This graph shows which files directly or indirectly include this file:

Macros
#define	SYMCRYPT_MLKEM_MATRIX_MAX_NROWS (4)

#define	SYMCRYPT_MLKEMKEY_MAX_SIZEOF_ENCODED_T (1536)

#define	SYMCRYPT_MLKEM_Q (3329)

#define	SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT ( sizeof(SYMCRYPT_MLKEM_POLYELEMENT) )

#define	SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT_ACCUMULATOR ( sizeof(SYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR) )

#define	SYMCRYPT_INTERNAL_MLKEM_MAXIMUM_VECTOR_SIZE ( sizeof(SYMCRYPT_MLKEM_VECTOR) + (SYMCRYPT_MLKEM_MATRIX_MAX_NROWS * SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT) )

#define	SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT_OFFSET(_row) ( sizeof(SYMCRYPT_MLKEM_VECTOR) + ((_row) * SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT) )

#define	SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT(_row, _pVector) (PSYMCRYPT_MLKEM_POLYELEMENT)( (PBYTE)(_pVector) + SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT_OFFSET(_row) )

#define	SYMCRYPT_MLKEM_SIZEOF_MAX_CIPHERTEXT (1568UL)

#define	SYMCRYPT_MLKEM_SIZEOF_AGREED_SECRET (32UL)

#define	SYMCRYPT_MLKEM_SIZEOF_ENCAPS_RANDOM (32UL)

Typedefs
typedef SYMCRYPT_ASYM_ALIGN_STRUCT	_SYMCRYPT_MLKEM_POLYELEMENT

typedef SYMCRYPT_MLKEM_POLYELEMENT *	PSYMCRYPT_MLKEM_POLYELEMENT

typedef const SYMCRYPT_MLKEM_POLYELEMENT *	PCSYMCRYPT_MLKEM_POLYELEMENT

typedef SYMCRYPT_ASYM_ALIGN_STRUCT	_SYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR

typedef SYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR *	PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR

typedef SYMCRYPT_ASYM_ALIGN_STRUCT	_SYMCRYPT_MLKEM_VECTOR

typedef const SYMCRYPT_MLKEM_VECTOR *	PCSYMCRYPT_MLKEM_VECTOR

typedef SYMCRYPT_ASYM_ALIGN_STRUCT	_SYMCRYPT_MLKEM_MATRIX

typedef const SYMCRYPT_MLKEM_MATRIX *	PCSYMCRYPT_MLKEM_MATRIX

typedef SYMCRYPT_ALIGN_STRUCT	_SYMCRYPT_MLKEM_INTERNAL_PARAMS

typedef const SYMCRYPT_MLKEM_INTERNAL_PARAMS *	PCSYMCRYPT_MLKEM_INTERNAL_PARAMS

typedef SYMCRYPT_ASYM_ALIGN_STRUCT	_SYMCRYPT_MLKEMKEY

typedef SYMCRYPT_ASYM_ALIGN_STRUCT	_SYMCRYPT_MLKEM_INTERNAL_COMPUTATION_TEMPORARIES

typedef SYMCRYPT_MLKEM_INTERNAL_COMPUTATION_TEMPORARIES *	PSYMCRYPT_MLKEM_INTERNAL_COMPUTATION_TEMPORARIES

Functions
SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptMlKemEncapsulateInternal (_In_ PCSYMCRYPT_MLKEMKEY pkMlKemkey, _Out_writes_bytes_(cbAgreedSecret) PBYTE pbAgreedSecret, SIZE_T cbAgreedSecret, _Out_writes_bytes_(cbCiphertext) PBYTE pbCiphertext, SIZE_T cbCiphertext, _In_reads_bytes_(SYMCRYPT_MLKEM_SIZEOF_ENCAPS_RANDOM) PCBYTE pbRandom, _Inout_ PSYMCRYPT_MLKEM_INTERNAL_COMPUTATION_TEMPORARIES pCompTemps)

PSYMCRYPT_MLKEM_POLYELEMENT SYMCRYPT_CALL	SymCryptMlKemPolyElementCreate (_Out_writes_bytes_(cbBuffer) PBYTE pbBuffer, UINT32 cbBuffer)

PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR SYMCRYPT_CALL	SymCryptMlKemPolyElementAccumulatorCreate (_Out_writes_bytes_(cbBuffer) PBYTE pbBuffer, UINT32 cbBuffer)

PSYMCRYPT_MLKEM_VECTOR SYMCRYPT_CALL	SymCryptMlKemVectorCreate (_Out_writes_bytes_(cbBuffer) PBYTE pbBuffer, UINT32 cbBuffer, UINT32 nRows)

PSYMCRYPT_MLKEM_MATRIX SYMCRYPT_CALL	SymCryptMlKemMatrixCreate (_Out_writes_bytes_(cbBuffer) PBYTE pbBuffer, UINT32 cbBuffer, UINT32 nRows)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementMulAndAccumulate (_In_ PCSYMCRYPT_MLKEM_POLYELEMENT peSrc1, _In_ PCSYMCRYPT_MLKEM_POLYELEMENT peSrc2, _Inout_ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR paDst)

VOID SYMCRYPT_CALL	SymCryptMlKemMontgomeryReduceAndAddPolyElementAccumulatorToPolyElement (_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR paSrc, _Inout_ PSYMCRYPT_MLKEM_POLYELEMENT peDst)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementMulR (_In_ PCSYMCRYPT_MLKEM_POLYELEMENT peSrc, _Out_ PSYMCRYPT_MLKEM_POLYELEMENT peDst)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementAdd (_In_ PCSYMCRYPT_MLKEM_POLYELEMENT peSrc1, _In_ PCSYMCRYPT_MLKEM_POLYELEMENT peSrc2, _Out_ PSYMCRYPT_MLKEM_POLYELEMENT peDst)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementSub (_In_ PCSYMCRYPT_MLKEM_POLYELEMENT peSrc1, _In_ PCSYMCRYPT_MLKEM_POLYELEMENT peSrc2, _Out_ PSYMCRYPT_MLKEM_POLYELEMENT peDst)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementNTT (_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT peSrc)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementINTTAndMulR (_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT peSrc)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementCompressAndEncode (_In_ PCSYMCRYPT_MLKEM_POLYELEMENT peSrc, UINT32 nBitsPerCoefficient, _Out_writes_bytes_(nBitsPerCoefficient *(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS/8)) PBYTE pbDst)

SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptMlKemPolyElementDecodeAndDecompress (_In_reads_bytes_(nBitsPerCoefficient *(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS/8)) PCBYTE pbSrc, UINT32 nBitsPerCoefficient, _Out_ PSYMCRYPT_MLKEM_POLYELEMENT peDst)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementSampleNTTFromShake128 (_Inout_ PSYMCRYPT_SHAKE128_STATE pState, _Out_ PSYMCRYPT_MLKEM_POLYELEMENT peDst)

VOID SYMCRYPT_CALL	SymCryptMlKemPolyElementSampleCBDFromBytes (_In_reads_bytes_(eta 2 (SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS/8)+1) PCBYTE pbSrc, _In_range_(2, 3) UINT32 eta, _Out_ PSYMCRYPT_MLKEM_POLYELEMENT peDst)

VOID SYMCRYPT_CALL	SymCryptMlKemMatrixTranspose (_Inout_ PSYMCRYPT_MLKEM_MATRIX pmSrc)

VOID SYMCRYPT_CALL	SymCryptMlKemMatrixVectorMontMulAndAdd (_In_ PCSYMCRYPT_MLKEM_MATRIX pmSrc1, _In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc2, _Inout_ PSYMCRYPT_MLKEM_VECTOR pvDst, _Inout_ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR paTmp)

VOID SYMCRYPT_CALL	SymCryptMlKemVectorMontDotProduct (_In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc1, _In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc2, _Inout_ PSYMCRYPT_MLKEM_POLYELEMENT peDst, _Inout_ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR paTmp)

VOID SYMCRYPT_CALL	SymCryptMlKemVectorSetZero (_Inout_ PSYMCRYPT_MLKEM_VECTOR pvSrc)

VOID SYMCRYPT_CALL	SymCryptMlKemVectorMulR (_In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc, _Out_ PSYMCRYPT_MLKEM_VECTOR pvDst)

VOID SYMCRYPT_CALL	SymCryptMlKemVectorAdd (_In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc1, _In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc2, _Out_ PSYMCRYPT_MLKEM_VECTOR pvDst)

VOID SYMCRYPT_CALL	SymCryptMlKemVectorSub (_In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc1, _In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc2, _Out_ PSYMCRYPT_MLKEM_VECTOR pvDst)

VOID SYMCRYPT_CALL	SymCryptMlKemVectorNTT (_Inout_ PSYMCRYPT_MLKEM_VECTOR pvSrc)

VOID SYMCRYPT_CALL	SymCryptMlKemVectorINTTAndMulR (_Inout_ PSYMCRYPT_MLKEM_VECTOR pvSrc)

VOID SYMCRYPT_CALL	SymCryptMlKemVectorCompressAndEncode (_In_ PCSYMCRYPT_MLKEM_VECTOR pvSrc, UINT32 nBitsPerCoefficient, _Out_writes_bytes_(cbDst) PBYTE pbDst, SIZE_T cbDst)

SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptMlKemVectorDecodeAndDecompress (_In_reads_bytes_(cbSrc) PCBYTE pbSrc, SIZE_T cbSrc, UINT32 nBitsPerCoefficient, _Out_ PSYMCRYPT_MLKEM_VECTOR pvDst)

VOID SYMCRYPT_CALL	SymCryptMlKemkeyWipePrivateState (_Inout_ PSYMCRYPT_MLKEMKEY pkMlKemkey)

Variables
	SYMCRYPT_MLKEM_POLYELEMENT

	SYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR

UINT32	cbTotalSize

	SYMCRYPT_MLKEM_VECTOR

*	PSYMCRYPT_MLKEM_VECTOR

PSYMCRYPT_MLKEM_POLYELEMENT	apPolyElements [SYMCRYPT_MLKEM_MATRIX_MAX_NROWS *SYMCRYPT_MLKEM_MATRIX_MAX_NROWS]

	SYMCRYPT_MLKEM_MATRIX

*	PSYMCRYPT_MLKEM_MATRIX

UINT32	cbPolyElement

UINT32	cbVector

UINT32	cbMatrix

UINT8	nRows

UINT8	nEta1

UINT8	nEta2

UINT8	nBitsOfU

UINT8	nBitsOfV

	SYMCRYPT_MLKEM_INTERNAL_PARAMS

*	PSYMCRYPT_MLKEM_INTERNAL_PARAMS

SYMCRYPT_MLKEM_INTERNAL_PARAMS	params

BOOLEAN	hasPrivateSeed

BOOLEAN	hasPrivateKey

BYTE	privateSeed [32]

BYTE	privateRandom [32]

BYTE	publicSeed [32]

PSYMCRYPT_MLKEM_MATRIX	pmAtranspose

PSYMCRYPT_MLKEM_VECTOR	pvt

PSYMCRYPT_MLKEM_VECTOR	pvs

BYTE	encodedT [SYMCRYPT_MLKEMKEY_MAX_SIZEOF_ENCODED_T]

BYTE	encapsKeyHash [32]

SYMCRYPT_MAGIC_FIELD	SYMCRYPT_MLKEMKEY

BYTE	abVectorBuffer1 [SYMCRYPT_INTERNAL_MLKEM_MAXIMUM_VECTOR_SIZE]

BYTE	abPolyElementBuffer0 [SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT]

BYTE	abPolyElementBuffer1 [SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT]

BYTE	abPolyElementAccumulatorBuffer [SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT_ACCUMULATOR]

union {
SYMCRYPT_SHAKE128_STATE shake128State

SYMCRYPT_SHAKE256_STATE shake256State

SYMCRYPT_SHA3_256_STATE sha3_256State

SYMCRYPT_SHA3_512_STATE sha3_512State

}	hashState0

union {
SYMCRYPT_SHAKE128_STATE shake128State

SYMCRYPT_SHAKE256_STATE shake256State

SYMCRYPT_SHA3_256_STATE sha3_256State

SYMCRYPT_SHA3_512_STATE sha3_512State

}	hashState1

	SYMCRYPT_MLKEM_INTERNAL_COMPUTATION_TEMPORARIES

Macro Definition Documentation

◆ SYMCRYPT_INTERNAL_MLKEM_MAXIMUM_VECTOR_SIZE

#define SYMCRYPT_INTERNAL_MLKEM_MAXIMUM_VECTOR_SIZE ( sizeof(SYMCRYPT_MLKEM_VECTOR) + (SYMCRYPT_MLKEM_MATRIX_MAX_NROWS * SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT) )

Definition at line 127 of file sc_lib_mlkem.h.

◆ SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT

#define SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT ( sizeof(SYMCRYPT_MLKEM_POLYELEMENT) )

Definition at line 125 of file sc_lib_mlkem.h.

◆ SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT_ACCUMULATOR

#define SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT_ACCUMULATOR ( sizeof(SYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR) )

Definition at line 126 of file sc_lib_mlkem.h.

◆ SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT

#define SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT	(	_row,
		_pVector
	)	(PSYMCRYPT_MLKEM_POLYELEMENT)( (PBYTE)(_pVector) + SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT_OFFSET(_row) )

Definition at line 129 of file sc_lib_mlkem.h.

◆ SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT_OFFSET

#define SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT_OFFSET ( _row ) ( sizeof(SYMCRYPT_MLKEM_VECTOR) + ((_row) * SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT) )

Definition at line 128 of file sc_lib_mlkem.h.

◆ SYMCRYPT_MLKEM_MATRIX_MAX_NROWS

#define SYMCRYPT_MLKEM_MATRIX_MAX_NROWS (4)

Definition at line 28 of file sc_lib_mlkem.h.

◆ SYMCRYPT_MLKEM_Q

#define SYMCRYPT_MLKEM_Q (3329)

Definition at line 123 of file sc_lib_mlkem.h.

◆ SYMCRYPT_MLKEM_SIZEOF_AGREED_SECRET

#define SYMCRYPT_MLKEM_SIZEOF_AGREED_SECRET (32UL)

Definition at line 132 of file sc_lib_mlkem.h.

◆ SYMCRYPT_MLKEM_SIZEOF_ENCAPS_RANDOM

#define SYMCRYPT_MLKEM_SIZEOF_ENCAPS_RANDOM (32UL)

Definition at line 133 of file sc_lib_mlkem.h.

◆ SYMCRYPT_MLKEM_SIZEOF_MAX_CIPHERTEXT

#define SYMCRYPT_MLKEM_SIZEOF_MAX_CIPHERTEXT (1568UL)

Definition at line 131 of file sc_lib_mlkem.h.

◆ SYMCRYPT_MLKEMKEY_MAX_SIZEOF_ENCODED_T

#define SYMCRYPT_MLKEMKEY_MAX_SIZEOF_ENCODED_T (1536)

Definition at line 60 of file sc_lib_mlkem.h.

Typedef Documentation

◆ _SYMCRYPT_MLKEM_INTERNAL_COMPUTATION_TEMPORARIES

typedef SYMCRYPT_ASYM_ALIGN_STRUCT _SYMCRYPT_MLKEM_INTERNAL_COMPUTATION_TEMPORARIES

Initial value:

{

BYTE abVectorBuffer0[SYMCRYPT_INTERNAL_MLKEM_MAXIMUM_VECTOR_SIZE]

SYMCRYPT_INTERNAL_MLKEM_MAXIMUM_VECTOR_SIZE

#define SYMCRYPT_INTERNAL_MLKEM_MAXIMUM_VECTOR_SIZE

Definition: sc_lib_mlkem.h:127

BYTE

unsigned char BYTE

Definition: xxhash.c:193

Definition at line 135 of file sc_lib_mlkem.h.

◆ _SYMCRYPT_MLKEM_INTERNAL_PARAMS

typedef SYMCRYPT_ALIGN_STRUCT _SYMCRYPT_MLKEM_INTERNAL_PARAMS

Initial value:

{

UINT32 params

params

GLenum const GLfloat * params

Definition: glext.h:5645

UINT32

uint32_t UINT32

Definition: typedefs.h:59

Definition at line 62 of file sc_lib_mlkem.h.

◆ _SYMCRYPT_MLKEM_MATRIX

typedef SYMCRYPT_ASYM_ALIGN_STRUCT _SYMCRYPT_MLKEM_MATRIX

Initial value:

{
    _Field_range_( 1, SYMCRYPT_MLKEM_MATRIX_MAX_NROWS )
        UINT32                      nRows

Definition at line 40 of file sc_lib_mlkem.h.

◆ _SYMCRYPT_MLKEM_POLYELEMENT

typedef SYMCRYPT_ASYM_ALIGN_STRUCT _SYMCRYPT_MLKEM_POLYELEMENT

Initial value:

{
    
    UINT16    coeffs[SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS]

Definition at line 14 of file sc_lib_mlkem.h.

◆ _SYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR

typedef SYMCRYPT_ASYM_ALIGN_STRUCT _SYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR

Initial value:

{
    
    UINT32    coeffs[SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS]

Definition at line 21 of file sc_lib_mlkem.h.

◆ _SYMCRYPT_MLKEM_VECTOR

typedef SYMCRYPT_ASYM_ALIGN_STRUCT _SYMCRYPT_MLKEM_VECTOR

Initial value:

{
    _Field_range_( 1, SYMCRYPT_MLKEM_MATRIX_MAX_NROWS )
        UINT32                      nRows

Definition at line 30 of file sc_lib_mlkem.h.

◆ _SYMCRYPT_MLKEMKEY

typedef SYMCRYPT_ASYM_ALIGN_STRUCT _SYMCRYPT_MLKEMKEY

Initial value:

{

UINT32 fAlgorithmInfo

Definition at line 82 of file sc_lib_mlkem.h.

◆ PCSYMCRYPT_MLKEM_INTERNAL_PARAMS

typedef const SYMCRYPT_MLKEM_INTERNAL_PARAMS* PCSYMCRYPT_MLKEM_INTERNAL_PARAMS

Definition at line 80 of file sc_lib_mlkem.h.

◆ PCSYMCRYPT_MLKEM_MATRIX

typedef const SYMCRYPT_MLKEM_MATRIX* PCSYMCRYPT_MLKEM_MATRIX

Definition at line 54 of file sc_lib_mlkem.h.

◆ PCSYMCRYPT_MLKEM_POLYELEMENT

typedef const SYMCRYPT_MLKEM_POLYELEMENT* PCSYMCRYPT_MLKEM_POLYELEMENT

Definition at line 19 of file sc_lib_mlkem.h.

◆ PCSYMCRYPT_MLKEM_VECTOR

typedef const SYMCRYPT_MLKEM_VECTOR* PCSYMCRYPT_MLKEM_VECTOR

Definition at line 38 of file sc_lib_mlkem.h.

◆ PSYMCRYPT_MLKEM_INTERNAL_COMPUTATION_TEMPORARIES

typedef SYMCRYPT_MLKEM_INTERNAL_COMPUTATION_TEMPORARIES* PSYMCRYPT_MLKEM_INTERNAL_COMPUTATION_TEMPORARIES

Definition at line 154 of file sc_lib_mlkem.h.

◆ PSYMCRYPT_MLKEM_POLYELEMENT

typedef SYMCRYPT_MLKEM_POLYELEMENT* PSYMCRYPT_MLKEM_POLYELEMENT

Definition at line 18 of file sc_lib_mlkem.h.

◆ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR

typedef SYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR* PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR

Definition at line 25 of file sc_lib_mlkem.h.

Function Documentation

◆ SymCryptMlKemEncapsulateInternal()

SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptMlKemEncapsulateInternal	(	_In_ PCSYMCRYPT_MLKEMKEY	pkMlKemkey,
		_Out_writes_bytes_(cbAgreedSecret) PBYTE	pbAgreedSecret,
		SIZE_T	cbAgreedSecret,
		_Out_writes_bytes_(cbCiphertext) PBYTE	pbCiphertext,
		SIZE_T	cbCiphertext,
		_In_reads_bytes_(SYMCRYPT_MLKEM_SIZEOF_ENCAPS_RANDOM) PCBYTE	pbRandom,
		_Inout_ PSYMCRYPT_MLKEM_INTERNAL_COMPUTATION_TEMPORARIES	pCompTemps
	)

Definition at line 807 of file mlkem.c.

{
    BYTE CBDSampleBuffer[3*64 + 1];
    SYMCRYPT_ERROR scError = SYMCRYPT_NO_ERROR;
    PSYMCRYPT_MLKEM_VECTOR pvrInner;
    PSYMCRYPT_MLKEM_VECTOR pvTmp;
    PSYMCRYPT_MLKEM_POLYELEMENT peTmp0, peTmp1;
    PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR paTmp;
    PSYMCRYPT_SHA3_512_STATE pHashState = &pCompTemps->hashState0.sha3_512State;
    PSYMCRYPT_SHAKE256_STATE pShakeBaseState = &pCompTemps->hashState0.shake256State;
    PSYMCRYPT_SHAKE256_STATE pShakeWorkState = &pCompTemps->hashState1.shake256State;
    SIZE_T cbU, cbV;
    UINT32 i;
    const UINT32 nRows = pkMlKemkey->params.nRows;
    const UINT32 nBitsOfU = pkMlKemkey->params.nBitsOfU;
    const UINT32 nBitsOfV = pkMlKemkey->params.nBitsOfV;
    const UINT32 nEta1 = pkMlKemkey->params.nEta1;
    const UINT32 nEta2 = pkMlKemkey->params.nEta2;
    const UINT32 cbPolyElement = pkMlKemkey->params.cbPolyElement;
    const UINT32 cbVector = pkMlKemkey->params.cbVector;
 
    // u vector encoded with nBitsOfU * SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS bits per polynomial
    cbU = nRows * nBitsOfU * (SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS / 8);
    // v polynomial encoded with nBitsOfV * SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS bits
    cbV = nBitsOfV * (SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS / 8);
 
    if( (cbAgreedSecret != SYMCRYPT_MLKEM_SIZEOF_AGREED_SECRET) ||
        (cbCiphertext != cbU + cbV) )
    {
        scError = SYMCRYPT_INVALID_ARGUMENT;
        goto cleanup;
    }
 
    pvrInner = SymCryptMlKemVectorCreate( pCompTemps->abVectorBuffer0, cbVector, nRows );
    SYMCRYPT_ASSERT( pvrInner != NULL );
    pvTmp = SymCryptMlKemVectorCreate( pCompTemps->abVectorBuffer1, cbVector, nRows );
    SYMCRYPT_ASSERT( pvTmp != NULL );
    peTmp0 = SymCryptMlKemPolyElementCreate( pCompTemps->abPolyElementBuffer0, cbPolyElement );
    SYMCRYPT_ASSERT( peTmp0 != NULL );
    peTmp1 = SymCryptMlKemPolyElementCreate( pCompTemps->abPolyElementBuffer1, cbPolyElement );
    SYMCRYPT_ASSERT( peTmp1 != NULL );
    paTmp = SymCryptMlKemPolyElementAccumulatorCreate( pCompTemps->abPolyElementAccumulatorBuffer, 2*cbPolyElement );
    SYMCRYPT_ASSERT( paTmp != NULL );
 
    // CBDSampleBuffer = (K || rOuter) = SHA3-512(pbRandom || encapsKeyHash)
    SymCryptSha3_512Init( pHashState );
    SymCryptSha3_512Append( pHashState, pbRandom, SYMCRYPT_MLKEM_SIZEOF_ENCAPS_RANDOM );
    SymCryptSha3_512Append( pHashState, pkMlKemkey->encapsKeyHash, sizeof(pkMlKemkey->encapsKeyHash) );
    SymCryptSha3_512Result( pHashState, CBDSampleBuffer );
 
    // Write K to pbAgreedSecret
    memcpy( pbAgreedSecret, CBDSampleBuffer, SYMCRYPT_MLKEM_SIZEOF_AGREED_SECRET );
 
    // Initialize pShakeStateBase with rOuter
    SymCryptShake256Init( pShakeBaseState );
    SymCryptShake256Append( pShakeBaseState, CBDSampleBuffer+cbAgreedSecret, 32 );
 
    // Expand rInner vector
    for( i=0; i<nRows; i++ )
    {
        CBDSampleBuffer[0] = (BYTE) i;
        SymCryptShake256StateCopy( pShakeBaseState, pShakeWorkState );
        SymCryptShake256Append( pShakeWorkState, CBDSampleBuffer, 1 );
 
        SymCryptShake256Extract( pShakeWorkState, CBDSampleBuffer, 64ul*nEta1, FALSE );
 
        SymCryptMlKemPolyElementSampleCBDFromBytes( CBDSampleBuffer, nEta1, SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT(i, pvrInner) );
    }
 
    // Perform NTT on rInner
    SymCryptMlKemVectorNTT( pvrInner );
 
    // Set pvTmp to 0
    SymCryptMlKemVectorSetZero( pvTmp );
 
    // pvTmp = (Atranspose o rInner) ./ R
    SymCryptMlKemMatrixVectorMontMulAndAdd( pkMlKemkey->pmAtranspose, pvrInner, pvTmp, paTmp );
 
    // pvTmp = INTT(Atranspose o rInner)
    SymCryptMlKemVectorINTTAndMulR( pvTmp );
 
    // Expand e1 and add it to pvTmp - do addition PolyElement-wise to reduce memory usage
    for( i=0; i<nRows; i++ )
    {
        CBDSampleBuffer[0] = (BYTE) (nRows+i);
        SymCryptShake256StateCopy( pShakeBaseState, pShakeWorkState );
        SymCryptShake256Append( pShakeWorkState, CBDSampleBuffer, 1 );
 
        SymCryptShake256Extract( pShakeWorkState, CBDSampleBuffer, 64ul*nEta2, FALSE );
 
        SymCryptMlKemPolyElementSampleCBDFromBytes( CBDSampleBuffer, nEta2, peTmp0 );
 
        SymCryptMlKemPolyElementAdd( SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT(i, pvTmp), peTmp0, SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT(i, pvTmp) );
    }
 
    // pvTmp = u = INTT(Atranspose o rInner) + e1
    // Compress and encode u into prefix of ciphertext
    SymCryptMlKemVectorCompressAndEncode( pvTmp, nBitsOfU, pbCiphertext, cbU );
 
    // peTmp0 = (t o r) ./ R
    SymCryptMlKemVectorMontDotProduct( pkMlKemkey->pvt, pvrInner, peTmp0, paTmp );
 
    // peTmp0 = INTT(t o r)
    SymCryptMlKemPolyElementINTTAndMulR( peTmp0 );
 
    // Expand e2 polynomial in peTmp1
    CBDSampleBuffer[0] = (BYTE) (2*nRows);
    SymCryptShake256StateCopy( pShakeBaseState, pShakeWorkState );
    SymCryptShake256Append( pShakeWorkState, CBDSampleBuffer, 1 );
 
    SymCryptShake256Extract( pShakeWorkState, CBDSampleBuffer, 64ul*nEta2, FALSE );
 
    SymCryptMlKemPolyElementSampleCBDFromBytes( CBDSampleBuffer, nEta2, peTmp1 );
 
    // peTmp = INTT(t o r) + e2
    SymCryptMlKemPolyElementAdd( peTmp0, peTmp1, peTmp0 );
 
    // peTmp1 = mu
    SymCryptMlKemPolyElementDecodeAndDecompress( pbRandom, 1, peTmp1 );
 
    // peTmp0 = v = INTT(t o r) + e2 + mu
    SymCryptMlKemPolyElementAdd( peTmp0, peTmp1, peTmp0 );
 
    // Compress and encode v into remainder of ciphertext
    SymCryptMlKemPolyElementCompressAndEncode( peTmp0, nBitsOfV, pbCiphertext+cbU );
 
cleanup:
    SymCryptWipeKnownSize( CBDSampleBuffer, sizeof(CBDSampleBuffer) );
 
    return scError;
}

Referenced by SymCryptMlKemDecapsulate(), and SymCryptMlKemEncapsulateEx().

◆ SymCryptMlKemkeyWipePrivateState()

VOID SYMCRYPT_CALL SymCryptMlKemkeyWipePrivateState ( _Inout_ PSYMCRYPT_MLKEMKEY pkMlKemkey )

Definition at line 1426 of file mlkem_primitives.c.

{
    SymCryptMlKemVectorSetZero( pkMlKemkey->pvs );
    SymCryptWipeKnownSize( pkMlKemkey->privateRandom, sizeof(pkMlKemkey->privateRandom) );
    SymCryptWipeKnownSize( pkMlKemkey->privateSeed, sizeof(pkMlKemkey->privateSeed) );
    pkMlKemkey->hasPrivateKey = FALSE;
    pkMlKemkey->hasPrivateSeed = FALSE;
}

◆ SymCryptMlKemMatrixCreate()

PSYMCRYPT_MLKEM_MATRIX SYMCRYPT_CALL SymCryptMlKemMatrixCreate	(	_Out_writes_bytes_(cbBuffer) PBYTE	pbBuffer,
		UINT32	cbBuffer,
		UINT32	nRows
	)

Definition at line 196 of file mlkem_primitives.c.

{
    PSYMCRYPT_MLKEM_MATRIX pDst = NULL;
    PSYMCRYPT_MLKEM_MATRIX pMatrix = (PSYMCRYPT_MLKEM_MATRIX)pbBuffer;
    UINT32 i;
    PBYTE pbTmp = pbBuffer + sizeof(SYMCRYPT_MLKEM_MATRIX);
 
    SYMCRYPT_ASSERT_ASYM_ALIGNED( pbBuffer );
 
    SYMCRYPT_ASSERT( nRows > 0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
 
    pMatrix->nRows = nRows;
    pMatrix->cbTotalSize = cbBuffer;
 
    for( i=0; i<(nRows*nRows); i++ )
    {
        pMatrix->apPolyElements[i] = SymCryptMlKemPolyElementCreate( pbTmp, SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT );
        if( pMatrix->apPolyElements[i] == NULL )
        {
            goto cleanup;
        }
 
        pbTmp += SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT;
    }
 
    SYMCRYPT_ASSERT( pbTmp == (pbBuffer + cbBuffer) );
 
    pDst = pMatrix;
 
cleanup:
    return pDst;
}

Referenced by SymCryptMlKemkeyInitialize().

◆ SymCryptMlKemMatrixTranspose()

VOID SYMCRYPT_CALL SymCryptMlKemMatrixTranspose ( _Inout_ PSYMCRYPT_MLKEM_MATRIX pmSrc )

Definition at line 1152 of file mlkem_primitives.c.

{
    UINT32 i, j;
    PSYMCRYPT_MLKEM_POLYELEMENT swap;
    const UINT32 nRows = pmSrc->nRows;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
 
    for( i=0; i<nRows; i++ )
    {
        for( j=i+1; j<nRows; j++ )
        {
            swap = pmSrc->apPolyElements[(i*nRows) + j];
            pmSrc->apPolyElements[(i*nRows) + j] = pmSrc->apPolyElements[(j*nRows) + i];
            pmSrc->apPolyElements[(j*nRows) + i] = swap;
        }
    }
}

Referenced by SymCryptMlKemkeyExpandFromPrivateSeed(), and SymCryptMlKemkeySetValue().

◆ SymCryptMlKemMatrixVectorMontMulAndAdd()

VOID SYMCRYPT_CALL SymCryptMlKemMatrixVectorMontMulAndAdd	(	_In_ PCSYMCRYPT_MLKEM_MATRIX	pmSrc1,
		_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc2,
		_Inout_ PSYMCRYPT_MLKEM_VECTOR	pvDst,
		_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR	paTmp
	)

Definition at line 1175 of file mlkem_primitives.c.

{
    UINT32 i, j;
    const UINT32 nRows = pmSrc1->nRows;
    PCSYMCRYPT_MLKEM_POLYELEMENT peSrc1, peSrc2;
    PSYMCRYPT_MLKEM_POLYELEMENT  peDst;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
    SYMCRYPT_ASSERT( pvSrc2->nRows == nRows );
    SYMCRYPT_ASSERT( pvDst->nRows == nRows );
 
    // Zero paTmp
    SymCryptWipeKnownSize( paTmp, SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT_ACCUMULATOR );
 
    for( i=0; i<nRows; i++ )
    {
        for( j=0; j<nRows; j++ )
        {
            peSrc1 = pmSrc1->apPolyElements[(i*nRows) + j];
            peSrc2 = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( j, pvSrc2 );
            SymCryptMlKemPolyElementMulAndAccumulate( peSrc1, peSrc2, paTmp );
        }
 
        // write accumulator to dest and zero accumulator
        peDst  = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvDst );
        SymCryptMlKemMontgomeryReduceAndAddPolyElementAccumulatorToPolyElement( paTmp, peDst );
    }
}

Referenced by SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemkeyExpandFromPrivateSeed().

◆ SymCryptMlKemMontgomeryReduceAndAddPolyElementAccumulatorToPolyElement()

VOID SYMCRYPT_CALL SymCryptMlKemMontgomeryReduceAndAddPolyElementAccumulatorToPolyElement	(	_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR	paSrc,
		_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT	peDst
	)

Definition at line 758 of file mlkem_primitives.c.

{
    UINT32 i;
    UINT32 a, c, inv;
 
    for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i++ )
    {
        a = paSrc->coeffs[i];
        SYMCRYPT_ASSERT( a <= 4*(SYMCRYPT_MLKEM_MaxCoeffProduct + SYMCRYPT_MLKEM_MaxA1B1ZetaPow) );
        paSrc->coeffs[i] = 0;
 
        c = peDst->coeffs[i];
        SYMCRYPT_ASSERT( c < SYMCRYPT_MLKEM_Q );
 
        // montgomery reduce sum of products
        inv = (a * SYMCRYPT_MLKEM_NegQInvModR) & SYMCRYPT_MLKEM_Rmask;
        a = (a + (inv * SYMCRYPT_MLKEM_Q)) >> SYMCRYPT_MLKEM_Rlog2; // in range [0, 4711]
        SYMCRYPT_ASSERT( a <= 4711 );
 
        // add destination
        c += a;
        SYMCRYPT_ASSERT( c <= 8039 );
 
        // subtraction and conditional additions for constant time range reduction
        c -= 2*SYMCRYPT_MLKEM_Q;           // in range [-2Q, 1381]
        SYMCRYPT_ASSERT( (c >= ((UINT32)(-2*SYMCRYPT_MLKEM_Q))) || (c < 1381) );
        c += SYMCRYPT_MLKEM_Q & (c >> 16); // in range [-Q, Q-1]
        SYMCRYPT_ASSERT( (c >= ((UINT32)-SYMCRYPT_MLKEM_Q)) || (c < SYMCRYPT_MLKEM_Q) );
        c += SYMCRYPT_MLKEM_Q & (c >> 16); // in range [0, Q-1]
        SYMCRYPT_ASSERT( c < SYMCRYPT_MLKEM_Q );
 
        peDst->coeffs[i] = (UINT16) c;
    }
}

Referenced by SymCryptMlKemMatrixVectorMontMulAndAdd(), and SymCryptMlKemVectorMontDotProduct().

◆ SymCryptMlKemPolyElementAccumulatorCreate()

PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR SYMCRYPT_CALL SymCryptMlKemPolyElementAccumulatorCreate	(	_Out_writes_bytes_(cbBuffer) PBYTE	pbBuffer,
		UINT32	cbBuffer
	)

Definition at line 140 of file mlkem_primitives.c.

{
    PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR pDst = (PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR) pbBuffer;
 
    UNREFERENCED_PARAMETER( cbBuffer );
 
    SYMCRYPT_ASSERT_ASYM_ALIGNED( pbBuffer );
    SYMCRYPT_ASSERT( cbBuffer == SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT_ACCUMULATOR );
 
    return pDst;
}

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemkeyExpandFromPrivateSeed().

◆ SymCryptMlKemPolyElementAdd()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementAdd	(	_In_ PCSYMCRYPT_MLKEM_POLYELEMENT	peSrc1,
		_In_ PCSYMCRYPT_MLKEM_POLYELEMENT	peSrc2,
		_Out_ PSYMCRYPT_MLKEM_POLYELEMENT	peDst
	)

Definition at line 811 of file mlkem_primitives.c.

{
    UINT32 i;
    for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i++ )
    {
        peDst->coeffs[i] = (UINT16) SymCryptMlKemModAdd( peSrc1->coeffs[i], peSrc2->coeffs[i] );
    }
}

Referenced by SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemVectorAdd().

◆ SymCryptMlKemPolyElementCompressAndEncode()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementCompressAndEncode	(	_In_ PCSYMCRYPT_MLKEM_POLYELEMENT	peSrc,
		UINT32	nBitsPerCoefficient,
		_Out_writes_bytes_(nBitsPerCoefficient *(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS/8)) PBYTE	pbDst
	)

Definition at line 890 of file mlkem_primitives.c.

{
    UINT32 i;
    UINT64 multiplication;
    UINT32 coefficient;
    UINT32 nBitsInCoefficient;
    UINT32 bitsToEncode;
    UINT32 nBitsToEncode;
    UINT32 cbDstWritten = 0;
    UINT32 accumulator = 0;
    UINT32 nBitsInAccumulator = 0;
 
    SYMCRYPT_ASSERT( nBitsPerCoefficient >  0  );
    SYMCRYPT_ASSERT( nBitsPerCoefficient <= 12 );
 
    for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i++ )
    {
        nBitsInCoefficient = nBitsPerCoefficient;
        coefficient = peSrc->coeffs[i]; // in range [0, Q-1]
        SYMCRYPT_ASSERT( coefficient < SYMCRYPT_MLKEM_Q );
 
        // first compress the coefficient
        // when nBitsPerCoefficient < 12 we compress per Compress_d in FIPS 203;
        if(nBitsPerCoefficient < 12)
        {
            // Multiply by 2^(nBitsPerCoefficient+1) / Q by multiplying by constant and shifting right
            multiplication = SYMCRYPT_MUL32x32TO64(coefficient, SYMCRYPT_MLKEM_COMPRESS_MULCONSTANT);
            coefficient = (UINT32) (multiplication >> (SYMCRYPT_MLKEM_COMPRESS_SHIFTCONSTANT-(nBitsPerCoefficient+1)));
 
            // add "half" to round to nearest integer
            coefficient++;
 
            // final divide by two to get multiplication by 2^nBitsPerCoefficient / Q
            coefficient >>= 1;                              // in range [0, 2^nBitsPerCoefficient]
            SYMCRYPT_ASSERT(coefficient <= (1UL<<nBitsPerCoefficient));
 
            // modular reduction by masking
            coefficient &= (1UL<<nBitsPerCoefficient)-1;    // in range [0, 2^nBitsPerCoefficient - 1]
            SYMCRYPT_ASSERT(coefficient <  (1UL<<nBitsPerCoefficient));
        }
 
        // encode the coefficient
        // simple loop to add bits to accumulator and write accumulator to output
        do
        {
            nBitsToEncode = SYMCRYPT_MIN(nBitsInCoefficient, 32-nBitsInAccumulator);
 
            bitsToEncode = coefficient & ((1UL<<nBitsToEncode)-1);
            coefficient >>= nBitsToEncode;
            nBitsInCoefficient -= nBitsToEncode;
 
            accumulator |= (bitsToEncode << nBitsInAccumulator);
            nBitsInAccumulator += nBitsToEncode;
            if(nBitsInAccumulator == 32)
            {
                SYMCRYPT_STORE_LSBFIRST32( pbDst+cbDstWritten, accumulator );
                cbDstWritten += 4;
                accumulator = 0;
                nBitsInAccumulator = 0;
            }
        } while( nBitsInCoefficient > 0 );
    }
 
    SYMCRYPT_ASSERT(nBitsInAccumulator == 0);
    SYMCRYPT_ASSERT(cbDstWritten == (nBitsPerCoefficient*(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS / 8)));
}

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemVectorCompressAndEncode().

◆ SymCryptMlKemPolyElementCreate()

PSYMCRYPT_MLKEM_POLYELEMENT SYMCRYPT_CALL SymCryptMlKemPolyElementCreate	(	_Out_writes_bytes_(cbBuffer) PBYTE	pbBuffer,
		UINT32	cbBuffer
	)

Definition at line 124 of file mlkem_primitives.c.

{
    PSYMCRYPT_MLKEM_POLYELEMENT pDst = (PSYMCRYPT_MLKEM_POLYELEMENT) pbBuffer;
 
    UNREFERENCED_PARAMETER( cbBuffer );
 
    SYMCRYPT_ASSERT_ASYM_ALIGNED( pbBuffer );
    SYMCRYPT_ASSERT( cbBuffer == SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT );
 
    return pDst;
}

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), SymCryptMlKemMatrixCreate(), and SymCryptMlKemVectorCreate().

◆ SymCryptMlKemPolyElementDecodeAndDecompress()

SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptMlKemPolyElementDecodeAndDecompress	(	_In_reads_bytes_(nBitsPerCoefficient *(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS/8)) PCBYTE	pbSrc,
		UINT32	nBitsPerCoefficient,
		_Out_ PSYMCRYPT_MLKEM_POLYELEMENT	peDst
	)

Definition at line 963 of file mlkem_primitives.c.

{
    UINT32 i;
    UINT32 coefficient;
    UINT32 nBitsInCoefficient;
    UINT32 bitsToDecode;
    UINT32 nBitsToDecode;
    UINT32 cbSrcRead = 0;
    UINT32 accumulator = 0;
    UINT32 nBitsInAccumulator = 0;
 
    SYMCRYPT_ASSERT( nBitsPerCoefficient >  0  );
    SYMCRYPT_ASSERT( nBitsPerCoefficient <= 12 );
 
    for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i++ )
    {
        coefficient = 0;
        nBitsInCoefficient = 0;
 
        // first gather and decode bits from pbSrc
        do
        {
            if(nBitsInAccumulator == 0)
            {
                accumulator = SYMCRYPT_LOAD_LSBFIRST32( pbSrc+cbSrcRead );
                cbSrcRead += 4;
                nBitsInAccumulator = 32;
            }
 
            nBitsToDecode = SYMCRYPT_MIN(nBitsPerCoefficient-nBitsInCoefficient, nBitsInAccumulator);
            SYMCRYPT_ASSERT(nBitsToDecode <= nBitsInAccumulator);
 
            bitsToDecode = accumulator & ((1UL<<nBitsToDecode)-1);
            accumulator >>= nBitsToDecode;
            nBitsInAccumulator -= nBitsToDecode;
 
            coefficient |= (bitsToDecode << nBitsInCoefficient);
            nBitsInCoefficient += nBitsToDecode;
        } while( nBitsPerCoefficient > nBitsInCoefficient );
        SYMCRYPT_ASSERT(nBitsInCoefficient == nBitsPerCoefficient);
 
        // decompress the coefficient
        // when nBitsPerCoefficient < 12 we decompress per Decompress_d in FIPS 203
        // otherwise we perform input validation per 203 6.2 Input validation 2 (Modulus check)
        if(nBitsPerCoefficient < 12)
        {
            // Multiply by Q / 2^(nBitsPerCoefficient-1) by multiplying by constant and shifting right
            coefficient *= SYMCRYPT_MLKEM_Q;
            coefficient >>= (nBitsPerCoefficient-1);
 
            // add "half" to round to nearest integer
            coefficient++;
 
            // final divide by two to get multiplication by Q / 2^nBitsPerCoefficient
            coefficient >>= 1;  // in range [0, Q]
 
            // modular reduction by conditional subtraction
            coefficient = SymCryptMlKemModSub( coefficient, SYMCRYPT_MLKEM_Q );
            SYMCRYPT_ASSERT( coefficient < SYMCRYPT_MLKEM_Q );
        }
        else if( coefficient >= SYMCRYPT_MLKEM_Q )
        {
            // input validation failure - this can happen with a malformed or corrupt encapsulation
            // or decapsulation key; we do not need to be constant time because we treat the
            // validity of an imported key as public information.
            return SYMCRYPT_INVALID_BLOB;
        }
 
        peDst->coeffs[i] = (UINT16) coefficient;
    }
 
    SYMCRYPT_ASSERT(nBitsInAccumulator == 0);
    SYMCRYPT_ASSERT(cbSrcRead == (nBitsPerCoefficient*(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS / 8)));
 
    return SYMCRYPT_NO_ERROR;
}

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemVectorDecodeAndDecompress().

◆ SymCryptMlKemPolyElementINTTAndMulR()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementINTTAndMulR ( _Inout_ PSYMCRYPT_MLKEM_POLYELEMENT peSrc )

Definition at line 859 of file mlkem_primitives.c.

{
    UINT32 i;
 
    SymCryptMlKemPolyElementINTTLayer( peSrc, 127,   2 );
    SymCryptMlKemPolyElementINTTLayer( peSrc,  63,   4 );
    SymCryptMlKemPolyElementINTTLayer( peSrc,  31,   8 );
    SymCryptMlKemPolyElementINTTLayer( peSrc,  15,  16 );
    SymCryptMlKemPolyElementINTTLayer( peSrc,   7,  32 );
    SymCryptMlKemPolyElementINTTLayer( peSrc,   3,  64 );
    SymCryptMlKemPolyElementINTTLayer( peSrc,   1, 128 );
 
    for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i++)
    {
        peSrc->coeffs[i] = (UINT16) SymCryptMlKemMontMul(
            peSrc->coeffs[i], SYMCRYPT_MLKEM_INTTFixupTimesRsqr, SYMCRYPT_MLKEM_INTTFixupTimesRsqrTimesNegQInvModR );
    }
}

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemVectorINTTAndMulR().

◆ SymCryptMlKemPolyElementMulAndAccumulate()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementMulAndAccumulate	(	_In_ PCSYMCRYPT_MLKEM_POLYELEMENT	peSrc1,
		_In_ PCSYMCRYPT_MLKEM_POLYELEMENT	peSrc2,
		_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR	paDst
	)

Definition at line 691 of file mlkem_primitives.c.

{
    UINT32 i;
    UINT32 a0, a1, b0, b1, c0, c1;
    UINT32 a0b0, a1b1, a0b1, a1b0, a1b1zetapow, inv;
 
    for( i=0; i<(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS / 2); i++ )
    {
        a0 = peSrc1->coeffs[(2*i)  ];
        SYMCRYPT_ASSERT( a0 < SYMCRYPT_MLKEM_Q );
        a1 = peSrc1->coeffs[(2*i)+1];
        SYMCRYPT_ASSERT( a1 < SYMCRYPT_MLKEM_Q );
 
        b0 = peSrc2->coeffs[(2*i)  ];
        SYMCRYPT_ASSERT( b0 < SYMCRYPT_MLKEM_Q );
        b1 = peSrc2->coeffs[(2*i)+1];
        SYMCRYPT_ASSERT( b1 < SYMCRYPT_MLKEM_Q );
 
        c0 = paDst->coeffs[(2*i)  ];
        SYMCRYPT_ASSERT( c0 <= 3*(SYMCRYPT_MLKEM_MaxCoeffProduct + SYMCRYPT_MLKEM_MaxA1B1ZetaPow) );
        c1 = paDst->coeffs[(2*i)+1];
        SYMCRYPT_ASSERT( c1 <= 3*(SYMCRYPT_MLKEM_MaxCoeffProduct + SYMCRYPT_MLKEM_MaxA1B1ZetaPow) );
 
        // multiplication results in range [0, MaxCoeffProduct = 3328*3328]
        a0b0 = a0 * b0;
        a1b1 = a1 * b1;
        a0b1 = a0 * b1;
        a1b0 = a1 * b0;
 
        // we need a1*b1*zetaTwoTimesBitRevPlus1TimesR[i]
        // eagerly reduce a1*b1 with montgomery reduction
        // a1b1 = red(a1*b1) -> range [0, MaxFirstStepReduction = 3494]
        //   (3494 is maximum result of first step of montgomery reduction of x*y for x,y in [0, 3328])
        // we do not need to do final reduction yet
        inv = (a1b1 * SYMCRYPT_MLKEM_NegQInvModR) & SYMCRYPT_MLKEM_Rmask;
        a1b1 = (a1b1 + (inv * SYMCRYPT_MLKEM_Q)) >> SYMCRYPT_MLKEM_Rlog2; // in range [0, MaxFirstStepReduction]
        SYMCRYPT_ASSERT( a1b1 <= SYMCRYPT_MLKEM_MaxFirstStepReduction );
 
        // now multiply a1b1 by power of zeta
        a1b1zetapow = a1b1 * zetaTwoTimesBitRevPlus1TimesR[i];
        // MaxZetaTwoTimesPlus1TimesR = 3254
        // MaxA1B1ZetaPow = MaxFirstStepReduction*MaxZetaTwoTimesPlus1TimesR = 3494*3254
        SYMCRYPT_ASSERT( a1b1zetapow <= SYMCRYPT_MLKEM_MaxA1B1ZetaPow );
 
        // sum pairs of products
        a0b0 += a1b1zetapow;    // a0*b0 + red(a1*b1)*zetapower in range [0, MaxCoeffProduct + MaxA1B1ZetaPow]
        SYMCRYPT_ASSERT( a0b0 <= SYMCRYPT_MLKEM_MaxCoeffProduct + SYMCRYPT_MLKEM_MaxA1B1ZetaPow );
        a0b1 += a1b0;           // a0*b1 + a1*b0                in range [0, 2*MaxCoeffProduct]
        SYMCRYPT_ASSERT( a0b1 <= 2*SYMCRYPT_MLKEM_MaxCoeffProduct );
 
        // We sum at most 4 pairs of products into an accumulator in ML-KEM
        C_ASSERT( SYMCRYPT_MLKEM_MATRIX_MAX_NROWS <= 4 );
        c0 += a0b0; // in range [0,4*MaxCoeffProduct + 4*MaxA1B1ZetaPow]
        SYMCRYPT_ASSERT( c0 < (4*SYMCRYPT_MLKEM_MaxCoeffProduct) + (4*SYMCRYPT_MLKEM_MaxA1B1ZetaPow) );
        c1 += a0b1; // in range [0,5*MaxCoeffProduct + 3*MaxA1B1ZetaPow]
        SYMCRYPT_ASSERT( c1 < (5*SYMCRYPT_MLKEM_MaxCoeffProduct) + (3*SYMCRYPT_MLKEM_MaxA1B1ZetaPow) );
 
        paDst->coeffs[(2*i)  ] = c0;
        paDst->coeffs[(2*i)+1] = c1;
    }
}

Referenced by SymCryptMlKemMatrixVectorMontMulAndAdd(), and SymCryptMlKemVectorMontDotProduct().

◆ SymCryptMlKemPolyElementMulR()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementMulR	(	_In_ PCSYMCRYPT_MLKEM_POLYELEMENT	peSrc,
		_Out_ PSYMCRYPT_MLKEM_POLYELEMENT	peDst
	)

Definition at line 797 of file mlkem_primitives.c.

{
    UINT32 i;
    for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i++ )
    {
        peDst->coeffs[i] = (UINT16) SymCryptMlKemMontMul(
            peSrc->coeffs[i], SYMCRYPT_MLKEM_Rsqr, SYMCRYPT_MLKEM_RsqrTimesNegQInvModR );
    }
}

Referenced by SymCryptMlKemVectorMulR().

◆ SymCryptMlKemPolyElementNTT()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementNTT ( _Inout_ PSYMCRYPT_MLKEM_POLYELEMENT peSrc )

Definition at line 839 of file mlkem_primitives.c.

{
    SymCryptMlKemPolyElementNTTLayer( peSrc,  1, 128 );
    SymCryptMlKemPolyElementNTTLayer( peSrc,  2,  64 );
    SymCryptMlKemPolyElementNTTLayer( peSrc,  4,  32 );
    SymCryptMlKemPolyElementNTTLayer( peSrc,  8,  16 );
    SymCryptMlKemPolyElementNTTLayer( peSrc, 16,   8 );
    SymCryptMlKemPolyElementNTTLayer( peSrc, 32,   4 );
    SymCryptMlKemPolyElementNTTLayer( peSrc, 64,   2 );
}

Referenced by SymCryptMlKemVectorNTT().

◆ SymCryptMlKemPolyElementSampleCBDFromBytes()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementSampleCBDFromBytes	(	_In_reads_bytes_(eta 2 (SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS/8)+1) PCBYTE	pbSrc,
		_In_range_(2, 3) UINT32	eta,
		_Out_ PSYMCRYPT_MLKEM_POLYELEMENT	peDst
	)

Definition at line 1081 of file mlkem_primitives.c.

{
    UINT32 i, j;
    UINT32 sampleBits;
    UINT32 coefficient;
 
    SYMCRYPT_ASSERT((eta == 2) || (eta == 3));
    if( eta == 3 )
    {
        for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i+=4 )
        {
            // unconditionally load 4 bytes into sampleBits, but only treat the load
            // as being 3 bytes (24-bits -> 4 coefficients) for eta==3 to align to
            // byte boundaries. Source buffer must be 1 byte larger than shake output
            sampleBits = SYMCRYPT_LOAD_LSBFIRST32( pbSrc );
            pbSrc += 3;
 
            // sum bit samples - each consecutive slice of eta bits is summed together
            sampleBits = (sampleBits&0x249249) + ((sampleBits>>1)&0x249249) + ((sampleBits>>2)&0x249249);
 
            for( j=0; j<4; j++ )
            {
                // each coefficient is formed by taking the difference of two consecutive slices of eta bits
                // the first eta bits are positive, the second eta bits are negative
                coefficient = sampleBits & 0x3f;
                sampleBits >>= 6;
                coefficient = (coefficient&3) - (coefficient>>3);
                SYMCRYPT_ASSERT((coefficient >= ((UINT32)-3)) || (coefficient <= 3));
 
                coefficient = coefficient + (SYMCRYPT_MLKEM_Q & (coefficient >> 16));     // in range [0, Q-1]
                SYMCRYPT_ASSERT( coefficient < SYMCRYPT_MLKEM_Q );
 
                peDst->coeffs[i+j] = (UINT16) coefficient;
            }
        }
    }
    else
    {
        for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i+=8 )
        {
            // unconditionally load 4 bytes (32-bits -> 8 coefficients) into sampleBits
            sampleBits = SYMCRYPT_LOAD_LSBFIRST32( pbSrc );
            pbSrc += 4;
 
            // sum bit samples - each consecutive slice of eta bits is summed together
            sampleBits = (sampleBits&0x55555555) + ((sampleBits>>1)&0x55555555);
 
            for( j=0; j<8; j++ )
            {
                // each coefficient is formed by taking the difference of two consecutive slices of eta bits
                // the first eta bits are positive, the second eta bits are negative
                coefficient = sampleBits & 0xf;
                sampleBits >>= 4;
                coefficient = (coefficient&3) - (coefficient>>2);
                SYMCRYPT_ASSERT((coefficient >= ((UINT32)-2)) || (coefficient <= 2));
 
                coefficient = coefficient + (SYMCRYPT_MLKEM_Q & (coefficient >> 16));     // in range [0, Q-1]
                SYMCRYPT_ASSERT( coefficient < SYMCRYPT_MLKEM_Q );
 
                peDst->coeffs[i+j] = (UINT16) coefficient;
            }
        }
    }
}

Referenced by SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemkeyExpandFromPrivateSeed().

◆ SymCryptMlKemPolyElementSampleNTTFromShake128()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementSampleNTTFromShake128	(	_Inout_ PSYMCRYPT_SHAKE128_STATE	pState,
		_Out_ PSYMCRYPT_MLKEM_POLYELEMENT	peDst
	)

Definition at line 1046 of file mlkem_primitives.c.

{
    UINT32 i=0;
    BYTE shakeOutputBuf[3*8]; // Keccak likes extracting multiples of 8-bytes
    UINT32 currBufIndex = sizeof(shakeOutputBuf);
    UINT16 sample0, sample1;
 
    while( i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS )
    {
        SYMCRYPT_ASSERT(currBufIndex <= sizeof(shakeOutputBuf));
        if( currBufIndex == sizeof(shakeOutputBuf) )
        {
            SymCryptShake128Extract(pState, shakeOutputBuf, sizeof(shakeOutputBuf), FALSE);
            currBufIndex = 0;
        }
 
        sample0 = SYMCRYPT_LOAD_LSBFIRST16( shakeOutputBuf+currBufIndex ) & 0xfff;
        sample1 = SYMCRYPT_LOAD_LSBFIRST16( shakeOutputBuf+currBufIndex+1 ) >> 4;
        currBufIndex += 3;
 
        peDst->coeffs[i] = sample0;
        i += sample0 < SYMCRYPT_MLKEM_Q;
 
        if( i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS )
        {
            peDst->coeffs[i] = sample1;
            i += sample1 < SYMCRYPT_MLKEM_Q;
        }
    }
}

Referenced by SymCryptMlKemkeyExpandPublicMatrixFromPublicSeed().

◆ SymCryptMlKemPolyElementSub()

VOID SYMCRYPT_CALL SymCryptMlKemPolyElementSub	(	_In_ PCSYMCRYPT_MLKEM_POLYELEMENT	peSrc1,
		_In_ PCSYMCRYPT_MLKEM_POLYELEMENT	peSrc2,
		_Out_ PSYMCRYPT_MLKEM_POLYELEMENT	peDst
	)

Definition at line 825 of file mlkem_primitives.c.

{
    UINT32 i;
    for( i=0; i<SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS; i++ )
    {
        peDst->coeffs[i] = (UINT16) SymCryptMlKemModSub( peSrc1->coeffs[i], peSrc2->coeffs[i] );
    }
}

Referenced by SymCryptMlKemDecapsulate(), and SymCryptMlKemVectorSub().

◆ SymCryptMlKemVectorAdd()

VOID SYMCRYPT_CALL SymCryptMlKemVectorAdd	(	_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc1,
		_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc2,
		_Out_ PSYMCRYPT_MLKEM_VECTOR	pvDst
	)

Definition at line 1276 of file mlkem_primitives.c.

{
    UINT32 i;
    const UINT32 nRows = pvSrc1->nRows;
    PCSYMCRYPT_MLKEM_POLYELEMENT peSrc1, peSrc2;
    PSYMCRYPT_MLKEM_POLYELEMENT  peDst;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
    SYMCRYPT_ASSERT( pvSrc2->nRows == nRows );
    SYMCRYPT_ASSERT( pvDst->nRows == nRows );
 
    for( i=0; i<nRows; i++ )
    {
        peSrc1 = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc1 );
        peSrc2 = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc2 );
        peDst  = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvDst );
        SymCryptMlKemPolyElementAdd( peSrc1, peSrc2, peDst );
    }
}

◆ SymCryptMlKemVectorCompressAndEncode()

VOID SYMCRYPT_CALL SymCryptMlKemVectorCompressAndEncode	(	_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc,
		UINT32	nBitsPerCoefficient,
		_Out_writes_bytes_(cbDst) PBYTE	pbDst,
		SIZE_T	cbDst
	)

Definition at line 1362 of file mlkem_primitives.c.

{
    UINT32 i;
    const UINT32 nRows = pvSrc->nRows;
    PCSYMCRYPT_MLKEM_POLYELEMENT peSrc;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
    SYMCRYPT_ASSERT( nBitsPerCoefficient >  0  );
    SYMCRYPT_ASSERT( nBitsPerCoefficient <= 12 );
    SYMCRYPT_ASSERT( cbDst == nRows*nBitsPerCoefficient*(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS / 8) );
 
    UNREFERENCED_PARAMETER( cbDst );
 
    for( i=0; i<nRows; i++ )
    {
        peSrc  = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc );
        SymCryptMlKemPolyElementCompressAndEncode( peSrc, nBitsPerCoefficient, pbDst );
        pbDst += nBitsPerCoefficient*(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS / 8);
    }
}

Referenced by SymCryptMlKemEncapsulateInternal(), SymCryptMlKemkeyExpandFromPrivateSeed(), and SymCryptMlKemkeyGetValue().

◆ SymCryptMlKemVectorCreate()

PSYMCRYPT_MLKEM_VECTOR SYMCRYPT_CALL SymCryptMlKemVectorCreate	(	_Out_writes_bytes_(cbBuffer) PBYTE	pbBuffer,
		UINT32	cbBuffer,
		UINT32	nRows
	)

Definition at line 156 of file mlkem_primitives.c.

{
    PSYMCRYPT_MLKEM_VECTOR pDst = NULL;
    PSYMCRYPT_MLKEM_VECTOR pVector = (PSYMCRYPT_MLKEM_VECTOR)pbBuffer;
    PSYMCRYPT_MLKEM_POLYELEMENT peTmp = NULL;
    UINT32 i;
    PBYTE pbTmp = pbBuffer + sizeof(SYMCRYPT_MLKEM_VECTOR);
 
    SYMCRYPT_ASSERT_ASYM_ALIGNED( pbBuffer );
 
    SYMCRYPT_ASSERT( nRows > 0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
 
    pVector->nRows = nRows;
    pVector->cbTotalSize = cbBuffer;
 
    for( i=0; i<nRows; i++ )
    {
        peTmp = SymCryptMlKemPolyElementCreate( pbTmp, SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT );
        if( peTmp == NULL )
        {
            goto cleanup;
        }
 
        pbTmp += SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT;
    }
 
    SYMCRYPT_ASSERT( pbTmp == (pbBuffer + cbBuffer) );
 
    pDst = pVector;
 
cleanup:
    return pDst;
}

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), SymCryptMlKemkeyExpandFromPrivateSeed(), and SymCryptMlKemkeyInitialize().

◆ SymCryptMlKemVectorDecodeAndDecompress()

SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptMlKemVectorDecodeAndDecompress	(	_In_reads_bytes_(cbSrc) PCBYTE	pbSrc,
		SIZE_T	cbSrc,
		UINT32	nBitsPerCoefficient,
		_Out_ PSYMCRYPT_MLKEM_VECTOR	pvDst
	)

Definition at line 1390 of file mlkem_primitives.c.

{
    SYMCRYPT_ERROR scError = SYMCRYPT_NO_ERROR;
    UINT32 i;
    const UINT32 nRows = pvDst->nRows;
    PSYMCRYPT_MLKEM_POLYELEMENT peDst;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
    SYMCRYPT_ASSERT( nBitsPerCoefficient >  0  );
    SYMCRYPT_ASSERT( nBitsPerCoefficient <= 12 );
    SYMCRYPT_ASSERT( cbSrc == nRows*nBitsPerCoefficient*(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS / 8) );
 
    UNREFERENCED_PARAMETER( cbSrc );
 
    for( i=0; i<nRows; i++ )
    {
        peDst  = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvDst );
        scError = SymCryptMlKemPolyElementDecodeAndDecompress( pbSrc, nBitsPerCoefficient, peDst );
        if( scError != SYMCRYPT_NO_ERROR )
        {
            goto cleanup;
        }
        pbSrc += nBitsPerCoefficient*(SYMCRYPT_MLWE_POLYNOMIAL_COEFFICIENTS / 8);
    }
 
cleanup:
    return scError;
}

Referenced by SymCryptMlKemDecapsulate(), and SymCryptMlKemkeySetValue().

◆ SymCryptMlKemVectorINTTAndMulR()

VOID SYMCRYPT_CALL SymCryptMlKemVectorINTTAndMulR ( _Inout_ PSYMCRYPT_MLKEM_VECTOR pvSrc )

Definition at line 1345 of file mlkem_primitives.c.

{
    UINT32 i;
    const UINT32 nRows = pvSrc->nRows;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
 
    for( i=0; i<nRows; i++ )
    {
        SymCryptMlKemPolyElementINTTAndMulR( SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc ) );
    }
}

Referenced by SymCryptMlKemEncapsulateInternal().

◆ SymCryptMlKemVectorMontDotProduct()

VOID SYMCRYPT_CALL SymCryptMlKemVectorMontDotProduct	(	_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc1,
		_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc2,
		_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT	peDst,
		_Inout_ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR	paTmp
	)

Definition at line 1211 of file mlkem_primitives.c.

{
    UINT32 i;
    const UINT32 nRows = pvSrc1->nRows;
    PCSYMCRYPT_MLKEM_POLYELEMENT peSrc1, peSrc2;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
    SYMCRYPT_ASSERT( pvSrc2->nRows == nRows );
 
    // Zero paTmp and peDst
    SymCryptWipeKnownSize( paTmp, SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT_ACCUMULATOR );
    SymCryptWipeKnownSize( peDst, SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT );
 
    for( i=0; i<nRows; i++ )
    {
        peSrc1 = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc1 );
        peSrc2 = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc2 );
        SymCryptMlKemPolyElementMulAndAccumulate( peSrc1, peSrc2, paTmp );
    }
 
    // write accumulator to dest and zero accumulator
    SymCryptMlKemMontgomeryReduceAndAddPolyElementAccumulatorToPolyElement( paTmp, peDst );
}

Referenced by SymCryptMlKemDecapsulate(), and SymCryptMlKemEncapsulateInternal().

◆ SymCryptMlKemVectorMulR()

VOID SYMCRYPT_CALL SymCryptMlKemVectorMulR	(	_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc,
		_Out_ PSYMCRYPT_MLKEM_VECTOR	pvDst
	)

Definition at line 1255 of file mlkem_primitives.c.

{
    UINT32 i;
    const UINT32 nRows = pvSrc->nRows;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
    SYMCRYPT_ASSERT( pvDst->nRows == nRows );
 
    for( i=0; i<nRows; i++ )
    {
        SymCryptMlKemPolyElementMulR(
            SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc ),
            SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvDst ) );
    }
}

Referenced by SymCryptMlKemkeyExpandFromPrivateSeed().

◆ SymCryptMlKemVectorNTT()

VOID SYMCRYPT_CALL SymCryptMlKemVectorNTT ( _Inout_ PSYMCRYPT_MLKEM_VECTOR pvSrc )

Definition at line 1328 of file mlkem_primitives.c.

{
    UINT32 i;
    const UINT32 nRows = pvSrc->nRows;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
 
    for( i=0; i<nRows; i++ )
    {
        SymCryptMlKemPolyElementNTT( SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc ) );
    }
}

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemkeyExpandFromPrivateSeed().

◆ SymCryptMlKemVectorSetZero()

VOID SYMCRYPT_CALL SymCryptMlKemVectorSetZero ( _Inout_ PSYMCRYPT_MLKEM_VECTOR pvSrc )

Definition at line 1242 of file mlkem_primitives.c.

{
    const UINT32 nRows = pvSrc->nRows;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
 
    SymCryptWipe( (PBYTE) SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( 0, pvSrc ), nRows*SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT );
}

Referenced by SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemkeyWipePrivateState().

◆ SymCryptMlKemVectorSub()

VOID SYMCRYPT_CALL SymCryptMlKemVectorSub	(	_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc1,
		_In_ PCSYMCRYPT_MLKEM_VECTOR	pvSrc2,
		_Out_ PSYMCRYPT_MLKEM_VECTOR	pvDst
	)

Definition at line 1302 of file mlkem_primitives.c.

{
    UINT32 i;
    const UINT32 nRows = pvSrc1->nRows;
    PCSYMCRYPT_MLKEM_POLYELEMENT peSrc1, peSrc2;
    PSYMCRYPT_MLKEM_POLYELEMENT  peDst;
 
    SYMCRYPT_ASSERT( nRows >  0 );
    SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLKEM_MATRIX_MAX_NROWS );
    SYMCRYPT_ASSERT( pvSrc2->nRows == nRows );
    SYMCRYPT_ASSERT( pvDst->nRows == nRows );
 
    for( i=0; i<nRows; i++ )
    {
        peSrc1 = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc1 );
        peSrc2 = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvSrc2 );
        peDst  = SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT( i, pvDst );
        SymCryptMlKemPolyElementSub( peSrc1, peSrc2, peDst );
    }
}

Variable Documentation

◆ abPolyElementAccumulatorBuffer

BYTE abPolyElementAccumulatorBuffer[SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT_ACCUMULATOR]

Definition at line 140 of file sc_lib_mlkem.h.

◆ abPolyElementBuffer0

BYTE abPolyElementBuffer0[SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT]

Definition at line 138 of file sc_lib_mlkem.h.

◆ abPolyElementBuffer1

BYTE abPolyElementBuffer1[SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT]

Definition at line 139 of file sc_lib_mlkem.h.

◆ abVectorBuffer1

BYTE abVectorBuffer1[SYMCRYPT_INTERNAL_MLKEM_MAXIMUM_VECTOR_SIZE]

Definition at line 137 of file sc_lib_mlkem.h.

◆ apPolyElements

PSYMCRYPT_MLKEM_POLYELEMENT apPolyElements[SYMCRYPT_MLKEM_MATRIX_MAX_NROWS *SYMCRYPT_MLKEM_MATRIX_MAX_NROWS]

Definition at line 46 of file sc_lib_mlkem.h.

◆ cbMatrix

UINT32 cbMatrix

Definition at line 67 of file sc_lib_mlkem.h.

Referenced by SymCryptMlDsakeyInitialize().

◆ cbPolyElement

UINT32 cbPolyElement

Definition at line 65 of file sc_lib_mlkem.h.

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemkeyExpandFromPrivateSeed().

◆ cbTotalSize

UINT32 cbTotalSize

Definition at line 33 of file sc_lib_mlkem.h.

◆ cbVector

UINT32 cbVector

Definition at line 66 of file sc_lib_mlkem.h.

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemkeyExpandFromPrivateSeed().

◆ encapsKeyHash

BYTE encapsKeyHash[32]

Definition at line 110 of file sc_lib_mlkem.h.

◆ encodedT

BYTE encodedT[SYMCRYPT_MLKEMKEY_MAX_SIZEOF_ENCODED_T]

Definition at line 108 of file sc_lib_mlkem.h.

◆

union { ... } hashState0

◆

union { ... } hashState1

◆ hasPrivateKey

BOOLEAN hasPrivateKey

Definition at line 93 of file sc_lib_mlkem.h.

◆ hasPrivateSeed

BOOLEAN hasPrivateSeed

Definition at line 92 of file sc_lib_mlkem.h.

◆ nBitsOfU

UINT8 nBitsOfU

Definition at line 75 of file sc_lib_mlkem.h.

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemkeyGenerate().

◆ nBitsOfV

UINT8 nBitsOfV

Definition at line 77 of file sc_lib_mlkem.h.

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemkeyGenerate().

◆ nEta1

UINT8 nEta1

Definition at line 71 of file sc_lib_mlkem.h.

Referenced by SymCryptMlKemEncapsulateInternal(), and SymCryptMlKemkeyExpandFromPrivateSeed().

◆ nEta2

UINT8 nEta2

Definition at line 73 of file sc_lib_mlkem.h.

Referenced by SymCryptMlKemEncapsulateInternal().

◆ nRows

UINT8 nRows

Definition at line 69 of file sc_lib_mlkem.h.

◆ params

SYMCRYPT_MLKEM_INTERNAL_PARAMS params

Definition at line 88 of file sc_lib_mlkem.h.

◆ pmAtranspose

PSYMCRYPT_MLKEM_MATRIX pmAtranspose

Definition at line 102 of file sc_lib_mlkem.h.

◆ privateRandom

BYTE privateRandom[32]

Definition at line 97 of file sc_lib_mlkem.h.

Referenced by SymCryptMlDsaSignEx().

◆ privateSeed

BYTE privateSeed[32]

Definition at line 96 of file sc_lib_mlkem.h.

◆ PSYMCRYPT_MLKEM_INTERNAL_PARAMS

* PSYMCRYPT_MLKEM_INTERNAL_PARAMS

Definition at line 79 of file sc_lib_mlkem.h.

◆ PSYMCRYPT_MLKEM_MATRIX

* PSYMCRYPT_MLKEM_MATRIX

Definition at line 53 of file sc_lib_mlkem.h.

Referenced by SymCryptMlKemMatrixCreate().

◆ PSYMCRYPT_MLKEM_VECTOR

* PSYMCRYPT_MLKEM_VECTOR

Definition at line 37 of file sc_lib_mlkem.h.

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateInternal(), SymCryptMlKemkeyExpandFromPrivateSeed(), and SymCryptMlKemVectorCreate().

◆ publicSeed

BYTE publicSeed[32]

Definition at line 99 of file sc_lib_mlkem.h.

◆ pvs

PSYMCRYPT_MLKEM_VECTOR pvs

Definition at line 105 of file sc_lib_mlkem.h.

Referenced by test_IProp().

◆ pvt

PSYMCRYPT_MLKEM_VECTOR pvt

Definition at line 103 of file sc_lib_mlkem.h.

Referenced by SafeArrayGetVartype().

◆ sha3_256State

SYMCRYPT_SHA3_256_STATE sha3_256State

Definition at line 144 of file sc_lib_mlkem.h.

◆ sha3_512State

SYMCRYPT_SHA3_512_STATE sha3_512State

Definition at line 145 of file sc_lib_mlkem.h.

◆ shake128State

SYMCRYPT_SHAKE128_STATE shake128State

Definition at line 142 of file sc_lib_mlkem.h.

◆ shake256State

SYMCRYPT_SHAKE256_STATE shake256State

Definition at line 143 of file sc_lib_mlkem.h.

◆ SYMCRYPT_MLKEM_INTERNAL_COMPUTATION_TEMPORARIES

SYMCRYPT_MLKEM_INTERNAL_COMPUTATION_TEMPORARIES

Definition at line 153 of file sc_lib_mlkem.h.

Referenced by SymCryptMlKemDecapsulate(), SymCryptMlKemEncapsulateEx(), and SymCryptMlKemkeySetValue().

◆ SYMCRYPT_MLKEM_INTERNAL_PARAMS

SYMCRYPT_MLKEM_INTERNAL_PARAMS

Definition at line 79 of file sc_lib_mlkem.h.

Referenced by SymCryptMlKemkeyAllocate(), SymCryptMlKemSizeofCiphertextFromParams(), and SymCryptMlKemSizeofKeyFormatFromParams().

◆ SYMCRYPT_MLKEM_MATRIX

SYMCRYPT_MLKEM_MATRIX

Definition at line 53 of file sc_lib_mlkem.h.

Referenced by SymCryptMlKemMatrixCreate().

◆ SYMCRYPT_MLKEM_POLYELEMENT

SYMCRYPT_MLKEM_POLYELEMENT

Definition at line 17 of file sc_lib_mlkem.h.

◆ SYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR

SYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR

Definition at line 24 of file sc_lib_mlkem.h.

◆ SYMCRYPT_MLKEM_VECTOR

SYMCRYPT_MLKEM_VECTOR

Definition at line 37 of file sc_lib_mlkem.h.

Referenced by SymCryptMlKemVectorCreate().

◆ SYMCRYPT_MLKEMKEY

SYMCRYPT_MAGIC_FIELD SYMCRYPT_MLKEMKEY

Definition at line 117 of file sc_lib_mlkem.h.

Macros

Typedefs

Functions

Variables

Macro Definition Documentation

◆ SYMCRYPT_INTERNAL_MLKEM_MAXIMUM_VECTOR_SIZE

◆ SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT

◆ SYMCRYPT_INTERNAL_MLKEM_SIZEOF_POLYRINGELEMENT_ACCUMULATOR

◆ SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT

◆ SYMCRYPT_INTERNAL_MLKEM_VECTOR_ELEMENT_OFFSET

◆ SYMCRYPT_MLKEM_MATRIX_MAX_NROWS

◆ SYMCRYPT_MLKEM_Q

◆ SYMCRYPT_MLKEM_SIZEOF_AGREED_SECRET

◆ SYMCRYPT_MLKEM_SIZEOF_ENCAPS_RANDOM

◆ SYMCRYPT_MLKEM_SIZEOF_MAX_CIPHERTEXT

◆ SYMCRYPT_MLKEMKEY_MAX_SIZEOF_ENCODED_T

Typedef Documentation

◆ _SYMCRYPT_MLKEM_INTERNAL_COMPUTATION_TEMPORARIES

◆ _SYMCRYPT_MLKEM_INTERNAL_PARAMS

◆ _SYMCRYPT_MLKEM_MATRIX

◆ _SYMCRYPT_MLKEM_POLYELEMENT

◆ _SYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR

◆ _SYMCRYPT_MLKEM_VECTOR

◆ _SYMCRYPT_MLKEMKEY

◆ PCSYMCRYPT_MLKEM_INTERNAL_PARAMS

◆ PCSYMCRYPT_MLKEM_MATRIX

◆ PCSYMCRYPT_MLKEM_POLYELEMENT

◆ PCSYMCRYPT_MLKEM_VECTOR

◆ PSYMCRYPT_MLKEM_INTERNAL_COMPUTATION_TEMPORARIES

◆ PSYMCRYPT_MLKEM_POLYELEMENT

◆ PSYMCRYPT_MLKEM_POLYELEMENT_ACCUMULATOR

Function Documentation

◆ SymCryptMlKemEncapsulateInternal()

◆ SymCryptMlKemkeyWipePrivateState()

◆ SymCryptMlKemMatrixCreate()

◆ SymCryptMlKemMatrixTranspose()

◆ SymCryptMlKemMatrixVectorMontMulAndAdd()

◆ SymCryptMlKemMontgomeryReduceAndAddPolyElementAccumulatorToPolyElement()

◆ SymCryptMlKemPolyElementAccumulatorCreate()

◆ SymCryptMlKemPolyElementAdd()

◆ SymCryptMlKemPolyElementCompressAndEncode()

◆ SymCryptMlKemPolyElementCreate()

◆ SymCryptMlKemPolyElementDecodeAndDecompress()

◆ SymCryptMlKemPolyElementINTTAndMulR()

◆ SymCryptMlKemPolyElementMulAndAccumulate()

◆ SymCryptMlKemPolyElementMulR()

◆ SymCryptMlKemPolyElementNTT()

◆ SymCryptMlKemPolyElementSampleCBDFromBytes()

◆ SymCryptMlKemPolyElementSampleNTTFromShake128()

◆ SymCryptMlKemPolyElementSub()

◆ SymCryptMlKemVectorAdd()

◆ SymCryptMlKemVectorCompressAndEncode()

◆ SymCryptMlKemVectorCreate()

◆ SymCryptMlKemVectorDecodeAndDecompress()

◆ SymCryptMlKemVectorINTTAndMulR()

◆ SymCryptMlKemVectorMontDotProduct()

◆ SymCryptMlKemVectorMulR()

◆ SymCryptMlKemVectorNTT()

◆ SymCryptMlKemVectorSetZero()

◆ SymCryptMlKemVectorSub()

Variable Documentation

◆ abPolyElementAccumulatorBuffer

◆ abPolyElementBuffer0

◆ abPolyElementBuffer1

◆ abVectorBuffer1

◆ apPolyElements

◆ cbMatrix

◆ cbPolyElement

◆ cbTotalSize

◆ cbVector

◆ encapsKeyHash

◆ encodedT

◆

◆

◆ hasPrivateKey

◆ hasPrivateSeed

◆ nBitsOfU

◆ nBitsOfV

◆ nEta1

◆ nEta2