru_hps40961229_length_public_key 1842 ------------------ 22| 34| kem->length_secret_key = OQS_KEM_ntru_hps40961229_length_secret_key; ------------------ | | 55| 34|#define OQS_KEM_ntru_hps40961229_length_secret_key 2366 ------------------ 23| 34| kem->length_ciphertext = OQS_KEM_ntru_hps40961229_length_ciphertext; ------------------ | | 56| 34|#define OQS_KEM_ntru_hps40961229_length_ciphertext 1842 ------------------ 24| 34| kem->length_shared_secret = OQS_KEM_ntru_hps40961229_length_shared_secret; ------------------ | | 57| 34|#define OQS_KEM_ntru_hps40961229_length_shared_secret 32 ------------------ 25| 34| kem->length_keypair_seed = OQS_KEM_ntru_hps40961229_length_keypair_seed; ------------------ | | 58| 34|#define OQS_KEM_ntru_hps40961229_length_keypair_seed 0 ------------------ 26| 34| kem->length_encaps_seed = OQS_KEM_ntru_hps40961229_length_encaps_seed; ------------------ | | 59| 34|#define OQS_KEM_ntru_hps40961229_length_encaps_seed 0 ------------------ 27| | 28| 34| kem->keypair = OQS_KEM_ntru_hps40961229_keypair; 29| 34| kem->keypair_derand = OQS_KEM_ntru_hps40961229_keypair_derand; 30| 34| kem->encaps = OQS_KEM_ntru_hps40961229_encaps; 31| 34| kem->encaps_derand = OQS_KEM_ntru_hps40961229_encaps_derand; 32| 34| kem->decaps = OQS_KEM_ntru_hps40961229_decaps; 33| | 34| 34| return kem; 35| 34|} OQS_KEM_ntru_hps40961229_keypair: 41| 34|OQS_API OQS_STATUS OQS_KEM_ntru_hps40961229_keypair(uint8_t *public_key, uint8_t *secret_key) { 42| 34| return (OQS_STATUS) PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_keypair(public_key, secret_key); 43| 34|} OQS_KEM_ntru_hps40961229_encaps: 60| 34|OQS_API OQS_STATUS OQS_KEM_ntru_hps40961229_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 34| return (OQS_STATUS) PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 34|} OQS_KEM_ntru_hps40961229_decaps: 64| 34|OQS_API OQS_STATUS OQS_KEM_ntru_hps40961229_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 34| return (OQS_STATUS) PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 34|} OQS_KEM_ntru_hps4096821_new: 9| 84|OQS_KEM *OQS_KEM_ntru_hps4096821_new(void) { 10| | 11| 84| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 84| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 84] ------------------ 13| 0| return NULL; 14| 0| } 15| 84| kem->method_name = OQS_KEM_alg_ntru_hps4096821; ------------------ | | 85| 84|#define OQS_KEM_alg_ntru_hps4096821 "NTRU-HPS-4096-821" ------------------ 16| 84| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 84| kem->claimed_nist_level = 5; 19| 84| kem->ind_cca = true; 20| | 21| 84| kem->length_public_key = OQS_KEM_ntru_hps4096821_length_public_key; ------------------ | | 39| 84|#define OQS_KEM_ntru_hps4096821_length_public_key 1230 ------------------ 22| 84| kem->length_secret_key = OQS_KEM_ntru_hps4096821_length_secret_key; ------------------ | | 40| 84|#define OQS_KEM_ntru_hps4096821_length_secret_key 1590 ------------------ 23| 84| kem->length_ciphertext = OQS_KEM_ntru_hps4096821_length_ciphertext; ------------------ | | 41| 84|#define OQS_KEM_ntru_hps4096821_length_ciphertext 1230 ------------------ 24| 84| kem->length_shared_secret = OQS_KEM_ntru_hps4096821_length_shared_secret; ------------------ | | 42| 84|#define OQS_KEM_ntru_hps4096821_length_shared_secret 32 ------------------ 25| 84| kem->length_keypair_seed = OQS_KEM_ntru_hps4096821_length_keypair_seed; ------------------ | | 43| 84|#define OQS_KEM_ntru_hps4096821_length_keypair_seed 0 ------------------ 26| 84| kem->length_encaps_seed = OQS_KEM_ntru_hps4096821_length_encaps_seed; ------------------ | | 44| 84|#define OQS_KEM_ntru_hps4096821_length_encaps_seed 0 ------------------ 27| | 28| 84| kem->keypair = OQS_KEM_ntru_hps4096821_keypair; 29| 84| kem->keypair_derand = OQS_KEM_ntru_hps4096821_keypair_derand; 30| 84| kem->encaps = OQS_KEM_ntru_hps4096821_encaps; 31| 84| kem->encaps_derand = OQS_KEM_ntru_hps4096821_encaps_derand; 32| 84| kem->decaps = OQS_KEM_ntru_hps4096821_decaps; 33| | 34| 84| return kem; 35| 84|} OQS_KEM_ntru_hps4096821_keypair: 47| 84|OQS_API OQS_STATUS OQS_KEM_ntru_hps4096821_keypair(uint8_t *public_key, uint8_t *secret_key) { 48| 84|#if defined(OQS_ENABLE_KEM_ntru_hps4096821_avx2) 49| 84|#if defined(OQS_DIST_BUILD) 50| 84| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (50:6): [True: 84, False: 0] | Branch (50:49): [True: 84, False: 0] ------------------ 51| 84|#endif /* OQS_DIST_BUILD */ 52| 84| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_keypair(public_key, secret_key); 53| 84|#if defined(OQS_DIST_BUILD) 54| 84| } else { 55| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_keypair(public_key, secret_key); 56| 0| } 57| 84|#endif /* OQS_DIST_BUILD */ 58| |#else 59| | return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_keypair(public_key, secret_key); 60| |#endif 61| 84|} OQS_KEM_ntru_hps4096821_encaps: 78| 84|OQS_API OQS_STATUS OQS_KEM_ntru_hps4096821_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 84|#if defined(OQS_ENABLE_KEM_ntru_hps4096821_avx2) 80| 84|#if defined(OQS_DIST_BUILD) 81| 84| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (81:6): [True: 84, False: 0] | Branch (81:49): [True: 84, False: 0] ------------------ 82| 84|#endif /* OQS_DIST_BUILD */ 83| 84| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 84|#if defined(OQS_DIST_BUILD) 85| 84| } else { 86| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 84|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 84|} OQS_KEM_ntru_hps4096821_decaps: 94| 84|OQS_API OQS_STATUS OQS_KEM_ntru_hps4096821_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 84|#if defined(OQS_ENABLE_KEM_ntru_hps4096821_avx2) 96| 84|#if defined(OQS_DIST_BUILD) 97| 84| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (97:6): [True: 84, False: 0] | Branch (97:49): [True: 84, False: 0] ------------------ 98| 84|#endif /* OQS_DIST_BUILD */ 99| 84| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 84|#if defined(OQS_DIST_BUILD) 101| 84| } else { 102| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 84|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 84|} OQS_KEM_ntru_hrss1373_new: 9| 2|OQS_KEM *OQS_KEM_ntru_hrss1373_new(void) { 10| | 11| 2| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 2| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 2] ------------------ 13| 0| return NULL; 14| 0| } 15| 2| kem->method_name = OQS_KEM_alg_ntru_hrss1373; ------------------ | | 91| 2|#define OQS_KEM_alg_ntru_hrss1373 "NTRU-HRSS-1373" ------------------ 16| 2| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 2| kem->claimed_nist_level = 5; 19| 2| kem->ind_cca = true; 20| | 21| 2| kem->length_public_key = OQS_KEM_ntru_hrss1373_length_public_key; ------------------ | | 84| 2|#define OQS_KEM_ntru_hrss1373_length_public_key 2401 ------------------ 22| 2| kem->length_secret_key = OQS_KEM_ntru_hrss1373_length_secret_key; ------------------ | | 85| 2|#define OQS_KEM_ntru_hrss1373_length_secret_key 2983 ------------------ 23| 2| kem->length_ciphertext = OQS_KEM_ntru_hrss1373_length_ciphertext; ------------------ | | 86| 2|#define OQS_KEM_ntru_hrss1373_length_ciphertext 2401 ------------------ 24| 2| kem->length_shared_secret = OQS_KEM_ntru_hrss1373_length_shared_secret; ------------------ | | 87| 2|#define OQS_KEM_ntru_hrss1373_length_shared_secret 32 ------------------ 25| 2| kem->length_keypair_seed = OQS_KEM_ntru_hrss1373_length_keypair_seed; ------------------ | | 88| 2|#define OQS_KEM_ntru_hrss1373_length_keypair_seed 0 ------------------ 26| 2| kem->length_encaps_seed = OQS_KEM_ntru_hrss1373_length_encaps_seed; ------------------ | | 89| 2|#define OQS_KEM_ntru_hrss1373_length_encaps_seed 0 ------------------ 27| | 28| 2| kem->keypair = OQS_KEM_ntru_hrss1373_keypair; 29| 2| kem->keypair_derand = OQS_KEM_ntru_hrss1373_keypair_derand; 30| 2| kem->encaps = OQS_KEM_ntru_hrss1373_encaps; 31| 2| kem->encaps_derand = OQS_KEM_ntru_hrss1373_encaps_derand; 32| 2| kem->decaps = OQS_KEM_ntru_hrss1373_decaps; 33| | 34| 2| return kem; 35| 2|} OQS_KEM_ntru_hrss1373_keypair: 41| 2|OQS_API OQS_STATUS OQS_KEM_ntru_hrss1373_keypair(uint8_t *public_key, uint8_t *secret_key) { 42| 2| return (OQS_STATUS) PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_keypair(public_key, secret_key); 43| 2|} OQS_KEM_ntru_hrss1373_encaps: 60| 2|OQS_API OQS_STATUS OQS_KEM_ntru_hrss1373_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 2| return (OQS_STATUS) PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 2|} OQS_KEM_ntru_hrss1373_decaps: 64| 2|OQS_API OQS_STATUS OQS_KEM_ntru_hrss1373_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 2| return (OQS_STATUS) PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 2|} OQS_KEM_ntru_hrss701_new: 9| 8|OQS_KEM *OQS_KEM_ntru_hrss701_new(void) { 10| | 11| 8| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 8| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 8] ------------------ 13| 0| return NULL; 14| 0| } 15| 8| kem->method_name = OQS_KEM_alg_ntru_hrss701; ------------------ | | 89| 8|#define OQS_KEM_alg_ntru_hrss701 "NTRU-HRSS-701" ------------------ 16| 8| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 8| kem->claimed_nist_level = 3; 19| 8| kem->ind_cca = true; 20| | 21| 8| kem->length_public_key = OQS_KEM_ntru_hrss701_length_public_key; ------------------ | | 69| 8|#define OQS_KEM_ntru_hrss701_length_public_key 1138 ------------------ 22| 8| kem->length_secret_key = OQS_KEM_ntru_hrss701_length_secret_key; ------------------ | | 70| 8|#define OQS_KEM_ntru_hrss701_length_secret_key 1450 ------------------ 23| 8| kem->length_ciphertext = OQS_KEM_ntru_hrss701_length_ciphertext; ------------------ | | 71| 8|#define OQS_KEM_ntru_hrss701_length_ciphertext 1138 ------------------ 24| 8| kem->length_shared_secret = OQS_KEM_ntru_hrss701_length_shared_secret; ------------------ | | 72| 8|#define OQS_KEM_ntru_hrss701_length_shared_secret 32 ------------------ 25| 8| kem->length_keypair_seed = OQS_KEM_ntru_hrss701_length_keypair_seed; ------------------ | | 73| 8|#define OQS_KEM_ntru_hrss701_length_keypair_seed 0 ------------------ 26| 8| kem->length_encaps_seed = OQS_KEM_ntru_hrss701_length_encaps_seed; ------------------ | | 74| 8|#define OQS_KEM_ntru_hrss701_length_encaps_seed 0 ------------------ 27| | 28| 8| kem->keypair = OQS_KEM_ntru_hrss701_keypair; 29| 8| kem->keypair_derand = OQS_KEM_ntru_hrss701_keypair_derand; 30| 8| kem->encaps = OQS_KEM_ntru_hrss701_encaps; 31| 8| kem->encaps_derand = OQS_KEM_ntru_hrss701_encaps_derand; 32| 8| kem->decaps = OQS_KEM_ntru_hrss701_decaps; 33| | 34| 8| return kem; 35| 8|} OQS_KEM_ntru_hrss701_keypair: 47| 8|OQS_API OQS_STATUS OQS_KEM_ntru_hrss701_keypair(uint8_t *public_key, uint8_t *secret_key) { 48| 8|#if defined(OQS_ENABLE_KEM_ntru_hrss701_avx2) 49| 8|#if defined(OQS_DIST_BUILD) 50| 8| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (50:6): [True: 8, False: 0] | Branch (50:49): [True: 8, False: 0] ------------------ 51| 8|#endif /* OQS_DIST_BUILD */ 52| 8| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_keypair(public_key, secret_key); 53| 8|#if defined(OQS_DIST_BUILD) 54| 8| } else { 55| 0| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_keypair(public_key, secret_key); 56| 0| } 57| 8|#endif /* OQS_DIST_BUILD */ 58| |#else 59| | return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_keypair(public_key, secret_key); 60| |#endif 61| 8|} OQS_KEM_ntru_hrss701_encaps: 78| 8|OQS_API OQS_STATUS OQS_KEM_ntru_hrss701_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 8|#if defined(OQS_ENABLE_KEM_ntru_hrss701_avx2) 80| 8|#if defined(OQS_DIST_BUILD) 81| 8| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (81:6): [True: 8, False: 0] | Branch (81:49): [True: 8, False: 0] ------------------ 82| 8|#endif /* OQS_DIST_BUILD */ 83| 8| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 8|#if defined(OQS_DIST_BUILD) 85| 8| } else { 86| 0| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 8|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 8|} OQS_KEM_ntru_hrss701_decaps: 94| 8|OQS_API OQS_STATUS OQS_KEM_ntru_hrss701_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 8|#if defined(OQS_ENABLE_KEM_ntru_hrss701_avx2) 96| 8|#if defined(OQS_DIST_BUILD) 97| 8| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (97:6): [True: 8, False: 0] | Branch (97:49): [True: 8, False: 0] ------------------ 98| 8|#endif /* OQS_DIST_BUILD */ 99| 8| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 8|#if defined(OQS_DIST_BUILD) 101| 8| } else { 102| 0| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 8|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 8|} PQCLEAN_NTRUHPS2048509_AVX2_cmov: 4| 174|void PQCLEAN_NTRUHPS2048509_AVX2_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 174| size_t i; 6| | 7| 174| b = (~b + 1); 8| 5.74k| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 5.56k, False: 174] ------------------ 9| 5.56k| r[i] ^= b & (x[i] ^ r[i]); 10| 5.56k| } 11| 174|} PQCLEAN_NTRUHPS2048509_AVX2_crypto_sort_int32: 903| 696|void PQCLEAN_NTRUHPS2048509_AVX2_crypto_sort_int32(int32 *x, size_t n) { 904| 696| size_t q, i, j; 905| | 906| 696| if (n <= 8) { ------------------ | Branch (906:9): [True: 0, False: 696] ------------------ 907| 0| if (n == 8) { ------------------ | Branch (907:13): [True: 0, False: 0] ------------------ 908| 0| int32_MINMAX(&x[0], &x[1]); 909| 0| int32_MINMAX(&x[1], &x[2]); 910| 0| int32_MINMAX(&x[2], &x[3]); 911| 0| int32_MINMAX(&x[3], &x[4]); 912| 0| int32_MINMAX(&x[4], &x[5]); 913| 0| int32_MINMAX(&x[5], &x[6]); 914| 0| int32_MINMAX(&x[6], &x[7]); 915| 0| } 916| 0| if (n >= 7) { ------------------ | Branch (916:13): [True: 0, False: 0] ------------------ 917| 0| int32_MINMAX(&x[0], &x[1]); 918| 0| int32_MINMAX(&x[1], &x[2]); 919| 0| int32_MINMAX(&x[2], &x[3]); 920| 0| int32_MINMAX(&x[3], &x[4]); 921| 0| int32_MINMAX(&x[4], &x[5]); 922| 0| int32_MINMAX(&x[5], &x[6]); 923| 0| } 924| 0| if (n >= 6) { ------------------ | Branch (924:13): [True: 0, False: 0] ------------------ 925| 0| int32_MINMAX(&x[0], &x[1]); 926| 0| int32_MINMAX(&x[1], &x[2]); 927| 0| int32_MINMAX(&x[2], &x[3]); 928| 0| int32_MINMAX(&x[3], &x[4]); 929| 0| int32_MINMAX(&x[4], &x[5]); 930| 0| } 931| 0| if (n >= 5) { ------------------ | Branch (931:13): [True: 0, False: 0] ------------------ 932| 0| int32_MINMAX(&x[0], &x[1]); 933| 0| int32_MINMAX(&x[1], &x[2]); 934| 0| int32_MINMAX(&x[2], &x[3]); 935| 0| int32_MINMAX(&x[3], &x[4]); 936| 0| } 937| 0| if (n >= 4) { ------------------ | Branch (937:13): [True: 0, False: 0] ------------------ 938| 0| int32_MINMAX(&x[0], &x[1]); 939| 0| int32_MINMAX(&x[1], &x[2]); 940| 0| int32_MINMAX(&x[2], &x[3]); 941| 0| } 942| 0| if (n >= 3) { ------------------ | Branch (942:13): [True: 0, False: 0] ------------------ 943| 0| int32_MINMAX(&x[0], &x[1]); 944| 0| int32_MINMAX(&x[1], &x[2]); 945| 0| } 946| 0| if (n >= 2) { ------------------ | Branch (946:13): [True: 0, False: 0] ------------------ 947| 0| int32_MINMAX(&x[0], &x[1]); 948| 0| } 949| 0| return; 950| 0| } 951| | 952| 696| if (!(n & (n - 1))) { ------------------ | Branch (952:9): [True: 0, False: 696] ------------------ 953| 0| int32_sort_2power(x, n, 0); 954| 0| return; 955| 0| } 956| | 957| 696| q = 8; 958| 3.82k| while (q < n - q) { ------------------ | Branch (958:12): [True: 3.13k, False: 696] ------------------ 959| 3.13k| q += q; 960| 3.13k| } 961| | /* n > q >= 8 */ 962| | 963| 696| if (q <= 128) { /* n <= 256 */ ------------------ | Branch (963:9): [True: 348, False: 348] ------------------ 964| 348| int32x8 y[32]; 965| 5.91k| for (i = q >> 3; i < q >> 2; ++i) { ------------------ | Branch (965:26): [True: 5.56k, False: 348] ------------------ 966| 5.56k| y[i] = _mm256_set1_epi32(0x7fffffff); 967| 5.56k| } 968| 88.0k| for (i = 0; i < n; ++i) { ------------------ | Branch (968:21): [True: 87.6k, False: 348] ------------------ 969| 87.6k| ((int32 *) y)[i] = x[i]; 970| 87.6k| } 971| 348| int32_sort_2power((int32 *) y, 2 * q, 0); 972| 88.0k| for (i = 0; i < n; ++i) { ------------------ | Branch (972:21): [True: 87.6k, False: 348] ------------------ 973| 87.6k| x[i] = ((int32 *) y)[i]; 974| 87.6k| } 975| 348| return; 976| 348| } 977| | 978| 348| int32_sort_2power(x, q, 1); 979| 348| PQCLEAN_NTRUHPS2048509_AVX2_crypto_sort_int32(x + q, n - q); 980| | 981| 696| while (q >= 64) { ------------------ | Branch (981:12): [True: 348, False: 348] ------------------ 982| 348| q >>= 2; 983| 348| j = int32_threestages(x, n, q); 984| 348| minmax_vector(x + j, x + j + 4 * q, n - 4 * q - j); 985| 348| if (j + 4 * q <= n) { ------------------ | Branch (985:13): [True: 348, False: 0] ------------------ 986| 3.13k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (986:25): [True: 2.78k, False: 348] ------------------ 987| 2.78k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 2.78k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 988| 2.78k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 2.78k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 989| 2.78k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 2.78k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 990| 2.78k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 2.78k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 991| 2.78k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 2.78k| do { \ | | 16| 2.78k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.78k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.78k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.78k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.78k| (a) = c; \ | | 19| 2.78k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.78k] | | ------------------ ------------------ 992| 2.78k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 2.78k| do { \ | | 16| 2.78k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.78k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.78k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.78k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.78k| (a) = c; \ | | 19| 2.78k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.78k] | | ------------------ ------------------ 993| 2.78k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 2.78k| do { \ | | 16| 2.78k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.78k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.78k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.78k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.78k| (a) = c; \ | | 19| 2.78k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.78k] | | ------------------ ------------------ 994| 2.78k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 2.78k| do { \ | | 16| 2.78k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.78k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.78k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.78k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.78k| (a) = c; \ | | 19| 2.78k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.78k] | | ------------------ ------------------ 995| 2.78k| int32x8_store(&x[i], x0); ------------------ | | 10| 2.78k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 996| 2.78k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 2.78k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 997| 2.78k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 2.78k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 998| 2.78k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 2.78k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 999| 2.78k| } 1000| 348| j += 4 * q; 1001| 348| } 1002| 348| minmax_vector(x + j, x + j + 2 * q, n - 2 * q - j); 1003| 348| if (j + 2 * q <= n) { ------------------ | Branch (1003:13): [True: 348, False: 0] ------------------ 1004| 3.13k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (1004:25): [True: 2.78k, False: 348] ------------------ 1005| 2.78k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 2.78k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1006| 2.78k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 2.78k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1007| 2.78k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 2.78k| do { \ | | 16| 2.78k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.78k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.78k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.78k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.78k| (a) = c; \ | | 19| 2.78k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.78k] | | ------------------ ------------------ 1008| 2.78k| int32x8_store(&x[i], x0); ------------------ | | 10| 2.78k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1009| 2.78k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 2.78k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1010| 2.78k| } 1011| 348| j += 2 * q; 1012| 348| } 1013| 348| minmax_vector(x + j, x + j + q, n - q - j); 1014| 348| q >>= 1; 1015| 348| } 1016| 348| if (q == 32) { ------------------ | Branch (1016:9): [True: 348, False: 0] ------------------ 1017| 348| j = 0; 1018| 2.78k| for (; j + 64 <= n; j += 64) { ------------------ | Branch (1018:16): [True: 2.43k, False: 348] ------------------ 1019| 2.43k| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 2.43k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1020| 2.43k| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 2.43k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1021| 2.43k| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 2.43k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1022| 2.43k| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 2.43k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1023| 2.43k| int32x8 x4 = int32x8_load(&x[j + 32]); ------------------ | | 9| 2.43k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1024| 2.43k| int32x8 x5 = int32x8_load(&x[j + 40]); ------------------ | | 9| 2.43k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1025| 2.43k| int32x8 x6 = int32x8_load(&x[j + 48]); ------------------ | | 9| 2.43k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1026| 2.43k| int32x8 x7 = int32x8_load(&x[j + 56]); ------------------ | | 9| 2.43k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1027| 2.43k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1028| 2.43k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1029| 2.43k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1030| 2.43k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1031| 2.43k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1032| 2.43k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1033| 2.43k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1034| 2.43k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1035| 2.43k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1036| 2.43k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1037| 2.43k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1038| 2.43k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1039| 2.43k| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1040| 2.43k| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1041| 2.43k| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1042| 2.43k| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1043| 2.43k| int32x8 a4 = _mm256_permute2x128_si256(x4, x5, 0x20); 1044| 2.43k| int32x8 a5 = _mm256_permute2x128_si256(x4, x5, 0x31); 1045| 2.43k| int32x8 a6 = _mm256_permute2x128_si256(x6, x7, 0x20); 1046| 2.43k| int32x8 a7 = _mm256_permute2x128_si256(x6, x7, 0x31); 1047| 2.43k| int32x8_MINMAX(a0, a1); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1048| 2.43k| int32x8_MINMAX(a2, a3); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1049| 2.43k| int32x8_MINMAX(a4, a5); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1050| 2.43k| int32x8_MINMAX(a6, a7); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1051| 2.43k| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1052| 2.43k| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1053| 2.43k| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1054| 2.43k| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1055| 2.43k| int32x8 b4 = _mm256_permute2x128_si256(a4, a5, 0x20); 1056| 2.43k| int32x8 b5 = _mm256_permute2x128_si256(a4, a5, 0x31); 1057| 2.43k| int32x8 b6 = _mm256_permute2x128_si256(a6, a7, 0x20); 1058| 2.43k| int32x8 b7 = _mm256_permute2x128_si256(a6, a7, 0x31); 1059| 2.43k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1060| 2.43k| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1061| 2.43k| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1062| 2.43k| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1063| 2.43k| int32x8 c4 = _mm256_unpacklo_epi64(b4, b5); 1064| 2.43k| int32x8 c5 = _mm256_unpackhi_epi64(b4, b5); 1065| 2.43k| int32x8 c6 = _mm256_unpacklo_epi64(b6, b7); 1066| 2.43k| int32x8 c7 = _mm256_unpackhi_epi64(b6, b7); 1067| 2.43k| int32x8_MINMAX(c0, c1); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1068| 2.43k| int32x8_MINMAX(c2, c3); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1069| 2.43k| int32x8_MINMAX(c4, c5); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1070| 2.43k| int32x8_MINMAX(c6, c7); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1071| 2.43k| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1072| 2.43k| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1073| 2.43k| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1074| 2.43k| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1075| 2.43k| int32x8 d4 = _mm256_unpacklo_epi32(c4, c5); 1076| 2.43k| int32x8 d5 = _mm256_unpackhi_epi32(c4, c5); 1077| 2.43k| int32x8 d6 = _mm256_unpacklo_epi32(c6, c7); 1078| 2.43k| int32x8 d7 = _mm256_unpackhi_epi32(c6, c7); 1079| 2.43k| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1080| 2.43k| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1081| 2.43k| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1082| 2.43k| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1083| 2.43k| int32x8 e4 = _mm256_unpacklo_epi64(d4, d5); 1084| 2.43k| int32x8 e5 = _mm256_unpackhi_epi64(d4, d5); 1085| 2.43k| int32x8 e6 = _mm256_unpacklo_epi64(d6, d7); 1086| 2.43k| int32x8 e7 = _mm256_unpackhi_epi64(d6, d7); 1087| 2.43k| int32x8_MINMAX(e0, e1); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1088| 2.43k| int32x8_MINMAX(e2, e3); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1089| 2.43k| int32x8_MINMAX(e4, e5); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1090| 2.43k| int32x8_MINMAX(e6, e7); ------------------ | | 15| 2.43k| do { \ | | 16| 2.43k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.43k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.43k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.43k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.43k| (a) = c; \ | | 19| 2.43k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.43k] | | ------------------ ------------------ 1091| 2.43k| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1092| 2.43k| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1093| 2.43k| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1094| 2.43k| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1095| 2.43k| int32x8 f4 = _mm256_unpacklo_epi32(e4, e5); 1096| 2.43k| int32x8 f5 = _mm256_unpackhi_epi32(e4, e5); 1097| 2.43k| int32x8 f6 = _mm256_unpacklo_epi32(e6, e7); 1098| 2.43k| int32x8 f7 = _mm256_unpackhi_epi32(e6, e7); 1099| 2.43k| int32x8_store(&x[j], f0); ------------------ | | 10| 2.43k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1100| 2.43k| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 2.43k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1101| 2.43k| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 2.43k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1102| 2.43k| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 2.43k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1103| 2.43k| int32x8_store(&x[j + 32], f4); ------------------ | | 10| 2.43k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1104| 2.43k| int32x8_store(&x[j + 40], f5); ------------------ | | 10| 2.43k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1105| 2.43k| int32x8_store(&x[j + 48], f6); ------------------ | | 10| 2.43k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1106| 2.43k| int32x8_store(&x[j + 56], f7); ------------------ | | 10| 2.43k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1107| 2.43k| } 1108| 348| minmax_vector(x + j, x + j + 32, n - 32 - j); 1109| 348| goto continue16; 1110| 348| } 1111| 0| if (q == 16) { ------------------ | Branch (1111:9): [True: 0, False: 0] ------------------ 1112| 0| j = 0; 1113| 348|continue16: 1114| 696| for (; j + 32 <= n; j += 32) { ------------------ | Branch (1114:16): [True: 348, False: 348] ------------------ 1115| 348| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 348|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1116| 348| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 348|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1117| 348| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 348|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1118| 348| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 348|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1119| 348| int32x8_MINMAX(x0, x2); ------------------ | | 15| 348| do { \ | | 16| 348| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 348|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 348| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 348|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 348| (a) = c; \ | | 19| 348| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 348] | | ------------------ ------------------ 1120| 348| int32x8_MINMAX(x1, x3); ------------------ | | 15| 348| do { \ | | 16| 348| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 348|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 348| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 348|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 348| (a) = c; \ | | 19| 348| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 348] | | ------------------ ------------------ 1121| 348| int32x8_MINMAX(x0, x1); ------------------ | | 15| 348| do { \ | | 16| 348| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 348|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 348| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 348|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 348| (a) = c; \ | | 19| 348| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 348] | | ------------------ ------------------ 1122| 348| int32x8_MINMAX(x2, x3); ------------------ | | 15| 348| do { \ | | 16| 348| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 348|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 348| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 348|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 348| (a) = c; \ | | 19| 348| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 348] | | ------------------ ------------------ 1123| 348| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1124| 348| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1125| 348| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1126| 348| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1127| 348| int32x8_MINMAX(a0, a1); ------------------ | | 15| 348| do { \ | | 16| 348| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 348|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 348| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 348|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 348| (a) = c; \ | | 19| 348| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 348] | | ------------------ ------------------ 1128| 348| int32x8_MINMAX(a2, a3); ------------------ | | 15| 348| do { \ | | 16| 348| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 348|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 348| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 348|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 348| (a) = c; \ | | 19| 348| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 348] | | ------------------ ------------------ 1129| 348| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1130| 348| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1131| 348| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1132| 348| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1133| 348| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1134| 348| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1135| 348| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1136| 348| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1137| 348| int32x8_MINMAX(c0, c1); ------------------ | | 15| 348| do { \ | | 16| 348| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 348|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 348| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 348|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 348| (a) = c; \ | | 19| 348| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 348] | | ------------------ ------------------ 1138| 348| int32x8_MINMAX(c2, c3); ------------------ | | 15| 348| do { \ | | 16| 348| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 348|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 348| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 348|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 348| (a) = c; \ | | 19| 348| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 348] | | ------------------ ------------------ 1139| 348| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1140| 348| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1141| 348| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1142| 348| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1143| 348| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1144| 348| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1145| 348| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1146| 348| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1147| 348| int32x8_MINMAX(e0, e1); ------------------ | | 15| 348| do { \ | | 16| 348| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 348|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 348| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 348|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 348| (a) = c; \ | | 19| 348| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 348] | | ------------------ ------------------ 1148| 348| int32x8_MINMAX(e2, e3); ------------------ | | 15| 348| do { \ | | 16| 348| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 348|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 348| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 348|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 348| (a) = c; \ | | 19| 348| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 348] | | ------------------ ------------------ 1149| 348| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1150| 348| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1151| 348| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1152| 348| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1153| 348| int32x8_store(&x[j], f0); ------------------ | | 10| 348|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1154| 348| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 348|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1155| 348| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 348|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1156| 348| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 348|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1157| 348| } 1158| 348| minmax_vector(x + j, x + j + 16, n - 16 - j); 1159| 348| goto continue8; 1160| 0| } 1161| | /* q == 8 */ 1162| 0| j = 0; 1163| 348|continue8: 1164| 696| for (; j + 16 <= n; j += 16) { ------------------ | Branch (1164:12): [True: 348, False: 348] ------------------ 1165| 348| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 348|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1166| 348| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 348|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1167| 348| int32x8_MINMAX(x0, x1); ------------------ | | 15| 348| do { \ | | 16| 348| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 348|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 348| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 348|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 348| (a) = c; \ | | 19| 348| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 348] | | ------------------ ------------------ 1168| 348| int32x8_store(&x[j], x0); ------------------ | | 10| 348|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1169| 348| int32x8_store(&x[j + 8], x1); ------------------ | | 10| 348|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1170| 348| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); /* x0123y0123 */ 1171| 348| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); /* x4567y4567 */ 1172| 348| int32x8_MINMAX(a0, a1); ------------------ | | 15| 348| do { \ | | 16| 348| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 348|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 348| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 348|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 348| (a) = c; \ | | 19| 348| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 348] | | ------------------ ------------------ 1173| 348| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); /* x01234567 */ 1174| 348| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); /* y01234567 */ 1175| 348| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); /* x01y01x45y45 */ 1176| 348| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); /* x23y23x67y67 */ 1177| 348| int32x8_MINMAX(c0, c1); ------------------ | | 15| 348| do { \ | | 16| 348| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 348|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 348| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 348|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 348| (a) = c; \ | | 19| 348| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 348] | | ------------------ ------------------ 1178| 348| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); /* x02x13x46x57 */ 1179| 348| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); /* y02y13y46y57 */ 1180| 348| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); /* x02y02x46y46 */ 1181| 348| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); /* x13y13x57y57 */ 1182| 348| int32x8_MINMAX(e0, e1); ------------------ | | 15| 348| do { \ | | 16| 348| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 348|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 348| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 348|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 348| (a) = c; \ | | 19| 348| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 348] | | ------------------ ------------------ 1183| 348| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); /* x01234567 */ 1184| 348| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); /* y01234567 */ 1185| 348| int32x8_store(&x[j], f0); ------------------ | | 10| 348|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1186| 348| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 348|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1187| 348| } 1188| 348| minmax_vector(x + j, x + j + 8, n - 8 - j); 1189| 348| if (j + 8 <= n) { ------------------ | Branch (1189:9): [True: 348, False: 0] ------------------ 1190| 348| int32_MINMAX(&x[j], &x[j + 4]); 1191| 348| int32_MINMAX(&x[j + 1], &x[j + 5]); 1192| 348| int32_MINMAX(&x[j + 2], &x[j + 6]); 1193| 348| int32_MINMAX(&x[j + 3], &x[j + 7]); 1194| 348| int32_MINMAX(&x[j], &x[j + 2]); 1195| 348| int32_MINMAX(&x[j + 1], &x[j + 3]); 1196| 348| int32_MINMAX(&x[j], &x[j + 1]); 1197| 348| int32_MINMAX(&x[j + 2], &x[j + 3]); 1198| 348| int32_MINMAX(&x[j + 4], &x[j + 6]); 1199| 348| int32_MINMAX(&x[j + 5], &x[j + 7]); 1200| 348| int32_MINMAX(&x[j + 4], &x[j + 5]); 1201| 348| int32_MINMAX(&x[j + 6], &x[j + 7]); 1202| 348| j += 8; 1203| 348| } 1204| 348| minmax_vector(x + j, x + j + 4, n - 4 - j); 1205| 348| if (j + 4 <= n) { ------------------ | Branch (1205:9): [True: 348, False: 0] ------------------ 1206| 348| int32_MINMAX(&x[j], &x[j + 2]); 1207| 348| int32_MINMAX(&x[j + 1], &x[j + 3]); 1208| 348| int32_MINMAX(&x[j], &x[j + 1]); 1209| 348| int32_MINMAX(&x[j + 2], &x[j + 3]); 1210| 348| j += 4; 1211| 348| } 1212| 348| if (j + 3 <= n) { ------------------ | Branch (1212:9): [True: 0, False: 348] ------------------ 1213| 0| int32_MINMAX(&x[j], &x[j + 2]); 1214| 0| } 1215| 348| if (j + 2 <= n) { ------------------ | Branch (1215:9): [True: 0, False: 348] ------------------ 1216| 0| int32_MINMAX(&x[j], &x[j + 1]); 1217| 0| } 1218| 348|} crypto_sort_int32.c:int32_MINMAX: 21| 9.88k|static inline void int32_MINMAX(int32 *a, int32 *b) { 22| 9.88k| int32 ab = *b ^ *a; ------------------ | | 6| 9.88k|#define int32 int32_t ------------------ 23| 9.88k| int32 c = (int32)((int64_t) * b - (int64_t) * a); ------------------ | | 6| 9.88k|#define int32 int32_t ------------------ 24| 9.88k| c ^= ab & (c ^ *b); 25| 9.88k| c >>= 31; 26| 9.88k| c &= ab; 27| 9.88k| *a ^= c; 28| 9.88k| *b ^= c; 29| 9.88k|} crypto_sort_int32.c:int32_sort_2power: 176| 1.26k|static void int32_sort_2power(int32 *x, size_t n, int flagdown) { 177| 1.26k| size_t p, q, i, j, k; 178| 1.26k| int32x8 mask; 179| | 180| 1.26k| if (n == 8) { ------------------ | Branch (180:9): [True: 0, False: 1.26k] ------------------ 181| 0| int32 x0 = x[0]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 182| 0| int32 x1 = x[1]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 183| 0| int32 x2 = x[2]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 184| 0| int32 x3 = x[3]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 185| 0| int32 x4 = x[4]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 186| 0| int32 x5 = x[5]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 187| 0| int32 x6 = x[6]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 188| 0| int32 x7 = x[7]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 189| | 190| | /* odd-even sort instead of bitonic sort */ 191| | 192| 0| int32_MINMAX(&x1, &x0); 193| 0| int32_MINMAX(&x3, &x2); 194| 0| int32_MINMAX(&x2, &x0); 195| 0| int32_MINMAX(&x3, &x1); 196| 0| int32_MINMAX(&x2, &x1); 197| | 198| 0| int32_MINMAX(&x5, &x4); 199| 0| int32_MINMAX(&x7, &x6); 200| 0| int32_MINMAX(&x6, &x4); 201| 0| int32_MINMAX(&x7, &x5); 202| 0| int32_MINMAX(&x6, &x5); 203| | 204| 0| int32_MINMAX(&x4, &x0); 205| 0| int32_MINMAX(&x6, &x2); 206| 0| int32_MINMAX(&x4, &x2); 207| | 208| 0| int32_MINMAX(&x5, &x1); 209| 0| int32_MINMAX(&x7, &x3); 210| 0| int32_MINMAX(&x5, &x3); 211| | 212| 0| int32_MINMAX(&x2, &x1); 213| 0| int32_MINMAX(&x4, &x3); 214| 0| int32_MINMAX(&x6, &x5); 215| | 216| 0| x[0] = x0; 217| 0| x[1] = x1; 218| 0| x[2] = x2; 219| 0| x[3] = x3; 220| 0| x[4] = x4; 221| 0| x[5] = x5; 222| 0| x[6] = x6; 223| 0| x[7] = x7; 224| 0| return; 225| 0| } 226| | 227| 1.26k| if (n == 16) { ------------------ | Branch (227:9): [True: 0, False: 1.26k] ------------------ 228| 0| int32x8 x0, x1, b0, b1, c0, c1; 229| | 230| 0| x0 = int32x8_load(&x[0]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 231| 0| x1 = int32x8_load(&x[8]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 232| | 233| 0| mask = _mm256_set_epi32(0, 0, -1, -1, 0, 0, -1, -1); 234| | 235| 0| x0 ^= mask; /* A01234567 */ 236| 0| x1 ^= mask; /* B01234567 */ 237| | 238| 0| b0 = _mm256_unpacklo_epi32(x0, x1); /* AB0AB1AB4AB5 */ 239| 0| b1 = _mm256_unpackhi_epi32(x0, x1); /* AB2AB3AB6AB7 */ 240| | 241| 0| c0 = _mm256_unpacklo_epi64(b0, b1); /* AB0AB2AB4AB6 */ 242| 0| c1 = _mm256_unpackhi_epi64(b0, b1); /* AB1AB3AB5AB7 */ 243| | 244| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 245| | 246| 0| mask = _mm256_set_epi32(0, 0, -1, -1, -1, -1, 0, 0); 247| 0| c0 ^= mask; 248| 0| c1 ^= mask; 249| | 250| 0| b0 = _mm256_unpacklo_epi32(c0, c1); /* A01B01A45B45 */ 251| 0| b1 = _mm256_unpackhi_epi32(c0, c1); /* A23B23A67B67 */ 252| | 253| 0| int32x8_MINMAX(b0, b1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 254| | 255| 0| x0 = _mm256_unpacklo_epi64(b0, b1); /* A01234567 */ 256| 0| x1 = _mm256_unpackhi_epi64(b0, b1); /* B01234567 */ 257| | 258| 0| b0 = _mm256_unpacklo_epi32(x0, x1); /* AB0AB1AB4AB5 */ 259| 0| b1 = _mm256_unpackhi_epi32(x0, x1); /* AB2AB3AB6AB7 */ 260| | 261| 0| c0 = _mm256_unpacklo_epi64(b0, b1); /* AB0AB2AB4AB6 */ 262| 0| c1 = _mm256_unpackhi_epi64(b0, b1); /* AB1AB3AB5AB7 */ 263| | 264| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 265| | 266| 0| b0 = _mm256_unpacklo_epi32(c0, c1); /* A01B01A45B45 */ 267| 0| b1 = _mm256_unpackhi_epi32(c0, c1); /* A23B23A67B67 */ 268| | 269| 0| b0 ^= mask; 270| 0| b1 ^= mask; 271| | 272| 0| c0 = _mm256_permute2x128_si256(b0, b1, 0x20); /* A01B01A23B23 */ 273| 0| c1 = _mm256_permute2x128_si256(b0, b1, 0x31); /* A45B45A67B67 */ 274| | 275| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 276| | 277| 0| b0 = _mm256_permute2x128_si256(c0, c1, 0x20); /* A01B01A45B45 */ 278| 0| b1 = _mm256_permute2x128_si256(c0, c1, 0x31); /* A23B23A67B67 */ 279| | 280| 0| int32x8_MINMAX(b0, b1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 281| | 282| 0| x0 = _mm256_unpacklo_epi64(b0, b1); /* A01234567 */ 283| 0| x1 = _mm256_unpackhi_epi64(b0, b1); /* B01234567 */ 284| | 285| 0| b0 = _mm256_unpacklo_epi32(x0, x1); /* AB0AB1AB4AB5 */ 286| 0| b1 = _mm256_unpackhi_epi32(x0, x1); /* AB2AB3AB6AB7 */ 287| | 288| 0| c0 = _mm256_unpacklo_epi64(b0, b1); /* AB0AB2AB4AB6 */ 289| 0| c1 = _mm256_unpackhi_epi64(b0, b1); /* AB1AB3AB5AB7 */ 290| | 291| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 292| | 293| 0| b0 = _mm256_unpacklo_epi32(c0, c1); /* A01B01A45B45 */ 294| 0| b1 = _mm256_unpackhi_epi32(c0, c1); /* A23B23A67B67 */ 295| | 296| 0| x0 = _mm256_unpacklo_epi64(b0, b1); /* A01234567 */ 297| 0| x1 = _mm256_unpackhi_epi64(b0, b1); /* B01234567 */ 298| | 299| 0| mask = _mm256_set1_epi32(-1); 300| 0| if (flagdown) { ------------------ | Branch (300:13): [True: 0, False: 0] ------------------ 301| 0| x1 ^= mask; 302| 0| } else { 303| 0| x0 ^= mask; 304| 0| } 305| | 306| 0| merge16_finish(x, x0, x1, flagdown); 307| 0| return; 308| 0| } 309| | 310| 1.26k| if (n == 32) { ------------------ | Branch (310:9): [True: 0, False: 1.26k] ------------------ 311| 0| int32x8 x0, x1, x2, x3; 312| | 313| 0| int32_sort_2power(x, 16, 1); 314| 0| int32_sort_2power(x + 16, 16, 0); 315| | 316| 0| x0 = int32x8_load(&x[0]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 317| 0| x1 = int32x8_load(&x[8]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 318| 0| x2 = int32x8_load(&x[16]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 319| 0| x3 = int32x8_load(&x[24]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 320| | 321| 0| if (flagdown) { ------------------ | Branch (321:13): [True: 0, False: 0] ------------------ 322| 0| mask = _mm256_set1_epi32(-1); 323| 0| x0 ^= mask; 324| 0| x1 ^= mask; 325| 0| x2 ^= mask; 326| 0| x3 ^= mask; 327| 0| } 328| | 329| 0| int32x8_MINMAX(x0, x2); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 330| 0| int32x8_MINMAX(x1, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 331| | 332| 0| merge16_finish(x, x0, x1, flagdown); 333| 0| merge16_finish(x + 16, x2, x3, flagdown); 334| 0| return; 335| 0| } 336| | 337| 1.26k| p = n >> 3; 338| 6.58k| for (i = 0; i < p; i += 8) { ------------------ | Branch (338:17): [True: 5.32k, False: 1.26k] ------------------ 339| 5.32k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 340| 5.32k| int32x8 x2 = int32x8_load(&x[i + 2 * p]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 341| 5.32k| int32x8 x4 = int32x8_load(&x[i + 4 * p]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 342| 5.32k| int32x8 x6 = int32x8_load(&x[i + 6 * p]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 343| | 344| | /* odd-even stage instead of bitonic stage */ 345| | 346| 5.32k| int32x8_MINMAX(x4, x0); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 347| 5.32k| int32x8_MINMAX(x6, x2); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 348| 5.32k| int32x8_MINMAX(x2, x0); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 349| 5.32k| int32x8_MINMAX(x6, x4); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 350| 5.32k| int32x8_MINMAX(x2, x4); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 351| | 352| 5.32k| int32x8_store(&x[i], x0); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 353| 5.32k| int32x8_store(&x[i + 2 * p], x2); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 354| 5.32k| int32x8_store(&x[i + 4 * p], x4); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 355| 5.32k| int32x8_store(&x[i + 6 * p], x6); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 356| | 357| 5.32k| int32x8 x1 = int32x8_load(&x[i + p]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 358| 5.32k| int32x8 x3 = int32x8_load(&x[i + 3 * p]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 359| 5.32k| int32x8 x5 = int32x8_load(&x[i + 5 * p]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 360| 5.32k| int32x8 x7 = int32x8_load(&x[i + 7 * p]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 361| | 362| 5.32k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 363| 5.32k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 364| 5.32k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 365| 5.32k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 366| 5.32k| int32x8_MINMAX(x5, x3); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 367| | 368| 5.32k| int32x8_store(&x[i + p], x1); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 369| 5.32k| int32x8_store(&x[i + 3 * p], x3); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 370| 5.32k| int32x8_store(&x[i + 5 * p], x5); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 371| 5.32k| int32x8_store(&x[i + 7 * p], x7); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 372| 5.32k| } 373| | 374| 1.26k| if (n >= 128) { ------------------ | Branch (374:9): [True: 1.09k, False: 168] ------------------ 375| 1.09k| int flip, flipflip; 376| | 377| 1.09k| mask = _mm256_set1_epi32(-1); 378| | 379| 11.4k| for (j = 0; j < n; j += 32) { ------------------ | Branch (379:21): [True: 10.3k, False: 1.09k] ------------------ 380| 10.3k| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 10.3k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 381| 10.3k| int32x8 x1 = int32x8_load(&x[j + 16]); ------------------ | | 9| 10.3k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 382| 10.3k| x0 ^= mask; 383| 10.3k| x1 ^= mask; 384| 10.3k| int32x8_store(&x[j], x0); ------------------ | | 10| 10.3k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 385| 10.3k| int32x8_store(&x[j + 16], x1); ------------------ | | 10| 10.3k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 386| 10.3k| } 387| | 388| 1.09k| p = 8; 389| 2.38k| for (;;) { /* for p in [8, 16, ..., n/16] */ 390| 2.38k| q = p >> 1; 391| 2.38k| while (q >= 128) { ------------------ | Branch (391:20): [True: 0, False: 2.38k] ------------------ 392| 0| int32_threestages(x, n, q >> 2); 393| 0| q >>= 3; 394| 0| } 395| 2.38k| if (q == 64) { ------------------ | Branch (395:17): [True: 0, False: 2.38k] ------------------ 396| 0| int32_twostages_32(x, n); 397| 0| q = 16; 398| 0| } 399| 2.38k| if (q == 32) { ------------------ | Branch (399:17): [True: 0, False: 2.38k] ------------------ 400| 0| q = 8; 401| 0| for (k = 0; k < n; k += 8 * q) { ------------------ | Branch (401:29): [True: 0, False: 0] ------------------ 402| 0| for (i = k; i < k + q; i += 8) { ------------------ | Branch (402:33): [True: 0, False: 0] ------------------ 403| 0| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 404| 0| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 405| 0| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 406| 0| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 407| 0| int32x8 x4 = int32x8_load(&x[i + 4 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 408| 0| int32x8 x5 = int32x8_load(&x[i + 5 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 409| 0| int32x8 x6 = int32x8_load(&x[i + 6 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 410| 0| int32x8 x7 = int32x8_load(&x[i + 7 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 411| | 412| 0| int32x8_MINMAX(x0, x4); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 413| 0| int32x8_MINMAX(x1, x5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 414| 0| int32x8_MINMAX(x2, x6); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 415| 0| int32x8_MINMAX(x3, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 416| 0| int32x8_MINMAX(x0, x2); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 417| 0| int32x8_MINMAX(x1, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 418| 0| int32x8_MINMAX(x4, x6); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 419| 0| int32x8_MINMAX(x5, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 420| 0| int32x8_MINMAX(x0, x1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 421| 0| int32x8_MINMAX(x2, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 422| 0| int32x8_MINMAX(x4, x5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 423| 0| int32x8_MINMAX(x6, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 424| | 425| 0| int32x8_store(&x[i], x0); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 426| 0| int32x8_store(&x[i + q], x1); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 427| 0| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 428| 0| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 429| 0| int32x8_store(&x[i + 4 * q], x4); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 430| 0| int32x8_store(&x[i + 5 * q], x5); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 431| 0| int32x8_store(&x[i + 6 * q], x6); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 432| 0| int32x8_store(&x[i + 7 * q], x7); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 433| 0| } 434| 0| } 435| 0| q = 4; 436| 0| } 437| 2.38k| if (q == 16) { ------------------ | Branch (437:17): [True: 198, False: 2.18k] ------------------ 438| 198| q = 8; 439| 3.36k| for (k = 0; k < n; k += 4 * q) { ------------------ | Branch (439:29): [True: 3.16k, False: 198] ------------------ 440| 6.33k| for (i = k; i < k + q; i += 8) { ------------------ | Branch (440:33): [True: 3.16k, False: 3.16k] ------------------ 441| 3.16k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 3.16k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 442| 3.16k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 3.16k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 443| 3.16k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 3.16k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 444| 3.16k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 3.16k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 445| | 446| 3.16k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 3.16k| do { \ | | 16| 3.16k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.16k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.16k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.16k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.16k| (a) = c; \ | | 19| 3.16k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.16k] | | ------------------ ------------------ 447| 3.16k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 3.16k| do { \ | | 16| 3.16k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.16k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.16k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.16k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.16k| (a) = c; \ | | 19| 3.16k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.16k] | | ------------------ ------------------ 448| 3.16k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 3.16k| do { \ | | 16| 3.16k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.16k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.16k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.16k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.16k| (a) = c; \ | | 19| 3.16k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.16k] | | ------------------ ------------------ 449| 3.16k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 3.16k| do { \ | | 16| 3.16k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.16k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.16k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.16k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.16k| (a) = c; \ | | 19| 3.16k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.16k] | | ------------------ ------------------ 450| | 451| 3.16k| int32x8_store(&x[i], x0); ------------------ | | 10| 3.16k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 452| 3.16k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 3.16k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 453| 3.16k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 3.16k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 454| 3.16k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 3.16k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 455| 3.16k| } 456| 3.16k| } 457| 198| q = 4; 458| 198| } 459| 2.38k| if (q == 8) { ------------------ | Branch (459:17): [True: 1.09k, False: 1.29k] ------------------ 460| 21.7k| for (k = 0; k < n; k += q + q) { ------------------ | Branch (460:29): [True: 20.6k, False: 1.09k] ------------------ 461| 20.6k| int32x8 x0 = int32x8_load(&x[k]); ------------------ | | 9| 20.6k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 462| 20.6k| int32x8 x1 = int32x8_load(&x[k + q]); ------------------ | | 9| 20.6k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 463| | 464| 20.6k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 20.6k| do { \ | | 16| 20.6k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 20.6k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 20.6k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 20.6k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 20.6k| (a) = c; \ | | 19| 20.6k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 20.6k] | | ------------------ ------------------ 465| | 466| 20.6k| int32x8_store(&x[k], x0); ------------------ | | 10| 20.6k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 467| 20.6k| int32x8_store(&x[k + q], x1); ------------------ | | 10| 20.6k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 468| 20.6k| } 469| 1.09k| } 470| | 471| 2.38k| q = n >> 3; 472| 2.38k| flip = 0; 473| 2.38k| if (p << 1 == q) { ------------------ | Branch (473:17): [True: 1.09k, False: 1.29k] ------------------ 474| 1.09k| flip = 1; 475| 1.09k| } 476| 2.38k| flipflip = 1 - flip; 477| 6.45k| for (j = 0; j < q; j += p + p) { ------------------ | Branch (477:25): [True: 4.06k, False: 2.38k] ------------------ 478| 12.2k| for (k = j; k < j + p + p; k += p) { ------------------ | Branch (478:29): [True: 8.13k, False: 4.06k] ------------------ 479| 20.0k| for (i = k; i < k + p; i += 8) { ------------------ | Branch (479:33): [True: 11.9k, False: 8.13k] ------------------ 480| 11.9k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 11.9k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 481| 11.9k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 11.9k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 482| 11.9k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 11.9k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 483| 11.9k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 11.9k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 484| 11.9k| int32x8 x4 = int32x8_load(&x[i + 4 * q]); ------------------ | | 9| 11.9k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 485| 11.9k| int32x8 x5 = int32x8_load(&x[i + 5 * q]); ------------------ | | 9| 11.9k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 486| 11.9k| int32x8 x6 = int32x8_load(&x[i + 6 * q]); ------------------ | | 9| 11.9k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 487| 11.9k| int32x8 x7 = int32x8_load(&x[i + 7 * q]); ------------------ | | 9| 11.9k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 488| | 489| 11.9k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 11.9k| do { \ | | 16| 11.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 11.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 11.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 11.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 11.9k| (a) = c; \ | | 19| 11.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 11.9k] | | ------------------ ------------------ 490| 11.9k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 11.9k| do { \ | | 16| 11.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 11.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 11.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 11.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 11.9k| (a) = c; \ | | 19| 11.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 11.9k] | | ------------------ ------------------ 491| 11.9k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 11.9k| do { \ | | 16| 11.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 11.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 11.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 11.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 11.9k| (a) = c; \ | | 19| 11.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 11.9k] | | ------------------ ------------------ 492| 11.9k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 11.9k| do { \ | | 16| 11.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 11.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 11.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 11.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 11.9k| (a) = c; \ | | 19| 11.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 11.9k] | | ------------------ ------------------ 493| 11.9k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 11.9k| do { \ | | 16| 11.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 11.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 11.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 11.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 11.9k| (a) = c; \ | | 19| 11.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 11.9k] | | ------------------ ------------------ 494| 11.9k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 11.9k| do { \ | | 16| 11.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 11.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 11.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 11.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 11.9k| (a) = c; \ | | 19| 11.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 11.9k] | | ------------------ ------------------ 495| 11.9k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 11.9k| do { \ | | 16| 11.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 11.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 11.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 11.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 11.9k| (a) = c; \ | | 19| 11.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 11.9k] | | ------------------ ------------------ 496| 11.9k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 11.9k| do { \ | | 16| 11.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 11.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 11.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 11.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 11.9k| (a) = c; \ | | 19| 11.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 11.9k] | | ------------------ ------------------ 497| 11.9k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 11.9k| do { \ | | 16| 11.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 11.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 11.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 11.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 11.9k| (a) = c; \ | | 19| 11.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 11.9k] | | ------------------ ------------------ 498| 11.9k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 11.9k| do { \ | | 16| 11.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 11.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 11.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 11.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 11.9k| (a) = c; \ | | 19| 11.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 11.9k] | | ------------------ ------------------ 499| 11.9k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 11.9k| do { \ | | 16| 11.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 11.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 11.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 11.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 11.9k| (a) = c; \ | | 19| 11.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 11.9k] | | ------------------ ------------------ 500| 11.9k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 11.9k| do { \ | | 16| 11.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 11.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 11.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 11.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 11.9k| (a) = c; \ | | 19| 11.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 11.9k] | | ------------------ ------------------ 501| | 502| 11.9k| if (flip) { ------------------ | Branch (502:29): [True: 5.95k, False: 5.95k] ------------------ 503| 5.95k| x0 ^= mask; 504| 5.95k| x1 ^= mask; 505| 5.95k| x2 ^= mask; 506| 5.95k| x3 ^= mask; 507| 5.95k| x4 ^= mask; 508| 5.95k| x5 ^= mask; 509| 5.95k| x6 ^= mask; 510| 5.95k| x7 ^= mask; 511| 5.95k| } 512| | 513| 11.9k| int32x8_store(&x[i], x0); ------------------ | | 10| 11.9k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 514| 11.9k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 11.9k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 515| 11.9k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 11.9k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 516| 11.9k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 11.9k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 517| 11.9k| int32x8_store(&x[i + 4 * q], x4); ------------------ | | 10| 11.9k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 518| 11.9k| int32x8_store(&x[i + 5 * q], x5); ------------------ | | 10| 11.9k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 519| 11.9k| int32x8_store(&x[i + 6 * q], x6); ------------------ | | 10| 11.9k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 520| 11.9k| int32x8_store(&x[i + 7 * q], x7); ------------------ | | 10| 11.9k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 521| 11.9k| } 522| 8.13k| flip ^= 1; 523| 8.13k| } 524| 4.06k| flip ^= flipflip; 525| 4.06k| } 526| | 527| 2.38k| if (p << 4 == n) { ------------------ | Branch (527:17): [True: 1.09k, False: 1.29k] ------------------ 528| 1.09k| break; 529| 1.09k| } 530| 1.29k| p <<= 1; 531| 1.29k| } 532| 1.09k| } 533| | 534| 5.04k| for (p = 4; p >= 1; p >>= 1) { ------------------ | Branch (534:17): [True: 3.78k, False: 1.26k] ------------------ 535| 3.78k| int32 *z = x; ------------------ | | 6| 3.78k|#define int32 int32_t ------------------ 536| 3.78k| int32 *target = x + n; ------------------ | | 6| 3.78k|#define int32 int32_t ------------------ 537| 3.78k| if (p == 4) { ------------------ | Branch (537:13): [True: 1.26k, False: 2.52k] ------------------ 538| 1.26k| mask = _mm256_set_epi32(0, 0, 0, 0, -1, -1, -1, -1); 539| 22.5k| while (z != target) { ------------------ | Branch (539:20): [True: 21.3k, False: 1.26k] ------------------ 540| 21.3k| int32x8 x0 = int32x8_load(&z[0]); ------------------ | | 9| 21.3k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 541| 21.3k| int32x8 x1 = int32x8_load(&z[8]); ------------------ | | 9| 21.3k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 542| 21.3k| x0 ^= mask; 543| 21.3k| x1 ^= mask; 544| 21.3k| int32x8_store(&z[0], x0); ------------------ | | 10| 21.3k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 545| 21.3k| int32x8_store(&z[8], x1); ------------------ | | 10| 21.3k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 546| 21.3k| z += 16; 547| 21.3k| } 548| 2.52k| } else if (p == 2) { ------------------ | Branch (548:20): [True: 1.26k, False: 1.26k] ------------------ 549| 1.26k| mask = _mm256_set_epi32(0, 0, -1, -1, -1, -1, 0, 0); 550| 22.5k| while (z != target) { ------------------ | Branch (550:20): [True: 21.3k, False: 1.26k] ------------------ 551| 21.3k| int32x8 x0 = int32x8_load(&z[0]); ------------------ | | 9| 21.3k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 552| 21.3k| int32x8 x1 = int32x8_load(&z[8]); ------------------ | | 9| 21.3k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 553| 21.3k| x0 ^= mask; 554| 21.3k| x1 ^= mask; 555| 21.3k| int32x8 b0 = _mm256_permute2x128_si256(x0, x1, 0x20); 556| 21.3k| int32x8 b1 = _mm256_permute2x128_si256(x0, x1, 0x31); 557| 21.3k| int32x8_MINMAX(b0, b1); ------------------ | | 15| 21.3k| do { \ | | 16| 21.3k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 21.3k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 21.3k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 21.3k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 21.3k| (a) = c; \ | | 19| 21.3k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 21.3k] | | ------------------ ------------------ 558| 21.3k| int32x8 c0 = _mm256_permute2x128_si256(b0, b1, 0x20); 559| 21.3k| int32x8 c1 = _mm256_permute2x128_si256(b0, b1, 0x31); 560| 21.3k| int32x8_store(&z[0], c0); ------------------ | | 10| 21.3k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 561| 21.3k| int32x8_store(&z[8], c1); ------------------ | | 10| 21.3k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 562| 21.3k| z += 16; 563| 21.3k| } 564| 1.26k| } else { /* p == 1 */ 565| 1.26k| mask = _mm256_set_epi32(0, -1, -1, 0, 0, -1, -1, 0); 566| 22.5k| while (z != target) { ------------------ | Branch (566:20): [True: 21.3k, False: 1.26k] ------------------ 567| 21.3k| int32x8 x0 = int32x8_load(&z[0]); ------------------ | | 9| 21.3k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 568| 21.3k| int32x8 x1 = int32x8_load(&z[8]); ------------------ | | 9| 21.3k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 569| 21.3k| x0 ^= mask; 570| 21.3k| x1 ^= mask; 571| 21.3k| int32x8 b0 = _mm256_permute2x128_si256(x0, x1, 0x20); /* A0123B0123 */ 572| 21.3k| int32x8 b1 = _mm256_permute2x128_si256(x0, x1, 0x31); /* A4567B4567 */ 573| 21.3k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); /* A0145B0145 */ 574| 21.3k| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); /* A2367B2367 */ 575| 21.3k| int32x8_MINMAX(c0, c1); ------------------ | | 15| 21.3k| do { \ | | 16| 21.3k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 21.3k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 21.3k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 21.3k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 21.3k| (a) = c; \ | | 19| 21.3k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 21.3k] | | ------------------ ------------------ 576| 21.3k| int32x8 d0 = _mm256_unpacklo_epi64(c0, c1); /* A0123B0123 */ 577| 21.3k| int32x8 d1 = _mm256_unpackhi_epi64(c0, c1); /* A4567B4567 */ 578| 21.3k| int32x8_MINMAX(d0, d1); ------------------ | | 15| 21.3k| do { \ | | 16| 21.3k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 21.3k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 21.3k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 21.3k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 21.3k| (a) = c; \ | | 19| 21.3k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 21.3k] | | ------------------ ------------------ 579| 21.3k| int32x8 e0 = _mm256_permute2x128_si256(d0, d1, 0x20); 580| 21.3k| int32x8 e1 = _mm256_permute2x128_si256(d0, d1, 0x31); 581| 21.3k| int32x8_store(&z[0], e0); ------------------ | | 10| 21.3k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 582| 21.3k| int32x8_store(&z[8], e1); ------------------ | | 10| 21.3k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 583| 21.3k| z += 16; 584| 21.3k| } 585| 1.26k| } 586| | 587| 3.78k| q = n >> 4; 588| 4.37k| while (q >= 128 || q == 32) { ------------------ | Branch (588:16): [True: 0, False: 4.37k] | Branch (588:28): [True: 594, False: 3.78k] ------------------ 589| 594| int32_threestages(x, n, q >> 2); 590| 594| q >>= 3; 591| 594| } 592| 6.46k| while (q >= 16) { ------------------ | Branch (592:16): [True: 2.68k, False: 3.78k] ------------------ 593| 2.68k| q >>= 1; 594| 24.1k| for (j = 0; j < n; j += 4 * q) { ------------------ | Branch (594:25): [True: 21.4k, False: 2.68k] ------------------ 595| 42.9k| for (k = j; k < j + q; k += 8) { ------------------ | Branch (595:29): [True: 21.4k, False: 21.4k] ------------------ 596| 21.4k| int32x8 x0 = int32x8_load(&x[k]); ------------------ | | 9| 21.4k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 597| 21.4k| int32x8 x1 = int32x8_load(&x[k + q]); ------------------ | | 9| 21.4k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 598| 21.4k| int32x8 x2 = int32x8_load(&x[k + 2 * q]); ------------------ | | 9| 21.4k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 599| 21.4k| int32x8 x3 = int32x8_load(&x[k + 3 * q]); ------------------ | | 9| 21.4k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 600| | 601| 21.4k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 21.4k| do { \ | | 16| 21.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 21.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 21.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 21.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 21.4k| (a) = c; \ | | 19| 21.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 21.4k] | | ------------------ ------------------ 602| 21.4k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 21.4k| do { \ | | 16| 21.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 21.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 21.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 21.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 21.4k| (a) = c; \ | | 19| 21.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 21.4k] | | ------------------ ------------------ 603| 21.4k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 21.4k| do { \ | | 16| 21.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 21.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 21.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 21.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 21.4k| (a) = c; \ | | 19| 21.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 21.4k] | | ------------------ ------------------ 604| 21.4k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 21.4k| do { \ | | 16| 21.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 21.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 21.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 21.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 21.4k| (a) = c; \ | | 19| 21.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 21.4k] | | ------------------ ------------------ 605| | 606| 21.4k| int32x8_store(&x[k], x0); ------------------ | | 10| 21.4k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 607| 21.4k| int32x8_store(&x[k + q], x1); ------------------ | | 10| 21.4k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 608| 21.4k| int32x8_store(&x[k + 2 * q], x2); ------------------ | | 10| 21.4k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 609| 21.4k| int32x8_store(&x[k + 3 * q], x3); ------------------ | | 10| 21.4k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 610| 21.4k| } 611| 21.4k| } 612| 2.68k| q >>= 1; 613| 2.68k| } 614| 3.78k| if (q == 8) { ------------------ | Branch (614:13): [True: 0, False: 3.78k] ------------------ 615| 0| for (j = 0; j < n; j += 2 * q) { ------------------ | Branch (615:25): [True: 0, False: 0] ------------------ 616| 0| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 617| 0| int32x8 x1 = int32x8_load(&x[j + q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 618| | 619| 0| int32x8_MINMAX(x0, x1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 620| | 621| 0| int32x8_store(&x[j], x0); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 622| 0| int32x8_store(&x[j + q], x1); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 623| 0| } 624| 0| } 625| | 626| 3.78k| q = n >> 3; 627| 19.7k| for (k = 0; k < q; k += 8) { ------------------ | Branch (627:21): [True: 15.9k, False: 3.78k] ------------------ 628| 15.9k| int32x8 x0 = int32x8_load(&x[k]); ------------------ | | 9| 15.9k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 629| 15.9k| int32x8 x1 = int32x8_load(&x[k + q]); ------------------ | | 9| 15.9k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 630| 15.9k| int32x8 x2 = int32x8_load(&x[k + 2 * q]); ------------------ | | 9| 15.9k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 631| 15.9k| int32x8 x3 = int32x8_load(&x[k + 3 * q]); ------------------ | | 9| 15.9k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 632| 15.9k| int32x8 x4 = int32x8_load(&x[k + 4 * q]); ------------------ | | 9| 15.9k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 633| 15.9k| int32x8 x5 = int32x8_load(&x[k + 5 * q]); ------------------ | | 9| 15.9k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 634| 15.9k| int32x8 x6 = int32x8_load(&x[k + 6 * q]); ------------------ | | 9| 15.9k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 635| 15.9k| int32x8 x7 = int32x8_load(&x[k + 7 * q]); ------------------ | | 9| 15.9k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 636| | 637| 15.9k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 15.9k| do { \ | | 16| 15.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 15.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 15.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 15.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 15.9k| (a) = c; \ | | 19| 15.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 15.9k] | | ------------------ ------------------ 638| 15.9k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 15.9k| do { \ | | 16| 15.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 15.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 15.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 15.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 15.9k| (a) = c; \ | | 19| 15.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 15.9k] | | ------------------ ------------------ 639| 15.9k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 15.9k| do { \ | | 16| 15.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 15.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 15.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 15.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 15.9k| (a) = c; \ | | 19| 15.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 15.9k] | | ------------------ ------------------ 640| 15.9k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 15.9k| do { \ | | 16| 15.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 15.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 15.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 15.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 15.9k| (a) = c; \ | | 19| 15.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 15.9k] | | ------------------ ------------------ 641| 15.9k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 15.9k| do { \ | | 16| 15.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 15.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 15.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 15.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 15.9k| (a) = c; \ | | 19| 15.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 15.9k] | | ------------------ ------------------ 642| 15.9k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 15.9k| do { \ | | 16| 15.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 15.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 15.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 15.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 15.9k| (a) = c; \ | | 19| 15.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 15.9k] | | ------------------ ------------------ 643| 15.9k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 15.9k| do { \ | | 16| 15.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 15.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 15.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 15.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 15.9k| (a) = c; \ | | 19| 15.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 15.9k] | | ------------------ ------------------ 644| 15.9k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 15.9k| do { \ | | 16| 15.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 15.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 15.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 15.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 15.9k| (a) = c; \ | | 19| 15.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 15.9k] | | ------------------ ------------------ 645| 15.9k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 15.9k| do { \ | | 16| 15.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 15.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 15.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 15.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 15.9k| (a) = c; \ | | 19| 15.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 15.9k] | | ------------------ ------------------ 646| 15.9k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 15.9k| do { \ | | 16| 15.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 15.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 15.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 15.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 15.9k| (a) = c; \ | | 19| 15.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 15.9k] | | ------------------ ------------------ 647| 15.9k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 15.9k| do { \ | | 16| 15.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 15.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 15.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 15.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 15.9k| (a) = c; \ | | 19| 15.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 15.9k] | | ------------------ ------------------ 648| 15.9k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 15.9k| do { \ | | 16| 15.9k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 15.9k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 15.9k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 15.9k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 15.9k| (a) = c; \ | | 19| 15.9k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 15.9k] | | ------------------ ------------------ 649| | 650| 15.9k| int32x8_store(&x[k], x0); ------------------ | | 10| 15.9k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 651| 15.9k| int32x8_store(&x[k + q], x1); ------------------ | | 10| 15.9k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 652| 15.9k| int32x8_store(&x[k + 2 * q], x2); ------------------ | | 10| 15.9k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 653| 15.9k| int32x8_store(&x[k + 3 * q], x3); ------------------ | | 10| 15.9k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 654| 15.9k| int32x8_store(&x[k + 4 * q], x4); ------------------ | | 10| 15.9k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 655| 15.9k| int32x8_store(&x[k + 5 * q], x5); ------------------ | | 10| 15.9k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 656| 15.9k| int32x8_store(&x[k + 6 * q], x6); ------------------ | | 10| 15.9k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 657| 15.9k| int32x8_store(&x[k + 7 * q], x7); ------------------ | | 10| 15.9k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 658| 15.9k| } 659| 3.78k| } 660| | 661| | /* everything is still masked with _mm256_set_epi32(0,-1,0,-1,0,-1,0,-1); */ 662| 1.26k| mask = _mm256_set1_epi32(-1); 663| | 664| 6.58k| for (i = 0; i < n; i += 64) { ------------------ | Branch (664:17): [True: 5.32k, False: 1.26k] ------------------ 665| 5.32k| int32x8 a0 = int32x8_load(&x[i]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 666| 5.32k| int32x8 a1 = int32x8_load(&x[i + 8]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 667| 5.32k| int32x8 a2 = int32x8_load(&x[i + 16]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 668| 5.32k| int32x8 a3 = int32x8_load(&x[i + 24]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 669| 5.32k| int32x8 a4 = int32x8_load(&x[i + 32]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 670| 5.32k| int32x8 a5 = int32x8_load(&x[i + 40]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 671| 5.32k| int32x8 a6 = int32x8_load(&x[i + 48]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 672| 5.32k| int32x8 a7 = int32x8_load(&x[i + 56]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 673| | 674| 5.32k| int32x8 b0 = _mm256_unpacklo_epi32(a0, a1); /* AB0AB1AB4AB5 */ 675| 5.32k| int32x8 b1 = _mm256_unpackhi_epi32(a0, a1); /* AB2AB3AB6AB7 */ 676| 5.32k| int32x8 b2 = _mm256_unpacklo_epi32(a2, a3); /* CD0CD1CD4CD5 */ 677| 5.32k| int32x8 b3 = _mm256_unpackhi_epi32(a2, a3); /* CD2CD3CD6CD7 */ 678| 5.32k| int32x8 b4 = _mm256_unpacklo_epi32(a4, a5); /* EF0EF1EF4EF5 */ 679| 5.32k| int32x8 b5 = _mm256_unpackhi_epi32(a4, a5); /* EF2EF3EF6EF7 */ 680| 5.32k| int32x8 b6 = _mm256_unpacklo_epi32(a6, a7); /* GH0GH1GH4GH5 */ 681| 5.32k| int32x8 b7 = _mm256_unpackhi_epi32(a6, a7); /* GH2GH3GH6GH7 */ 682| | 683| 5.32k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b2); /* ABCD0ABCD4 */ 684| 5.32k| int32x8 c1 = _mm256_unpacklo_epi64(b1, b3); /* ABCD2ABCD6 */ 685| 5.32k| int32x8 c2 = _mm256_unpackhi_epi64(b0, b2); /* ABCD1ABCD5 */ 686| 5.32k| int32x8 c3 = _mm256_unpackhi_epi64(b1, b3); /* ABCD3ABCD7 */ 687| 5.32k| int32x8 c4 = _mm256_unpacklo_epi64(b4, b6); /* EFGH0EFGH4 */ 688| 5.32k| int32x8 c5 = _mm256_unpacklo_epi64(b5, b7); /* EFGH2EFGH6 */ 689| 5.32k| int32x8 c6 = _mm256_unpackhi_epi64(b4, b6); /* EFGH1EFGH5 */ 690| 5.32k| int32x8 c7 = _mm256_unpackhi_epi64(b5, b7); /* EFGH3EFGH7 */ 691| | 692| 5.32k| if (flagdown) { ------------------ | Branch (692:13): [True: 3.64k, False: 1.68k] ------------------ 693| 3.64k| c2 ^= mask; 694| 3.64k| c3 ^= mask; 695| 3.64k| c6 ^= mask; 696| 3.64k| c7 ^= mask; 697| 3.64k| } else { 698| 1.68k| c0 ^= mask; 699| 1.68k| c1 ^= mask; 700| 1.68k| c4 ^= mask; 701| 1.68k| c5 ^= mask; 702| 1.68k| } 703| | 704| 5.32k| int32x8 d0 = _mm256_permute2x128_si256(c0, c4, 0x20); /* ABCDEFGH0 */ 705| 5.32k| int32x8 d1 = _mm256_permute2x128_si256(c2, c6, 0x20); /* ABCDEFGH1 */ 706| 5.32k| int32x8 d2 = _mm256_permute2x128_si256(c1, c5, 0x20); /* ABCDEFGH2 */ 707| 5.32k| int32x8 d3 = _mm256_permute2x128_si256(c3, c7, 0x20); /* ABCDEFGH5 */ 708| 5.32k| int32x8 d4 = _mm256_permute2x128_si256(c0, c4, 0x31); /* ABCDEFGH4 */ 709| 5.32k| int32x8 d5 = _mm256_permute2x128_si256(c2, c6, 0x31); /* ABCDEFGH3 */ 710| 5.32k| int32x8 d6 = _mm256_permute2x128_si256(c1, c5, 0x31); /* ABCDEFGH6 */ 711| 5.32k| int32x8 d7 = _mm256_permute2x128_si256(c3, c7, 0x31); /* ABCDEFGH7 */ 712| | 713| 5.32k| int32x8_MINMAX(d0, d1); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 714| 5.32k| int32x8_MINMAX(d2, d3); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 715| 5.32k| int32x8_MINMAX(d4, d5); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 716| 5.32k| int32x8_MINMAX(d6, d7); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 717| 5.32k| int32x8_MINMAX(d0, d2); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 718| 5.32k| int32x8_MINMAX(d1, d3); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 719| 5.32k| int32x8_MINMAX(d4, d6); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 720| 5.32k| int32x8_MINMAX(d5, d7); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 721| 5.32k| int32x8_MINMAX(d0, d4); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 722| 5.32k| int32x8_MINMAX(d1, d5); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 723| 5.32k| int32x8_MINMAX(d2, d6); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 724| 5.32k| int32x8_MINMAX(d3, d7); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 725| | 726| 5.32k| int32x8 e0 = _mm256_unpacklo_epi32(d0, d1); 727| 5.32k| int32x8 e1 = _mm256_unpackhi_epi32(d0, d1); 728| 5.32k| int32x8 e2 = _mm256_unpacklo_epi32(d2, d3); 729| 5.32k| int32x8 e3 = _mm256_unpackhi_epi32(d2, d3); 730| 5.32k| int32x8 e4 = _mm256_unpacklo_epi32(d4, d5); 731| 5.32k| int32x8 e5 = _mm256_unpackhi_epi32(d4, d5); 732| 5.32k| int32x8 e6 = _mm256_unpacklo_epi32(d6, d7); 733| 5.32k| int32x8 e7 = _mm256_unpackhi_epi32(d6, d7); 734| | 735| 5.32k| int32x8 f0 = _mm256_unpacklo_epi64(e0, e2); 736| 5.32k| int32x8 f1 = _mm256_unpacklo_epi64(e1, e3); 737| 5.32k| int32x8 f2 = _mm256_unpackhi_epi64(e0, e2); 738| 5.32k| int32x8 f3 = _mm256_unpackhi_epi64(e1, e3); 739| 5.32k| int32x8 f4 = _mm256_unpacklo_epi64(e4, e6); 740| 5.32k| int32x8 f5 = _mm256_unpacklo_epi64(e5, e7); 741| 5.32k| int32x8 f6 = _mm256_unpackhi_epi64(e4, e6); 742| 5.32k| int32x8 f7 = _mm256_unpackhi_epi64(e5, e7); 743| | 744| 5.32k| int32x8 g0 = _mm256_permute2x128_si256(f0, f4, 0x20); 745| 5.32k| int32x8 g1 = _mm256_permute2x128_si256(f2, f6, 0x20); 746| 5.32k| int32x8 g2 = _mm256_permute2x128_si256(f1, f5, 0x20); 747| 5.32k| int32x8 g3 = _mm256_permute2x128_si256(f3, f7, 0x20); 748| 5.32k| int32x8 g4 = _mm256_permute2x128_si256(f0, f4, 0x31); 749| 5.32k| int32x8 g5 = _mm256_permute2x128_si256(f2, f6, 0x31); 750| 5.32k| int32x8 g6 = _mm256_permute2x128_si256(f1, f5, 0x31); 751| 5.32k| int32x8 g7 = _mm256_permute2x128_si256(f3, f7, 0x31); 752| | 753| 5.32k| int32x8_store(&x[i], g0); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 754| 5.32k| int32x8_store(&x[i + 8], g1); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 755| 5.32k| int32x8_store(&x[i + 16], g2); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 756| 5.32k| int32x8_store(&x[i + 24], g3); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 757| 5.32k| int32x8_store(&x[i + 32], g4); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 758| 5.32k| int32x8_store(&x[i + 40], g5); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 759| 5.32k| int32x8_store(&x[i + 48], g6); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 760| 5.32k| int32x8_store(&x[i + 56], g7); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 761| 5.32k| } 762| | 763| 1.26k| q = n >> 4; 764| 1.45k| while (q >= 128 || q == 32) { ------------------ | Branch (764:12): [True: 0, False: 1.45k] | Branch (764:24): [True: 198, False: 1.26k] ------------------ 765| 198| q >>= 2; 766| 1.78k| for (j = 0; j < n; j += 8 * q) { ------------------ | Branch (766:21): [True: 1.58k, False: 198] ------------------ 767| 3.16k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (767:25): [True: 1.58k, False: 1.58k] ------------------ 768| 1.58k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 1.58k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 769| 1.58k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 1.58k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 770| 1.58k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 1.58k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 771| 1.58k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 1.58k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 772| 1.58k| int32x8 x4 = int32x8_load(&x[i + 4 * q]); ------------------ | | 9| 1.58k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 773| 1.58k| int32x8 x5 = int32x8_load(&x[i + 5 * q]); ------------------ | | 9| 1.58k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 774| 1.58k| int32x8 x6 = int32x8_load(&x[i + 6 * q]); ------------------ | | 9| 1.58k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 775| 1.58k| int32x8 x7 = int32x8_load(&x[i + 7 * q]); ------------------ | | 9| 1.58k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 776| 1.58k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 1.58k| do { \ | | 16| 1.58k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.58k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.58k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.58k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.58k| (a) = c; \ | | 19| 1.58k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.58k] | | ------------------ ------------------ 777| 1.58k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 1.58k| do { \ | | 16| 1.58k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.58k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.58k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.58k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.58k| (a) = c; \ | | 19| 1.58k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.58k] | | ------------------ ------------------ 778| 1.58k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 1.58k| do { \ | | 16| 1.58k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.58k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.58k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.58k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.58k| (a) = c; \ | | 19| 1.58k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.58k] | | ------------------ ------------------ 779| 1.58k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 1.58k| do { \ | | 16| 1.58k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.58k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.58k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.58k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.58k| (a) = c; \ | | 19| 1.58k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.58k] | | ------------------ ------------------ 780| 1.58k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 1.58k| do { \ | | 16| 1.58k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.58k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.58k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.58k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.58k| (a) = c; \ | | 19| 1.58k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.58k] | | ------------------ ------------------ 781| 1.58k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 1.58k| do { \ | | 16| 1.58k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.58k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.58k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.58k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.58k| (a) = c; \ | | 19| 1.58k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.58k] | | ------------------ ------------------ 782| 1.58k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 1.58k| do { \ | | 16| 1.58k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.58k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.58k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.58k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.58k| (a) = c; \ | | 19| 1.58k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.58k] | | ------------------ ------------------ 783| 1.58k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 1.58k| do { \ | | 16| 1.58k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.58k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.58k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.58k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.58k| (a) = c; \ | | 19| 1.58k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.58k] | | ------------------ ------------------ 784| 1.58k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 1.58k| do { \ | | 16| 1.58k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.58k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.58k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.58k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.58k| (a) = c; \ | | 19| 1.58k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.58k] | | ------------------ ------------------ 785| 1.58k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 1.58k| do { \ | | 16| 1.58k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.58k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.58k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.58k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.58k| (a) = c; \ | | 19| 1.58k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.58k] | | ------------------ ------------------ 786| 1.58k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 1.58k| do { \ | | 16| 1.58k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.58k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.58k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.58k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.58k| (a) = c; \ | | 19| 1.58k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.58k] | | ------------------ ------------------ 787| 1.58k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 1.58k| do { \ | | 16| 1.58k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.58k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.58k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.58k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.58k| (a) = c; \ | | 19| 1.58k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.58k] | | ------------------ ------------------ 788| 1.58k| int32x8_store(&x[i], x0); ------------------ | | 10| 1.58k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 789| 1.58k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 1.58k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 790| 1.58k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 1.58k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 791| 1.58k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 1.58k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 792| 1.58k| int32x8_store(&x[i + 4 * q], x4); ------------------ | | 10| 1.58k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 793| 1.58k| int32x8_store(&x[i + 5 * q], x5); ------------------ | | 10| 1.58k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 794| 1.58k| int32x8_store(&x[i + 6 * q], x6); ------------------ | | 10| 1.58k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 795| 1.58k| int32x8_store(&x[i + 7 * q], x7); ------------------ | | 10| 1.58k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 796| 1.58k| } 797| 1.58k| } 798| 198| q >>= 1; 799| 198| } 800| 2.15k| while (q >= 16) { ------------------ | Branch (800:12): [True: 894, False: 1.26k] ------------------ 801| 894| q >>= 1; 802| 8.04k| for (j = 0; j < n; j += 4 * q) { ------------------ | Branch (802:21): [True: 7.15k, False: 894] ------------------ 803| 14.3k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (803:25): [True: 7.15k, False: 7.15k] ------------------ 804| 7.15k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 7.15k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 805| 7.15k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 7.15k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 806| 7.15k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 7.15k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 807| 7.15k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 7.15k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 808| 7.15k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 7.15k| do { \ | | 16| 7.15k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.15k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.15k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.15k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.15k| (a) = c; \ | | 19| 7.15k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.15k] | | ------------------ ------------------ 809| 7.15k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 7.15k| do { \ | | 16| 7.15k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.15k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.15k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.15k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.15k| (a) = c; \ | | 19| 7.15k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.15k] | | ------------------ ------------------ 810| 7.15k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 7.15k| do { \ | | 16| 7.15k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.15k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.15k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.15k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.15k| (a) = c; \ | | 19| 7.15k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.15k] | | ------------------ ------------------ 811| 7.15k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 7.15k| do { \ | | 16| 7.15k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.15k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.15k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.15k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.15k| (a) = c; \ | | 19| 7.15k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.15k] | | ------------------ ------------------ 812| 7.15k| int32x8_store(&x[i], x0); ------------------ | | 10| 7.15k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 813| 7.15k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 7.15k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 814| 7.15k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 7.15k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 815| 7.15k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 7.15k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 816| 7.15k| } 817| 7.15k| } 818| 894| q >>= 1; 819| 894| } 820| 1.26k| if (q == 8) { ------------------ | Branch (820:9): [True: 0, False: 1.26k] ------------------ 821| 0| for (j = 0; j < n; j += q + q) { ------------------ | Branch (821:21): [True: 0, False: 0] ------------------ 822| 0| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 823| 0| int32x8 x1 = int32x8_load(&x[j + q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 824| 0| int32x8_MINMAX(x0, x1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 825| 0| int32x8_store(&x[j], x0); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 826| 0| int32x8_store(&x[j + q], x1); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 827| 0| } 828| 0| } 829| | 830| 1.26k| q = n >> 3; 831| 6.58k| for (i = 0; i < q; i += 8) { ------------------ | Branch (831:17): [True: 5.32k, False: 1.26k] ------------------ 832| 5.32k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 833| 5.32k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 834| 5.32k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 835| 5.32k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 836| 5.32k| int32x8 x4 = int32x8_load(&x[i + 4 * q]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 837| 5.32k| int32x8 x5 = int32x8_load(&x[i + 5 * q]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 838| 5.32k| int32x8 x6 = int32x8_load(&x[i + 6 * q]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 839| 5.32k| int32x8 x7 = int32x8_load(&x[i + 7 * q]); ------------------ | | 9| 5.32k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 840| | 841| 5.32k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 842| 5.32k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 843| 5.32k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 844| 5.32k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 845| 5.32k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 846| 5.32k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 847| 5.32k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 848| 5.32k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 849| 5.32k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 850| 5.32k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 851| 5.32k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 852| 5.32k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 5.32k| do { \ | | 16| 5.32k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.32k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.32k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.32k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.32k| (a) = c; \ | | 19| 5.32k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.32k] | | ------------------ ------------------ 853| | 854| 5.32k| int32x8 b0 = _mm256_unpacklo_epi32(x0, x4); /* AE0AE1AE4AE5 */ 855| 5.32k| int32x8 b1 = _mm256_unpackhi_epi32(x0, x4); /* AE2AE3AE6AE7 */ 856| 5.32k| int32x8 b2 = _mm256_unpacklo_epi32(x1, x5); /* BF0BF1BF4BF5 */ 857| 5.32k| int32x8 b3 = _mm256_unpackhi_epi32(x1, x5); /* BF2BF3BF6BF7 */ 858| 5.32k| int32x8 b4 = _mm256_unpacklo_epi32(x2, x6); /* CG0CG1CG4CG5 */ 859| 5.32k| int32x8 b5 = _mm256_unpackhi_epi32(x2, x6); /* CG2CG3CG6CG7 */ 860| 5.32k| int32x8 b6 = _mm256_unpacklo_epi32(x3, x7); /* DH0DH1DH4DH5 */ 861| 5.32k| int32x8 b7 = _mm256_unpackhi_epi32(x3, x7); /* DH2DH3DH6DH7 */ 862| | 863| 5.32k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b4); /* AECG0AECG4 */ 864| 5.32k| int32x8 c1 = _mm256_unpacklo_epi64(b1, b5); /* AECG2AECG6 */ 865| 5.32k| int32x8 c2 = _mm256_unpackhi_epi64(b0, b4); /* AECG1AECG5 */ 866| 5.32k| int32x8 c3 = _mm256_unpackhi_epi64(b1, b5); /* AECG3AECG7 */ 867| 5.32k| int32x8 c4 = _mm256_unpacklo_epi64(b2, b6); /* BFDH0BFDH4 */ 868| 5.32k| int32x8 c5 = _mm256_unpacklo_epi64(b3, b7); /* BFDH2BFDH6 */ 869| 5.32k| int32x8 c6 = _mm256_unpackhi_epi64(b2, b6); /* BFDH1BFDH5 */ 870| 5.32k| int32x8 c7 = _mm256_unpackhi_epi64(b3, b7); /* BFDH3BFDH7 */ 871| | 872| 5.32k| int32x8 d0 = _mm256_permute2x128_si256(c0, c4, 0x20); /* AECGBFDH0 */ 873| 5.32k| int32x8 d1 = _mm256_permute2x128_si256(c1, c5, 0x20); /* AECGBFDH2 */ 874| 5.32k| int32x8 d2 = _mm256_permute2x128_si256(c2, c6, 0x20); /* AECGBFDH1 */ 875| 5.32k| int32x8 d3 = _mm256_permute2x128_si256(c3, c7, 0x20); /* AECGBFDH3 */ 876| 5.32k| int32x8 d4 = _mm256_permute2x128_si256(c0, c4, 0x31); /* AECGBFDH4 */ 877| 5.32k| int32x8 d5 = _mm256_permute2x128_si256(c1, c5, 0x31); /* AECGBFDH6 */ 878| 5.32k| int32x8 d6 = _mm256_permute2x128_si256(c2, c6, 0x31); /* AECGBFDH5 */ 879| 5.32k| int32x8 d7 = _mm256_permute2x128_si256(c3, c7, 0x31); /* AECGBFDH7 */ 880| | 881| 5.32k| if (flagdown) { ------------------ | Branch (881:13): [True: 3.64k, False: 1.68k] ------------------ 882| 3.64k| d0 ^= mask; 883| 3.64k| d1 ^= mask; 884| 3.64k| d2 ^= mask; 885| 3.64k| d3 ^= mask; 886| 3.64k| d4 ^= mask; 887| 3.64k| d5 ^= mask; 888| 3.64k| d6 ^= mask; 889| 3.64k| d7 ^= mask; 890| 3.64k| } 891| | 892| 5.32k| int32x8_store(&x[i], d0); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 893| 5.32k| int32x8_store(&x[i + q], d4); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 894| 5.32k| int32x8_store(&x[i + 2 * q], d1); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 895| 5.32k| int32x8_store(&x[i + 3 * q], d5); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 896| 5.32k| int32x8_store(&x[i + 4 * q], d2); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 897| 5.32k| int32x8_store(&x[i + 5 * q], d6); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 898| 5.32k| int32x8_store(&x[i + 6 * q], d3); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 899| 5.32k| int32x8_store(&x[i + 7 * q], d7); ------------------ | | 10| 5.32k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 900| 5.32k| } 901| 1.26k|} crypto_sort_int32.c:int32_threestages: 132| 1.50k|static size_t int32_threestages(int32 *x, size_t n, size_t q) { 133| 1.50k| size_t k, i; 134| | 135| 7.41k| for (k = 0; k + 8 * q <= n; k += 8 * q) { ------------------ | Branch (135:17): [True: 5.91k, False: 1.50k] ------------------ 136| 12.9k| for (i = k; i < k + q; i += 8) { ------------------ | Branch (136:21): [True: 7.06k, False: 5.91k] ------------------ 137| 7.06k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 7.06k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 138| 7.06k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 7.06k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 139| 7.06k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 7.06k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 140| 7.06k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 7.06k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 141| 7.06k| int32x8 x4 = int32x8_load(&x[i + 4 * q]); ------------------ | | 9| 7.06k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 142| 7.06k| int32x8 x5 = int32x8_load(&x[i + 5 * q]); ------------------ | | 9| 7.06k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 143| 7.06k| int32x8 x6 = int32x8_load(&x[i + 6 * q]); ------------------ | | 9| 7.06k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 144| 7.06k| int32x8 x7 = int32x8_load(&x[i + 7 * q]); ------------------ | | 9| 7.06k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 145| | 146| 7.06k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 7.06k| do { \ | | 16| 7.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.06k| (a) = c; \ | | 19| 7.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.06k] | | ------------------ ------------------ 147| 7.06k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 7.06k| do { \ | | 16| 7.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.06k| (a) = c; \ | | 19| 7.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.06k] | | ------------------ ------------------ 148| 7.06k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 7.06k| do { \ | | 16| 7.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.06k| (a) = c; \ | | 19| 7.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.06k] | | ------------------ ------------------ 149| 7.06k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 7.06k| do { \ | | 16| 7.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.06k| (a) = c; \ | | 19| 7.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.06k] | | ------------------ ------------------ 150| 7.06k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 7.06k| do { \ | | 16| 7.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.06k| (a) = c; \ | | 19| 7.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.06k] | | ------------------ ------------------ 151| 7.06k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 7.06k| do { \ | | 16| 7.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.06k| (a) = c; \ | | 19| 7.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.06k] | | ------------------ ------------------ 152| 7.06k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 7.06k| do { \ | | 16| 7.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.06k| (a) = c; \ | | 19| 7.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.06k] | | ------------------ ------------------ 153| 7.06k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 7.06k| do { \ | | 16| 7.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.06k| (a) = c; \ | | 19| 7.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.06k] | | ------------------ ------------------ 154| 7.06k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 7.06k| do { \ | | 16| 7.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.06k| (a) = c; \ | | 19| 7.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.06k] | | ------------------ ------------------ 155| 7.06k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 7.06k| do { \ | | 16| 7.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.06k| (a) = c; \ | | 19| 7.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.06k] | | ------------------ ------------------ 156| 7.06k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 7.06k| do { \ | | 16| 7.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.06k| (a) = c; \ | | 19| 7.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.06k] | | ------------------ ------------------ 157| 7.06k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 7.06k| do { \ | | 16| 7.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.06k| (a) = c; \ | | 19| 7.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.06k] | | ------------------ ------------------ 158| | 159| 7.06k| int32x8_store(&x[i], x0); ------------------ | | 10| 7.06k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 160| 7.06k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 7.06k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 161| 7.06k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 7.06k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 162| 7.06k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 7.06k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 163| 7.06k| int32x8_store(&x[i + 4 * q], x4); ------------------ | | 10| 7.06k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 164| 7.06k| int32x8_store(&x[i + 5 * q], x5); ------------------ | | 10| 7.06k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 165| 7.06k| int32x8_store(&x[i + 6 * q], x6); ------------------ | | 10| 7.06k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 166| 7.06k| int32x8_store(&x[i + 7 * q], x7); ------------------ | | 10| 7.06k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 167| 7.06k| } 168| 5.91k| } 169| | 170| 1.50k| return k; 171| 1.50k|} crypto_sort_int32.c:minmax_vector: 32| 5.19k|static void minmax_vector(int32 *x, int32 *y, size_t n) { 33| 5.19k| if ((long long) n < 8) { ------------------ | Branch (33:9): [True: 2.55k, False: 2.64k] ------------------ 34| 5.41k| while ((long long) n > 0) { ------------------ | Branch (34:16): [True: 2.85k, False: 2.55k] ------------------ 35| 2.85k| int32_MINMAX(x, y); 36| 2.85k| ++x; 37| 2.85k| ++y; 38| 2.85k| --n; 39| 2.85k| } 40| 2.55k| return; 41| 2.55k| } 42| 2.64k| if (n & 7) { ------------------ | Branch (42:9): [True: 2.64k, False: 0] ------------------ 43| 2.64k| int32x8 x0 = int32x8_load(x + n - 8); ------------------ | | 9| 2.64k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 44| 2.64k| int32x8 y0 = int32x8_load(y + n - 8); ------------------ | | 9| 2.64k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 45| 2.64k| int32x8_MINMAX(x0, y0); ------------------ | | 15| 2.64k| do { \ | | 16| 2.64k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.64k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.64k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.64k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.64k| (a) = c; \ | | 19| 2.64k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.64k] | | ------------------ ------------------ 46| 2.64k| int32x8_store(x + n - 8, x0); ------------------ | | 10| 2.64k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 47| 2.64k| int32x8_store(y + n - 8, y0); ------------------ | | 10| 2.64k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 48| 2.64k| n &= ~7; 49| 2.64k| } 50| 29.6k| do { 51| 29.6k| int32x8 x0 = int32x8_load(x); ------------------ | | 9| 29.6k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 52| 29.6k| int32x8 y0 = int32x8_load(y); ------------------ | | 9| 29.6k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 53| 29.6k| int32x8_MINMAX(x0, y0); ------------------ | | 15| 29.6k| do { \ | | 16| 29.6k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 29.6k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 29.6k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 29.6k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 29.6k| (a) = c; \ | | 19| 29.6k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 29.6k] | | ------------------ ------------------ 54| 29.6k| int32x8_store(x, x0); ------------------ | | 10| 29.6k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 55| 29.6k| int32x8_store(y, y0); ------------------ | | 10| 29.6k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 56| 29.6k| x += 8; 57| 29.6k| y += 8; 58| 29.6k| n -= 8; 59| 29.6k| } while (n); ------------------ | Branch (59:14): [True: 26.9k, False: 2.64k] ------------------ 60| 2.64k|} PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_keypair: 10| 174|int PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 174| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 174| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 174|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 22| 174|#define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 174|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 174|#define NTRU_N 509 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 174|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 174|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 14| 174| PQCLEAN_NTRUHPS2048509_AVX2_owcpa_keypair(pk, sk, seed); 15| | 16| 174| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 174|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 30| 174|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 174|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 174|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 174|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 174|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 174|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 174|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 174|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 17| 174|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 174| return 0; 19| 174|} PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_enc: 21| 174|int PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 174| poly r, m; 23| 174| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 174| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 174| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 174|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 23| 174|#define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 174|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 174|#define NTRU_N 509 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 174|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 174|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 174| PQCLEAN_NTRUHPS2048509_AVX2_sample_rm(&r, &m, rm_seed); 29| | 30| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(rm, &r); 31| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 26| 174|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 174|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 174|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 32| 174| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 174|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 174|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 174|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 174|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 174|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(&r); 35| 174| PQCLEAN_NTRUHPS2048509_AVX2_owcpa_enc(c, &r, &m, pk); 36| | 37| 174| return 0; 38| 174|} PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_dec: 40| 174|int PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 174| int i, fail; 42| 174| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 174| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 174| fail = PQCLEAN_NTRUHPS2048509_AVX2_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHPS2048509_AVX2_owcpa_dec for details. */ 48| | 49| 174| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 174|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 174|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 174|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 174|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 174|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 5.74k| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 17| 5.74k|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 5.56k, False: 174] ------------------ 53| 5.56k| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 30| 5.56k|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 5.56k|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 5.56k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 5.56k|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 5.56k|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 5.56k|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 5.56k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 5.56k|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 5.56k| } 55| 121k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 35| 121k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 121k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 121k|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 121k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 121k|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 121k, False: 174] ------------------ 56| 121k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 17| 121k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 121k| } 58| 174| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 174|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 17| 174|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 35| 174|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 174|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 174|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 174|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 174|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 174| PQCLEAN_NTRUHPS2048509_AVX2_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 18| 174|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 174| return 0; 63| 174|} PQCLEAN_NTRUHPS2048509_AVX2_owcpa_keypair: 62| 174| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 63| 174| int i; 64| | 65| 174| poly x1, x2, x3, x4, x5; 66| | 67| 174| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 68| 174| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 69| 174| poly *invh = &x3, *h = &x3; 70| | 71| 174| PQCLEAN_NTRUHPS2048509_AVX2_sample_fg(f, g, seed); 72| | 73| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_inv(invf_mod3, f); 74| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(sk, f); 75| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 26| 174|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 174|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 174|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 76| | 77| | /* Lift coeffs of f and g from Z_p to Z_q */ 78| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(f); 79| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(g); 80| | 81| | 82| | /* g = 3*g */ 83| 88.7k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 88.7k|#define NTRU_N 509 ------------------ | Branch (83:17): [True: 88.5k, False: 174] ------------------ 84| 88.5k| g->coeffs[i] = 3 * g->coeffs[i]; 85| 88.5k| } 86| | 87| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(gf, g, f); 88| | 89| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_inv(invgf, gf); 90| | 91| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(tmp, invgf, f); 92| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_mul(invh, tmp, f); 93| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 26| 174|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 174|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 174|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 94| | 95| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(tmp, invgf, g); 96| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(h, tmp, g); 97| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_tobytes(pk, h); 98| 174|} PQCLEAN_NTRUHPS2048509_AVX2_owcpa_enc: 104| 174| const unsigned char *pk) { 105| 174| int i; 106| 174| poly x1, x2; 107| 174| poly *h = &x1, *liftm = &x1; 108| 174| poly *ct = &x2; 109| | 110| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_frombytes(h, pk); 111| | 112| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(ct, r, h); 113| | 114| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_lift(liftm, m); 115| 88.7k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 88.7k|#define NTRU_N 509 ------------------ | Branch (115:17): [True: 88.5k, False: 174] ------------------ 116| 88.5k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 117| 88.5k| } 118| | 119| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_tobytes(c, ct); 120| 174|} PQCLEAN_NTRUHPS2048509_AVX2_owcpa_dec: 124| 174| const unsigned char *secretkey) { 125| 174| int i; 126| 174| int fail; 127| 174| poly x1, x2, x3, x4; 128| | 129| 174| poly *c = &x1, *f = &x2, *cf = &x3; 130| 174| poly *mf = &x2, *finv3 = &x3, *m = &x4; 131| 174| poly *liftm = &x2, *invh = &x3, *r = &x4; 132| 174| poly *b = &x1; 133| | 134| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_frombytes(c, ciphertext); 135| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_frombytes(f, secretkey); 136| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(f); 137| | 138| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(cf, c, f); 139| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_to_S3(mf, cf); 140| | 141| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 174|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 174|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 174|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 142| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_mul(m, mf, finv3); 143| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 26| 174|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 174|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 174|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 144| | 145| 174| fail = 0; 146| | 147| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 148| 174| fail |= owcpa_check_ciphertext(ciphertext); 149| | 150| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 151| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 152| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 153| | /* (m can take any value in S3 in NTRU_HRSS) */ 154| 174| fail |= owcpa_check_m(m); 155| | 156| | /* b = c - Lift(m) mod (q, x^n - 1) */ 157| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_lift(liftm, m); 158| 88.7k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 88.7k|#define NTRU_N 509 ------------------ | Branch (158:17): [True: 88.5k, False: 174] ------------------ 159| 88.5k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 160| 88.5k| } 161| | 162| | /* r = b / h mod (q, Phi_n) */ 163| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 174|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 174|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 174|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 164| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_mul(r, b, invh); 165| | 166| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 167| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 168| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 169| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 170| | /* where r gets a final reduction modulo p. */ 171| | /* We need this change to use Proposition 1 of [Sch18]. */ 172| | 173| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 174| | /* if and only if fail==0 after the following call to owcpa_check_r */ 175| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 176| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 177| 174| fail |= owcpa_check_r(r); 178| | 179| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_trinary_Zq_to_Z3(r); 180| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(rm, r); 181| | 182| 174| return fail; 183| 174|} PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes: 3| 1.04k|void PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 1.04k| int i; 5| 1.04k| unsigned char c; 6| 1.04k| int j; 7| | 8| 106k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 106k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 106k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (8:17): [True: 105k, False: 1.04k] ------------------ 9| 105k| c = a->coeffs[5 * i + 4] & 255; 10| 105k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 11| 105k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 12| 105k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 13| 105k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 14| 105k| msg[i] = c; 15| 105k| } 16| 1.04k| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 1.04k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 1.04k|#define NTRU_N 509 | | ------------------ ------------------ 17| 1.04k| c = 0; 18| 4.17k| for (j = NTRU_PACK_DEG - (5 * i) - 1; j >= 0; j--) { ------------------ | | 25| 1.04k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 1.04k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (18:43): [True: 3.13k, False: 1.04k] ------------------ 19| 3.13k| c = (3 * c + a->coeffs[5 * i + j]) & 255; 20| 3.13k| } 21| 1.04k| msg[i] = c; 22| 1.04k|} PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_frombytes: 24| 348|void PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 25| 348| int i; 26| 348| unsigned char c; 27| 348| int j; 28| | 29| 35.4k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 35.4k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 35.4k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (29:17): [True: 35.1k, False: 348] ------------------ 30| 35.1k| c = msg[i]; 31| 35.1k| r->coeffs[5 * i + 0] = c; 32| 35.1k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 33| 35.1k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 34| 35.1k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 35| 35.1k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 36| 35.1k| } 37| 348| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 348|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 348|#define NTRU_N 509 | | ------------------ ------------------ 38| 348| c = msg[i]; 39| 1.39k| for (j = 0; (5 * i + j) < NTRU_PACK_DEG; j++) { ------------------ | | 25| 1.39k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 1.39k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (39:17): [True: 1.04k, False: 348] ------------------ 40| 1.04k| r->coeffs[5 * i + j] = c; 41| 1.04k| c = c * 171 >> 9; 42| 1.04k| } 43| 348| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 348|#define NTRU_N 509 ------------------ 44| 348| PQCLEAN_NTRUHPS2048509_AVX2_poly_mod_3_Phi_n(r); 45| 348|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_tobytes: 3| 522|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_tobytes(unsigned char *r, const poly *a) { 4| 522| int i, j; 5| 522| uint16_t t[8]; 6| | 7| 33.4k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 25| 33.4k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 33.4k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (7:17): [True: 32.8k, False: 522] ------------------ 8| 295k| for (j = 0; j < 8; j++) { ------------------ | Branch (8:21): [True: 263k, False: 32.8k] ------------------ 9| 263k| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 263k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 263k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 263k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 10| 263k| } 11| | 12| 32.8k| r[11 * i + 0] = (unsigned char) ( t[0] & 0xff); 13| 32.8k| r[11 * i + 1] = (unsigned char) ((t[0] >> 8) | ((t[1] & 0x1f) << 3)); 14| 32.8k| r[11 * i + 2] = (unsigned char) ((t[1] >> 5) | ((t[2] & 0x03) << 6)); 15| 32.8k| r[11 * i + 3] = (unsigned char) ((t[2] >> 2) & 0xff); 16| 32.8k| r[11 * i + 4] = (unsigned char) ((t[2] >> 10) | ((t[3] & 0x7f) << 1)); 17| 32.8k| r[11 * i + 5] = (unsigned char) ((t[3] >> 7) | ((t[4] & 0x0f) << 4)); 18| 32.8k| r[11 * i + 6] = (unsigned char) ((t[4] >> 4) | ((t[5] & 0x01) << 7)); 19| 32.8k| r[11 * i + 7] = (unsigned char) ((t[5] >> 1) & 0xff); 20| 32.8k| r[11 * i + 8] = (unsigned char) ((t[5] >> 9) | ((t[6] & 0x3f) << 2)); 21| 32.8k| r[11 * i + 9] = (unsigned char) ((t[6] >> 6) | ((t[7] & 0x07) << 5)); 22| 32.8k| r[11 * i + 10] = (unsigned char) ((t[7] >> 3)); 23| 32.8k| } 24| | 25| 2.61k| for (j = 0; j < NTRU_PACK_DEG - 8 * i; j++) { ------------------ | | 25| 2.61k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 2.61k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (25:17): [True: 2.08k, False: 522] ------------------ 26| 2.08k| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 2.08k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 2.08k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 2.08k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 27| 2.08k| } 28| 2.61k| for (; j < 8; j++) { ------------------ | Branch (28:12): [True: 2.08k, False: 522] ------------------ 29| 2.08k| t[j] = 0; 30| 2.08k| } 31| | 32| 522| switch (NTRU_PACK_DEG & 0x07) { ------------------ | | 25| 522|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 522|#define NTRU_N 509 | | ------------------ ------------------ | Branch (32:13): [True: 522, Folded] ------------------ 33| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 34| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 35| 522| case 4: ------------------ | Branch (35:5): [True: 522, False: 0] ------------------ 36| 522| r[11 * i + 0] = (unsigned char) (t[0] & 0xff); 37| 522| r[11 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x1f) << 3); 38| 522| r[11 * i + 2] = (unsigned char) (t[1] >> 5) | ((t[2] & 0x03) << 6); 39| 522| r[11 * i + 3] = (unsigned char) (t[2] >> 2) & 0xff; 40| 522| r[11 * i + 4] = (unsigned char) (t[2] >> 10) | ((t[3] & 0x7f) << 1); 41| 522| r[11 * i + 5] = (unsigned char) (t[3] >> 7) | ((t[4] & 0x0f) << 4); 42| 522| break; 43| 0| case 2: ------------------ | Branch (43:5): [True: 0, False: 522] ------------------ 44| 0| r[11 * i + 0] = (unsigned char) (t[0] & 0xff); 45| 0| r[11 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x1f) << 3); 46| 0| r[11 * i + 2] = (unsigned char) (t[1] >> 5) | ((t[2] & 0x03) << 6); 47| 0| break; 48| 522| } 49| 522|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_frombytes: 51| 522|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_frombytes(poly *r, const unsigned char *a) { 52| 522| int i; 53| 33.4k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 25| 33.4k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 33.4k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (53:17): [True: 32.8k, False: 522] ------------------ 54| 32.8k| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 55| 32.8k| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 56| 32.8k| r->coeffs[8 * i + 2] = (a[11 * i + 2] >> 6) | (((uint16_t)a[11 * i + 3] & 0xff) << 2) | (((uint16_t)a[11 * i + 4] & 0x01) << 10); 57| 32.8k| r->coeffs[8 * i + 3] = (a[11 * i + 4] >> 1) | (((uint16_t)a[11 * i + 5] & 0x0f) << 7); 58| 32.8k| r->coeffs[8 * i + 4] = (a[11 * i + 5] >> 4) | (((uint16_t)a[11 * i + 6] & 0x7f) << 4); 59| 32.8k| r->coeffs[8 * i + 5] = (a[11 * i + 6] >> 7) | (((uint16_t)a[11 * i + 7] & 0xff) << 1) | (((uint16_t)a[11 * i + 8] & 0x03) << 9); 60| 32.8k| r->coeffs[8 * i + 6] = (a[11 * i + 8] >> 2) | (((uint16_t)a[11 * i + 9] & 0x1f) << 6); 61| 32.8k| r->coeffs[8 * i + 7] = (a[11 * i + 9] >> 5) | (((uint16_t)a[11 * i + 10] & 0xff) << 3); 62| 32.8k| } 63| 522| switch (NTRU_PACK_DEG & 0x07) { ------------------ | | 25| 522|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 522|#define NTRU_N 509 | | ------------------ ------------------ | Branch (63:13): [True: 522, Folded] ------------------ 64| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 65| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 66| 522| case 4: ------------------ | Branch (66:5): [True: 522, False: 0] ------------------ 67| 522| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 68| 522| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 69| 522| r->coeffs[8 * i + 2] = (a[11 * i + 2] >> 6) | (((uint16_t)a[11 * i + 3] & 0xff) << 2) | (((uint16_t)a[11 * i + 4] & 0x01) << 10); 70| 522| r->coeffs[8 * i + 3] = (a[11 * i + 4] >> 1) | (((uint16_t)a[11 * i + 5] & 0x0f) << 7); 71| 522| break; 72| 0| case 2: ------------------ | Branch (72:5): [True: 0, False: 522] ------------------ 73| 0| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 74| 0| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 75| 0| break; 76| 522| } 77| 522| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 522|#define NTRU_N 509 ------------------ 78| 522|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_tobytes: 80| 348|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 81| 348| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_tobytes(r, a); 82| 348|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_frombytes: 84| 348|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 85| 348| int i; 86| 348| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_frombytes(r, a); 87| | 88| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 89| 348| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 348|#define NTRU_N 509 ------------------ 90| 177k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 25| 177k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 177k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (90:17): [True: 176k, False: 348] ------------------ 91| 176k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 176k|#define NTRU_N 509 ------------------ 92| 176k| } 93| 348|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq: 4| 1.04k|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(poly *r) { 5| 1.04k| int i; 6| 532k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 532k|#define NTRU_N 509 ------------------ | Branch (6:17): [True: 531k, False: 1.04k] ------------------ 7| 531k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 531k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 531k|#define NTRU_LOGQ 11 | | ------------------ ------------------ 8| 531k| } 9| 1.04k|} PQCLEAN_NTRUHPS2048509_AVX2_poly_trinary_Zq_to_Z3: 12| 174|void PQCLEAN_NTRUHPS2048509_AVX2_poly_trinary_Zq_to_Z3(poly *r) { 13| 174| int i; 14| 88.7k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 88.7k|#define NTRU_N 509 ------------------ | Branch (14:17): [True: 88.5k, False: 174] ------------------ 15| 88.5k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 88.5k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 88.5k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 88.5k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 16| 88.5k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 88.5k|#define NTRU_LOGQ 11 ------------------ 17| 88.5k| } 18| 174|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_mul: 20| 348|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 348| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(r, a, b); 22| 348| PQCLEAN_NTRUHPS2048509_AVX2_poly_mod_q_Phi_n(r); 23| 348|} PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_mul: 25| 174|void PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 174| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(r, a, b); 32| 88.7k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 88.7k|#define NTRU_N 509 ------------------ | Branch (32:17): [True: 88.5k, False: 174] ------------------ 33| 88.5k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 88.5k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 88.5k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 88.5k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 34| 88.5k| } 35| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_mod_3_Phi_n(r); 36| 174|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_inv: 71| 174|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_inv(poly *r, const poly *a) { 72| 174| poly ai2; 73| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv(&ai2, a); 74| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 174|} poly.c:PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv_to_Rq_inv: 38| 174|static void PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 174| int i; 41| 174| poly b, c; 42| 174| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 88.7k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 88.7k|#define NTRU_N 509 ------------------ | Branch (46:17): [True: 88.5k, False: 174] ------------------ 47| 88.5k| b.coeffs[i] = -(a->coeffs[i]); 48| 88.5k| } 49| | 50| 88.7k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 88.7k|#define NTRU_N 509 ------------------ | Branch (50:17): [True: 88.5k, False: 174] ------------------ 51| 88.5k| r->coeffs[i] = ai->coeffs[i]; 52| 88.5k| } 53| | 54| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&c, r, &b); 55| 174| c.coeffs[0] += 2; // c = 2 - a*ai 56| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&c, &s, &b); 59| 174| c.coeffs[0] += 2; // c = 2 - a*s 60| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&c, r, &b); 63| 174| c.coeffs[0] += 2; // c = 2 - a*r 64| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&c, &s, &b); 67| 174| c.coeffs[0] += 2; // c = 2 - a*s 68| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 69| 174|} PQCLEAN_NTRUHPS2048509_AVX2_poly_lift: 3| 348|void PQCLEAN_NTRUHPS2048509_AVX2_poly_lift(poly *r, const poly *a) { 4| 348| int i; 5| 177k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 177k|#define NTRU_N 509 ------------------ | Branch (5:17): [True: 177k, False: 348] ------------------ 6| 177k| r->coeffs[i] = a->coeffs[i]; 7| 177k| } 8| 348| PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(r); 9| 348|} PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_tobytes: 11| 174|void PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_tobytes(unsigned char *out, const poly *a) { 12| | // Since pext works on a uint64_t we view the coefficient pointer as a 64-bit pointer 13| | // so that we can extract 4 coefficient at a time. It also makes arithmetic a little easier. 14| 174| uint64_t *coeff_pointer = (void *) a->coeffs; 15| | 16| 174| int i; 17| 11.1k| for (i = 0; i < 63; i++) { ------------------ | Branch (17:17): [True: 10.9k, False: 174] ------------------ 18| 10.9k| out[i] = _pext_u64(coeff_pointer[2 * i], 0x1000100010001); 19| 10.9k| out[i] |= _pext_u64(coeff_pointer[2 * i + 1], 0x1000100010001) << 4; 20| 10.9k| } 21| 174| out[i] = _pext_u64(coeff_pointer[2 * 63], 0x1000100010001); 22| 174| out[i] |= _pext_u64(coeff_pointer[2 * 63 + 1], 0x1) << 4; 23| 174|} PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_frombytes: 25| 174|void PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_frombytes(poly *a, const unsigned char *in) { 26| | // Since pdep results in a uint64_t we view the coefficient pointer as a 64-bit pointer 27| | // so that we can store 4 coefficient at a time. It also makes arithmetic a little easier. 28| 174| uint64_t *coeff_pointer = (void *) a->coeffs; 29| | 30| 174| int i; 31| 11.1k| for (i = 0; i < 63; i++) { ------------------ | Branch (31:17): [True: 10.9k, False: 174] ------------------ 32| 10.9k| coeff_pointer[2 * i] = _pdep_u64(in[i], 0x1000100010001); 33| 10.9k| coeff_pointer[2 * i + 1] = _pdep_u64(in[i] >> 4, 0x1000100010001); 34| 10.9k| } 35| | // From the last byte we only want 5 bits (since we have 509 total, not 512). 36| 174| coeff_pointer[2 * 63] = _pdep_u64(in[i], 0x1000100010001); 37| 174| coeff_pointer[2 * 63 + 1] = _pdep_u64(in[i] >> 4, 0x1); 38| 174|} PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv: 40| 174|void PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv(poly *r, const poly *a) { 41| 174| union { 42| 174| unsigned char s[64]; 43| 174| __m256i s_x32[2]; 44| 174| } squares[13]; 45| 174|#define s(x) squares[(x)].s 46| | 47| | // This relies on the following addition chain: 48| | // 1, 2, 3, 6, 12, 15, 30, 60, 63, 126, 252, 504, 507 49| | 50| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_tobytes(s(0), a); // TODO alignment ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 51| | 52| 174| PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(1), s(0)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(1), s(0)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 53| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 54| 174| PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(2), s(1)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(2), s(1)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 55| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 56| 174| PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(3), s(2)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(3), s(2)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 57| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 58| 174| PQCLEAN_NTRUHPS2048509_AVX2_square_6_509(s(4), s(3)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_6_509(s(4), s(3)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 59| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 60| 174| PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(5), s(4)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(5), s(4)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 61| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 62| 174| PQCLEAN_NTRUHPS2048509_AVX2_square_15_509(s(6), s(5)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_15_509(s(6), s(5)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 63| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 64| 174| PQCLEAN_NTRUHPS2048509_AVX2_square_30_509(s(7), s(6)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_30_509(s(7), s(6)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 65| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 66| 174| PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(8), s(7)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(8), s(7)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 67| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(8), s(8), s(2)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(8), s(8), s(2)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(8), s(8), s(2)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 68| 174| PQCLEAN_NTRUHPS2048509_AVX2_square_63_509(s(9), s(8)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_63_509(s(9), s(8)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 69| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 70| 174| PQCLEAN_NTRUHPS2048509_AVX2_square_126_509(s(10), s(9)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_126_509(s(10), s(9)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 71| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 72| 174| PQCLEAN_NTRUHPS2048509_AVX2_square_252_509(s(11), s(10)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_252_509(s(11), s(10)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 73| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 74| 174| PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(12), s(11)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(12), s(11)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 75| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 76| 174| PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(0), s(12)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(0), s(12)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 77| | 78| 174| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_frombytes(r, s(0)); ------------------ | | 45| 174|#define s(x) squares[(x)].s ------------------ 79| 174|#undef s 80| 174|} PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_inv: 439| 174|void PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_inv(poly *r_out, const poly *a) { 440| 174| const unsigned char *in = (void *) a; 441| 174| unsigned char *out = (void *) r_out; 442| | 443| 174| small input[ppad]; 444| 174| small output[ppad]; 445| 174| int i; 446| | 447| | /* XXX: obviously input/output format should be packed into bytes */ 448| | 449| 88.5k| for (i = 0; i < p; ++i) { ------------------ | | 7| 88.5k|#define p 508 ------------------ | Branch (449:17): [True: 88.3k, False: 174] ------------------ 450| 88.3k| small x = in[2 * i] & 3; /* 0 1 2 3 */ 451| 88.3k| x += 1; /* 0 1 2 3 4 5 6, offset by 1 */ 452| 88.3k| x &= (x - 3) >> 5; /* 0 1 2, offset by 1 */ 453| 88.3k| input[i] = x - 1; 454| 88.3k| } 455| | /* XXX: merge with vec256_init */ 456| | 457| 174| __poly_S3_inv((unsigned char *)output, (unsigned char *)input); 458| | 459| 88.5k| for (i = 0; i < p; ++i) { ------------------ | | 7| 88.5k|#define p 508 ------------------ | Branch (459:17): [True: 88.3k, False: 174] ------------------ 460| 88.3k| out[2 * i] = (3 & output[i]) ^ ((3 & output[i]) >> 1); 461| 88.3k| out[2 * i + 1] = 0; 462| 88.3k| } 463| 174|} poly_s3_inv.c:__poly_S3_inv: 310| 174|static int __poly_S3_inv(unsigned char *outbytes, const unsigned char *inbytes) { 311| 174| small *out = (void *) outbytes; 312| 174| small *in = (void *) inbytes; 313| 174| vec256 F0[numvec]; 314| 174| vec256 F1[numvec]; 315| 174| vec256 G0[numvec]; 316| 174| vec256 G1[numvec]; 317| 174| vec256 V0[numvec]; 318| 174| vec256 V1[numvec]; 319| 174| vec256 R0[numvec]; 320| 174| vec256 R1[numvec]; 321| 174| vec256 c0vec, c1vec; 322| 174| int loop; 323| 174| int c0, c1; 324| 174| int minusdelta = -1; 325| 174| int swapmask; 326| 174| vec256 swapvec; 327| | 328| 174| vec256_init(G0, G1, in); 329| 174| F0[0] = _mm256_set_epi32(-1, -1, -1, -1, -1, -1, -1, -1); 330| 174| F0[1] = _mm256_set_epi32(2147483647, -1, 2147483647, -1, 2147483647, -1, -1, -1); 331| 174| F1[0] = _mm256_set1_epi32(0); 332| 174| F1[1] = _mm256_set1_epi32(0); 333| | 334| 174| V0[0] = _mm256_set1_epi32(0); 335| 174| V1[0] = _mm256_set1_epi32(0); 336| 174| V0[1] = _mm256_set1_epi32(0); 337| 174| V1[1] = _mm256_set1_epi32(0); 338| | 339| 174| R0[0] = _mm256_set_epi32(0, 0, 0, 0, 0, 0, 0, 1); 340| 174| R1[0] = _mm256_set1_epi32(0); 341| 174| R0[1] = _mm256_set1_epi32(0); 342| 174| R1[1] = _mm256_set1_epi32(0); 343| | 344| 44.7k| for (loop = 256; loop > 0; --loop) { ------------------ | Branch (344:22): [True: 44.5k, False: 174] ------------------ 345| 44.5k| vec256_timesx_1(V0); 346| 44.5k| vec256_timesx_1(V1); 347| 44.5k| swapmask = negative_mask(minusdelta) & vec256_bit0mask(G0); 348| | 349| 44.5k| c0 = vec256_bit0mask(F0) & vec256_bit0mask(G0); 350| 44.5k| c1 = vec256_bit0mask(F1) ^ vec256_bit0mask(G1); 351| 44.5k| c1 &= c0; 352| | 353| 44.5k| minusdelta ^= swapmask & (minusdelta ^ -minusdelta); 354| 44.5k| minusdelta -= 1; 355| | 356| 44.5k| swapvec = _mm256_set1_epi32(swapmask); 357| 44.5k| vec256_swap(F0, G0, 2, swapvec); 358| 44.5k| vec256_swap(F1, G1, 2, swapvec); 359| | 360| 44.5k| c0vec = _mm256_set1_epi32(c0); 361| 44.5k| c1vec = _mm256_set1_epi32(c1); 362| | 363| 44.5k| vec256_eliminate(F0, F1, G0, G1, 2, c0vec, c1vec); 364| 44.5k| vec256_divx_2(G0); 365| 44.5k| vec256_divx_2(G1); 366| | 367| 44.5k| vec256_swap(V0, R0, 1, swapvec); 368| 44.5k| vec256_swap(V1, R1, 1, swapvec); 369| 44.5k| vec256_eliminate(V0, V1, R0, R1, 1, c0vec, c1vec); 370| 44.5k| } 371| | 372| 87.6k| for (loop = 503; loop > 0; --loop) { ------------------ | Branch (372:22): [True: 87.5k, False: 174] ------------------ 373| 87.5k| vec256_timesx_2(V0); 374| 87.5k| vec256_timesx_2(V1); 375| 87.5k| swapmask = negative_mask(minusdelta) & vec256_bit0mask(G0); 376| | 377| 87.5k| c0 = vec256_bit0mask(F0) & vec256_bit0mask(G0); 378| 87.5k| c1 = vec256_bit0mask(F1) ^ vec256_bit0mask(G1); 379| 87.5k| c1 &= c0; 380| | 381| 87.5k| minusdelta ^= swapmask & (minusdelta ^ -minusdelta); 382| 87.5k| minusdelta -= 1; 383| | 384| 87.5k| swapvec = _mm256_set1_epi32(swapmask); 385| 87.5k| vec256_swap(F0, G0, 2, swapvec); 386| 87.5k| vec256_swap(F1, G1, 2, swapvec); 387| | 388| 87.5k| c0vec = _mm256_set1_epi32(c0); 389| 87.5k| c1vec = _mm256_set1_epi32(c1); 390| | 391| 87.5k| vec256_eliminate(F0, F1, G0, G1, 2, c0vec, c1vec); 392| 87.5k| vec256_divx_2(G0); 393| 87.5k| vec256_divx_2(G1); 394| | 395| 87.5k| vec256_swap(V0, R0, 2, swapvec); 396| 87.5k| vec256_swap(V1, R1, 2, swapvec); 397| 87.5k| vec256_eliminate(V0, V1, R0, R1, 2, c0vec, c1vec); 398| 87.5k| } 399| | 400| 44.7k| for (loop = 256; loop > 0; --loop) { ------------------ | Branch (400:22): [True: 44.5k, False: 174] ------------------ 401| 44.5k| vec256_timesx_2(V0); 402| 44.5k| vec256_timesx_2(V1); 403| 44.5k| swapmask = negative_mask(minusdelta) & vec256_bit0mask(G0); 404| | 405| 44.5k| c0 = vec256_bit0mask(F0) & vec256_bit0mask(G0); 406| 44.5k| c1 = vec256_bit0mask(F1) ^ vec256_bit0mask(G1); 407| 44.5k| c1 &= c0; 408| | 409| 44.5k| minusdelta ^= swapmask & (minusdelta ^ -minusdelta); 410| 44.5k| minusdelta -= 1; 411| | 412| 44.5k| swapvec = _mm256_set1_epi32(swapmask); 413| 44.5k| vec256_swap(F0, G0, 1, swapvec); 414| 44.5k| vec256_swap(F1, G1, 1, swapvec); 415| | 416| 44.5k| c0vec = _mm256_set1_epi32(c0); 417| 44.5k| c1vec = _mm256_set1_epi32(c1); 418| | 419| 44.5k| vec256_eliminate(F0, F1, G0, G1, 1, c0vec, c1vec); 420| 44.5k| vec256_divx_1(G0); 421| 44.5k| vec256_divx_1(G1); 422| | 423| 44.5k| vec256_swap(V0, R0, 2, swapvec); 424| 44.5k| vec256_swap(V1, R1, 2, swapvec); 425| 44.5k| vec256_eliminate(V0, V1, R0, R1, 2, c0vec, c1vec); 426| 44.5k| } 427| | 428| 174| c0vec = _mm256_set1_epi32(vec256_bit0mask(F0)); 429| 174| c1vec = _mm256_set1_epi32(vec256_bit0mask(F1)); 430| 174| vec256_scale(V0, V1, c0vec, c1vec); 431| | 432| 174| vec256_final(out, V0, V1); 433| 174| out[p] = negative_mask(minusdelta); ------------------ | | 7| 174|#define p 508 ------------------ 434| 174| return 0; 435| 174|} poly_s3_inv.c:vec256_init: 143| 281|static void vec256_init(vec256 *G0, vec256 *G1, const small *s) { 144| 281| int i; 145| 281| small srev[ppad + (ppad - p)]; 146| 281| small si; 147| 281| small g0[ppad]; 148| 281| small g1[ppad]; 149| | 150| 173k| for (i = 0; i < p; ++i) { ------------------ | | 7| 173k|#define p 508 ------------------ | Branch (150:17): [True: 173k, False: 281] ------------------ 151| 173k| srev[ppad - 1 - i] = s[i]; ------------------ | | 8| 173k|#define ppad 512 ------------------ 152| 173k| } 153| 20.0k| for (i = 0; i < ppad - p; ++i) { ------------------ | | 8| 20.0k|#define ppad 512 ------------------ for (i = 0; i < ppad - p; ++i) { ------------------ | | 7| 20.0k|#define p 508 ------------------ | Branch (153:17): [True: 19.7k, False: 281] ------------------ 154| 19.7k| srev[i] = 0; 155| 19.7k| } 156| 20.0k| for (i = p; i < ppad; ++i) { ------------------ | | 7| 281|#define p 508 ------------------ for (i = p; i < ppad; ++i) { ------------------ | | 8| 20.0k|#define ppad 512 ------------------ | Branch (156:17): [True: 19.7k, False: 281] ------------------ 157| 19.7k| srev[i + ppad - p] = 0; ------------------ | | 8| 19.7k|#define ppad 512 ------------------ srev[i + ppad - p] = 0; ------------------ | | 7| 19.7k|#define p 508 ------------------ 158| 19.7k| } 159| | 160| 193k| for (i = 0; i < ppad; ++i) { ------------------ | | 8| 193k|#define ppad 512 ------------------ | Branch (160:17): [True: 192k, False: 281] ------------------ 161| 192k| si = srev[i + ppad - p]; ------------------ | | 8| 192k|#define ppad 512 ------------------ si = srev[i + ppad - p]; ------------------ | | 7| 192k|#define p 508 ------------------ 162| 192k| g0[i] = si & 1; 163| 192k| g1[i] = (si >> 1) & g0[i]; 164| 192k| } 165| | 166| 281| vec256_frombits(G0, g0); 167| 281| vec256_frombits(G1, g1); 168| 281|} poly_s3_inv.c:vec256_frombits: 23| 562|static inline void vec256_frombits(vec256 *v, const small *b) { 24| 562| int i; 25| | 26| 2.06k| for (i = 0; i < numvec; ++i) { ------------------ | | 9| 2.06k|#define numvec 2 ------------------ | Branch (26:17): [True: 1.50k, False: 562] ------------------ 27| 1.50k| vec256 b0 = _mm256_loadu_si256((vec256 *) b); 28| 1.50k| b += 32; /* 0,1,...,31 */ 29| 1.50k| vec256 b1 = _mm256_loadu_si256((vec256 *) b); 30| 1.50k| b += 32; /* 32,33,... */ 31| 1.50k| vec256 b2 = _mm256_loadu_si256((vec256 *) b); 32| 1.50k| b += 32; 33| 1.50k| vec256 b3 = _mm256_loadu_si256((vec256 *) b); 34| 1.50k| b += 32; 35| 1.50k| vec256 b4 = _mm256_loadu_si256((vec256 *) b); 36| 1.50k| b += 32; 37| 1.50k| vec256 b5 = _mm256_loadu_si256((vec256 *) b); 38| 1.50k| b += 32; 39| 1.50k| vec256 b6 = _mm256_loadu_si256((vec256 *) b); 40| 1.50k| b += 32; 41| 1.50k| vec256 b7 = _mm256_loadu_si256((vec256 *) b); 42| 1.50k| b += 32; 43| | 44| 1.50k| vec256 c0 = _mm256_unpacklo_epi32(b0, b1); /* 0 1 2 3 32 33 34 35 4 5 6 7 36 37 38 39 ... 55 */ 45| 1.50k| vec256 c1 = _mm256_unpackhi_epi32(b0, b1); /* 8 9 10 11 40 41 42 43 ... 63 */ 46| 1.50k| vec256 c2 = _mm256_unpacklo_epi32(b2, b3); 47| 1.50k| vec256 c3 = _mm256_unpackhi_epi32(b2, b3); 48| 1.50k| vec256 c4 = _mm256_unpacklo_epi32(b4, b5); 49| 1.50k| vec256 c5 = _mm256_unpackhi_epi32(b4, b5); 50| 1.50k| vec256 c6 = _mm256_unpacklo_epi32(b6, b7); 51| 1.50k| vec256 c7 = _mm256_unpackhi_epi32(b6, b7); 52| | 53| 1.50k| vec256 d0 = c0 | _mm256_slli_epi32(c1, 2); /* 0 8, 1 9, 2 10, 3 11, 32 40, 33 41, ..., 55 63 */ 54| 1.50k| vec256 d2 = c2 | _mm256_slli_epi32(c3, 2); 55| 1.50k| vec256 d4 = c4 | _mm256_slli_epi32(c5, 2); 56| 1.50k| vec256 d6 = c6 | _mm256_slli_epi32(c7, 2); 57| | 58| 1.50k| vec256 e0 = _mm256_unpacklo_epi64(d0, d2); 59| 1.50k| vec256 e2 = _mm256_unpackhi_epi64(d0, d2); 60| 1.50k| vec256 e4 = _mm256_unpacklo_epi64(d4, d6); 61| 1.50k| vec256 e6 = _mm256_unpackhi_epi64(d4, d6); 62| | 63| 1.50k| vec256 f0 = e0 | _mm256_slli_epi32(e2, 1); 64| 1.50k| vec256 f4 = e4 | _mm256_slli_epi32(e6, 1); 65| | 66| 1.50k| vec256 g0 = _mm256_permute2x128_si256(f0, f4, 0x20); 67| 1.50k| vec256 g4 = _mm256_permute2x128_si256(f0, f4, 0x31); 68| | 69| 1.50k| vec256 h = g0 | _mm256_slli_epi32(g4, 4); 70| | 71| 1.50k|#define TRANSPOSE _mm256_set_epi8( 31,27,23,19, 30,26,22,18, 29,25,21,17, 28,24,20,16, 15,11,7,3, 14,10,6,2, 13,9,5,1, 12,8,4,0 ) 72| 1.50k| h = _mm256_shuffle_epi8(h, TRANSPOSE); ------------------ | | 71| 1.50k|#define TRANSPOSE _mm256_set_epi8( 31,27,23,19, 30,26,22,18, 29,25,21,17, 28,24,20,16, 15,11,7,3, 14,10,6,2, 13,9,5,1, 12,8,4,0 ) ------------------ 73| 1.50k| h = _mm256_permute4x64_epi64(h, 0xd8); 74| 1.50k| h = _mm256_shuffle_epi32(h, 0xd8); 75| | 76| 1.50k| *v++ = h; 77| 1.50k| } 78| 562|} poly_s3_inv.c:vec256_timesx_1: 280| 143k|static inline void vec256_timesx_1(vec256 *f) { 281| 143k| vec256 f0 = _mm256_permute4x64_epi64(f[0], 0x93); 282| | 283| 143k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 284| | 285| 143k| low0 = low0 << 1; 286| | 287| 143k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 288| | 289| 143k| f[0] = f0; 290| 143k|} poly_s3_inv.c:negative_mask: 196| 346k|static inline int negative_mask(int x) { 197| 346k| return x >> 31; 198| 346k|} poly_s3_inv.c:vec256_bit0mask: 247| 1.72M|static inline int vec256_bit0mask(vec256 *f) { 248| 1.72M| return -(_mm_cvtsi128_si32(_mm256_castsi256_si128(f[0])) & 1); 249| 1.72M|} poly_s3_inv.c:vec256_swap: 200| 1.38M|static inline void vec256_swap(vec256 *f, vec256 *g, int len, vec256 mask) { 201| 1.38M| vec256 flip; 202| 1.38M| int i; 203| | 204| 4.61M| for (i = 0; i < len; ++i) { ------------------ | Branch (204:17): [True: 3.22M, False: 1.38M] ------------------ 205| 3.22M| flip = mask & (f[i] ^ g[i]); 206| 3.22M| f[i] ^= flip; 207| 3.22M| g[i] ^= flip; 208| 3.22M| } 209| 1.38M|} poly_s3_inv.c:vec256_eliminate: 227| 691k|static inline void vec256_eliminate(vec256 *f0, vec256 *f1, vec256 *g0, vec256 *g1, int len, const vec256 c0, const vec256 c1) { 228| 691k| int i; 229| | 230| 2.30M| for (i = 0; i < len; ++i) { ------------------ | Branch (230:17): [True: 1.61M, False: 691k] ------------------ 231| 1.61M| vec256 f0i = f0[i]; 232| 1.61M| vec256 f1i = f1[i]; 233| 1.61M| vec256 g0i = g0[i]; 234| 1.61M| vec256 g1i = g1[i]; 235| 1.61M| vec256 t; 236| | 237| 1.61M| f0i &= c0; 238| 1.61M| f1i ^= c1; 239| 1.61M| f1i &= f0i; 240| | 241| 1.61M| t = g0i ^ f0i; 242| 1.61M| g0[i] = t | (g1i ^ f1i); 243| 1.61M| g1[i] = (g1i ^ f0i) & (f1i ^ t); 244| 1.61M| } 245| 691k|} poly_s3_inv.c:vec256_divx_2: 263| 318k|static inline void vec256_divx_2(vec256 *f) { 264| 318k| vec256 f0 = f[0]; 265| 318k| vec256 f1 = f[1]; 266| | 267| 318k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 268| 318k| unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1)); 269| | 270| 318k| low0 = (low0 >> 1) | (low1 << 63); 271| 318k| low1 = low1 >> 1; 272| | 273| 318k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 274| 318k| f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3); 275| | 276| 318k| f[0] = _mm256_permute4x64_epi64(f0, 0x39); 277| | f[1] = _mm256_permute4x64_epi64(f1, 0x39); 278| 318k|} poly_s3_inv.c:vec256_timesx_2: 292| 318k|static inline void vec256_timesx_2(vec256 *f) { 293| 318k| vec256 f0 = _mm256_permute4x64_epi64(f[0], 0x93); 294| 318k| vec256 f1 = _mm256_permute4x64_epi64(f[1], 0x93); 295| | 296| 318k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 297| 318k| unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1)); 298| | 299| 318k| low1 = (low1 << 1) | (low0 >> 63); 300| 318k| low0 = low0 << 1; 301| | 302| 318k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 303| 318k| f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3); 304| | 305| 318k| f[0] = f0; 306| 318k| f[1] = f1; 307| 318k|} poly_s3_inv.c:vec256_divx_1: 251| 143k|static inline void vec256_divx_1(vec256 *f) { 252| 143k| vec256 f0 = f[0]; 253| | 254| 143k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 255| | 256| 143k| low0 = low0 >> 1; 257| | 258| 143k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 259| | 260| | f[0] = _mm256_permute4x64_epi64(f0, 0x39); 261| 143k|} poly_s3_inv.c:vec256_scale: 211| 281|static inline void vec256_scale(vec256 *f0, vec256 *f1, const vec256 c0, const vec256 c1) { 212| 281| int i; 213| | 214| 1.03k| for (i = 0; i < numvec; ++i) { ------------------ | | 9| 1.03k|#define numvec 2 ------------------ | Branch (214:17): [True: 753, False: 281] ------------------ 215| 753| vec256 f0i = f0[i]; 216| 753| vec256 f1i = f1[i]; 217| | 218| 753| f0i &= c0; 219| 753| f1i ^= c1; 220| 753| f1i &= f0i; 221| | 222| 753| f0[i] = f0i; 223| 753| f1[i] = f1i; 224| 753| } 225| 281|} poly_s3_inv.c:vec256_final: 170| 281|static void vec256_final(small *out, const vec256 *V0, const vec256 *V1) { 171| 281| int i; 172| 281| small v0[ppad]; 173| 281| small v1[ppad]; 174| 281| small v[ppad]; 175| 281| small vrev[ppad + (ppad - p)]; 176| | 177| 281| vec256_tobits(V0, v0); 178| 281| vec256_tobits(V1, v1); 179| | 180| 193k| for (i = 0; i < ppad; ++i) { ------------------ | | 8| 193k|#define ppad 512 ------------------ | Branch (180:17): [True: 192k, False: 281] ------------------ 181| 192k| v[i] = v0[i] + 2 * v1[i] - 4 * (v0[i] & v1[i]); 182| 192k| } 183| | 184| 193k| for (i = 0; i < ppad; ++i) { ------------------ | | 8| 193k|#define ppad 512 ------------------ | Branch (184:17): [True: 192k, False: 281] ------------------ 185| 192k| vrev[i] = v[ppad - 1 - i]; ------------------ | | 8| 192k|#define ppad 512 ------------------ 186| 192k| } 187| 20.0k| for (i = ppad; i < ppad + (ppad - p); ++i) { ------------------ | | 8| 281|#define ppad 512 ------------------ for (i = ppad; i < ppad + (ppad - p); ++i) { ------------------ | | 8| 20.0k|#define ppad 512 ------------------ for (i = ppad; i < ppad + (ppad - p); ++i) { ------------------ | | 8| 20.0k|#define ppad 512 ------------------ for (i = ppad; i < ppad + (ppad - p); ++i) { ------------------ | | 7| 20.0k|#define p 508 ------------------ | Branch (187:20): [True: 19.7k, False: 281] ------------------ 188| 19.7k| vrev[i] = 0; 189| 19.7k| } 190| | 191| 173k| for (i = 0; i < p; ++i) { ------------------ | | 7| 173k|#define p 508 ------------------ | Branch (191:17): [True: 173k, False: 281] ------------------ 192| 173k| out[i] = vrev[i + ppad - p]; ------------------ | | 8| 173k|#define ppad 512 ------------------ out[i] = vrev[i + ppad - p]; ------------------ | | 7| 173k|#define p 508 ------------------ 193| 173k| } 194| 281|} poly_s3_inv.c:vec256_tobits: 80| 562|static inline void vec256_tobits(const vec256 *v, small *b) { 81| 562| int i; 82| | 83| 2.06k| for (i = 0; i < numvec; ++i) { ------------------ | | 9| 2.06k|#define numvec 2 ------------------ | Branch (83:17): [True: 1.50k, False: 562] ------------------ 84| 1.50k| vec256 h = *v++; 85| | 86| 1.50k| h = _mm256_shuffle_epi32(h, 0xd8); 87| 1.50k| h = _mm256_permute4x64_epi64(h, 0xd8); 88| 1.50k| h = _mm256_shuffle_epi8(h, TRANSPOSE); ------------------ | | 71| 1.50k|#define TRANSPOSE _mm256_set_epi8( 31,27,23,19, 30,26,22,18, 29,25,21,17, 28,24,20,16, 15,11,7,3, 14,10,6,2, 13,9,5,1, 12,8,4,0 ) ------------------ 89| | 90| 1.50k| vec256 g0 = h & _mm256_set1_epi8(15); 91| 1.50k| vec256 g4 = _mm256_srli_epi32(h, 4) & _mm256_set1_epi8(15); 92| | 93| 1.50k| vec256 f0 = _mm256_permute2x128_si256(g0, g4, 0x20); 94| 1.50k| vec256 f4 = _mm256_permute2x128_si256(g0, g4, 0x31); 95| | 96| 1.50k| vec256 e0 = f0 & _mm256_set1_epi8(5); 97| 1.50k| vec256 e2 = _mm256_srli_epi32(f0, 1) & _mm256_set1_epi8(5); 98| 1.50k| vec256 e4 = f4 & _mm256_set1_epi8(5); 99| 1.50k| vec256 e6 = _mm256_srli_epi32(f4, 1) & _mm256_set1_epi8(5); 100| | 101| 1.50k| vec256 d0 = _mm256_unpacklo_epi32(e0, e2); 102| 1.50k| vec256 d2 = _mm256_unpackhi_epi32(e0, e2); 103| 1.50k| vec256 d4 = _mm256_unpacklo_epi32(e4, e6); 104| 1.50k| vec256 d6 = _mm256_unpackhi_epi32(e4, e6); 105| | 106| 1.50k| vec256 c0 = d0 & _mm256_set1_epi8(1); 107| 1.50k| vec256 c1 = _mm256_srli_epi32(d0, 2) & _mm256_set1_epi8(1); 108| 1.50k| vec256 c2 = d2 & _mm256_set1_epi8(1); 109| 1.50k| vec256 c3 = _mm256_srli_epi32(d2, 2) & _mm256_set1_epi8(1); 110| 1.50k| vec256 c4 = d4 & _mm256_set1_epi8(1); 111| 1.50k| vec256 c5 = _mm256_srli_epi32(d4, 2) & _mm256_set1_epi8(1); 112| 1.50k| vec256 c6 = d6 & _mm256_set1_epi8(1); 113| 1.50k| vec256 c7 = _mm256_srli_epi32(d6, 2) & _mm256_set1_epi8(1); 114| | 115| 1.50k| vec256 b0 = _mm256_unpacklo_epi64(c0, c1); 116| 1.50k| vec256 b1 = _mm256_unpackhi_epi64(c0, c1); 117| 1.50k| vec256 b2 = _mm256_unpacklo_epi64(c2, c3); 118| 1.50k| vec256 b3 = _mm256_unpackhi_epi64(c2, c3); 119| 1.50k| vec256 b4 = _mm256_unpacklo_epi64(c4, c5); 120| 1.50k| vec256 b5 = _mm256_unpackhi_epi64(c4, c5); 121| 1.50k| vec256 b6 = _mm256_unpacklo_epi64(c6, c7); 122| 1.50k| vec256 b7 = _mm256_unpackhi_epi64(c6, c7); 123| | 124| 1.50k| _mm256_storeu_si256((vec256 *) b, b0); 125| 1.50k| b += 32; 126| 1.50k| _mm256_storeu_si256((vec256 *) b, b1); 127| 1.50k| b += 32; 128| 1.50k| _mm256_storeu_si256((vec256 *) b, b2); 129| 1.50k| b += 32; 130| 1.50k| _mm256_storeu_si256((vec256 *) b, b3); 131| 1.50k| b += 32; 132| 1.50k| _mm256_storeu_si256((vec256 *) b, b4); 133| 1.50k| b += 32; 134| 1.50k| _mm256_storeu_si256((vec256 *) b, b5); 135| 1.50k| b += 32; 136| 1.50k| _mm256_storeu_si256((vec256 *) b, b6); 137| 1.50k| b += 32; 138| 1.50k| _mm256_storeu_si256((vec256 *) b, b7); 139| 1.50k| b += 32; 140| 1.50k| } 141| 562|} PQCLEAN_NTRUHPS2048509_AVX2_sample_fg: 3| 174|void PQCLEAN_NTRUHPS2048509_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| | 5| 174| PQCLEAN_NTRUHPS2048509_AVX2_sample_iid(f, uniformbytes); 6| 174| PQCLEAN_NTRUHPS2048509_AVX2_sample_fixed_type(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 174|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 174|#define NTRU_N 509 | | ------------------ ------------------ 7| 174|} PQCLEAN_NTRUHPS2048509_AVX2_sample_rm: 9| 174|void PQCLEAN_NTRUHPS2048509_AVX2_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| | 11| 174| PQCLEAN_NTRUHPS2048509_AVX2_sample_iid(r, uniformbytes); 12| 174| PQCLEAN_NTRUHPS2048509_AVX2_sample_fixed_type(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 174|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 174|#define NTRU_N 509 | | ------------------ ------------------ 13| 174|} PQCLEAN_NTRUHPS2048509_AVX2_sample_fixed_type: 16| 348|void PQCLEAN_NTRUHPS2048509_AVX2_sample_fixed_type(poly *r, const unsigned char u[NTRU_SAMPLE_FT_BYTES]) { 17| | // Assumes NTRU_SAMPLE_FT_BYTES = ceil(30*(n-1)/8) 18| | 19| 348| int32_t s[NTRU_N - 1]; 20| 348| int i; 21| | 22| | // Use 30 bits of u per word 23| 44.5k| for (i = 0; i < (NTRU_N - 1) / 4; i++) { ------------------ | | 5| 44.5k|#define NTRU_N 509 ------------------ | Branch (23:17): [True: 44.1k, False: 348] ------------------ 24| 44.1k| s[4 * i + 0] = (u[15 * i + 0] << 2) + (u[15 * i + 1] << 10) + (u[15 * i + 2] << 18) + ((uint32_t) u[15 * i + 3] << 26); 25| 44.1k| s[4 * i + 1] = ((u[15 * i + 3] & 0xc0) >> 4) + (u[15 * i + 4] << 4) + (u[15 * i + 5] << 12) + (u[15 * i + 6] << 20) + ((uint32_t) u[15 * i + 7] << 28); 26| 44.1k| s[4 * i + 2] = ((u[15 * i + 7] & 0xf0) >> 2) + (u[15 * i + 8] << 6) + (u[15 * i + 9] << 14) + (u[15 * i + 10] << 22) + ((uint32_t) u[15 * i + 11] << 30); 27| 44.1k| s[4 * i + 3] = (u[15 * i + 11] & 0xfc) + (u[15 * i + 12] << 8) + (u[15 * i + 13] << 16) + ((uint32_t) u[15 * i + 14] << 24); 28| 44.1k| } 29| | 30| 44.5k| for (i = 0; i < NTRU_WEIGHT / 2; i++) { ------------------ | | 14| 44.5k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 44.5k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 44.5k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ | Branch (30:17): [True: 44.1k, False: 348] ------------------ 31| 44.1k| s[i] |= 1; 32| 44.1k| } 33| | 34| 44.5k| for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 348|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 348|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 348|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 44.5k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 44.5k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 44.5k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ | Branch (34:31): [True: 44.1k, False: 348] ------------------ 35| 44.1k| s[i] |= 2; 36| 44.1k| } 37| | 38| 348| PQCLEAN_NTRUHPS2048509_AVX2_crypto_sort_int32(s, NTRU_N - 1); ------------------ | | 5| 348|#define NTRU_N 509 ------------------ 39| | 40| 177k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 177k|#define NTRU_N 509 ------------------ | Branch (40:17): [True: 176k, False: 348] ------------------ 41| 176k| r->coeffs[i] = ((uint16_t) (s[i] & 3)); 42| 176k| } 43| | 44| 348| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 348|#define NTRU_N 509 ------------------ 45| 348|} PQCLEAN_NTRUHPS2048509_AVX2_sample_iid: 7| 348|void PQCLEAN_NTRUHPS2048509_AVX2_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 8| 348| int i; 9| 348| union { /* align to 32 byte boundary for vmovdqa */ 10| 348| unsigned char b[PAD32(NTRU_SAMPLE_IID_BYTES)]; 11| 348| __m256i b_x32[PAD32(NTRU_SAMPLE_IID_BYTES) / 32]; 12| 348| } buffer; 13| | 14| 177k| for (i = 0; i < NTRU_SAMPLE_IID_BYTES; i++) { ------------------ | | 20| 177k|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 177k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (14:17): [True: 176k, False: 348] ------------------ 15| 176k| buffer.b[i] = uniformbytes[i]; 16| 176k| } 17| 1.74k| for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 20| 348|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 348|#define NTRU_N 509 | | ------------------ ------------------ for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 11| 1.74k|#define PAD32(X) ((((X) + 31)/32)*32) ------------------ | Branch (17:37): [True: 1.39k, False: 348] ------------------ 18| 1.39k| buffer.b[i] = 0; 19| 1.39k| } 20| 348| PQCLEAN_NTRUHPS2048509_AVX2_vec32_sample_iid(r, buffer.b); 21| 348|} owcpa.c:owcpa_check_ciphertext: 5| 317|static int owcpa_check_ciphertext(const unsigned char *ciphertext) { 6| | /* A ciphertext is log2(q)*(n-1) bits packed into bytes. */ 7| | /* Check that any unused bits of the final byte are zero. */ 8| | 9| 317| uint16_t t = 0; 10| | 11| 317| t = ciphertext[NTRU_CIPHERTEXTBYTES - 1]; ------------------ | | 35| 317|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 317|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 317|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 317|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 317|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 12| 317| t &= 0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))); ------------------ | | 6| 317|#define NTRU_LOGQ 11 ------------------ t &= 0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))); ------------------ | | 25| 317|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 317|#define NTRU_N 509 | | ------------------ ------------------ 13| | 14| | /* We have 0 <= t < 256 */ 15| | /* Return 0 on success (t=0), 1 on failure */ 16| 317| return (int) (1 & ((~t + 1) >> 15)); 17| 317|} owcpa.c:owcpa_check_m: 38| 307|static int owcpa_check_m(const poly *m) { 39| | /* Check that m is in message space, i.e. */ 40| | /* (1) |{i : m[i] = 1}| = |{i : m[i] = 2}|, and */ 41| | /* (2) |{i : m[i] != 0}| = NTRU_WEIGHT. */ 42| | /* Note: We may assume that m has coefficients in {0,1,2}. */ 43| | 44| 307| int i; 45| 307| uint32_t t = 0; 46| 307| uint16_t ps = 0; 47| 307| uint16_t ms = 0; 48| 209k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 209k|#define NTRU_N 509 ------------------ | Branch (48:17): [True: 209k, False: 307] ------------------ 49| 209k| ps += m->coeffs[i] & 1; 50| 209k| ms += m->coeffs[i] & 2; 51| 209k| } 52| 307| t |= ps ^ (ms >> 1); /* 0 if (1) holds */ 53| 307| t |= ms ^ NTRU_WEIGHT; /* 0 if (1) and (2) hold */ ------------------ | | 14| 307|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 307|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 307|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 54| | 55| | /* We have 0 <= t < 2^16. */ 56| | /* Return 0 on success (t=0), 1 on failure */ 57| 307| return (int) (1 & ((~t + 1) >> 31)); 58| 307|} owcpa.c:owcpa_check_r: 19| 317|static int owcpa_check_r(const poly *r) { 20| | /* A valid r has coefficients in {0,1,q-1} and has r[N-1] = 0 */ 21| | /* Note: We may assume that 0 <= r[i] <= q-1 for all i */ 22| | 23| 317| int i; 24| 317| uint32_t t = 0; 25| 317| uint16_t c; 26| 217k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 217k|#define NTRU_N 509 ------------------ | Branch (26:17): [True: 217k, False: 317] ------------------ 27| 217k| c = r->coeffs[i]; 28| 217k| t |= (c + 1) & (NTRU_Q - 4); /* 0 iff c is in {-1,0,1,2} */ ------------------ | | 13| 217k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 217k|#define NTRU_LOGQ 11 | | ------------------ ------------------ 29| 217k| t |= (c + 2) & 4; /* 1 if c = 2, 0 if c is in {-1,0,1} */ 30| 217k| } 31| 317| t |= r->coeffs[NTRU_N - 1]; /* Coefficient n-1 must be zero */ ------------------ | | 5| 317|#define NTRU_N 509 ------------------ 32| | 33| | /* We have 0 <= t < 2^16. */ 34| | /* Return 0 on success (t=0), 1 on failure */ 35| 317| return (int) (1 & ((~t + 1) >> 31)); 36| 317|} poly_mod.c:mod3: 3| 183k|static uint16_t mod3(uint16_t a) { 4| 183k| uint16_t r; 5| 183k| int16_t t, c; 6| | 7| 183k| r = (a >> 8) + (a & 0xff); // r mod 255 == a mod 255 8| 183k| r = (r >> 4) + (r & 0xf); // r' mod 15 == r mod 15 9| 183k| r = (r >> 2) + (r & 0x3); // r' mod 3 == r mod 3 10| 183k| r = (r >> 2) + (r & 0x3); // r' mod 3 == r mod 3 11| | 12| 183k| t = r - 3; 13| 183k| c = t >> 15; 14| | 15| 183k| return (c & r) ^ (~c & t); 16| 183k|} poly_r2_inv.c:both_negative_mask: 6| 88.9k|static inline int16_t both_negative_mask(int16_t x, int16_t y) { 7| 88.9k| return (x & y) >> 15; 8| 88.9k|} poly_rq_mul.c:toom4_k2x2_mul: 47| 578|static void toom4_k2x2_mul(uint16_t ab[2 * L], const uint16_t a[L], const uint16_t b[L]) { 48| 578| uint16_t tmpA[9 * K]; 49| 578| uint16_t tmpB[9 * K]; 50| 578| uint16_t eC[63 * 2 * K]; 51| | 52| 578| toom4_k2x2_eval_0(tmpA, a); 53| 578| toom4_k2x2_eval_0(tmpB, b); 54| 578| toom4_k2x2_basemul(eC + 0 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 578|#define K (L/16) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 55| | 56| 578| toom4_k2x2_eval_p1(tmpA, a); 57| 578| toom4_k2x2_eval_p1(tmpB, b); 58| 578| toom4_k2x2_basemul(eC + 1 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 578|#define K (L/16) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 59| | 60| 578| toom4_k2x2_eval_m1(tmpA, a); 61| 578| toom4_k2x2_eval_m1(tmpB, b); 62| 578| toom4_k2x2_basemul(eC + 2 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 578|#define K (L/16) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 63| | 64| 578| toom4_k2x2_eval_p2(tmpA, a); 65| 578| toom4_k2x2_eval_p2(tmpB, b); 66| 578| toom4_k2x2_basemul(eC + 3 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 578|#define K (L/16) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 67| | 68| 578| toom4_k2x2_eval_m2(tmpA, a); 69| 578| toom4_k2x2_eval_m2(tmpB, b); 70| 578| toom4_k2x2_basemul(eC + 4 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 578|#define K (L/16) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 71| | 72| 578| toom4_k2x2_eval_p3(tmpA, a); 73| 578| toom4_k2x2_eval_p3(tmpB, b); 74| 578| toom4_k2x2_basemul(eC + 5 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 578|#define K (L/16) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 75| | 76| 578| toom4_k2x2_eval_inf(tmpA, a); 77| 578| toom4_k2x2_eval_inf(tmpB, b); 78| 578| toom4_k2x2_basemul(eC + 6 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 578|#define K (L/16) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 79| | 80| 578| toom4_k2x2_interpolate(ab, eC); 81| 578|} poly_rq_mul.c:toom4_k2x2_eval_0: 84| 1.15k|static void toom4_k2x2_eval_0(uint16_t r[9 * K], const uint16_t a[L]) { 85| 361k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 361k|#define M (L/4) | | ------------------ | | | | 6| 361k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 361k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (85:24): [True: 360k, False: 1.15k] ------------------ 86| 360k| r[i] = a[i]; 87| 360k| } 88| 1.15k| k2x2_eval(r); 89| 1.15k|} poly_rq_mul.c:k2x2_eval: 148| 8.70k|static inline void k2x2_eval(uint16_t r[9 * K]) { 149| | /* Input: e + f.Y + g.Y^2 + h.Y^3 */ 150| | /* Output: [ e | f | g | h | e+f | f+h | g+e | h+g | e+f+g+h ] */ 151| | 152| 8.70k| size_t i; 153| 2.74M| for (i = 0; i < 4 * K; i++) { ------------------ | | 8| 2.74M|#define K (L/16) | | ------------------ | | | | 6| 2.74M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 2.74M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (153:17): [True: 2.73M, False: 8.70k] ------------------ 154| 2.73M| r[4 * K + i] = r[i]; ------------------ | | 8| 2.73M|#define K (L/16) | | ------------------ | | | | 6| 2.73M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 2.73M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 155| 2.73M| } 156| 692k| for (i = 0; i < K; i++) { ------------------ | | 8| 692k|#define K (L/16) | | ------------------ | | | | 6| 692k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 692k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (156:17): [True: 683k, False: 8.70k] ------------------ 157| 683k| r[4 * K + i] += r[1 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[4 * K + i] += r[1 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 158| 683k| r[5 * K + i] += r[3 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[5 * K + i] += r[3 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 159| 683k| r[6 * K + i] += r[0 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[6 * K + i] += r[0 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 160| 683k| r[7 * K + i] += r[2 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[7 * K + i] += r[2 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 161| 683k| r[8 * K + i] = r[5 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[8 * K + i] = r[5 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 162| 683k| r[8 * K + i] += r[6 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[8 * K + i] += r[6 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 163| 683k| } 164| 8.70k|} poly_rq_mul.c:toom4_k2x2_basemul: 166| 4.04k|static void toom4_k2x2_basemul(uint16_t r[18 * K], const uint16_t a[9 * K], const uint16_t b[9 * K]) { 167| 4.04k| schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 168| 4.04k| schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 169| 4.04k| schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 170| 4.04k| schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 171| 4.04k| schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 172| 4.04k| schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 173| 4.04k| schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 174| 4.04k| schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 175| 4.04k| schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 4.04k|#define K (L/16) | | ------------------ | | | | 6| 4.04k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.04k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 176| 4.04k|} poly_rq_mul.c:schoolbook_KxK: 178| 39.1k|static inline void schoolbook_KxK(uint16_t r[2 * K], const uint16_t a[K], const uint16_t b[K]) { 179| 39.1k| size_t i, j; 180| 3.11M| for (j = 0; j < K; j++) { ------------------ | | 8| 3.11M|#define K (L/16) | | ------------------ | | | | 6| 3.11M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.11M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (180:17): [True: 3.07M, False: 39.1k] ------------------ 181| 3.07M| r[j] = a[0] * (uint32_t)b[j]; 182| 3.07M| } 183| 3.07M| for (i = 1; i < K; i++) { ------------------ | | 8| 3.07M|#define K (L/16) | | ------------------ | | | | 6| 3.07M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.07M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (183:17): [True: 3.03M, False: 39.1k] ------------------ 184| 238M| for (j = 0; j < K - 1; j++) { ------------------ | | 8| 238M|#define K (L/16) | | ------------------ | | | | 6| 238M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 238M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (184:21): [True: 235M, False: 3.03M] ------------------ 185| 235M| r[i + j] += a[i] * (uint32_t)b[j]; 186| 235M| } 187| 3.03M| r[i + K - 1] = a[i] * (uint32_t)b[K - 1]; ------------------ | | 8| 3.03M|#define K (L/16) | | ------------------ | | | | 6| 3.03M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.03M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[i + K - 1] = a[i] * (uint32_t)b[K - 1]; ------------------ | | 8| 3.03M|#define K (L/16) | | ------------------ | | | | 6| 3.03M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.03M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 188| 3.03M| } 189| 39.1k| r[2 * K - 1] = 0; ------------------ | | 8| 39.1k|#define K (L/16) | | ------------------ | | | | 6| 39.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 39.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 190| 39.1k|} poly_rq_mul.c:toom4_k2x2_eval_p1: 91| 1.15k|static void toom4_k2x2_eval_p1(uint16_t r[9 * K], const uint16_t a[L]) { 92| 361k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 361k|#define M (L/4) | | ------------------ | | | | 6| 361k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 361k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (92:24): [True: 360k, False: 1.15k] ------------------ 93| 360k| r[i] = a[0 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 94| 360k| r[i] += a[1 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 95| 360k| r[i] += a[2 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 96| 360k| r[i] += a[3 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 97| 360k| } 98| 1.15k| k2x2_eval(r); 99| 1.15k|} poly_rq_mul.c:toom4_k2x2_eval_m1: 101| 1.15k|static void toom4_k2x2_eval_m1(uint16_t r[9 * K], const uint16_t a[L]) { 102| 361k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 361k|#define M (L/4) | | ------------------ | | | | 6| 361k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 361k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (102:24): [True: 360k, False: 1.15k] ------------------ 103| 360k| r[i] = a[0 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 104| 360k| r[i] -= a[1 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 105| 360k| r[i] += a[2 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 106| 360k| r[i] -= a[3 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 107| 360k| } 108| 1.15k| k2x2_eval(r); 109| 1.15k|} poly_rq_mul.c:toom4_k2x2_eval_p2: 111| 1.15k|static void toom4_k2x2_eval_p2(uint16_t r[9 * K], const uint16_t a[L]) { 112| 361k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 361k|#define M (L/4) | | ------------------ | | | | 6| 361k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 361k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (112:24): [True: 360k, False: 1.15k] ------------------ 113| 360k| r[i] = a[0 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 114| 360k| r[i] += 2 * a[1 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 115| 360k| r[i] += 4 * a[2 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 116| 360k| r[i] += 8 * a[3 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 117| 360k| } 118| 1.15k| k2x2_eval(r); 119| 1.15k|} poly_rq_mul.c:toom4_k2x2_eval_m2: 121| 1.15k|static void toom4_k2x2_eval_m2(uint16_t r[9 * K], const uint16_t a[L]) { 122| 361k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 361k|#define M (L/4) | | ------------------ | | | | 6| 361k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 361k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (122:24): [True: 360k, False: 1.15k] ------------------ 123| 360k| r[i] = a[0 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 124| 360k| r[i] -= 2 * a[1 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 125| 360k| r[i] += 4 * a[2 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 126| 360k| r[i] -= 8 * a[3 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 127| 360k| } 128| 1.15k| k2x2_eval(r); 129| 1.15k|} poly_rq_mul.c:toom4_k2x2_eval_p3: 131| 1.15k|static void toom4_k2x2_eval_p3(uint16_t r[9 * K], const uint16_t a[L]) { 132| 361k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 361k|#define M (L/4) | | ------------------ | | | | 6| 361k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 361k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (132:24): [True: 360k, False: 1.15k] ------------------ 133| 360k| r[i] = a[0 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 134| 360k| r[i] += 3 * a[1 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 135| 360k| r[i] += 9 * a[2 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 136| 360k| r[i] += 27 * a[3 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 137| 360k| } 138| 1.15k| k2x2_eval(r); 139| 1.15k|} poly_rq_mul.c:toom4_k2x2_eval_inf: 141| 1.15k|static void toom4_k2x2_eval_inf(uint16_t r[9 * K], const uint16_t a[L]) { 142| 361k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 361k|#define M (L/4) | | ------------------ | | | | 6| 361k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 361k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (142:24): [True: 360k, False: 1.15k] ------------------ 143| 360k| r[i] = a[3 * M + i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 144| 360k| } 145| 1.15k| k2x2_eval(r); 146| 1.15k|} poly_rq_mul.c:toom4_k2x2_interpolate: 192| 578|static void toom4_k2x2_interpolate(uint16_t r[2 * L], const uint16_t a[7 * 18 * K]) { 193| 578| size_t i; 194| | 195| 578| uint16_t P1[2 * M]; 196| 578| uint16_t Pm1[2 * M]; 197| 578| uint16_t P2[2 * M]; 198| 578| uint16_t Pm2[2 * M]; 199| | 200| 578| uint16_t *C0 = r; 201| 578| uint16_t *C2 = r + 2 * M; ------------------ | | 7| 578|#define M (L/4) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 202| 578| uint16_t *C4 = r + 4 * M; ------------------ | | 7| 578|#define M (L/4) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 203| 578| uint16_t *C6 = r + 6 * M; ------------------ | | 7| 578|#define M (L/4) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 204| | 205| 578| uint16_t V0, V1, V2; 206| | 207| 578| k2x2_interpolate(C0, a + 0 * 9 * 2 * K); ------------------ | | 8| 578|#define K (L/16) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 208| 578| k2x2_interpolate(P1, a + 1 * 9 * 2 * K); ------------------ | | 8| 578|#define K (L/16) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 209| 578| k2x2_interpolate(Pm1, a + 2 * 9 * 2 * K); ------------------ | | 8| 578|#define K (L/16) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 210| 578| k2x2_interpolate(P2, a + 3 * 9 * 2 * K); ------------------ | | 8| 578|#define K (L/16) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 211| 578| k2x2_interpolate(Pm2, a + 4 * 9 * 2 * K); ------------------ | | 8| 578|#define K (L/16) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 212| 578| k2x2_interpolate(C6, a + 6 * 9 * 2 * K); ------------------ | | 8| 578|#define K (L/16) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 213| | 214| 361k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 361k|#define M (L/4) | | ------------------ | | | | 6| 361k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 361k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (214:17): [True: 360k, False: 578] ------------------ 215| 360k| V0 = ((uint32_t)(P1[i] + Pm1[i])) >> 1; 216| 360k| V0 = V0 - C0[i] - C6[i]; 217| 360k| V1 = ((uint32_t)(P2[i] + Pm2[i] - 2 * C0[i] - 128 * C6[i])) >> 3; 218| 360k| C4[i] = 43691 * (uint32_t)(V1 - V0); 219| 360k| C2[i] = V0 - C4[i]; 220| 360k| P1[i] = ((uint32_t)(P1[i] - Pm1[i])) >> 1; 221| 360k| } 222| | 223| | /* reuse Pm1 for P3 */ 224| 578|#define P3 Pm1 225| 578| k2x2_interpolate(P3, a + 5 * 9 * 2 * K); ------------------ | | 224| 578|#define P3 Pm1 ------------------ k2x2_interpolate(P3, a + 5 * 9 * 2 * K); ------------------ | | 8| 578|#define K (L/16) | | ------------------ | | | | 6| 578|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 226| | 227| 361k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 361k|#define M (L/4) | | ------------------ | | | | 6| 361k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 361k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (227:17): [True: 360k, False: 578] ------------------ 228| 360k| V0 = P1[i]; 229| 360k| V1 = 43691 * (((uint32_t)(P2[i] - Pm2[i]) >> 2) - V0); 230| 360k| V2 = 43691 * (uint32_t)(P3[i] - C0[i] - 9 * (C2[i] + 9 * (C4[i] + 9 * C6[i]))); ------------------ | | 224| 360k|#define P3 Pm1 ------------------ 231| 360k| V2 = ((uint32_t)(V2 - V0)) >> 3; 232| 360k| V2 -= V1; 233| 360k| P3[i] = 52429 * (uint32_t)V2; ------------------ | | 224| 360k|#define P3 Pm1 ------------------ 234| 360k| P2[i] = V1 - V2; 235| 360k| P1[i] = V0 - P2[i] - P3[i]; ------------------ | | 224| 360k|#define P3 Pm1 ------------------ 236| 360k| } 237| | 238| 361k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 361k|#define M (L/4) | | ------------------ | | | | 6| 361k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 361k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (238:17): [True: 360k, False: 578] ------------------ 239| 360k| r[1 * M + i] += P1[i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 240| 360k| r[3 * M + i] += P2[i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 241| 360k| r[5 * M + i] += P3[i]; ------------------ | | 7| 360k|#define M (L/4) | | ------------------ | | | | 6| 360k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 360k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[5 * M + i] += P3[i]; ------------------ | | 224| 360k|#define P3 Pm1 ------------------ 242| 360k| } 243| 578|} poly_rq_mul.c:k2x2_interpolate: 245| 4.35k|static inline void k2x2_interpolate(uint16_t r[2 * M], const uint16_t a[18 * K]) { 246| 4.35k| size_t i; 247| 4.35k| uint16_t tmp[4 * K]; 248| | 249| 688k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 688k|#define K (L/16) | | ------------------ | | | | 6| 688k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 688k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (249:17): [True: 683k, False: 4.35k] ------------------ 250| 683k| r[0 * K + i] = a[0 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[0 * K + i] = a[0 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 251| 683k| r[2 * K + i] = a[2 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[2 * K + i] = a[2 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 252| 683k| } 253| | 254| 688k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 688k|#define K (L/16) | | ------------------ | | | | 6| 688k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 688k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (254:17): [True: 683k, False: 4.35k] ------------------ 255| 683k| r[1 * K + i] += a[8 * K + i] - a[0 * K + i] - a[2 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[1 * K + i] += a[8 * K + i] - a[0 * K + i] - a[2 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[1 * K + i] += a[8 * K + i] - a[0 * K + i] - a[2 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[1 * K + i] += a[8 * K + i] - a[0 * K + i] - a[2 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 256| 683k| } 257| | 258| 688k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 688k|#define K (L/16) | | ------------------ | | | | 6| 688k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 688k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (258:17): [True: 683k, False: 4.35k] ------------------ 259| 683k| r[4 * K + i] = a[4 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[4 * K + i] = a[4 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 260| 683k| r[6 * K + i] = a[6 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[6 * K + i] = a[6 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 261| 683k| } 262| | 263| 688k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 688k|#define K (L/16) | | ------------------ | | | | 6| 688k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 688k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (263:17): [True: 683k, False: 4.35k] ------------------ 264| 683k| r[5 * K + i] += a[14 * K + i] - a[4 * K + i] - a[6 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[5 * K + i] += a[14 * K + i] - a[4 * K + i] - a[6 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[5 * K + i] += a[14 * K + i] - a[4 * K + i] - a[6 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[5 * K + i] += a[14 * K + i] - a[4 * K + i] - a[6 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 265| 683k| } 266| | 267| 688k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 688k|#define K (L/16) | | ------------------ | | | | 6| 688k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 688k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (267:17): [True: 683k, False: 4.35k] ------------------ 268| 683k| tmp[0 * K + i] = a[12 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * K + i] = a[12 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 269| 683k| tmp[2 * K + i] = a[10 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[2 * K + i] = a[10 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 270| 683k| } 271| | 272| 688k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 688k|#define K (L/16) | | ------------------ | | | | 6| 688k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 688k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (272:17): [True: 683k, False: 4.35k] ------------------ 273| 683k| tmp[K + i] += a[16 * K + i] - a[12 * K + i] - a[10 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[K + i] += a[16 * K + i] - a[12 * K + i] - a[10 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[K + i] += a[16 * K + i] - a[12 * K + i] - a[10 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[K + i] += a[16 * K + i] - a[12 * K + i] - a[10 * K + i]; ------------------ | | 8| 683k|#define K (L/16) | | ------------------ | | | | 6| 683k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 683k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 274| 683k| } 275| | 276| 1.37M| for (i = 0; i < 4 * K; i++) { ------------------ | | 8| 1.37M|#define K (L/16) | | ------------------ | | | | 6| 1.37M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.37M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (276:17): [True: 1.36M, False: 4.35k] ------------------ 277| 1.36M| tmp[0 * K + i] = tmp[0 * K + i] - r[0 * K + i] - r[4 * K + i]; ------------------ | | 8| 1.36M|#define K (L/16) | | ------------------ | | | | 6| 1.36M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.36M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * K + i] = tmp[0 * K + i] - r[0 * K + i] - r[4 * K + i]; ------------------ | | 8| 1.36M|#define K (L/16) | | ------------------ | | | | 6| 1.36M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.36M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * K + i] = tmp[0 * K + i] - r[0 * K + i] - r[4 * K + i]; ------------------ | | 8| 1.36M|#define K (L/16) | | ------------------ | | | | 6| 1.36M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.36M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * K + i] = tmp[0 * K + i] - r[0 * K + i] - r[4 * K + i]; ------------------ | | 8| 1.36M|#define K (L/16) | | ------------------ | | | | 6| 1.36M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.36M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 278| 1.36M| } 279| | 280| 1.37M| for (i = 0; i < 4 * K; i++) { ------------------ | | 8| 1.37M|#define K (L/16) | | ------------------ | | | | 6| 1.37M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.37M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (280:17): [True: 1.36M, False: 4.35k] ------------------ 281| 1.36M| r[2 * K + i] += tmp[0 * K + i]; ------------------ | | 8| 1.36M|#define K (L/16) | | ------------------ | | | | 6| 1.36M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.36M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[2 * K + i] += tmp[0 * K + i]; ------------------ | | 8| 1.36M|#define K (L/16) | | ------------------ | | | | 6| 1.36M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.36M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 282| 1.36M| } 283| 4.35k|} poly_s3_inv.c:mod3: 5| 220M|static inline uint8_t mod3(uint8_t a) { /* a between 0 and 9 */ 6| 220M| int16_t t, c; 7| 220M| a = (a >> 2) + (a & 3); /* between 0 and 4 */ 8| 220M| t = a - 3; 9| 220M| c = t >> 5; 10| 220M| return (uint8_t) (t ^ (c & (a ^ t))); 11| 220M|} poly_s3_inv.c:both_negative_mask: 14| 88.9k|static inline int16_t both_negative_mask(int16_t x, int16_t y) { 15| 88.9k| return (x & y) >> 15; 16| 88.9k|} sample_iid.c:mod3: 3| 94.4k|static uint16_t mod3(uint16_t a) { 4| 94.4k| uint16_t r; 5| 94.4k| int16_t t, c; 6| | 7| 94.4k| r = (a >> 8) + (a & 0xff); // r mod 255 == a mod 255 8| 94.4k| r = (r >> 4) + (r & 0xf); // r' mod 15 == r mod 15 9| 94.4k| r = (r >> 2) + (r & 0x3); // r' mod 3 == r mod 3 10| 94.4k| r = (r >> 2) + (r & 0x3); // r' mod 3 == r mod 3 11| | 12| 94.4k| t = r - 3; 13| 94.4k| c = t >> 15; 14| | 15| 94.4k| return (c & r) ^ (~c & t); 16| 94.4k|} PQCLEAN_NTRUHPS2048677_AVX2_cmov: 4| 15|void PQCLEAN_NTRUHPS2048677_AVX2_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 15| size_t i; 6| | 7| 15| b = (~b + 1); 8| 495| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 480, False: 15] ------------------ 9| 480| r[i] ^= b & (x[i] ^ r[i]); 10| 480| } 11| 15|} PQCLEAN_NTRUHPS2048677_AVX2_crypto_sort_int32: 903| 60|void PQCLEAN_NTRUHPS2048677_AVX2_crypto_sort_int32(int32 *x, size_t n) { 904| 60| size_t q, i, j; 905| | 906| 60| if (n <= 8) { ------------------ | Branch (906:9): [True: 0, False: 60] ------------------ 907| 0| if (n == 8) { ------------------ | Branch (907:13): [True: 0, False: 0] ------------------ 908| 0| int32_MINMAX(&x[0], &x[1]); 909| 0| int32_MINMAX(&x[1], &x[2]); 910| 0| int32_MINMAX(&x[2], &x[3]); 911| 0| int32_MINMAX(&x[3], &x[4]); 912| 0| int32_MINMAX(&x[4], &x[5]); 913| 0| int32_MINMAX(&x[5], &x[6]); 914| 0| int32_MINMAX(&x[6], &x[7]); 915| 0| } 916| 0| if (n >= 7) { ------------------ | Branch (916:13): [True: 0, False: 0] ------------------ 917| 0| int32_MINMAX(&x[0], &x[1]); 918| 0| int32_MINMAX(&x[1], &x[2]); 919| 0| int32_MINMAX(&x[2], &x[3]); 920| 0| int32_MINMAX(&x[3], &x[4]); 921| 0| int32_MINMAX(&x[4], &x[5]); 922| 0| int32_MINMAX(&x[5], &x[6]); 923| 0| } 924| 0| if (n >= 6) { ------------------ | Branch (924:13): [True: 0, False: 0] ------------------ 925| 0| int32_MINMAX(&x[0], &x[1]); 926| 0| int32_MINMAX(&x[1], &x[2]); 927| 0| int32_MINMAX(&x[2], &x[3]); 928| 0| int32_MINMAX(&x[3], &x[4]); 929| 0| int32_MINMAX(&x[4], &x[5]); 930| 0| } 931| 0| if (n >= 5) { ------------------ | Branch (931:13): [True: 0, False: 0] ------------------ 932| 0| int32_MINMAX(&x[0], &x[1]); 933| 0| int32_MINMAX(&x[1], &x[2]); 934| 0| int32_MINMAX(&x[2], &x[3]); 935| 0| int32_MINMAX(&x[3], &x[4]); 936| 0| } 937| 0| if (n >= 4) { ------------------ | Branch (937:13): [True: 0, False: 0] ------------------ 938| 0| int32_MINMAX(&x[0], &x[1]); 939| 0| int32_MINMAX(&x[1], &x[2]); 940| 0| int32_MINMAX(&x[2], &x[3]); 941| 0| } 942| 0| if (n >= 3) { ------------------ | Branch (942:13): [True: 0, False: 0] ------------------ 943| 0| int32_MINMAX(&x[0], &x[1]); 944| 0| int32_MINMAX(&x[1], &x[2]); 945| 0| } 946| 0| if (n >= 2) { ------------------ | Branch (946:13): [True: 0, False: 0] ------------------ 947| 0| int32_MINMAX(&x[0], &x[1]); 948| 0| } 949| 0| return; 950| 0| } 951| | 952| 60| if (!(n & (n - 1))) { ------------------ | Branch (952:9): [True: 0, False: 60] ------------------ 953| 0| int32_sort_2power(x, n, 0); 954| 0| return; 955| 0| } 956| | 957| 60| q = 8; 958| 360| while (q < n - q) { ------------------ | Branch (958:12): [True: 300, False: 60] ------------------ 959| 300| q += q; 960| 300| } 961| | /* n > q >= 8 */ 962| | 963| 60| if (q <= 128) { /* n <= 256 */ ------------------ | Branch (963:9): [True: 30, False: 30] ------------------ 964| 30| int32x8 y[32]; 965| 510| for (i = q >> 3; i < q >> 2; ++i) { ------------------ | Branch (965:26): [True: 480, False: 30] ------------------ 966| 480| y[i] = _mm256_set1_epi32(0x7fffffff); 967| 480| } 968| 4.95k| for (i = 0; i < n; ++i) { ------------------ | Branch (968:21): [True: 4.92k, False: 30] ------------------ 969| 4.92k| ((int32 *) y)[i] = x[i]; 970| 4.92k| } 971| 30| int32_sort_2power((int32 *) y, 2 * q, 0); 972| 4.95k| for (i = 0; i < n; ++i) { ------------------ | Branch (972:21): [True: 4.92k, False: 30] ------------------ 973| 4.92k| x[i] = ((int32 *) y)[i]; 974| 4.92k| } 975| 30| return; 976| 30| } 977| | 978| 30| int32_sort_2power(x, q, 1); 979| 30| PQCLEAN_NTRUHPS2048677_AVX2_crypto_sort_int32(x + q, n - q); 980| | 981| 90| while (q >= 64) { ------------------ | Branch (981:12): [True: 60, False: 30] ------------------ 982| 60| q >>= 2; 983| 60| j = int32_threestages(x, n, q); 984| 60| minmax_vector(x + j, x + j + 4 * q, n - 4 * q - j); 985| 60| if (j + 4 * q <= n) { ------------------ | Branch (985:13): [True: 30, False: 30] ------------------ 986| 510| for (i = j; i < j + q; i += 8) { ------------------ | Branch (986:25): [True: 480, False: 30] ------------------ 987| 480| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 480|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 988| 480| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 480|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 989| 480| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 480|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 990| 480| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 480|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 991| 480| int32x8_MINMAX(x0, x2); ------------------ | | 15| 480| do { \ | | 16| 480| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 480|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 480| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 480|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 480| (a) = c; \ | | 19| 480| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 480] | | ------------------ ------------------ 992| 480| int32x8_MINMAX(x1, x3); ------------------ | | 15| 480| do { \ | | 16| 480| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 480|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 480| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 480|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 480| (a) = c; \ | | 19| 480| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 480] | | ------------------ ------------------ 993| 480| int32x8_MINMAX(x0, x1); ------------------ | | 15| 480| do { \ | | 16| 480| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 480|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 480| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 480|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 480| (a) = c; \ | | 19| 480| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 480] | | ------------------ ------------------ 994| 480| int32x8_MINMAX(x2, x3); ------------------ | | 15| 480| do { \ | | 16| 480| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 480|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 480| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 480|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 480| (a) = c; \ | | 19| 480| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 480] | | ------------------ ------------------ 995| 480| int32x8_store(&x[i], x0); ------------------ | | 10| 480|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 996| 480| int32x8_store(&x[i + q], x1); ------------------ | | 10| 480|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 997| 480| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 480|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 998| 480| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 480|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 999| 480| } 1000| 30| j += 4 * q; 1001| 30| } 1002| 60| minmax_vector(x + j, x + j + 2 * q, n - 2 * q - j); 1003| 60| if (j + 2 * q <= n) { ------------------ | Branch (1003:13): [True: 30, False: 30] ------------------ 1004| 90| for (i = j; i < j + q; i += 8) { ------------------ | Branch (1004:25): [True: 60, False: 30] ------------------ 1005| 60| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 60|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1006| 60| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 60|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1007| 60| int32x8_MINMAX(x0, x1); ------------------ | | 15| 60| do { \ | | 16| 60| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 60|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 60| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 60|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 60| (a) = c; \ | | 19| 60| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 60] | | ------------------ ------------------ 1008| 60| int32x8_store(&x[i], x0); ------------------ | | 10| 60|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1009| 60| int32x8_store(&x[i + q], x1); ------------------ | | 10| 60|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1010| 60| } 1011| 30| j += 2 * q; 1012| 30| } 1013| 60| minmax_vector(x + j, x + j + q, n - q - j); 1014| 60| q >>= 1; 1015| 60| } 1016| 30| if (q == 32) { ------------------ | Branch (1016:9): [True: 0, False: 30] ------------------ 1017| 0| j = 0; 1018| 0| for (; j + 64 <= n; j += 64) { ------------------ | Branch (1018:16): [True: 0, False: 0] ------------------ 1019| 0| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1020| 0| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1021| 0| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1022| 0| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1023| 0| int32x8 x4 = int32x8_load(&x[j + 32]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1024| 0| int32x8 x5 = int32x8_load(&x[j + 40]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1025| 0| int32x8 x6 = int32x8_load(&x[j + 48]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1026| 0| int32x8 x7 = int32x8_load(&x[j + 56]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1027| 0| int32x8_MINMAX(x0, x4); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1028| 0| int32x8_MINMAX(x1, x5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1029| 0| int32x8_MINMAX(x2, x6); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1030| 0| int32x8_MINMAX(x3, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1031| 0| int32x8_MINMAX(x0, x2); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1032| 0| int32x8_MINMAX(x1, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1033| 0| int32x8_MINMAX(x4, x6); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1034| 0| int32x8_MINMAX(x5, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1035| 0| int32x8_MINMAX(x0, x1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1036| 0| int32x8_MINMAX(x2, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1037| 0| int32x8_MINMAX(x4, x5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1038| 0| int32x8_MINMAX(x6, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1039| 0| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1040| 0| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1041| 0| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1042| 0| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1043| 0| int32x8 a4 = _mm256_permute2x128_si256(x4, x5, 0x20); 1044| 0| int32x8 a5 = _mm256_permute2x128_si256(x4, x5, 0x31); 1045| 0| int32x8 a6 = _mm256_permute2x128_si256(x6, x7, 0x20); 1046| 0| int32x8 a7 = _mm256_permute2x128_si256(x6, x7, 0x31); 1047| 0| int32x8_MINMAX(a0, a1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1048| 0| int32x8_MINMAX(a2, a3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1049| 0| int32x8_MINMAX(a4, a5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1050| 0| int32x8_MINMAX(a6, a7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1051| 0| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1052| 0| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1053| 0| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1054| 0| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1055| 0| int32x8 b4 = _mm256_permute2x128_si256(a4, a5, 0x20); 1056| 0| int32x8 b5 = _mm256_permute2x128_si256(a4, a5, 0x31); 1057| 0| int32x8 b6 = _mm256_permute2x128_si256(a6, a7, 0x20); 1058| 0| int32x8 b7 = _mm256_permute2x128_si256(a6, a7, 0x31); 1059| 0| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1060| 0| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1061| 0| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1062| 0| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1063| 0| int32x8 c4 = _mm256_unpacklo_epi64(b4, b5); 1064| 0| int32x8 c5 = _mm256_unpackhi_epi64(b4, b5); 1065| 0| int32x8 c6 = _mm256_unpacklo_epi64(b6, b7); 1066| 0| int32x8 c7 = _mm256_unpackhi_epi64(b6, b7); 1067| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1068| 0| int32x8_MINMAX(c2, c3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1069| 0| int32x8_MINMAX(c4, c5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1070| 0| int32x8_MINMAX(c6, c7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1071| 0| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1072| 0| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1073| 0| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1074| 0| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1075| 0| int32x8 d4 = _mm256_unpacklo_epi32(c4, c5); 1076| 0| int32x8 d5 = _mm256_unpackhi_epi32(c4, c5); 1077| 0| int32x8 d6 = _mm256_unpacklo_epi32(c6, c7); 1078| 0| int32x8 d7 = _mm256_unpackhi_epi32(c6, c7); 1079| 0| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1080| 0| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1081| 0| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1082| 0| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1083| 0| int32x8 e4 = _mm256_unpacklo_epi64(d4, d5); 1084| 0| int32x8 e5 = _mm256_unpackhi_epi64(d4, d5); 1085| 0| int32x8 e6 = _mm256_unpacklo_epi64(d6, d7); 1086| 0| int32x8 e7 = _mm256_unpackhi_epi64(d6, d7); 1087| 0| int32x8_MINMAX(e0, e1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1088| 0| int32x8_MINMAX(e2, e3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1089| 0| int32x8_MINMAX(e4, e5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1090| 0| int32x8_MINMAX(e6, e7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1091| 0| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1092| 0| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1093| 0| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1094| 0| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1095| 0| int32x8 f4 = _mm256_unpacklo_epi32(e4, e5); 1096| 0| int32x8 f5 = _mm256_unpackhi_epi32(e4, e5); 1097| 0| int32x8 f6 = _mm256_unpacklo_epi32(e6, e7); 1098| 0| int32x8 f7 = _mm256_unpackhi_epi32(e6, e7); 1099| 0| int32x8_store(&x[j], f0); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1100| 0| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1101| 0| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1102| 0| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1103| 0| int32x8_store(&x[j + 32], f4); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1104| 0| int32x8_store(&x[j + 40], f5); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1105| 0| int32x8_store(&x[j + 48], f6); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1106| 0| int32x8_store(&x[j + 56], f7); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1107| 0| } 1108| 0| minmax_vector(x + j, x + j + 32, n - 32 - j); 1109| 0| goto continue16; 1110| 0| } 1111| 30| if (q == 16) { ------------------ | Branch (1111:9): [True: 0, False: 30] ------------------ 1112| 0| j = 0; 1113| 0|continue16: 1114| 0| for (; j + 32 <= n; j += 32) { ------------------ | Branch (1114:16): [True: 0, False: 0] ------------------ 1115| 0| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1116| 0| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1117| 0| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1118| 0| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1119| 0| int32x8_MINMAX(x0, x2); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1120| 0| int32x8_MINMAX(x1, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1121| 0| int32x8_MINMAX(x0, x1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1122| 0| int32x8_MINMAX(x2, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1123| 0| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1124| 0| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1125| 0| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1126| 0| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1127| 0| int32x8_MINMAX(a0, a1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1128| 0| int32x8_MINMAX(a2, a3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1129| 0| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1130| 0| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1131| 0| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1132| 0| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1133| 0| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1134| 0| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1135| 0| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1136| 0| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1137| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1138| 0| int32x8_MINMAX(c2, c3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1139| 0| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1140| 0| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1141| 0| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1142| 0| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1143| 0| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1144| 0| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1145| 0| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1146| 0| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1147| 0| int32x8_MINMAX(e0, e1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1148| 0| int32x8_MINMAX(e2, e3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1149| 0| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1150| 0| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1151| 0| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1152| 0| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1153| 0| int32x8_store(&x[j], f0); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1154| 0| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1155| 0| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1156| 0| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1157| 0| } 1158| 0| minmax_vector(x + j, x + j + 16, n - 16 - j); 1159| 0| goto continue8; 1160| 0| } 1161| | /* q == 8 */ 1162| 30| j = 0; 1163| 30|continue8: 1164| 1.29k| for (; j + 16 <= n; j += 16) { ------------------ | Branch (1164:12): [True: 1.26k, False: 30] ------------------ 1165| 1.26k| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 1.26k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1166| 1.26k| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 1.26k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1167| 1.26k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 1.26k| do { \ | | 16| 1.26k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.26k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.26k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.26k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.26k| (a) = c; \ | | 19| 1.26k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.26k] | | ------------------ ------------------ 1168| 1.26k| int32x8_store(&x[j], x0); ------------------ | | 10| 1.26k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1169| 1.26k| int32x8_store(&x[j + 8], x1); ------------------ | | 10| 1.26k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1170| 1.26k| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); /* x0123y0123 */ 1171| 1.26k| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); /* x4567y4567 */ 1172| 1.26k| int32x8_MINMAX(a0, a1); ------------------ | | 15| 1.26k| do { \ | | 16| 1.26k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.26k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.26k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.26k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.26k| (a) = c; \ | | 19| 1.26k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.26k] | | ------------------ ------------------ 1173| 1.26k| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); /* x01234567 */ 1174| 1.26k| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); /* y01234567 */ 1175| 1.26k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); /* x01y01x45y45 */ 1176| 1.26k| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); /* x23y23x67y67 */ 1177| 1.26k| int32x8_MINMAX(c0, c1); ------------------ | | 15| 1.26k| do { \ | | 16| 1.26k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.26k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.26k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.26k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.26k| (a) = c; \ | | 19| 1.26k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.26k] | | ------------------ ------------------ 1178| 1.26k| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); /* x02x13x46x57 */ 1179| 1.26k| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); /* y02y13y46y57 */ 1180| 1.26k| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); /* x02y02x46y46 */ 1181| 1.26k| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); /* x13y13x57y57 */ 1182| 1.26k| int32x8_MINMAX(e0, e1); ------------------ | | 15| 1.26k| do { \ | | 16| 1.26k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.26k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.26k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.26k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.26k| (a) = c; \ | | 19| 1.26k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.26k] | | ------------------ ------------------ 1183| 1.26k| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); /* x01234567 */ 1184| 1.26k| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); /* y01234567 */ 1185| 1.26k| int32x8_store(&x[j], f0); ------------------ | | 10| 1.26k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1186| 1.26k| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 1.26k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1187| 1.26k| } 1188| 30| minmax_vector(x + j, x + j + 8, n - 8 - j); 1189| 30| if (j + 8 <= n) { ------------------ | Branch (1189:9): [True: 0, False: 30] ------------------ 1190| 0| int32_MINMAX(&x[j], &x[j + 4]); 1191| 0| int32_MINMAX(&x[j + 1], &x[j + 5]); 1192| 0| int32_MINMAX(&x[j + 2], &x[j + 6]); 1193| 0| int32_MINMAX(&x[j + 3], &x[j + 7]); 1194| 0| int32_MINMAX(&x[j], &x[j + 2]); 1195| 0| int32_MINMAX(&x[j + 1], &x[j + 3]); 1196| 0| int32_MINMAX(&x[j], &x[j + 1]); 1197| 0| int32_MINMAX(&x[j + 2], &x[j + 3]); 1198| 0| int32_MINMAX(&x[j + 4], &x[j + 6]); 1199| 0| int32_MINMAX(&x[j + 5], &x[j + 7]); 1200| 0| int32_MINMAX(&x[j + 4], &x[j + 5]); 1201| 0| int32_MINMAX(&x[j + 6], &x[j + 7]); 1202| 0| j += 8; 1203| 0| } 1204| 30| minmax_vector(x + j, x + j + 4, n - 4 - j); 1205| 30| if (j + 4 <= n) { ------------------ | Branch (1205:9): [True: 30, False: 0] ------------------ 1206| 30| int32_MINMAX(&x[j], &x[j + 2]); 1207| 30| int32_MINMAX(&x[j + 1], &x[j + 3]); 1208| 30| int32_MINMAX(&x[j], &x[j + 1]); 1209| 30| int32_MINMAX(&x[j + 2], &x[j + 3]); 1210| 30| j += 4; 1211| 30| } 1212| 30| if (j + 3 <= n) { ------------------ | Branch (1212:9): [True: 0, False: 30] ------------------ 1213| 0| int32_MINMAX(&x[j], &x[j + 2]); 1214| 0| } 1215| 30| if (j + 2 <= n) { ------------------ | Branch (1215:9): [True: 0, False: 30] ------------------ 1216| 0| int32_MINMAX(&x[j], &x[j + 1]); 1217| 0| } 1218| 30|} PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_keypair: 10| 15|int PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 15| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 15| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 15|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 22| 15|#define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 15|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 15|#define NTRU_N 677 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 15|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 15|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 14| 15| PQCLEAN_NTRUHPS2048677_AVX2_owcpa_keypair(pk, sk, seed); 15| | 16| 15| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 15|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 30| 15|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 15|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 15|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 15|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 15|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 15|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 15|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 15|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 17| 15|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 15| return 0; 19| 15|} PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_enc: 21| 15|int PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 15| poly r, m; 23| 15| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 15| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 15| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 15|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 23| 15|#define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 15|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 15|#define NTRU_N 677 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 15|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 15|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 15| PQCLEAN_NTRUHPS2048677_AVX2_sample_rm(&r, &m, rm_seed); 29| | 30| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(rm, &r); 31| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 26| 15|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 15|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 15|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 32| 15| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 15|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 15|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 15|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 15|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 15|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(&r); 35| 15| PQCLEAN_NTRUHPS2048677_AVX2_owcpa_enc(c, &r, &m, pk); 36| | 37| 15| return 0; 38| 15|} PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_dec: 40| 15|int PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 15| int i, fail; 42| 15| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 15| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 15| fail = PQCLEAN_NTRUHPS2048677_AVX2_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHPS2048677_AVX2_owcpa_dec for details. */ 48| | 49| 15| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 15|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 15|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 15|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 15|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 15|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 495| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 17| 495|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 480, False: 15] ------------------ 53| 480| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 30| 480|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 480|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 480|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 480|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 480|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 480|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 480|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 480|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 480| } 55| 13.9k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 35| 13.9k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 13.9k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 13.9k|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 13.9k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 13.9k|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 13.9k, False: 15] ------------------ 56| 13.9k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 17| 13.9k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 13.9k| } 58| 15| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 15|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 17| 15|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 35| 15|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 15|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 15|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 15|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 15|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 15| PQCLEAN_NTRUHPS2048677_AVX2_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 18| 15|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 15| return 0; 63| 15|} PQCLEAN_NTRUHPS2048677_AVX2_owcpa_keypair: 62| 15| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 63| 15| int i; 64| | 65| 15| poly x1, x2, x3, x4, x5; 66| | 67| 15| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 68| 15| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 69| 15| poly *invh = &x3, *h = &x3; 70| | 71| 15| PQCLEAN_NTRUHPS2048677_AVX2_sample_fg(f, g, seed); 72| | 73| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_inv(invf_mod3, f); 74| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(sk, f); 75| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 26| 15|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 15|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 15|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 76| | 77| | /* Lift coeffs of f and g from Z_p to Z_q */ 78| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(f); 79| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(g); 80| | 81| | 82| | /* g = 3*g */ 83| 10.1k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 10.1k|#define NTRU_N 677 ------------------ | Branch (83:17): [True: 10.1k, False: 15] ------------------ 84| 10.1k| g->coeffs[i] = 3 * g->coeffs[i]; 85| 10.1k| } 86| | 87| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(gf, g, f); 88| | 89| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_inv(invgf, gf); 90| | 91| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(tmp, invgf, f); 92| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_mul(invh, tmp, f); 93| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 26| 15|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 15|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 15|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 94| | 95| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(tmp, invgf, g); 96| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(h, tmp, g); 97| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_tobytes(pk, h); 98| 15|} PQCLEAN_NTRUHPS2048677_AVX2_owcpa_enc: 104| 15| const unsigned char *pk) { 105| 15| int i; 106| 15| poly x1, x2; 107| 15| poly *h = &x1, *liftm = &x1; 108| 15| poly *ct = &x2; 109| | 110| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_frombytes(h, pk); 111| | 112| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(ct, r, h); 113| | 114| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_lift(liftm, m); 115| 10.1k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 10.1k|#define NTRU_N 677 ------------------ | Branch (115:17): [True: 10.1k, False: 15] ------------------ 116| 10.1k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 117| 10.1k| } 118| | 119| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_tobytes(c, ct); 120| 15|} PQCLEAN_NTRUHPS2048677_AVX2_owcpa_dec: 124| 15| const unsigned char *secretkey) { 125| 15| int i; 126| 15| int fail; 127| 15| poly x1, x2, x3, x4; 128| | 129| 15| poly *c = &x1, *f = &x2, *cf = &x3; 130| 15| poly *mf = &x2, *finv3 = &x3, *m = &x4; 131| 15| poly *liftm = &x2, *invh = &x3, *r = &x4; 132| 15| poly *b = &x1; 133| | 134| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_frombytes(c, ciphertext); 135| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_frombytes(f, secretkey); 136| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(f); 137| | 138| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(cf, c, f); 139| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_to_S3(mf, cf); 140| | 141| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 15|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 15|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 15|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 142| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_mul(m, mf, finv3); 143| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 26| 15|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 15|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 15|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 144| | 145| 15| fail = 0; 146| | 147| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 148| 15| fail |= owcpa_check_ciphertext(ciphertext); 149| | 150| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 151| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 152| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 153| | /* (m can take any value in S3 in NTRU_HRSS) */ 154| 15| fail |= owcpa_check_m(m); 155| | 156| | /* b = c - Lift(m) mod (q, x^n - 1) */ 157| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_lift(liftm, m); 158| 10.1k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 10.1k|#define NTRU_N 677 ------------------ | Branch (158:17): [True: 10.1k, False: 15] ------------------ 159| 10.1k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 160| 10.1k| } 161| | 162| | /* r = b / h mod (q, Phi_n) */ 163| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 15|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 15|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 15|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 164| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_mul(r, b, invh); 165| | 166| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 167| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 168| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 169| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 170| | /* where r gets a final reduction modulo p. */ 171| | /* We need this change to use Proposition 1 of [Sch18]. */ 172| | 173| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 174| | /* if and only if fail==0 after the following call to owcpa_check_r */ 175| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 176| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 177| 15| fail |= owcpa_check_r(r); 178| | 179| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_trinary_Zq_to_Z3(r); 180| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(rm, r); 181| | 182| 15| return fail; 183| 15|} PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes: 3| 90|void PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 90| int i; 5| 90| unsigned char c; 6| 90| int j; 7| | 8| 12.2k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 12.2k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 12.2k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (8:17): [True: 12.1k, False: 90] ------------------ 9| 12.1k| c = a->coeffs[5 * i + 4] & 255; 10| 12.1k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 11| 12.1k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 12| 12.1k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 13| 12.1k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 14| 12.1k| msg[i] = c; 15| 12.1k| } 16| 90| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 90|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 90|#define NTRU_N 677 | | ------------------ ------------------ 17| 90| c = 0; 18| 180| for (j = NTRU_PACK_DEG - (5 * i) - 1; j >= 0; j--) { ------------------ | | 25| 90|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 90|#define NTRU_N 677 | | ------------------ ------------------ | Branch (18:43): [True: 90, False: 90] ------------------ 19| 90| c = (3 * c + a->coeffs[5 * i + j]) & 255; 20| 90| } 21| 90| msg[i] = c; 22| 90|} PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_frombytes: 24| 30|void PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 25| 30| int i; 26| 30| unsigned char c; 27| 30| int j; 28| | 29| 4.08k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 4.08k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 4.08k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (29:17): [True: 4.05k, False: 30] ------------------ 30| 4.05k| c = msg[i]; 31| 4.05k| r->coeffs[5 * i + 0] = c; 32| 4.05k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 33| 4.05k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 34| 4.05k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 35| 4.05k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 36| 4.05k| } 37| 30| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 30|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 30|#define NTRU_N 677 | | ------------------ ------------------ 38| 30| c = msg[i]; 39| 60| for (j = 0; (5 * i + j) < NTRU_PACK_DEG; j++) { ------------------ | | 25| 60|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 60|#define NTRU_N 677 | | ------------------ ------------------ | Branch (39:17): [True: 30, False: 30] ------------------ 40| 30| r->coeffs[5 * i + j] = c; 41| 30| c = c * 171 >> 9; 42| 30| } 43| 30| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 30|#define NTRU_N 677 ------------------ 44| 30| PQCLEAN_NTRUHPS2048677_AVX2_poly_mod_3_Phi_n(r); 45| 30|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_tobytes: 3| 45|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_tobytes(unsigned char *r, const poly *a) { 4| 45| int i, j; 5| 45| uint16_t t[8]; 6| | 7| 3.82k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 25| 3.82k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 3.82k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (7:17): [True: 3.78k, False: 45] ------------------ 8| 34.0k| for (j = 0; j < 8; j++) { ------------------ | Branch (8:21): [True: 30.2k, False: 3.78k] ------------------ 9| 30.2k| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 30.2k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 30.2k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 30.2k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 10| 30.2k| } 11| | 12| 3.78k| r[11 * i + 0] = (unsigned char) ( t[0] & 0xff); 13| 3.78k| r[11 * i + 1] = (unsigned char) ((t[0] >> 8) | ((t[1] & 0x1f) << 3)); 14| 3.78k| r[11 * i + 2] = (unsigned char) ((t[1] >> 5) | ((t[2] & 0x03) << 6)); 15| 3.78k| r[11 * i + 3] = (unsigned char) ((t[2] >> 2) & 0xff); 16| 3.78k| r[11 * i + 4] = (unsigned char) ((t[2] >> 10) | ((t[3] & 0x7f) << 1)); 17| 3.78k| r[11 * i + 5] = (unsigned char) ((t[3] >> 7) | ((t[4] & 0x0f) << 4)); 18| 3.78k| r[11 * i + 6] = (unsigned char) ((t[4] >> 4) | ((t[5] & 0x01) << 7)); 19| 3.78k| r[11 * i + 7] = (unsigned char) ((t[5] >> 1) & 0xff); 20| 3.78k| r[11 * i + 8] = (unsigned char) ((t[5] >> 9) | ((t[6] & 0x3f) << 2)); 21| 3.78k| r[11 * i + 9] = (unsigned char) ((t[6] >> 6) | ((t[7] & 0x07) << 5)); 22| 3.78k| r[11 * i + 10] = (unsigned char) ((t[7] >> 3)); 23| 3.78k| } 24| | 25| 225| for (j = 0; j < NTRU_PACK_DEG - 8 * i; j++) { ------------------ | | 25| 225|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 225|#define NTRU_N 677 | | ------------------ ------------------ | Branch (25:17): [True: 180, False: 45] ------------------ 26| 180| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 180|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 180|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 180|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 27| 180| } 28| 225| for (; j < 8; j++) { ------------------ | Branch (28:12): [True: 180, False: 45] ------------------ 29| 180| t[j] = 0; 30| 180| } 31| | 32| 45| switch (NTRU_PACK_DEG & 0x07) { ------------------ | | 25| 45|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 45|#define NTRU_N 677 | | ------------------ ------------------ | Branch (32:13): [True: 45, Folded] ------------------ 33| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 34| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 35| 45| case 4: ------------------ | Branch (35:5): [True: 45, False: 0] ------------------ 36| 45| r[11 * i + 0] = (unsigned char) (t[0] & 0xff); 37| 45| r[11 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x1f) << 3); 38| 45| r[11 * i + 2] = (unsigned char) (t[1] >> 5) | ((t[2] & 0x03) << 6); 39| 45| r[11 * i + 3] = (unsigned char) (t[2] >> 2) & 0xff; 40| 45| r[11 * i + 4] = (unsigned char) (t[2] >> 10) | ((t[3] & 0x7f) << 1); 41| 45| r[11 * i + 5] = (unsigned char) (t[3] >> 7) | ((t[4] & 0x0f) << 4); 42| 45| break; 43| 0| case 2: ------------------ | Branch (43:5): [True: 0, False: 45] ------------------ 44| 0| r[11 * i + 0] = (unsigned char) (t[0] & 0xff); 45| 0| r[11 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x1f) << 3); 46| 0| r[11 * i + 2] = (unsigned char) (t[1] >> 5) | ((t[2] & 0x03) << 6); 47| 0| break; 48| 45| } 49| 45|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_frombytes: 51| 45|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_frombytes(poly *r, const unsigned char *a) { 52| 45| int i; 53| 3.82k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 25| 3.82k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 3.82k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (53:17): [True: 3.78k, False: 45] ------------------ 54| 3.78k| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 55| 3.78k| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 56| 3.78k| r->coeffs[8 * i + 2] = (a[11 * i + 2] >> 6) | (((uint16_t)a[11 * i + 3] & 0xff) << 2) | (((uint16_t)a[11 * i + 4] & 0x01) << 10); 57| 3.78k| r->coeffs[8 * i + 3] = (a[11 * i + 4] >> 1) | (((uint16_t)a[11 * i + 5] & 0x0f) << 7); 58| 3.78k| r->coeffs[8 * i + 4] = (a[11 * i + 5] >> 4) | (((uint16_t)a[11 * i + 6] & 0x7f) << 4); 59| 3.78k| r->coeffs[8 * i + 5] = (a[11 * i + 6] >> 7) | (((uint16_t)a[11 * i + 7] & 0xff) << 1) | (((uint16_t)a[11 * i + 8] & 0x03) << 9); 60| 3.78k| r->coeffs[8 * i + 6] = (a[11 * i + 8] >> 2) | (((uint16_t)a[11 * i + 9] & 0x1f) << 6); 61| 3.78k| r->coeffs[8 * i + 7] = (a[11 * i + 9] >> 5) | (((uint16_t)a[11 * i + 10] & 0xff) << 3); 62| 3.78k| } 63| 45| switch (NTRU_PACK_DEG & 0x07) { ------------------ | | 25| 45|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 45|#define NTRU_N 677 | | ------------------ ------------------ | Branch (63:13): [True: 45, Folded] ------------------ 64| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 65| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 66| 45| case 4: ------------------ | Branch (66:5): [True: 45, False: 0] ------------------ 67| 45| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 68| 45| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 69| 45| r->coeffs[8 * i + 2] = (a[11 * i + 2] >> 6) | (((uint16_t)a[11 * i + 3] & 0xff) << 2) | (((uint16_t)a[11 * i + 4] & 0x01) << 10); 70| 45| r->coeffs[8 * i + 3] = (a[11 * i + 4] >> 1) | (((uint16_t)a[11 * i + 5] & 0x0f) << 7); 71| 45| break; 72| 0| case 2: ------------------ | Branch (72:5): [True: 0, False: 45] ------------------ 73| 0| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 74| 0| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 75| 0| break; 76| 45| } 77| 45| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 45|#define NTRU_N 677 ------------------ 78| 45|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_tobytes: 80| 30|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 81| 30| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_tobytes(r, a); 82| 30|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_frombytes: 84| 30|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 85| 30| int i; 86| 30| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_frombytes(r, a); 87| | 88| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 89| 30| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 30|#define NTRU_N 677 ------------------ 90| 20.3k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 25| 20.3k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 20.3k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (90:17): [True: 20.2k, False: 30] ------------------ 91| 20.2k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 20.2k|#define NTRU_N 677 ------------------ 92| 20.2k| } 93| 30|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq: 4| 90|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(poly *r) { 5| 90| int i; 6| 61.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 61.0k|#define NTRU_N 677 ------------------ | Branch (6:17): [True: 60.9k, False: 90] ------------------ 7| 60.9k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 60.9k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 60.9k|#define NTRU_LOGQ 11 | | ------------------ ------------------ 8| 60.9k| } 9| 90|} PQCLEAN_NTRUHPS2048677_AVX2_poly_trinary_Zq_to_Z3: 12| 15|void PQCLEAN_NTRUHPS2048677_AVX2_poly_trinary_Zq_to_Z3(poly *r) { 13| 15| int i; 14| 10.1k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 10.1k|#define NTRU_N 677 ------------------ | Branch (14:17): [True: 10.1k, False: 15] ------------------ 15| 10.1k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 10.1k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 10.1k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 10.1k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 16| 10.1k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 10.1k|#define NTRU_LOGQ 11 ------------------ 17| 10.1k| } 18| 15|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_mul: 20| 30|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 30| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(r, a, b); 22| 30| PQCLEAN_NTRUHPS2048677_AVX2_poly_mod_q_Phi_n(r); 23| 30|} PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_mul: 25| 15|void PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 15| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(r, a, b); 32| 10.1k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 10.1k|#define NTRU_N 677 ------------------ | Branch (32:17): [True: 10.1k, False: 15] ------------------ 33| 10.1k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 10.1k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 10.1k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 10.1k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 34| 10.1k| } 35| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_mod_3_Phi_n(r); 36| 15|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_inv: 71| 15|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_inv(poly *r, const poly *a) { 72| 15| poly ai2; 73| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv(&ai2, a); 74| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 15|} poly.c:PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv_to_Rq_inv: 38| 15|static void PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 15| int i; 41| 15| poly b, c; 42| 15| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 10.1k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 10.1k|#define NTRU_N 677 ------------------ | Branch (46:17): [True: 10.1k, False: 15] ------------------ 47| 10.1k| b.coeffs[i] = -(a->coeffs[i]); 48| 10.1k| } 49| | 50| 10.1k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 10.1k|#define NTRU_N 677 ------------------ | Branch (50:17): [True: 10.1k, False: 15] ------------------ 51| 10.1k| r->coeffs[i] = ai->coeffs[i]; 52| 10.1k| } 53| | 54| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&c, r, &b); 55| 15| c.coeffs[0] += 2; // c = 2 - a*ai 56| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&c, &s, &b); 59| 15| c.coeffs[0] += 2; // c = 2 - a*s 60| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&c, r, &b); 63| 15| c.coeffs[0] += 2; // c = 2 - a*r 64| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&c, &s, &b); 67| 15| c.coeffs[0] += 2; // c = 2 - a*s 68| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 69| 15|} PQCLEAN_NTRUHPS2048677_AVX2_poly_lift: 3| 30|void PQCLEAN_NTRUHPS2048677_AVX2_poly_lift(poly *r, const poly *a) { 4| 30| int i; 5| 20.3k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 20.3k|#define NTRU_N 677 ------------------ | Branch (5:17): [True: 20.3k, False: 30] ------------------ 6| 20.3k| r->coeffs[i] = a->coeffs[i]; 7| 20.3k| } 8| 30| PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(r); 9| 30|} PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_tobytes: 6| 15|void PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_tobytes(unsigned char *out, const poly *a) { 7| 15| int i, j, k; 8| 195| for (i = 0; i < 12; i++) { ------------------ | Branch (8:17): [True: 180, False: 15] ------------------ 9| 1.62k| for (k = 0; k < 8; k++) { ------------------ | Branch (9:21): [True: 1.44k, False: 180] ------------------ 10| 1.44k| out[i * 8 + k] = 0; 11| 12.9k| for (j = 0; j < 8; j++) { ------------------ | Branch (11:25): [True: 11.5k, False: 1.44k] ------------------ 12| 11.5k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 11.5k|#define NTRU_N 677 ------------------ | Branch (12:21): [True: 10.1k, False: 1.36k] ------------------ 13| 10.1k| out[i * 8 + k] |= (a->coeffs[(i * 8 + k) * 8 + j] & 1) << j; 14| 10.1k| } 15| 11.5k| } 16| 1.44k| } 17| 180| } 18| 15|} PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_frombytes: 20| 15|void PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_frombytes(poly *a, const unsigned char *in) { 21| 15| int i, j, k; 22| 195| for (i = 0; i < 12; i++) { ------------------ | Branch (22:17): [True: 180, False: 15] ------------------ 23| 1.62k| for (k = 0; k < 8; k++) { ------------------ | Branch (23:21): [True: 1.44k, False: 180] ------------------ 24| 12.9k| for (j = 0; j < 8; j++) { ------------------ | Branch (24:25): [True: 11.5k, False: 1.44k] ------------------ 25| 11.5k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 11.5k|#define NTRU_N 677 ------------------ | Branch (25:21): [True: 10.1k, False: 1.36k] ------------------ 26| 10.1k| a->coeffs[(i * 8 + k) * 8 + j] = (in[i * 8 + k] >> j) & 1; 27| 10.1k| } 28| 11.5k| } 29| 1.44k| } 30| 180| } 31| 15|} PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv: 33| 15|void PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv(poly *r, const poly *a) { 34| 15| union { 35| 15| unsigned char s[96]; 36| 15| __m256i s_x32[3]; 37| 15| } squares[13]; 38| 15|#define s(x) squares[(x)].s 39| | 40| | // This relies on the following addition chain: 41| | // 1, 2, 3, 5, 10, 20, 21, 42, 84, 168, 336, 672, 675 42| | 43| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_tobytes(s(0), a); // TODO alignment ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 44| | 45| 15| PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(1), s(0)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(1), s(0)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 46| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 47| 15| PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(2), s(1)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(2), s(1)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 48| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 49| 15| PQCLEAN_NTRUHPS2048677_AVX2_square_2_677(s(3), s(2)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_2_677(s(3), s(2)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 50| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(3), s(3), s(1)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(3), s(3), s(1)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(3), s(3), s(1)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 51| 15| PQCLEAN_NTRUHPS2048677_AVX2_square_5_677(s(4), s(3)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_5_677(s(4), s(3)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 52| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 53| 15| PQCLEAN_NTRUHPS2048677_AVX2_square_10_677(s(5), s(4)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_10_677(s(5), s(4)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 54| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 55| 15| PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(6), s(5)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(6), s(5)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 56| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(6), s(6), s(0)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(6), s(6), s(0)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(6), s(6), s(0)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 57| 15| PQCLEAN_NTRUHPS2048677_AVX2_square_21_677(s(7), s(6)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_21_677(s(7), s(6)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 58| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 59| 15| PQCLEAN_NTRUHPS2048677_AVX2_square_42_677(s(8), s(7)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_42_677(s(8), s(7)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 60| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 61| 15| PQCLEAN_NTRUHPS2048677_AVX2_square_84_677(s(9), s(8)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_84_677(s(9), s(8)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 62| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 63| 15| PQCLEAN_NTRUHPS2048677_AVX2_square_168_677(s(10), s(9)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_168_677(s(10), s(9)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 64| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 65| 15| PQCLEAN_NTRUHPS2048677_AVX2_square_336_677(s(11), s(10)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_336_677(s(11), s(10)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 66| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 67| 15| PQCLEAN_NTRUHPS2048677_AVX2_square_3_677(s(12), s(11)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_3_677(s(12), s(11)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 68| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 69| 15| PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(0), s(12)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(0), s(12)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 70| | 71| 15| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_frombytes(r, s(0)); ------------------ | | 38| 15|#define s(x) squares[(x)].s ------------------ 72| 15|#undef s 73| 15|} PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_inv: 545| 15|void PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_inv(poly *r_out, const poly *a) { 546| 15| const unsigned char *in = (void *) a; 547| 15| unsigned char *out = (void *) r_out; 548| | 549| 15| small input[ppad]; 550| 15| small output[ppad]; 551| 15| int i; 552| | 553| | /* XXX: obviously input/output format should be packed into bytes */ 554| | 555| 10.1k| for (i = 0; i < p; ++i) { ------------------ | | 7| 10.1k|#define p 676 ------------------ | Branch (555:17): [True: 10.1k, False: 15] ------------------ 556| 10.1k| small x = in[2 * i] & 3; /* 0 1 2 3 */ 557| 10.1k| x += 1; /* 0 1 2 3 4 5 6, offset by 1 */ 558| 10.1k| x &= (x - 3) >> 5; /* 0 1 2, offset by 1 */ 559| 10.1k| input[i] = x - 1; 560| 10.1k| } 561| | /* XXX: merge with vec256_init */ 562| | 563| 15| __poly_S3_inv((unsigned char *)output, (unsigned char *)input); 564| | 565| 10.1k| for (i = 0; i < p; ++i) { ------------------ | | 7| 10.1k|#define p 676 ------------------ | Branch (565:17): [True: 10.1k, False: 15] ------------------ 566| 10.1k| out[2 * i] = (3 & output[i]) ^ ((3 & output[i]) >> 1); 567| 10.1k| out[2 * i + 1] = 0; 568| 10.1k| } 569| 15|} poly_s3_inv.c:vec256_divx_3: 280| 82.3k|static inline void vec256_divx_3(vec256 *f) { 281| 82.3k| vec256 f0 = f[0]; 282| 82.3k| vec256 f1 = f[1]; 283| 82.3k| vec256 f2 = f[2]; 284| | 285| 82.3k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 286| 82.3k| unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1)); 287| 82.3k| unsigned long long low2 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f2)); 288| | 289| 82.3k| low0 = (low0 >> 1) | (low1 << 63); 290| 82.3k| low1 = (low1 >> 1) | (low2 << 63); 291| 82.3k| low2 = low2 >> 1; 292| | 293| 82.3k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 294| 82.3k| f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3); 295| 82.3k| f2 = _mm256_blend_epi32(f2, _mm256_set_epi64x(0, 0, 0, low2), 0x3); 296| | 297| 82.3k| f[0] = _mm256_permute4x64_epi64(f0, 0x39); 298| 82.3k| f[1] = _mm256_permute4x64_epi64(f1, 0x39); 299| | f[2] = _mm256_permute4x64_epi64(f2, 0x39); 300| 82.3k|} poly_s3_inv.c:vec256_timesx_3: 331| 82.3k|static inline void vec256_timesx_3(vec256 *f) { 332| 82.3k| vec256 f0 = _mm256_permute4x64_epi64(f[0], 0x93); 333| 82.3k| vec256 f1 = _mm256_permute4x64_epi64(f[1], 0x93); 334| 82.3k| vec256 f2 = _mm256_permute4x64_epi64(f[2], 0x93); 335| | 336| 82.3k| unsigned long long low0 = *(unsigned long long *) &f0; 337| 82.3k| unsigned long long low1 = *(unsigned long long *) &f1; 338| 82.3k| unsigned long long low2 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f2)); 339| | 340| 82.3k| low2 = (low2 << 1) | (low1 >> 63); 341| 82.3k| low1 = (low1 << 1) | (low0 >> 63); 342| 82.3k| low0 = low0 << 1; 343| | 344| 82.3k| *(unsigned long long *) &f0 = low0; 345| 82.3k| *(unsigned long long *) &f1 = low1; 346| 82.3k| f2 = _mm256_blend_epi32(f2, _mm256_set_epi64x(0, 0, 0, low2), 0x3); 347| | 348| 82.3k| f[0] = f0; 349| 82.3k| f[1] = f1; 350| 82.3k| f[2] = f2; 351| 82.3k|} PQCLEAN_NTRUHPS2048677_AVX2_sample_fg: 3| 15|void PQCLEAN_NTRUHPS2048677_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| | 5| 15| PQCLEAN_NTRUHPS2048677_AVX2_sample_iid(f, uniformbytes); 6| 15| PQCLEAN_NTRUHPS2048677_AVX2_sample_fixed_type(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 15|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 15|#define NTRU_N 677 | | ------------------ ------------------ 7| 15|} PQCLEAN_NTRUHPS2048677_AVX2_sample_rm: 9| 15|void PQCLEAN_NTRUHPS2048677_AVX2_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| | 11| 15| PQCLEAN_NTRUHPS2048677_AVX2_sample_iid(r, uniformbytes); 12| 15| PQCLEAN_NTRUHPS2048677_AVX2_sample_fixed_type(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 15|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 15|#define NTRU_N 677 | | ------------------ ------------------ 13| 15|} PQCLEAN_NTRUHPS2048677_AVX2_sample_fixed_type: 16| 30|void PQCLEAN_NTRUHPS2048677_AVX2_sample_fixed_type(poly *r, const unsigned char u[NTRU_SAMPLE_FT_BYTES]) { 17| | // Assumes NTRU_SAMPLE_FT_BYTES = ceil(30*(n-1)/8) 18| | 19| 30| int32_t s[NTRU_N - 1]; 20| 30| int i; 21| | 22| | // Use 30 bits of u per word 23| 5.10k| for (i = 0; i < (NTRU_N - 1) / 4; i++) { ------------------ | | 5| 5.10k|#define NTRU_N 677 ------------------ | Branch (23:17): [True: 5.07k, False: 30] ------------------ 24| 5.07k| s[4 * i + 0] = (u[15 * i + 0] << 2) + (u[15 * i + 1] << 10) + (u[15 * i + 2] << 18) + ((uint32_t) u[15 * i + 3] << 26); 25| 5.07k| s[4 * i + 1] = ((u[15 * i + 3] & 0xc0) >> 4) + (u[15 * i + 4] << 4) + (u[15 * i + 5] << 12) + (u[15 * i + 6] << 20) + ((uint32_t) u[15 * i + 7] << 28); 26| 5.07k| s[4 * i + 2] = ((u[15 * i + 7] & 0xf0) >> 2) + (u[15 * i + 8] << 6) + (u[15 * i + 9] << 14) + (u[15 * i + 10] << 22) + ((uint32_t) u[15 * i + 11] << 30); 27| 5.07k| s[4 * i + 3] = (u[15 * i + 11] & 0xfc) + (u[15 * i + 12] << 8) + (u[15 * i + 13] << 16) + ((uint32_t) u[15 * i + 14] << 24); 28| 5.07k| } 29| | 30| 3.84k| for (i = 0; i < NTRU_WEIGHT / 2; i++) { ------------------ | | 14| 3.84k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 3.84k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 3.84k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ | Branch (30:17): [True: 3.81k, False: 30] ------------------ 31| 3.81k| s[i] |= 1; 32| 3.81k| } 33| | 34| 3.84k| for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 30|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 30|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 30|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 3.84k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 3.84k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 3.84k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ | Branch (34:31): [True: 3.81k, False: 30] ------------------ 35| 3.81k| s[i] |= 2; 36| 3.81k| } 37| | 38| 30| PQCLEAN_NTRUHPS2048677_AVX2_crypto_sort_int32(s, NTRU_N - 1); ------------------ | | 5| 30|#define NTRU_N 677 ------------------ 39| | 40| 20.3k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 20.3k|#define NTRU_N 677 ------------------ | Branch (40:17): [True: 20.2k, False: 30] ------------------ 41| 20.2k| r->coeffs[i] = ((uint16_t) (s[i] & 3)); 42| 20.2k| } 43| | 44| 30| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 30|#define NTRU_N 677 ------------------ 45| 30|} PQCLEAN_NTRUHPS2048677_AVX2_sample_iid: 7| 30|void PQCLEAN_NTRUHPS2048677_AVX2_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 8| 30| int i; 9| 30| union { /* align to 32 byte boundary for vmovdqa */ 10| 30| unsigned char b[PAD32(NTRU_SAMPLE_IID_BYTES)]; 11| 30| __m256i b_x32[PAD32(NTRU_SAMPLE_IID_BYTES) / 32]; 12| 30| } buffer; 13| | 14| 20.3k| for (i = 0; i < NTRU_SAMPLE_IID_BYTES; i++) { ------------------ | | 20| 20.3k|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 20.3k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (14:17): [True: 20.2k, False: 30] ------------------ 15| 20.2k| buffer.b[i] = uniformbytes[i]; 16| 20.2k| } 17| 870| for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 20| 30|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 30|#define NTRU_N 677 | | ------------------ ------------------ for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 11| 870|#define PAD32(X) ((((X) + 31)/32)*32) ------------------ | Branch (17:37): [True: 840, False: 30] ------------------ 18| 840| buffer.b[i] = 0; 19| 840| } 20| 30| PQCLEAN_NTRUHPS2048677_AVX2_vec32_sample_iid(r, buffer.b); 21| 30|} PQCLEAN_NTRUHPS40961229_CLEAN_cmov: 4| 34|void PQCLEAN_NTRUHPS40961229_CLEAN_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 34| size_t i; 6| | 7| 34| b = (~b + 1); 8| 1.12k| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 1.08k, False: 34] ------------------ 9| 1.08k| r[i] ^= b & (x[i] ^ r[i]); 10| 1.08k| } 11| 34|} PQCLEAN_NTRUHPS40961229_CLEAN_crypto_sort_int32: 20| 68|void PQCLEAN_NTRUHPS40961229_CLEAN_crypto_sort_int32(int32 *array, size_t n) { 21| 68| size_t top, p, q, r, i, j; 22| 68| int32 *x = array; ------------------ | | 6| 68|#define int32 int32_t ------------------ 23| | 24| 68| top = 1; 25| 748| while (top < n - top) { ------------------ | Branch (25:12): [True: 680, False: 68] ------------------ 26| 680| top += top; 27| 680| } 28| | 29| 816| for (p = top; p >= 1; p >>= 1) { ------------------ | Branch (29:19): [True: 748, False: 68] ------------------ 30| 748| i = 0; 31| 83.9k| while (i + 2 * p <= n) { ------------------ | Branch (31:16): [True: 83.1k, False: 748] ------------------ 32| 475k| for (j = i; j < i + p; ++j) { ------------------ | Branch (32:25): [True: 392k, False: 83.1k] ------------------ 33| 392k| int32_MINMAX(x[j], x[j + p]); ------------------ | | 9| 392k| do { \ | | 10| 392k| int32_t ab = (b) ^ (a); \ | | 11| 392k| int32_t c = (int32_t)((int64_t)(b) - (int64_t)(a)); \ | | 12| 392k| c ^= ab & (c ^ (b)); \ | | 13| 392k| c >>= 31; \ | | 14| 392k| c &= ab; \ | | 15| 392k| (a) ^= c; \ | | 16| 392k| (b) ^= c; \ | | 17| 392k| } while(0) | | ------------------ | | | Branch (17:13): [Folded, False: 392k] | | ------------------ ------------------ 34| 392k| } 35| 83.1k| i += 2 * p; 36| 83.1k| } 37| 20.8k| for (j = i; j < n - p; ++j) { ------------------ | Branch (37:21): [True: 20.1k, False: 748] ------------------ 38| 20.1k| int32_MINMAX(x[j], x[j + p]); ------------------ | | 9| 20.1k| do { \ | | 10| 20.1k| int32_t ab = (b) ^ (a); \ | | 11| 20.1k| int32_t c = (int32_t)((int64_t)(b) - (int64_t)(a)); \ | | 12| 20.1k| c ^= ab & (c ^ (b)); \ | | 13| 20.1k| c >>= 31; \ | | 14| 20.1k| c &= ab; \ | | 15| 20.1k| (a) ^= c; \ | | 16| 20.1k| (b) ^= c; \ | | 17| 20.1k| } while(0) | | ------------------ | | | Branch (17:13): [Folded, False: 20.1k] | | ------------------ ------------------ 39| 20.1k| } 40| | 41| 748| i = 0; 42| 748| j = 0; 43| 4.48k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (43:23): [True: 3.74k, False: 748] ------------------ 44| 3.74k| if (j != i) { ------------------ | Branch (44:17): [True: 680, False: 3.06k] ------------------ 45| 10.3k| for (;;) { 46| 10.3k| if (j == n - q) { ------------------ | Branch (46:25): [True: 0, False: 10.3k] ------------------ 47| 0| goto done; 48| 0| } 49| 10.3k| int32 a = x[j + p]; ------------------ | | 6| 10.3k|#define int32 int32_t ------------------ 50| 31.5k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (50:33): [True: 21.2k, False: 10.3k] ------------------ 51| 21.2k| int32_MINMAX(a, x[j + r]); ------------------ | | 9| 21.2k| do { \ | | 10| 21.2k| int32_t ab = (b) ^ (a); \ | | 11| 21.2k| int32_t c = (int32_t)((int64_t)(b) - (int64_t)(a)); \ | | 12| 21.2k| c ^= ab & (c ^ (b)); \ | | 13| 21.2k| c >>= 31; \ | | 14| 21.2k| c &= ab; \ | | 15| 21.2k| (a) ^= c; \ | | 16| 21.2k| (b) ^= c; \ | | 17| 21.2k| } while(0) | | ------------------ | | | Branch (17:13): [Folded, False: 21.2k] | | ------------------ ------------------ 52| 21.2k| } 53| 10.3k| x[j + p] = a; 54| 10.3k| ++j; 55| 10.3k| if (j == i + p) { ------------------ | Branch (55:25): [True: 680, False: 9.65k] ------------------ 56| 680| i += 2 * p; 57| 680| break; 58| 680| } 59| 10.3k| } 60| 680| } 61| 85.8k| while (i + p <= n - q) { ------------------ | Branch (61:20): [True: 82.0k, False: 3.74k] ------------------ 62| 387k| for (j = i; j < i + p; ++j) { ------------------ | Branch (62:29): [True: 305k, False: 82.0k] ------------------ 63| 305k| int32 a = x[j + p]; ------------------ | | 6| 305k|#define int32 int32_t ------------------ 64| 1.90M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (64:33): [True: 1.60M, False: 305k] ------------------ 65| 1.60M| int32_MINMAX(a, x[j + r]); ------------------ | | 9| 1.60M| do { \ | | 10| 1.60M| int32_t ab = (b) ^ (a); \ | | 11| 1.60M| int32_t c = (int32_t)((int64_t)(b) - (int64_t)(a)); \ | | 12| 1.60M| c ^= ab & (c ^ (b)); \ | | 13| 1.60M| c >>= 31; \ | | 14| 1.60M| c &= ab; \ | | 15| 1.60M| (a) ^= c; \ | | 16| 1.60M| (b) ^= c; \ | | 17| 1.60M| } while(0) | | ------------------ | | | Branch (17:13): [Folded, False: 1.60M] | | ------------------ ------------------ 66| 1.60M| } 67| 305k| x[j + p] = a; 68| 305k| } 69| 82.0k| i += 2 * p; 70| 82.0k| } 71| | /* now i + p > n - q */ 72| 3.74k| j = i; 73| 54.3k| while (j < n - q) { ------------------ | Branch (73:20): [True: 50.5k, False: 3.74k] ------------------ 74| 50.5k| int32 a = x[j + p]; ------------------ | | 6| 50.5k|#define int32 int32_t ------------------ 75| 135k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (75:29): [True: 84.8k, False: 50.5k] ------------------ 76| 84.8k| int32_MINMAX(a, x[j + r]); ------------------ | | 9| 84.8k| do { \ | | 10| 84.8k| int32_t ab = (b) ^ (a); \ | | 11| 84.8k| int32_t c = (int32_t)((int64_t)(b) - (int64_t)(a)); \ | | 12| 84.8k| c ^= ab & (c ^ (b)); \ | | 13| 84.8k| c >>= 31; \ | | 14| 84.8k| c &= ab; \ | | 15| 84.8k| (a) ^= c; \ | | 16| 84.8k| (b) ^= c; \ | | 17| 84.8k| } while(0) | | ------------------ | | | Branch (17:13): [Folded, False: 84.8k] | | ------------------ ------------------ 77| 84.8k| } 78| 50.5k| x[j + p] = a; 79| 50.5k| ++j; 80| 50.5k| } 81| | 82| 3.74k|done: 83| 3.74k| ; 84| 3.74k| } 85| 748| } 86| 68|} PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_keypair: 10| 34|int PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 34| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 34| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 34|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 22| 34|#define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 34|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 34|#define NTRU_N 1229 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 34|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 34|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 14| 34| PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_keypair(pk, sk, seed); 15| | 16| 34| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 34|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 30| 34|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 34|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 34|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 34|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 34|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 34|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 34|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 34|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 17| 34|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 34| return 0; 19| 34|} PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_enc: 21| 34|int PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 34| poly r, m; 23| 34| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 34| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 34| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 34|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 23| 34|#define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 34|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 34|#define NTRU_N 1229 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 34|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 34|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 34| PQCLEAN_NTRUHPS40961229_CLEAN_sample_rm(&r, &m, rm_seed); 29| | 30| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(rm, &r); 31| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 26| 34|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 34|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 34|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 32| 34| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 34|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 34|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 34|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 34|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 34|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(&r); 35| 34| PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_enc(c, &r, &m, pk); 36| | 37| 34| return 0; 38| 34|} PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_dec: 40| 34|int PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 34| int i, fail; 42| 34| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 34| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 34| fail = PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_dec for details. */ 48| | 49| 34| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 34|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 34|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 34|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 34|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 34|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 1.12k| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 17| 1.12k|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 1.08k, False: 34] ------------------ 53| 1.08k| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 30| 1.08k|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 1.08k|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 1.08k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 1.08k|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 1.08k|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 1.08k|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 1.08k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 1.08k|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 1.08k| } 55| 62.6k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 35| 62.6k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 62.6k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 62.6k|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 62.6k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 62.6k|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 62.6k, False: 34] ------------------ 56| 62.6k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 17| 62.6k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 62.6k| } 58| 34| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 34|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 17| 34|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 35| 34|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 34|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 34|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 34|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 34|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 34| PQCLEAN_NTRUHPS40961229_CLEAN_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 18| 34|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 34| return 0; 63| 34|} PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_keypair: 62| 34| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 63| 34| int i; 64| | 65| 34| poly x1, x2, x3, x4, x5; 66| | 67| 34| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 68| 34| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 69| 34| poly *invh = &x3, *h = &x3; 70| | 71| 34| PQCLEAN_NTRUHPS40961229_CLEAN_sample_fg(f, g, seed); 72| | 73| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_inv(invf_mod3, f); 74| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(sk, f); 75| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 26| 34|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 34|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 34|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 76| | 77| | /* Lift coeffs of f and g from Z_p to Z_q */ 78| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(f); 79| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(g); 80| | 81| | 82| | /* g = 3*g */ 83| 41.8k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 41.8k|#define NTRU_N 1229 ------------------ | Branch (83:17): [True: 41.7k, False: 34] ------------------ 84| 41.7k| g->coeffs[i] = 3 * g->coeffs[i]; 85| 41.7k| } 86| | 87| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(gf, g, f); 88| | 89| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_inv(invgf, gf); 90| | 91| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(tmp, invgf, f); 92| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_mul(invh, tmp, f); 93| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 26| 34|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 34|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 34|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 94| | 95| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(tmp, invgf, g); 96| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(h, tmp, g); 97| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_tobytes(pk, h); 98| 34|} PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_enc: 104| 34| const unsigned char *pk) { 105| 34| int i; 106| 34| poly x1, x2; 107| 34| poly *h = &x1, *liftm = &x1; 108| 34| poly *ct = &x2; 109| | 110| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_frombytes(h, pk); 111| | 112| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(ct, r, h); 113| | 114| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_lift(liftm, m); 115| 41.8k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 41.8k|#define NTRU_N 1229 ------------------ | Branch (115:17): [True: 41.7k, False: 34] ------------------ 116| 41.7k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 117| 41.7k| } 118| | 119| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_tobytes(c, ct); 120| 34|} PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_dec: 124| 34| const unsigned char *secretkey) { 125| 34| int i; 126| 34| int fail; 127| 34| poly x1, x2, x3, x4; 128| | 129| 34| poly *c = &x1, *f = &x2, *cf = &x3; 130| 34| poly *mf = &x2, *finv3 = &x3, *m = &x4; 131| 34| poly *liftm = &x2, *invh = &x3, *r = &x4; 132| 34| poly *b = &x1; 133| | 134| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_frombytes(c, ciphertext); 135| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_frombytes(f, secretkey); 136| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(f); 137| | 138| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(cf, c, f); 139| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_to_S3(mf, cf); 140| | 141| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 34|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 34|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 34|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 142| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_mul(m, mf, finv3); 143| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 26| 34|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 34|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 34|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 144| | 145| 34| fail = 0; 146| | 147| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 148| 34| fail |= owcpa_check_ciphertext(ciphertext); 149| | 150| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 151| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 152| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 153| | /* (m can take any value in S3 in NTRU_HRSS) */ 154| 34| fail |= owcpa_check_m(m); 155| | 156| | /* b = c - Lift(m) mod (q, x^n - 1) */ 157| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_lift(liftm, m); 158| 41.8k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 41.8k|#define NTRU_N 1229 ------------------ | Branch (158:17): [True: 41.7k, False: 34] ------------------ 159| 41.7k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 160| 41.7k| } 161| | 162| | /* r = b / h mod (q, Phi_n) */ 163| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 34|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 34|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 34|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 164| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_mul(r, b, invh); 165| | 166| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 167| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 168| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 169| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 170| | /* where r gets a final reduction modulo p. */ 171| | /* We need this change to use Proposition 1 of [Sch18]. */ 172| | 173| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 174| | /* if and only if fail==0 after the following call to owcpa_check_r */ 175| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 176| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 177| 34| fail |= owcpa_check_r(r); 178| | 179| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_trinary_Zq_to_Z3(r); 180| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(rm, r); 181| | 182| 34| return fail; 183| 34|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes: 3| 204|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 204| int i; 5| 204| unsigned char c; 6| 204| int j; 7| | 8| 50.1k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 50.1k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 50.1k|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (8:17): [True: 49.9k, False: 204] ------------------ 9| 49.9k| c = a->coeffs[5 * i + 4] & 255; 10| 49.9k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 11| 49.9k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 12| 49.9k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 13| 49.9k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 14| 49.9k| msg[i] = c; 15| 49.9k| } 16| 204| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 204|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 204|#define NTRU_N 1229 | | ------------------ ------------------ 17| 204| c = 0; 18| 816| for (j = NTRU_PACK_DEG - (5 * i) - 1; j >= 0; j--) { ------------------ | | 25| 204|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 204|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (18:43): [True: 612, False: 204] ------------------ 19| 612| c = (3 * c + a->coeffs[5 * i + j]) & 255; 20| 612| } 21| 204| msg[i] = c; 22| 204|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_frombytes: 24| 68|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 25| 68| int i; 26| 68| unsigned char c; 27| 68| int j; 28| | 29| 16.7k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 16.7k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 16.7k|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (29:17): [True: 16.6k, False: 68] ------------------ 30| 16.6k| c = msg[i]; 31| 16.6k| r->coeffs[5 * i + 0] = c; 32| 16.6k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 33| 16.6k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 34| 16.6k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 35| 16.6k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 36| 16.6k| } 37| 68| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 68|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 68|#define NTRU_N 1229 | | ------------------ ------------------ 38| 68| c = msg[i]; 39| 272| for (j = 0; (5 * i + j) < NTRU_PACK_DEG; j++) { ------------------ | | 25| 272|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 272|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (39:17): [True: 204, False: 68] ------------------ 40| 204| r->coeffs[5 * i + j] = c; 41| 204| c = c * 171 >> 9; 42| 204| } 43| 68| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 68|#define NTRU_N 1229 ------------------ 44| 68| PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_3_Phi_n(r); 45| 68|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_tobytes: 4| 102|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_tobytes(unsigned char *r, const poly *a) { 5| 102| int i; 6| | 7| 62.7k| for (i = 0; i < NTRU_PACK_DEG / 2; i++) { ------------------ | | 25| 62.7k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 62.7k|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (7:17): [True: 62.6k, False: 102] ------------------ 8| 62.6k| r[3 * i + 0] = (unsigned char) ( MODQ(a->coeffs[2 * i + 0]) & 0xff); ------------------ | | 9| 62.6k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 62.6k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 62.6k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 9| 62.6k| r[3 * i + 1] = (unsigned char) ((MODQ(a->coeffs[2 * i + 0]) >> 8) | ((MODQ(a->coeffs[2 * i + 1]) & 0x0f) << 4)); ------------------ | | 9| 62.6k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 62.6k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 62.6k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ r[3 * i + 1] = (unsigned char) ((MODQ(a->coeffs[2 * i + 0]) >> 8) | ((MODQ(a->coeffs[2 * i + 1]) & 0x0f) << 4)); ------------------ | | 9| 62.6k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 62.6k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 62.6k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 10| 62.6k| r[3 * i + 2] = (unsigned char) ((MODQ(a->coeffs[2 * i + 1]) >> 4)); ------------------ | | 9| 62.6k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 62.6k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 62.6k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 11| 62.6k| } 12| 102|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_frombytes: 14| 102|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_frombytes(poly *r, const unsigned char *a) { 15| 102| int i; 16| 62.7k| for (i = 0; i < NTRU_PACK_DEG / 2; i++) { ------------------ | | 25| 62.7k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 62.7k|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (16:17): [True: 62.6k, False: 102] ------------------ 17| 62.6k| r->coeffs[2 * i + 0] = (a[3 * i + 0] >> 0) | (((uint16_t)a[3 * i + 1] & 0x0f) << 8); 18| 62.6k| r->coeffs[2 * i + 1] = (a[3 * i + 1] >> 4) | (((uint16_t)a[3 * i + 2] & 0xff) << 4); 19| 62.6k| } 20| 102| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 102|#define NTRU_N 1229 ------------------ 21| 102|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_tobytes: 23| 68|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 24| 68| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_tobytes(r, a); 25| 68|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_frombytes: 27| 68|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 28| 68| int i; 29| 68| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_frombytes(r, a); 30| | 31| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 32| 68| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 68|#define NTRU_N 1229 ------------------ 33| 83.5k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 25| 83.5k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 83.5k|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (33:17): [True: 83.5k, False: 68] ------------------ 34| 83.5k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 83.5k|#define NTRU_N 1229 ------------------ 35| 83.5k| } 36| 68|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq: 4| 204|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(poly *r) { 5| 204| int i; 6| 250k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 250k|#define NTRU_N 1229 ------------------ | Branch (6:17): [True: 250k, False: 204] ------------------ 7| 250k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 250k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 250k|#define NTRU_LOGQ 12 | | ------------------ ------------------ 8| 250k| } 9| 204|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_trinary_Zq_to_Z3: 12| 34|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_trinary_Zq_to_Z3(poly *r) { 13| 34| int i; 14| 41.8k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 41.8k|#define NTRU_N 1229 ------------------ | Branch (14:17): [True: 41.7k, False: 34] ------------------ 15| 41.7k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 41.7k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 41.7k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 41.7k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 16| 41.7k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 41.7k|#define NTRU_LOGQ 12 ------------------ 17| 41.7k| } 18| 34|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_mul: 20| 68|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 68| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(r, a, b); 22| 68| PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_q_Phi_n(r); 23| 68|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_mul: 25| 34|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 34| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(r, a, b); 32| 41.8k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 41.8k|#define NTRU_N 1229 ------------------ | Branch (32:17): [True: 41.7k, False: 34] ------------------ 33| 41.7k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 41.7k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 41.7k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 41.7k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 34| 41.7k| } 35| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_3_Phi_n(r); 36| 34|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_inv: 71| 34|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_inv(poly *r, const poly *a) { 72| 34| poly ai2; 73| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv(&ai2, a); 74| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 34|} poly.c:PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv_to_Rq_inv: 38| 34|static void PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 34| int i; 41| 34| poly b, c; 42| 34| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 41.8k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 41.8k|#define NTRU_N 1229 ------------------ | Branch (46:17): [True: 41.7k, False: 34] ------------------ 47| 41.7k| b.coeffs[i] = -(a->coeffs[i]); 48| 41.7k| } 49| | 50| 41.8k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 41.8k|#define NTRU_N 1229 ------------------ | Branch (50:17): [True: 41.7k, False: 34] ------------------ 51| 41.7k| r->coeffs[i] = ai->coeffs[i]; 52| 41.7k| } 53| | 54| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&c, r, &b); 55| 34| c.coeffs[0] += 2; // c = 2 - a*ai 56| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&c, &s, &b); 59| 34| c.coeffs[0] += 2; // c = 2 - a*s 60| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&c, r, &b); 63| 34| c.coeffs[0] += 2; // c = 2 - a*r 64| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&c, &s, &b); 67| 34| c.coeffs[0] += 2; // c = 2 - a*s 68| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(r, &c, &s); // r = s*c 69| 34|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_lift: 3| 68|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_lift(poly *r, const poly *a) { 4| 68| int i; 5| 83.6k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 83.6k|#define NTRU_N 1229 ------------------ | Branch (5:17): [True: 83.5k, False: 68] ------------------ 6| 83.5k| r->coeffs[i] = a->coeffs[i]; 7| 83.5k| } 8| 68| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(r); 9| 68|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_3_Phi_n: 18| 136|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_3_Phi_n(poly *r) { 19| 136| int i; 20| 167k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 167k|#define NTRU_N 1229 ------------------ | Branch (20:17): [True: 167k, False: 136] ------------------ 21| 167k| r->coeffs[i] = mod3(r->coeffs[i] + 2 * r->coeffs[NTRU_N - 1]); ------------------ | | 5| 167k|#define NTRU_N 1229 ------------------ 22| 167k| } 23| 136|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_q_Phi_n: 25| 68|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_q_Phi_n(poly *r) { 26| 68| int i; 27| 83.6k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 83.6k|#define NTRU_N 1229 ------------------ | Branch (27:17): [True: 83.5k, False: 68] ------------------ 28| 83.5k| r->coeffs[i] = r->coeffs[i] - r->coeffs[NTRU_N - 1]; ------------------ | | 5| 83.5k|#define NTRU_N 1229 ------------------ 29| 83.5k| } 30| 68|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_to_S3: 32| 34|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_to_S3(poly *r, const poly *a) { 33| 34| int i; 34| 34| uint16_t flag; 35| | 36| | /* The coefficients of a are stored as non-negative integers. */ 37| | /* We must translate to representatives in [-q/2, q/2) before */ 38| | /* reduction mod 3. */ 39| 41.8k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 41.8k|#define NTRU_N 1229 ------------------ | Branch (39:17): [True: 41.7k, False: 34] ------------------ 40| | /* Need an explicit reduction mod q here */ 41| 41.7k| r->coeffs[i] = MODQ(a->coeffs[i]); ------------------ | | 9| 41.7k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 41.7k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 41.7k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 42| | 43| | /* flag = 1 if r[i] >= q/2 else 0 */ 44| 41.7k| flag = r->coeffs[i] >> (NTRU_LOGQ - 1); ------------------ | | 6| 41.7k|#define NTRU_LOGQ 12 ------------------ 45| | 46| | /* Now we will add (-q) mod 3 if r[i] >= q/2 */ 47| | /* Note (-q) mod 3=(-2^k) mod 3=1<<(1-(k&1)) */ 48| 41.7k| r->coeffs[i] += flag << (1 - (NTRU_LOGQ & 1)); ------------------ | | 6| 41.7k|#define NTRU_LOGQ 12 ------------------ 49| 41.7k| } 50| | 51| 34| PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_3_Phi_n(r); 52| 34|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv: 10| 34|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv(poly *r, const poly *a) { 11| 34| poly f, g, v, w; 12| 34| size_t i, loop; 13| 34| int16_t delta, sign, swap, t; 14| | 15| 41.8k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 41.8k|#define NTRU_N 1229 ------------------ | Branch (15:17): [True: 41.7k, False: 34] ------------------ 16| 41.7k| v.coeffs[i] = 0; 17| 41.7k| } 18| 41.8k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 41.8k|#define NTRU_N 1229 ------------------ | Branch (18:17): [True: 41.7k, False: 34] ------------------ 19| 41.7k| w.coeffs[i] = 0; 20| 41.7k| } 21| 34| w.coeffs[0] = 1; 22| | 23| 41.8k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 41.8k|#define NTRU_N 1229 ------------------ | Branch (23:17): [True: 41.7k, False: 34] ------------------ 24| 41.7k| f.coeffs[i] = 1; 25| 41.7k| } 26| 41.7k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 41.7k|#define NTRU_N 1229 ------------------ | Branch (26:17): [True: 41.7k, False: 34] ------------------ 27| 41.7k| g.coeffs[NTRU_N - 2 - i] = (a->coeffs[i] ^ a->coeffs[NTRU_N - 1]) & 1; ------------------ | | 5| 41.7k|#define NTRU_N 1229 ------------------ g.coeffs[NTRU_N - 2 - i] = (a->coeffs[i] ^ a->coeffs[NTRU_N - 1]) & 1; ------------------ | | 5| 41.7k|#define NTRU_N 1229 ------------------ 28| 41.7k| } 29| 34| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 34|#define NTRU_N 1229 ------------------ 30| | 31| 34| delta = 1; 32| | 33| 83.5k| for (loop = 0; loop < 2 * (NTRU_N - 1) - 1; ++loop) { ------------------ | | 5| 83.5k|#define NTRU_N 1229 ------------------ | Branch (33:20): [True: 83.4k, False: 34] ------------------ 34| 102M| for (i = NTRU_N - 1; i > 0; --i) { ------------------ | | 5| 83.4k|#define NTRU_N 1229 ------------------ | Branch (34:30): [True: 102M, False: 83.4k] ------------------ 35| 102M| v.coeffs[i] = v.coeffs[i - 1]; 36| 102M| } 37| 83.4k| v.coeffs[0] = 0; 38| | 39| 83.4k| sign = g.coeffs[0] & f.coeffs[0]; 40| 83.4k| swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]); 41| 83.4k| delta ^= swap & (delta ^ -delta); 42| 83.4k| delta += 1; 43| | 44| 102M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 102M|#define NTRU_N 1229 ------------------ | Branch (44:21): [True: 102M, False: 83.4k] ------------------ 45| 102M| t = swap & (f.coeffs[i] ^ g.coeffs[i]); 46| 102M| f.coeffs[i] ^= t; 47| 102M| g.coeffs[i] ^= t; 48| 102M| t = swap & (v.coeffs[i] ^ w.coeffs[i]); 49| 102M| v.coeffs[i] ^= t; 50| 102M| w.coeffs[i] ^= t; 51| 102M| } 52| | 53| 102M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 102M|#define NTRU_N 1229 ------------------ | Branch (53:21): [True: 102M, False: 83.4k] ------------------ 54| 102M| g.coeffs[i] = g.coeffs[i] ^ (sign & f.coeffs[i]); 55| 102M| } 56| 102M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 102M|#define NTRU_N 1229 ------------------ | Branch (56:21): [True: 102M, False: 83.4k] ------------------ 57| 102M| w.coeffs[i] = w.coeffs[i] ^ (sign & v.coeffs[i]); 58| 102M| } 59| 102M| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 102M|#define NTRU_N 1229 ------------------ | Branch (59:21): [True: 102M, False: 83.4k] ------------------ 60| 102M| g.coeffs[i] = g.coeffs[i + 1]; 61| 102M| } 62| 83.4k| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 83.4k|#define NTRU_N 1229 ------------------ 63| 83.4k| } 64| | 65| 41.7k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 41.7k|#define NTRU_N 1229 ------------------ | Branch (65:17): [True: 41.7k, False: 34] ------------------ 66| 41.7k| r->coeffs[i] = v.coeffs[NTRU_N - 2 - i]; ------------------ | | 5| 41.7k|#define NTRU_N 1229 ------------------ 67| 41.7k| } 68| 34| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 34|#define NTRU_N 1229 ------------------ 69| 34|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul: 27| 578|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(poly *r, const poly *a, const poly *b) { 28| 578| size_t i; 29| 578| uint16_t ab[2 * L]; 30| | 31| 710k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 710k|#define NTRU_N 1229 ------------------ | Branch (31:17): [True: 710k, False: 578] ------------------ 32| 710k| ab[i] = a->coeffs[i]; 33| 710k| ab[L + i] = b->coeffs[i]; ------------------ | | 6| 710k|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 710k|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 34| 710k| } 35| 11.5k| for (i = NTRU_N; i < L; i++) { ------------------ | | 5| 578|#define NTRU_N 1229 ------------------ for (i = NTRU_N; i < L; i++) { ------------------ | | 6| 11.5k|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 11.5k|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ | Branch (35:22): [True: 10.9k, False: 578] ------------------ 36| 10.9k| ab[i] = 0; 37| 10.9k| ab[L + i] = 0; ------------------ | | 6| 10.9k|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 10.9k|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 38| 10.9k| } 39| | 40| 578| toom4_k2x2_mul(ab, ab, ab + L); ------------------ | | 6| 578|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 578|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 41| | 42| 710k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 710k|#define NTRU_N 1229 ------------------ | Branch (42:17): [True: 710k, False: 578] ------------------ 43| 710k| r->coeffs[i] = ab[i] + ab[NTRU_N + i]; ------------------ | | 5| 710k|#define NTRU_N 1229 ------------------ 44| 710k| } 45| 578|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_inv: 18| 34|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_inv(poly *r, const poly *a) { 19| 34| poly f, g, v, w; 20| 34| size_t i, loop; 21| 34| int16_t delta, sign, swap, t; 22| | 23| 41.8k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 41.8k|#define NTRU_N 1229 ------------------ | Branch (23:17): [True: 41.7k, False: 34] ------------------ 24| 41.7k| v.coeffs[i] = 0; 25| 41.7k| } 26| 41.8k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 41.8k|#define NTRU_N 1229 ------------------ | Branch (26:17): [True: 41.7k, False: 34] ------------------ 27| 41.7k| w.coeffs[i] = 0; 28| 41.7k| } 29| 34| w.coeffs[0] = 1; 30| | 31| 41.8k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 41.8k|#define NTRU_N 1229 ------------------ | Branch (31:17): [True: 41.7k, False: 34] ------------------ 32| 41.7k| f.coeffs[i] = 1; 33| 41.7k| } 34| 41.7k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 41.7k|#define NTRU_N 1229 ------------------ | Branch (34:17): [True: 41.7k, False: 34] ------------------ 35| 41.7k| g.coeffs[NTRU_N - 2 - i] = mod3((a->coeffs[i] & 3) + 2 * (a->coeffs[NTRU_N - 1] & 3)); ------------------ | | 5| 41.7k|#define NTRU_N 1229 ------------------ g.coeffs[NTRU_N - 2 - i] = mod3((a->coeffs[i] & 3) + 2 * (a->coeffs[NTRU_N - 1] & 3)); ------------------ | | 5| 41.7k|#define NTRU_N 1229 ------------------ 36| 41.7k| } 37| 34| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 34|#define NTRU_N 1229 ------------------ 38| | 39| 34| delta = 1; 40| | 41| 83.5k| for (loop = 0; loop < 2 * (NTRU_N - 1) - 1; ++loop) { ------------------ | | 5| 83.5k|#define NTRU_N 1229 ------------------ | Branch (41:20): [True: 83.4k, False: 34] ------------------ 42| 102M| for (i = NTRU_N - 1; i > 0; --i) { ------------------ | | 5| 83.4k|#define NTRU_N 1229 ------------------ | Branch (42:30): [True: 102M, False: 83.4k] ------------------ 43| 102M| v.coeffs[i] = v.coeffs[i - 1]; 44| 102M| } 45| 83.4k| v.coeffs[0] = 0; 46| | 47| 83.4k| sign = mod3((uint8_t) (2 * g.coeffs[0] * f.coeffs[0])); 48| 83.4k| swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]); 49| 83.4k| delta ^= swap & (delta ^ -delta); 50| 83.4k| delta += 1; 51| | 52| 102M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 102M|#define NTRU_N 1229 ------------------ | Branch (52:21): [True: 102M, False: 83.4k] ------------------ 53| 102M| t = swap & (f.coeffs[i] ^ g.coeffs[i]); 54| 102M| f.coeffs[i] ^= t; 55| 102M| g.coeffs[i] ^= t; 56| 102M| t = swap & (v.coeffs[i] ^ w.coeffs[i]); 57| 102M| v.coeffs[i] ^= t; 58| 102M| w.coeffs[i] ^= t; 59| 102M| } 60| | 61| 102M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 102M|#define NTRU_N 1229 ------------------ | Branch (61:21): [True: 102M, False: 83.4k] ------------------ 62| 102M| g.coeffs[i] = mod3((uint8_t) (g.coeffs[i] + sign * f.coeffs[i])); 63| 102M| } 64| 102M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 102M|#define NTRU_N 1229 ------------------ | Branch (64:21): [True: 102M, False: 83.4k] ------------------ 65| 102M| w.coeffs[i] = mod3((uint8_t) (w.coeffs[i] + sign * v.coeffs[i])); 66| 102M| } 67| 102M| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 102M|#define NTRU_N 1229 ------------------ | Branch (67:21): [True: 102M, False: 83.4k] ------------------ 68| 102M| g.coeffs[i] = g.coeffs[i + 1]; 69| 102M| } 70| 83.4k| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 83.4k|#define NTRU_N 1229 ------------------ 71| 83.4k| } 72| | 73| 34| sign = f.coeffs[0]; 74| 41.7k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 41.7k|#define NTRU_N 1229 ------------------ | Branch (74:17): [True: 41.7k, False: 34] ------------------ 75| 41.7k| r->coeffs[i] = mod3((uint8_t) (sign * v.coeffs[NTRU_N - 2 - i])); ------------------ | | 5| 41.7k|#define NTRU_N 1229 ------------------ 76| 41.7k| } 77| 34| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 34|#define NTRU_N 1229 ------------------ 78| 34|} PQCLEAN_NTRUHPS40961229_CLEAN_sample_fg: 3| 34|void PQCLEAN_NTRUHPS40961229_CLEAN_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| | 5| 34| PQCLEAN_NTRUHPS40961229_CLEAN_sample_iid(f, uniformbytes); 6| 34| PQCLEAN_NTRUHPS40961229_CLEAN_sample_fixed_type(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 34|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 34|#define NTRU_N 1229 | | ------------------ ------------------ 7| 34|} PQCLEAN_NTRUHPS40961229_CLEAN_sample_rm: 9| 34|void PQCLEAN_NTRUHPS40961229_CLEAN_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| | 11| 34| PQCLEAN_NTRUHPS40961229_CLEAN_sample_iid(r, uniformbytes); 12| 34| PQCLEAN_NTRUHPS40961229_CLEAN_sample_fixed_type(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 34|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 34|#define NTRU_N 1229 | | ------------------ ------------------ 13| 34|} PQCLEAN_NTRUHPS40961229_CLEAN_sample_fixed_type: 16| 68|void PQCLEAN_NTRUHPS40961229_CLEAN_sample_fixed_type(poly *r, const unsigned char u[NTRU_SAMPLE_FT_BYTES]) { 17| | // Assumes NTRU_SAMPLE_FT_BYTES = ceil(30*(n-1)/8) 18| | 19| 68| int32_t s[NTRU_N - 1]; 20| 68| int i; 21| | 22| | // Use 30 bits of u per word 23| 20.9k| for (i = 0; i < (NTRU_N - 1) / 4; i++) { ------------------ | | 5| 20.9k|#define NTRU_N 1229 ------------------ | Branch (23:17): [True: 20.8k, False: 68] ------------------ 24| 20.8k| s[4 * i + 0] = (u[15 * i + 0] << 2) + (u[15 * i + 1] << 10) + (u[15 * i + 2] << 18) + ((uint32_t) u[15 * i + 3] << 26); 25| 20.8k| s[4 * i + 1] = ((u[15 * i + 3] & 0xc0) >> 4) + (u[15 * i + 4] << 4) + (u[15 * i + 5] << 12) + (u[15 * i + 6] << 20) + ((uint32_t) u[15 * i + 7] << 28); 26| 20.8k| s[4 * i + 2] = ((u[15 * i + 7] & 0xf0) >> 2) + (u[15 * i + 8] << 6) + (u[15 * i + 9] << 14) + (u[15 * i + 10] << 22) + ((uint32_t) u[15 * i + 11] << 30); 27| 20.8k| s[4 * i + 3] = (u[15 * i + 11] & 0xfc) + (u[15 * i + 12] << 8) + (u[15 * i + 13] << 16) + ((uint32_t) u[15 * i + 14] << 24); 28| 20.8k| } 29| | 30| 17.4k| for (i = 0; i < NTRU_WEIGHT / 2; i++) { ------------------ | | 14| 17.4k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 17.4k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 17.4k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ | Branch (30:17): [True: 17.3k, False: 68] ------------------ 31| 17.3k| s[i] |= 1; 32| 17.3k| } 33| | 34| 17.4k| for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 68|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 68|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 68|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 17.4k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 17.4k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 17.4k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ | Branch (34:31): [True: 17.3k, False: 68] ------------------ 35| 17.3k| s[i] |= 2; 36| 17.3k| } 37| | 38| 68| PQCLEAN_NTRUHPS40961229_CLEAN_crypto_sort_int32(s, NTRU_N - 1); ------------------ | | 5| 68|#define NTRU_N 1229 ------------------ 39| | 40| 83.5k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 83.5k|#define NTRU_N 1229 ------------------ | Branch (40:17): [True: 83.5k, False: 68] ------------------ 41| 83.5k| r->coeffs[i] = ((uint16_t) (s[i] & 3)); 42| 83.5k| } 43| | 44| 68| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 68|#define NTRU_N 1229 ------------------ 45| 68|} PQCLEAN_NTRUHPS40961229_CLEAN_sample_iid: 18| 68|void PQCLEAN_NTRUHPS40961229_CLEAN_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 19| 68| int i; 20| | /* {0,1,...,255} -> {0,1,2}; Pr[0] = 86/256, Pr[1] = Pr[-1] = 85/256 */ 21| 83.5k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 83.5k|#define NTRU_N 1229 ------------------ | Branch (21:17): [True: 83.5k, False: 68] ------------------ 22| 83.5k| r->coeffs[i] = mod3(uniformbytes[i]); 23| 83.5k| } 24| | 25| 68| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 68|#define NTRU_N 1229 ------------------ 26| 68|} PQCLEAN_NTRUHPS4096821_AVX2_cmov: 4| 84|void PQCLEAN_NTRUHPS4096821_AVX2_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 84| size_t i; 6| | 7| 84| b = (~b + 1); 8| 2.77k| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 2.68k, False: 84] ------------------ 9| 2.68k| r[i] ^= b & (x[i] ^ r[i]); 10| 2.68k| } 11| 84|} PQCLEAN_NTRUHPS4096821_AVX2_crypto_sort_int32: 903| 504|void PQCLEAN_NTRUHPS4096821_AVX2_crypto_sort_int32(int32 *x, size_t n) { 904| 504| size_t q, i, j; 905| | 906| 504| if (n <= 8) { ------------------ | Branch (906:9): [True: 0, False: 504] ------------------ 907| 0| if (n == 8) { ------------------ | Branch (907:13): [True: 0, False: 0] ------------------ 908| 0| int32_MINMAX(&x[0], &x[1]); 909| 0| int32_MINMAX(&x[1], &x[2]); 910| 0| int32_MINMAX(&x[2], &x[3]); 911| 0| int32_MINMAX(&x[3], &x[4]); 912| 0| int32_MINMAX(&x[4], &x[5]); 913| 0| int32_MINMAX(&x[5], &x[6]); 914| 0| int32_MINMAX(&x[6], &x[7]); 915| 0| } 916| 0| if (n >= 7) { ------------------ | Branch (916:13): [True: 0, False: 0] ------------------ 917| 0| int32_MINMAX(&x[0], &x[1]); 918| 0| int32_MINMAX(&x[1], &x[2]); 919| 0| int32_MINMAX(&x[2], &x[3]); 920| 0| int32_MINMAX(&x[3], &x[4]); 921| 0| int32_MINMAX(&x[4], &x[5]); 922| 0| int32_MINMAX(&x[5], &x[6]); 923| 0| } 924| 0| if (n >= 6) { ------------------ | Branch (924:13): [True: 0, False: 0] ------------------ 925| 0| int32_MINMAX(&x[0], &x[1]); 926| 0| int32_MINMAX(&x[1], &x[2]); 927| 0| int32_MINMAX(&x[2], &x[3]); 928| 0| int32_MINMAX(&x[3], &x[4]); 929| 0| int32_MINMAX(&x[4], &x[5]); 930| 0| } 931| 0| if (n >= 5) { ------------------ | Branch (931:13): [True: 0, False: 0] ------------------ 932| 0| int32_MINMAX(&x[0], &x[1]); 933| 0| int32_MINMAX(&x[1], &x[2]); 934| 0| int32_MINMAX(&x[2], &x[3]); 935| 0| int32_MINMAX(&x[3], &x[4]); 936| 0| } 937| 0| if (n >= 4) { ------------------ | Branch (937:13): [True: 0, False: 0] ------------------ 938| 0| int32_MINMAX(&x[0], &x[1]); 939| 0| int32_MINMAX(&x[1], &x[2]); 940| 0| int32_MINMAX(&x[2], &x[3]); 941| 0| } 942| 0| if (n >= 3) { ------------------ | Branch (942:13): [True: 0, False: 0] ------------------ 943| 0| int32_MINMAX(&x[0], &x[1]); 944| 0| int32_MINMAX(&x[1], &x[2]); 945| 0| } 946| 0| if (n >= 2) { ------------------ | Branch (946:13): [True: 0, False: 0] ------------------ 947| 0| int32_MINMAX(&x[0], &x[1]); 948| 0| } 949| 0| return; 950| 0| } 951| | 952| 504| if (!(n & (n - 1))) { ------------------ | Branch (952:9): [True: 0, False: 504] ------------------ 953| 0| int32_sort_2power(x, n, 0); 954| 0| return; 955| 0| } 956| | 957| 504| q = 8; 958| 2.68k| while (q < n - q) { ------------------ | Branch (958:12): [True: 2.18k, False: 504] ------------------ 959| 2.18k| q += q; 960| 2.18k| } 961| | /* n > q >= 8 */ 962| | 963| 504| if (q <= 128) { /* n <= 256 */ ------------------ | Branch (963:9): [True: 168, False: 336] ------------------ 964| 168| int32x8 y[32]; 965| 840| for (i = q >> 3; i < q >> 2; ++i) { ------------------ | Branch (965:26): [True: 672, False: 168] ------------------ 966| 672| y[i] = _mm256_set1_epi32(0x7fffffff); 967| 672| } 968| 8.90k| for (i = 0; i < n; ++i) { ------------------ | Branch (968:21): [True: 8.73k, False: 168] ------------------ 969| 8.73k| ((int32 *) y)[i] = x[i]; 970| 8.73k| } 971| 168| int32_sort_2power((int32 *) y, 2 * q, 0); 972| 8.90k| for (i = 0; i < n; ++i) { ------------------ | Branch (972:21): [True: 8.73k, False: 168] ------------------ 973| 8.73k| x[i] = ((int32 *) y)[i]; 974| 8.73k| } 975| 168| return; 976| 168| } 977| | 978| 336| int32_sort_2power(x, q, 1); 979| 336| PQCLEAN_NTRUHPS4096821_AVX2_crypto_sort_int32(x + q, n - q); 980| | 981| 840| while (q >= 64) { ------------------ | Branch (981:12): [True: 504, False: 336] ------------------ 982| 504| q >>= 2; 983| 504| j = int32_threestages(x, n, q); 984| 504| minmax_vector(x + j, x + j + 4 * q, n - 4 * q - j); 985| 504| if (j + 4 * q <= n) { ------------------ | Branch (985:13): [True: 336, False: 168] ------------------ 986| 4.36k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (986:25): [True: 4.03k, False: 336] ------------------ 987| 4.03k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 4.03k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 988| 4.03k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 4.03k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 989| 4.03k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 4.03k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 990| 4.03k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 4.03k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 991| 4.03k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 4.03k| do { \ | | 16| 4.03k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 4.03k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 4.03k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 4.03k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 4.03k| (a) = c; \ | | 19| 4.03k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 4.03k] | | ------------------ ------------------ 992| 4.03k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 4.03k| do { \ | | 16| 4.03k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 4.03k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 4.03k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 4.03k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 4.03k| (a) = c; \ | | 19| 4.03k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 4.03k] | | ------------------ ------------------ 993| 4.03k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 4.03k| do { \ | | 16| 4.03k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 4.03k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 4.03k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 4.03k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 4.03k| (a) = c; \ | | 19| 4.03k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 4.03k] | | ------------------ ------------------ 994| 4.03k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 4.03k| do { \ | | 16| 4.03k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 4.03k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 4.03k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 4.03k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 4.03k| (a) = c; \ | | 19| 4.03k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 4.03k] | | ------------------ ------------------ 995| 4.03k| int32x8_store(&x[i], x0); ------------------ | | 10| 4.03k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 996| 4.03k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 4.03k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 997| 4.03k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 4.03k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 998| 4.03k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 4.03k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 999| 4.03k| } 1000| 336| j += 4 * q; 1001| 336| } 1002| 504| minmax_vector(x + j, x + j + 2 * q, n - 2 * q - j); 1003| 504| if (j + 2 * q <= n) { ------------------ | Branch (1003:13): [True: 336, False: 168] ------------------ 1004| 3.36k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (1004:25): [True: 3.02k, False: 336] ------------------ 1005| 3.02k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 3.02k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1006| 3.02k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 3.02k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1007| 3.02k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 3.02k| do { \ | | 16| 3.02k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.02k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.02k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.02k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.02k| (a) = c; \ | | 19| 3.02k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.02k] | | ------------------ ------------------ 1008| 3.02k| int32x8_store(&x[i], x0); ------------------ | | 10| 3.02k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1009| 3.02k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 3.02k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1010| 3.02k| } 1011| 336| j += 2 * q; 1012| 336| } 1013| 504| minmax_vector(x + j, x + j + q, n - q - j); 1014| 504| q >>= 1; 1015| 504| } 1016| 336| if (q == 32) { ------------------ | Branch (1016:9): [True: 168, False: 168] ------------------ 1017| 168| j = 0; 1018| 840| for (; j + 64 <= n; j += 64) { ------------------ | Branch (1018:16): [True: 672, False: 168] ------------------ 1019| 672| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 672|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1020| 672| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 672|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1021| 672| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 672|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1022| 672| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 672|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1023| 672| int32x8 x4 = int32x8_load(&x[j + 32]); ------------------ | | 9| 672|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1024| 672| int32x8 x5 = int32x8_load(&x[j + 40]); ------------------ | | 9| 672|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1025| 672| int32x8 x6 = int32x8_load(&x[j + 48]); ------------------ | | 9| 672|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1026| 672| int32x8 x7 = int32x8_load(&x[j + 56]); ------------------ | | 9| 672|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1027| 672| int32x8_MINMAX(x0, x4); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1028| 672| int32x8_MINMAX(x1, x5); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1029| 672| int32x8_MINMAX(x2, x6); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1030| 672| int32x8_MINMAX(x3, x7); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1031| 672| int32x8_MINMAX(x0, x2); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1032| 672| int32x8_MINMAX(x1, x3); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1033| 672| int32x8_MINMAX(x4, x6); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1034| 672| int32x8_MINMAX(x5, x7); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1035| 672| int32x8_MINMAX(x0, x1); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1036| 672| int32x8_MINMAX(x2, x3); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1037| 672| int32x8_MINMAX(x4, x5); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1038| 672| int32x8_MINMAX(x6, x7); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1039| 672| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1040| 672| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1041| 672| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1042| 672| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1043| 672| int32x8 a4 = _mm256_permute2x128_si256(x4, x5, 0x20); 1044| 672| int32x8 a5 = _mm256_permute2x128_si256(x4, x5, 0x31); 1045| 672| int32x8 a6 = _mm256_permute2x128_si256(x6, x7, 0x20); 1046| 672| int32x8 a7 = _mm256_permute2x128_si256(x6, x7, 0x31); 1047| 672| int32x8_MINMAX(a0, a1); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1048| 672| int32x8_MINMAX(a2, a3); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1049| 672| int32x8_MINMAX(a4, a5); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1050| 672| int32x8_MINMAX(a6, a7); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1051| 672| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1052| 672| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1053| 672| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1054| 672| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1055| 672| int32x8 b4 = _mm256_permute2x128_si256(a4, a5, 0x20); 1056| 672| int32x8 b5 = _mm256_permute2x128_si256(a4, a5, 0x31); 1057| 672| int32x8 b6 = _mm256_permute2x128_si256(a6, a7, 0x20); 1058| 672| int32x8 b7 = _mm256_permute2x128_si256(a6, a7, 0x31); 1059| 672| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1060| 672| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1061| 672| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1062| 672| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1063| 672| int32x8 c4 = _mm256_unpacklo_epi64(b4, b5); 1064| 672| int32x8 c5 = _mm256_unpackhi_epi64(b4, b5); 1065| 672| int32x8 c6 = _mm256_unpacklo_epi64(b6, b7); 1066| 672| int32x8 c7 = _mm256_unpackhi_epi64(b6, b7); 1067| 672| int32x8_MINMAX(c0, c1); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1068| 672| int32x8_MINMAX(c2, c3); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1069| 672| int32x8_MINMAX(c4, c5); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1070| 672| int32x8_MINMAX(c6, c7); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1071| 672| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1072| 672| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1073| 672| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1074| 672| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1075| 672| int32x8 d4 = _mm256_unpacklo_epi32(c4, c5); 1076| 672| int32x8 d5 = _mm256_unpackhi_epi32(c4, c5); 1077| 672| int32x8 d6 = _mm256_unpacklo_epi32(c6, c7); 1078| 672| int32x8 d7 = _mm256_unpackhi_epi32(c6, c7); 1079| 672| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1080| 672| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1081| 672| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1082| 672| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1083| 672| int32x8 e4 = _mm256_unpacklo_epi64(d4, d5); 1084| 672| int32x8 e5 = _mm256_unpackhi_epi64(d4, d5); 1085| 672| int32x8 e6 = _mm256_unpacklo_epi64(d6, d7); 1086| 672| int32x8 e7 = _mm256_unpackhi_epi64(d6, d7); 1087| 672| int32x8_MINMAX(e0, e1); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1088| 672| int32x8_MINMAX(e2, e3); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1089| 672| int32x8_MINMAX(e4, e5); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1090| 672| int32x8_MINMAX(e6, e7); ------------------ | | 15| 672| do { \ | | 16| 672| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 672|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 672| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 672|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 672| (a) = c; \ | | 19| 672| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 672] | | ------------------ ------------------ 1091| 672| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1092| 672| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1093| 672| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1094| 672| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1095| 672| int32x8 f4 = _mm256_unpacklo_epi32(e4, e5); 1096| 672| int32x8 f5 = _mm256_unpackhi_epi32(e4, e5); 1097| 672| int32x8 f6 = _mm256_unpacklo_epi32(e6, e7); 1098| 672| int32x8 f7 = _mm256_unpackhi_epi32(e6, e7); 1099| 672| int32x8_store(&x[j], f0); ------------------ | | 10| 672|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1100| 672| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 672|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1101| 672| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 672|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1102| 672| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 672|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1103| 672| int32x8_store(&x[j + 32], f4); ------------------ | | 10| 672|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1104| 672| int32x8_store(&x[j + 40], f5); ------------------ | | 10| 672|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1105| 672| int32x8_store(&x[j + 48], f6); ------------------ | | 10| 672|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1106| 672| int32x8_store(&x[j + 56], f7); ------------------ | | 10| 672|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1107| 672| } 1108| 168| minmax_vector(x + j, x + j + 32, n - 32 - j); 1109| 168| goto continue16; 1110| 168| } 1111| 168| if (q == 16) { ------------------ | Branch (1111:9): [True: 0, False: 168] ------------------ 1112| 0| j = 0; 1113| 168|continue16: 1114| 336| for (; j + 32 <= n; j += 32) { ------------------ | Branch (1114:16): [True: 168, False: 168] ------------------ 1115| 168| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 168|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1116| 168| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 168|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1117| 168| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 168|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1118| 168| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 168|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1119| 168| int32x8_MINMAX(x0, x2); ------------------ | | 15| 168| do { \ | | 16| 168| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 168|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 168| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 168|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 168| (a) = c; \ | | 19| 168| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 168] | | ------------------ ------------------ 1120| 168| int32x8_MINMAX(x1, x3); ------------------ | | 15| 168| do { \ | | 16| 168| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 168|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 168| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 168|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 168| (a) = c; \ | | 19| 168| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 168] | | ------------------ ------------------ 1121| 168| int32x8_MINMAX(x0, x1); ------------------ | | 15| 168| do { \ | | 16| 168| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 168|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 168| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 168|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 168| (a) = c; \ | | 19| 168| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 168] | | ------------------ ------------------ 1122| 168| int32x8_MINMAX(x2, x3); ------------------ | | 15| 168| do { \ | | 16| 168| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 168|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 168| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 168|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 168| (a) = c; \ | | 19| 168| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 168] | | ------------------ ------------------ 1123| 168| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1124| 168| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1125| 168| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1126| 168| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1127| 168| int32x8_MINMAX(a0, a1); ------------------ | | 15| 168| do { \ | | 16| 168| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 168|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 168| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 168|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 168| (a) = c; \ | | 19| 168| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 168] | | ------------------ ------------------ 1128| 168| int32x8_MINMAX(a2, a3); ------------------ | | 15| 168| do { \ | | 16| 168| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 168|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 168| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 168|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 168| (a) = c; \ | | 19| 168| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 168] | | ------------------ ------------------ 1129| 168| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1130| 168| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1131| 168| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1132| 168| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1133| 168| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1134| 168| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1135| 168| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1136| 168| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1137| 168| int32x8_MINMAX(c0, c1); ------------------ | | 15| 168| do { \ | | 16| 168| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 168|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 168| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 168|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 168| (a) = c; \ | | 19| 168| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 168] | | ------------------ ------------------ 1138| 168| int32x8_MINMAX(c2, c3); ------------------ | | 15| 168| do { \ | | 16| 168| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 168|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 168| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 168|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 168| (a) = c; \ | | 19| 168| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 168] | | ------------------ ------------------ 1139| 168| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1140| 168| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1141| 168| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1142| 168| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1143| 168| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1144| 168| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1145| 168| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1146| 168| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1147| 168| int32x8_MINMAX(e0, e1); ------------------ | | 15| 168| do { \ | | 16| 168| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 168|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 168| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 168|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 168| (a) = c; \ | | 19| 168| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 168] | | ------------------ ------------------ 1148| 168| int32x8_MINMAX(e2, e3); ------------------ | | 15| 168| do { \ | | 16| 168| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 168|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 168| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 168|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 168| (a) = c; \ | | 19| 168| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 168] | | ------------------ ------------------ 1149| 168| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1150| 168| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1151| 168| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1152| 168| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1153| 168| int32x8_store(&x[j], f0); ------------------ | | 10| 168|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1154| 168| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 168|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1155| 168| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 168|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1156| 168| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 168|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1157| 168| } 1158| 168| minmax_vector(x + j, x + j + 16, n - 16 - j); 1159| 168| goto continue8; 1160| 0| } 1161| | /* q == 8 */ 1162| 168| j = 0; 1163| 336|continue8: 1164| 9.07k| for (; j + 16 <= n; j += 16) { ------------------ | Branch (1164:12): [True: 8.73k, False: 336] ------------------ 1165| 8.73k| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 8.73k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1166| 8.73k| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 8.73k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1167| 8.73k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 8.73k| do { \ | | 16| 8.73k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 8.73k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 8.73k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 8.73k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 8.73k| (a) = c; \ | | 19| 8.73k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 8.73k] | | ------------------ ------------------ 1168| 8.73k| int32x8_store(&x[j], x0); ------------------ | | 10| 8.73k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1169| 8.73k| int32x8_store(&x[j + 8], x1); ------------------ | | 10| 8.73k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1170| 8.73k| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); /* x0123y0123 */ 1171| 8.73k| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); /* x4567y4567 */ 1172| 8.73k| int32x8_MINMAX(a0, a1); ------------------ | | 15| 8.73k| do { \ | | 16| 8.73k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 8.73k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 8.73k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 8.73k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 8.73k| (a) = c; \ | | 19| 8.73k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 8.73k] | | ------------------ ------------------ 1173| 8.73k| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); /* x01234567 */ 1174| 8.73k| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); /* y01234567 */ 1175| 8.73k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); /* x01y01x45y45 */ 1176| 8.73k| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); /* x23y23x67y67 */ 1177| 8.73k| int32x8_MINMAX(c0, c1); ------------------ | | 15| 8.73k| do { \ | | 16| 8.73k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 8.73k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 8.73k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 8.73k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 8.73k| (a) = c; \ | | 19| 8.73k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 8.73k] | | ------------------ ------------------ 1178| 8.73k| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); /* x02x13x46x57 */ 1179| 8.73k| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); /* y02y13y46y57 */ 1180| 8.73k| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); /* x02y02x46y46 */ 1181| 8.73k| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); /* x13y13x57y57 */ 1182| 8.73k| int32x8_MINMAX(e0, e1); ------------------ | | 15| 8.73k| do { \ | | 16| 8.73k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 8.73k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 8.73k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 8.73k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 8.73k| (a) = c; \ | | 19| 8.73k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 8.73k] | | ------------------ ------------------ 1183| 8.73k| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); /* x01234567 */ 1184| 8.73k| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); /* y01234567 */ 1185| 8.73k| int32x8_store(&x[j], f0); ------------------ | | 10| 8.73k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1186| 8.73k| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 8.73k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1187| 8.73k| } 1188| 336| minmax_vector(x + j, x + j + 8, n - 8 - j); 1189| 336| if (j + 8 <= n) { ------------------ | Branch (1189:9): [True: 0, False: 336] ------------------ 1190| 0| int32_MINMAX(&x[j], &x[j + 4]); 1191| 0| int32_MINMAX(&x[j + 1], &x[j + 5]); 1192| 0| int32_MINMAX(&x[j + 2], &x[j + 6]); 1193| 0| int32_MINMAX(&x[j + 3], &x[j + 7]); 1194| 0| int32_MINMAX(&x[j], &x[j + 2]); 1195| 0| int32_MINMAX(&x[j + 1], &x[j + 3]); 1196| 0| int32_MINMAX(&x[j], &x[j + 1]); 1197| 0| int32_MINMAX(&x[j + 2], &x[j + 3]); 1198| 0| int32_MINMAX(&x[j + 4], &x[j + 6]); 1199| 0| int32_MINMAX(&x[j + 5], &x[j + 7]); 1200| 0| int32_MINMAX(&x[j + 4], &x[j + 5]); 1201| 0| int32_MINMAX(&x[j + 6], &x[j + 7]); 1202| 0| j += 8; 1203| 0| } 1204| 336| minmax_vector(x + j, x + j + 4, n - 4 - j); 1205| 336| if (j + 4 <= n) { ------------------ | Branch (1205:9): [True: 336, False: 0] ------------------ 1206| 336| int32_MINMAX(&x[j], &x[j + 2]); 1207| 336| int32_MINMAX(&x[j + 1], &x[j + 3]); 1208| 336| int32_MINMAX(&x[j], &x[j + 1]); 1209| 336| int32_MINMAX(&x[j + 2], &x[j + 3]); 1210| 336| j += 4; 1211| 336| } 1212| 336| if (j + 3 <= n) { ------------------ | Branch (1212:9): [True: 0, False: 336] ------------------ 1213| 0| int32_MINMAX(&x[j], &x[j + 2]); 1214| 0| } 1215| 336| if (j + 2 <= n) { ------------------ | Branch (1215:9): [True: 0, False: 336] ------------------ 1216| 0| int32_MINMAX(&x[j], &x[j + 1]); 1217| 0| } 1218| 336|} PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_keypair: 10| 84|int PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 84| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 84| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 84|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 22| 84|#define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 84|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 84|#define NTRU_N 821 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 84|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 84|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 14| 84| PQCLEAN_NTRUHPS4096821_AVX2_owcpa_keypair(pk, sk, seed); 15| | 16| 84| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 84|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 30| 84|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 84|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 84|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 84|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 84|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 84|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 84|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 84|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 17| 84|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 84| return 0; 19| 84|} PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_enc: 21| 84|int PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 84| poly r, m; 23| 84| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 84| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 84| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 84|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 23| 84|#define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 84|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 84|#define NTRU_N 821 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 84|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 84|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 84| PQCLEAN_NTRUHPS4096821_AVX2_sample_rm(&r, &m, rm_seed); 29| | 30| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(rm, &r); 31| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 26| 84|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 84|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 84|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 32| 84| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 84|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 84|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 84|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 84|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 84|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(&r); 35| 84| PQCLEAN_NTRUHPS4096821_AVX2_owcpa_enc(c, &r, &m, pk); 36| | 37| 84| return 0; 38| 84|} PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_dec: 40| 84|int PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 84| int i, fail; 42| 84| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 84| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 84| fail = PQCLEAN_NTRUHPS4096821_AVX2_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHPS4096821_AVX2_owcpa_dec for details. */ 48| | 49| 84| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 84|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 84|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 84|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 84|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 84|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 2.77k| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 17| 2.77k|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 2.68k, False: 84] ------------------ 53| 2.68k| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 30| 2.68k|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 2.68k|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 2.68k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 2.68k|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 2.68k|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 2.68k|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 2.68k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 2.68k|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 2.68k| } 55| 103k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 35| 103k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 103k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 103k|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 103k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 103k|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 103k, False: 84] ------------------ 56| 103k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 17| 103k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 103k| } 58| 84| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 84|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 17| 84|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 35| 84|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 84|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 84|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 84|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 84|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 84| PQCLEAN_NTRUHPS4096821_AVX2_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 18| 84|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 84| return 0; 63| 84|} PQCLEAN_NTRUHPS4096821_AVX2_owcpa_keypair: 62| 84| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 63| 84| int i; 64| | 65| 84| poly x1, x2, x3, x4, x5; 66| | 67| 84| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 68| 84| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 69| 84| poly *invh = &x3, *h = &x3; 70| | 71| 84| PQCLEAN_NTRUHPS4096821_AVX2_sample_fg(f, g, seed); 72| | 73| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_inv(invf_mod3, f); 74| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(sk, f); 75| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 26| 84|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 84|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 84|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 76| | 77| | /* Lift coeffs of f and g from Z_p to Z_q */ 78| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(f); 79| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(g); 80| | 81| | 82| | /* g = 3*g */ 83| 69.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 69.0k|#define NTRU_N 821 ------------------ | Branch (83:17): [True: 68.9k, False: 84] ------------------ 84| 68.9k| g->coeffs[i] = 3 * g->coeffs[i]; 85| 68.9k| } 86| | 87| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(gf, g, f); 88| | 89| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_inv(invgf, gf); 90| | 91| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(tmp, invgf, f); 92| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_mul(invh, tmp, f); 93| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 26| 84|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 84|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 84|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 94| | 95| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(tmp, invgf, g); 96| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(h, tmp, g); 97| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_tobytes(pk, h); 98| 84|} PQCLEAN_NTRUHPS4096821_AVX2_owcpa_enc: 104| 84| const unsigned char *pk) { 105| 84| int i; 106| 84| poly x1, x2; 107| 84| poly *h = &x1, *liftm = &x1; 108| 84| poly *ct = &x2; 109| | 110| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_frombytes(h, pk); 111| | 112| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(ct, r, h); 113| | 114| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_lift(liftm, m); 115| 69.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 69.0k|#define NTRU_N 821 ------------------ | Branch (115:17): [True: 68.9k, False: 84] ------------------ 116| 68.9k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 117| 68.9k| } 118| | 119| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_tobytes(c, ct); 120| 84|} PQCLEAN_NTRUHPS4096821_AVX2_owcpa_dec: 124| 84| const unsigned char *secretkey) { 125| 84| int i; 126| 84| int fail; 127| 84| poly x1, x2, x3, x4; 128| | 129| 84| poly *c = &x1, *f = &x2, *cf = &x3; 130| 84| poly *mf = &x2, *finv3 = &x3, *m = &x4; 131| 84| poly *liftm = &x2, *invh = &x3, *r = &x4; 132| 84| poly *b = &x1; 133| | 134| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_frombytes(c, ciphertext); 135| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_frombytes(f, secretkey); 136| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(f); 137| | 138| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(cf, c, f); 139| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_to_S3(mf, cf); 140| | 141| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 84|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 84|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 84|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 142| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_mul(m, mf, finv3); 143| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 26| 84|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 84|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 84|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 144| | 145| 84| fail = 0; 146| | 147| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 148| 84| fail |= owcpa_check_ciphertext(ciphertext); 149| | 150| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 151| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 152| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 153| | /* (m can take any value in S3 in NTRU_HRSS) */ 154| 84| fail |= owcpa_check_m(m); 155| | 156| | /* b = c - Lift(m) mod (q, x^n - 1) */ 157| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_lift(liftm, m); 158| 69.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 69.0k|#define NTRU_N 821 ------------------ | Branch (158:17): [True: 68.9k, False: 84] ------------------ 159| 68.9k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 160| 68.9k| } 161| | 162| | /* r = b / h mod (q, Phi_n) */ 163| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 84|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 84|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 84|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 164| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_mul(r, b, invh); 165| | 166| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 167| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 168| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 169| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 170| | /* where r gets a final reduction modulo p. */ 171| | /* We need this change to use Proposition 1 of [Sch18]. */ 172| | 173| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 174| | /* if and only if fail==0 after the following call to owcpa_check_r */ 175| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 176| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 177| 84| fail |= owcpa_check_r(r); 178| | 179| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_trinary_Zq_to_Z3(r); 180| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(rm, r); 181| | 182| 84| return fail; 183| 84|} PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes: 3| 504|void PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 504| int i; 5| 504| unsigned char c; 6| | 7| 83.1k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 83.1k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 83.1k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (7:17): [True: 82.6k, False: 504] ------------------ 8| 82.6k| c = a->coeffs[5 * i + 4] & 255; 9| 82.6k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 10| 82.6k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 11| 82.6k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 12| 82.6k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 13| 82.6k| msg[i] = c; 14| 82.6k| } 15| 504|} PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_frombytes: 17| 168|void PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 18| 168| int i; 19| 168| unsigned char c; 20| | 21| 27.7k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 27.7k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 27.7k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (21:17): [True: 27.5k, False: 168] ------------------ 22| 27.5k| c = msg[i]; 23| 27.5k| r->coeffs[5 * i + 0] = c; 24| 27.5k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 25| 27.5k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 26| 27.5k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 27| 27.5k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 28| 27.5k| } 29| 168| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 168|#define NTRU_N 821 ------------------ 30| 168| PQCLEAN_NTRUHPS4096821_AVX2_poly_mod_3_Phi_n(r); 31| 168|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_tobytes: 4| 252|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_tobytes(unsigned char *r, const poly *a) { 5| 252| int i; 6| | 7| 103k| for (i = 0; i < NTRU_PACK_DEG / 2; i++) { ------------------ | | 25| 103k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 103k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (7:17): [True: 103k, False: 252] ------------------ 8| 103k| r[3 * i + 0] = (unsigned char) ( MODQ(a->coeffs[2 * i + 0]) & 0xff); ------------------ | | 9| 103k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 103k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 103k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 9| 103k| r[3 * i + 1] = (unsigned char) ((MODQ(a->coeffs[2 * i + 0]) >> 8) | ((MODQ(a->coeffs[2 * i + 1]) & 0x0f) << 4)); ------------------ | | 9| 103k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 103k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 103k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ r[3 * i + 1] = (unsigned char) ((MODQ(a->coeffs[2 * i + 0]) >> 8) | ((MODQ(a->coeffs[2 * i + 1]) & 0x0f) << 4)); ------------------ | | 9| 103k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 103k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 103k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 10| 103k| r[3 * i + 2] = (unsigned char) ((MODQ(a->coeffs[2 * i + 1]) >> 4)); ------------------ | | 9| 103k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 103k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 103k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 11| 103k| } 12| 252|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_frombytes: 14| 252|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_frombytes(poly *r, const unsigned char *a) { 15| 252| int i; 16| 103k| for (i = 0; i < NTRU_PACK_DEG / 2; i++) { ------------------ | | 25| 103k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 103k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (16:17): [True: 103k, False: 252] ------------------ 17| 103k| r->coeffs[2 * i + 0] = (a[3 * i + 0] >> 0) | (((uint16_t)a[3 * i + 1] & 0x0f) << 8); 18| 103k| r->coeffs[2 * i + 1] = (a[3 * i + 1] >> 4) | (((uint16_t)a[3 * i + 2] & 0xff) << 4); 19| 103k| } 20| 252| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 252|#define NTRU_N 821 ------------------ 21| 252|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_tobytes: 23| 168|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 24| 168| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_tobytes(r, a); 25| 168|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_frombytes: 27| 168|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 28| 168| int i; 29| 168| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_frombytes(r, a); 30| | 31| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 32| 168| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 168|#define NTRU_N 821 ------------------ 33| 137k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 25| 137k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 137k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (33:17): [True: 137k, False: 168] ------------------ 34| 137k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 137k|#define NTRU_N 821 ------------------ 35| 137k| } 36| 168|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq: 4| 504|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(poly *r) { 5| 504| int i; 6| 414k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 414k|#define NTRU_N 821 ------------------ | Branch (6:17): [True: 413k, False: 504] ------------------ 7| 413k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 413k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 413k|#define NTRU_LOGQ 12 | | ------------------ ------------------ 8| 413k| } 9| 504|} PQCLEAN_NTRUHPS4096821_AVX2_poly_trinary_Zq_to_Z3: 12| 84|void PQCLEAN_NTRUHPS4096821_AVX2_poly_trinary_Zq_to_Z3(poly *r) { 13| 84| int i; 14| 69.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 69.0k|#define NTRU_N 821 ------------------ | Branch (14:17): [True: 68.9k, False: 84] ------------------ 15| 68.9k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 68.9k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 68.9k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 68.9k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 16| 68.9k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 68.9k|#define NTRU_LOGQ 12 ------------------ 17| 68.9k| } 18| 84|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_mul: 20| 168|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 168| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(r, a, b); 22| 168| PQCLEAN_NTRUHPS4096821_AVX2_poly_mod_q_Phi_n(r); 23| 168|} PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_mul: 25| 84|void PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 84| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(r, a, b); 32| 69.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 69.0k|#define NTRU_N 821 ------------------ | Branch (32:17): [True: 68.9k, False: 84] ------------------ 33| 68.9k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 68.9k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 68.9k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 68.9k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 34| 68.9k| } 35| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_mod_3_Phi_n(r); 36| 84|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_inv: 71| 84|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_inv(poly *r, const poly *a) { 72| 84| poly ai2; 73| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv(&ai2, a); 74| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 84|} poly.c:PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv_to_Rq_inv: 38| 84|static void PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 84| int i; 41| 84| poly b, c; 42| 84| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 69.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 69.0k|#define NTRU_N 821 ------------------ | Branch (46:17): [True: 68.9k, False: 84] ------------------ 47| 68.9k| b.coeffs[i] = -(a->coeffs[i]); 48| 68.9k| } 49| | 50| 69.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 69.0k|#define NTRU_N 821 ------------------ | Branch (50:17): [True: 68.9k, False: 84] ------------------ 51| 68.9k| r->coeffs[i] = ai->coeffs[i]; 52| 68.9k| } 53| | 54| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&c, r, &b); 55| 84| c.coeffs[0] += 2; // c = 2 - a*ai 56| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&c, &s, &b); 59| 84| c.coeffs[0] += 2; // c = 2 - a*s 60| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&c, r, &b); 63| 84| c.coeffs[0] += 2; // c = 2 - a*r 64| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&c, &s, &b); 67| 84| c.coeffs[0] += 2; // c = 2 - a*s 68| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 69| 84|} PQCLEAN_NTRUHPS4096821_AVX2_poly_lift: 3| 168|void PQCLEAN_NTRUHPS4096821_AVX2_poly_lift(poly *r, const poly *a) { 4| 168| int i; 5| 138k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 138k|#define NTRU_N 821 ------------------ | Branch (5:17): [True: 137k, False: 168] ------------------ 6| 137k| r->coeffs[i] = a->coeffs[i]; 7| 137k| } 8| 168| PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(r); 9| 168|} PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_tobytes: 6| 84|void PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_tobytes(unsigned char *out, const poly *a) { 7| 84| int i, j, k; 8| 1.42k| for (i = 0; i < 16; i++) { ------------------ | Branch (8:17): [True: 1.34k, False: 84] ------------------ 9| 12.0k| for (k = 0; k < 8; k++) { ------------------ | Branch (9:21): [True: 10.7k, False: 1.34k] ------------------ 10| 10.7k| out[i * 8 + k] = 0; 11| 96.7k| for (j = 0; j < 8; j++) { ------------------ | Branch (11:25): [True: 86.0k, False: 10.7k] ------------------ 12| 86.0k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 86.0k|#define NTRU_N 821 ------------------ | Branch (12:21): [True: 68.9k, False: 17.0k] ------------------ 13| 68.9k| out[i * 8 + k] |= (a->coeffs[(i * 8 + k) * 8 + j] & 1) << j; 14| 68.9k| } 15| 86.0k| } 16| 10.7k| } 17| 1.34k| } 18| 84|} PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_frombytes: 20| 84|void PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_frombytes(poly *a, const unsigned char *in) { 21| 84| int i, j, k; 22| 1.42k| for (i = 0; i < 16; i++) { ------------------ | Branch (22:17): [True: 1.34k, False: 84] ------------------ 23| 12.0k| for (k = 0; k < 8; k++) { ------------------ | Branch (23:21): [True: 10.7k, False: 1.34k] ------------------ 24| 96.7k| for (j = 0; j < 8; j++) { ------------------ | Branch (24:25): [True: 86.0k, False: 10.7k] ------------------ 25| 86.0k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 86.0k|#define NTRU_N 821 ------------------ | Branch (25:21): [True: 68.9k, False: 17.0k] ------------------ 26| 68.9k| a->coeffs[(i * 8 + k) * 8 + j] = (in[i * 8 + k] >> j) & 1; 27| 68.9k| } 28| 86.0k| } 29| 10.7k| } 30| 1.34k| } 31| 84|} PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv: 48| 84|void PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv(poly *r, const poly *a) { 49| 84| union { 50| 84| unsigned char s[128]; 51| 84| __m256i s_x32[4]; 52| 84| } squares[13]; 53| 84|#define s(x) squares[(x)].s 54| | 55| | // This relies on the following addition chain: 56| | // 1, 2, 3, 6, 12, 24, 48, 51, 102, 204, 408, 816, 819 57| | 58| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_tobytes(s(0), a); // TODO alignment ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 59| | 60| 84| PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(1), s(0)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(1), s(0)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 61| 84| _poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 62| 84| PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(2), s(1)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(2), s(1)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 63| 84| _poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 64| 84| PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(3), s(2)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(3), s(2)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 65| 84| _poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 66| 84| PQCLEAN_NTRUHPS4096821_AVX2_square_6_821(s(4), s(3)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_6_821(s(4), s(3)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 67| 84| _poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 68| 84| PQCLEAN_NTRUHPS4096821_AVX2_square_12_821(s(5), s(4)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_12_821(s(5), s(4)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 69| 84| _poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 70| 84| PQCLEAN_NTRUHPS4096821_AVX2_square_24_821(s(6), s(5)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_24_821(s(6), s(5)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 71| 84| _poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 72| 84| PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(7), s(6)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(7), s(6)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 73| 84| _poly_R2_mul(s(7), s(7), s(2)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(7), s(7), s(2)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(7), s(7), s(2)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 74| 84| PQCLEAN_NTRUHPS4096821_AVX2_square_51_821(s(8), s(7)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_51_821(s(8), s(7)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 75| 84| _poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 76| 84| PQCLEAN_NTRUHPS4096821_AVX2_square_102_821(s(9), s(8)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_102_821(s(9), s(8)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 77| 84| _poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 78| 84| PQCLEAN_NTRUHPS4096821_AVX2_square_204_821(s(10), s(9)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_204_821(s(10), s(9)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 79| 84| _poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 80| 84| PQCLEAN_NTRUHPS4096821_AVX2_square_408_821(s(11), s(10)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_408_821(s(11), s(10)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 81| 84| _poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 82| 84| PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(12), s(11)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(12), s(11)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 83| 84| _poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 84| 84| PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(0), s(12)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(0), s(12)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 85| | 86| | 87| 84| PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_frombytes(r, s(0)); ------------------ | | 53| 84|#define s(x) squares[(x)].s ------------------ 88| 84|#undef s 89| 84|} poly_r2_inv.c:_poly_R2_mul: 34| 1.00k|static void _poly_R2_mul(unsigned char r[128], unsigned char a[128], unsigned char b[128]) { 35| | // TODO: Try to avoid copying input 36| 1.00k| int i; 37| 1.00k| union { 38| 1.00k| unsigned char b[128]; 39| 1.00k| __m256i b_x32[4]; 40| 1.00k| } rt; 41| | 42| 1.00k| PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_mul(rt.b, a, b); 43| 130k| for (i = 0; i < 128; i++) { ------------------ | Branch (43:17): [True: 129k, False: 1.00k] ------------------ 44| 129k| r[i] = rt.b[i]; 45| 129k| } 46| 1.00k|} PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_inv: 661| 84|void PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_inv(poly *r_out, const poly *a) { 662| 84| const unsigned char *in = (void *) a; 663| 84| unsigned char *out = (void *) r_out; 664| | 665| 84| small input[ppad]; 666| 84| small output[ppad]; 667| 84| int i; 668| | 669| | /* XXX: obviously input/output format should be packed into bytes */ 670| | 671| 68.9k| for (i = 0; i < p; ++i) { ------------------ | | 7| 68.9k|#define p 820 ------------------ | Branch (671:17): [True: 68.8k, False: 84] ------------------ 672| 68.8k| small x = in[2 * i] & 3; /* 0 1 2 3 */ 673| 68.8k| x += 1; /* 0 1 2 3 4 5 6, offset by 1 */ 674| 68.8k| x &= (x - 3) >> 5; /* 0 1 2, offset by 1 */ 675| 68.8k| input[i] = x - 1; 676| 68.8k| } 677| | /* XXX: merge with vec256_init */ 678| | 679| 84| __poly_S3_inv((unsigned char *)output, (unsigned char *)input); 680| | 681| 68.9k| for (i = 0; i < p; ++i) { ------------------ | | 7| 68.9k|#define p 820 ------------------ | Branch (681:17): [True: 68.8k, False: 84] ------------------ 682| 68.8k| out[2 * i] = (3 & output[i]) ^ ((3 & output[i]) >> 1); 683| 68.8k| out[2 * i + 1] = 0; 684| 68.8k| } 685| 84|} poly_s3_inv.c:vec256_divx_4: 302| 146k|static inline void vec256_divx_4(vec256 *f) { 303| 146k| vec256 f0 = f[0]; 304| 146k| vec256 f1 = f[1]; 305| 146k| vec256 f2 = f[2]; 306| 146k| vec256 f3 = f[3]; 307| | 308| 146k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 309| 146k| unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1)); 310| 146k| unsigned long long low2 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f2)); 311| 146k| unsigned long long low3 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f3)); 312| | 313| 146k| low0 = (low0 >> 1) | (low1 << 63); 314| 146k| low1 = (low1 >> 1) | (low2 << 63); 315| 146k| low2 = (low2 >> 1) | (low3 << 63); 316| 146k| low3 = low3 >> 1; 317| | 318| 146k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 319| 146k| f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3); 320| 146k| f2 = _mm256_blend_epi32(f2, _mm256_set_epi64x(0, 0, 0, low2), 0x3); 321| 146k| f3 = _mm256_blend_epi32(f3, _mm256_set_epi64x(0, 0, 0, low3), 0x3); 322| | 323| 146k| f[0] = _mm256_permute4x64_epi64(f0, 0x39); 324| 146k| f[1] = _mm256_permute4x64_epi64(f1, 0x39); 325| 146k| f[2] = _mm256_permute4x64_epi64(f2, 0x39); 326| | f[3] = _mm256_permute4x64_epi64(f3, 0x39); 327| 146k|} poly_s3_inv.c:vec256_timesx_4: 380| 146k|static inline void vec256_timesx_4(vec256 *f) { 381| 146k| vec256 f0 = _mm256_permute4x64_epi64(f[0], 0x93); 382| 146k| vec256 f1 = _mm256_permute4x64_epi64(f[1], 0x93); 383| 146k| vec256 f2 = _mm256_permute4x64_epi64(f[2], 0x93); 384| 146k| vec256 f3 = _mm256_permute4x64_epi64(f[3], 0x93); 385| | 386| 146k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 387| 146k| unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1)); 388| 146k| unsigned long long low2 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f2)); 389| 146k| unsigned long long low3 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f3)); 390| | 391| 146k| low3 = (low3 << 1) | (low2 >> 63); 392| 146k| low2 = (low2 << 1) | (low1 >> 63); 393| 146k| low1 = (low1 << 1) | (low0 >> 63); 394| 146k| low0 = low0 << 1; 395| | 396| 146k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 397| 146k| f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3); 398| 146k| f2 = _mm256_blend_epi32(f2, _mm256_set_epi64x(0, 0, 0, low2), 0x3); 399| 146k| f3 = _mm256_blend_epi32(f3, _mm256_set_epi64x(0, 0, 0, low3), 0x3); 400| | 401| 146k| f[0] = f0; 402| 146k| f[1] = f1; 403| 146k| f[2] = f2; 404| 146k| f[3] = f3; 405| 146k|} PQCLEAN_NTRUHPS4096821_AVX2_sample_fg: 3| 84|void PQCLEAN_NTRUHPS4096821_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| | 5| 84| PQCLEAN_NTRUHPS4096821_AVX2_sample_iid(f, uniformbytes); 6| 84| PQCLEAN_NTRUHPS4096821_AVX2_sample_fixed_type(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 84|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 84|#define NTRU_N 821 | | ------------------ ------------------ 7| 84|} PQCLEAN_NTRUHPS4096821_AVX2_sample_rm: 9| 84|void PQCLEAN_NTRUHPS4096821_AVX2_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| | 11| 84| PQCLEAN_NTRUHPS4096821_AVX2_sample_iid(r, uniformbytes); 12| 84| PQCLEAN_NTRUHPS4096821_AVX2_sample_fixed_type(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 84|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 84|#define NTRU_N 821 | | ------------------ ------------------ 13| 84|} PQCLEAN_NTRUHPS4096821_AVX2_sample_fixed_type: 16| 168|void PQCLEAN_NTRUHPS4096821_AVX2_sample_fixed_type(poly *r, const unsigned char u[NTRU_SAMPLE_FT_BYTES]) { 17| | // Assumes NTRU_SAMPLE_FT_BYTES = ceil(30*(n-1)/8) 18| | 19| 168| int32_t s[NTRU_N - 1]; 20| 168| int i; 21| | 22| | // Use 30 bits of u per word 23| 34.6k| for (i = 0; i < (NTRU_N - 1) / 4; i++) { ------------------ | | 5| 34.6k|#define NTRU_N 821 ------------------ | Branch (23:17): [True: 34.4k, False: 168] ------------------ 24| 34.4k| s[4 * i + 0] = (u[15 * i + 0] << 2) + (u[15 * i + 1] << 10) + (u[15 * i + 2] << 18) + ((uint32_t) u[15 * i + 3] << 26); 25| 34.4k| s[4 * i + 1] = ((u[15 * i + 3] & 0xc0) >> 4) + (u[15 * i + 4] << 4) + (u[15 * i + 5] << 12) + (u[15 * i + 6] << 20) + ((uint32_t) u[15 * i + 7] << 28); 26| 34.4k| s[4 * i + 2] = ((u[15 * i + 7] & 0xf0) >> 2) + (u[15 * i + 8] << 6) + (u[15 * i + 9] << 14) + (u[15 * i + 10] << 22) + ((uint32_t) u[15 * i + 11] << 30); 27| 34.4k| s[4 * i + 3] = (u[15 * i + 11] & 0xfc) + (u[15 * i + 12] << 8) + (u[15 * i + 13] << 16) + ((uint32_t) u[15 * i + 14] << 24); 28| 34.4k| } 29| | 30| 43.0k| for (i = 0; i < NTRU_WEIGHT / 2; i++) { ------------------ | | 14| 43.0k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 43.0k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 43.0k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ | Branch (30:17): [True: 42.8k, False: 168] ------------------ 31| 42.8k| s[i] |= 1; 32| 42.8k| } 33| | 34| 43.0k| for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 168|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 168|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 168|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 43.0k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 43.0k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 43.0k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ | Branch (34:31): [True: 42.8k, False: 168] ------------------ 35| 42.8k| s[i] |= 2; 36| 42.8k| } 37| | 38| 168| PQCLEAN_NTRUHPS4096821_AVX2_crypto_sort_int32(s, NTRU_N - 1); ------------------ | | 5| 168|#define NTRU_N 821 ------------------ 39| | 40| 137k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 137k|#define NTRU_N 821 ------------------ | Branch (40:17): [True: 137k, False: 168] ------------------ 41| 137k| r->coeffs[i] = ((uint16_t) (s[i] & 3)); 42| 137k| } 43| | 44| 168| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 168|#define NTRU_N 821 ------------------ 45| 168|} PQCLEAN_NTRUHPS4096821_AVX2_sample_iid: 7| 168|void PQCLEAN_NTRUHPS4096821_AVX2_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 8| 168| int i; 9| 168| union { /* align to 32 byte boundary for vmovdqa */ 10| 168| unsigned char b[PAD32(NTRU_SAMPLE_IID_BYTES)]; 11| 168| __m256i b_x32[PAD32(NTRU_SAMPLE_IID_BYTES) / 32]; 12| 168| } buffer; 13| | 14| 137k| for (i = 0; i < NTRU_SAMPLE_IID_BYTES; i++) { ------------------ | | 20| 137k|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 137k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (14:17): [True: 137k, False: 168] ------------------ 15| 137k| buffer.b[i] = uniformbytes[i]; 16| 137k| } 17| 2.18k| for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 20| 168|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 168|#define NTRU_N 821 | | ------------------ ------------------ for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 11| 2.18k|#define PAD32(X) ((((X) + 31)/32)*32) ------------------ | Branch (17:37): [True: 2.01k, False: 168] ------------------ 18| 2.01k| buffer.b[i] = 0; 19| 2.01k| } 20| 168| PQCLEAN_NTRUHPS4096821_AVX2_vec32_sample_iid(r, buffer.b); 21| 168|} PQCLEAN_NTRUHRSS1373_CLEAN_cmov: 4| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 2| size_t i; 6| | 7| 2| b = (~b + 1); 8| 66| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 64, False: 2] ------------------ 9| 64| r[i] ^= b & (x[i] ^ r[i]); 10| 64| } 11| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_keypair: 10| 2|int PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 2| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 2| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 2|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 20| 2|#define NTRU_SAMPLE_FG_BYTES (2*NTRU_SAMPLE_IID_BYTES) | | ------------------ | | | | 19| 2|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 2|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 14| 2| PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_keypair(pk, sk, seed); 15| | 16| 2| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 2|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 28| 2|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 2|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 27| 2|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 2|#define NTRU_LOGQ 14 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 2|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 16| 2|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 2| return 0; 19| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_enc: 21| 2|int PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 2| poly r, m; 23| 2| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 2| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 2| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 2|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 21| 2|#define NTRU_SAMPLE_RM_BYTES (2*NTRU_SAMPLE_IID_BYTES) | | ------------------ | | | | 19| 2|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 2|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 2| PQCLEAN_NTRUHRSS1373_CLEAN_sample_rm(&r, &m, rm_seed); 29| | 30| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(rm, &r); 31| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 2|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 32| 2| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 2|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 26| 2|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 2|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(&r); 35| 2| PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_enc(c, &r, &m, pk); 36| | 37| 2| return 0; 38| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_dec: 40| 2|int PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 2| int i, fail; 42| 2| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 2| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 2| fail = PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_dec for details. */ 48| | 49| 2| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 2|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 26| 2|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 2|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 66| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 16| 66|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 64, False: 2] ------------------ 53| 64| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 28| 64|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 24| 64|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 64|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 64|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 27| 64|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 64|#define NTRU_LOGQ 14 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 64|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 64|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 64| } 55| 4.80k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 33| 4.80k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 29| 4.80k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 4.80k|#define NTRU_LOGQ 14 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 4.80k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 4.80k|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 4.80k, False: 2] ------------------ 56| 4.80k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 16| 4.80k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 4.80k| } 58| 2| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 2|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 16| 2|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 33| 2|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 29| 2|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 2|#define NTRU_LOGQ 14 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 2|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 2| PQCLEAN_NTRUHRSS1373_CLEAN_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 17| 2|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 2| return 0; 63| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_keypair: 41| 2| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 42| 2| int i; 43| | 44| 2| poly x1, x2, x3, x4, x5; 45| | 46| 2| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 47| 2| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 48| 2| poly *invh = &x3, *h = &x3; 49| | 50| 2| PQCLEAN_NTRUHRSS1373_CLEAN_sample_fg(f, g, seed); 51| | 52| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_inv(invf_mod3, f); 53| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(sk, f); 54| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 2|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 55| | 56| | /* Lift coeffs of f and g from Z_p to Z_q */ 57| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(f); 58| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(g); 59| | 60| | /* g = 3*(x-1)*g */ 61| 2.74k| for (i = NTRU_N - 1; i > 0; i--) { ------------------ | | 5| 2|#define NTRU_N 1373 ------------------ | Branch (61:26): [True: 2.74k, False: 2] ------------------ 62| 2.74k| g->coeffs[i] = 3 * (g->coeffs[i - 1] - g->coeffs[i]); 63| 2.74k| } 64| 2| g->coeffs[0] = -(3 * g->coeffs[0]); 65| | 66| | 67| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(gf, g, f); 68| | 69| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_inv(invgf, gf); 70| | 71| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(tmp, invgf, f); 72| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_mul(invh, tmp, f); 73| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 2|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 74| | 75| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(tmp, invgf, g); 76| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(h, tmp, g); 77| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_tobytes(pk, h); 78| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_enc: 84| 2| const unsigned char *pk) { 85| 2| int i; 86| 2| poly x1, x2; 87| 2| poly *h = &x1, *liftm = &x1; 88| 2| poly *ct = &x2; 89| | 90| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_frombytes(h, pk); 91| | 92| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(ct, r, h); 93| | 94| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_lift(liftm, m); 95| 2.74k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (95:17): [True: 2.74k, False: 2] ------------------ 96| 2.74k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 97| 2.74k| } 98| | 99| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_tobytes(c, ct); 100| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_dec: 104| 2| const unsigned char *secretkey) { 105| 2| int i; 106| 2| int fail; 107| 2| poly x1, x2, x3, x4; 108| | 109| 2| poly *c = &x1, *f = &x2, *cf = &x3; 110| 2| poly *mf = &x2, *finv3 = &x3, *m = &x4; 111| 2| poly *liftm = &x2, *invh = &x3, *r = &x4; 112| 2| poly *b = &x1; 113| | 114| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_frombytes(c, ciphertext); 115| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_frombytes(f, secretkey); 116| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(f); 117| | 118| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(cf, c, f); 119| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_to_S3(mf, cf); 120| | 121| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 2|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 122| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_mul(m, mf, finv3); 123| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 2|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 124| | 125| 2| fail = 0; 126| | 127| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 128| 2| fail |= owcpa_check_ciphertext(ciphertext); 129| | 130| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 131| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 132| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 133| | /* (m can take any value in S3 in NTRU_HRSS) */ 134| | 135| | /* b = c - Lift(m) mod (q, x^n - 1) */ 136| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_lift(liftm, m); 137| 2.74k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (137:17): [True: 2.74k, False: 2] ------------------ 138| 2.74k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 139| 2.74k| } 140| | 141| | /* r = b / h mod (q, Phi_n) */ 142| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 2|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 143| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_mul(r, b, invh); 144| | 145| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 146| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 147| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 148| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 149| | /* where r gets a final reduction modulo p. */ 150| | /* We need this change to use Proposition 1 of [Sch18]. */ 151| | 152| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 153| | /* if and only if fail==0 after the following call to owcpa_check_r */ 154| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 155| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 156| 2| fail |= owcpa_check_r(r); 157| | 158| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_trinary_Zq_to_Z3(r); 159| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(rm, r); 160| | 161| 2| return fail; 162| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes: 3| 12|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 12| int i; 5| 12| unsigned char c; 6| 12| int j; 7| | 8| 3.30k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 23| 3.30k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 3.30k|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (8:17): [True: 3.28k, False: 12] ------------------ 9| 3.28k| c = a->coeffs[5 * i + 4] & 255; 10| 3.28k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 11| 3.28k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 12| 3.28k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 13| 3.28k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 14| 3.28k| msg[i] = c; 15| 3.28k| } 16| 12| i = NTRU_PACK_DEG / 5; ------------------ | | 23| 12|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 12|#define NTRU_N 1373 | | ------------------ ------------------ 17| 12| c = 0; 18| 36| for (j = NTRU_PACK_DEG - (5 * i) - 1; j >= 0; j--) { ------------------ | | 23| 12|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 12|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (18:43): [True: 24, False: 12] ------------------ 19| 24| c = (3 * c + a->coeffs[5 * i + j]) & 255; 20| 24| } 21| 12| msg[i] = c; 22| 12|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_frombytes: 24| 4|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 25| 4| int i; 26| 4| unsigned char c; 27| 4| int j; 28| | 29| 1.10k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 23| 1.10k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 1.10k|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (29:17): [True: 1.09k, False: 4] ------------------ 30| 1.09k| c = msg[i]; 31| 1.09k| r->coeffs[5 * i + 0] = c; 32| 1.09k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 33| 1.09k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 34| 1.09k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 35| 1.09k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 36| 1.09k| } 37| 4| i = NTRU_PACK_DEG / 5; ------------------ | | 23| 4|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 4|#define NTRU_N 1373 | | ------------------ ------------------ 38| 4| c = msg[i]; 39| 12| for (j = 0; (5 * i + j) < NTRU_PACK_DEG; j++) { ------------------ | | 23| 12|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 12|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (39:17): [True: 8, False: 4] ------------------ 40| 8| r->coeffs[5 * i + j] = c; 41| 8| c = c * 171 >> 9; 42| 8| } 43| 4| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 4|#define NTRU_N 1373 ------------------ 44| 4| PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n(r); 45| 4|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_tobytes: 4| 6|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_tobytes(unsigned char *r, const poly *a) { 5| 6| int i, j; 6| 6| uint16_t t[4]; 7| | 8| 2.06k| for (i = 0; i < NTRU_PACK_DEG / 4; i++) { ------------------ | | 23| 2.06k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 2.06k|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (8:17): [True: 2.05k, False: 6] ------------------ 9| 10.2k| for (j = 0; j < 4; j++) { ------------------ | Branch (9:21): [True: 8.23k, False: 2.05k] ------------------ 10| 8.23k| t[j] = MODQ(a->coeffs[4 * i + j]); ------------------ | | 9| 8.23k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 8.23k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 8.23k|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 11| 8.23k| } 12| | 13| | // t0 t1 t2 t3 14| | // r0 8 15| | // r1 6 | 2 16| | // r2 8 17| | // r3 4 | 4 18| | // r4 8 19| | // r5 2 | 6 20| | // r6 8 21| 2.05k| r[7 * i + 0] = (unsigned char) ( t[0] & 0xff ); 22| 2.05k| r[7 * i + 1] = (unsigned char) ((t[0] >> 8) | ((t[1] & 0x03) << 6)); 23| 2.05k| r[7 * i + 2] = (unsigned char) ((t[1] >> 2) & 0xff); 24| 2.05k| r[7 * i + 3] = (unsigned char) ((t[1] >> 10) | ((t[2] & 0x0f) << 4)); 25| 2.05k| r[7 * i + 4] = (unsigned char) ((t[2] >> 4) & 0xff); 26| 2.05k| r[7 * i + 5] = (unsigned char) ((t[2] >> 12) | ((t[3] & 0x3f) << 2)); 27| 2.05k| r[7 * i + 6] = (unsigned char) ( t[3] >> 6); 28| 2.05k| } 29| | 30| | // i=NTRU_PACK_DEG/4; 31| 6| if (NTRU_PACK_DEG % 4 == 2) { ------------------ | | 23| 6|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 6|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (31:9): [Folded, False: 6] ------------------ 32| 0| t[0] = MODQ(a->coeffs[NTRU_PACK_DEG - 2]); ------------------ | | 9| 0|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 0|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 0|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 33| 0| t[1] = MODQ(a->coeffs[NTRU_PACK_DEG - 1]); ------------------ | | 9| 0|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 0|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 0|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 34| 0| r[7 * i + 0] = (unsigned char) ( t[0] & 0xff ); 35| 0| r[7 * i + 1] = (unsigned char) ((t[0] >> 8) | ((t[1] & 0x03) << 6)); 36| 0| r[7 * i + 2] = (unsigned char) ((t[1] >> 2) & 0xff); 37| 0| r[7 * i + 3] = (unsigned char) ( t[1] >> 10 ); 38| 0| } 39| 6|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_frombytes: 41| 6|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_frombytes(poly *r, const unsigned char *a) { 42| 6| int i; 43| 2.06k| for (i = 0; i < NTRU_PACK_DEG / 4; i++) { ------------------ | | 23| 2.06k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 2.06k|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (43:17): [True: 2.05k, False: 6] ------------------ 44| 2.05k| r->coeffs[4 * i + 0] = a[7 * i + 0] | (((uint16_t)a[7 * i + 1] & 0x3f) << 8); 45| 2.05k| r->coeffs[4 * i + 1] = (a[7 * i + 1] >> 6) | (((uint16_t)a[7 * i + 2] ) << 2) | (((uint16_t)a[7 * i + 3] & 0x0f) << 10); 46| 2.05k| r->coeffs[4 * i + 2] = (a[7 * i + 3] >> 4) | (((uint16_t)a[7 * i + 4] & 0xff) << 4) | (((uint16_t)a[7 * i + 5] & 0x03) << 12); 47| 2.05k| r->coeffs[4 * i + 3] = (a[7 * i + 5] >> 2) | (((uint16_t)a[7 * i + 6] ) << 6); 48| 2.05k| } 49| | 50| | // i=NTRU_PACK_DEG/4; 51| 6| if (NTRU_PACK_DEG % 4 == 2) { ------------------ | | 23| 6|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 6|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (51:9): [Folded, False: 6] ------------------ 52| 0| r->coeffs[4 * i + 0] = a[7 * i + 0] | (((uint16_t)a[7 * i + 1] & 0x3f) << 8); 53| 0| r->coeffs[4 * i + 1] = (a[7 * i + 1] >> 6) | (((uint16_t)a[7 * i + 2] ) << 2) | (((uint16_t)a[7 * i + 3] & 0x0f) << 10); 54| 0| } 55| 6| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 6|#define NTRU_N 1373 ------------------ 56| 6|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_tobytes: 58| 4|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 59| 4| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_tobytes(r, a); 60| 4|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_frombytes: 62| 4|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 63| 4| int i; 64| 4| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_frombytes(r, a); 65| | 66| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 67| 4| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 4|#define NTRU_N 1373 ------------------ 68| 5.49k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 23| 5.49k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 5.49k|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (68:17): [True: 5.48k, False: 4] ------------------ 69| 5.48k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ 70| 5.48k| } 71| 4|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq: 4| 12|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(poly *r) { 5| 12| int i; 6| 16.4k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 16.4k|#define NTRU_N 1373 ------------------ | Branch (6:17): [True: 16.4k, False: 12] ------------------ 7| 16.4k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 16.4k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 16.4k|#define NTRU_LOGQ 14 | | ------------------ ------------------ 8| 16.4k| } 9| 12|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_trinary_Zq_to_Z3: 12| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_trinary_Zq_to_Z3(poly *r) { 13| 2| int i; 14| 2.74k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (14:17): [True: 2.74k, False: 2] ------------------ 15| 2.74k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 2.74k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 2.74k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 2.74k|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 16| 2.74k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 2.74k|#define NTRU_LOGQ 14 ------------------ 17| 2.74k| } 18| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_mul: 20| 4|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 4| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(r, a, b); 22| 4| PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_q_Phi_n(r); 23| 4|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_mul: 25| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 2| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(r, a, b); 32| 2.74k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (32:17): [True: 2.74k, False: 2] ------------------ 33| 2.74k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 2.74k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 2.74k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 2.74k|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 34| 2.74k| } 35| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n(r); 36| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_inv: 71| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_inv(poly *r, const poly *a) { 72| 2| poly ai2; 73| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv(&ai2, a); 74| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 2|} poly.c:PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv_to_Rq_inv: 38| 2|static void PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 2| int i; 41| 2| poly b, c; 42| 2| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 2.74k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (46:17): [True: 2.74k, False: 2] ------------------ 47| 2.74k| b.coeffs[i] = -(a->coeffs[i]); 48| 2.74k| } 49| | 50| 2.74k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (50:17): [True: 2.74k, False: 2] ------------------ 51| 2.74k| r->coeffs[i] = ai->coeffs[i]; 52| 2.74k| } 53| | 54| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&c, r, &b); 55| 2| c.coeffs[0] += 2; // c = 2 - a*ai 56| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&c, &s, &b); 59| 2| c.coeffs[0] += 2; // c = 2 - a*s 60| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&c, r, &b); 63| 2| c.coeffs[0] += 2; // c = 2 - a*r 64| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&c, &s, &b); 67| 2| c.coeffs[0] += 2; // c = 2 - a*s 68| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(r, &c, &s); // r = s*c 69| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_lift: 4| 4|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_lift(poly *r, const poly *a) { 5| | /* NOTE: Assumes input is in {0,1,2}^N */ 6| | /* Produces output in [0,Q-1]^N */ 7| 4| int i; 8| 4| poly b; 9| 4| uint16_t t, zj; 10| | 11| | /* Define z by = delta_{i,0} mod 3: */ 12| | /* t = -1/N mod p = -N mod 3 */ 13| | /* z[0] = 2 - t mod 3 */ 14| | /* z[1] = 0 mod 3 */ 15| | /* z[j] = z[j-1] + t mod 3 */ 16| | /* We'll compute b = a/(x-1) mod (3, Phi) using */ 17| | /* b[0] = , b[1] = , b[2] = */ 18| | /* b[i] = b[i-3] - (a[i] + a[i-1] + a[i-2]) */ 19| 4| t = 3 - (NTRU_N % 3); ------------------ | | 5| 4|#define NTRU_N 1373 ------------------ 20| 4| b.coeffs[0] = a->coeffs[0] * (2 - t) + a->coeffs[1] * 0 + a->coeffs[2] * t; 21| 4| b.coeffs[1] = a->coeffs[1] * (2 - t) + a->coeffs[2] * 0; 22| 4| b.coeffs[2] = a->coeffs[2] * (2 - t); 23| | 24| 4| zj = 0; /* z[1] */ 25| 5.48k| for (i = 3; i < NTRU_N; i++) { ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ | Branch (25:17): [True: 5.48k, False: 4] ------------------ 26| 5.48k| b.coeffs[0] += a->coeffs[i] * (zj + 2 * t); 27| 5.48k| b.coeffs[1] += a->coeffs[i] * (zj + t); 28| 5.48k| b.coeffs[2] += a->coeffs[i] * zj; 29| 5.48k| zj = (zj + t) % 3; 30| 5.48k| } 31| 4| b.coeffs[1] += a->coeffs[0] * (zj + t); 32| 4| b.coeffs[2] += a->coeffs[0] * zj; 33| 4| b.coeffs[2] += a->coeffs[1] * (zj + t); 34| | 35| 4| b.coeffs[0] = b.coeffs[0]; 36| 4| b.coeffs[1] = b.coeffs[1]; 37| 4| b.coeffs[2] = b.coeffs[2]; 38| 5.48k| for (i = 3; i < NTRU_N; i++) { ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ | Branch (38:17): [True: 5.48k, False: 4] ------------------ 39| 5.48k| b.coeffs[i] = b.coeffs[i - 3] + 2 * (a->coeffs[i] + a->coeffs[i - 1] + a->coeffs[i - 2]); 40| 5.48k| } 41| | 42| | /* Finish reduction mod Phi by subtracting Phi * b[N-1] */ 43| 4| PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n(&b); 44| | 45| | /* Switch from {0,1,2} to {0,1,q-1} coefficient representation */ 46| 4| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(&b); 47| | 48| | /* Multiply by (x-1) */ 49| 4| r->coeffs[0] = -(b.coeffs[0]); 50| 5.49k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 5.49k|#define NTRU_N 1373 ------------------ | Branch (50:17): [True: 5.48k, False: 4] ------------------ 51| 5.48k| r->coeffs[i + 1] = b.coeffs[i] - b.coeffs[i + 1]; 52| 5.48k| } 53| 4|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n: 18| 12|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n(poly *r) { 19| 12| int i; 20| 16.4k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 16.4k|#define NTRU_N 1373 ------------------ | Branch (20:17): [True: 16.4k, False: 12] ------------------ 21| 16.4k| r->coeffs[i] = mod3(r->coeffs[i] + 2 * r->coeffs[NTRU_N - 1]); ------------------ | | 5| 16.4k|#define NTRU_N 1373 ------------------ 22| 16.4k| } 23| 12|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_q_Phi_n: 25| 4|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_q_Phi_n(poly *r) { 26| 4| int i; 27| 5.49k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 5.49k|#define NTRU_N 1373 ------------------ | Branch (27:17): [True: 5.49k, False: 4] ------------------ 28| 5.49k| r->coeffs[i] = r->coeffs[i] - r->coeffs[NTRU_N - 1]; ------------------ | | 5| 5.49k|#define NTRU_N 1373 ------------------ 29| 5.49k| } 30| 4|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_to_S3: 32| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_to_S3(poly *r, const poly *a) { 33| 2| int i; 34| 2| uint16_t flag; 35| | 36| | /* The coefficients of a are stored as non-negative integers. */ 37| | /* We must translate to representatives in [-q/2, q/2) before */ 38| | /* reduction mod 3. */ 39| 2.74k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (39:17): [True: 2.74k, False: 2] ------------------ 40| | /* Need an explicit reduction mod q here */ 41| 2.74k| r->coeffs[i] = MODQ(a->coeffs[i]); ------------------ | | 9| 2.74k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 2.74k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 2.74k|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 42| | 43| | /* flag = 1 if r[i] >= q/2 else 0 */ 44| 2.74k| flag = r->coeffs[i] >> (NTRU_LOGQ - 1); ------------------ | | 6| 2.74k|#define NTRU_LOGQ 14 ------------------ 45| | 46| | /* Now we will add (-q) mod 3 if r[i] >= q/2 */ 47| | /* Note (-q) mod 3=(-2^k) mod 3=1<<(1-(k&1)) */ 48| 2.74k| r->coeffs[i] += flag << (1 - (NTRU_LOGQ & 1)); ------------------ | | 6| 2.74k|#define NTRU_LOGQ 14 ------------------ 49| 2.74k| } 50| | 51| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n(r); 52| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv: 10| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv(poly *r, const poly *a) { 11| 2| poly f, g, v, w; 12| 2| size_t i, loop; 13| 2| int16_t delta, sign, swap, t; 14| | 15| 2.74k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (15:17): [True: 2.74k, False: 2] ------------------ 16| 2.74k| v.coeffs[i] = 0; 17| 2.74k| } 18| 2.74k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (18:17): [True: 2.74k, False: 2] ------------------ 19| 2.74k| w.coeffs[i] = 0; 20| 2.74k| } 21| 2| w.coeffs[0] = 1; 22| | 23| 2.74k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (23:17): [True: 2.74k, False: 2] ------------------ 24| 2.74k| f.coeffs[i] = 1; 25| 2.74k| } 26| 2.74k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (26:17): [True: 2.74k, False: 2] ------------------ 27| 2.74k| g.coeffs[NTRU_N - 2 - i] = (a->coeffs[i] ^ a->coeffs[NTRU_N - 1]) & 1; ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ g.coeffs[NTRU_N - 2 - i] = (a->coeffs[i] ^ a->coeffs[NTRU_N - 1]) & 1; ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ 28| 2.74k| } 29| 2| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 2|#define NTRU_N 1373 ------------------ 30| | 31| 2| delta = 1; 32| | 33| 5.48k| for (loop = 0; loop < 2 * (NTRU_N - 1) - 1; ++loop) { ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ | Branch (33:20): [True: 5.48k, False: 2] ------------------ 34| 7.53M| for (i = NTRU_N - 1; i > 0; --i) { ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ | Branch (34:30): [True: 7.52M, False: 5.48k] ------------------ 35| 7.52M| v.coeffs[i] = v.coeffs[i - 1]; 36| 7.52M| } 37| 5.48k| v.coeffs[0] = 0; 38| | 39| 5.48k| sign = g.coeffs[0] & f.coeffs[0]; 40| 5.48k| swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]); 41| 5.48k| delta ^= swap & (delta ^ -delta); 42| 5.48k| delta += 1; 43| | 44| 7.53M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 7.53M|#define NTRU_N 1373 ------------------ | Branch (44:21): [True: 7.53M, False: 5.48k] ------------------ 45| 7.53M| t = swap & (f.coeffs[i] ^ g.coeffs[i]); 46| 7.53M| f.coeffs[i] ^= t; 47| 7.53M| g.coeffs[i] ^= t; 48| 7.53M| t = swap & (v.coeffs[i] ^ w.coeffs[i]); 49| 7.53M| v.coeffs[i] ^= t; 50| 7.53M| w.coeffs[i] ^= t; 51| 7.53M| } 52| | 53| 7.53M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 7.53M|#define NTRU_N 1373 ------------------ | Branch (53:21): [True: 7.53M, False: 5.48k] ------------------ 54| 7.53M| g.coeffs[i] = g.coeffs[i] ^ (sign & f.coeffs[i]); 55| 7.53M| } 56| 7.53M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 7.53M|#define NTRU_N 1373 ------------------ | Branch (56:21): [True: 7.53M, False: 5.48k] ------------------ 57| 7.53M| w.coeffs[i] = w.coeffs[i] ^ (sign & v.coeffs[i]); 58| 7.53M| } 59| 7.53M| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 7.53M|#define NTRU_N 1373 ------------------ | Branch (59:21): [True: 7.52M, False: 5.48k] ------------------ 60| 7.52M| g.coeffs[i] = g.coeffs[i + 1]; 61| 7.52M| } 62| 5.48k| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ 63| 5.48k| } 64| | 65| 2.74k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (65:17): [True: 2.74k, False: 2] ------------------ 66| 2.74k| r->coeffs[i] = v.coeffs[NTRU_N - 2 - i]; ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ 67| 2.74k| } 68| 2| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 2|#define NTRU_N 1373 ------------------ 69| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul: 29| 34|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(poly *r, const poly *a, const poly *b) { 30| 34| size_t i; 31| 34| uint16_t ab[2 * L]; 32| | 33| 46.7k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 46.7k|#define NTRU_N 1373 ------------------ | Branch (33:17): [True: 46.6k, False: 34] ------------------ 34| 46.6k| ab[i] = a->coeffs[i]; 35| 46.6k| ab[L + i] = b->coeffs[i]; ------------------ | | 6| 46.6k|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 46.6k|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 36| 46.6k| } 37| 136| for (i = NTRU_N; i < L; i++) { ------------------ | | 5| 34|#define NTRU_N 1373 ------------------ for (i = NTRU_N; i < L; i++) { ------------------ | | 6| 136|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 136|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ | Branch (37:22): [True: 102, False: 34] ------------------ 38| 102| ab[i] = 0; 39| 102| ab[L + i] = 0; ------------------ | | 6| 102|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 102|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 40| 102| } 41| | 42| 34| k2x4_mul(ab, ab, ab + L); ------------------ | | 6| 34|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 43| | 44| 46.7k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 46.7k|#define NTRU_N 1373 ------------------ | Branch (44:17): [True: 46.6k, False: 34] ------------------ 45| 46.6k| r->coeffs[i] = ab[i] + ab[NTRU_N + i]; ------------------ | | 5| 46.6k|#define NTRU_N 1373 ------------------ 46| 46.6k| } 47| 34|} poly_rq_mul.c:k2x4_mul: 49| 34|static void k2x4_mul(uint16_t ab[2 * L], const uint16_t a[L], const uint16_t b[L]) { 50| 34| uint16_t tmpA[9 * K]; 51| 34| uint16_t tmpB[9 * K]; 52| 34| uint16_t eC[81 * 2 * K]; 53| | 54| 34| k2x4_eval_00(tmpA, a); 55| 34| k2x4_eval_00(tmpB, b); 56| 34| k2x4_basemul(eC + 0 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 57| | 58| 34| k2x4_eval_0inf(tmpA, a); 59| 34| k2x4_eval_0inf(tmpB, b); 60| 34| k2x4_basemul(eC + 1 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 61| | 62| 34| k2x4_eval_inf0(tmpA, a); 63| 34| k2x4_eval_inf0(tmpB, b); 64| 34| k2x4_basemul(eC + 2 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 65| | 66| 34| k2x4_eval_infinf(tmpA, a); 67| 34| k2x4_eval_infinf(tmpB, b); 68| 34| k2x4_basemul(eC + 3 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 69| | 70| 34| k2x4_eval_01(tmpA, a); 71| 34| k2x4_eval_01(tmpB, b); 72| 34| k2x4_basemul(eC + 4 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 73| | 74| 34| k2x4_eval_1inf(tmpA, a); 75| 34| k2x4_eval_1inf(tmpB, b); 76| 34| k2x4_basemul(eC + 5 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 77| | 78| 34| k2x4_eval_10(tmpA, a); 79| 34| k2x4_eval_10(tmpB, b); 80| 34| k2x4_basemul(eC + 6 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 81| | 82| 34| k2x4_eval_inf1(tmpA, a); 83| 34| k2x4_eval_inf1(tmpB, b); 84| 34| k2x4_basemul(eC + 7 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 85| | 86| 34| k2x4_eval_11(tmpA, a); 87| 34| k2x4_eval_11(tmpB, b); 88| 34| k2x4_basemul(eC + 8 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 89| | 90| 34| k2x4_interpolate(ab, eC); 91| 34|} poly_rq_mul.c:k2x4_eval_00: 93| 68|static void k2x4_eval_00(uint16_t r[9 * K], const uint16_t a[L]) { 94| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (94:24): [True: 23.3k, False: 68] ------------------ 95| 23.3k| r[i] = a[i]; 96| 23.3k| } 97| 68| k2x2_eval(r); 98| 68|} poly_rq_mul.c:k2x4_basemul: 181| 306|static void k2x4_basemul(uint16_t r[18 * K], const uint16_t a[9 * K], const uint16_t b[9 * K]) { 182| 306| schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 183| 306| schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 184| 306| schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 185| 306| schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 186| 306| schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 187| 306| schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 188| 306| schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 189| 306| schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 190| 306| schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 191| 306|} poly_rq_mul.c:k2x4_eval_0inf: 108| 68|static void k2x4_eval_0inf(uint16_t r[9 * K], const uint16_t a[L]) { 109| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (109:24): [True: 23.3k, False: 68] ------------------ 110| 23.3k| r[i] = a[1 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 111| 23.3k| } 112| 68| k2x2_eval(r); 113| 68|} poly_rq_mul.c:k2x4_eval_inf0: 141| 68|static void k2x4_eval_inf0(uint16_t r[9 * K], const uint16_t a[L]) { 142| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (142:24): [True: 23.3k, False: 68] ------------------ 143| 23.3k| r[i] = a[2 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 144| 23.3k| } 145| 68| k2x2_eval(r); 146| 68|} poly_rq_mul.c:k2x4_eval_infinf: 156| 68|static void k2x4_eval_infinf(uint16_t r[9 * K], const uint16_t a[L]) { 157| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (157:24): [True: 23.3k, False: 68] ------------------ 158| 23.3k| r[i] = a[3 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 159| 23.3k| } 160| 68| k2x2_eval(r); 161| 68|} poly_rq_mul.c:k2x4_eval_01: 100| 68|static void k2x4_eval_01(uint16_t r[9 * K], const uint16_t a[L]) { 101| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (101:24): [True: 23.3k, False: 68] ------------------ 102| 23.3k| r[i] = a[0 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 103| 23.3k| r[i] += a[1 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 104| 23.3k| } 105| 68| k2x2_eval(r); 106| 68|} poly_rq_mul.c:k2x4_eval_1inf: 133| 68|static void k2x4_eval_1inf(uint16_t r[9 * K], const uint16_t a[L]) { 134| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (134:24): [True: 23.3k, False: 68] ------------------ 135| 23.3k| r[i] = a[1 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 136| 23.3k| r[i] += a[3 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 137| 23.3k| } 138| 68| k2x2_eval(r); 139| 68|} poly_rq_mul.c:k2x4_eval_10: 115| 68|static void k2x4_eval_10(uint16_t r[9 * K], const uint16_t a[L]) { 116| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (116:24): [True: 23.3k, False: 68] ------------------ 117| 23.3k| r[i] = a[0 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 118| 23.3k| r[i] += a[2 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 119| 23.3k| } 120| 68| k2x2_eval(r); 121| 68|} poly_rq_mul.c:k2x4_eval_inf1: 148| 68|static void k2x4_eval_inf1(uint16_t r[9 * K], const uint16_t a[L]) { 149| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (149:24): [True: 23.3k, False: 68] ------------------ 150| 23.3k| r[i] = a[2 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 151| 23.3k| r[i] += a[3 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 152| 23.3k| } 153| 68| k2x2_eval(r); 154| 68|} poly_rq_mul.c:k2x4_eval_11: 123| 68|static void k2x4_eval_11(uint16_t r[9 * K], const uint16_t a[L]) { 124| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (124:24): [True: 23.3k, False: 68] ------------------ 125| 23.3k| r[i] = a[0 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 126| 23.3k| r[i] += a[1 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 127| 23.3k| r[i] += a[2 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 128| 23.3k| r[i] += a[3 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 129| 23.3k| } 130| 68| k2x2_eval(r); 131| 68|} poly_rq_mul.c:k2x4_interpolate: 207| 34|static void k2x4_interpolate(uint16_t r[2 * L], const uint16_t a[81 * 2 * K]) { 208| 34| size_t i; 209| | 210| 34| uint16_t tmp[4 * M]; 211| | 212| 34| uint16_t P1[2 * M]; 213| 34| uint16_t P2[2 * M]; 214| 34| uint16_t P3[2 * M]; 215| | 216| 34| k2x2_interpolate(P1, a + 0 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 217| 34| k2x2_interpolate(P2, a + 1 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 218| 34| k2x2_interpolate(P3, a + 4 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 219| 23.4k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (219:17): [True: 23.3k, False: 34] ------------------ 220| 23.3k| r[0 * M + i] = P1[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 221| 23.3k| r[2 * M + i] = P2[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 222| 23.3k| } 223| | 224| 23.4k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (224:17): [True: 23.3k, False: 34] ------------------ 225| 23.3k| r[1 * M + i] += P3[i] - P1[i] - P2[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 226| 23.3k| } 227| | 228| 34| k2x2_interpolate(P1, a + 2 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 229| 34| k2x2_interpolate(P2, a + 3 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 230| 34| k2x2_interpolate(P3, a + 7 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 231| 23.4k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (231:17): [True: 23.3k, False: 34] ------------------ 232| 23.3k| r[4 * M + i] = P1[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 233| 23.3k| r[6 * M + i] = P2[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 234| 23.3k| } 235| | 236| 23.4k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (236:17): [True: 23.3k, False: 34] ------------------ 237| 23.3k| r[5 * M + i] += P3[i] - P1[i] - P2[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 238| 23.3k| } 239| | 240| 34| k2x2_interpolate(P1, a + 6 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 241| 34| k2x2_interpolate(P2, a + 5 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 242| 34| k2x2_interpolate(P3, a + 8 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 243| 23.4k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (243:17): [True: 23.3k, False: 34] ------------------ 244| 23.3k| tmp[0 * M + i] = P1[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 245| 23.3k| tmp[2 * M + i] = P2[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 246| 23.3k| } 247| | 248| 23.4k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (248:17): [True: 23.3k, False: 34] ------------------ 249| 23.3k| tmp[1 * M + i] += P3[i] - P1[i] - P2[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 250| 23.3k| } 251| | 252| 46.8k| for (i = 0; i < 4 * M; i++) { ------------------ | | 7| 46.8k|#define M (L/4) | | ------------------ | | | | 6| 46.8k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 46.8k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (252:17): [True: 46.7k, False: 34] ------------------ 253| 46.7k| tmp[0 * M + i] = tmp[0 * M + i] - r[0 * M + i] - r[4 * M + i]; ------------------ | | 7| 46.7k|#define M (L/4) | | ------------------ | | | | 6| 46.7k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 46.7k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * M + i] = tmp[0 * M + i] - r[0 * M + i] - r[4 * M + i]; ------------------ | | 7| 46.7k|#define M (L/4) | | ------------------ | | | | 6| 46.7k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 46.7k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * M + i] = tmp[0 * M + i] - r[0 * M + i] - r[4 * M + i]; ------------------ | | 7| 46.7k|#define M (L/4) | | ------------------ | | | | 6| 46.7k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 46.7k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * M + i] = tmp[0 * M + i] - r[0 * M + i] - r[4 * M + i]; ------------------ | | 7| 46.7k|#define M (L/4) | | ------------------ | | | | 6| 46.7k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 46.7k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 254| 46.7k| } 255| | 256| 46.8k| for (i = 0; i < 4 * M; i++) { ------------------ | | 7| 46.8k|#define M (L/4) | | ------------------ | | | | 6| 46.8k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 46.8k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (256:17): [True: 46.7k, False: 34] ------------------ 257| 46.7k| r[2 * M + i] += tmp[0 * M + i]; ------------------ | | 7| 46.7k|#define M (L/4) | | ------------------ | | | | 6| 46.7k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 46.7k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[2 * M + i] += tmp[0 * M + i]; ------------------ | | 7| 46.7k|#define M (L/4) | | ------------------ | | | | 6| 46.7k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 46.7k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 258| 46.7k| } 259| 34|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_inv: 18| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_inv(poly *r, const poly *a) { 19| 2| poly f, g, v, w; 20| 2| size_t i, loop; 21| 2| int16_t delta, sign, swap, t; 22| | 23| 2.74k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (23:17): [True: 2.74k, False: 2] ------------------ 24| 2.74k| v.coeffs[i] = 0; 25| 2.74k| } 26| 2.74k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (26:17): [True: 2.74k, False: 2] ------------------ 27| 2.74k| w.coeffs[i] = 0; 28| 2.74k| } 29| 2| w.coeffs[0] = 1; 30| | 31| 2.74k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (31:17): [True: 2.74k, False: 2] ------------------ 32| 2.74k| f.coeffs[i] = 1; 33| 2.74k| } 34| 2.74k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (34:17): [True: 2.74k, False: 2] ------------------ 35| 2.74k| g.coeffs[NTRU_N - 2 - i] = mod3((a->coeffs[i] & 3) + 2 * (a->coeffs[NTRU_N - 1] & 3)); ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ g.coeffs[NTRU_N - 2 - i] = mod3((a->coeffs[i] & 3) + 2 * (a->coeffs[NTRU_N - 1] & 3)); ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ 36| 2.74k| } 37| 2| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 2|#define NTRU_N 1373 ------------------ 38| | 39| 2| delta = 1; 40| | 41| 5.48k| for (loop = 0; loop < 2 * (NTRU_N - 1) - 1; ++loop) { ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ | Branch (41:20): [True: 5.48k, False: 2] ------------------ 42| 7.53M| for (i = NTRU_N - 1; i > 0; --i) { ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ | Branch (42:30): [True: 7.52M, False: 5.48k] ------------------ 43| 7.52M| v.coeffs[i] = v.coeffs[i - 1]; 44| 7.52M| } 45| 5.48k| v.coeffs[0] = 0; 46| | 47| 5.48k| sign = mod3((uint8_t) (2 * g.coeffs[0] * f.coeffs[0])); 48| 5.48k| swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]); 49| 5.48k| delta ^= swap & (delta ^ -delta); 50| 5.48k| delta += 1; 51| | 52| 7.53M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 7.53M|#define NTRU_N 1373 ------------------ | Branch (52:21): [True: 7.53M, False: 5.48k] ------------------ 53| 7.53M| t = swap & (f.coeffs[i] ^ g.coeffs[i]); 54| 7.53M| f.coeffs[i] ^= t; 55| 7.53M| g.coeffs[i] ^= t; 56| 7.53M| t = swap & (v.coeffs[i] ^ w.coeffs[i]); 57| 7.53M| v.coeffs[i] ^= t; 58| 7.53M| w.coeffs[i] ^= t; 59| 7.53M| } 60| | 61| 7.53M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 7.53M|#define NTRU_N 1373 ------------------ | Branch (61:21): [True: 7.53M, False: 5.48k] ------------------ 62| 7.53M| g.coeffs[i] = mod3((uint8_t) (g.coeffs[i] + sign * f.coeffs[i])); 63| 7.53M| } 64| 7.53M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 7.53M|#define NTRU_N 1373 ------------------ | Branch (64:21): [True: 7.53M, False: 5.48k] ------------------ 65| 7.53M| w.coeffs[i] = mod3((uint8_t) (w.coeffs[i] + sign * v.coeffs[i])); 66| 7.53M| } 67| 7.53M| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 7.53M|#define NTRU_N 1373 ------------------ | Branch (67:21): [True: 7.52M, False: 5.48k] ------------------ 68| 7.52M| g.coeffs[i] = g.coeffs[i + 1]; 69| 7.52M| } 70| 5.48k| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ 71| 5.48k| } 72| | 73| 2| sign = f.coeffs[0]; 74| 2.74k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (74:17): [True: 2.74k, False: 2] ------------------ 75| 2.74k| r->coeffs[i] = mod3((uint8_t) (sign * v.coeffs[NTRU_N - 2 - i])); ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ 76| 2.74k| } 77| 2| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 2|#define NTRU_N 1373 ------------------ 78| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_sample_fg: 3| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| 2| PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid_plus(f, uniformbytes); 5| 2| PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid_plus(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 19| 2|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 2|#define NTRU_N 1373 | | ------------------ ------------------ 6| | 7| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_sample_rm: 9| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| 2| PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid(r, uniformbytes); 11| 2| PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 19| 2|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 2|#define NTRU_N 1373 | | ------------------ ------------------ 12| | 13| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid_plus: 15| 4|void PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid_plus(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 16| | /* Sample r using PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid then conditionally flip */ 17| | /* signs of even index coefficients so that >= 0. */ 18| | 19| 4| int i; 20| 4| uint16_t s = 0; 21| | 22| 4| PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid(r, uniformbytes); 23| | 24| | /* Map {0,1,2} -> {0, 1, 2^16 - 1} */ 25| 5.49k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 5.49k|#define NTRU_N 1373 ------------------ | Branch (25:17): [True: 5.48k, False: 4] ------------------ 26| 5.48k| r->coeffs[i] = r->coeffs[i] | (-(r->coeffs[i] >> 1)); 27| 5.48k| } 28| | 29| | /* s = . (r[n-1] = 0) */ 30| 5.49k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 5.49k|#define NTRU_N 1373 ------------------ | Branch (30:17): [True: 5.48k, False: 4] ------------------ 31| 5.48k| s += (uint16_t)((uint32_t)r->coeffs[i + 1] * (uint32_t)r->coeffs[i]); 32| 5.48k| } 33| | 34| | /* Extract sign of s (sign(0) = 1) */ 35| 4| s = 1 | (-(s >> 15)); 36| | 37| 2.75k| for (i = 0; i < NTRU_N; i += 2) { ------------------ | | 5| 2.75k|#define NTRU_N 1373 ------------------ | Branch (37:17): [True: 2.74k, False: 4] ------------------ 38| 2.74k| r->coeffs[i] = (uint16_t)((uint32_t)s * (uint32_t)r->coeffs[i]); 39| 2.74k| } 40| | 41| | /* Map {0,1,2^16-1} -> {0, 1, 2} */ 42| 5.49k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 5.49k|#define NTRU_N 1373 ------------------ | Branch (42:17): [True: 5.49k, False: 4] ------------------ 43| 5.49k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> 15)); 44| 5.49k| } 45| 4|} PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid: 18| 8|void PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 19| 8| int i; 20| | /* {0,1,...,255} -> {0,1,2}; Pr[0] = 86/256, Pr[1] = Pr[-1] = 85/256 */ 21| 10.9k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 10.9k|#define NTRU_N 1373 ------------------ | Branch (21:17): [True: 10.9k, False: 8] ------------------ 22| 10.9k| r->coeffs[i] = mod3(uniformbytes[i]); 23| 10.9k| } 24| | 25| 8| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 8|#define NTRU_N 1373 ------------------ 26| 8|} PQCLEAN_NTRUHRSS701_AVX2_cmov: 4| 8|void PQCLEAN_NTRUHRSS701_AVX2_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 8| size_t i; 6| | 7| 8| b = (~b + 1); 8| 264| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 256, False: 8] ------------------ 9| 256| r[i] ^= b & (x[i] ^ r[i]); 10| 256| } 11| 8|} PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_keypair: 10| 8|int PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 8| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 8| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 8|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 20| 8|#define NTRU_SAMPLE_FG_BYTES (2*NTRU_SAMPLE_IID_BYTES) | | ------------------ | | | | 19| 8|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 8|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 14| 8| PQCLEAN_NTRUHRSS701_AVX2_owcpa_keypair(pk, sk, seed); 15| | 16| 8| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 8|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 28| 8|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 24| 8|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 8|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 8|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 27| 8|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 8|#define NTRU_LOGQ 13 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 8|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 8|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 16| 8|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 8| return 0; 19| 8|} PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_enc: 21| 8|int PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 8| poly r, m; 23| 8| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 8| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 8| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 8|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 21| 8|#define NTRU_SAMPLE_RM_BYTES (2*NTRU_SAMPLE_IID_BYTES) | | ------------------ | | | | 19| 8|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 8|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 8| PQCLEAN_NTRUHRSS701_AVX2_sample_rm(&r, &m, rm_seed); 29| | 30| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(rm, &r); 31| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 24| 8|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 8|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 8|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 32| 8| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 8|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 26| 8|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 24| 8|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 8|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 8|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq(&r); 35| 8| PQCLEAN_NTRUHRSS701_AVX2_owcpa_enc(c, &r, &m, pk); 36| | 37| 8| return 0; 38| 8|} PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_dec: 40| 8|int PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 8| int i, fail; 42| 8| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 8| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 8| fail = PQCLEAN_NTRUHRSS701_AVX2_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHRSS701_AVX2_owcpa_dec for details. */ 48| | 49| 8| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 8|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 26| 8|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 24| 8|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 8|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 8|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 264| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 16| 264|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 256, False: 8] ------------------ 53| 256| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 28| 256|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 24| 256|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 256|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 256|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 27| 256|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 256|#define NTRU_LOGQ 13 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 256|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 256|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 256| } 55| 9.11k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 33| 9.11k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 29| 9.11k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 9.11k|#define NTRU_LOGQ 13 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 9.11k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 9.11k|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 9.10k, False: 8] ------------------ 56| 9.10k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 16| 9.10k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 9.10k| } 58| 8| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 8|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 16| 8|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 33| 8|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 29| 8|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 8|#define NTRU_LOGQ 13 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 8|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 8|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 8| PQCLEAN_NTRUHRSS701_AVX2_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 17| 8|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 8| return 0; 63| 8|} PQCLEAN_NTRUHRSS701_AVX2_owcpa_keypair: 41| 8| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 42| 8| int i; 43| | 44| 8| poly x1, x2, x3, x4, x5; 45| | 46| 8| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 47| 8| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 48| 8| poly *invh = &x3, *h = &x3; 49| | 50| 8| PQCLEAN_NTRUHRSS701_AVX2_sample_fg(f, g, seed); 51| | 52| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_inv(invf_mod3, f); 53| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(sk, f); 54| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 24| 8|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 8|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 8|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 55| | 56| | /* Lift coeffs of f and g from Z_p to Z_q */ 57| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq(f); 58| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq(g); 59| | 60| | /* g = 3*(x-1)*g */ 61| 5.60k| for (i = NTRU_N - 1; i > 0; i--) { ------------------ | | 5| 8|#define NTRU_N 701 ------------------ | Branch (61:26): [True: 5.60k, False: 8] ------------------ 62| 5.60k| g->coeffs[i] = 3 * (g->coeffs[i - 1] - g->coeffs[i]); 63| 5.60k| } 64| 8| g->coeffs[0] = -(3 * g->coeffs[0]); 65| | 66| | 67| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(gf, g, f); 68| | 69| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_inv(invgf, gf); 70| | 71| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(tmp, invgf, f); 72| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_mul(invh, tmp, f); 73| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 24| 8|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 8|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 8|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 74| | 75| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(tmp, invgf, g); 76| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(h, tmp, g); 77| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_tobytes(pk, h); 78| 8|} PQCLEAN_NTRUHRSS701_AVX2_owcpa_enc: 84| 8| const unsigned char *pk) { 85| 8| int i; 86| 8| poly x1, x2; 87| 8| poly *h = &x1, *liftm = &x1; 88| 8| poly *ct = &x2; 89| | 90| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_frombytes(h, pk); 91| | 92| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(ct, r, h); 93| | 94| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_lift(liftm, m); 95| 5.61k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 5.61k|#define NTRU_N 701 ------------------ | Branch (95:17): [True: 5.60k, False: 8] ------------------ 96| 5.60k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 97| 5.60k| } 98| | 99| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_tobytes(c, ct); 100| 8|} PQCLEAN_NTRUHRSS701_AVX2_owcpa_dec: 104| 8| const unsigned char *secretkey) { 105| 8| int i; 106| 8| int fail; 107| 8| poly x1, x2, x3, x4; 108| | 109| 8| poly *c = &x1, *f = &x2, *cf = &x3; 110| 8| poly *mf = &x2, *finv3 = &x3, *m = &x4; 111| 8| poly *liftm = &x2, *invh = &x3, *r = &x4; 112| 8| poly *b = &x1; 113| | 114| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_frombytes(c, ciphertext); 115| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_frombytes(f, secretkey); 116| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq(f); 117| | 118| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(cf, c, f); 119| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_to_S3(mf, cf); 120| | 121| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 24| 8|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 8|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 8|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 122| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_mul(m, mf, finv3); 123| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 24| 8|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 8|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 8|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 124| | 125| 8| fail = 0; 126| | 127| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 128| 8| fail |= owcpa_check_ciphertext(ciphertext); 129| | 130| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 131| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 132| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 133| | /* (m can take any value in S3 in NTRU_HRSS) */ 134| | 135| | /* b = c - Lift(m) mod (q, x^n - 1) */ 136| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_lift(liftm, m); 137| 5.61k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 5.61k|#define NTRU_N 701 ------------------ | Branch (137:17): [True: 5.60k, False: 8] ------------------ 138| 5.60k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 139| 5.60k| } 140| | 141| | /* r = b / h mod (q, Phi_n) */ 142| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 24| 8|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 8|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 8|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 143| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_mul(r, b, invh); 144| | 145| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 146| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 147| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 148| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 149| | /* where r gets a final reduction modulo p. */ 150| | /* We need this change to use Proposition 1 of [Sch18]. */ 151| | 152| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 153| | /* if and only if fail==0 after the following call to owcpa_check_r */ 154| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 155| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 156| 8| fail |= owcpa_check_r(r); 157| | 158| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_trinary_Zq_to_Z3(r); 159| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(rm, r); 160| | 161| 8| return fail; 162| 8|} PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes: 3| 48|void PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 48| int i; 5| 48| unsigned char c; 6| | 7| 6.76k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 23| 6.76k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 6.76k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (7:17): [True: 6.72k, False: 48] ------------------ 8| 6.72k| c = a->coeffs[5 * i + 4] & 255; 9| 6.72k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 10| 6.72k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 11| 6.72k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 12| 6.72k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 13| 6.72k| msg[i] = c; 14| 6.72k| } 15| 48|} PQCLEAN_NTRUHRSS701_AVX2_poly_S3_frombytes: 17| 16|void PQCLEAN_NTRUHRSS701_AVX2_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 18| 16| int i; 19| 16| unsigned char c; 20| | 21| 2.25k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 23| 2.25k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 2.25k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (21:17): [True: 2.24k, False: 16] ------------------ 22| 2.24k| c = msg[i]; 23| 2.24k| r->coeffs[5 * i + 0] = c; 24| 2.24k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 25| 2.24k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 26| 2.24k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 27| 2.24k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 28| 2.24k| } 29| 16| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 16|#define NTRU_N 701 ------------------ 30| 16| PQCLEAN_NTRUHRSS701_AVX2_poly_mod_3_Phi_n(r); 31| 16|} PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_tobytes: 4| 24|void PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_tobytes(unsigned char *r, const poly *a) { 5| 24| int i, j; 6| 24| uint16_t t[8]; 7| | 8| 2.11k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 23| 2.11k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 2.11k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (8:17): [True: 2.08k, False: 24] ------------------ 9| 18.7k| for (j = 0; j < 8; j++) { ------------------ | Branch (9:21): [True: 16.7k, False: 2.08k] ------------------ 10| 16.7k| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 16.7k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 16.7k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 16.7k|#define NTRU_LOGQ 13 | | | | ------------------ | | ------------------ ------------------ 11| 16.7k| } 12| | 13| 2.08k| r[13 * i + 0] = (unsigned char) ( t[0] & 0xff); 14| 2.08k| r[13 * i + 1] = (unsigned char) ((t[0] >> 8) | ((t[1] & 0x07) << 5)); 15| 2.08k| r[13 * i + 2] = (unsigned char) ((t[1] >> 3) & 0xff); 16| 2.08k| r[13 * i + 3] = (unsigned char) ((t[1] >> 11) | ((t[2] & 0x3f) << 2)); 17| 2.08k| r[13 * i + 4] = (unsigned char) ((t[2] >> 6) | ((t[3] & 0x01) << 7)); 18| 2.08k| r[13 * i + 5] = (unsigned char) ((t[3] >> 1) & 0xff); 19| 2.08k| r[13 * i + 6] = (unsigned char) ((t[3] >> 9) | ((t[4] & 0x0f) << 4)); 20| 2.08k| r[13 * i + 7] = (unsigned char) ((t[4] >> 4) & 0xff); 21| 2.08k| r[13 * i + 8] = (unsigned char) ((t[4] >> 12) | ((t[5] & 0x7f) << 1)); 22| 2.08k| r[13 * i + 9] = (unsigned char) ((t[5] >> 7) | ((t[6] & 0x03) << 6)); 23| 2.08k| r[13 * i + 10] = (unsigned char) ((t[6] >> 2) & 0xff); 24| 2.08k| r[13 * i + 11] = (unsigned char) ((t[6] >> 10) | ((t[7] & 0x1f) << 3)); 25| 2.08k| r[13 * i + 12] = (unsigned char) ((t[7] >> 5)); 26| 2.08k| } 27| | 28| 120| for (j = 0; j < NTRU_PACK_DEG - 8 * i; j++) { ------------------ | | 23| 120|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 120|#define NTRU_N 701 | | ------------------ ------------------ | Branch (28:17): [True: 96, False: 24] ------------------ 29| 96| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 96|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 96|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 96|#define NTRU_LOGQ 13 | | | | ------------------ | | ------------------ ------------------ 30| 96| } 31| 120| for (; j < 8; j++) { ------------------ | Branch (31:12): [True: 96, False: 24] ------------------ 32| 96| t[j] = 0; 33| 96| } 34| | 35| 24| switch (NTRU_PACK_DEG - 8 * (NTRU_PACK_DEG / 8)) { ------------------ | | 23| 24|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 24|#define NTRU_N 701 | | ------------------ ------------------ switch (NTRU_PACK_DEG - 8 * (NTRU_PACK_DEG / 8)) { ------------------ | | 23| 24|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 24|#define NTRU_N 701 | | ------------------ ------------------ | Branch (35:13): [True: 24, Folded] ------------------ 36| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 37| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 38| 24| case 4: ------------------ | Branch (38:5): [True: 24, False: 0] ------------------ 39| 24| r[13 * i + 0] = (unsigned char) ( t[0] & 0xff); 40| 24| r[13 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x07) << 5); 41| 24| r[13 * i + 2] = (unsigned char) (t[1] >> 3) & 0xff; 42| 24| r[13 * i + 3] = (unsigned char) (t[1] >> 11) | ((t[2] & 0x3f) << 2); 43| 24| r[13 * i + 4] = (unsigned char) (t[2] >> 6) | ((t[3] & 0x01) << 7); 44| 24| r[13 * i + 5] = (unsigned char) (t[3] >> 1) & 0xff; 45| 24| r[13 * i + 6] = (unsigned char) (t[3] >> 9) | ((t[4] & 0x0f) << 4); 46| 24| break; 47| 0| case 2: ------------------ | Branch (47:5): [True: 0, False: 24] ------------------ 48| 0| r[13 * i + 0] = (unsigned char) ( t[0] & 0xff); 49| 0| r[13 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x07) << 5); 50| 0| r[13 * i + 2] = (unsigned char) (t[1] >> 3) & 0xff; 51| 0| r[13 * i + 3] = (unsigned char) (t[1] >> 11) | ((t[2] & 0x3f) << 2); 52| 0| break; 53| 24| } 54| 24|} PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_frombytes: 56| 24|void PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_frombytes(poly *r, const unsigned char *a) { 57| 24| int i; 58| 2.11k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 23| 2.11k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 2.11k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (58:17): [True: 2.08k, False: 24] ------------------ 59| 2.08k| r->coeffs[8 * i + 0] = a[13 * i + 0] | (((uint16_t)a[13 * i + 1] & 0x1f) << 8); 60| 2.08k| r->coeffs[8 * i + 1] = (a[13 * i + 1] >> 5) | (((uint16_t)a[13 * i + 2] ) << 3) | (((uint16_t)a[13 * i + 3] & 0x03) << 11); 61| 2.08k| r->coeffs[8 * i + 2] = (a[13 * i + 3] >> 2) | (((uint16_t)a[13 * i + 4] & 0x7f) << 6); 62| 2.08k| r->coeffs[8 * i + 3] = (a[13 * i + 4] >> 7) | (((uint16_t)a[13 * i + 5] ) << 1) | (((uint16_t)a[13 * i + 6] & 0x0f) << 9); 63| 2.08k| r->coeffs[8 * i + 4] = (a[13 * i + 6] >> 4) | (((uint16_t)a[13 * i + 7] ) << 4) | (((uint16_t)a[13 * i + 8] & 0x01) << 12); 64| 2.08k| r->coeffs[8 * i + 5] = (a[13 * i + 8] >> 1) | (((uint16_t)a[13 * i + 9] & 0x3f) << 7); 65| 2.08k| r->coeffs[8 * i + 6] = (a[13 * i + 9] >> 6) | (((uint16_t)a[13 * i + 10] ) << 2) | (((uint16_t)a[13 * i + 11] & 0x07) << 10); 66| 2.08k| r->coeffs[8 * i + 7] = (a[13 * i + 11] >> 3) | (((uint16_t)a[13 * i + 12] ) << 5); 67| 2.08k| } 68| 24| switch (NTRU_PACK_DEG & 0x07) { ------------------ | | 23| 24|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 24|#define NTRU_N 701 | | ------------------ ------------------ | Branch (68:13): [True: 24, Folded] ------------------ 69| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 70| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 71| 24| case 4: ------------------ | Branch (71:5): [True: 24, False: 0] ------------------ 72| 24| r->coeffs[8 * i + 0] = a[13 * i + 0] | (((uint16_t)a[13 * i + 1] & 0x1f) << 8); 73| 24| r->coeffs[8 * i + 1] = (a[13 * i + 1] >> 5) | (((uint16_t)a[13 * i + 2] ) << 3) | (((uint16_t)a[13 * i + 3] & 0x03) << 11); 74| 24| r->coeffs[8 * i + 2] = (a[13 * i + 3] >> 2) | (((uint16_t)a[13 * i + 4] & 0x7f) << 6); 75| 24| r->coeffs[8 * i + 3] = (a[13 * i + 4] >> 7) | (((uint16_t)a[13 * i + 5] ) << 1) | (((uint16_t)a[13 * i + 6] & 0x0f) << 9); 76| 24| break; 77| 0| case 2: ------------------ | Branch (77:5): [True: 0, False: 24] ------------------ 78| 0| r->coeffs[8 * i + 0] = a[13 * i + 0] | (((uint16_t)a[13 * i + 1] & 0x1f) << 8); 79| 0| r->coeffs[8 * i + 1] = (a[13 * i + 1] >> 5) | (((uint16_t)a[13 * i + 2] ) << 3) | (((uint16_t)a[13 * i + 3] & 0x03) << 11); 80| 0| break; 81| 24| } 82| 24| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 24|#define NTRU_N 701 ------------------ 83| 24|} PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_tobytes: 85| 16|void PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 86| 16| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_tobytes(r, a); 87| 16|} PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_frombytes: 89| 16|void PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 90| 16| int i; 91| 16| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_frombytes(r, a); 92| | 93| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 94| 16| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 16|#define NTRU_N 701 ------------------ 95| 11.2k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 23| 11.2k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 11.2k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (95:17): [True: 11.2k, False: 16] ------------------ 96| 11.2k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 11.2k|#define NTRU_N 701 ------------------ 97| 11.2k| } 98| 16|} PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq: 4| 32|void PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq(poly *r) { 5| 32| int i; 6| 22.4k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 22.4k|#define NTRU_N 701 ------------------ | Branch (6:17): [True: 22.4k, False: 32] ------------------ 7| 22.4k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 22.4k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 22.4k|#define NTRU_LOGQ 13 | | ------------------ ------------------ 8| 22.4k| } 9| 32|} PQCLEAN_NTRUHRSS701_AVX2_poly_trinary_Zq_to_Z3: 12| 8|void PQCLEAN_NTRUHRSS701_AVX2_poly_trinary_Zq_to_Z3(poly *r) { 13| 8| int i; 14| 5.61k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 5.61k|#define NTRU_N 701 ------------------ | Branch (14:17): [True: 5.60k, False: 8] ------------------ 15| 5.60k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 5.60k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 5.60k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 5.60k|#define NTRU_LOGQ 13 | | | | ------------------ | | ------------------ ------------------ 16| 5.60k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 5.60k|#define NTRU_LOGQ 13 ------------------ 17| 5.60k| } 18| 8|} PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_mul: 20| 16|void PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 16| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(r, a, b); 22| 16| PQCLEAN_NTRUHRSS701_AVX2_poly_mod_q_Phi_n(r); 23| 16|} PQCLEAN_NTRUHRSS701_AVX2_poly_S3_mul: 25| 8|void PQCLEAN_NTRUHRSS701_AVX2_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 8| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(r, a, b); 32| 5.61k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 5.61k|#define NTRU_N 701 ------------------ | Branch (32:17): [True: 5.60k, False: 8] ------------------ 33| 5.60k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 5.60k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 5.60k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 5.60k|#define NTRU_LOGQ 13 | | | | ------------------ | | ------------------ ------------------ 34| 5.60k| } 35| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_mod_3_Phi_n(r); 36| 8|} PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_inv: 71| 8|void PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_inv(poly *r, const poly *a) { 72| 8| poly ai2; 73| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv(&ai2, a); 74| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 8|} poly.c:PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv_to_Rq_inv: 38| 8|static void PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 8| int i; 41| 8| poly b, c; 42| 8| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 5.61k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 5.61k|#define NTRU_N 701 ------------------ | Branch (46:17): [True: 5.60k, False: 8] ------------------ 47| 5.60k| b.coeffs[i] = -(a->coeffs[i]); 48| 5.60k| } 49| | 50| 5.61k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 5.61k|#define NTRU_N 701 ------------------ | Branch (50:17): [True: 5.60k, False: 8] ------------------ 51| 5.60k| r->coeffs[i] = ai->coeffs[i]; 52| 5.60k| } 53| | 54| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&c, r, &b); 55| 8| c.coeffs[0] += 2; // c = 2 - a*ai 56| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&c, &s, &b); 59| 8| c.coeffs[0] += 2; // c = 2 - a*s 60| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&c, r, &b); 63| 8| c.coeffs[0] += 2; // c = 2 - a*r 64| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&c, &s, &b); 67| 8| c.coeffs[0] += 2; // c = 2 - a*s 68| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 69| 8|} PQCLEAN_NTRUHRSS701_AVX2_poly_R2_tobytes: 6| 8|void PQCLEAN_NTRUHRSS701_AVX2_poly_R2_tobytes(unsigned char *out, const poly *a) { 7| 8| int i, j, k; 8| 104| for (i = 0; i < 12; i++) { ------------------ | Branch (8:17): [True: 96, False: 8] ------------------ 9| 864| for (k = 0; k < 8; k++) { ------------------ | Branch (9:21): [True: 768, False: 96] ------------------ 10| 768| out[i * 8 + k] = 0; 11| 6.91k| for (j = 0; j < 8; j++) { ------------------ | Branch (11:25): [True: 6.14k, False: 768] ------------------ 12| 6.14k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 6.14k|#define NTRU_N 701 ------------------ | Branch (12:21): [True: 5.60k, False: 536] ------------------ 13| 5.60k| out[i * 8 + k] |= (a->coeffs[(i * 8 + k) * 8 + j] & 1) << j; 14| 5.60k| } 15| 6.14k| } 16| 768| } 17| 96| } 18| 8|} PQCLEAN_NTRUHRSS701_AVX2_poly_R2_frombytes: 20| 8|void PQCLEAN_NTRUHRSS701_AVX2_poly_R2_frombytes(poly *a, const unsigned char *in) { 21| 8| int i, j, k; 22| 104| for (i = 0; i < 12; i++) { ------------------ | Branch (22:17): [True: 96, False: 8] ------------------ 23| 864| for (k = 0; k < 8; k++) { ------------------ | Branch (23:21): [True: 768, False: 96] ------------------ 24| 6.91k| for (j = 0; j < 8; j++) { ------------------ | Branch (24:25): [True: 6.14k, False: 768] ------------------ 25| 6.14k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 6.14k|#define NTRU_N 701 ------------------ | Branch (25:21): [True: 5.60k, False: 536] ------------------ 26| 5.60k| a->coeffs[(i * 8 + k) * 8 + j] = (in[i * 8 + k] >> j) & 1; 27| 5.60k| } 28| 6.14k| } 29| 768| } 30| 96| } 31| 8|} PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv: 33| 8|void PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv(poly *r, const poly *a) { 34| 8| union { 35| 8| unsigned char s[96]; 36| 8| __m256i s_x32[3]; 37| 8| } squares[13]; 38| 8|#define s(x) squares[(x)].s 39| | 40| | // This relies on the following addition chain: 41| | // 1, 2, 3, 6, 12, 15, 27, 42, 84, 168, 336, 672, 699 42| | 43| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_tobytes(s(0), a); // TODO alignment ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 44| | 45| 8| PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(1), s(0)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(1), s(0)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 46| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 47| 8| PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(2), s(1)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(2), s(1)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 48| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 49| 8| PQCLEAN_NTRUHRSS701_AVX2_square_3_701(s(3), s(2)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_3_701(s(3), s(2)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 50| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 51| 8| PQCLEAN_NTRUHRSS701_AVX2_square_6_701(s(4), s(3)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_6_701(s(4), s(3)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 52| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 53| 8| PQCLEAN_NTRUHRSS701_AVX2_square_3_701(s(5), s(4)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_3_701(s(5), s(4)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 54| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 55| 8| PQCLEAN_NTRUHRSS701_AVX2_square_12_701(s(6), s(5)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_12_701(s(6), s(5)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 56| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(6), s(6), s(4)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(6), s(6), s(4)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(6), s(6), s(4)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 57| 8| PQCLEAN_NTRUHRSS701_AVX2_square_15_701(s(7), s(6)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_15_701(s(7), s(6)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 58| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(7), s(7), s(5)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(7), s(7), s(5)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(7), s(7), s(5)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 59| 8| PQCLEAN_NTRUHRSS701_AVX2_square_42_701(s(8), s(7)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_42_701(s(8), s(7)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 60| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 61| 8| PQCLEAN_NTRUHRSS701_AVX2_square_84_701(s(9), s(8)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_84_701(s(9), s(8)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 62| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 63| 8| PQCLEAN_NTRUHRSS701_AVX2_square_168_701(s(10), s(9)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_168_701(s(10), s(9)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 64| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 65| 8| PQCLEAN_NTRUHRSS701_AVX2_square_336_701(s(11), s(10)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_336_701(s(11), s(10)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 66| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 67| 8| PQCLEAN_NTRUHRSS701_AVX2_square_27_701(s(12), s(11)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_27_701(s(12), s(11)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 68| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(12), s(12), s(6)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(12), s(12), s(6)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(12), s(12), s(6)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 69| 8| PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(0), s(12)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(0), s(12)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 70| | 71| 8| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_frombytes(r, s(0)); ------------------ | | 38| 8|#define s(x) squares[(x)].s ------------------ 72| 8|#undef s 73| 8|} PQCLEAN_NTRUHRSS701_AVX2_poly_S3_inv: 545| 8|void PQCLEAN_NTRUHRSS701_AVX2_poly_S3_inv(poly *r_out, const poly *a) { 546| 8| const unsigned char *in = (void *) a; 547| 8| unsigned char *out = (void *) r_out; 548| | 549| 8| small input[ppad]; 550| 8| small output[ppad]; 551| 8| int i; 552| | 553| | /* XXX: obviously input/output format should be packed into bytes */ 554| | 555| 5.60k| for (i = 0; i < p; ++i) { ------------------ | | 7| 5.60k|#define p 700 ------------------ | Branch (555:17): [True: 5.60k, False: 8] ------------------ 556| 5.60k| small x = in[2 * i] & 3; /* 0 1 2 3 */ 557| 5.60k| x += 1; /* 0 1 2 3 4 5 6, offset by 1 */ 558| 5.60k| x &= (x - 3) >> 5; /* 0 1 2, offset by 1 */ 559| 5.60k| input[i] = x - 1; 560| 5.60k| } 561| | /* XXX: merge with vec256_init */ 562| | 563| 8| __poly_S3_inv((unsigned char *)output, (unsigned char *)input); 564| | 565| 5.60k| for (i = 0; i < p; ++i) { ------------------ | | 7| 5.60k|#define p 700 ------------------ | Branch (565:17): [True: 5.60k, False: 8] ------------------ 566| 5.60k| out[2 * i] = (3 & output[i]) ^ ((3 & output[i]) >> 1); 567| 5.60k| out[2 * i + 1] = 0; 568| 5.60k| } 569| 8|} PQCLEAN_NTRUHRSS701_AVX2_sample_fg: 3| 8|void PQCLEAN_NTRUHRSS701_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| 8| PQCLEAN_NTRUHRSS701_AVX2_sample_iid_plus(f, uniformbytes); 5| 8| PQCLEAN_NTRUHRSS701_AVX2_sample_iid_plus(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 19| 8|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 8|#define NTRU_N 701 | | ------------------ ------------------ 6| | 7| 8|} PQCLEAN_NTRUHRSS701_AVX2_sample_rm: 9| 8|void PQCLEAN_NTRUHRSS701_AVX2_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| 8| PQCLEAN_NTRUHRSS701_AVX2_sample_iid(r, uniformbytes); 11| 8| PQCLEAN_NTRUHRSS701_AVX2_sample_iid(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 19| 8|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 8|#define NTRU_N 701 | | ------------------ ------------------ 12| | 13| 8|} PQCLEAN_NTRUHRSS701_AVX2_sample_iid_plus: 15| 16|void PQCLEAN_NTRUHRSS701_AVX2_sample_iid_plus(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 16| | /* Sample r using PQCLEAN_NTRUHRSS701_AVX2_sample_iid then conditionally flip */ 17| | /* signs of even index coefficients so that >= 0. */ 18| | 19| 16| int i; 20| 16| uint16_t s = 0; 21| | 22| 16| PQCLEAN_NTRUHRSS701_AVX2_sample_iid(r, uniformbytes); 23| | 24| | /* Map {0,1,2} -> {0, 1, 2^16 - 1} */ 25| 11.2k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 11.2k|#define NTRU_N 701 ------------------ | Branch (25:17): [True: 11.2k, False: 16] ------------------ 26| 11.2k| r->coeffs[i] = r->coeffs[i] | (-(r->coeffs[i] >> 1)); 27| 11.2k| } 28| | 29| | /* s = . (r[n-1] = 0) */ 30| 11.2k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 11.2k|#define NTRU_N 701 ------------------ | Branch (30:17): [True: 11.2k, False: 16] ------------------ 31| 11.2k| s += (uint16_t)((uint32_t)r->coeffs[i + 1] * (uint32_t)r->coeffs[i]); 32| 11.2k| } 33| | 34| | /* Extract sign of s (sign(0) = 1) */ 35| 16| s = 1 | (-(s >> 15)); 36| | 37| 5.63k| for (i = 0; i < NTRU_N; i += 2) { ------------------ | | 5| 5.63k|#define NTRU_N 701 ------------------ | Branch (37:17): [True: 5.61k, False: 16] ------------------ 38| 5.61k| r->coeffs[i] = (uint16_t)((uint32_t)s * (uint32_t)r->coeffs[i]); 39| 5.61k| } 40| | 41| | /* Map {0,1,2^16-1} -> {0, 1, 2} */ 42| 11.2k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 11.2k|#define NTRU_N 701 ------------------ | Branch (42:17): [True: 11.2k, False: 16] ------------------ 43| 11.2k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> 15)); 44| 11.2k| } 45| 16|} PQCLEAN_NTRUHRSS701_AVX2_sample_iid: 7| 32|void PQCLEAN_NTRUHRSS701_AVX2_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 8| 32| int i; 9| 32| union { /* align to 32 byte boundary for vmovdqa */ 10| 32| unsigned char b[PAD32(NTRU_SAMPLE_IID_BYTES)]; 11| 32| __m256i b_x32[PAD32(NTRU_SAMPLE_IID_BYTES) / 32]; 12| 32| } buffer; 13| | 14| 22.4k| for (i = 0; i < NTRU_SAMPLE_IID_BYTES; i++) { ------------------ | | 19| 22.4k|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 22.4k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (14:17): [True: 22.4k, False: 32] ------------------ 15| 22.4k| buffer.b[i] = uniformbytes[i]; 16| 22.4k| } 17| 160| for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 19| 32|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 32|#define NTRU_N 701 | | ------------------ ------------------ for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 11| 160|#define PAD32(X) ((((X) + 31)/32)*32) ------------------ | Branch (17:37): [True: 128, False: 32] ------------------ 18| 128| buffer.b[i] = 0; 19| 128| } 20| 32| PQCLEAN_NTRUHRSS701_AVX2_vec32_sample_iid(r, buffer.b); 21| 32|} OQS_KEM_ntruprime_sntrup761_new: 9| 9|OQS_KEM *OQS_KEM_ntruprime_sntrup761_new(void) { 10| | 11| 9| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 9| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 9] ------------------ 13| 0| return NULL; 14| 0| } 15| 9| kem->method_name = OQS_KEM_alg_ntruprime_sntrup761; ------------------ | | 93| 9|#define OQS_KEM_alg_ntruprime_sntrup761 "sntrup761" ------------------ 16| 9| kem->alg_version = "v1.9.2026.01.20 via https://github.com/openssh/openssh-portable/blob/master/sntrup761.c"; 17| | 18| 9| kem->claimed_nist_level = 2; 19| 9| kem->ind_cca = true; 20| | 21| 9| kem->length_public_key = OQS_KEM_ntruprime_sntrup761_length_public_key; ------------------ | | 9| 9|#define OQS_KEM_ntruprime_sntrup761_length_public_key 1158 ------------------ 22| 9| kem->length_secret_key = OQS_KEM_ntruprime_sntrup761_length_secret_key; ------------------ | | 10| 9|#define OQS_KEM_ntruprime_sntrup761_length_secret_key 1763 ------------------ 23| 9| kem->length_ciphertext = OQS_KEM_ntruprime_sntrup761_length_ciphertext; ------------------ | | 11| 9|#define OQS_KEM_ntruprime_sntrup761_length_ciphertext 1039 ------------------ 24| 9| kem->length_shared_secret = OQS_KEM_ntruprime_sntrup761_length_shared_secret; ------------------ | | 12| 9|#define OQS_KEM_ntruprime_sntrup761_length_shared_secret 32 ------------------ 25| 9| kem->length_keypair_seed = OQS_KEM_ntruprime_sntrup761_length_keypair_seed; ------------------ | | 13| 9|#define OQS_KEM_ntruprime_sntrup761_length_keypair_seed 0 ------------------ 26| 9| kem->length_encaps_seed = OQS_KEM_ntruprime_sntrup761_length_encaps_seed; ------------------ | | 14| 9|#define OQS_KEM_ntruprime_sntrup761_length_encaps_seed 0 ------------------ 27| | 28| 9| kem->keypair = OQS_KEM_ntruprime_sntrup761_keypair; 29| 9| kem->keypair_derand = OQS_KEM_ntruprime_sntrup761_keypair_derand; 30| 9| kem->encaps = OQS_KEM_ntruprime_sntrup761_encaps; 31| 9| kem->encaps_derand = OQS_KEM_ntruprime_sntrup761_encaps_derand; 32| 9| kem->decaps = OQS_KEM_ntruprime_sntrup761_decaps; 33| | 34| 9| return kem; 35| 9|} OQS_KEM_ntruprime_sntrup761_keypair: 48| 9|OQS_API OQS_STATUS OQS_KEM_ntruprime_sntrup761_keypair(uint8_t *public_key, uint8_t *secret_key) { 49| 9| return (OQS_STATUS) OPENSSH_SNTRUP761_crypto_kem_keypair(public_key, secret_key); 50| 9|} OQS_KEM_ntruprime_sntrup761_encaps: 60| 9|OQS_API OQS_STATUS OQS_KEM_ntruprime_sntrup761_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 9| return (OQS_STATUS) OPENSSH_SNTRUP761_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 9|} OQS_KEM_ntruprime_sntrup761_decaps: 64| 9|OQS_API OQS_STATUS OQS_KEM_ntruprime_sntrup761_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 9| return (OQS_STATUS) OPENSSH_SNTRUP761_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 9|} OPENSSH_SNTRUP761_crypto_kem_keypair: 2103| 9|int crypto_kem_sntrup761_keypair(unsigned char *pk, unsigned char *sk) { 2104| 9| int i; 2105| 9| ZKeyGen(pk, sk); 2106| 9| sk += SecretKeys_bytes; ------------------ | | 1703| 9|#define SecretKeys_bytes (2 * Small_bytes) | | ------------------ | | | | 1701| 9|#define Small_bytes ((p + 3) / 4) | | | | ------------------ | | | | | | 1694| 9|#define p 761 | | | | ------------------ | | ------------------ ------------------ 2107| 10.4k| for (i = 0; i < crypto_kem_sntrup761_PUBLICKEYBYTES; ++i) *sk++ = pk[i]; ------------------ | | 4| 10.4k|#define crypto_kem_sntrup761_PUBLICKEYBYTES 1158 ------------------ | Branch (2107:15): [True: 10.4k, False: 9] ------------------ 2108| 9| randombytes(sk, Small_bytes); ------------------ | | 10| 9|#define randombytes(buf,len) OQS_randombytes((uint8_t *)(buf),(len)) ------------------ 2109| 9| Hash_prefix(sk + Small_bytes, 4, pk, crypto_kem_sntrup761_PUBLICKEYBYTES); ------------------ | | 1701| 9|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 9|#define p 761 | | ------------------ ------------------ Hash_prefix(sk + Small_bytes, 4, pk, crypto_kem_sntrup761_PUBLICKEYBYTES); ------------------ | | 4| 9|#define crypto_kem_sntrup761_PUBLICKEYBYTES 1158 ------------------ 2110| 9| return 0; 2111| 9|} OPENSSH_SNTRUP761_crypto_kem_enc: 2119| 9|int crypto_kem_sntrup761_enc(unsigned char *c, unsigned char *k, const unsigned char *pk) { 2120| 9| Inputs r; 2121| 9| unsigned char r_enc[Small_bytes], cache[Hash_bytes]; 2122| 9| Hash_prefix(cache, 4, pk, crypto_kem_sntrup761_PUBLICKEYBYTES); ------------------ | | 4| 9|#define crypto_kem_sntrup761_PUBLICKEYBYTES 1158 ------------------ 2123| 9| Short_random(r); 2124| 9| Hide(c, r_enc, r, pk, cache); 2125| 9| HashSession(k, 1, r_enc, c); 2126| 9| return 0; 2127| 9|} OPENSSH_SNTRUP761_crypto_kem_dec: 2136| 9|int crypto_kem_sntrup761_dec(unsigned char *k, const unsigned char *c, const unsigned char *sk) { 2137| 9| const unsigned char *pk = sk + SecretKeys_bytes; ------------------ | | 1703| 9|#define SecretKeys_bytes (2 * Small_bytes) | | ------------------ | | | | 1701| 9|#define Small_bytes ((p + 3) / 4) | | | | ------------------ | | | | | | 1694| 9|#define p 761 | | | | ------------------ | | ------------------ ------------------ 2138| 9| const unsigned char *rho = pk + crypto_kem_sntrup761_PUBLICKEYBYTES; ------------------ | | 4| 9|#define crypto_kem_sntrup761_PUBLICKEYBYTES 1158 ------------------ 2139| 9| const unsigned char *cache = rho + Small_bytes; ------------------ | | 1701| 9|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 9|#define p 761 | | ------------------ ------------------ 2140| 9| Inputs r; 2141| 9| unsigned char r_enc[Small_bytes], cnew[crypto_kem_sntrup761_CIPHERTEXTBYTES]; 2142| 9| int mask, i; 2143| 9| ZDecrypt(r, c, sk); 2144| 9| Hide(cnew, r_enc, r, pk, cache); 2145| 9| mask = Ciphertexts_diff_mask(c, cnew); 2146| 1.72k| for (i = 0; i < Small_bytes; ++i) r_enc[i] ^= mask & (r_enc[i] ^ rho[i]); ------------------ | | 1701| 1.72k|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 1.72k|#define p 761 | | ------------------ ------------------ | Branch (2146:15): [True: 1.71k, False: 9] ------------------ 2147| 9| HashSession(k, 1 + mask, r_enc, c); 2148| 9| return 0; 2149| 9|} sntrup761.c:ZKeyGen: 2062| 9|static void ZKeyGen(unsigned char *pk, unsigned char *sk) { 2063| 9| Fq h[p]; 2064| 9| small f[p], v[p]; 2065| 9| KeyGen(h, f, v); 2066| 9| Rq_encode(pk, h); 2067| 9| Small_encode(sk, f); 2068| 9| Small_encode(sk + Small_bytes, v); ------------------ | | 1701| 9|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 9|#define p 761 | | ------------------ ------------------ 2069| 9|} sntrup761.c:KeyGen: 1977| 9|static void KeyGen(Fq *h, small *f, small *ginv) { 1978| 9| small g[p]; 1979| 9| Fq finv[p]; 1980| 9| for (;;) { 1981| 9| int result; 1982| 9| Small_random(g); 1983| 9| result = R3_recip(ginv, g); 1984| 9| crypto_declassify(&result, sizeof result); ------------------ | | 18| 9|#define crypto_declassify(x, y) do {} while (0) | | ------------------ | | | Branch (18:46): [Folded, False: 9] | | ------------------ ------------------ 1985| 9| if (result == 0) break; ------------------ | Branch (1985:9): [True: 9, False: 0] ------------------ 1986| 9| } 1987| 9| Short_random(f); 1988| 9| Rq_recip3(finv, f); 1989| 9| Rq_mult_small(h, finv, g); 1990| 9|} sntrup761.c:Small_random: 1970| 9|static void Small_random(small *out) { 1971| 9| int i; 1972| 9| uint32_t L[p]; 1973| 9| randombytes(L, sizeof(L)); ------------------ | | 10| 9|#define randombytes(buf,len) OQS_randombytes((uint8_t *)(buf),(len)) ------------------ 1974| 6.85k| for (i = 0; i < p; ++i) out[i] = (((L[i] & 0x3fffffff) * 3) >> 30) - 1; ------------------ | | 1694| 6.85k|#define p 761 ------------------ | Branch (1974:15): [True: 6.84k, False: 9] ------------------ 1975| 9| explicit_bzero(L, sizeof(L)); ------------------ | | 14| 9|#define explicit_bzero OQS_MEM_cleanse ------------------ 1976| 9|} sntrup761.c:R3_recip: 1840| 9|static int R3_recip(small *out, const small *in) { 1841| 9| small f[p + 1], g[p + 1], v[p + 1], r[p + 1]; 1842| 9| int sign, swap, t, i, loop, delta = 1; 1843| 6.86k| for (i = 0; i < p + 1; ++i) v[i] = 0; ------------------ | | 1694| 6.86k|#define p 761 ------------------ | Branch (1843:15): [True: 6.85k, False: 9] ------------------ 1844| 6.86k| for (i = 0; i < p + 1; ++i) r[i] = 0; ------------------ | | 1694| 6.86k|#define p 761 ------------------ | Branch (1844:15): [True: 6.85k, False: 9] ------------------ 1845| 9| r[0] = 1; 1846| 6.85k| for (i = 0; i < p; ++i) f[i] = 0; ------------------ | | 1694| 6.85k|#define p 761 ------------------ | Branch (1846:15): [True: 6.84k, False: 9] ------------------ 1847| 9| f[0] = 1; 1848| 9| f[p - 1] = f[p] = -1; ------------------ | | 1694| 9|#define p 761 ------------------ f[p - 1] = f[p] = -1; ------------------ | | 1694| 9|#define p 761 ------------------ 1849| 6.85k| for (i = 0; i < p; ++i) g[p - 1 - i] = in[i]; ------------------ | | 1694| 6.85k|#define p 761 ------------------ for (i = 0; i < p; ++i) g[p - 1 - i] = in[i]; ------------------ | | 1694| 6.84k|#define p 761 ------------------ | Branch (1849:15): [True: 6.84k, False: 9] ------------------ 1850| 9| g[p] = 0; ------------------ | | 1694| 9|#define p 761 ------------------ 1851| 13.6k| for (loop = 0; loop < 2 * p - 1; ++loop) { ------------------ | | 1694| 13.6k|#define p 761 ------------------ | Branch (1851:18): [True: 13.6k, False: 9] ------------------ 1852| 10.4M| for (i = p; i > 0; --i) v[i] = v[i - 1]; ------------------ | | 1694| 13.6k|#define p 761 ------------------ | Branch (1852:17): [True: 10.4M, False: 13.6k] ------------------ 1853| 13.6k| v[0] = 0; 1854| 13.6k| sign = -g[0] * f[0]; 1855| 13.6k| swap = crypto_int16_negative_mask(-delta) & crypto_int16_nonzero_mask(g[0]); 1856| 13.6k| delta ^= swap & (delta ^ -delta); 1857| 13.6k| delta += 1; 1858| 10.4M| for (i = 0; i < p + 1; ++i) { ------------------ | | 1694| 10.4M|#define p 761 ------------------ | Branch (1858:17): [True: 10.4M, False: 13.6k] ------------------ 1859| 10.4M| t = swap & (f[i] ^ g[i]); 1860| 10.4M| f[i] ^= t; 1861| 10.4M| g[i] ^= t; 1862| 10.4M| t = swap & (v[i] ^ r[i]); 1863| 10.4M| v[i] ^= t; 1864| 10.4M| r[i] ^= t; 1865| 10.4M| } 1866| 10.4M| for (i = 0; i < p + 1; ++i) g[i] = F3_freeze(g[i] + sign * f[i]); ------------------ | | 1694| 10.4M|#define p 761 ------------------ | Branch (1866:17): [True: 10.4M, False: 13.6k] ------------------ 1867| 10.4M| for (i = 0; i < p + 1; ++i) r[i] = F3_freeze(r[i] + sign * v[i]); ------------------ | | 1694| 10.4M|#define p 761 ------------------ | Branch (1867:17): [True: 10.4M, False: 13.6k] ------------------ 1868| 10.4M| for (i = 0; i < p; ++i) g[i] = g[i + 1]; ------------------ | | 1694| 10.4M|#define p 761 ------------------ | Branch (1868:17): [True: 10.4M, False: 13.6k] ------------------ 1869| 13.6k| g[p] = 0; ------------------ | | 1694| 13.6k|#define p 761 ------------------ 1870| 13.6k| } 1871| 9| sign = f[0]; 1872| 6.85k| for (i = 0; i < p; ++i) out[i] = sign * v[p - 1 - i]; ------------------ | | 1694| 6.85k|#define p 761 ------------------ for (i = 0; i < p; ++i) out[i] = sign * v[p - 1 - i]; ------------------ | | 1694| 6.84k|#define p 761 ------------------ | Branch (1872:15): [True: 6.84k, False: 9] ------------------ 1873| 9| return crypto_int16_nonzero_mask(delta); 1874| 9|} sntrup761.c:crypto_int16_negative_mask: 62| 27.3k|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 63| 27.3k|#if defined(__GNUC__) && defined(__x86_64__) 64| 27.3k| __asm__ ("sarw $15,%0" : "+r"(crypto_int16_x) : : "cc"); 65| 27.3k| return crypto_int16_x; 66| |#elif defined(__GNUC__) && defined(__aarch64__) 67| | crypto_int16 crypto_int16_y; 68| | __asm__ ("sbfx %w0,%w1,15,1" : "=r"(crypto_int16_y) : "r"(crypto_int16_x) : ); 69| | return crypto_int16_y; 70| |#else 71| | crypto_int16_x >>= 16-6; 72| | crypto_int16_x ^= crypto_int16_optblocker; 73| | crypto_int16_x >>= 5; 74| | return crypto_int16_x; 75| |#endif 76| 27.3k|} sntrup761.c:crypto_int16_nonzero_mask: 220| 27.4k|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 221| 27.4k|#if defined(__GNUC__) && defined(__x86_64__) 222| 27.4k| crypto_int16 crypto_int16_q,crypto_int16_z; ------------------ | | 39| 27.4k|#define crypto_int16 int16_t ------------------ 223| 27.4k| __asm__ ("xorw %0,%0\n movw $-1,%1\n testw %2,%2\n cmovnew %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x) : "cc"); 224| 27.4k| return crypto_int16_z; 225| |#elif defined(__GNUC__) && defined(__aarch64__) 226| | crypto_int16 crypto_int16_z; 227| | __asm__ ("tst %w1,65535\n csetm %w0,ne" : "=r"(crypto_int16_z) : "r"(crypto_int16_x) : "cc"); 228| | return crypto_int16_z; 229| |#else 230| | crypto_int16_x |= -crypto_int16_x; 231| | return crypto_int16_negative_mask(crypto_int16_x); 232| |#endif 233| 27.4k|} sntrup761.c:F3_freeze: 1706| 20.8M|static small F3_freeze(int16_t x) { return x - 3 * ((10923 * x + 16384) >> 15); } sntrup761.c:Rq_recip3: 1902| 9|static int Rq_recip3(Fq *out, const small *in) { 1903| 9| Fq f[p + 1], g[p + 1], v[p + 1], r[p + 1], scale; 1904| 9| int swap, t, i, loop, delta = 1; 1905| 9| int32_t f0, g0; 1906| 6.86k| for (i = 0; i < p + 1; ++i) v[i] = 0; ------------------ | | 1694| 6.86k|#define p 761 ------------------ | Branch (1906:15): [True: 6.85k, False: 9] ------------------ 1907| 6.86k| for (i = 0; i < p + 1; ++i) r[i] = 0; ------------------ | | 1694| 6.86k|#define p 761 ------------------ | Branch (1907:15): [True: 6.85k, False: 9] ------------------ 1908| 9| r[0] = Fq_recip(3); 1909| 6.85k| for (i = 0; i < p; ++i) f[i] = 0; ------------------ | | 1694| 6.85k|#define p 761 ------------------ | Branch (1909:15): [True: 6.84k, False: 9] ------------------ 1910| 9| f[0] = 1; 1911| 9| f[p - 1] = f[p] = -1; ------------------ | | 1694| 9|#define p 761 ------------------ f[p - 1] = f[p] = -1; ------------------ | | 1694| 9|#define p 761 ------------------ 1912| 6.85k| for (i = 0; i < p; ++i) g[p - 1 - i] = in[i]; ------------------ | | 1694| 6.85k|#define p 761 ------------------ for (i = 0; i < p; ++i) g[p - 1 - i] = in[i]; ------------------ | | 1694| 6.84k|#define p 761 ------------------ | Branch (1912:15): [True: 6.84k, False: 9] ------------------ 1913| 9| g[p] = 0; ------------------ | | 1694| 9|#define p 761 ------------------ 1914| 13.6k| for (loop = 0; loop < 2 * p - 1; ++loop) { ------------------ | | 1694| 13.6k|#define p 761 ------------------ | Branch (1914:18): [True: 13.6k, False: 9] ------------------ 1915| 10.4M| for (i = p; i > 0; --i) v[i] = v[i - 1]; ------------------ | | 1694| 13.6k|#define p 761 ------------------ | Branch (1915:17): [True: 10.4M, False: 13.6k] ------------------ 1916| 13.6k| v[0] = 0; 1917| 13.6k| swap = crypto_int16_negative_mask(-delta) & crypto_int16_nonzero_mask(g[0]); 1918| 13.6k| delta ^= swap & (delta ^ -delta); 1919| 13.6k| delta += 1; 1920| 10.4M| for (i = 0; i < p + 1; ++i) { ------------------ | | 1694| 10.4M|#define p 761 ------------------ | Branch (1920:17): [True: 10.4M, False: 13.6k] ------------------ 1921| 10.4M| t = swap & (f[i] ^ g[i]); 1922| 10.4M| f[i] ^= t; 1923| 10.4M| g[i] ^= t; 1924| 10.4M| t = swap & (v[i] ^ r[i]); 1925| 10.4M| v[i] ^= t; 1926| 10.4M| r[i] ^= t; 1927| 10.4M| } 1928| 13.6k| f0 = f[0]; 1929| 13.6k| g0 = g[0]; 1930| 10.4M| for (i = 0; i < p + 1; ++i) g[i] = Fq_freeze(f0 * g[i] - g0 * f[i]); ------------------ | | 1694| 10.4M|#define p 761 ------------------ | Branch (1930:17): [True: 10.4M, False: 13.6k] ------------------ 1931| 10.4M| for (i = 0; i < p + 1; ++i) r[i] = Fq_freeze(f0 * r[i] - g0 * v[i]); ------------------ | | 1694| 10.4M|#define p 761 ------------------ | Branch (1931:17): [True: 10.4M, False: 13.6k] ------------------ 1932| 10.4M| for (i = 0; i < p; ++i) g[i] = g[i + 1]; ------------------ | | 1694| 10.4M|#define p 761 ------------------ | Branch (1932:17): [True: 10.4M, False: 13.6k] ------------------ 1933| 13.6k| g[p] = 0; ------------------ | | 1694| 13.6k|#define p 761 ------------------ 1934| 13.6k| } 1935| 9| scale = Fq_recip(f[0]); 1936| 6.85k| for (i = 0; i < p; ++i) out[i] = Fq_freeze(scale * (int32_t)v[p - 1 - i]); ------------------ | | 1694| 6.85k|#define p 761 ------------------ for (i = 0; i < p; ++i) out[i] = Fq_freeze(scale * (int32_t)v[p - 1 - i]); ------------------ | | 1694| 6.84k|#define p 761 ------------------ | Branch (1936:15): [True: 6.84k, False: 9] ------------------ 1937| 9| return crypto_int16_nonzero_mask(delta); 1938| 9|} sntrup761.c:Fq_recip: 1892| 18|static Fq Fq_recip(Fq a1) { 1893| 18| int i = 1; 1894| 18| Fq ai = a1; 1895| 82.6k| while (i < q - 2) { ------------------ | | 1695| 82.6k|#define q 4591 ------------------ | Branch (1895:10): [True: 82.5k, False: 18] ------------------ 1896| 82.5k| ai = Fq_freeze(a1 * (int32_t)ai); 1897| 82.5k| i += 1; 1898| 82.5k| } 1899| 18| return ai; 1900| 18|} sntrup761.c:Fq_freeze: 1708| 20.9M|static Fq Fq_freeze(int32_t x) { 1709| 20.9M| const int32_t q16 = (0x10000 + q / 2) / q; ------------------ | | 1695| 20.9M|#define q 4591 ------------------ const int32_t q16 = (0x10000 + q / 2) / q; ------------------ | | 1695| 20.9M|#define q 4591 ------------------ 1710| 20.9M| const int32_t q20 = (0x100000 + q / 2) / q; ------------------ | | 1695| 20.9M|#define q 4591 ------------------ const int32_t q20 = (0x100000 + q / 2) / q; ------------------ | | 1695| 20.9M|#define q 4591 ------------------ 1711| 20.9M| const int32_t q28 = (0x10000000 + q / 2) / q; ------------------ | | 1695| 20.9M|#define q 4591 ------------------ const int32_t q28 = (0x10000000 + q / 2) / q; ------------------ | | 1695| 20.9M|#define q 4591 ------------------ 1712| 20.9M| x -= q * ((q16 * x) >> 16); ------------------ | | 1695| 20.9M|#define q 4591 ------------------ 1713| 20.9M| x -= q * ((q20 * x) >> 20); ------------------ | | 1695| 20.9M|#define q 4591 ------------------ 1714| 20.9M| return x - q * ((q28 * x + 0x8000000) >> 28); ------------------ | | 1695| 20.9M|#define q 4591 ------------------ 1715| 20.9M|} sntrup761.c:Rq_mult_small: 1876| 36|static void Rq_mult_small(Fq *h, const Fq *f, const small *g) { 1877| 36| int32_t fg[p + p - 1]; 1878| 36| int i, j; 1879| 54.7k| for (i = 0; i < p + p - 1; ++i) fg[i] = 0; ------------------ | | 1694| 54.7k|#define p 761 ------------------ for (i = 0; i < p + p - 1; ++i) fg[i] = 0; ------------------ | | 1694| 54.7k|#define p 761 ------------------ | Branch (1879:15): [True: 54.7k, False: 36] ------------------ 1880| 27.4k| for (i = 0; i < p; ++i) ------------------ | | 1694| 27.4k|#define p 761 ------------------ | Branch (1880:15): [True: 27.3k, False: 36] ------------------ 1881| 20.8M| for (j = 0; j < p; ++j) fg[i + j] += f[i] * (int32_t)g[j]; ------------------ | | 1694| 20.8M|#define p 761 ------------------ | Branch (1881:17): [True: 20.8M, False: 27.3k] ------------------ 1882| 27.3k| for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 36|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 27.3k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 27.3k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 27.3k|#define p 761 ------------------ | Branch (1882:15): [True: 27.3k, False: 36] ------------------ 1883| 27.3k| for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 36|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 27.3k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 27.3k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 27.3k|#define p 761 ------------------ | Branch (1883:15): [True: 27.3k, False: 36] ------------------ 1884| 27.4k| for (i = 0; i < p; ++i) h[i] = Fq_freeze(fg[i]); ------------------ | | 1694| 27.4k|#define p 761 ------------------ | Branch (1884:15): [True: 27.3k, False: 36] ------------------ 1885| 36|} sntrup761.c:Rq_encode: 2030| 9|static void Rq_encode(unsigned char *s, const Fq *r) { 2031| 9| uint16_t R[p], M[p]; 2032| 9| int i; 2033| 6.85k| for (i = 0; i < p; ++i) R[i] = r[i] + q12; ------------------ | | 1694| 6.85k|#define p 761 ------------------ for (i = 0; i < p; ++i) R[i] = r[i] + q12; ------------------ | | 1697| 6.84k|#define q12 ((q - 1) / 2) | | ------------------ | | | | 1695| 6.84k|#define q 4591 | | ------------------ ------------------ | Branch (2033:15): [True: 6.84k, False: 9] ------------------ 2034| 6.85k| for (i = 0; i < p; ++i) M[i] = q; ------------------ | | 1694| 6.85k|#define p 761 ------------------ for (i = 0; i < p; ++i) M[i] = q; ------------------ | | 1695| 6.84k|#define q 4591 ------------------ | Branch (2034:15): [True: 6.84k, False: 9] ------------------ 2035| 9| Encode(s, R, M, p); ------------------ | | 1694| 9|#define p 761 ------------------ 2036| 9|} sntrup761.c:Encode: 1746| 297|static void Encode(unsigned char *out, const uint16_t *R, const uint16_t *M, long long len) { 1747| 297| if (len == 1) { ------------------ | Branch (1747:7): [True: 27, False: 270] ------------------ 1748| 27| uint16_t r = R[0], m = M[0]; 1749| 81| while (m > 1) { ------------------ | Branch (1749:12): [True: 54, False: 27] ------------------ 1750| 54| *out++ = r; 1751| 54| r >>= 8; 1752| 54| m = (m + 255) >> 8; 1753| 54| } 1754| 27| } 1755| 297| if (len > 1) { ------------------ | Branch (1755:7): [True: 270, False: 27] ------------------ 1756| 270| uint16_t *R2 = (uint16_t *)alloca(sizeof(uint16_t) * ((len + 1) / 2)), *M2 = (uint16_t *)alloca(sizeof(uint16_t) * ((len + 1) / 2)); 1757| 270| long long i; 1758| 20.7k| for (i = 0; i < len - 1; i += 2) { ------------------ | Branch (1758:17): [True: 20.5k, False: 270] ------------------ 1759| 20.5k| uint32_t m0 = M[i]; 1760| 20.5k| uint32_t r = R[i] + R[i + 1] * m0; 1761| 20.5k| uint32_t m = M[i + 1] * m0; 1762| 49.0k| while (m >= 16384) { ------------------ | Branch (1762:14): [True: 28.4k, False: 20.5k] ------------------ 1763| 28.4k| *out++ = r; 1764| 28.4k| r >>= 8; 1765| 28.4k| m = (m + 255) >> 8; 1766| 28.4k| } 1767| 20.5k| R2[i / 2] = r; 1768| 20.5k| M2[i / 2] = m; 1769| 20.5k| } 1770| 270| if (i < len) { ------------------ | Branch (1770:9): [True: 108, False: 162] ------------------ 1771| 108| R2[i / 2] = R[i]; 1772| 108| M2[i / 2] = M[i]; 1773| 108| } 1774| 270| Encode(out, R2, M2, (len + 1) / 2); 1775| 270| } 1776| 297|} sntrup761.c:Small_encode: 2011| 36|static void Small_encode(unsigned char *s, const small *f) { 2012| 36| int i, j; 2013| 6.87k| for (i = 0; i < p / 4; ++i) { ------------------ | | 1694| 6.87k|#define p 761 ------------------ | Branch (2013:15): [True: 6.84k, False: 36] ------------------ 2014| 6.84k| small x = 0; 2015| 34.2k| for (j = 0;j < 4;++j) x += (*f++ + 1) << (2 * j); ------------------ | Branch (2015:16): [True: 27.3k, False: 6.84k] ------------------ 2016| 6.84k| *s++ = x; 2017| 6.84k| } 2018| 36| *s = *f++ + 1; 2019| 36|} sntrup761.c:Hash_prefix: 1954| 90|static void Hash_prefix(unsigned char *out, int b, const unsigned char *in, int inlen) { 1955| 90| unsigned char *x = (unsigned char *)alloca(inlen + 1), h[64]; 1956| 90| int i; 1957| 90| x[0] = b; 1958| 48.2k| for (i = 0; i < inlen; ++i) x[i + 1] = in[i]; ------------------ | Branch (1958:15): [True: 48.1k, False: 90] ------------------ 1959| 90| crypto_hash_sha512(h, x, inlen + 1); ------------------ | | 9| 90|#define crypto_hash_sha512 OQS_SHA2_sha512 ------------------ 1960| 2.97k| for (i = 0; i < 32; ++i) out[i] = h[i]; ------------------ | Branch (1960:15): [True: 2.88k, False: 90] ------------------ 1961| 90|} sntrup761.c:Short_random: 1964| 18|static void Short_random(small *out) { 1965| 18| uint32_t L[p]; 1966| 18| randombytes(L, sizeof(L)); ------------------ | | 10| 18|#define randombytes(buf,len) OQS_randombytes((uint8_t *)(buf),(len)) ------------------ 1967| 18| Short_fromlist(out, L); 1968| 18| explicit_bzero(L, sizeof(L)); ------------------ | | 14| 18|#define explicit_bzero OQS_MEM_cleanse ------------------ 1969| 18|} sntrup761.c:Short_fromlist: 1945| 18|static void Short_fromlist(small *out, const uint32_t *in) { 1946| 18| uint32_t L[p]; 1947| 18| int i; 1948| 5.16k| for (i = 0; i < w; ++i) L[i] = in[i] & (uint32_t)-2; ------------------ | | 1696| 5.16k|#define w 286 ------------------ | Branch (1948:15): [True: 5.14k, False: 18] ------------------ 1949| 8.56k| for (i = w; i < p; ++i) L[i] = (in[i] & (uint32_t)-3) | 1; ------------------ | | 1696| 18|#define w 286 ------------------ for (i = w; i < p; ++i) L[i] = (in[i] & (uint32_t)-3) | 1; ------------------ | | 1694| 8.56k|#define p 761 ------------------ | Branch (1949:15): [True: 8.55k, False: 18] ------------------ 1950| 18| crypto_sort_uint32(L, p); ------------------ | | 1694| 18|#define p 761 ------------------ 1951| 13.7k| for (i = 0; i < p; ++i) out[i] = (L[i] & 3) - 1; ------------------ | | 1694| 13.7k|#define p 761 ------------------ | Branch (1951:15): [True: 13.6k, False: 18] ------------------ 1952| 18|} sntrup761.c:crypto_sort_uint32: 1683| 18|{ 1684| 18| crypto_uint32 *x = array; ------------------ | | 6| 18|#define crypto_uint32 uint32_t ------------------ 1685| 18| long long j; 1686| 13.7k| for (j = 0;j < n;++j) x[j] ^= 0x80000000; ------------------ | Branch (1686:14): [True: 13.6k, False: 18] ------------------ 1687| 18| crypto_sort_int32(array,n); 1688| 13.7k| for (j = 0;j < n;++j) x[j] ^= 0x80000000; ------------------ | Branch (1688:14): [True: 13.6k, False: 18] ------------------ 1689| 18|} sntrup761.c:crypto_sort_int32: 1620| 18|{ 1621| 18| long long top,p,q,r,i,j; 1622| 18| int32 *x = array; ------------------ | | 24| 18|#define int32 crypto_int32 | | ------------------ | | | | 562| 18|#define crypto_int32 int32_t | | ------------------ ------------------ 1623| | 1624| 18| if (n < 2) return; ------------------ | Branch (1624:7): [True: 0, False: 18] ------------------ 1625| 18| top = 1; 1626| 180| while (top < n - top) top += top; ------------------ | Branch (1626:10): [True: 162, False: 18] ------------------ 1627| | 1628| 198| for (p = top;p >= 1;p >>= 1) { ------------------ | Branch (1628:16): [True: 180, False: 18] ------------------ 1629| 180| i = 0; 1630| 13.7k| while (i + 2 * p <= n) { ------------------ | Branch (1630:12): [True: 13.5k, False: 180] ------------------ 1631| 68.7k| for (j = i;j < i + p;++j) ------------------ | Branch (1631:18): [True: 55.2k, False: 13.5k] ------------------ 1632| 55.2k| int32_MINMAX(x[j],x[j+p]); ------------------ | | 1617| 55.2k|#define int32_MINMAX(a,b) crypto_int32_minmax(&a,&b) ------------------ 1633| 13.5k| i += 2 * p; 1634| 13.5k| } 1635| 8.49k| for (j = i;j < n - p;++j) ------------------ | Branch (1635:16): [True: 8.31k, False: 180] ------------------ 1636| 8.31k| int32_MINMAX(x[j],x[j+p]); ------------------ | | 1617| 8.31k|#define int32_MINMAX(a,b) crypto_int32_minmax(&a,&b) ------------------ 1637| | 1638| 180| i = 0; 1639| 180| j = 0; 1640| 990| for (q = top;q > p;q >>= 1) { ------------------ | Branch (1640:18): [True: 810, False: 180] ------------------ 1641| 810| if (j != i) for (;;) { ------------------ | Branch (1641:11): [True: 234, False: 576] ------------------ 1642| 450| if (j == n - q) goto done; ------------------ | Branch (1642:13): [True: 0, False: 450] ------------------ 1643| 450| int32 a = x[j + p]; ------------------ | | 24| 450|#define int32 crypto_int32 | | ------------------ | | | | 562| 450|#define crypto_int32 int32_t | | ------------------ ------------------ 1644| 2.08k| for (r = q;r > p;r >>= 1) ------------------ | Branch (1644:20): [True: 1.63k, False: 450] ------------------ 1645| 1.63k| int32_MINMAX(a,x[j + r]); ------------------ | | 1617| 2.08k|#define int32_MINMAX(a,b) crypto_int32_minmax(&a,&b) ------------------ 1646| 450| x[j + p] = a; 1647| 450| ++j; 1648| 450| if (j == i + p) { ------------------ | Branch (1648:13): [True: 234, False: 216] ------------------ 1649| 234| i += 2 * p; 1650| 234| break; 1651| 234| } 1652| 450| } 1653| 14.0k| while (i + p <= n - q) { ------------------ | Branch (1653:14): [True: 13.2k, False: 810] ------------------ 1654| 63.1k| for (j = i;j < i + p;++j) { ------------------ | Branch (1654:20): [True: 49.8k, False: 13.2k] ------------------ 1655| 49.8k| int32 a = x[j + p]; ------------------ | | 24| 49.8k|#define int32 crypto_int32 | | ------------------ | | | | 562| 49.8k|#define crypto_int32 int32_t | | ------------------ ------------------ 1656| 280k| for (r = q;r > p;r >>= 1) ------------------ | Branch (1656:22): [True: 230k, False: 49.8k] ------------------ 1657| 230k| int32_MINMAX(a,x[j+r]); ------------------ | | 1617| 230k|#define int32_MINMAX(a,b) crypto_int32_minmax(&a,&b) ------------------ 1658| 49.8k| x[j + p] = a; 1659| 49.8k| } 1660| 13.2k| i += 2 * p; 1661| 13.2k| } 1662| | /* now i + p > n - q */ 1663| 810| j = i; 1664| 5.56k| while (j < n - q) { ------------------ | Branch (1664:14): [True: 4.75k, False: 810] ------------------ 1665| 4.75k| int32 a = x[j + p]; ------------------ | | 24| 4.75k|#define int32 crypto_int32 | | ------------------ | | | | 562| 4.75k|#define crypto_int32 int32_t | | ------------------ ------------------ 1666| 10.3k| for (r = q;r > p;r >>= 1) ------------------ | Branch (1666:20): [True: 5.63k, False: 4.75k] ------------------ 1667| 5.63k| int32_MINMAX(a,x[j+r]); ------------------ | | 1617| 5.63k|#define int32_MINMAX(a,b) crypto_int32_minmax(&a,&b) ------------------ 1668| 4.75k| x[j + p] = a; 1669| 4.75k| ++j; 1670| 4.75k| } 1671| | 1672| 810| done: ; 1673| 810| } 1674| 180| } 1675| 18|} sntrup761.c:crypto_int32_minmax: 949| 301k|void crypto_int32_minmax(crypto_int32 *crypto_int32_p,crypto_int32 *crypto_int32_q) { 950| 301k| crypto_int32 crypto_int32_x = *crypto_int32_p; ------------------ | | 562| 301k|#define crypto_int32 int32_t ------------------ 951| 301k| crypto_int32 crypto_int32_y = *crypto_int32_q; ------------------ | | 562| 301k|#define crypto_int32 int32_t ------------------ 952| 301k|#if defined(__GNUC__) && defined(__x86_64__) 953| 301k| crypto_int32 crypto_int32_z; ------------------ | | 562| 301k|#define crypto_int32 int32_t ------------------ 954| 301k| __asm__ ("cmpl %2,%1\n movl %1,%0\n cmovgl %2,%1\n cmovgl %0,%2" : "=&r"(crypto_int32_z), "+&r"(crypto_int32_x), "+r"(crypto_int32_y) : : "cc"); 955| 301k| *crypto_int32_p = crypto_int32_x; 956| 301k| *crypto_int32_q = crypto_int32_y; 957| |#elif defined(__GNUC__) && defined(__aarch64__) 958| | crypto_int32 crypto_int32_r, crypto_int32_s; 959| | __asm__ ("cmp %w2,%w3\n csel %w0,%w2,%w3,lt\n csel %w1,%w3,%w2,lt" : "=&r"(crypto_int32_r), "=r"(crypto_int32_s) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); 960| | *crypto_int32_p = crypto_int32_r; 961| | *crypto_int32_q = crypto_int32_s; 962| |#else 963| | crypto_int64 crypto_int32_r = (crypto_int64)crypto_int32_y ^ (crypto_int64)crypto_int32_x; 964| | crypto_int64 crypto_int32_z = (crypto_int64)crypto_int32_y - (crypto_int64)crypto_int32_x; 965| | crypto_int32_z ^= crypto_int32_r & (crypto_int32_z ^ crypto_int32_y); 966| | crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); 967| | crypto_int32_z &= crypto_int32_r; 968| | crypto_int32_x ^= crypto_int32_z; 969| | crypto_int32_y ^= crypto_int32_z; 970| | *crypto_int32_p = crypto_int32_x; 971| | *crypto_int32_q = crypto_int32_y; 972| |#endif 973| 301k|} sntrup761.c:Hide: 2113| 18|static void Hide(unsigned char *c, unsigned char *r_enc, const Inputs r, const unsigned char *pk, const unsigned char *cache) { 2114| 18| Small_encode(r_enc, r); 2115| 18| ZEncrypt(c, r, pk); 2116| 18| HashConfirm(c + crypto_kem_sntrup761_CIPHERTEXTBYTES - Confirm_bytes, r_enc, cache); ------------------ | | 6| 18|#define crypto_kem_sntrup761_CIPHERTEXTBYTES 1039 ------------------ HashConfirm(c + crypto_kem_sntrup761_CIPHERTEXTBYTES - Confirm_bytes, r_enc, cache); ------------------ | | 1704| 18|#define Confirm_bytes 32 ------------------ 2117| 18|} sntrup761.c:ZEncrypt: 2071| 18|static void ZEncrypt(unsigned char *C, const Inputs r, const unsigned char *pk) { 2072| 18| Fq h[p], c[p]; 2073| 18| Rq_decode(h, pk); 2074| 18| Encrypt(c, r, h); 2075| 18| Rounded_encode(C, c); 2076| 18|} sntrup761.c:Rq_decode: 2038| 18|static void Rq_decode(Fq *r, const unsigned char *s) { 2039| 18| uint16_t R[p], M[p]; 2040| 18| int i; 2041| 13.7k| for (i = 0; i < p; ++i) M[i] = q; ------------------ | | 1694| 13.7k|#define p 761 ------------------ for (i = 0; i < p; ++i) M[i] = q; ------------------ | | 1695| 13.6k|#define q 4591 ------------------ | Branch (2041:15): [True: 13.6k, False: 18] ------------------ 2042| 18| Decode(R, s, M, p); ------------------ | | 1694| 18|#define p 761 ------------------ 2043| 13.7k| for (i = 0; i < p; ++i) r[i] = ((Fq)R[i]) - q12; ------------------ | | 1694| 13.7k|#define p 761 ------------------ for (i = 0; i < p; ++i) r[i] = ((Fq)R[i]) - q12; ------------------ | | 1697| 13.6k|#define q12 ((q - 1) / 2) | | ------------------ | | | | 1695| 13.6k|#define q 4591 | | ------------------ ------------------ | Branch (2043:15): [True: 13.6k, False: 18] ------------------ 2044| 18|} sntrup761.c:Decode: 1778| 297|static void Decode(uint16_t *out, const unsigned char *S, const uint16_t *M, long long len) { 1779| 297| if (len == 1) { ------------------ | Branch (1779:7): [True: 27, False: 270] ------------------ 1780| 27| if (M[0] == 1) ------------------ | Branch (1780:9): [True: 0, False: 27] ------------------ 1781| 0| *out = 0; 1782| 27| else if (M[0] <= 256) ------------------ | Branch (1782:14): [True: 0, False: 27] ------------------ 1783| 0| *out = uint32_mod_uint14(S[0], M[0]); 1784| 27| else 1785| 27| *out = uint32_mod_uint14(S[0] + (((uint16_t)S[1]) << 8), M[0]); 1786| 27| } 1787| 297| if (len > 1) { ------------------ | Branch (1787:7): [True: 270, False: 27] ------------------ 1788| 270| uint16_t *R2 = (uint16_t *)alloca(sizeof(uint16_t) * ((len + 1) / 2)), *M2 = (uint16_t *)alloca(sizeof(uint16_t) * ((len + 1) / 2)), *bottomr = (uint16_t *)alloca(sizeof(uint16_t) * (len / 2)); 1789| 270| uint32_t *bottomt = (uint32_t *)alloca(sizeof(uint32_t) * (len / 2)); 1790| 270| long long i; 1791| 20.7k| for (i = 0; i < len - 1; i += 2) { ------------------ | Branch (1791:17): [True: 20.5k, False: 270] ------------------ 1792| 20.5k| uint32_t m = M[i] * (uint32_t)M[i + 1]; 1793| 20.5k| if (m > 256 * 16383) { ------------------ | Branch (1793:11): [True: 9.33k, False: 11.1k] ------------------ 1794| 9.33k| bottomt[i / 2] = 256 * 256; 1795| 9.33k| bottomr[i / 2] = S[0] + 256 * S[1]; 1796| 9.33k| S += 2; 1797| 9.33k| M2[i / 2] = (((m + 255) >> 8) + 255) >> 8; 1798| 11.1k| } else if (m >= 16384) { ------------------ | Branch (1798:18): [True: 11.1k, False: 0] ------------------ 1799| 11.1k| bottomt[i / 2] = 256; 1800| 11.1k| bottomr[i / 2] = S[0]; 1801| 11.1k| S += 1; 1802| 11.1k| M2[i / 2] = (m + 255) >> 8; 1803| 11.1k| } else { 1804| 0| bottomt[i / 2] = 1; 1805| 0| bottomr[i / 2] = 0; 1806| 0| M2[i / 2] = m; 1807| 0| } 1808| 20.5k| } 1809| 270| if (i < len) M2[i / 2] = M[i]; ------------------ | Branch (1809:9): [True: 108, False: 162] ------------------ 1810| 270| Decode(R2, S, M2, (len + 1) / 2); 1811| 20.7k| for (i = 0; i < len - 1; i += 2) { ------------------ | Branch (1811:17): [True: 20.5k, False: 270] ------------------ 1812| 20.5k| uint32_t r1, r = bottomr[i / 2]; 1813| 20.5k| uint16_t r0; 1814| 20.5k| r += bottomt[i / 2] * R2[i / 2]; 1815| 20.5k| uint32_divmod_uint14(&r1, &r0, r, M[i]); 1816| 20.5k| r1 = uint32_mod_uint14(r1, M[i + 1]); 1817| 20.5k| *out++ = r0; 1818| 20.5k| *out++ = r1; 1819| 20.5k| } 1820| 270| if (i < len) *out++ = R2[i / 2]; ------------------ | Branch (1820:9): [True: 108, False: 162] ------------------ 1821| 270| } 1822| 297|} sntrup761.c:uint32_mod_uint14: 1739| 20.5k|static uint16_t uint32_mod_uint14(uint32_t x, uint16_t m) { 1740| 20.5k| uint32_t Q; 1741| 20.5k| uint16_t r; 1742| 20.5k| uint32_divmod_uint14(&Q, &r, x, m); 1743| 20.5k| return r; 1744| 20.5k|} sntrup761.c:uint32_divmod_uint14: 1723| 41.0k|static void uint32_divmod_uint14(uint32_t *Q, uint16_t *r, uint32_t x, uint16_t m) { 1724| 41.0k| uint32_t qpart, mask, v = 0x80000000 / m; 1725| 41.0k| qpart = (x * (uint64_t)v) >> 31; 1726| 41.0k| x -= qpart * m; 1727| 41.0k| *Q = qpart; 1728| 41.0k| qpart = (x * (uint64_t)v) >> 31; 1729| 41.0k| x -= qpart * m; 1730| 41.0k| *Q += qpart; 1731| 41.0k| x -= m; 1732| 41.0k| *Q += 1; 1733| 41.0k| mask = crypto_int32_negative_mask(x); 1734| 41.0k| x += mask & (uint32_t)m; 1735| 41.0k| *Q += mask; 1736| 41.0k| *r = x; 1737| 41.0k|} sntrup761.c:crypto_int32_negative_mask: 589| 41.0k|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 590| 41.0k|#if defined(__GNUC__) && defined(__x86_64__) 591| 41.0k| __asm__ ("sarl $31,%0" : "+r"(crypto_int32_x) : : "cc"); 592| 41.0k| return crypto_int32_x; 593| |#elif defined(__GNUC__) && defined(__aarch64__) 594| | crypto_int32 crypto_int32_y; 595| | __asm__ ("asr %w0,%w1,31" : "=r"(crypto_int32_y) : "r"(crypto_int32_x) : ); 596| | return crypto_int32_y; 597| |#else 598| | crypto_int32_x >>= 32-6; 599| | crypto_int32_x ^= crypto_int32_optblocker; 600| | crypto_int32_x >>= 5; 601| | return crypto_int32_x; 602| |#endif 603| 41.0k|} sntrup761.c:Encrypt: 1992| 18|static void Encrypt(Fq *c, const small *r, const Fq *h) { 1993| 18| Fq hr[p]; 1994| 18| Rq_mult_small(hr, h, r); 1995| 18| Round(c, hr); 1996| 18|} sntrup761.c:Round: 1940| 18|static void Round(Fq *out, const Fq *a) { 1941| 18| int i; 1942| 13.7k| for (i = 0; i < p; ++i) out[i] = a[i] - F3_freeze(a[i]); ------------------ | | 1694| 13.7k|#define p 761 ------------------ | Branch (1942:15): [True: 13.6k, False: 18] ------------------ 1943| 18|} sntrup761.c:Rounded_encode: 2046| 18|static void Rounded_encode(unsigned char *s, const Fq *r) { 2047| 18| uint16_t R[p], M[p]; 2048| 18| int i; 2049| 13.7k| for (i = 0; i < p; ++i) R[i] = ((r[i] + q12) * 10923) >> 15; ------------------ | | 1694| 13.7k|#define p 761 ------------------ for (i = 0; i < p; ++i) R[i] = ((r[i] + q12) * 10923) >> 15; ------------------ | | 1697| 13.6k|#define q12 ((q - 1) / 2) | | ------------------ | | | | 1695| 13.6k|#define q 4591 | | ------------------ ------------------ | Branch (2049:15): [True: 13.6k, False: 18] ------------------ 2050| 13.7k| for (i = 0; i < p; ++i) M[i] = (q + 2) / 3; ------------------ | | 1694| 13.7k|#define p 761 ------------------ for (i = 0; i < p; ++i) M[i] = (q + 2) / 3; ------------------ | | 1695| 13.6k|#define q 4591 ------------------ | Branch (2050:15): [True: 13.6k, False: 18] ------------------ 2051| 18| Encode(s, R, M, p); ------------------ | | 1694| 18|#define p 761 ------------------ 2052| 18|} sntrup761.c:HashConfirm: 2087| 18|static void HashConfirm(unsigned char *h, const unsigned char *r, const unsigned char *cache) { 2088| 18| unsigned char x[Hash_bytes * 2]; 2089| 18| int i; 2090| 18| Hash_prefix(x, 3, r, Small_bytes); ------------------ | | 1701| 18|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 18|#define p 761 | | ------------------ ------------------ 2091| 594| for (i = 0; i < Hash_bytes; ++i) x[Hash_bytes + i] = cache[i]; ------------------ | | 1700| 594|#define Hash_bytes 32 ------------------ for (i = 0; i < Hash_bytes; ++i) x[Hash_bytes + i] = cache[i]; ------------------ | | 1700| 576|#define Hash_bytes 32 ------------------ | Branch (2091:15): [True: 576, False: 18] ------------------ 2092| 18| Hash_prefix(h, 2, x, sizeof x); 2093| 18|} sntrup761.c:HashSession: 2095| 18|static void HashSession(unsigned char *k, int b, const unsigned char *y, const unsigned char *z) { 2096| 18| unsigned char x[Hash_bytes + crypto_kem_sntrup761_CIPHERTEXTBYTES]; 2097| 18| int i; 2098| 18| Hash_prefix(x, 3, y, Small_bytes); ------------------ | | 1701| 18|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 18|#define p 761 | | ------------------ ------------------ 2099| 18.7k| for (i = 0; i < crypto_kem_sntrup761_CIPHERTEXTBYTES; ++i) x[Hash_bytes + i] = z[i]; ------------------ | | 6| 18.7k|#define crypto_kem_sntrup761_CIPHERTEXTBYTES 1039 ------------------ for (i = 0; i < crypto_kem_sntrup761_CIPHERTEXTBYTES; ++i) x[Hash_bytes + i] = z[i]; ------------------ | | 1700| 18.7k|#define Hash_bytes 32 ------------------ | Branch (2099:15): [True: 18.7k, False: 18] ------------------ 2100| 18| Hash_prefix(k, b, x, sizeof x); 2101| 18|} sntrup761.c:ZDecrypt: 2078| 9|static void ZDecrypt(Inputs r, const unsigned char *C, const unsigned char *sk) { 2079| 9| small f[p], v[p]; 2080| 9| Fq c[p]; 2081| 9| Small_decode(f, sk); 2082| 9| Small_decode(v, sk + Small_bytes); ------------------ | | 1701| 9|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 9|#define p 761 | | ------------------ ------------------ 2083| 9| Rounded_decode(c, C); 2084| 9| Decrypt(r, c, f, v); 2085| 9|} sntrup761.c:Small_decode: 2021| 18|static void Small_decode(small *f, const unsigned char *s) { 2022| 18| int i, j; 2023| 3.43k| for (i = 0; i < p / 4; ++i) { ------------------ | | 1694| 3.43k|#define p 761 ------------------ | Branch (2023:15): [True: 3.42k, False: 18] ------------------ 2024| 3.42k| unsigned char x = *s++; 2025| 17.1k| for (j = 0;j < 4;++j) *f++ = ((small)((x >> (2 * j)) & 3)) - 1; ------------------ | Branch (2025:16): [True: 13.6k, False: 3.42k] ------------------ 2026| 3.42k| } 2027| 18| *f++ = ((small)(*s & 3)) - 1; 2028| 18|} sntrup761.c:Rounded_decode: 2054| 9|static void Rounded_decode(Fq *r, const unsigned char *s) { 2055| 9| uint16_t R[p], M[p]; 2056| 9| int i; 2057| 6.85k| for (i = 0; i < p; ++i) M[i] = (q + 2) / 3; ------------------ | | 1694| 6.85k|#define p 761 ------------------ for (i = 0; i < p; ++i) M[i] = (q + 2) / 3; ------------------ | | 1695| 6.84k|#define q 4591 ------------------ | Branch (2057:15): [True: 6.84k, False: 9] ------------------ 2058| 9| Decode(R, s, M, p); ------------------ | | 1694| 9|#define p 761 ------------------ 2059| 6.85k| for (i = 0; i < p; ++i) r[i] = R[i] * 3 - q12; ------------------ | | 1694| 6.85k|#define p 761 ------------------ for (i = 0; i < p; ++i) r[i] = R[i] * 3 - q12; ------------------ | | 1697| 6.84k|#define q12 ((q - 1) / 2) | | ------------------ | | | | 1695| 6.84k|#define q 4591 | | ------------------ ------------------ | Branch (2059:15): [True: 6.84k, False: 9] ------------------ 2060| 9|} sntrup761.c:Decrypt: 1998| 9|static void Decrypt(small *r, const Fq *c, const small *f, const small *ginv) { 1999| 9| Fq cf[p], cf3[p]; 2000| 9| small e[p], ev[p]; 2001| 9| int mask, i; 2002| 9| Rq_mult_small(cf, c, f); 2003| 9| Rq_mult3(cf3, cf); 2004| 9| R3_fromRq(e, cf3); 2005| 9| R3_mult(ev, e, ginv); 2006| 9| mask = Weightw_mask(ev); 2007| 2.58k| for (i = 0; i < w; ++i) r[i] = ((ev[i] ^ 1) & ~mask) ^ 1; ------------------ | | 1696| 2.58k|#define w 286 ------------------ | Branch (2007:15): [True: 2.57k, False: 9] ------------------ 2008| 4.28k| for (i = w; i < p; ++i) r[i] = ev[i] & ~mask; ------------------ | | 1696| 9|#define w 286 ------------------ for (i = w; i < p; ++i) r[i] = ev[i] & ~mask; ------------------ | | 1694| 4.28k|#define p 761 ------------------ | Branch (2008:15): [True: 4.27k, False: 9] ------------------ 2009| 9|} sntrup761.c:Rq_mult3: 1887| 9|static void Rq_mult3(Fq *h, const Fq *f) { 1888| 9| int i; 1889| 6.85k| for (i = 0; i < p; ++i) h[i] = Fq_freeze(3 * f[i]); ------------------ | | 1694| 6.85k|#define p 761 ------------------ | Branch (1889:15): [True: 6.84k, False: 9] ------------------ 1890| 9|} sntrup761.c:R3_fromRq: 1824| 9|static void R3_fromRq(small *out, const Fq *r) { 1825| 9| int i; 1826| 6.85k| for (i = 0; i < p; ++i) out[i] = F3_freeze(r[i]); ------------------ | | 1694| 6.85k|#define p 761 ------------------ | Branch (1826:15): [True: 6.84k, False: 9] ------------------ 1827| 9|} sntrup761.c:R3_mult: 1829| 9|static void R3_mult(small *h, const small *f, const small *g) { 1830| 9| int16_t fg[p + p - 1]; 1831| 9| int i, j; 1832| 13.6k| for (i = 0; i < p + p - 1; ++i) fg[i] = 0; ------------------ | | 1694| 13.6k|#define p 761 ------------------ for (i = 0; i < p + p - 1; ++i) fg[i] = 0; ------------------ | | 1694| 13.6k|#define p 761 ------------------ | Branch (1832:15): [True: 13.6k, False: 9] ------------------ 1833| 6.85k| for (i = 0; i < p; ++i) ------------------ | | 1694| 6.85k|#define p 761 ------------------ | Branch (1833:15): [True: 6.84k, False: 9] ------------------ 1834| 5.21M| for (j = 0; j < p; ++j) fg[i + j] += f[i] * (int16_t)g[j]; ------------------ | | 1694| 5.21M|#define p 761 ------------------ | Branch (1834:17): [True: 5.21M, False: 6.84k] ------------------ 1835| 6.84k| for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 9|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 6.84k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 6.84k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 6.84k|#define p 761 ------------------ | Branch (1835:15): [True: 6.84k, False: 9] ------------------ 1836| 6.84k| for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 9|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 6.84k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 6.84k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 6.84k|#define p 761 ------------------ | Branch (1836:15): [True: 6.84k, False: 9] ------------------ 1837| 6.85k| for (i = 0; i < p; ++i) h[i] = F3_freeze(fg[i]); ------------------ | | 1694| 6.85k|#define p 761 ------------------ | Branch (1837:15): [True: 6.84k, False: 9] ------------------ 1838| 9|} sntrup761.c:Weightw_mask: 1717| 9|static int Weightw_mask(small *r) { 1718| 9| int i, weight = 0; 1719| 6.85k| for (i = 0; i < p; ++i) weight += crypto_int64_bottombit_01(r[i]); ------------------ | | 1694| 6.85k|#define p 761 ------------------ | Branch (1719:15): [True: 6.84k, False: 9] ------------------ 1720| 9| return crypto_int16_nonzero_mask(weight - w); ------------------ | | 1696| 9|#define w 286 ------------------ 1721| 9|} sntrup761.c:crypto_int64_bottombit_01: 1193| 6.85k|crypto_int64 crypto_int64_bottombit_01(crypto_int64 crypto_int64_x) { 1194| 6.85k|#if defined(__GNUC__) && defined(__x86_64__) 1195| 6.85k| __asm__ ("andq $1,%0" : "+r"(crypto_int64_x) : : "cc"); 1196| 6.85k| return crypto_int64_x; 1197| |#elif defined(__GNUC__) && defined(__aarch64__) 1198| | crypto_int64 crypto_int64_y; 1199| | __asm__ ("ubfx %0,%1,0,1" : "=r"(crypto_int64_y) : "r"(crypto_int64_x) : ); 1200| | return crypto_int64_y; 1201| |#else 1202| | crypto_int64_x &= 1 ^ crypto_int64_optblocker; 1203| | return crypto_int64_x; 1204| |#endif 1205| 6.85k|} sntrup761.c:Ciphertexts_diff_mask: 2129| 9|static int Ciphertexts_diff_mask(const unsigned char *c, const unsigned char *c2) { 2130| 9| uint16_t differentbits = 0; 2131| 9| int len = crypto_kem_sntrup761_CIPHERTEXTBYTES; ------------------ | | 6| 9|#define crypto_kem_sntrup761_CIPHERTEXTBYTES 1039 ------------------ 2132| 9.36k| while (len-- > 0) differentbits |= (*c++) ^ (*c2++); ------------------ | Branch (2132:10): [True: 9.35k, False: 9] ------------------ 2133| 9| return (crypto_int64_bitmod_01((differentbits - 1),8)) - 1; 2134| 9|} sntrup761.c:crypto_int64_bitmod_01: 1272| 9|crypto_int64 crypto_int64_bitmod_01(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_s) { 1273| 9| crypto_int64_x = crypto_int64_shrmod(crypto_int64_x,crypto_int64_s); 1274| 9| return crypto_int64_bottombit_01(crypto_int64_x); 1275| 9|} sntrup761.c:crypto_int64_shrmod: 1250| 9|crypto_int64 crypto_int64_shrmod(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_s) { 1251| 9|#if defined(__GNUC__) && defined(__x86_64__) 1252| 9| __asm__ ("sarq %%cl,%0" : "+r"(crypto_int64_x) : "c"(crypto_int64_s) : "cc"); 1253| |#elif defined(__GNUC__) && defined(__aarch64__) 1254| | __asm__ ("asr %0,%0,%1" : "+r"(crypto_int64_x) : "r"(crypto_int64_s) : ); 1255| |#else 1256| | int crypto_int64_k, crypto_int64_l; 1257| | for (crypto_int64_l = 0,crypto_int64_k = 1;crypto_int64_k < 64;++crypto_int64_l,crypto_int64_k *= 2) 1258| | crypto_int64_x ^= (crypto_int64_x ^ (crypto_int64_x >> crypto_int64_k)) & crypto_int64_bitinrangepublicpos_mask(crypto_int64_s,crypto_int64_l); 1259| |#endif 1260| 9| return crypto_int64_x; 1261| 9|} min: 18| 1.78k|size_t min(size_t a, size_t b) { 19| 1.78k| return a < b ? a : b; ------------------ | Branch (19:9): [True: 1.75k, False: 33] ------------------ 20| 1.78k|} fuzz_rand: 36| 8.16k|void fuzz_rand(uint8_t *random_array, size_t bytes_to_read) { 37| 4.14M| for (size_t i = 0; i < bytes_to_read; i++) { ------------------ | Branch (37:21): [True: 4.13M, False: 8.16k] ------------------ 38| 4.13M| random_array[i] = (uint8_t)rand(); 39| 4.13M| } 40| 8.16k|} init_fuzz_context: 42| 1.78k|fuzz_ctx_t init_fuzz_context(const uint8_t *data, size_t data_len) { 43| | 44| 1.78k| fuzz_ctx_t ctx = {{0, 0}, NULL, 0}; 45| 1.78k| if (data_len > sizeof(fuzz_init_ctx_t)) { ------------------ | Branch (45:6): [True: 1.78k, False: 5] ------------------ 46| 1.78k| memcpy(&ctx.init, data, sizeof(fuzz_init_ctx_t)); 47| 1.78k| ctx.data = data + sizeof(fuzz_init_ctx_t); 48| 1.78k| ctx.data_len = data_len - sizeof(fuzz_init_ctx_t); 49| | 50| 1.78k| ctx.init.algorithm_index %= OQS_KEM_algs_length; ------------------ | | 122| 1.78k|#define OQS_KEM_algs_length 41 ------------------ 51| 1.78k| } else { 52| 5| ctx.data = data; 53| 5| ctx.data_len = data_len; 54| 5| } 55| | 56| 1.78k| srand(ctx.init.random_seed); 57| 1.78k| OQS_randombytes_custom_algorithm(&fuzz_rand); 58| | 59| 1.78k| return ctx; 60| 1.78k|} cleanup_heap: 134| 1.78k| uint8_t *ciphertext, OQS_KEM *kem) { 135| 1.78k| if (kem != NULL) { ------------------ | Branch (135:6): [True: 1.78k, False: 0] ------------------ 136| 1.78k| OQS_MEM_secure_free(secret_key, kem->length_secret_key); 137| 1.78k| OQS_MEM_secure_free(shared_secret_e, kem->length_shared_secret); 138| 1.78k| OQS_MEM_secure_free(shared_secret_d, kem->length_shared_secret); 139| 1.78k| } 140| 1.78k| OQS_MEM_insecure_free(public_key); 141| 1.78k| OQS_MEM_insecure_free(ciphertext); 142| 1.78k| OQS_KEM_free(kem); 143| 1.78k|} LLVMFuzzerTestOneInput: 145| 1.78k|int LLVMFuzzerTestOneInput(const char *data, size_t size) { 146| 1.78k| OQS_init(); 147| 1.78k| if (OQS_ERROR == fuzz_kem((const uint8_t *)data, size)) { ------------------ | Branch (147:6): [True: 0, False: 1.78k] ------------------ 148| | // If we get an error prune testcase from corpus. 149| 0| return -1; 150| 0| } 151| 1.78k| OQS_destroy(); 152| 1.78k| return 0; 153| 1.78k|} fuzz_test_kem.c:fuzz_kem: 68| 1.78k|static OQS_STATUS fuzz_kem(const uint8_t *data, size_t data_len) { 69| 1.78k| OQS_KEM *kem = NULL; 70| 1.78k| uint8_t *public_key = NULL; 71| 1.78k| uint8_t *secret_key = NULL; 72| 1.78k| uint8_t *ciphertext = NULL; 73| 1.78k| uint8_t *shared_secret_e = NULL; 74| 1.78k| uint8_t *shared_secret_d = NULL; 75| | 76| 1.78k| fuzz_ctx_t ctx = init_fuzz_context(data, data_len); 77| 1.78k| const char *algorithm = OQS_KEM_alg_identifier(ctx.init.algorithm_index); 78| 1.78k| kem = OQS_KEM_new(algorithm); 79| 1.78k| if (kem == NULL) { ------------------ | Branch (79:6): [True: 0, False: 1.78k] ------------------ 80| 0| printf("%s was not enabled at compile-time.\n", algorithm); 81| 0| return OQS_ERROR; 82| 0| } 83| | 84| 1.78k| public_key = OQS_MEM_malloc(kem->length_public_key); 85| 1.78k| secret_key = OQS_MEM_malloc(kem->length_secret_key); 86| 1.78k| ciphertext = OQS_MEM_malloc(kem->length_ciphertext); 87| 1.78k| shared_secret_e = OQS_MEM_malloc(kem->length_shared_secret); 88| 1.78k| shared_secret_d = OQS_MEM_malloc(kem->length_shared_secret); 89| | 90| 1.78k| if ((public_key == NULL) || (secret_key == NULL) || (ciphertext == NULL) || ------------------ | Branch (90:6): [True: 0, False: 1.78k] | Branch (90:30): [True: 0, False: 1.78k] | Branch (90:54): [True: 0, False: 1.78k] ------------------ 91| 1.78k| (shared_secret_e == NULL) || (shared_secret_d == NULL)) { ------------------ | Branch (91:10): [True: 0, False: 1.78k] | Branch (91:39): [True: 0, False: 1.78k] ------------------ 92| 0| fprintf(stderr, "ERROR: OQS_MEM_malloc failed!\n"); 93| 0| cleanup_heap(secret_key, shared_secret_e, shared_secret_d, public_key, 94| 0| ciphertext, kem); 95| | 96| 0| return OQS_ERROR; 97| 0| } 98| | 99| 1.78k| memcpy(shared_secret_e, ctx.data, min(ctx.data_len, kem->length_shared_secret)); 100| 1.78k| OQS_STATUS rc = OQS_KEM_keypair(kem, public_key, secret_key); 101| 1.78k| if (rc != OQS_SUCCESS) { ------------------ | Branch (101:6): [True: 0, False: 1.78k] ------------------ 102| 0| fprintf(stderr, "ERROR: OQS_KEM_keypair failed!\n"); 103| 0| cleanup_heap(secret_key, shared_secret_e, shared_secret_d, public_key, 104| 0| ciphertext, kem); 105| | 106| 0| return rc; 107| 0| } 108| 1.78k| rc = OQS_KEM_encaps(kem, ciphertext, shared_secret_e, public_key); 109| 1.78k| if (rc != OQS_SUCCESS) { ------------------ | Branch (109:6): [True: 0, False: 1.78k] ------------------ 110| 0| fprintf(stderr, "ERROR: OQS_KEM_encaps failed!\n"); 111| 0| cleanup_heap(secret_key, shared_secret_e, shared_secret_d, public_key, 112| 0| ciphertext, kem); 113| | 114| 0| return rc; 115| 0| } 116| 1.78k| rc = OQS_KEM_decaps(kem, shared_secret_d, ciphertext, secret_key); 117| 1.78k| if (rc != OQS_SUCCESS) { ------------------ | Branch (117:6): [True: 0, False: 1.78k] ------------------ 118| 0| fprintf(stderr, "ERROR: OQS_KEM_decaps failed! with algorithm index %u\n", ctx.init.algorithm_index); 119| 0| cleanup_heap(secret_key, shared_secret_e, shared_secret_d, public_key, 120| 0| ciphertext, kem); 121| | 122| 0| return rc; 123| 0| } 124| 1.78k| assert(memcmp(shared_secret_d, shared_secret_e, kem->length_shared_secret) == 0); 125| | 126| 1.78k| cleanup_heap(secret_key, shared_secret_e, shared_secret_d, public_key, 127| 1.78k| ciphertext, kem); 128| | 129| 1.78k| return OQS_SUCCESS; // success 130| 1.78k|}