#include "precomp.h"

Include dependency graph for mlkem_primitives.c:

Macros
#define	SYMCRYPT_MLKEM_MaxCoeff (SYMCRYPT_MLKEM_Q - 1)

#define	SYMCRYPT_MLKEM_MaxCoeffProduct (SYMCRYPT_MLKEM_MaxCoeff*SYMCRYPT_MLKEM_MaxCoeff)

#define	SYMCRYPT_MLKEM_MaxFirstStepReduction (3494)

#define	SYMCRYPT_MLKEM_MaxZetaTwoTimesPlus1TimesR (3254)

#define	SYMCRYPT_MLKEM_MaxA1B1ZetaPow (SYMCRYPT_MLKEM_MaxFirstStepReduction*SYMCRYPT_MLKEM_MaxZetaTwoTimesPlus1TimesR)

Functions
PSYMCRYPT_MLKEM_POLYELEMENT SYMCRYPT_CALL	SymCryptMlKemPolyElementCreate (_Out_writes_bytes_(cbBuffer) PBYTE pbBuffer, UINT32 cbBuffer)

PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR SYMCRYPT_CALL	SymCryptMlKemPolyElementAccumulatorCreate (_Out_writes_bytes_(cbBuffer) PBYTE pbBuffer, UINT32 cbBuffer)

PSYMCRYPT_MLKEM_VECTOR SYMCRYPT_CALL	SymCryptMlKemVectorCreate (_Out_writes_bytes_(cbBuffer) PBYTE pbBuffer, UINT32 cbBuffer, UINT32 nRows)

PSYMCRYPT_MLKEM_MATRIX SYMCRYPT_CALL	SymCryptMlKemMatrixCreate (_Out_writes_bytes_(cbBuffer) PBYTE pbBuffer, UINT32 cbBuffer, UINT32 nRows)

FORCEINLINE UINT32 SYMCRYPT_CALL	SymCryptMlKemModAdd (UINT32 a, UINT32 b)

FORCEINLINE UINT32 SYMCRYPT_CALL	SymCryptMlKemModSub (UINT32 a, UINT32 b)

FORCEINLINE UINT32 SYMCRYPT_CALL	SymCryptMlKemMontMul (UINT32 a, UINT32 b, UINT32 bMont)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementNTTLayerC (_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT peSrc, UINT32 k, UINT32 len)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementINTTLayerC (_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT peSrc, UINT32 k, UINT32 len)

FORCEINLINE VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementNTTLayer (_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT peSrc, UINT32 k, UINT32 len)

FORCEINLINE VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementINTTLayer (_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT peSrc, UINT32 k, UINT32 len)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementMulAndAccumulate (_In_ PCSYMCRYPT_MLKEM_POLYELEMENT peSrc1, _In_ PCSYMCRYPT_MLKEM_POLYELEMENT peSrc2, _Inout_ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR paDst)

VOID SYMCRYPT_CALL	SymCryptMlKemMontgomeryReduceAndAddPolyElementAccumulatorToPolyElement (_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR paSrc, _Inout_ PSYMCRYPT_MLKEM_POLYELEMENT peDst)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementMulR (_In_ PCSYMCRYPT_MLKEM_POLYELEMENT peSrc, _Out_ PSYMCRYPT_MLKEM_POLYELEMENT peDst)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementAdd (_In_ PCSYMCRYPT_MLKEM_POLYELEMENT peSrc1, _In_ PCSYMCRYPT_MLKEM_POLYELEMENT peSrc2, _Out_ PSYMCRYPT_MLKEM_POLYELEMENT peDst)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementSub (_In_ PCSYMCRYPT_MLKEM_POLYELEMENT peSrc1, _In_ PCSYMCRYPT_MLKEM_POLYELEMENT peSrc2, _Out_ PSYMCRYPT_MLKEM_POLYELEMENT peDst)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementNTT (_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT peSrc)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementINTTAndMulR (_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT peSrc)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementCompressAndEncode (_In_ PCSYMCRYPT_MLKEM_POLYELEMENT peSrc, UINT32 nBitsPerCoefficient, _Out_writes_bytes_(nBitsPerCoefficient *(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS/8)) PBYTE pbDst)

SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptMlKemPolyElementDecodeAndDecompress (_In_reads_bytes_(nBitsPerCoefficient *(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS/8)) PCBYTE pbSrc, UINT32 nBitsPerCoefficient, _Out_ PSYMCRYPT_MLKEM_POLYELEMENT peDst)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementSampleNTTFromShake128 (_Inout_ PSYMCRYPT_SHAKE128_STATE pState, _Out_ PSYMCRYPT_MLKEM_POLYELEMENT peDst)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementSampleCBDFromBytes (_In_reads_bytes_(eta 2 (SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS/8)+1) PCBYTE pbSrc, _In_range_(2, 3) UINT32 eta, _Out_ PSYMCRYPT_MLKEM_POLYELEMENT peDst)

VOID SYMCRYPT_CALL	SymCryptMlKemMatrixTranspose (_Inout_ PSYMCRYPT_MLKEM_MATRIX pmSrc)

VOID SYMCRYPT_CALL	SymCryptMlKemMatrixVectorMontMulAndAdd (_In_ PCSYMCRYPT_MLKEM_MATRIX pmSrc1, _In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc2, _Inout_ PSYMCRYPT_MLKEM_VECTOR pvDst, _Inout_ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR paTmp)

VOID SYMCRYPT_CALL	SymCryptMlKemVectorMontDotProduct (_In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc1, _In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc2, _Inout_ PSYMCRYPT_MLKEM_POLYELEMENT peDst, _Inout_ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR paTmp)

VOID SYMCRYPT_CALL	SymCryptMlKemVectorSetZero (_Inout_ PSYMCRYPT_MLKEM_VECTOR pvSrc)

VOID SYMCRYPT_CALL	SymCryptMlKemVectorMulR (_In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc, _Out_ PSYMCRYPT_MLKEM_VECTOR pvDst)

VOID SYMCRYPT_CALL	SymCryptMlKemVectorAdd (_In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc1, _In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc2, _Out_ PSYMCRYPT_MLKEM_VECTOR pvDst)

VOID SYMCRYPT_CALL	SymCryptMlKemVectorSub (_In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc1, _In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc2, _Out_ PSYMCRYPT_MLKEM_VECTOR pvDst)

VOID SYMCRYPT_CALL	SymCryptMlKemVectorNTT (_Inout_ PSYMCRYPT_MLKEM_VECTOR pvSrc)

VOID SYMCRYPT_CALL	SymCryptMlKemVectorINTTAndMulR (_Inout_ PSYMCRYPT_MLKEM_VECTOR pvSrc)

VOID SYMCRYPT_CALL	SymCryptMlKemVectorCompressAndEncode (_In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc, UINT32 nBitsPerCoefficient, _Out_writes_bytes_(cbDst) PBYTE pbDst, SIZE_T cbDst)

SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptMlKemVectorDecodeAndDecompress (_In_reads_bytes_(cbSrc) PCBYTE pbSrc, SIZE_T cbSrc, UINT32 nBitsPerCoefficient, _Out_ PSYMCRYPT_MLKEM_VECTOR pvDst)

VOID SYMCRYPT_CALL	SymCryptMlKemkeyWipePrivateState (_Inout_ PSYMCRYPT_MLKEMKEY pkMlKemkey)

Variables
const UINT32	SYMCRYPT_MLKEM_Rlog2 = 16

const UINT32	SYMCRYPT_MLKEM_Rmask = 0xffff

const UINT32	SYMCRYPT_MLKEM_NegQInvModR = 3327

const UINT32	SYMCRYPT_MLKEM_Rsqr = 1353

const UINT32	SYMCRYPT_MLKEM_RsqrTimesNegQInvModR = 44983

const UINT16	MlKemZetaBitRevTimesR [128]

const UINT16	MlKemZetaBitRevTimesRTimesNegQInvModR [128]

const UINT16	zetaTwoTimesBitRevPlus1TimesR [128]

const UINT32	SYMCRYPT_MLKEM_INTTFixupTimesRsqr = 1441

const UINT32	SYMCRYPT_MLKEM_INTTFixupTimesRsqrTimesNegQInvModR = 10079

const UINT32	SYMCRYPT_MLKEM_COMPRESS_MULCONSTANT = 0x275f6f

const UINT32	SYMCRYPT_MLKEM_COMPRESS_SHIFTCONSTANT = 33

Macro Definition Documentation

◆ SYMCRYPT_MLKEM_MaxA1B1ZetaPow

#define SYMCRYPT_MLKEM_MaxA1B1ZetaPow (SYMCRYPT_MLKEM_MaxFirstStepReduction*SYMCRYPT_MLKEM_MaxZetaTwoTimesPlus1TimesR)

Definition at line 687 of file mlkem_primitives.c.

◆ SYMCRYPT_MLKEM_MaxCoeff

#define SYMCRYPT_MLKEM_MaxCoeff (SYMCRYPT_MLKEM_Q - 1)

Definition at line 680 of file mlkem_primitives.c.

◆ SYMCRYPT_MLKEM_MaxCoeffProduct

#define SYMCRYPT_MLKEM_MaxCoeffProduct (SYMCRYPT_MLKEM_MaxCoeff*SYMCRYPT_MLKEM_MaxCoeff)

Definition at line 681 of file mlkem_primitives.c.

◆ SYMCRYPT_MLKEM_MaxFirstStepReduction

#define SYMCRYPT_MLKEM_MaxFirstStepReduction (3494)

Definition at line 684 of file mlkem_primitives.c.

◆ SYMCRYPT_MLKEM_MaxZetaTwoTimesPlus1TimesR

#define SYMCRYPT_MLKEM_MaxZetaTwoTimesPlus1TimesR (3254)

Definition at line 686 of file mlkem_primitives.c.

Function Documentation

◆ SymCryptMlKemkeyWipePrivateState()

VOID SYMCRYPT_CALL SymCryptMlKemkeyWipePrivateState ( _Inout_ PSYMCRYPT_MLKEMKEY pkMlKemkey )

Definition at line 1426 of file mlkem_primitives.c.

{
    SymCryptMlKemVectorSetZero( pkMlKemkey->pvs );
    SymCryptWipeKnownSize( pkMlKemkey->privateRandom, sizeof(pkMlKemkey->privateRandom) );
    SymCryptWipeKnownSize( pkMlKemkey->privateSeed, sizeof(pkMlKemkey->privateSeed) );
    pkMlKemkey->hasPrivateKey = FALSE;
    pkMlKemkey->hasPrivateSeed = FALSE;
}

◆ SymCryptMlKemMatrixCreate()

PSYMCRYPT_MLKEM_MATRIX SYMCRYPT_CALL SymCryptMlKemMatrixCreate	(	_Out_writes_bytes_(cbBuffer) PBYTE	pbBuffer,
		UINT32	cbBuffer,
		UINT32	nRows
	)

Definition at line 196 of file mlkem_primitives.c.

{
    PSYMCRYPT_MLKEM_MATRIX pDst = NULL;
    PSYMCRYPT_MLKEM_MATRIX pMatrix = (PSYMCRYPT_MLKEM_MATRIX)pbBuffer;
    UINT32 i;
    PBYTE pbTmp = pbBuffer + sizeof(SYMCRYPT_MLKEM_MATRIX);
 
    SYMCRYPT_ASSERT_ASYM_ALIGNED( pbBuffer );
 
    SYMCRYPT_ASSERT( nRows > 0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
 
    pMatrix->nRows = nRows;
    pMatrix->cbTotalSize = cbBuffer;
 
    for( i=0; i<(nRows*nRows); i++ )
    {
        pMatrix->apPolyElements[i] = SymCryptMlKemPolyElementCreate( pbTmp, SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT );
        if( pMatrix->apPolyElements[i] == NULL )
        {
            goto cleanup;
        }
 
        pbTmp += SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT;
    }
 
    SYMCRYPT_ASSERT( pbTmp == (pbBuffer + cbBuffer) );
 
    pDst = pMatrix;
 
cleanup:
    return pDst;
}

Referenced by SymCryptMlKemkeyInitialize().

◆ SymCryptMlKemMatrixTranspose()

VOID SYMCRYPT_CALL SymCryptMlKemMatrixTranspose ( _Inout_ PSYMCRYPT_MLKEM_MATRIX pmSrc )

Definition at line 1152 of file mlkem_primitives.c.

{
    UINT32 i, j;
    PSYMCRYPT_MLKEM_POLYELEMENT swap;
    const UINT32 nRows = pmSrc->nRows;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
 
    for( i=0; i<nRows; i++ )
    {
        for( j=i+1; j<nRows; j++ )
        {
            swap = pmSrc->apPolyElements[(i*nRows) + j];
            pmSrc->apPolyElements[(i*nRows) + j] = pmSrc->apPolyElements[(j*nRows) + i];
            pmSrc->apPolyElements[(j*nRows) + i] = swap;
        }
    }
}

Referenced by SymCryptMlKemkeyExpandFromPrivateSeed(), and SymCryptMlKemkeySetValue().

◆ SymCryptMlKemMatrixVectorMontMulAndAdd()

VOID SYMCRYPT_CALL SymCryptMlKemMatrixVectorMontMulAndAdd	(	_In_ PCSYMCRYPT_MLKEM_MATRIX	pmSrc1,
		_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc2,
		_Inout_ PSYMCRYPT_MLKEM_VECTOR	pvDst,
		_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR	paTmp
	)

Definition at line 1175 of file mlkem_primitives.c.

{
    UINT32 i, j;
    const UINT32 nRows = pmSrc1->nRows;
    PCSYMCRYPT_MLKEM_POLYELEMENT peSrc1, peSrc2;
    PSYMCRYPT_MLKEM_POLYELEMENT  peDst;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
    SYMCRYPT_ASSERT( pvSrc2->nRows == nRows );
    SYMCRYPT_ASSERT( pvDst->nRows == nRows );
 
    // Zero paTmp
    SymCryptWipeKnownSize( paTmp, SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT_ACCUMULATOR );
 
    for( i=0; i<nRows; i++ )
    {
        for( j=0; j<nRows; j++ )
        {
            peSrc1 = pmSrc1->apPolyElements[(i*nRows) + j];
            peSrc2 = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( j, pvSrc2 );
            SymCryptMlKemPolyElementMulAndAccumulate( peSrc1, peSrc2, paTmp );
        }
 
        // write accumulator to dest and zero accumulator
        peDst  = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvDst );
        SymCryptMlKemMontgomeryReduceAndAddPolyElementAccumulatorToPolyElement( paTmp, peDst );
    }
}

Referenced by SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemkeyExpandFromPrivateSeed().

◆ SymCryptMlKemModAdd()

FORCEINLINE UINT32 SYMCRYPT_CALL SymCryptMlKemModAdd	(	UINT32	a,
		UINT32	b
	)

Definition at line 483 of file mlkem_primitives.c.

{
    UINT32 res;
 
    SYMCRYPT_ASSERT( a < SYMCRYPT_MLKEM_Q );
    SYMCRYPT_ASSERT( b < SYMCRYPT_MLKEM_Q );
 
    res = a + b - SYMCRYPT_MLKEM_Q;
    SYMCRYPT_ASSERT( ((res >> 16) == 0) || ((res >> 16) == 0xffff) );
    res = res + (SYMCRYPT_MLKEM_Q & (res >> 16));
    SYMCRYPT_ASSERT( res < SYMCRYPT_MLKEM_Q );
 
    return res;
}

Referenced by SymCryptMlKemPolyElementAdd(), SymCryptMlKemPolyElementINTTLayerC(), and SymCryptMlKemPolyElementNTTLayerC().

◆ SymCryptMlKemModSub()

FORCEINLINE UINT32 SYMCRYPT_CALL SymCryptMlKemModSub	(	UINT32	a,
		UINT32	b
	)

Definition at line 503 of file mlkem_primitives.c.

{
    UINT32 res;
 
    SYMCRYPT_ASSERT( a < 2*SYMCRYPT_MLKEM_Q );
    SYMCRYPT_ASSERT( b <= SYMCRYPT_MLKEM_Q );
 
    res = a - b;
    SYMCRYPT_ASSERT( ((res >> 16) == 0) || ((res >> 16) == 0xffff) );
    res = res + (SYMCRYPT_MLKEM_Q & (res >> 16));
    SYMCRYPT_ASSERT( res < SYMCRYPT_MLKEM_Q );
 
    return res;
}

Referenced by SymCryptMlKemMontMul(), SymCryptMlKemPolyElementDecodeAndDecompress(), SymCryptMlKemPolyElementINTTLayerC(), SymCryptMlKemPolyElementNTTLayerC(), and SymCryptMlKemPolyElementSub().

◆ SymCryptMlKemMontgomeryReduceAndAddPolyElementAccumulatorToPolyElement()

VOID SYMCRYPT_CALL SymCryptMlKemMontgomeryReduceAndAddPolyElementAccumulatorToPolyElement	(	_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR	paSrc,
		_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT	peDst
	)

Definition at line 758 of file mlkem_primitives.c.

{
    UINT32 i;
    UINT32 a, c, inv;
 
    for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i++ )
    {
        a = paSrc->coeffs[i];
        SYMCRYPT_ASSERT( a <= 4*(SYMCRYPT_MLKEM_MaxCoeffProduct + SYMCRYPT_MLKEM_MaxA1B1ZetaPow) );
        paSrc->coeffs[i] = 0;
 
        c = peDst->coeffs[i];
        SYMCRYPT_ASSERT( c < SYMCRYPT_MLKEM_Q );
 
        // montgomery reduce sum of products
        inv = (a * SYMCRYPT_MLKEM_NegQInvModR) & SYMCRYPT_MLKEM_Rmask;
        a = (a + (inv * SYMCRYPT_MLKEM_Q)) >> SYMCRYPT_MLKEM_Rlog2; // in range [0, 4711]
        SYMCRYPT_ASSERT( a <= 4711 );
 
        // add destination
        c += a;
        SYMCRYPT_ASSERT( c <= 8039 );
 
        // subtraction and conditional additions for constant time range reduction
        c -= 2*SYMCRYPT_MLKEM_Q;           // in range [-2Q, 1381]
        SYMCRYPT_ASSERT( (c >= ((UINT32)(-2*SYMCRYPT_MLKEM_Q))) || (c < 1381) );
        c += SYMCRYPT_MLKEM_Q & (c >> 16); // in range [-Q, Q-1]
        SYMCRYPT_ASSERT( (c >= ((UINT32)-SYMCRYPT_MLKEM_Q)) || (c < SYMCRYPT_MLKEM_Q) );
        c += SYMCRYPT_MLKEM_Q & (c >> 16); // in range [0, Q-1]
        SYMCRYPT_ASSERT( c < SYMCRYPT_MLKEM_Q );
 
        peDst->coeffs[i] = (UINT16) c;
    }
}

Referenced by SymCryptMlKemMatrixVectorMontMulAndAdd(), and SymCryptMlKemVectorMontDotProduct().

◆ SymCryptMlKemMontMul()

FORCEINLINE UINT32 SYMCRYPT_CALL SymCryptMlKemMontMul	(	UINT32	a,
		UINT32	b,
		UINT32	bMont
	)

Definition at line 523 of file mlkem_primitives.c.

{
    UINT32 res, inv;
 
    SYMCRYPT_ASSERT( a < SYMCRYPT_MLKEM_Q );
    SYMCRYPT_ASSERT( b < SYMCRYPT_MLKEM_Q );
    SYMCRYPT_ASSERT( bMont <= SYMCRYPT_MLKEM_Rmask );
    SYMCRYPT_ASSERT( bMont == ((b * SYMCRYPT_MLKEM_NegQInvModR) & SYMCRYPT_MLKEM_Rmask) );
 
    res = a * b;
    inv = (a * bMont) & SYMCRYPT_MLKEM_Rmask;
    res += inv * SYMCRYPT_MLKEM_Q;
    SYMCRYPT_ASSERT( (res & SYMCRYPT_MLKEM_Rmask) == 0 );
    res = res >> SYMCRYPT_MLKEM_Rlog2;
 
    return SymCryptMlKemModSub( res, SYMCRYPT_MLKEM_Q );
}

Referenced by SymCryptMlKemPolyElementINTTAndMulR(), SymCryptMlKemPolyElementINTTLayerC(), SymCryptMlKemPolyElementMulR(), and SymCryptMlKemPolyElementNTTLayerC().

◆ SymCryptMlKemPolyElementAccumulatorCreate()

PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR SYMCRYPT_CALL SymCryptMlKemPolyElementAccumulatorCreate	(	_Out_writes_bytes_(cbBuffer) PBYTE	pbBuffer,
		UINT32	cbBuffer
	)

Definition at line 140 of file mlkem_primitives.c.

{
    PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR pDst = (PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR) pbBuffer;
 
    UNREFERENCED_PARAMETER( cbBuffer );
 
    SYMCRYPT_ASSERT_ASYM_ALIGNED( pbBuffer );
    SYMCRYPT_ASSERT( cbBuffer == SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT_ACCUMULATOR );
 
    return pDst;
}

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemkeyExpandFromPrivateSeed().

◆ SymCryptMlKemPolyElementAdd()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementAdd	(	_In_ PCSYMCRYPT_MLKEM_POLYELEMENT	peSrc1,
		_In_ PCSYMCRYPT_MLKEM_POLYELEMENT	peSrc2,
		_Out_ PSYMCRYPT_MLKEM_POLYELEMENT	peDst
	)

Definition at line 811 of file mlkem_primitives.c.

{
    UINT32 i;
    for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i++ )
    {
        peDst->coeffs[i] = (UINT16) SymCryptMlKemModAdd( peSrc1->coeffs[i], peSrc2->coeffs[i] );
    }
}

Referenced by SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemVectorAdd().

◆ SymCryptMlKemPolyElementCompressAndEncode()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementCompressAndEncode	(	_In_ PCSYMCRYPT_MLKEM_POLYELEMENT	peSrc,
		UINT32	nBitsPerCoefficient,
		_Out_writes_bytes_(nBitsPerCoefficient *(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS/8)) PBYTE	pbDst
	)

Definition at line 890 of file mlkem_primitives.c.

{
    UINT32 i;
    UINT64 multiplication;
    UINT32 coefficient;
    UINT32 nBitsInCoefficient;
    UINT32 bitsToEncode;
    UINT32 nBitsToEncode;
    UINT32 cbDstWritten = 0;
    UINT32 accumulator = 0;
    UINT32 nBitsInAccumulator = 0;
 
    SYMCRYPT_ASSERT( nBitsPerCoefficient >  0  );
    SYMCRYPT_ASSERT( nBitsPerCoefficient <= 12 );
 
    for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i++ )
    {
        nBitsInCoefficient = nBitsPerCoefficient;
        coefficient = peSrc->coeffs[i]; // in range [0, Q-1]
        SYMCRYPT_ASSERT( coefficient < SYMCRYPT_MLKEM_Q );
 
        // first compress the coefficient
        // when nBitsPerCoefficient < 12 we compress per Compress_d in FIPS 203;
        if(nBitsPerCoefficient < 12)
        {
            // Multiply by 2^(nBitsPerCoefficient+1) / Q by multiplying by constant and shifting right
            multiplication = SYMCRYPT_MUL32x32TO64(coefficient, SYMCRYPT_MLKEM_COMPRESS_MULCONSTANT);
            coefficient = (UINT32) (multiplication >> (SYMCRYPT_MLKEM_COMPRESS_SHIFTCONSTANT-(nBitsPerCoefficient+1)));
 
            // add "half" to round to nearest integer
            coefficient++;
 
            // final divide by two to get multiplication by 2^nBitsPerCoefficient / Q
            coefficient >>= 1;                              // in range [0, 2^nBitsPerCoefficient]
            SYMCRYPT_ASSERT(coefficient <= (1UL<<nBitsPerCoefficient));
 
            // modular reduction by masking
            coefficient &= (1UL<<nBitsPerCoefficient)-1;    // in range [0, 2^nBitsPerCoefficient - 1]
            SYMCRYPT_ASSERT(coefficient <  (1UL<<nBitsPerCoefficient));
        }
 
        // encode the coefficient
        // simple loop to add bits to accumulator and write accumulator to output
        do
        {
            nBitsToEncode = SYMCRYPT_MIN(nBitsInCoefficient, 32-nBitsInAccumulator);
 
            bitsToEncode = coefficient & ((1UL<<nBitsToEncode)-1);
            coefficient >>= nBitsToEncode;
            nBitsInCoefficient -= nBitsToEncode;
 
            accumulator |= (bitsToEncode << nBitsInAccumulator);
            nBitsInAccumulator += nBitsToEncode;
            if(nBitsInAccumulator == 32)
            {
                SYMCRYPT_STORE_LSBFIRST32( pbDst+cbDstWritten, accumulator );
                cbDstWritten += 4;
                accumulator = 0;
                nBitsInAccumulator = 0;
            }
        } while( nBitsInCoefficient > 0 );
    }
 
    SYMCRYPT_ASSERT(nBitsInAccumulator == 0);
    SYMCRYPT_ASSERT(cbDstWritten == (nBitsPerCoefficient*(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS / 8)));
}

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemVectorCompressAndEncode().

◆ SymCryptMlKemPolyElementCreate()

PSYMCRYPT_MLKEM_POLYELEMENT SYMCRYPT_CALL SymCryptMlKemPolyElementCreate	(	_Out_writes_bytes_(cbBuffer) PBYTE	pbBuffer,
		UINT32	cbBuffer
	)

Definition at line 124 of file mlkem_primitives.c.

{
    PSYMCRYPT_MLKEM_POLYELEMENT pDst = (PSYMCRYPT_MLKEM_POLYELEMENT) pbBuffer;
 
    UNREFERENCED_PARAMETER( cbBuffer );
 
    SYMCRYPT_ASSERT_ASYM_ALIGNED( pbBuffer );
    SYMCRYPT_ASSERT( cbBuffer == SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT );
 
    return pDst;
}

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), SymCryptMlKemMatrixCreate(), and SymCryptMlKemVectorCreate().

◆ SymCryptMlKemPolyElementDecodeAndDecompress()

SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptMlKemPolyElementDecodeAndDecompress	(	_In_reads_bytes_(nBitsPerCoefficient *(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS/8)) PCBYTE	pbSrc,
		UINT32	nBitsPerCoefficient,
		_Out_ PSYMCRYPT_MLKEM_POLYELEMENT	peDst
	)

Definition at line 963 of file mlkem_primitives.c.

{
    UINT32 i;
    UINT32 coefficient;
    UINT32 nBitsInCoefficient;
    UINT32 bitsToDecode;
    UINT32 nBitsToDecode;
    UINT32 cbSrcRead = 0;
    UINT32 accumulator = 0;
    UINT32 nBitsInAccumulator = 0;
 
    SYMCRYPT_ASSERT( nBitsPerCoefficient >  0  );
    SYMCRYPT_ASSERT( nBitsPerCoefficient <= 12 );
 
    for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i++ )
    {
        coefficient = 0;
        nBitsInCoefficient = 0;
 
        // first gather and decode bits from pbSrc
        do
        {
            if(nBitsInAccumulator == 0)
            {
                accumulator = SYMCRYPT_LOAD_LSBFIRST32( pbSrc+cbSrcRead );
                cbSrcRead += 4;
                nBitsInAccumulator = 32;
            }
 
            nBitsToDecode = SYMCRYPT_MIN(nBitsPerCoefficient-nBitsInCoefficient, nBitsInAccumulator);
            SYMCRYPT_ASSERT(nBitsToDecode <= nBitsInAccumulator);
 
            bitsToDecode = accumulator & ((1UL<<nBitsToDecode)-1);
            accumulator >>= nBitsToDecode;
            nBitsInAccumulator -= nBitsToDecode;
 
            coefficient |= (bitsToDecode << nBitsInCoefficient);
            nBitsInCoefficient += nBitsToDecode;
        } while( nBitsPerCoefficient > nBitsInCoefficient );
        SYMCRYPT_ASSERT(nBitsInCoefficient == nBitsPerCoefficient);
 
        // decompress the coefficient
        // when nBitsPerCoefficient < 12 we decompress per Decompress_d in FIPS 203
        // otherwise we perform input validation per 203 6.2 Input validation 2 (Modulus check)
        if(nBitsPerCoefficient < 12)
        {
            // Multiply by Q / 2^(nBitsPerCoefficient-1) by multiplying by constant and shifting right
            coefficient *= SYMCRYPT_MLKEM_Q;
            coefficient >>= (nBitsPerCoefficient-1);
 
            // add "half" to round to nearest integer
            coefficient++;
 
            // final divide by two to get multiplication by Q / 2^nBitsPerCoefficient
            coefficient >>= 1;  // in range [0, Q]
 
            // modular reduction by conditional subtraction
            coefficient = SymCryptMlKemModSub( coefficient, SYMCRYPT_MLKEM_Q );
            SYMCRYPT_ASSERT( coefficient < SYMCRYPT_MLKEM_Q );
        }
        else if( coefficient >= SYMCRYPT_MLKEM_Q )
        {
            // input validation failure - this can happen with a malformed or corrupt encapsulation
            // or decapsulation key; we do not need to be constant time because we treat the
            // validity of an imported key as public information.
            return SYMCRYPT_INVALID_BLOB;
        }
 
        peDst->coeffs[i] = (UINT16) coefficient;
    }
 
    SYMCRYPT_ASSERT(nBitsInAccumulator == 0);
    SYMCRYPT_ASSERT(cbSrcRead == (nBitsPerCoefficient*(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS / 8)));
 
    return SYMCRYPT_NO_ERROR;
}

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemVectorDecodeAndDecompress().

◆ SymCryptMlKemPolyElementINTTAndMulR()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementINTTAndMulR ( _Inout_ PSYMCRYPT_MLKEM_POLYELEMENT peSrc )

Definition at line 859 of file mlkem_primitives.c.

{
    UINT32 i;
 
    SymCryptMlKemPolyElementINTTLayer( peSrc, 127,   2 );
    SymCryptMlKemPolyElementINTTLayer( peSrc,  63,   4 );
    SymCryptMlKemPolyElementINTTLayer( peSrc,  31,   8 );
    SymCryptMlKemPolyElementINTTLayer( peSrc,  15,  16 );
    SymCryptMlKemPolyElementINTTLayer( peSrc,   7,  32 );
    SymCryptMlKemPolyElementINTTLayer( peSrc,   3,  64 );
    SymCryptMlKemPolyElementINTTLayer( peSrc,   1, 128 );
 
    for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i++)
    {
        peSrc->coeffs[i] = (UINT16) SymCryptMlKemMontMul(
            peSrc->coeffs[i], SYMCRYPT_MLKEM_INTTFixupTimesRsqr, SYMCRYPT_MLKEM_INTTFixupTimesRsqrTimesNegQInvModR );
    }
}

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemVectorINTTAndMulR().

◆ SymCryptMlKemPolyElementINTTLayer()

FORCEINLINE VOID SYMCRYPT_CALL SymCryptMlKemPolyElementINTTLayer	(	_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT	peSrc,
		UINT32	k,
		UINT32	len
	)

Definition at line 647 of file mlkem_primitives.c.

{
#if SYMCRYPT_CPU_X86
    SYMCRYPT_EXTENDED_SAVE_DATA  SaveData;
    if( SYMCRYPT_CPU_FEATURES_PRESENT( SYMCRYPT_CPU_FEATURE_SSE2 ) && SymCryptSaveXmm( &SaveData ) == SYMCRYPT_NO_ERROR )
    {
        SymCryptMlKemPolyElementINTTLayerVec128( peSrc, k, len );
        SymCryptRestoreXmm( &SaveData );
    } else {
        SymCryptMlKemPolyElementINTTLayerC( peSrc, k, len );
    }
#elif SYMCRYPT_CPU_AMD64
    if( SYMCRYPT_CPU_FEATURES_PRESENT( SYMCRYPT_CPU_FEATURE_SSE2 ) )
    {
        SymCryptMlKemPolyElementINTTLayerVec128( peSrc, k, len );
    } else {
        SymCryptMlKemPolyElementINTTLayerC( peSrc, k, len );
    }
#elif SYMCRYPT_CPU_ARM64
    if( SYMCRYPT_CPU_FEATURES_PRESENT( SYMCRYPT_CPU_FEATURE_NEON ) )
    {
        SymCryptMlKemPolyElementINTTLayerVec128( peSrc, k, len );
    } else {
        SymCryptMlKemPolyElementINTTLayerC( peSrc, k, len );
    }
#else
    SymCryptMlKemPolyElementINTTLayerC( peSrc, k, len );
#endif
}

Referenced by SymCryptMlKemPolyElementINTTAndMulR().

◆ SymCryptMlKemPolyElementINTTLayerC()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementINTTLayerC	(	_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT	peSrc,
		UINT32	k,
		UINT32	len
	)

Definition at line 578 of file mlkem_primitives.c.

{
    UINT32 start, j;
    UINT32 twiddleFactor, twiddleFactorMont, c0, c1, tmp;
 
    for( start=0; start<256; start+=(2*len) )
    {
        twiddleFactor = MlKemZetaBitRevTimesR[k];
        twiddleFactorMont = MlKemZetaBitRevTimesRTimesNegQInvModR[k];
        k--;
        for( j=0; j<len; j++ )
        {
            c0 = peSrc->coeffs[start+j];
            SYMCRYPT_ASSERT( c0 < SYMCRYPT_MLKEM_Q );
            c1 = peSrc->coeffs[start+j+len];
            SYMCRYPT_ASSERT( c1 < SYMCRYPT_MLKEM_Q );
 
            tmp = SymCryptMlKemModAdd( c0, c1 );
            c1 = SymCryptMlKemModSub( c1, c0 );
            c1 = SymCryptMlKemMontMul( c1, twiddleFactor, twiddleFactorMont );
 
            peSrc->coeffs[start+j]      = (UINT16) tmp;
            peSrc->coeffs[start+j+len]  = (UINT16) c1;
        }
    }
}

Referenced by SymCryptMlKemPolyElementINTTLayer().

◆ SymCryptMlKemPolyElementMulAndAccumulate()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementMulAndAccumulate	(	_In_ PCSYMCRYPT_MLKEM_POLYELEMENT	peSrc1,
		_In_ PCSYMCRYPT_MLKEM_POLYELEMENT	peSrc2,
		_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR	paDst
	)

Definition at line 691 of file mlkem_primitives.c.

{
    UINT32 i;
    UINT32 a0, a1, b0, b1, c0, c1;
    UINT32 a0b0, a1b1, a0b1, a1b0, a1b1zetapow, inv;
 
    for( i=0; i<(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS / 2); i++ )
    {
        a0 = peSrc1->coeffs[(2*i)  ];
        SYMCRYPT_ASSERT( a0 < SYMCRYPT_MLKEM_Q );
        a1 = peSrc1->coeffs[(2*i)+1];
        SYMCRYPT_ASSERT( a1 < SYMCRYPT_MLKEM_Q );
 
        b0 = peSrc2->coeffs[(2*i)  ];
        SYMCRYPT_ASSERT( b0 < SYMCRYPT_MLKEM_Q );
        b1 = peSrc2->coeffs[(2*i)+1];
        SYMCRYPT_ASSERT( b1 < SYMCRYPT_MLKEM_Q );
 
        c0 = paDst->coeffs[(2*i)  ];
        SYMCRYPT_ASSERT( c0 <= 3*(SYMCRYPT_MLKEM_MaxCoeffProduct + SYMCRYPT_MLKEM_MaxA1B1ZetaPow) );
        c1 = paDst->coeffs[(2*i)+1];
        SYMCRYPT_ASSERT( c1 <= 3*(SYMCRYPT_MLKEM_MaxCoeffProduct + SYMCRYPT_MLKEM_MaxA1B1ZetaPow) );
 
        // multiplication results in range [0, MaxCoeffProduct = 3328*3328]
        a0b0 = a0 * b0;
        a1b1 = a1 * b1;
        a0b1 = a0 * b1;
        a1b0 = a1 * b0;
 
        // we need a1*b1*zetaTwoTimesBitRevPlus1TimesR[i]
        // eagerly reduce a1*b1 with montgomery reduction
        // a1b1 = red(a1*b1) -> range [0, MaxFirstStepReduction = 3494]
        //   (3494 is maximum result of first step of montgomery reduction of x*y for x,y in [0, 3328])
        // we do not need to do final reduction yet
        inv = (a1b1 * SYMCRYPT_MLKEM_NegQInvModR) & SYMCRYPT_MLKEM_Rmask;
        a1b1 = (a1b1 + (inv * SYMCRYPT_MLKEM_Q)) >> SYMCRYPT_MLKEM_Rlog2; // in range [0, MaxFirstStepReduction]
        SYMCRYPT_ASSERT( a1b1 <= SYMCRYPT_MLKEM_MaxFirstStepReduction );
 
        // now multiply a1b1 by power of zeta
        a1b1zetapow = a1b1 * zetaTwoTimesBitRevPlus1TimesR[i];
        // MaxZetaTwoTimesPlus1TimesR = 3254
        // MaxA1B1ZetaPow = MaxFirstStepReduction*MaxZetaTwoTimesPlus1TimesR = 3494*3254
        SYMCRYPT_ASSERT( a1b1zetapow <= SYMCRYPT_MLKEM_MaxA1B1ZetaPow );
 
        // sum pairs of products
        a0b0 += a1b1zetapow;    // a0*b0 + red(a1*b1)*zetapower in range [0, MaxCoeffProduct + MaxA1B1ZetaPow]
        SYMCRYPT_ASSERT( a0b0 <= SYMCRYPT_MLKEM_MaxCoeffProduct + SYMCRYPT_MLKEM_MaxA1B1ZetaPow );
        a0b1 += a1b0;           // a0*b1 + a1*b0                in range [0, 2*MaxCoeffProduct]
        SYMCRYPT_ASSERT( a0b1 <= 2*SYMCRYPT_MLKEM_MaxCoeffProduct );
 
        // We sum at most 4 pairs of products into an accumulator in ML-KEM
        C_ASSERT( SYMCRYPT_MLKEM_MATRIX_MAX_NROWS <= 4 );
        c0 += a0b0; // in range [0,4*MaxCoeffProduct + 4*MaxA1B1ZetaPow]
        SYMCRYPT_ASSERT( c0 < (4*SYMCRYPT_MLKEM_MaxCoeffProduct) + (4*SYMCRYPT_MLKEM_MaxA1B1ZetaPow) );
        c1 += a0b1; // in range [0,5*MaxCoeffProduct + 3*MaxA1B1ZetaPow]
        SYMCRYPT_ASSERT( c1 < (5*SYMCRYPT_MLKEM_MaxCoeffProduct) + (3*SYMCRYPT_MLKEM_MaxA1B1ZetaPow) );
 
        paDst->coeffs[(2*i)  ] = c0;
        paDst->coeffs[(2*i)+1] = c1;
    }
}

Referenced by SymCryptMlKemMatrixVectorMontMulAndAdd(), and SymCryptMlKemVectorMontDotProduct().

◆ SymCryptMlKemPolyElementMulR()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementMulR	(	_In_ PCSYMCRYPT_MLKEM_POLYELEMENT	peSrc,
		_Out_ PSYMCRYPT_MLKEM_POLYELEMENT	peDst
	)

Definition at line 797 of file mlkem_primitives.c.

{
    UINT32 i;
    for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i++ )
    {
        peDst->coeffs[i] = (UINT16) SymCryptMlKemMontMul(
            peSrc->coeffs[i], SYMCRYPT_MLKEM_Rsqr, SYMCRYPT_MLKEM_RsqrTimesNegQInvModR );
    }
}

Referenced by SymCryptMlKemVectorMulR().

◆ SymCryptMlKemPolyElementNTT()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementNTT ( _Inout_ PSYMCRYPT_MLKEM_POLYELEMENT peSrc )

Definition at line 839 of file mlkem_primitives.c.

{
    SymCryptMlKemPolyElementNTTLayer( peSrc,  1, 128 );
    SymCryptMlKemPolyElementNTTLayer( peSrc,  2,  64 );
    SymCryptMlKemPolyElementNTTLayer( peSrc,  4,  32 );
    SymCryptMlKemPolyElementNTTLayer( peSrc,  8,  16 );
    SymCryptMlKemPolyElementNTTLayer( peSrc, 16,   8 );
    SymCryptMlKemPolyElementNTTLayer( peSrc, 32,   4 );
    SymCryptMlKemPolyElementNTTLayer( peSrc, 64,   2 );
}

Referenced by SymCryptMlKemVectorNTT().

◆ SymCryptMlKemPolyElementNTTLayer()

FORCEINLINE VOID SYMCRYPT_CALL SymCryptMlKemPolyElementNTTLayer	(	_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT	peSrc,
		UINT32	k,
		UINT32	len
	)

Definition at line 611 of file mlkem_primitives.c.

{
#if SYMCRYPT_CPU_X86
    SYMCRYPT_EXTENDED_SAVE_DATA  SaveData;
    if( SYMCRYPT_CPU_FEATURES_PRESENT( SYMCRYPT_CPU_FEATURE_SSE2 ) && SymCryptSaveXmm( &SaveData ) == SYMCRYPT_NO_ERROR )
    {
        SymCryptMlKemPolyElementNTTLayerVec128( peSrc, k, len );
        SymCryptRestoreXmm( &SaveData );
    } else {
        SymCryptMlKemPolyElementNTTLayerC( peSrc, k, len );
    }
#elif SYMCRYPT_CPU_AMD64
    if( SYMCRYPT_CPU_FEATURES_PRESENT( SYMCRYPT_CPU_FEATURE_SSE2 ) )
    {
        SymCryptMlKemPolyElementNTTLayerVec128( peSrc, k, len );
    } else {
        SymCryptMlKemPolyElementNTTLayerC( peSrc, k, len );
    }
#elif SYMCRYPT_CPU_ARM64
    if( SYMCRYPT_CPU_FEATURES_PRESENT( SYMCRYPT_CPU_FEATURE_NEON ) )
    {
        SymCryptMlKemPolyElementNTTLayerVec128( peSrc, k, len );
    } else {
        SymCryptMlKemPolyElementNTTLayerC( peSrc, k, len );
    }
#else
    SymCryptMlKemPolyElementNTTLayerC( peSrc, k, len );
#endif
}

Referenced by SymCryptMlKemPolyElementNTT().

◆ SymCryptMlKemPolyElementNTTLayerC()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementNTTLayerC	(	_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT	peSrc,
		UINT32	k,
		UINT32	len
	)

Definition at line 546 of file mlkem_primitives.c.

{
    UINT32 start, j;
    UINT32 twiddleFactor, twiddleFactorMont, c0, c1, c1TimesTwiddle;
 
    for( start=0; start<256; start+=(2*len) )
    {
        twiddleFactor = MlKemZetaBitRevTimesR[k];
        twiddleFactorMont = MlKemZetaBitRevTimesRTimesNegQInvModR[k];
        k++;
        for( j=0; j<len; j++ )
        {
            c0 = peSrc->coeffs[start+j];
            SYMCRYPT_ASSERT( c0 < SYMCRYPT_MLKEM_Q );
            c1 = peSrc->coeffs[start+j+len];
            SYMCRYPT_ASSERT( c1 < SYMCRYPT_MLKEM_Q );
 
            c1TimesTwiddle = SymCryptMlKemMontMul( c1, twiddleFactor, twiddleFactorMont );
            c1 = SymCryptMlKemModSub( c0, c1TimesTwiddle );
            c0 = SymCryptMlKemModAdd( c0, c1TimesTwiddle );
 
            peSrc->coeffs[start+j]      = (UINT16) c0;
            peSrc->coeffs[start+j+len]  = (UINT16) c1;
        }
    }
}

Referenced by SymCryptMlKemPolyElementNTTLayer().

◆ SymCryptMlKemPolyElementSampleCBDFromBytes()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementSampleCBDFromBytes	(	_In_reads_bytes_(eta 2 (SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS/8)+1) PCBYTE	pbSrc,
		_In_range_(2, 3) UINT32	eta,
		_Out_ PSYMCRYPT_MLKEM_POLYELEMENT	peDst
	)

Definition at line 1081 of file mlkem_primitives.c.

{
    UINT32 i, j;
    UINT32 sampleBits;
    UINT32 coefficient;
 
    SYMCRYPT_ASSERT((eta == 2) || (eta == 3));
    if( eta == 3 )
    {
        for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i+=4 )
        {
            // unconditionally load 4 bytes into sampleBits, but only treat the load
            // as being 3 bytes (24-bits -> 4 coefficients) for eta==3 to align to
            // byte boundaries. Source buffer must be 1 byte larger than shake output
            sampleBits = SYMCRYPT_LOAD_LSBFIRST32( pbSrc );
            pbSrc += 3;
 
            // sum bit samples - each consecutive slice of eta bits is summed together
            sampleBits = (sampleBits&0x249249) + ((sampleBits>>1)&0x249249) + ((sampleBits>>2)&0x249249);
 
            for( j=0; j<4; j++ )
            {
                // each coefficient is formed by taking the difference of two consecutive slices of eta bits
                // the first eta bits are positive, the second eta bits are negative
                coefficient = sampleBits & 0x3f;
                sampleBits >>= 6;
                coefficient = (coefficient&3) - (coefficient>>3);
                SYMCRYPT_ASSERT((coefficient >= ((UINT32)-3)) || (coefficient <= 3));
 
                coefficient = coefficient + (SYMCRYPT_MLKEM_Q & (coefficient >> 16));     // in range [0, Q-1]
                SYMCRYPT_ASSERT( coefficient < SYMCRYPT_MLKEM_Q );
 
                peDst->coeffs[i+j] = (UINT16) coefficient;
            }
        }
    }
    else
    {
        for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i+=8 )
        {
            // unconditionally load 4 bytes (32-bits -> 8 coefficients) into sampleBits
            sampleBits = SYMCRYPT_LOAD_LSBFIRST32( pbSrc );
            pbSrc += 4;
 
            // sum bit samples - each consecutive slice of eta bits is summed together
            sampleBits = (sampleBits&0x55555555) + ((sampleBits>>1)&0x55555555);
 
            for( j=0; j<8; j++ )
            {
                // each coefficient is formed by taking the difference of two consecutive slices of eta bits
                // the first eta bits are positive, the second eta bits are negative
                coefficient = sampleBits & 0xf;
                sampleBits >>= 4;
                coefficient = (coefficient&3) - (coefficient>>2);
                SYMCRYPT_ASSERT((coefficient >= ((UINT32)-2)) || (coefficient <= 2));
 
                coefficient = coefficient + (SYMCRYPT_MLKEM_Q & (coefficient >> 16));     // in range [0, Q-1]
                SYMCRYPT_ASSERT( coefficient < SYMCRYPT_MLKEM_Q );
 
                peDst->coeffs[i+j] = (UINT16) coefficient;
            }
        }
    }
}

Referenced by SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemkeyExpandFromPrivateSeed().

◆ SymCryptMlKemPolyElementSampleNTTFromShake128()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementSampleNTTFromShake128	(	_Inout_ PSYMCRYPT_SHAKE128_STATE	pState,
		_Out_ PSYMCRYPT_MLKEM_POLYELEMENT	peDst
	)

Definition at line 1046 of file mlkem_primitives.c.

{
    UINT32 i=0;
    BYTE shakeOutputBuf[3*8]; // Keccak likes extracting multiples of 8-bytes
    UINT32 currBufIndex = sizeof(shakeOutputBuf);
    UINT16 sample0, sample1;
 
    while( i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS )
    {
        SYMCRYPT_ASSERT(currBufIndex <= sizeof(shakeOutputBuf));
        if( currBufIndex == sizeof(shakeOutputBuf) )
        {
            SymCryptShake128Extract(pState, shakeOutputBuf, sizeof(shakeOutputBuf), FALSE);
            currBufIndex = 0;
        }
 
        sample0 = SYMCRYPT_LOAD_LSBFIRST16( shakeOutputBuf+currBufIndex ) & 0xfff;
        sample1 = SYMCRYPT_LOAD_LSBFIRST16( shakeOutputBuf+currBufIndex+1 ) >> 4;
        currBufIndex += 3;
 
        peDst->coeffs[i] = sample0;
        i += sample0 < SYMCRYPT_MLKEM_Q;
 
        if( i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS )
        {
            peDst->coeffs[i] = sample1;
            i += sample1 < SYMCRYPT_MLKEM_Q;
        }
    }
}

Referenced by SymCryptMlKemkeyExpandPublicMatrixFromPublicSeed().

◆ SymCryptMlKemPolyElementSub()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementSub	(	_In_ PCSYMCRYPT_MLKEM_POLYELEMENT	peSrc1,
		_In_ PCSYMCRYPT_MLKEM_POLYELEMENT	peSrc2,
		_Out_ PSYMCRYPT_MLKEM_POLYELEMENT	peDst
	)

Definition at line 825 of file mlkem_primitives.c.

{
    UINT32 i;
    for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i++ )
    {
        peDst->coeffs[i] = (UINT16) SymCryptMlKemModSub( peSrc1->coeffs[i], peSrc2->coeffs[i] );
    }
}

Referenced by SymCryptMlKemDecapsulate(), and SymCryptMlKemVectorSub().

◆ SymCryptMlKemVectorAdd()

VOID SYMCRYPT_CALL SymCryptMlKemVectorAdd	(	_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc1,
		_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc2,
		_Out_ PSYMCRYPT_MLKEM_VECTOR	pvDst
	)

Definition at line 1276 of file mlkem_primitives.c.

{
    UINT32 i;
    const UINT32 nRows = pvSrc1->nRows;
    PCSYMCRYPT_MLKEM_POLYELEMENT peSrc1, peSrc2;
    PSYMCRYPT_MLKEM_POLYELEMENT  peDst;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
    SYMCRYPT_ASSERT( pvSrc2->nRows == nRows );
    SYMCRYPT_ASSERT( pvDst->nRows == nRows );
 
    for( i=0; i<nRows; i++ )
    {
        peSrc1 = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc1 );
        peSrc2 = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc2 );
        peDst  = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvDst );
        SymCryptMlKemPolyElementAdd( peSrc1, peSrc2, peDst );
    }
}

◆ SymCryptMlKemVectorCompressAndEncode()

VOID SYMCRYPT_CALL SymCryptMlKemVectorCompressAndEncode	(	_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc,
		UINT32	nBitsPerCoefficient,
		_Out_writes_bytes_(cbDst) PBYTE	pbDst,
		SIZE_T	cbDst
	)

Definition at line 1362 of file mlkem_primitives.c.

{
    UINT32 i;
    const UINT32 nRows = pvSrc->nRows;
    PCSYMCRYPT_MLKEM_POLYELEMENT peSrc;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
    SYMCRYPT_ASSERT( nBitsPerCoefficient >  0  );
    SYMCRYPT_ASSERT( nBitsPerCoefficient <= 12 );
    SYMCRYPT_ASSERT( cbDst == nRows*nBitsPerCoefficient*(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS / 8) );
 
    UNREFERENCED_PARAMETER( cbDst );
 
    for( i=0; i<nRows; i++ )
    {
        peSrc  = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc );
        SymCryptMlKemPolyElementCompressAndEncode( peSrc, nBitsPerCoefficient, pbDst );
        pbDst += nBitsPerCoefficient*(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS / 8);
    }
}

Referenced by SymCryptMlKemEncapsulateInternal(), SymCryptMlKemkeyExpandFromPrivateSeed(), and SymCryptMlKemkeyGetValue().

◆ SymCryptMlKemVectorCreate()

PSYMCRYPT_MLKEM_VECTOR SYMCRYPT_CALL SymCryptMlKemVectorCreate	(	_Out_writes_bytes_(cbBuffer) PBYTE	pbBuffer,
		UINT32	cbBuffer,
		UINT32	nRows
	)

Definition at line 156 of file mlkem_primitives.c.

{
    PSYMCRYPT_MLKEM_VECTOR pDst = NULL;
    PSYMCRYPT_MLKEM_VECTOR pVector = (PSYMCRYPT_MLKEM_VECTOR)pbBuffer;
    PSYMCRYPT_MLKEM_POLYELEMENT peTmp = NULL;
    UINT32 i;
    PBYTE pbTmp = pbBuffer + sizeof(SYMCRYPT_MLKEM_VECTOR);
 
    SYMCRYPT_ASSERT_ASYM_ALIGNED( pbBuffer );
 
    SYMCRYPT_ASSERT( nRows > 0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
 
    pVector->nRows = nRows;
    pVector->cbTotalSize = cbBuffer;
 
    for( i=0; i<nRows; i++ )
    {
        peTmp = SymCryptMlKemPolyElementCreate( pbTmp, SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT );
        if( peTmp == NULL )
        {
            goto cleanup;
        }
 
        pbTmp += SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT;
    }
 
    SYMCRYPT_ASSERT( pbTmp == (pbBuffer + cbBuffer) );
 
    pDst = pVector;
 
cleanup:
    return pDst;
}

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), SymCryptMlKemkeyExpandFromPrivateSeed(), and SymCryptMlKemkeyInitialize().

◆ SymCryptMlKemVectorDecodeAndDecompress()

SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptMlKemVectorDecodeAndDecompress	(	_In_reads_bytes_(cbSrc) PCBYTE	pbSrc,
		SIZE_T	cbSrc,
		UINT32	nBitsPerCoefficient,
		_Out_ PSYMCRYPT_MLKEM_VECTOR	pvDst
	)

Definition at line 1390 of file mlkem_primitives.c.

{
    SYMCRYPT_ERROR scError = SYMCRYPT_NO_ERROR;
    UINT32 i;
    const UINT32 nRows = pvDst->nRows;
    PSYMCRYPT_MLKEM_POLYELEMENT peDst;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
    SYMCRYPT_ASSERT( nBitsPerCoefficient >  0  );
    SYMCRYPT_ASSERT( nBitsPerCoefficient <= 12 );
    SYMCRYPT_ASSERT( cbSrc == nRows*nBitsPerCoefficient*(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS / 8) );
 
    UNREFERENCED_PARAMETER( cbSrc );
 
    for( i=0; i<nRows; i++ )
    {
        peDst  = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvDst );
        scError = SymCryptMlKemPolyElementDecodeAndDecompress( pbSrc, nBitsPerCoefficient, peDst );
        if( scError != SYMCRYPT_NO_ERROR )
        {
            goto cleanup;
        }
        pbSrc += nBitsPerCoefficient*(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS / 8);
    }
 
cleanup:
    return scError;
}

Referenced by SymCryptMlKemDecapsulate(), and SymCryptMlKemkeySetValue().

◆ SymCryptMlKemVectorINTTAndMulR()

VOID SYMCRYPT_CALL SymCryptMlKemVectorINTTAndMulR ( _Inout_ PSYMCRYPT_MLKEM_VECTOR pvSrc )

Definition at line 1345 of file mlkem_primitives.c.

{
    UINT32 i;
    const UINT32 nRows = pvSrc->nRows;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
 
    for( i=0; i<nRows; i++ )
    {
        SymCryptMlKemPolyElementINTTAndMulR( SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc ) );
    }
}

Referenced by SymCryptMlKemEncapsulateInternal().

◆ SymCryptMlKemVectorMontDotProduct()

VOID SYMCRYPT_CALL SymCryptMlKemVectorMontDotProduct	(	_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc1,
		_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc2,
		_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT	peDst,
		_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR	paTmp
	)

Definition at line 1211 of file mlkem_primitives.c.

{
    UINT32 i;
    const UINT32 nRows = pvSrc1->nRows;
    PCSYMCRYPT_MLKEM_POLYELEMENT peSrc1, peSrc2;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
    SYMCRYPT_ASSERT( pvSrc2->nRows == nRows );
 
    // Zero paTmp and peDst
    SymCryptWipeKnownSize( paTmp, SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT_ACCUMULATOR );
    SymCryptWipeKnownSize( peDst, SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT );
 
    for( i=0; i<nRows; i++ )
    {
        peSrc1 = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc1 );
        peSrc2 = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc2 );
        SymCryptMlKemPolyElementMulAndAccumulate( peSrc1, peSrc2, paTmp );
    }
 
    // write accumulator to dest and zero accumulator
    SymCryptMlKemMontgomeryReduceAndAddPolyElementAccumulatorToPolyElement( paTmp, peDst );
}

Referenced by SymCryptMlKemDecapsulate(), and SymCryptMlKemEncapsulateInternal().

◆ SymCryptMlKemVectorMulR()

VOID SYMCRYPT_CALL SymCryptMlKemVectorMulR	(	_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc,
		_Out_ PSYMCRYPT_MLKEM_VECTOR	pvDst
	)

Definition at line 1255 of file mlkem_primitives.c.

{
    UINT32 i;
    const UINT32 nRows = pvSrc->nRows;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
    SYMCRYPT_ASSERT( pvDst->nRows == nRows );
 
    for( i=0; i<nRows; i++ )
    {
        SymCryptMlKemPolyElementMulR(
            SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc ),
            SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvDst ) );
    }
}

Referenced by SymCryptMlKemkeyExpandFromPrivateSeed().

◆ SymCryptMlKemVectorNTT()

VOID SYMCRYPT_CALL SymCryptMlKemVectorNTT ( _Inout_ PSYMCRYPT_MLKEM_VECTOR pvSrc )

Definition at line 1328 of file mlkem_primitives.c.

{
    UINT32 i;
    const UINT32 nRows = pvSrc->nRows;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
 
    for( i=0; i<nRows; i++ )
    {
        SymCryptMlKemPolyElementNTT( SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc ) );
    }
}

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemkeyExpandFromPrivateSeed().

◆ SymCryptMlKemVectorSetZero()

VOID SYMCRYPT_CALL SymCryptMlKemVectorSetZero ( _Inout_ PSYMCRYPT_MLKEM_VECTOR pvSrc )

Definition at line 1242 of file mlkem_primitives.c.

{
    const UINT32 nRows = pvSrc->nRows;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
 
    SymCryptWipe( (PBYTE) SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( 0, pvSrc ), nRows*SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT );
}

Referenced by SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemkeyWipePrivateState().

◆ SymCryptMlKemVectorSub()

VOID SYMCRYPT_CALL SymCryptMlKemVectorSub	(	_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc1,
		_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc2,
		_Out_ PSYMCRYPT_MLKEM_VECTOR	pvDst
	)

Definition at line 1302 of file mlkem_primitives.c.

{
    UINT32 i;
    const UINT32 nRows = pvSrc1->nRows;
    PCSYMCRYPT_MLKEM_POLYELEMENT peSrc1, peSrc2;
    PSYMCRYPT_MLKEM_POLYELEMENT  peDst;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
    SYMCRYPT_ASSERT( pvSrc2->nRows == nRows );
    SYMCRYPT_ASSERT( pvDst->nRows == nRows );
 
    for( i=0; i<nRows; i++ )
    {
        peSrc1 = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc1 );
        peSrc2 = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc2 );
        peDst  = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvDst );
        SymCryptMlKemPolyElementSub( peSrc1, peSrc2, peDst );
    }
}

Variable Documentation

◆ MlKemZetaBitRevTimesR

const UINT16 MlKemZetaBitRevTimesR[128]

Initial value:

=
{
    2285, 2571, 2970, 1812, 1493, 1422,  287,  202,
    3158,  622, 1577,  182,  962, 2127, 1855, 1468,
     573, 2004,  264,  383, 2500, 1458, 1727, 3199,
    2648, 1017,  732,  608, 1787,  411, 3124, 1758,
    1223,  652, 2777, 1015, 2036, 1491, 3047, 1785,
     516, 3321, 3009, 2663, 1711, 2167,  126, 1469,
    2476, 3239, 3058,  830,  107, 1908, 3082, 2378,
    2931,  961, 1821, 2604,  448, 2264,  677, 2054,
    2226,  430,  555,  843, 2078,  871, 1550,  105,
     422,  587,  177, 3094, 3038, 2869, 1574, 1653,
    3083,  778, 1159, 3182, 2552, 1483, 2727, 1119,
    1739,  644, 2457,  349,  418,  329, 3173, 3254,
     817, 1097,  603,  610, 1322, 2044, 1864,  384,
    2114, 3193, 1218, 1994, 2455,  220, 2142, 1670,
    2144, 1799, 2051,  794, 1819, 2475, 2459,  478,
    3221, 3021,  996,  991,  958, 1869, 1522, 1628,
}

Definition at line 54 of file mlkem_primitives.c.

Referenced by SymCryptMlKemPolyElementINTTLayerC(), and SymCryptMlKemPolyElementNTTLayerC().

◆ MlKemZetaBitRevTimesRTimesNegQInvModR

const UINT16 MlKemZetaBitRevTimesRTimesNegQInvModR[128]

Initial value:

=
{
       19, 34037, 50790, 64748, 52011, 12402, 37345, 16694,
    20906, 37778,  3799, 15690, 54846, 64177, 11201, 34372,
     5827, 48172, 26360, 29057, 59964,  1102, 44097, 26241,
    28072, 41223, 10532, 56736, 47109, 56677, 38860, 16162,
     5689,  6516, 64039, 34569, 23564, 45357, 44825, 40455,
    12796, 38919, 49471, 12441, 56401,   649, 25986, 37699,
    45652, 28249, 15886,  8898, 28309, 56460, 30198, 47286,
    52109, 51519, 29155, 12756, 48704, 61224, 24155, 17914,
      334, 54354, 11477, 52149, 32226, 14233, 45042, 21655,
    27738, 52405, 64591,  4586, 14882, 42443, 59354, 60043,
    33525, 32502, 54905, 35218, 36360, 18741, 28761, 52897,
    18485, 45436, 47975, 47011, 14430, 46007,  5275, 12618,
    31183, 45239, 40101, 63390,  7382, 50180, 41144, 32384,
    20926,  6279, 54590, 14902, 41321, 11044, 48546, 51066,
    55200, 21497,  7933, 20198, 22501, 42325, 54629, 17442,
    33899, 23859, 36892, 20257, 41538, 57779, 17422, 42404,
}

Definition at line 78 of file mlkem_primitives.c.

Referenced by SymCryptMlKemPolyElementINTTLayerC(), and SymCryptMlKemPolyElementNTTLayerC().

◆ SYMCRYPT_MLKEM_COMPRESS_MULCONSTANT

const UINT32 SYMCRYPT_MLKEM_COMPRESS_MULCONSTANT = 0x275f6f

Definition at line 885 of file mlkem_primitives.c.

Referenced by SymCryptMlKemPolyElementCompressAndEncode().

◆ SYMCRYPT_MLKEM_COMPRESS_SHIFTCONSTANT

const UINT32 SYMCRYPT_MLKEM_COMPRESS_SHIFTCONSTANT = 33

Definition at line 886 of file mlkem_primitives.c.

Referenced by SymCryptMlKemPolyElementCompressAndEncode().

◆ SYMCRYPT_MLKEM_INTTFixupTimesRsqr

const UINT32 SYMCRYPT_MLKEM_INTTFixupTimesRsqr = 1441

Definition at line 854 of file mlkem_primitives.c.

Referenced by SymCryptMlKemPolyElementINTTAndMulR().

◆ SYMCRYPT_MLKEM_INTTFixupTimesRsqrTimesNegQInvModR

const UINT32 SYMCRYPT_MLKEM_INTTFixupTimesRsqrTimesNegQInvModR = 10079

Definition at line 855 of file mlkem_primitives.c.

Referenced by SymCryptMlKemPolyElementINTTAndMulR().

◆ SYMCRYPT_MLKEM_NegQInvModR

const UINT32 SYMCRYPT_MLKEM_NegQInvModR = 3327

Definition at line 34 of file mlkem_primitives.c.

Referenced by SymCryptMlKemMontgomeryReduceAndAddPolyElementAccumulatorToPolyElement(), SymCryptMlKemMontMul(), and SymCryptMlKemPolyElementMulAndAccumulate().

◆ SYMCRYPT_MLKEM_Rlog2

const UINT32 SYMCRYPT_MLKEM_Rlog2 = 16

Definition at line 30 of file mlkem_primitives.c.

Referenced by SymCryptMlKemMontgomeryReduceAndAddPolyElementAccumulatorToPolyElement(), SymCryptMlKemMontMul(), and SymCryptMlKemPolyElementMulAndAccumulate().

◆ SYMCRYPT_MLKEM_Rmask

const UINT32 SYMCRYPT_MLKEM_Rmask = 0xffff

Definition at line 31 of file mlkem_primitives.c.

Referenced by SymCryptMlKemMontgomeryReduceAndAddPolyElementAccumulatorToPolyElement(), SymCryptMlKemMontMul(), and SymCryptMlKemPolyElementMulAndAccumulate().

◆ SYMCRYPT_MLKEM_Rsqr

const UINT32 SYMCRYPT_MLKEM_Rsqr = 1353

Definition at line 37 of file mlkem_primitives.c.

Referenced by SymCryptMlKemPolyElementMulR().

◆ SYMCRYPT_MLKEM_RsqrTimesNegQInvModR

const UINT32 SYMCRYPT_MLKEM_RsqrTimesNegQInvModR = 44983

Definition at line 39 of file mlkem_primitives.c.

Referenced by SymCryptMlKemPolyElementMulR().

◆ zetaTwoTimesBitRevPlus1TimesR

const UINT16 zetaTwoTimesBitRevPlus1TimesR[128]

Initial value:

=
{
    2226, 1103,  430, 2899,  555, 2774,  843, 2486,
    2078, 1251,  871, 2458, 1550, 1779,  105, 3224,
     422, 2907,  587, 2742,  177, 3152, 3094,  235,
    3038,  291, 2869,  460, 1574, 1755, 1653, 1676,
    3083,  246,  778, 2551, 1159, 2170, 3182,  147,
    2552,  777, 1483, 1846, 2727,  602, 1119, 2210,
    1739, 1590,  644, 2685, 2457,  872,  349, 2980,
     418, 2911,  329, 3000, 3173,  156, 3254,   75,
     817, 2512, 1097, 2232,  603, 2726,  610, 2719,
    1322, 2007, 2044, 1285, 1864, 1465,  384, 2945,
    2114, 1215, 3193,  136, 1218, 2111, 1994, 1335,
    2455,  874,  220, 3109, 2142, 1187, 1670, 1659,
    2144, 1185, 1799, 1530, 2051, 1278,  794, 2535,
    1819, 1510, 2475,  854, 2459,  870,  478, 2851,
    3221,  108, 3021,  308,  996, 2333,  991, 2338,
     958, 2371, 1869, 1460, 1522, 1807, 1628, 1701,
}

Definition at line 102 of file mlkem_primitives.c.

Referenced by SymCryptMlKemPolyElementMulAndAccumulate().

Macros

Functions

Variables

Macro Definition Documentation

◆ SYMCRYPT_MLKEM_MaxA1B1ZetaPow

◆ SYMCRYPT_MLKEM_MaxCoeff

◆ SYMCRYPT_MLKEM_MaxCoeffProduct

◆ SYMCRYPT_MLKEM_MaxFirstStepReduction

◆ SYMCRYPT_MLKEM_MaxZetaTwoTimesPlus1TimesR

Function Documentation

◆ SymCryptMlKemkeyWipePrivateState()

◆ SymCryptMlKemMatrixCreate()

◆ SymCryptMlKemMatrixTranspose()

◆ SymCryptMlKemMatrixVectorMontMulAndAdd()

◆ SymCryptMlKemModAdd()

◆ SymCryptMlKemModSub()

◆ SymCryptMlKemMontgomeryReduceAndAddPolyElementAccumulatorToPolyElement()

◆ SymCryptMlKemMontMul()

◆ SymCryptMlKemPolyElementAccumulatorCreate()

◆ SymCryptMlKemPolyElementAdd()

◆ SymCryptMlKemPolyElementCompressAndEncode()

◆ SymCryptMlKemPolyElementCreate()

◆ SymCryptMlKemPolyElementDecodeAndDecompress()

◆ SymCryptMlKemPolyElementINTTAndMulR()

◆ SymCryptMlKemPolyElementINTTLayer()

◆ SymCryptMlKemPolyElementINTTLayerC()

◆ SymCryptMlKemPolyElementMulAndAccumulate()

◆ SymCryptMlKemPolyElementMulR()

◆ SymCryptMlKemPolyElementNTT()

◆ SymCryptMlKemPolyElementNTTLayer()

◆ SymCryptMlKemPolyElementNTTLayerC()

◆ SymCryptMlKemPolyElementSampleCBDFromBytes()

◆ SymCryptMlKemPolyElementSampleNTTFromShake128()

◆ SymCryptMlKemPolyElementSub()

◆ SymCryptMlKemVectorAdd()

◆ SymCryptMlKemVectorCompressAndEncode()

◆ SymCryptMlKemVectorCreate()

◆ SymCryptMlKemVectorDecodeAndDecompress()

◆ SymCryptMlKemVectorINTTAndMulR()

◆ SymCryptMlKemVectorMontDotProduct()

◆ SymCryptMlKemVectorMulR()

◆ SymCryptMlKemVectorNTT()

◆ SymCryptMlKemVectorSetZero()

◆ SymCryptMlKemVectorSub()

Variable Documentation

◆ MlKemZetaBitRevTimesR

◆ MlKemZetaBitRevTimesRTimesNegQInvModR

◆ SYMCRYPT_MLKEM_COMPRESS_MULCONSTANT

◆ SYMCRYPT_MLKEM_COMPRESS_SHIFTCONSTANT

◆ SYMCRYPT_MLKEM_INTTFixupTimesRsqr

◆ SYMCRYPT_MLKEM_INTTFixupTimesRsqrTimesNegQInvModR

◆ SYMCRYPT_MLKEM_NegQInvModR

◆ SYMCRYPT_MLKEM_Rlog2

◆ SYMCRYPT_MLKEM_Rmask

◆ SYMCRYPT_MLKEM_Rsqr

◆ SYMCRYPT_MLKEM_RsqrTimesNegQInvModR

◆ zetaTwoTimesBitRevPlus1TimesR