diff --git a/fips202/fips202.c b/fips202/fips202.c index 0ad3dc645..36cbcc879 100644 --- a/fips202/fips202.c +++ b/fips202/fips202.c @@ -72,9 +72,9 @@ static void keccak_absorb(uint64_t *s, * - uint64_t *s: pointer to in/output Keccak state * - uint32_t r: rate in bytes (e.g., 168 for SHAKE128) **************************************************/ -static void keccak_squeezeblocks(uint8_t *h, size_t nblocks, - uint64_t *s, - uint32_t r) +void keccak_squeezeblocks(uint8_t *h, size_t nblocks, + uint64_t *s, + uint32_t r) { while (nblocks > 0) { diff --git a/fips202/fips202x.c b/fips202/fips202x.c index 545984052..c007177b7 100644 --- a/fips202/fips202x.c +++ b/fips202/fips202x.c @@ -12,9 +12,11 @@ static void keccak_absorb_x4(uint64_t *s, uint32_t r, const uint8_t *in2, const uint8_t *in3, size_t inlen, - uint8_t p) { + uint8_t p) +{ - while (inlen >= r) { + while (inlen >= r) + { KeccakF1600_StateXORBytes(s + KECCAK_CTX * 0, in0, 0, r); KeccakF1600_StateXORBytes(s + KECCAK_CTX * 1, in1, 0, r); @@ -33,20 +35,24 @@ static void keccak_absorb_x4(uint64_t *s, uint32_t r, inlen -= r; } - if (inlen > 0) { + if (inlen > 0) + { KeccakF1600_StateXORBytes(s + KECCAK_CTX * 0, in0, 0, inlen); KeccakF1600_StateXORBytes(s + KECCAK_CTX * 1, in1, 0, inlen); KeccakF1600_StateXORBytes(s + KECCAK_CTX * 2, in2, 0, inlen); KeccakF1600_StateXORBytes(s + KECCAK_CTX * 3, in3, 0, inlen); } - if (inlen == r - 1) { + if (inlen == r - 1) + { p |= 128; KeccakF1600_StateXORBytes(s + KECCAK_CTX * 0, &p, inlen, 1); KeccakF1600_StateXORBytes(s + KECCAK_CTX * 1, &p, inlen, 1); KeccakF1600_StateXORBytes(s + KECCAK_CTX * 2, &p, inlen, 1); KeccakF1600_StateXORBytes(s + KECCAK_CTX * 3, &p, inlen, 1); - } else { + } + else + { KeccakF1600_StateXORBytes(s + KECCAK_CTX * 0, &p, inlen, 1); KeccakF1600_StateXORBytes(s + KECCAK_CTX * 1, &p, inlen, 1); KeccakF1600_StateXORBytes(s + KECCAK_CTX * 2, &p, inlen, 1); @@ -65,9 +71,11 @@ static void keccak_squeezeblocks_x4(uint8_t *out0, uint8_t *out3, size_t nblocks, uint64_t *s, - uint32_t r) { + uint32_t r) +{ - while (nblocks > 0) { + while (nblocks > 0) + { KeccakF1600_StatePermute(s + KECCAK_CTX * 0); KeccakF1600_StatePermute(s + KECCAK_CTX * 1); KeccakF1600_StatePermute(s + KECCAK_CTX * 2); @@ -86,8 +94,10 @@ static void keccak_squeezeblocks_x4(uint8_t *out0, } } -uint64_t *keccakx_get_lane_state(keccakx4_state *state, size_t index) { - if (index >= KECCAK_WAY) { +uint64_t *keccakx_get_lane_state(keccakx4_state *state, size_t index) +{ + if (index >= KECCAK_WAY) + { return NULL; } @@ -99,8 +109,10 @@ int shake128x4_absorb(keccakx4_state *state, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, - size_t inlen) { - if (state == NULL || in0 == NULL || in1 == NULL || in2 == NULL || in3 == NULL) { + size_t inlen) +{ + if (state == NULL || in0 == NULL || in1 == NULL || in2 == NULL || in3 == NULL) + { return 1; } @@ -116,8 +128,10 @@ int shake256x4_absorb(keccakx4_state *state, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, - size_t inlen) { - if (state == NULL || in0 == NULL || in1 == NULL || in2 == NULL || in3 == NULL) { + size_t inlen) +{ + if (state == NULL || in0 == NULL || in1 == NULL || in2 == NULL || in3 == NULL) + { return 1; } @@ -134,8 +148,10 @@ int shake128x4_squeezeblocks(uint8_t *out0, uint8_t *out2, uint8_t *out3, size_t nblocks, - keccakx4_state *state) { - if (state == NULL || out0 == NULL || out1 == NULL || out2 == NULL || out3 == NULL) { + keccakx4_state *state) +{ + if (state == NULL || out0 == NULL || out1 == NULL || out2 == NULL || out3 == NULL) + { return 1; } keccak_squeezeblocks_x4(out0, out1, out2, out3, nblocks, state->ctx, SHAKE128_RATE); @@ -148,9 +164,11 @@ int shake256x4_squeezeblocks(uint8_t *out0, uint8_t *out2, uint8_t *out3, size_t nblocks, - keccakx4_state *state) { + keccakx4_state *state) +{ - if (state == NULL || out0 == NULL || out1 == NULL || out2 == NULL || out3 == NULL) { + if (state == NULL || out0 == NULL || out1 == NULL || out2 == NULL || out3 == NULL) + { return 1; } keccak_squeezeblocks_x4(out0, out1, out2, out3, nblocks, state->ctx, SHAKE256_RATE); diff --git a/fips202/fips202x.h b/fips202/fips202x.h index 9a68f1332..c97471710 100644 --- a/fips202/fips202x.h +++ b/fips202/fips202x.h @@ -8,7 +8,8 @@ #include -typedef struct { +typedef struct +{ uint64_t ctx[25 * KECCAK_WAY]; } keccakx4_state; diff --git a/mlkem/indcpa.c b/mlkem/indcpa.c index 412a123bb..e3c0c9e10 100644 --- a/mlkem/indcpa.c +++ b/mlkem/indcpa.c @@ -186,10 +186,13 @@ void gen_matrix(polyvec *a, const uint8_t seed[KYBER_SYMBYTES], int transposed) memcpy(seedxy[j], seed, KYBER_SYMBYTES); x = (i + j) / KYBER_K; y = (i + j) % KYBER_K; - if (transposed) { + if (transposed) + { seedxy[j][KYBER_SYMBYTES + 0] = x; seedxy[j][KYBER_SYMBYTES + 1] = y; - } else { + } + else + { seedxy[j][KYBER_SYMBYTES + 0] = y; seedxy[j][KYBER_SYMBYTES + 1] = x; } @@ -198,7 +201,8 @@ void gen_matrix(polyvec *a, const uint8_t seed[KYBER_SYMBYTES], int transposed) shake128x4_absorb(&statex, seedxy[0], seedxy[1], seedxy[2], seedxy[3], KYBER_SYMBYTES + 2); shake128x4_squeezeblocks(bufx[0], bufx[1], bufx[2], bufx[3], GEN_MATRIX_NBLOCKS, &statex); - for (j = 0; j < KECCAK_WAY; j++) { + for (j = 0; j < KECCAK_WAY; j++) + { x = (i + j) / KYBER_K; y = (i + j) % KYBER_K; vec = a[x].vec[y].coeffs; @@ -206,7 +210,8 @@ void gen_matrix(polyvec *a, const uint8_t seed[KYBER_SYMBYTES], int transposed) buflen = GEN_MATRIX_NBLOCKS *XOF_BLOCKBYTES; ctr = rej_uniform(vec, KYBER_N, buf, buflen); - while (ctr < KYBER_N ) { + while (ctr < KYBER_N ) + { uint64_t *ctx = keccakx_get_lane_state(&statex, j); keccak_squeezeblocks(buf, 1, ctx, SHAKE128_RATE); buflen = XOF_BLOCKBYTES; @@ -216,15 +221,19 @@ void gen_matrix(polyvec *a, const uint8_t seed[KYBER_SYMBYTES], int transposed) } // For left over vector, we use single keccak. - for (; i < KYBER_K *KYBER_K; i++) { + for (; i < KYBER_K *KYBER_K; i++) + { x = i / KYBER_K; y = i % KYBER_K; buf = bufx[0]; vec = a[x].vec[y].coeffs; - if (transposed) { + if (transposed) + { xof_absorb(&state, seed, x, y); - } else { + } + else + { xof_absorb(&state, seed, y, x); } xof_squeezeblocks(buf, GEN_MATRIX_NBLOCKS, &state);