Botan 3.4.0
Crypto and TLS for C&
Public Member Functions | Static Public Member Functions | Public Attributes | List of all members
Botan::Dilithium::Polynomial Class Reference

#include <dilithium_polynomials.h>

Public Member Functions

void cadd_q ()
 
void invntt_tomont ()
 
int32_t montgomery_reduce (int64_t a) const
 
void ntt ()
 
Polynomial & operator+= (const Polynomial &other)
 
Polynomial & operator-= (const Polynomial &other)
 
void poly_decompose (Polynomial &a1, Polynomial &a0, const DilithiumModeConstants &mode) const
 
void poly_invntt_tomont ()
 
void poly_pointwise_montgomery (Polynomial &output, const Polynomial &second) const
 
void poly_reduce ()
 
void poly_shiftl ()
 
void poly_uniform_gamma1 (const secure_vector< uint8_t > &seed, uint16_t nonce, const DilithiumModeConstants &mode)
 
void polyeta_pack (uint8_t *r, const DilithiumModeConstants &mode) const
 
 Polynomial ()=default
 
void polyt0_pack (uint8_t *r) const
 
void polyt1_pack (uint8_t *r) const
 
void polyw1_pack (uint8_t *r, const DilithiumModeConstants &mode)
 
void polyz_pack (uint8_t *r, const DilithiumModeConstants &mode) const
 

Static Public Member Functions

static int32_t decompose (int32_t *a0, int32_t a, const DilithiumModeConstants &mode)
 
static void fill_poly_uniform_eta (Polynomial &a, const secure_vector< uint8_t > &seed, uint16_t nonce, const DilithiumModeConstants &mode)
 
static void fill_polys_power2round (Polynomial &a1, Polynomial &a0, const Polynomial &a)
 
static size_t generate_hint_polynomial (Polynomial &h, const Polynomial &a0, const Polynomial &a1, const DilithiumModeConstants &mode)
 
static int32_t make_hint (size_t a0, size_t a1, const DilithiumModeConstants &mode)
 
static Polynomial poly_challenge (const uint8_t *seed, const DilithiumModeConstants &mode)
 
static bool poly_chknorm (const Polynomial &a, size_t B)
 
static void poly_use_hint (Polynomial &b, const Polynomial &a, const Polynomial &h, const DilithiumModeConstants &mode)
 
static Polynomial polyeta_unpack (std::span< const uint8_t > a, const DilithiumModeConstants &mode)
 
static Polynomial polyt0_unpack (std::span< const uint8_t > a)
 
static void polyt1_unpack (Polynomial &r, const uint8_t *a)
 
static void polyz_unpack (Polynomial &r, const uint8_t *a, const DilithiumModeConstants &mode)
 
static int32_t power2round (int32_t &a0, int32_t a)
 
static size_t rej_eta (Polynomial &a, size_t offset, size_t len, const secure_vector< uint8_t > &buf, size_t buflen, const DilithiumModeConstants &mode)
 
static size_t rej_uniform (Polynomial &p, size_t position, size_t len, const uint8_t *buf, size_t buflen)
 
static int32_t use_hint (int32_t a, size_t hint, const DilithiumModeConstants &mode)
 

Public Attributes

std::array< int32_t, Botan::DilithiumModeConstants::N > m_coeffs
 

Detailed Description

Definition at line 28 of file dilithium_polynomials.h.

Constructor & Destructor Documentation

◆ Polynomial()

Botan::Dilithium::Polynomial::Polynomial ( )
default

Member Function Documentation

◆ cadd_q()

void Botan::Dilithium::Polynomial::cadd_q ( )
inline

Definition at line 533 of file dilithium_polynomials.h.

533 {
534 for(auto& i : m_coeffs) {
535 i += (i >> 31) & DilithiumModeConstants::Q;
536 }
537 }
Botan::Dilithium::Polynomial::m_coeffs
std::array< int32_t, Botan::DilithiumModeConstants::N > m_coeffs
Definition dilithium_polynomials.h:31

References m_coeffs, and Botan::DilithiumModeConstants::Q.

◆ decompose()

static int32_t Botan::Dilithium::Polynomial::decompose ( int32_t * a0,
int32_t a,
const DilithiumModeConstants & mode )
inlinestatic

Definition at line 338 of file dilithium_polynomials.h.

338 {
339 int32_t a1 = (a + 127) >> 7;
340 if(mode.gamma2() == (DilithiumModeConstants::Q - 1) / 32) {
341 a1 = (a1 * 1025 + (1 << 21)) >> 22;
342 a1 &= 15;
343 } else {
344 BOTAN_ASSERT_NOMSG(mode.gamma2() == (DilithiumModeConstants::Q - 1) / 88);
345 a1 = (a1 * 11275 + (1 << 23)) >> 24;
346 a1 ^= ((43 - a1) >> 31) & a1;
347 }
348
349 *a0 = a - a1 * 2 * static_cast<int32_t>(mode.gamma2());
350 *a0 -= (((DilithiumModeConstants::Q - 1) / 2 - *a0) >> 31) & DilithiumModeConstants::Q;
351 return a1;
352 }
BOTAN_ASSERT_NOMSG
#define BOTAN_ASSERT_NOMSG(expr)
Definition assert.h:59

References BOTAN_ASSERT_NOMSG, Botan::DilithiumModeConstants::gamma2(), and Botan::DilithiumModeConstants::Q.

Referenced by poly_decompose(), and use_hint().

◆ fill_poly_uniform_eta()

static void Botan::Dilithium::Polynomial::fill_poly_uniform_eta ( Polynomial & a,
const secure_vector< uint8_t > & seed,
uint16_t nonce,
const DilithiumModeConstants & mode )
inlinestatic

Definition at line 148 of file dilithium_polynomials.h.

151 {
152 BOTAN_ASSERT_NOMSG(seed.size() == DilithiumModeConstants::CRHBYTES);
153
154 auto xof = mode.XOF_256(seed, nonce);
155
156 secure_vector<uint8_t> buf(mode.poly_uniform_eta_nblocks() * mode.stream256_blockbytes());
157 xof->output(buf);
158 size_t ctr = Polynomial::rej_eta(a, 0, DilithiumModeConstants::N, buf, buf.size(), mode);
159
160 while(ctr < DilithiumModeConstants::N) {
161 xof->output(std::span(buf).first(mode.stream256_blockbytes()));
162 ctr += Polynomial::rej_eta(a, ctr, DilithiumModeConstants::N - ctr, buf, mode.stream256_blockbytes(), mode);
163 }
164 }
Botan::Dilithium::Polynomial::rej_eta
static size_t rej_eta(Polynomial &a, size_t offset, size_t len, const secure_vector< uint8_t > &buf, size_t buflen, const DilithiumModeConstants &mode)
Definition dilithium_polynomials.h:101

References BOTAN_ASSERT_NOMSG, Botan::DilithiumModeConstants::CRHBYTES, Botan::DilithiumModeConstants::N, Botan::DilithiumModeConstants::poly_uniform_eta_nblocks(), rej_eta(), Botan::DilithiumModeConstants::stream256_blockbytes(), and Botan::DilithiumModeConstants::XOF_256().

Referenced by Botan::Dilithium::PolynomialVector::fill_polyvec_uniform_eta().

◆ fill_polys_power2round()

static void Botan::Dilithium::Polynomial::fill_polys_power2round ( Polynomial & a1,
Polynomial & a0,
const Polynomial & a )
inlinestatic

Definition at line 196 of file dilithium_polynomials.h.

196 {
197 for(size_t i = 0; i < DilithiumModeConstants::N; ++i) {
198 a1.m_coeffs[i] = Polynomial::power2round(a0.m_coeffs[i], a.m_coeffs[i]);
199 }
200 }
Botan::Dilithium::Polynomial::power2round
static int32_t power2round(int32_t &a0, int32_t a)
Definition dilithium_polynomials.h:178

References m_coeffs, Botan::DilithiumModeConstants::N, and power2round().

Referenced by Botan::Dilithium::PolynomialVector::fill_polyvecs_power2round().

◆ generate_hint_polynomial()

static size_t Botan::Dilithium::Polynomial::generate_hint_polynomial ( Polynomial & h,
const Polynomial & a0,
const Polynomial & a1,
const DilithiumModeConstants & mode )
inlinestatic

Definition at line 309 of file dilithium_polynomials.h.

312 {
313 size_t s = 0;
314
315 for(size_t i = 0; i < DilithiumModeConstants::N; ++i) {
316 h.m_coeffs[i] = Polynomial::make_hint(a0.m_coeffs[i], a1.m_coeffs[i], mode);
317 s += h.m_coeffs[i];
318 }
319
320 return s;
321 }
Botan::Dilithium::Polynomial::make_hint
static int32_t make_hint(size_t a0, size_t a1, const DilithiumModeConstants &mode)
Definition dilithium_polynomials.h:286

References m_coeffs, make_hint(), and Botan::DilithiumModeConstants::N.

Referenced by Botan::Dilithium::PolynomialVector::generate_hint_polyvec().

◆ invntt_tomont()

void Botan::Dilithium::Polynomial::invntt_tomont ( )
inline

Definition at line 494 of file dilithium_polynomials.h.

494 {
495 size_t j;
496 int32_t f = 41978; // mont^2/256
497 size_t k = 256;
498 for(size_t len = 1; len < DilithiumModeConstants::N; len <<= 1) {
499 for(size_t start = 0; start < DilithiumModeConstants::N; start = j + len) {
500 int32_t zeta = -DilithiumModeConstants::ZETAS[--k];
501 for(j = start; j < start + len; ++j) {
502 int32_t t = m_coeffs[j];
503 m_coeffs[j] = t + m_coeffs[j + len];
504 m_coeffs[j + len] = t - m_coeffs[j + len];
505 m_coeffs[j + len] = montgomery_reduce(static_cast<int64_t>(zeta) * m_coeffs[j + len]);
506 }
507 }
508 }
509
510 for(j = 0; j < DilithiumModeConstants::N; ++j) {
511 m_coeffs[j] = montgomery_reduce(static_cast<int64_t>(f) * m_coeffs[j]);
512 }
513 }
Botan::DilithiumModeConstants::ZETAS
static constexpr int32_t ZETAS[DilithiumModeConstants::N]
Definition dilithium_symmetric_primitives.h:75
Botan::Dilithium::Polynomial::montgomery_reduce
int32_t montgomery_reduce(int64_t a) const
Definition dilithium_polynomials.h:418

References m_coeffs, montgomery_reduce(), Botan::DilithiumModeConstants::N, and Botan::DilithiumModeConstants::ZETAS.

Referenced by poly_invntt_tomont().

◆ make_hint()

static int32_t Botan::Dilithium::Polynomial::make_hint ( size_t a0,
size_t a1,
const DilithiumModeConstants & mode )
inlinestatic

Definition at line 286 of file dilithium_polynomials.h.

286 {
287 const auto gamma2 = mode.gamma2();
288 const auto Q_gamma2 = DilithiumModeConstants::Q - gamma2;
289 if(a0 <= gamma2 || a0 > Q_gamma2 || (a0 == Q_gamma2 && a1 == 0)) {
290 return 0;
291 }
292 return 1;
293 }

References Botan::DilithiumModeConstants::gamma2(), and Botan::DilithiumModeConstants::Q.

Referenced by generate_hint_polynomial().

◆ montgomery_reduce()

int32_t Botan::Dilithium::Polynomial::montgomery_reduce ( int64_t a) const
inline

Definition at line 418 of file dilithium_polynomials.h.

418 {
419 int32_t t = static_cast<int32_t>(static_cast<int64_t>(static_cast<int32_t>(a)) * DilithiumModeConstants::QINV);
420 t = (a - static_cast<int64_t>(t) * DilithiumModeConstants::Q) >> 32;
421 return t;
422 }

References Botan::DilithiumModeConstants::Q, and Botan::DilithiumModeConstants::QINV.

Referenced by invntt_tomont(), ntt(), and poly_pointwise_montgomery().

◆ ntt()

void Botan::Dilithium::Polynomial::ntt ( )
inline

Definition at line 451 of file dilithium_polynomials.h.

451 {
452 size_t j;
453 size_t k = 0;
454
455 for(size_t len = 128; len > 0; len >>= 1) {
456 for(size_t start = 0; start < DilithiumModeConstants::N; start = j + len) {
457 int32_t zeta = DilithiumModeConstants::ZETAS[++k];
458 for(j = start; j < start + len; ++j) {
459 int32_t t = montgomery_reduce(static_cast<int64_t>(zeta) * m_coeffs[j + len]);
460 m_coeffs[j + len] = m_coeffs[j] - t;
461 m_coeffs[j] = m_coeffs[j] + t;
462 }
463 }
464 }
465 }

References m_coeffs, montgomery_reduce(), Botan::DilithiumModeConstants::N, and Botan::DilithiumModeConstants::ZETAS.

◆ operator+=()

Polynomial & Botan::Dilithium::Polynomial::operator+= ( const Polynomial & other)
inline

Adds two polynomials element-wise. Does not perform a reduction after the addition. Therefore this operation might cause an integer overflow.

Definition at line 37 of file dilithium_polynomials.h.

37 {
38 for(size_t i = 0; i < this->m_coeffs.size(); ++i) {
39 this->m_coeffs[i] = this->m_coeffs[i] + other.m_coeffs[i];
40 }
41 return *this;
42 }

References m_coeffs.

◆ operator-=()

Polynomial & Botan::Dilithium::Polynomial::operator-= ( const Polynomial & other)
inline

Subtracts two polynomials element-wise. Does not perform a reduction after the subtraction. Therefore this operation might cause an integer underflow.

Definition at line 48 of file dilithium_polynomials.h.

48 {
49 for(size_t i = 0; i < this->m_coeffs.size(); ++i) {
50 this->m_coeffs[i] = this->m_coeffs[i] - other.m_coeffs[i];
51 }
52 return *this;
53 }

References m_coeffs.

◆ poly_challenge()

static Polynomial Botan::Dilithium::Polynomial::poly_challenge ( const uint8_t * seed,
const DilithiumModeConstants & mode )
inlinestatic

Definition at line 213 of file dilithium_polynomials.h.

213 {
214 Polynomial c;
215
216 SHAKE_256 shake256_hasher(DilithiumModeConstants::SHAKE256_RATE * 8);
217 shake256_hasher.update(seed, DilithiumModeConstants::SEEDBYTES);
218 auto buf = shake256_hasher.final();
219
220 uint64_t signs = 0;
221 for(size_t i = 0; i < 8; ++i) {
222 signs |= static_cast<uint64_t>(buf[i]) << 8 * i;
223 }
224 size_t pos = 8;
225
226 for(size_t i = 0; i < DilithiumModeConstants::N; ++i) {
227 c.m_coeffs[i] = 0;
228 }
229 for(size_t i = DilithiumModeConstants::N - mode.tau(); i < DilithiumModeConstants::N; ++i) {
230 size_t b;
231 do {
232 b = buf[pos++];
233 } while(b > i);
234
235 c.m_coeffs[i] = c.m_coeffs[b];
236 c.m_coeffs[b] = 1 - 2 * (signs & 1);
237 signs >>= 1;
238 }
239 return c;
240 }

References Botan::Buffered_Computation::final(), m_coeffs, Botan::DilithiumModeConstants::N, Botan::DilithiumModeConstants::SEEDBYTES, Botan::DilithiumModeConstants::SHAKE256_RATE, Botan::DilithiumModeConstants::tau(), and Botan::Buffered_Computation::update().

◆ poly_chknorm()

static bool Botan::Dilithium::Polynomial::poly_chknorm ( const Polynomial & a,
size_t B )
inlinestatic

Definition at line 253 of file dilithium_polynomials.h.

253 {
254 if(B > (DilithiumModeConstants::Q - 1) / 8) {
255 return true;
256 }
257
258 /* It is ok to leak which coefficient violates the bound since
259 the probability for each coefficient is independent of secret
260 data but we must not leak the sign of the centralized representative. */
261 for(const auto& coeff : a.m_coeffs) {
262 /* Absolute value */
263 size_t t = coeff >> 31;
264 t = coeff - (t & 2 * coeff);
265
266 if(t >= B) {
267 return true;
268 }
269 }
270 return false;
271 }

References m_coeffs, and Botan::DilithiumModeConstants::Q.

Referenced by Botan::Dilithium::PolynomialVector::polyvec_chknorm().

◆ poly_decompose()

void Botan::Dilithium::Polynomial::poly_decompose ( Polynomial & a1,
Polynomial & a0,
const DilithiumModeConstants & mode ) const
inline

Definition at line 569 of file dilithium_polynomials.h.

569 {
570 for(size_t i = 0; i < DilithiumModeConstants::N; ++i) {
571 a1.m_coeffs[i] = Polynomial::decompose(&a0.m_coeffs[i], m_coeffs[i], mode);
572 }
573 }
Botan::Dilithium::Polynomial::decompose
static int32_t decompose(int32_t *a0, int32_t a, const DilithiumModeConstants &mode)
Definition dilithium_polynomials.h:338

References decompose(), m_coeffs, and Botan::DilithiumModeConstants::N.

◆ poly_invntt_tomont()

void Botan::Dilithium::Polynomial::poly_invntt_tomont ( )
inline

Definition at line 524 of file dilithium_polynomials.h.

524{ invntt_tomont(); }

References invntt_tomont().

◆ poly_pointwise_montgomery()

void Botan::Dilithium::Polynomial::poly_pointwise_montgomery ( Polynomial & output,
const Polynomial & second ) const
inline

Definition at line 437 of file dilithium_polynomials.h.

437 {
438 for(size_t i = 0; i < DilithiumModeConstants::N; ++i) {
439 output.m_coeffs[i] = montgomery_reduce(static_cast<int64_t>(m_coeffs[i]) * second.m_coeffs[i]);
440 }
441 }

References m_coeffs, montgomery_reduce(), and Botan::DilithiumModeConstants::N.

◆ poly_reduce()

void Botan::Dilithium::Polynomial::poly_reduce ( )
inline

Definition at line 477 of file dilithium_polynomials.h.

477 {
478 for(auto& i : m_coeffs) {
479 int32_t t = (i + (1 << 22)) >> 23;
480 t = i - t * DilithiumModeConstants::Q;
481 i = t;
482 }
483 }

References m_coeffs, and Botan::DilithiumModeConstants::Q.

◆ poly_shiftl()

void Botan::Dilithium::Polynomial::poly_shiftl ( )
inline

Definition at line 583 of file dilithium_polynomials.h.

583 {
584 for(size_t i = 0; i < m_coeffs.size(); ++i) {
585 m_coeffs[i] <<= DilithiumModeConstants::D;
586 }
587 }

References Botan::DilithiumModeConstants::D, and m_coeffs.

◆ poly_uniform_gamma1()

void Botan::Dilithium::Polynomial::poly_uniform_gamma1 ( const secure_vector< uint8_t > & seed,
uint16_t nonce,
const DilithiumModeConstants & mode )
inline

Definition at line 550 of file dilithium_polynomials.h.

550 {
551 auto buf = mode.ExpandMask(seed, nonce);
552
553 Polynomial::polyz_unpack(*this, buf.data(), mode);
554 }
Botan::Dilithium::Polynomial::polyz_unpack
static void polyz_unpack(Polynomial &r, const uint8_t *a, const DilithiumModeConstants &mode)
Definition dilithium_polynomials.h:819

References Botan::DilithiumModeConstants::ExpandMask(), and polyz_unpack().

◆ poly_use_hint()

static void Botan::Dilithium::Polynomial::poly_use_hint ( Polynomial & b,
const Polynomial & a,
const Polynomial & h,
const DilithiumModeConstants & mode )
inlinestatic

Definition at line 399 of file dilithium_polynomials.h.

402 {
403 for(size_t i = 0; i < DilithiumModeConstants::N; ++i) {
404 b.m_coeffs[i] = Polynomial::use_hint(a.m_coeffs[i], h.m_coeffs[i], mode);
405 }
406 }
Botan::Dilithium::Polynomial::use_hint
static int32_t use_hint(int32_t a, size_t hint, const DilithiumModeConstants &mode)
Definition dilithium_polynomials.h:365

References m_coeffs, Botan::DilithiumModeConstants::N, and use_hint().

Referenced by Botan::Dilithium::PolynomialVector::polyvec_use_hint().

◆ polyeta_pack()

void Botan::Dilithium::Polynomial::polyeta_pack ( uint8_t * r,
const DilithiumModeConstants & mode ) const
inline

Definition at line 674 of file dilithium_polynomials.h.

674 {
675 uint8_t t[8];
676
677 switch(mode.eta()) {
678 case DilithiumEta::Eta2: {
679 for(size_t i = 0; i < DilithiumModeConstants::N / 8; ++i) {
680 t[0] = static_cast<uint8_t>(mode.eta() - m_coeffs[8 * i + 0]);
681 t[1] = static_cast<uint8_t>(mode.eta() - m_coeffs[8 * i + 1]);
682 t[2] = static_cast<uint8_t>(mode.eta() - m_coeffs[8 * i + 2]);
683 t[3] = static_cast<uint8_t>(mode.eta() - m_coeffs[8 * i + 3]);
684 t[4] = static_cast<uint8_t>(mode.eta() - m_coeffs[8 * i + 4]);
685 t[5] = static_cast<uint8_t>(mode.eta() - m_coeffs[8 * i + 5]);
686 t[6] = static_cast<uint8_t>(mode.eta() - m_coeffs[8 * i + 6]);
687 t[7] = static_cast<uint8_t>(mode.eta() - m_coeffs[8 * i + 7]);
688
689 r[3 * i + 0] = (t[0] >> 0) | (t[1] << 3) | (t[2] << 6);
690 r[3 * i + 1] = (t[2] >> 2) | (t[3] << 1) | (t[4] << 4) | (t[5] << 7);
691 r[3 * i + 2] = (t[5] >> 1) | (t[6] << 2) | (t[7] << 5);
692 }
693 } break;
694 case DilithiumEta::Eta4: {
695 for(size_t i = 0; i < DilithiumModeConstants::N / 2; ++i) {
696 t[0] = static_cast<uint8_t>(mode.eta() - m_coeffs[2 * i + 0]);
697 t[1] = static_cast<uint8_t>(mode.eta() - m_coeffs[2 * i + 1]);
698 r[i] = static_cast<uint8_t>(t[0] | (t[1] << 4));
699 }
700 } break;
701 }
702 }

References Botan::DilithiumModeConstants::eta(), Botan::Eta2, Botan::Eta4, m_coeffs, and Botan::DilithiumModeConstants::N.

◆ polyeta_unpack()

static Polynomial Botan::Dilithium::Polynomial::polyeta_unpack ( std::span< const uint8_t > a,
const DilithiumModeConstants & mode )
inlinestatic

Definition at line 626 of file dilithium_polynomials.h.

626 {
627 Polynomial r;
628
629 switch(mode.eta()) {
630 case DilithiumEta::Eta2: {
631 for(size_t i = 0; i < DilithiumModeConstants::N / 8; ++i) {
632 r.m_coeffs[8 * i + 0] = (a[3 * i + 0] >> 0) & 7;
633 r.m_coeffs[8 * i + 1] = (a[3 * i + 0] >> 3) & 7;
634 r.m_coeffs[8 * i + 2] = ((a[3 * i + 0] >> 6) | (a[3 * i + 1] << 2)) & 7;
635 r.m_coeffs[8 * i + 3] = (a[3 * i + 1] >> 1) & 7;
636 r.m_coeffs[8 * i + 4] = (a[3 * i + 1] >> 4) & 7;
637 r.m_coeffs[8 * i + 5] = ((a[3 * i + 1] >> 7) | (a[3 * i + 2] << 1)) & 7;
638 r.m_coeffs[8 * i + 6] = (a[3 * i + 2] >> 2) & 7;
639 r.m_coeffs[8 * i + 7] = (a[3 * i + 2] >> 5) & 7;
640
641 r.m_coeffs[8 * i + 0] = static_cast<uint8_t>(mode.eta()) - r.m_coeffs[8 * i + 0];
642 r.m_coeffs[8 * i + 1] = static_cast<uint8_t>(mode.eta()) - r.m_coeffs[8 * i + 1];
643 r.m_coeffs[8 * i + 2] = static_cast<uint8_t>(mode.eta()) - r.m_coeffs[8 * i + 2];
644 r.m_coeffs[8 * i + 3] = static_cast<uint8_t>(mode.eta()) - r.m_coeffs[8 * i + 3];
645 r.m_coeffs[8 * i + 4] = static_cast<uint8_t>(mode.eta()) - r.m_coeffs[8 * i + 4];
646 r.m_coeffs[8 * i + 5] = static_cast<uint8_t>(mode.eta()) - r.m_coeffs[8 * i + 5];
647 r.m_coeffs[8 * i + 6] = static_cast<uint8_t>(mode.eta()) - r.m_coeffs[8 * i + 6];
648 r.m_coeffs[8 * i + 7] = static_cast<uint8_t>(mode.eta()) - r.m_coeffs[8 * i + 7];
649 }
650 } break;
651 case DilithiumEta::Eta4: {
652 for(size_t i = 0; i < DilithiumModeConstants::N / 2; ++i) {
653 r.m_coeffs[2 * i + 0] = a[i] & 0x0F;
654 r.m_coeffs[2 * i + 1] = a[i] >> 4;
655 r.m_coeffs[2 * i + 0] = static_cast<uint8_t>(mode.eta()) - r.m_coeffs[2 * i + 0];
656 r.m_coeffs[2 * i + 1] = static_cast<uint8_t>(mode.eta()) - r.m_coeffs[2 * i + 1];
657 }
658 } break;
659 }
660
661 return r;
662 }

References Botan::DilithiumModeConstants::eta(), Botan::Eta2, Botan::Eta4, m_coeffs, and Botan::DilithiumModeConstants::N.

Referenced by Botan::Dilithium::PolynomialVector::unpack_eta().

◆ polyt0_pack()

void Botan::Dilithium::Polynomial::polyt0_pack ( uint8_t * r) const
inline

Definition at line 774 of file dilithium_polynomials.h.

774 {
775 uint32_t t[8];
776 for(size_t i = 0; i < DilithiumModeConstants::N / 8; ++i) {
777 t[0] = (1 << (DilithiumModeConstants::D - 1)) - m_coeffs[8 * i + 0];
778 t[1] = (1 << (DilithiumModeConstants::D - 1)) - m_coeffs[8 * i + 1];
779 t[2] = (1 << (DilithiumModeConstants::D - 1)) - m_coeffs[8 * i + 2];
780 t[3] = (1 << (DilithiumModeConstants::D - 1)) - m_coeffs[8 * i + 3];
781 t[4] = (1 << (DilithiumModeConstants::D - 1)) - m_coeffs[8 * i + 4];
782 t[5] = (1 << (DilithiumModeConstants::D - 1)) - m_coeffs[8 * i + 5];
783 t[6] = (1 << (DilithiumModeConstants::D - 1)) - m_coeffs[8 * i + 6];
784 t[7] = (1 << (DilithiumModeConstants::D - 1)) - m_coeffs[8 * i + 7];
785
786 r[13 * i + 0] = static_cast<uint8_t>(t[0]);
787 r[13 * i + 1] = static_cast<uint8_t>(t[0] >> 8);
788 r[13 * i + 1] |= static_cast<uint8_t>(t[1] << 5);
789 r[13 * i + 2] = static_cast<uint8_t>(t[1] >> 3);
790 r[13 * i + 3] = static_cast<uint8_t>(t[1] >> 11);
791 r[13 * i + 3] |= static_cast<uint8_t>(t[2] << 2);
792 r[13 * i + 4] = static_cast<uint8_t>(t[2] >> 6);
793 r[13 * i + 4] |= static_cast<uint8_t>(t[3] << 7);
794 r[13 * i + 5] = static_cast<uint8_t>(t[3] >> 1);
795 r[13 * i + 6] = static_cast<uint8_t>(t[3] >> 9);
796 r[13 * i + 6] |= static_cast<uint8_t>(t[4] << 4);
797 r[13 * i + 7] = static_cast<uint8_t>(t[4] >> 4);
798 r[13 * i + 8] = static_cast<uint8_t>(t[4] >> 12);
799 r[13 * i + 8] |= static_cast<uint8_t>(t[5] << 1);
800 r[13 * i + 9] = static_cast<uint8_t>(t[5] >> 7);
801 r[13 * i + 9] |= static_cast<uint8_t>(t[6] << 6);
802 r[13 * i + 10] = static_cast<uint8_t>(t[6] >> 2);
803 r[13 * i + 11] = static_cast<uint8_t>(t[6] >> 10);
804 r[13 * i + 11] |= static_cast<uint8_t>(t[7] << 3);
805 r[13 * i + 12] = static_cast<uint8_t>(t[7] >> 5);
806 }
807 }

References Botan::DilithiumModeConstants::D, m_coeffs, and Botan::DilithiumModeConstants::N.

◆ polyt0_unpack()

static Polynomial Botan::Dilithium::Polynomial::polyt0_unpack ( std::span< const uint8_t > a)
inlinestatic

Definition at line 712 of file dilithium_polynomials.h.

712 {
713 Polynomial r;
714
715 for(size_t i = 0; i < DilithiumModeConstants::N / 8; ++i) {
716 r.m_coeffs[8 * i + 0] = a[13 * i + 0];
717 r.m_coeffs[8 * i + 0] |= static_cast<uint32_t>(a[13 * i + 1]) << 8;
718 r.m_coeffs[8 * i + 0] &= 0x1FFF;
719
720 r.m_coeffs[8 * i + 1] = a[13 * i + 1] >> 5;
721 r.m_coeffs[8 * i + 1] |= static_cast<uint32_t>(a[13 * i + 2]) << 3;
722 r.m_coeffs[8 * i + 1] |= static_cast<uint32_t>(a[13 * i + 3]) << 11;
723 r.m_coeffs[8 * i + 1] &= 0x1FFF;
724
725 r.m_coeffs[8 * i + 2] = a[13 * i + 3] >> 2;
726 r.m_coeffs[8 * i + 2] |= static_cast<uint32_t>(a[13 * i + 4]) << 6;
727 r.m_coeffs[8 * i + 2] &= 0x1FFF;
728
729 r.m_coeffs[8 * i + 3] = a[13 * i + 4] >> 7;
730 r.m_coeffs[8 * i + 3] |= static_cast<uint32_t>(a[13 * i + 5]) << 1;
731 r.m_coeffs[8 * i + 3] |= static_cast<uint32_t>(a[13 * i + 6]) << 9;
732 r.m_coeffs[8 * i + 3] &= 0x1FFF;
733
734 r.m_coeffs[8 * i + 4] = a[13 * i + 6] >> 4;
735 r.m_coeffs[8 * i + 4] |= static_cast<uint32_t>(a[13 * i + 7]) << 4;
736 r.m_coeffs[8 * i + 4] |= static_cast<uint32_t>(a[13 * i + 8]) << 12;
737 r.m_coeffs[8 * i + 4] &= 0x1FFF;
738
739 r.m_coeffs[8 * i + 5] = a[13 * i + 8] >> 1;
740 r.m_coeffs[8 * i + 5] |= static_cast<uint32_t>(a[13 * i + 9]) << 7;
741 r.m_coeffs[8 * i + 5] &= 0x1FFF;
742
743 r.m_coeffs[8 * i + 6] = a[13 * i + 9] >> 6;
744 r.m_coeffs[8 * i + 6] |= static_cast<uint32_t>(a[13 * i + 10]) << 2;
745 r.m_coeffs[8 * i + 6] |= static_cast<uint32_t>(a[13 * i + 11]) << 10;
746 r.m_coeffs[8 * i + 6] &= 0x1FFF;
747
748 r.m_coeffs[8 * i + 7] = a[13 * i + 11] >> 3;
749 r.m_coeffs[8 * i + 7] |= static_cast<uint32_t>(a[13 * i + 12]) << 5;
750 r.m_coeffs[8 * i + 7] &= 0x1FFF;
751
752 r.m_coeffs[8 * i + 0] = (1 << (DilithiumModeConstants::D - 1)) - r.m_coeffs[8 * i + 0];
753 r.m_coeffs[8 * i + 1] = (1 << (DilithiumModeConstants::D - 1)) - r.m_coeffs[8 * i + 1];
754 r.m_coeffs[8 * i + 2] = (1 << (DilithiumModeConstants::D - 1)) - r.m_coeffs[8 * i + 2];
755 r.m_coeffs[8 * i + 3] = (1 << (DilithiumModeConstants::D - 1)) - r.m_coeffs[8 * i + 3];
756 r.m_coeffs[8 * i + 4] = (1 << (DilithiumModeConstants::D - 1)) - r.m_coeffs[8 * i + 4];
757 r.m_coeffs[8 * i + 5] = (1 << (DilithiumModeConstants::D - 1)) - r.m_coeffs[8 * i + 5];
758 r.m_coeffs[8 * i + 6] = (1 << (DilithiumModeConstants::D - 1)) - r.m_coeffs[8 * i + 6];
759 r.m_coeffs[8 * i + 7] = (1 << (DilithiumModeConstants::D - 1)) - r.m_coeffs[8 * i + 7];
760 }
761
762 return r;
763 }

References Botan::DilithiumModeConstants::D, m_coeffs, and Botan::DilithiumModeConstants::N.

Referenced by Botan::Dilithium::PolynomialVector::unpack_t0().

◆ polyt1_pack()

void Botan::Dilithium::Polynomial::polyt1_pack ( uint8_t * r) const
inline

Definition at line 939 of file dilithium_polynomials.h.

939 {
940 for(size_t i = 0; i < DilithiumModeConstants::N / 4; ++i) {
941 r[5 * i + 0] = static_cast<uint8_t>((m_coeffs[4 * i + 0] >> 0));
942 r[5 * i + 1] = static_cast<uint8_t>((m_coeffs[4 * i + 0] >> 8) | (m_coeffs[4 * i + 1] << 2));
943 r[5 * i + 2] = static_cast<uint8_t>((m_coeffs[4 * i + 1] >> 6) | (m_coeffs[4 * i + 2] << 4));
944 r[5 * i + 3] = static_cast<uint8_t>((m_coeffs[4 * i + 2] >> 4) | (m_coeffs[4 * i + 3] << 6));
945 r[5 * i + 4] = static_cast<uint8_t>((m_coeffs[4 * i + 3] >> 2));
946 }
947 }

References m_coeffs, and Botan::DilithiumModeConstants::N.

◆ polyt1_unpack()

static void Botan::Dilithium::Polynomial::polyt1_unpack ( Polynomial & r,
const uint8_t * a )
inlinestatic

Definition at line 921 of file dilithium_polynomials.h.

921 {
922 for(size_t i = 0; i < DilithiumModeConstants::N / 4; ++i) {
923 r.m_coeffs[4 * i + 0] = ((a[5 * i + 0] >> 0) | (static_cast<uint32_t>(a[5 * i + 1]) << 8)) & 0x3FF;
924 r.m_coeffs[4 * i + 1] = ((a[5 * i + 1] >> 2) | (static_cast<uint32_t>(a[5 * i + 2]) << 6)) & 0x3FF;
925 r.m_coeffs[4 * i + 2] = ((a[5 * i + 2] >> 4) | (static_cast<uint32_t>(a[5 * i + 3]) << 4)) & 0x3FF;
926 r.m_coeffs[4 * i + 3] = ((a[5 * i + 3] >> 6) | (static_cast<uint32_t>(a[5 * i + 4]) << 2)) & 0x3FF;
927 }
928 }

References m_coeffs, and Botan::DilithiumModeConstants::N.

Referenced by Botan::Dilithium::PolynomialVector::unpack_t1().

◆ polyw1_pack()

void Botan::Dilithium::Polynomial::polyw1_pack ( uint8_t * r,
const DilithiumModeConstants & mode )
inline

Definition at line 599 of file dilithium_polynomials.h.

599 {
600 if(mode.gamma2() == (DilithiumModeConstants::Q - 1) / 88) {
601 for(size_t i = 0; i < DilithiumModeConstants::N / 4; ++i) {
602 r[3 * i + 0] = static_cast<uint8_t>(m_coeffs[4 * i + 0]);
603 r[3 * i + 0] |= static_cast<uint8_t>(m_coeffs[4 * i + 1] << 6);
604 r[3 * i + 1] = static_cast<uint8_t>(m_coeffs[4 * i + 1] >> 2);
605 r[3 * i + 1] |= static_cast<uint8_t>(m_coeffs[4 * i + 2] << 4);
606 r[3 * i + 2] = static_cast<uint8_t>(m_coeffs[4 * i + 2] >> 4);
607 r[3 * i + 2] |= static_cast<uint8_t>(m_coeffs[4 * i + 3] << 2);
608 }
609 } else {
610 BOTAN_ASSERT_NOMSG(mode.gamma2() == (DilithiumModeConstants::Q - 1) / 32);
611 for(size_t i = 0; i < DilithiumModeConstants::N / 2; ++i) {
612 r[i] = static_cast<uint8_t>(m_coeffs[2 * i + 0] | (m_coeffs[2 * i + 1] << 4));
613 }
614 }
615 }

References BOTAN_ASSERT_NOMSG, Botan::DilithiumModeConstants::gamma2(), m_coeffs, Botan::DilithiumModeConstants::N, and Botan::DilithiumModeConstants::Q.

◆ polyz_pack()

void Botan::Dilithium::Polynomial::polyz_pack ( uint8_t * r,
const DilithiumModeConstants & mode ) const
inline

Definition at line 875 of file dilithium_polynomials.h.

875 {
876 uint32_t t[4];
877 if(mode.gamma1() == (1 << 17)) {
878 for(size_t i = 0; i < DilithiumModeConstants::N / 4; ++i) {
879 t[0] = static_cast<uint32_t>(mode.gamma1()) - m_coeffs[4 * i + 0];
880 t[1] = static_cast<uint32_t>(mode.gamma1()) - m_coeffs[4 * i + 1];
881 t[2] = static_cast<uint32_t>(mode.gamma1()) - m_coeffs[4 * i + 2];
882 t[3] = static_cast<uint32_t>(mode.gamma1()) - m_coeffs[4 * i + 3];
883
884 r[9 * i + 0] = static_cast<uint8_t>(t[0]);
885 r[9 * i + 1] = static_cast<uint8_t>(t[0] >> 8);
886 r[9 * i + 2] = static_cast<uint8_t>(t[0] >> 16);
887 r[9 * i + 2] |= static_cast<uint8_t>(t[1] << 2);
888 r[9 * i + 3] = static_cast<uint8_t>(t[1] >> 6);
889 r[9 * i + 4] = static_cast<uint8_t>(t[1] >> 14);
890 r[9 * i + 4] |= static_cast<uint8_t>(t[2] << 4);
891 r[9 * i + 5] = static_cast<uint8_t>(t[2] >> 4);
892 r[9 * i + 6] = static_cast<uint8_t>(t[2] >> 12);
893 r[9 * i + 6] |= static_cast<uint8_t>(t[3] << 6);
894 r[9 * i + 7] = static_cast<uint8_t>(t[3] >> 2);
895 r[9 * i + 8] = static_cast<uint8_t>(t[3] >> 10);
896 }
897 } else if(mode.gamma1() == (1 << 19)) {
898 for(size_t i = 0; i < DilithiumModeConstants::N / 2; ++i) {
899 t[0] = static_cast<uint32_t>(mode.gamma1()) - m_coeffs[2 * i + 0];
900 t[1] = static_cast<uint32_t>(mode.gamma1()) - m_coeffs[2 * i + 1];
901
902 r[5 * i + 0] = static_cast<uint8_t>(t[0]);
903 r[5 * i + 1] = static_cast<uint8_t>(t[0] >> 8);
904 r[5 * i + 2] = static_cast<uint8_t>(t[0] >> 16);
905 r[5 * i + 2] |= static_cast<uint8_t>(t[1] << 4);
906 r[5 * i + 3] = static_cast<uint8_t>(t[1] >> 4);
907 r[5 * i + 4] = static_cast<uint8_t>(t[1] >> 12);
908 }
909 }
910 }

References Botan::DilithiumModeConstants::gamma1(), m_coeffs, and Botan::DilithiumModeConstants::N.

◆ polyz_unpack()

static void Botan::Dilithium::Polynomial::polyz_unpack ( Polynomial & r,
const uint8_t * a,
const DilithiumModeConstants & mode )
inlinestatic

Definition at line 819 of file dilithium_polynomials.h.

819 {
820 if(mode.gamma1() == (1 << 17)) {
821 for(size_t i = 0; i < DilithiumModeConstants::N / 4; ++i) {
822 r.m_coeffs[4 * i + 0] = a[9 * i + 0];
823 r.m_coeffs[4 * i + 0] |= static_cast<uint32_t>(a[9 * i + 1]) << 8;
824 r.m_coeffs[4 * i + 0] |= static_cast<uint32_t>(a[9 * i + 2]) << 16;
825 r.m_coeffs[4 * i + 0] &= 0x3FFFF;
826
827 r.m_coeffs[4 * i + 1] = a[9 * i + 2] >> 2;
828 r.m_coeffs[4 * i + 1] |= static_cast<uint32_t>(a[9 * i + 3]) << 6;
829 r.m_coeffs[4 * i + 1] |= static_cast<uint32_t>(a[9 * i + 4]) << 14;
830 r.m_coeffs[4 * i + 1] &= 0x3FFFF;
831
832 r.m_coeffs[4 * i + 2] = a[9 * i + 4] >> 4;
833 r.m_coeffs[4 * i + 2] |= static_cast<uint32_t>(a[9 * i + 5]) << 4;
834 r.m_coeffs[4 * i + 2] |= static_cast<uint32_t>(a[9 * i + 6]) << 12;
835 r.m_coeffs[4 * i + 2] &= 0x3FFFF;
836
837 r.m_coeffs[4 * i + 3] = a[9 * i + 6] >> 6;
838 r.m_coeffs[4 * i + 3] |= static_cast<uint32_t>(a[9 * i + 7]) << 2;
839 r.m_coeffs[4 * i + 3] |= static_cast<uint32_t>(a[9 * i + 8]) << 10;
840 r.m_coeffs[4 * i + 3] &= 0x3FFFF;
841
842 r.m_coeffs[4 * i + 0] = static_cast<uint32_t>(mode.gamma1()) - r.m_coeffs[4 * i + 0];
843 r.m_coeffs[4 * i + 1] = static_cast<uint32_t>(mode.gamma1()) - r.m_coeffs[4 * i + 1];
844 r.m_coeffs[4 * i + 2] = static_cast<uint32_t>(mode.gamma1()) - r.m_coeffs[4 * i + 2];
845 r.m_coeffs[4 * i + 3] = static_cast<uint32_t>(mode.gamma1()) - r.m_coeffs[4 * i + 3];
846 }
847 } else if(mode.gamma1() == (1 << 19)) {
848 for(size_t i = 0; i < DilithiumModeConstants::N / 2; ++i) {
849 r.m_coeffs[2 * i + 0] = a[5 * i + 0];
850 r.m_coeffs[2 * i + 0] |= static_cast<uint32_t>(a[5 * i + 1]) << 8;
851 r.m_coeffs[2 * i + 0] |= static_cast<uint32_t>(a[5 * i + 2]) << 16;
852 r.m_coeffs[2 * i + 0] &= 0xFFFFF;
853
854 r.m_coeffs[2 * i + 1] = a[5 * i + 2] >> 4;
855 r.m_coeffs[2 * i + 1] |= static_cast<uint32_t>(a[5 * i + 3]) << 4;
856 r.m_coeffs[2 * i + 1] |= static_cast<uint32_t>(a[5 * i + 4]) << 12;
857 r.m_coeffs[2 * i + 0] &= 0xFFFFF;
858
859 r.m_coeffs[2 * i + 0] = static_cast<uint32_t>(mode.gamma1()) - r.m_coeffs[2 * i + 0];
860 r.m_coeffs[2 * i + 1] = static_cast<uint32_t>(mode.gamma1()) - r.m_coeffs[2 * i + 1];
861 }
862 }
863 }

References Botan::DilithiumModeConstants::gamma1(), m_coeffs, and Botan::DilithiumModeConstants::N.

Referenced by poly_uniform_gamma1(), Botan::Dilithium::PolynomialVector::polyvec_unpack_z(), and Botan::Dilithium::PolynomialVector::unpack_sig().

◆ power2round()

static int32_t Botan::Dilithium::Polynomial::power2round ( int32_t & a0,
int32_t a )
inlinestatic

Definition at line 178 of file dilithium_polynomials.h.

178 {
179 int32_t a1 = (a + (1 << (DilithiumModeConstants::D - 1)) - 1) >> DilithiumModeConstants::D;
180 a0 = a - (a1 << DilithiumModeConstants::D);
181 return a1;
182 }

References Botan::DilithiumModeConstants::D.

Referenced by fill_polys_power2round().

◆ rej_eta()

static size_t Botan::Dilithium::Polynomial::rej_eta ( Polynomial & a,
size_t offset,
size_t len,
const secure_vector< uint8_t > & buf,
size_t buflen,
const DilithiumModeConstants & mode )
inlinestatic

Definition at line 101 of file dilithium_polynomials.h.

106 {
107 size_t ctr = 0, pos = 0;
108 while(ctr < len && pos < buflen) {
109 uint32_t t0 = buf[pos] & 0x0F;
110 uint32_t t1 = buf[pos++] >> 4;
111
112 switch(mode.eta()) {
113 case DilithiumEta::Eta2: {
114 if(t0 < 15) {
115 t0 = t0 - (205 * t0 >> 10) * 5;
116 a.m_coeffs[offset + ctr++] = 2 - t0;
117 }
118 if(t1 < 15 && ctr < len) {
119 t1 = t1 - (205 * t1 >> 10) * 5;
120 a.m_coeffs[offset + ctr++] = 2 - t1;
121 }
122 } break;
123 case DilithiumEta::Eta4: {
124 if(t0 < 9) {
125 a.m_coeffs[offset + ctr++] = 4 - t0;
126 }
127 if(t1 < 9 && ctr < len) {
128 a.m_coeffs[offset + ctr++] = 4 - t1;
129 }
130 } break;
131 }
132 }
133 return ctr;
134 }

References Botan::DilithiumModeConstants::eta(), Botan::Eta2, Botan::Eta4, and m_coeffs.

Referenced by fill_poly_uniform_eta().

◆ rej_uniform()

static size_t Botan::Dilithium::Polynomial::rej_uniform ( Polynomial & p,
size_t position,
size_t len,
const uint8_t * buf,
size_t buflen )
inlinestatic

Definition at line 70 of file dilithium_polynomials.h.

70 {
71 size_t ctr = 0, pos = 0;
72 while(ctr < len && pos + 3 <= buflen) {
73 uint32_t t = buf[pos++];
74 t |= static_cast<uint32_t>(buf[pos++]) << 8;
75 t |= static_cast<uint32_t>(buf[pos++]) << 16;
76 t &= 0x7FFFFF;
77
78 if(t < DilithiumModeConstants::Q) {
79 p.m_coeffs[position + ctr++] = static_cast<int32_t>(t);
80 }
81 }
82 return ctr;
83 }

References m_coeffs, and Botan::DilithiumModeConstants::Q.

Referenced by Botan::Dilithium::PolynomialVector::poly_uniform().

◆ use_hint()

static int32_t Botan::Dilithium::Polynomial::use_hint ( int32_t a,
size_t hint,
const DilithiumModeConstants & mode )
inlinestatic

Definition at line 365 of file dilithium_polynomials.h.

365 {
366 int32_t a0;
367
368 int32_t a1 = Polynomial::decompose(&a0, a, mode);
369 if(hint == 0) {
370 return a1;
371 }
372
373 if(mode.gamma2() == ((DilithiumModeConstants::Q - 1) / 32)) {
374 if(a0 > 0) {
375 return (a1 + 1) & 15;
376 } else {
377 return (a1 - 1) & 15;
378 }
379 } else {
380 if(a0 > 0) {
381 return (a1 == 43) ? 0 : a1 + 1;
382 } else {
383 return (a1 == 0) ? 43 : a1 - 1;
384 }
385 }
386 }

References decompose(), Botan::DilithiumModeConstants::gamma2(), and Botan::DilithiumModeConstants::Q.

Referenced by poly_use_hint().

Member Data Documentation

◆ m_coeffs

std::array<int32_t, Botan::DilithiumModeConstants::N> Botan::Dilithium::Polynomial::m_coeffs

Definition at line 31 of file dilithium_polynomials.h.

Referenced by cadd_q(), fill_polys_power2round(), generate_hint_polynomial(), invntt_tomont(), ntt(), operator+=(), operator-=(), poly_challenge(), poly_chknorm(), poly_decompose(), poly_pointwise_montgomery(), poly_reduce(), poly_shiftl(), poly_use_hint(), polyeta_pack(), polyeta_unpack(), polyt0_pack(), polyt0_unpack(), polyt1_pack(), polyt1_unpack(), polyw1_pack(), polyz_pack(), polyz_unpack(), rej_eta(), and rej_uniform().

The documentation for this class was generated from the following file:
Generated by doxygen 1.10.0