14#ifndef BOTAN_DILITHIUM_POLYNOMIAL_H_
15#define BOTAN_DILITHIUM_POLYNOMIAL_H_
17#include <botan/dilithium.h>
19#include <botan/internal/dilithium_symmetric_primitives.h>
20#include <botan/internal/shake.h>
31 std::array<int32_t, Botan::DilithiumModeConstants::N>
m_coeffs;
38 for(
size_t i = 0; i < this->m_coeffs.size(); ++i) {
39 this->m_coeffs[i] = this->m_coeffs[i] + other.
m_coeffs[i];
49 for(
size_t i = 0; i < this->m_coeffs.size(); ++i) {
50 this->m_coeffs[i] = this->m_coeffs[i] - other.
m_coeffs[i];
71 size_t ctr = 0, pos = 0;
72 while(ctr < len && pos + 3 <= buflen) {
73 uint32_t t = buf[pos++];
74 t |=
static_cast<uint32_t
>(buf[pos++]) << 8;
75 t |=
static_cast<uint32_t
>(buf[pos++]) << 16;
79 p.
m_coeffs[position + ctr++] =
static_cast<int32_t
>(t);
107 size_t ctr = 0, pos = 0;
108 while(ctr < len && pos < buflen) {
109 uint32_t t0 = buf[pos] & 0x0F;
110 uint32_t t1 = buf[pos++] >> 4;
115 t0 = t0 - (205 * t0 >> 10) * 5;
116 a.
m_coeffs[offset + ctr++] = 2 - t0;
118 if(t1 < 15 && ctr < len) {
119 t1 = t1 - (205 * t1 >> 10) * 5;
120 a.
m_coeffs[offset + ctr++] = 2 - t1;
125 a.
m_coeffs[offset + ctr++] = 4 - t0;
127 if(t1 < 9 && ctr < len) {
128 a.
m_coeffs[offset + ctr++] = 4 - t1;
154 auto xof = mode.
XOF_256(seed, nonce);
218 auto buf = shake256_hasher.
final();
221 for(
size_t i = 0; i < 8; ++i) {
222 signs |=
static_cast<uint64_t
>(buf[i]) << 8 * i;
236 c.
m_coeffs[b] = 1 - 2 * (signs & 1);
261 for(
const auto& coeff : a.
m_coeffs) {
263 size_t t = coeff >> 31;
264 t = coeff - (t & 2 * coeff);
287 const auto gamma2 = mode.
gamma2();
289 if(a0 <= gamma2 || a0 > Q_gamma2 || (a0 == Q_gamma2 && a1 == 0)) {
339 int32_t a1 = (a + 127) >> 7;
341 a1 = (a1 * 1025 + (1 << 21)) >> 22;
345 a1 = (a1 * 11275 + (1 << 23)) >> 24;
346 a1 ^= ((43 - a1) >> 31) & a1;
349 *a0 = a - a1 * 2 *
static_cast<int32_t
>(mode.
gamma2());
375 return (a1 + 1) & 15;
377 return (a1 - 1) & 15;
381 return (a1 == 43) ? 0 : a1 + 1;
383 return (a1 == 0) ? 43 : a1 - 1;
455 for(
size_t len = 128; len > 0; len >>= 1) {
458 for(j = start; j < start + len; ++j) {
479 int32_t t = (i + (1 << 22)) >> 23;
501 for(j = start; j < start + len; ++j) {
584 for(
size_t i = 0; i <
m_coeffs.size(); ++i) {
602 r[3 * i + 0] =
static_cast<uint8_t
>(
m_coeffs[4 * i + 0]);
603 r[3 * i + 0] |=
static_cast<uint8_t
>(
m_coeffs[4 * i + 1] << 6);
604 r[3 * i + 1] =
static_cast<uint8_t
>(
m_coeffs[4 * i + 1] >> 2);
605 r[3 * i + 1] |=
static_cast<uint8_t
>(
m_coeffs[4 * i + 2] << 4);
606 r[3 * i + 2] =
static_cast<uint8_t
>(
m_coeffs[4 * i + 2] >> 4);
607 r[3 * i + 2] |=
static_cast<uint8_t
>(
m_coeffs[4 * i + 3] << 2);
612 r[i] =
static_cast<uint8_t
>(
m_coeffs[2 * i + 0] | (
m_coeffs[2 * i + 1] << 4));
632 r.
m_coeffs[8 * i + 0] = (a[3 * i + 0] >> 0) & 7;
633 r.
m_coeffs[8 * i + 1] = (a[3 * i + 0] >> 3) & 7;
634 r.
m_coeffs[8 * i + 2] = ((a[3 * i + 0] >> 6) | (a[3 * i + 1] << 2)) & 7;
635 r.
m_coeffs[8 * i + 3] = (a[3 * i + 1] >> 1) & 7;
636 r.
m_coeffs[8 * i + 4] = (a[3 * i + 1] >> 4) & 7;
637 r.
m_coeffs[8 * i + 5] = ((a[3 * i + 1] >> 7) | (a[3 * i + 2] << 1)) & 7;
638 r.
m_coeffs[8 * i + 6] = (a[3 * i + 2] >> 2) & 7;
639 r.
m_coeffs[8 * i + 7] = (a[3 * i + 2] >> 5) & 7;
653 r.
m_coeffs[2 * i + 0] = a[i] & 0x0F;
680 t[0] =
static_cast<uint8_t
>(mode.
eta() -
m_coeffs[8 * i + 0]);
681 t[1] =
static_cast<uint8_t
>(mode.
eta() -
m_coeffs[8 * i + 1]);
682 t[2] =
static_cast<uint8_t
>(mode.
eta() -
m_coeffs[8 * i + 2]);
683 t[3] =
static_cast<uint8_t
>(mode.
eta() -
m_coeffs[8 * i + 3]);
684 t[4] =
static_cast<uint8_t
>(mode.
eta() -
m_coeffs[8 * i + 4]);
685 t[5] =
static_cast<uint8_t
>(mode.
eta() -
m_coeffs[8 * i + 5]);
686 t[6] =
static_cast<uint8_t
>(mode.
eta() -
m_coeffs[8 * i + 6]);
687 t[7] =
static_cast<uint8_t
>(mode.
eta() -
m_coeffs[8 * i + 7]);
689 r[3 * i + 0] = (t[0] >> 0) | (t[1] << 3) | (t[2] << 6);
690 r[3 * i + 1] = (t[2] >> 2) | (t[3] << 1) | (t[4] << 4) | (t[5] << 7);
691 r[3 * i + 2] = (t[5] >> 1) | (t[6] << 2) | (t[7] << 5);
696 t[0] =
static_cast<uint8_t
>(mode.
eta() -
m_coeffs[2 * i + 0]);
697 t[1] =
static_cast<uint8_t
>(mode.
eta() -
m_coeffs[2 * i + 1]);
698 r[i] =
static_cast<uint8_t
>(t[0] | (t[1] << 4));
716 r.
m_coeffs[8 * i + 0] = a[13 * i + 0];
717 r.
m_coeffs[8 * i + 0] |=
static_cast<uint32_t
>(a[13 * i + 1]) << 8;
720 r.
m_coeffs[8 * i + 1] = a[13 * i + 1] >> 5;
721 r.
m_coeffs[8 * i + 1] |=
static_cast<uint32_t
>(a[13 * i + 2]) << 3;
722 r.
m_coeffs[8 * i + 1] |=
static_cast<uint32_t
>(a[13 * i + 3]) << 11;
725 r.
m_coeffs[8 * i + 2] = a[13 * i + 3] >> 2;
726 r.
m_coeffs[8 * i + 2] |=
static_cast<uint32_t
>(a[13 * i + 4]) << 6;
729 r.
m_coeffs[8 * i + 3] = a[13 * i + 4] >> 7;
730 r.
m_coeffs[8 * i + 3] |=
static_cast<uint32_t
>(a[13 * i + 5]) << 1;
731 r.
m_coeffs[8 * i + 3] |=
static_cast<uint32_t
>(a[13 * i + 6]) << 9;
734 r.
m_coeffs[8 * i + 4] = a[13 * i + 6] >> 4;
735 r.
m_coeffs[8 * i + 4] |=
static_cast<uint32_t
>(a[13 * i + 7]) << 4;
736 r.
m_coeffs[8 * i + 4] |=
static_cast<uint32_t
>(a[13 * i + 8]) << 12;
739 r.
m_coeffs[8 * i + 5] = a[13 * i + 8] >> 1;
740 r.
m_coeffs[8 * i + 5] |=
static_cast<uint32_t
>(a[13 * i + 9]) << 7;
743 r.
m_coeffs[8 * i + 6] = a[13 * i + 9] >> 6;
744 r.
m_coeffs[8 * i + 6] |=
static_cast<uint32_t
>(a[13 * i + 10]) << 2;
745 r.
m_coeffs[8 * i + 6] |=
static_cast<uint32_t
>(a[13 * i + 11]) << 10;
748 r.
m_coeffs[8 * i + 7] = a[13 * i + 11] >> 3;
749 r.
m_coeffs[8 * i + 7] |=
static_cast<uint32_t
>(a[13 * i + 12]) << 5;
786 r[13 * i + 0] =
static_cast<uint8_t
>(t[0]);
787 r[13 * i + 1] =
static_cast<uint8_t
>(t[0] >> 8);
788 r[13 * i + 1] |=
static_cast<uint8_t
>(t[1] << 5);
789 r[13 * i + 2] =
static_cast<uint8_t
>(t[1] >> 3);
790 r[13 * i + 3] =
static_cast<uint8_t
>(t[1] >> 11);
791 r[13 * i + 3] |=
static_cast<uint8_t
>(t[2] << 2);
792 r[13 * i + 4] =
static_cast<uint8_t
>(t[2] >> 6);
793 r[13 * i + 4] |=
static_cast<uint8_t
>(t[3] << 7);
794 r[13 * i + 5] =
static_cast<uint8_t
>(t[3] >> 1);
795 r[13 * i + 6] =
static_cast<uint8_t
>(t[3] >> 9);
796 r[13 * i + 6] |=
static_cast<uint8_t
>(t[4] << 4);
797 r[13 * i + 7] =
static_cast<uint8_t
>(t[4] >> 4);
798 r[13 * i + 8] =
static_cast<uint8_t
>(t[4] >> 12);
799 r[13 * i + 8] |=
static_cast<uint8_t
>(t[5] << 1);
800 r[13 * i + 9] =
static_cast<uint8_t
>(t[5] >> 7);
801 r[13 * i + 9] |=
static_cast<uint8_t
>(t[6] << 6);
802 r[13 * i + 10] =
static_cast<uint8_t
>(t[6] >> 2);
803 r[13 * i + 11] =
static_cast<uint8_t
>(t[6] >> 10);
804 r[13 * i + 11] |=
static_cast<uint8_t
>(t[7] << 3);
805 r[13 * i + 12] =
static_cast<uint8_t
>(t[7] >> 5);
820 if(mode.
gamma1() == (1 << 17)) {
822 r.
m_coeffs[4 * i + 0] = a[9 * i + 0];
823 r.
m_coeffs[4 * i + 0] |=
static_cast<uint32_t
>(a[9 * i + 1]) << 8;
824 r.
m_coeffs[4 * i + 0] |=
static_cast<uint32_t
>(a[9 * i + 2]) << 16;
827 r.
m_coeffs[4 * i + 1] = a[9 * i + 2] >> 2;
828 r.
m_coeffs[4 * i + 1] |=
static_cast<uint32_t
>(a[9 * i + 3]) << 6;
829 r.
m_coeffs[4 * i + 1] |=
static_cast<uint32_t
>(a[9 * i + 4]) << 14;
832 r.
m_coeffs[4 * i + 2] = a[9 * i + 4] >> 4;
833 r.
m_coeffs[4 * i + 2] |=
static_cast<uint32_t
>(a[9 * i + 5]) << 4;
834 r.
m_coeffs[4 * i + 2] |=
static_cast<uint32_t
>(a[9 * i + 6]) << 12;
837 r.
m_coeffs[4 * i + 3] = a[9 * i + 6] >> 6;
838 r.
m_coeffs[4 * i + 3] |=
static_cast<uint32_t
>(a[9 * i + 7]) << 2;
839 r.
m_coeffs[4 * i + 3] |=
static_cast<uint32_t
>(a[9 * i + 8]) << 10;
847 }
else if(mode.
gamma1() == (1 << 19)) {
849 r.
m_coeffs[2 * i + 0] = a[5 * i + 0];
850 r.
m_coeffs[2 * i + 0] |=
static_cast<uint32_t
>(a[5 * i + 1]) << 8;
851 r.
m_coeffs[2 * i + 0] |=
static_cast<uint32_t
>(a[5 * i + 2]) << 16;
854 r.
m_coeffs[2 * i + 1] = a[5 * i + 2] >> 4;
855 r.
m_coeffs[2 * i + 1] |=
static_cast<uint32_t
>(a[5 * i + 3]) << 4;
856 r.
m_coeffs[2 * i + 1] |=
static_cast<uint32_t
>(a[5 * i + 4]) << 12;
877 if(mode.
gamma1() == (1 << 17)) {
879 t[0] =
static_cast<uint32_t
>(mode.
gamma1()) -
m_coeffs[4 * i + 0];
880 t[1] =
static_cast<uint32_t
>(mode.
gamma1()) -
m_coeffs[4 * i + 1];
881 t[2] =
static_cast<uint32_t
>(mode.
gamma1()) -
m_coeffs[4 * i + 2];
882 t[3] =
static_cast<uint32_t
>(mode.
gamma1()) -
m_coeffs[4 * i + 3];
884 r[9 * i + 0] =
static_cast<uint8_t
>(t[0]);
885 r[9 * i + 1] =
static_cast<uint8_t
>(t[0] >> 8);
886 r[9 * i + 2] =
static_cast<uint8_t
>(t[0] >> 16);
887 r[9 * i + 2] |=
static_cast<uint8_t
>(t[1] << 2);
888 r[9 * i + 3] =
static_cast<uint8_t
>(t[1] >> 6);
889 r[9 * i + 4] =
static_cast<uint8_t
>(t[1] >> 14);
890 r[9 * i + 4] |=
static_cast<uint8_t
>(t[2] << 4);
891 r[9 * i + 5] =
static_cast<uint8_t
>(t[2] >> 4);
892 r[9 * i + 6] =
static_cast<uint8_t
>(t[2] >> 12);
893 r[9 * i + 6] |=
static_cast<uint8_t
>(t[3] << 6);
894 r[9 * i + 7] =
static_cast<uint8_t
>(t[3] >> 2);
895 r[9 * i + 8] =
static_cast<uint8_t
>(t[3] >> 10);
897 }
else if(mode.
gamma1() == (1 << 19)) {
899 t[0] =
static_cast<uint32_t
>(mode.
gamma1()) -
m_coeffs[2 * i + 0];
900 t[1] =
static_cast<uint32_t
>(mode.
gamma1()) -
m_coeffs[2 * i + 1];
902 r[5 * i + 0] =
static_cast<uint8_t
>(t[0]);
903 r[5 * i + 1] =
static_cast<uint8_t
>(t[0] >> 8);
904 r[5 * i + 2] =
static_cast<uint8_t
>(t[0] >> 16);
905 r[5 * i + 2] |=
static_cast<uint8_t
>(t[1] << 4);
906 r[5 * i + 3] =
static_cast<uint8_t
>(t[1] >> 4);
907 r[5 * i + 4] =
static_cast<uint8_t
>(t[1] >> 12);
923 r.
m_coeffs[4 * i + 0] = ((a[5 * i + 0] >> 0) | (
static_cast<uint32_t
>(a[5 * i + 1]) << 8)) & 0x3FF;
924 r.
m_coeffs[4 * i + 1] = ((a[5 * i + 1] >> 2) | (
static_cast<uint32_t
>(a[5 * i + 2]) << 6)) & 0x3FF;
925 r.
m_coeffs[4 * i + 2] = ((a[5 * i + 2] >> 4) | (
static_cast<uint32_t
>(a[5 * i + 3]) << 4)) & 0x3FF;
926 r.
m_coeffs[4 * i + 3] = ((a[5 * i + 3] >> 6) | (
static_cast<uint32_t
>(a[5 * i + 4]) << 2)) & 0x3FF;
941 r[5 * i + 0] =
static_cast<uint8_t
>((
m_coeffs[4 * i + 0] >> 0));
942 r[5 * i + 1] =
static_cast<uint8_t
>((
m_coeffs[4 * i + 0] >> 8) | (
m_coeffs[4 * i + 1] << 2));
943 r[5 * i + 2] =
static_cast<uint8_t
>((
m_coeffs[4 * i + 1] >> 6) | (
m_coeffs[4 * i + 2] << 4));
944 r[5 * i + 3] =
static_cast<uint8_t
>((
m_coeffs[4 * i + 2] >> 4) | (
m_coeffs[4 * i + 3] << 6));
945 r[5 * i + 4] =
static_cast<uint8_t
>((
m_coeffs[4 * i + 3] >> 2));
962 for(
size_t i = 0; i <
m_vec.size(); ++i) {
963 this->m_vec[i] += other.
m_vec[i];
970 for(
size_t i = 0; i < this->m_vec.size(); ++i) {
971 this->m_vec[i] -= other.
m_vec[i];
996 std::vector<uint8_t> buf(buflen + 2);
998 auto xof = mode.
XOF_128(seed, nonce);
999 xof->output(std::span(buf).first(buflen));
1005 for(
size_t i = 0; i < off; ++i) {
1006 buf[i] = buf[buflen - off + i];
1020 for(
size_t i = 0; i < v.
m_vec.size(); ++i) {
1042 u.
m_vec[0].poly_pointwise_montgomery(w, v.
m_vec[0]);
1044 for(
size_t i = 1; i < v.
m_vec.size(); ++i) {
1046 u.
m_vec[i].poly_pointwise_montgomery(t, v.
m_vec[i]);
1067 "possible buffer overflow! Wrong PolynomialVector sizes.");
1068 for(
size_t i = 0; i < v1.
m_vec.size(); ++i) {
1073 static bool unpack_sig(std::array<uint8_t, DilithiumModeConstants::SEEDBYTES>& c,
1076 const std::vector<uint8_t>& sig,
1080 size_t position = 0;
1082 std::copy(sig.begin(), sig.begin() + c.size(), c.begin());
1086 for(
size_t i = 0; i < mode.
l(); ++i) {
1093 for(
size_t i = 0; i < mode.
k(); ++i) {
1095 h.
m_vec[i].m_coeffs[j] = 0;
1098 if(sig[position + mode.
omega() + i] < k || sig[position + mode.
omega() + i] > mode.
omega()) {
1102 for(
size_t j = k; j < sig[position + mode.
omega() + i]; ++j) {
1104 if(j > k && sig[position + j] <= sig[position + j - 1]) {
1107 h.
m_vec[i].m_coeffs[sig[position + j]] = 1;
1110 k = sig[position + mode.
omega() + i];
1114 for(
size_t j = k; j < mode.
omega(); ++j) {
1115 if(sig[position + j]) {
1141 for(
size_t i = 0; i < h.
m_vec.size(); ++i) {
1155 for(
auto& i :
m_vec) {
1179 for(
size_t i = 0; i <
m_vec.size(); ++i) {
1182 return std::make_tuple(v1, v0);
1192 for(
auto& i :
m_vec) {
1205 for(
auto& i :
m_vec) {
1206 i.poly_invntt_tomont();
1220 BOTAN_ASSERT((
m_vec.size() == v.
m_vec.size()),
"possible buffer overflow! Wrong PolynomialVector sizes.");
1221 for(
size_t i = 0; i <
m_vec.size(); ++i) {
1233 for(
auto& i :
m_vec) {
1242 for(uint16_t i = 0; i < static_cast<uint16_t>(this->m_vec.size()); ++i) {
1243 m_vec[i].poly_uniform_gamma1(seed, mode.
l() * nonce + i, mode);
1248 for(
size_t i = 0; i <
m_vec.size(); ++i) {
1249 m_vec[i].poly_pointwise_montgomery(r.
m_vec[i], a);
1265 for(
auto& i :
m_vec) {
1280 for(
auto& i :
m_vec) {
1297 for(
size_t i = 0; i < w.
m_vec.size(); ++i) {
1304 for(
size_t i = 0; i <
m_vec.size(); ++i) {
1316 for(
size_t i = 0; i < pv.
m_vec.size(); ++i) {
1325 for(
size_t i = 0; i <
m_vec.size(); ++i) {
1333 "Invalid buffer size");
1336 for(
size_t i = 0; i < t0.
m_vec.size(); ++i) {
1345 for(
size_t i = 0; i <
m_vec.size(); ++i) {
1354 "Invalid buffer size");
1357 for(
size_t i = 0; i < t1.
m_vec.size(); ++i) {
1365 for(
size_t i = 0; i <
m_vec.size(); ++i) {
1373 for(
size_t i = 0; i < z.
m_vec.size(); ++i) {
1392 for(
size_t i = 0; i < mode.
k(); ++i) {
1402 std::vector<PolynomialVector> m_mat;
1425 for(uint16_t i = 0; i < mode.
k(); ++i) {
1426 for(uint16_t j = 0; j < mode.
l(); ++j) {
1433 const std::vector<PolynomialVector>&
get_matrix()
const {
return m_mat; }
#define BOTAN_ASSERT_NOMSG(expr)
#define BOTAN_ARG_CHECK(expr, msg)
#define BOTAN_ASSERT(expr, assertion_made)
void update(const uint8_t in[], size_t length)
void final(uint8_t out[])
static constexpr int32_t SEEDBYTES
std::unique_ptr< Botan::XOF > XOF_128(std::span< const uint8_t > seed, uint16_t nonce) const
size_t polyz_packedbytes() const
size_t polyw1_packedbytes() const
size_t crypto_bytes() const
static constexpr int32_t POLYT0_PACKEDBYTES
static constexpr int32_t SHAKE256_RATE
size_t polyeta_packedbytes() const
size_t stream128_blockbytes() const
size_t poly_uniform_nblocks() const
static constexpr int32_t Q
static constexpr int32_t POLYT1_PACKEDBYTES
static constexpr int32_t N
size_t stream256_blockbytes() const
std::unique_ptr< Botan::XOF > XOF_256(std::span< const uint8_t > seed, uint16_t nonce) const
secure_vector< uint8_t > ExpandMask(const secure_vector< uint8_t > &seed, uint16_t nonce) const
static constexpr int32_t ZETAS[DilithiumModeConstants::N]
static constexpr int32_t CRHBYTES
static constexpr int32_t QINV
static constexpr int32_t D
size_t poly_uniform_eta_nblocks() const
const std::vector< PolynomialVector > & get_matrix() const
static PolynomialMatrix generate_matrix(const std::vector< uint8_t > &rho, const DilithiumModeConstants &mode)
PolynomialMatrix()=delete
static PolynomialVector polyvec_unpack_z(const uint8_t *packed_z, const DilithiumModeConstants &mode)
static PolynomialVector unpack_t1(std::span< const uint8_t > packed_t1, const DilithiumModeConstants &mode)
static bool unpack_sig(std::array< uint8_t, DilithiumModeConstants::SEEDBYTES > &c, PolynomialVector &z, PolynomialVector &h, const std::vector< uint8_t > &sig, const DilithiumModeConstants &mode)
secure_vector< uint8_t > polyvec_pack_t0() const
secure_vector< uint8_t > polyvec_pack_eta(const DilithiumModeConstants &mode) const
static PolynomialVector unpack_t0(std::span< const uint8_t > buffer, const DilithiumModeConstants &mode)
std::vector< Polynomial > m_vec
static void polyvec_pointwise_acc_montgomery(Polynomial &w, const PolynomialVector &u, const PolynomialVector &v)
void polyvec_use_hint(PolynomialVector &w, const PolynomialVector &h, const DilithiumModeConstants &mode)
PolynomialVector & operator+=(const PolynomialVector &other)
void polyvecl_uniform_gamma1(const secure_vector< uint8_t > &seed, uint16_t nonce, const DilithiumModeConstants &mode)
PolynomialVector()=default
static void fill_polyvec_uniform_eta(PolynomialVector &v, const secure_vector< uint8_t > &seed, uint16_t nonce, const DilithiumModeConstants &mode)
static void fill_polyvecs_power2round(PolynomialVector &v1, PolynomialVector &v0, const PolynomialVector &v)
PolynomialVector(size_t size)
bool polyvec_chknorm(size_t bound)
static PolynomialVector generate_polyvec_matrix_pointwise_montgomery(const std::vector< PolynomialVector > &mat, const PolynomialVector &v, const DilithiumModeConstants &mode)
void add_polyvec(const PolynomialVector &v)
static Polynomial poly_uniform(const std::vector< uint8_t > &seed, uint16_t nonce, const DilithiumModeConstants &mode)
std::vector< uint8_t > polyvec_pack_t1() const
std::vector< uint8_t > polyvec_pack_w1(const DilithiumModeConstants &mode)
static PolynomialVector unpack_eta(std::span< const uint8_t > buffer, size_t size, const DilithiumModeConstants &mode)
std::tuple< PolynomialVector, PolynomialVector > polyvec_decompose(const DilithiumModeConstants &mode)
PolynomialVector & operator-=(const PolynomialVector &other)
void polyvec_pointwise_poly_montgomery(PolynomialVector &r, const Polynomial &a)
static size_t generate_hint_polyvec(PolynomialVector &h, const PolynomialVector &v0, const PolynomialVector &v1, const DilithiumModeConstants &mode)
static size_t rej_eta(Polynomial &a, size_t offset, size_t len, const secure_vector< uint8_t > &buf, size_t buflen, const DilithiumModeConstants &mode)
void polyt1_pack(uint8_t *r) const
static int32_t power2round(int32_t &a0, int32_t a)
static void polyz_unpack(Polynomial &r, const uint8_t *a, const DilithiumModeConstants &mode)
static void fill_polys_power2round(Polynomial &a1, Polynomial &a0, const Polynomial &a)
static Polynomial polyt0_unpack(std::span< const uint8_t > a)
void polyeta_pack(uint8_t *r, const DilithiumModeConstants &mode) const
void poly_decompose(Polynomial &a1, Polynomial &a0, const DilithiumModeConstants &mode) const
void poly_invntt_tomont()
static Polynomial poly_challenge(const uint8_t *seed, const DilithiumModeConstants &mode)
static void polyt1_unpack(Polynomial &r, const uint8_t *a)
static int32_t use_hint(int32_t a, size_t hint, const DilithiumModeConstants &mode)
void poly_uniform_gamma1(const secure_vector< uint8_t > &seed, uint16_t nonce, const DilithiumModeConstants &mode)
void poly_pointwise_montgomery(Polynomial &output, const Polynomial &second) const
Polynomial & operator+=(const Polynomial &other)
static Polynomial polyeta_unpack(std::span< const uint8_t > a, const DilithiumModeConstants &mode)
static void fill_poly_uniform_eta(Polynomial &a, const secure_vector< uint8_t > &seed, uint16_t nonce, const DilithiumModeConstants &mode)
static int32_t make_hint(size_t a0, size_t a1, const DilithiumModeConstants &mode)
void polyz_pack(uint8_t *r, const DilithiumModeConstants &mode) const
int32_t montgomery_reduce(int64_t a) const
std::array< int32_t, Botan::DilithiumModeConstants::N > m_coeffs
void polyt0_pack(uint8_t *r) const
void polyw1_pack(uint8_t *r, const DilithiumModeConstants &mode)
static int32_t decompose(int32_t *a0, int32_t a, const DilithiumModeConstants &mode)
static bool poly_chknorm(const Polynomial &a, size_t B)
static size_t generate_hint_polynomial(Polynomial &h, const Polynomial &a0, const Polynomial &a1, const DilithiumModeConstants &mode)
Polynomial & operator-=(const Polynomial &other)
static size_t rej_uniform(Polynomial &p, size_t position, size_t len, const uint8_t *buf, size_t buflen)
static void poly_use_hint(Polynomial &b, const Polynomial &a, const Polynomial &h, const DilithiumModeConstants &mode)
std::vector< T, secure_allocator< T > > secure_vector