From d575e505a391ffdee523b5fe2d9b600a0cfa3cb8 Mon Sep 17 00:00:00 2001 From: Vincent Laporte Date: Thu, 1 Oct 2026 14:51:45 +0200 Subject: [PATCH] Remove Dilithium draft See https://github.com/formosa-crypto/formosa-mldsa --- .../dilithium/common/amd64/avx2/expandA.jinc | 217 --- .../common/amd64/avx2/expandA_end.jinc | 123 -- .../common/amd64/avx2/expandMask.jinc | 275 ---- .../common/amd64/avx2/expandMask_end.jinc | 40 - .../common/amd64/avx2/keccak1600.jinc | 274 ---- .../common/amd64/avx2/keccakf1600.jinc | 202 --- .../dilithium/common/amd64/avx2/ntt.jinc | 733 ----------- .../dilithium/common/amd64/avx2/poly.jinc | 214 --- .../dilithium/common/amd64/avx2/poly_end.jinc | 47 - .../common/amd64/avx2/polyvec_end.jinc | 462 ------- .../dilithium/common/amd64/avx2/sign_end.jinc | 238 ---- .../dilithium/common/amd64/expandA_end.jinc | 86 -- .../dilithium/common/amd64/expandMask.jinc | 107 -- .../common/amd64/expandMask_end.jinc | 20 - .../dilithium/common/amd64/expandS.jinc | 144 -- .../dilithium/common/amd64/expandS_end.jinc | 28 - .../dilithium/common/amd64/fips202.jinc | 229 ---- .../dilithium/common/amd64/hashing_end.jinc | 249 ---- .../dilithium/common/amd64/keygen_end.jinc | 142 -- .../dilithium/common/amd64/montgomery.jinc | 84 -- .../dilithium/common/amd64/ntt.jinc | 190 --- .../dilithium/common/amd64/packing.jinc | 1168 ----------------- .../dilithium/common/amd64/packing_end.jinc | 116 -- .../dilithium/common/amd64/params.jinc | 28 - .../dilithium/common/amd64/params_end.jinc | 19 - .../dilithium/common/amd64/poly.jinc | 147 --- .../dilithium/common/amd64/poly_end.jinc | 47 - .../dilithium/common/amd64/polyvec_end.jinc | 463 ------- .../dilithium/common/amd64/rounding.jinc | 147 --- .../dilithium/common/amd64/rounding_end.jinc | 17 - .../dilithium/common/amd64/sign.jinc | 98 -- .../dilithium/common/amd64/sign_end.jinc | 235 ---- .../common/amd64/twiddle_factors.jinc | 19 - .../dilithium/common/amd64/verify_end.jinc | 260 ---- .../crypto_sign/dilithium/dilithium2/META.yml | 20 - .../dilithium/dilithium2/amd64/avx2/Makefile | 2 - .../dilithium2/amd64/avx2/common.jinc | 54 - .../dilithium2/amd64/avx2/include/api.h | 37 - .../dilithium2/amd64/avx2/packing.jinc | 67 - .../dilithium2/amd64/avx2/params.jinc | 19 - .../dilithium/dilithium2/amd64/avx2/sign.jazz | 52 - .../dilithium/dilithium2/amd64/ref/Makefile | 2 - .../dilithium2/amd64/ref/common.jinc | 47 - .../dilithium2/amd64/ref/include/api.h | 37 - .../dilithium2/amd64/ref/packing.jinc | 67 - .../dilithium2/amd64/ref/params.jinc | 19 - .../dilithium/dilithium2/amd64/ref/sign.jazz | 50 - .../crypto_sign/dilithium/dilithium3/META.yml | 20 - .../dilithium/dilithium3/amd64/avx2/Makefile | 2 - .../dilithium3/amd64/avx2/common.jinc | 54 - .../dilithium3/amd64/avx2/include/api.h | 37 - .../dilithium3/amd64/avx2/packing.jinc | 68 - .../dilithium3/amd64/avx2/params.jinc | 19 - .../dilithium/dilithium3/amd64/avx2/sign.jazz | 52 - .../dilithium/dilithium3/amd64/ref/Makefile | 2 - .../dilithium3/amd64/ref/common.jinc | 47 - .../dilithium3/amd64/ref/include/api.h | 37 - .../dilithium3/amd64/ref/packing.jinc | 68 - .../dilithium3/amd64/ref/params.jinc | 19 - .../dilithium/dilithium3/amd64/ref/sign.jazz | 50 - .../crypto_sign/dilithium/dilithium5/META.yml | 20 - .../dilithium/dilithium5/amd64/avx2/Makefile | 2 - .../dilithium5/amd64/avx2/common.jinc | 54 - .../dilithium5/amd64/avx2/include/api.h | 37 - .../dilithium5/amd64/avx2/packing.jinc | 67 - .../dilithium5/amd64/avx2/params.jinc | 19 - .../dilithium/dilithium5/amd64/avx2/sign.jazz | 52 - .../dilithium/dilithium5/amd64/ref/Makefile | 2 - .../dilithium5/amd64/ref/common.jinc | 47 - .../dilithium5/amd64/ref/include/api.h | 37 - .../dilithium5/amd64/ref/packing.jinc | 67 - .../dilithium5/amd64/ref/params.jinc | 19 - .../dilithium/dilithium5/amd64/ref/sign.jazz | 50 - 73 files changed, 8289 deletions(-) delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/expandA.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/expandA_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/expandMask.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/expandMask_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/keccak1600.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/keccakf1600.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/ntt.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/poly.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/poly_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/polyvec_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/sign_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandA_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandMask.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandMask_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandS.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandS_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/fips202.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/hashing_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/keygen_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/montgomery.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/ntt.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/packing.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/packing_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/params.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/params_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/poly.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/poly_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/polyvec_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/rounding.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/rounding_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/sign.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/sign_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/twiddle_factors.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/common/amd64/verify_end.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium2/META.yml delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/Makefile delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/common.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/include/api.h delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/packing.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/params.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/sign.jazz delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/Makefile delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/common.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/include/api.h delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/packing.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/params.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/sign.jazz delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium3/META.yml delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/Makefile delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/common.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/include/api.h delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/packing.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/params.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/sign.jazz delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/Makefile delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/common.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/include/api.h delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/packing.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/params.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/sign.jazz delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium5/META.yml delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/Makefile delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/common.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/include/api.h delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/packing.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/params.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/sign.jazz delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/Makefile delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/common.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/include/api.h delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/packing.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/params.jinc delete mode 100644 oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/sign.jazz diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/expandA.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/expandA.jinc deleted file mode 100644 index 01f63032..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/expandA.jinc +++ /dev/null @@ -1,217 +0,0 @@ -from Jade require "common/keccak/keccak1600/amd64/avx2/keccakf1600_4x.jinc" - -// SHAKE128 rate is 168 bytes -// Then the pad byte is at the 8th byte of the 5th u256 block -u256 SHAKE128_END_OF_ABSORB = (4u64)[0x8000000000000000, 0x0, 0x0, 0x0]; -u256 POLYDEG_4X = (4u64)[Li2_polydeg, Li2_polydeg, Li2_polydeg, Li2_polydeg]; - -inline -fn expandA_xof_buf_addr(reg u64 addr, reg u64 lane) -> reg u64 -{ - reg u64 v64; - - v64 = addr; - addr &= 0x7; - v64 &= 0xFFFFFFFFFFFFFFF8; - lane <<= 3; - addr |= lane; - v64 <<= 2; - addr |= v64; - return addr; -} - -inline -fn expandA_poly_extract(reg ptr u32[Li2_polydeg] poly, - stack u64 coeffs_filled, - stack u256[25] xof, - reg u64 xof_offset, - reg u64 lane) - -> reg ptr u32[Li2_polydeg], - stack u64, - stack u256[25], - reg u64 -{ - // Assume the XOF buffer is full. - // - // Extract until: - // * The poly buffer is full, or - // * The XOF buffer is empty. - // - // Note: This function relies on the fact that the amount of bytes - // needed to sample a coefficient mod q (3 bytes) aligns with the - // SHAKE128 rate (168 bytes). That is why we don't have to stash - // any bytes in some scratch space between calls. - // - // TODO: Make an attempt to un-inline this function - // - reg u32[3] vs; - reg u8 yield; - reg u64 addr; - reg u32 coeff; - - reg u64 v64_1 v64_2; - - inline int ii; - - ?{}, yield = #set0_8(); - while (yield == 0) { - for ii = 0 to 3 { - v64_1 = xof_offset; - v64_2 = lane; - addr = expandA_xof_buf_addr(v64_1, v64_2); - vs[ii] = (32u) xof[:u8 addr]; - xof_offset += 1; - } - - // There are now 3 bytes in vs[ii] ready for rejection sample - coeff = vs[0]; - vs[1] <<= 8; - coeff |= vs[1]; - vs[2] <<= 16; - coeff |= vs[2]; - - // Rejection-sample - coeff &= 0x7FFFFF; - if coeff < Li2_q { - addr = coeffs_filled; - poly[addr] = coeff; - coeffs_filled += 1; - if coeffs_filled >= Li2_polydeg { - yield = 1; - } - } - - if xof_offset >= SHAKE128_RATE { - // We have run out of random bytes. - // Yield back to the caller. - yield = 1; - } - } - - return poly, coeffs_filled, xof, xof_offset; -} - -inline -fn expandA_chunk( - reg ptr u8[32] rho, - stack u64[4] nonces, - reg ptr u32[Li2_polydeg] poly0, - reg ptr u32[Li2_polydeg] poly1, - reg ptr u32[Li2_polydeg] poly2, - reg ptr u32[Li2_polydeg] poly3) - -> - reg ptr u32[Li2_polydeg], - reg ptr u32[Li2_polydeg], - reg ptr u32[Li2_polydeg], - reg ptr u32[Li2_polydeg] -{ - stack u256[25] xof; - - stack u64[4] coeffs_filled; - stack u64[4] xof_offset; - - reg u256 v256 v256_zero; - reg u64 v64; - - reg u8 done; - reg bool zf; - - inline int ii lane; - - // Initialize the XOF state - for ii = 0 to 4 { - v64 = rho.[:u64 8 * ii]; - v256 = (256u) v64; - v256 = #VPBROADCAST_4u64(v256); - xof[ii] = v256; - } - for lane = 0 to 4 { - v64 = nonces[lane]; - v64 = #LEA_64(0x1F0000 + v64); - xof[:u64 16 + (int) lane] = v64; - } - ?{}, v256_zero = #set0_256(); - for ii = 5 to 20 { - xof[ii] = v256_zero; - } - v64 = 0x8000000000000000; - v256 = (256u) v64; - v256 = #VPBROADCAST_4u64(v256); - xof[20] = v256; - for ii = 21 to 25 { - xof[ii] = v256_zero; - } - - ?{}, done = #set0_8(); - coeffs_filled[0] = 0; - coeffs_filled[1] = 0; - coeffs_filled[2] = 0; - coeffs_filled[3] = 0; - while { - v64 = coeffs_filled[lane]; - } (done != 0x0F) { - xof = _keccakf1600_4x_avx2(xof); - for lane = 0 to 4 { - xof_offset[lane] = 0; - } - - lane = 0; - _, _, _, _, zf = #TEST_8(done, 1 << lane); - if zf { - poly0, coeffs_filled[lane], xof, xof_offset[lane] = - expandA_poly_extract( - poly0, - coeffs_filled[lane], - xof, xof_offset[lane], - lane); - if (coeffs_filled[lane] >= Li2_polydeg) { - // TODO: opt: use setcc + shift to elim branch - done |= 1 << lane; - } - } - - lane = 1; - _, _, _, _, zf = #TEST_8(done, 1 << lane); - if zf { - poly1, coeffs_filled[lane], xof, xof_offset[lane] = - expandA_poly_extract( - poly1, - coeffs_filled[lane], - xof, xof_offset[lane], - lane); - if (coeffs_filled[lane] >= Li2_polydeg) { - done |= 1 << lane; - } - } - - lane = 2; - _, _, _, _, zf = #TEST_8(done, 1 << lane); - if zf { - poly2, coeffs_filled[lane], xof, xof_offset[lane] = - expandA_poly_extract( - poly2, - coeffs_filled[lane], - xof, xof_offset[lane], - lane); - if (coeffs_filled[lane] >= Li2_polydeg) { - done |= 1 << lane; - } - } - - lane = 3; - _, _, _, _, zf = #TEST_8(done, 1 << lane); - if zf { - poly3, coeffs_filled[lane], xof, xof_offset[lane] = - expandA_poly_extract( - poly3, - coeffs_filled[lane], - xof, xof_offset[lane], - lane); - if (coeffs_filled[lane] >= Li2_polydeg) { - done |= 1 << lane; - } - } - } - - return poly0, poly1, poly2, poly3; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/expandA_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/expandA_end.jinc deleted file mode 100644 index ee91634d..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/expandA_end.jinc +++ /dev/null @@ -1,123 +0,0 @@ -require "expandA.jinc" - -inline -fn expandA_aligned(stack u8[32] rho) -> stack u32[Li2_k * Li2_l * Li2_polydeg] -{ - reg ptr u8[32] rho_rsp; - reg ptr u32[Li2_polydeg] poly0 poly1 poly2 poly3 poly_tmp; - stack u32[Li2_k * Li2_l * Li2_polydeg] matrix; - - stack u64[4] nonces; - - inline int row col chunk idx lane; - - for chunk = 0 to Li2_k * Li2_l / 4 { - idx = 4 * chunk; - - rho_rsp = rho; - poly0 = matrix[(idx + 0) * Li2_polydeg : Li2_polydeg]; - poly1 = matrix[(idx + 1) * Li2_polydeg : Li2_polydeg]; - poly2 = matrix[(idx + 2) * Li2_polydeg : Li2_polydeg]; - poly3 = matrix[(idx + 3) * Li2_polydeg : Li2_polydeg]; - for lane = 0 to 4 { - row = (idx + lane) / Li2_l; - col = (idx + lane) % Li2_l; - nonces[lane] = (row << 8) | col; - } - - poly0, poly1, poly2, poly3 = expandA_chunk( - rho_rsp, nonces, poly0, poly1, poly2, poly3); - - poly_tmp = poly0; - poly0 = ntt_transpose_avx2(poly_tmp); - poly_tmp = poly1; - poly1 = ntt_transpose_avx2(poly_tmp); - poly_tmp = poly2; - poly2 = ntt_transpose_avx2(poly_tmp); - poly_tmp = poly3; - poly3 = ntt_transpose_avx2(poly_tmp); - - matrix[(idx + 0) * Li2_polydeg : Li2_polydeg] = poly0; - matrix[(idx + 1) * Li2_polydeg : Li2_polydeg] = poly1; - matrix[(idx + 2) * Li2_polydeg : Li2_polydeg] = poly2; - matrix[(idx + 3) * Li2_polydeg : Li2_polydeg] = poly3; - } - - return matrix; -} - -inline -fn expandA_unaligned2(stack u8[32] rho) -> stack u32[Li2_k * Li2_l * Li2_polydeg] -{ - // In the case of Dilithium3, the number of matrix elements is not - // divisible by four. As such, blocks of 4 XOF lanes are not - // aligned, but offset with the number of matrix elements by 2. - // This function specializes for this case. - - reg ptr u8[32] rho_rsp; - reg ptr u32[Li2_polydeg] poly0 poly1 poly2 poly3 poly_tmp; - stack u32[Li2_k * Li2_l * Li2_polydeg] matrix; - stack u32[Li2_polydeg] scratch0 scratch1; - - stack u64[4] nonces; - - inline int row col chunk idx lane; - - for chunk = 0 to (Li2_k * Li2_l - 2) / 4 { - idx = 4 * chunk; - - rho_rsp = rho; - poly0 = matrix[(idx + 0) * Li2_polydeg : Li2_polydeg]; - poly1 = matrix[(idx + 1) * Li2_polydeg : Li2_polydeg]; - poly2 = matrix[(idx + 2) * Li2_polydeg : Li2_polydeg]; - poly3 = matrix[(idx + 3) * Li2_polydeg : Li2_polydeg]; - for lane = 0 to 4 { - row = (idx + lane) / Li2_l; - col = (idx + lane) % Li2_l; - nonces[lane] = (row << 8) | col; - } - - poly0, poly1, poly2, poly3 = expandA_chunk( - rho_rsp, nonces, poly0, poly1, poly2, poly3); - - poly_tmp = poly0; - poly0 = ntt_transpose_avx2(poly_tmp); - poly_tmp = poly1; - poly1 = ntt_transpose_avx2(poly_tmp); - poly_tmp = poly2; - poly2 = ntt_transpose_avx2(poly_tmp); - poly_tmp = poly3; - poly3 = ntt_transpose_avx2(poly_tmp); - - matrix[(idx + 0) * Li2_polydeg : Li2_polydeg] = poly0; - matrix[(idx + 1) * Li2_polydeg : Li2_polydeg] = poly1; - matrix[(idx + 2) * Li2_polydeg : Li2_polydeg] = poly2; - matrix[(idx + 3) * Li2_polydeg : Li2_polydeg] = poly3; - } - - // Fill last two elements - chunk = (Li2_k * Li2_l - 2) / 4; - idx = 4 * chunk; - - rho_rsp = rho; - poly0 = matrix[(idx + 0) * Li2_polydeg : Li2_polydeg]; - poly1 = matrix[(idx + 1) * Li2_polydeg : Li2_polydeg]; - for lane = 0 to 2 { - row = (idx + lane) / Li2_l; - col = (idx + lane) % Li2_l; - nonces[lane] = (row << 8) | col; - } - - poly0, poly1, scratch0, scratch1 = expandA_chunk( - rho_rsp, nonces, poly0, poly1, scratch0, scratch1); - - poly_tmp = poly0; - poly0 = ntt_transpose_avx2(poly_tmp); - poly_tmp = poly1; - poly1 = ntt_transpose_avx2(poly_tmp); - - matrix[(idx + 0) * Li2_polydeg : Li2_polydeg] = poly0; - matrix[(idx + 1) * Li2_polydeg : Li2_polydeg] = poly1; - - return matrix; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/expandMask.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/expandMask.jinc deleted file mode 100644 index 02131237..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/expandMask.jinc +++ /dev/null @@ -1,275 +0,0 @@ -require "../fips202.jinc" -require "../packing.jinc" -require "../params.jinc" -from Jade require "common/keccak/keccak1600/amd64/avx2/keccakf1600_4x.jinc" - -u256 CONST_0123 = (4u64) [3, 2, 1, 0]; - -param int y_packed_buflen_gamma1_217 = (Li2_pack_zlen_gamma1_217 / SHAKE256_RATE + 1) * SHAKE256_RATE; -param int y_packed_buflen_gamma1_219 = (Li2_pack_zlen_gamma1_219 / SHAKE256_RATE + 1) * SHAKE256_RATE; - -inline -fn expandMask_xof_addr(reg u64 addr, reg u64 lane) -> reg u64 -{ - reg u64 v64; - - v64 = addr; - addr &= 0x7; - v64 &= 0xFFFFFFFFFFFFFFF8; - lane <<= 3; - addr |= lane; - v64 <<= 2; - addr |= v64; - return addr; -} - -inline -fn expandMask_poly_shake_init(stack u64[25] state, reg ptr u8[64] rho_prime, stack u16 kappa) - -> stack u64[25] { - reg u64 i; - reg u8 c; - reg u16 v; - - state = st0(state); - i = 0; - while (i < 64) { - c = rho_prime[i]; - state[:u8 i] = c; - i += 1; - } - - v = kappa; - v &= 255; - c = (8u) v; - state[:u8 64] = c; - - v = kappa; - v >>= 8; - c = (8u) v; - state[:u8 65] = c; - state[:u8 66] ^= 0x1f; - state[:u8 SHAKE256_RATE - 1] ^= 0x80; - - return state; -} - -inline -fn expandMask_poly_xof_init(stack u256[25] xof, reg ptr u8[64] rho_prime, stack u64 kappa) - -> stack u256[25] { - - reg u256 v256 v256_zero; - reg u64 v64; - - inline int ii lane; - - ?{}, v256_zero = #set0_256(); - for ii = 0 to 25 { - xof[ii] = v256_zero; - } - for ii = 0 to 8 { - v64 = rho_prime.[:u64 8 * ii]; - v256 = (256u) v64; - v256 = #VPBROADCAST_4u64(v256); - xof[ii] = v256; - } - for lane = 0 to 4 { - v64 = kappa; - v64 = #LEA_64(0x1F0000 + v64); - v256 = (256u) v64; - v256 = #VPBROADCAST_4u64(v256); - v256 = #VPADD_4u64(v256, CONST_0123); - xof[8] = v256; - } - v64 = 0x8000000000000000; - v256 = (256u) v64; - v256 = #VPBROADCAST_4u64(v256); - xof[16] = v256; - - return xof; -} - -inline -fn expandMask_poly_gamma1_217_4x( - reg ptr u32[4 * Li2_polydeg] f_4x, - reg ptr u8[64] rho_prime, - stack u16 kappa) - -> reg ptr u32[4 * Li2_polydeg] -{ - // TODO: change kappa type to u64 - // TODO: un-inline this function - // TODO: Ethan wrote this function to always copy complete SHAKE256 - // blocks to the packed-y buffer. However, we do not have to copy - // the complete last block. Fix this. - reg ptr u32[Li2_polydeg] f; - stack u8[4 * y_packed_buflen_gamma1_217] y_packed; - stack u64 y_packed_filled; - stack u64 output_squeeze_counter; - stack u256[25] xof; - - reg u64 addr v64; - reg u64 i j; - reg u8 c; - - inline int total_blocks; - - - v64 = (64u) kappa; - xof = expandMask_poly_xof_init(xof, rho_prime, v64); - - y_packed_filled = 0; - output_squeeze_counter = 0; - total_blocks = Li2_pack_zlen_gamma1_217 / SHAKE256_RATE + 1; - while (output_squeeze_counter < total_blocks) { - xof = _keccakf1600_4x_avx2(xof); - - ?{}, i = #set0_64(); - while (i < SHAKE256_RATE) { - ?{}, j = #set0_64(); - while (j < 4) { - addr = i; - v64 = j; - addr = expandMask_xof_addr(addr, v64); - c = xof[:u8 addr]; - addr = y_packed_buflen_gamma1_217; - addr *= j; - addr += y_packed_filled; - addr += i; - y_packed[addr] = c; - j += 1; - } - i += 1; - } - y_packed_filled += SHAKE256_RATE; - output_squeeze_counter += 1; - } - - f = f_4x[0 * Li2_polydeg : Li2_polydeg]; - f = polyz_unpack_gamma1_217(f, y_packed[0 * y_packed_buflen_gamma1_217 : Li2_pack_zlen_gamma1_217]); - f_4x[0 * Li2_polydeg : Li2_polydeg] = f; - - f = f_4x[1 * Li2_polydeg : Li2_polydeg]; - f = polyz_unpack_gamma1_217(f, y_packed[1 * y_packed_buflen_gamma1_217 : Li2_pack_zlen_gamma1_217]); - f_4x[1 * Li2_polydeg : Li2_polydeg] = f; - - f = f_4x[2 * Li2_polydeg : Li2_polydeg]; - f = polyz_unpack_gamma1_217(f, y_packed[2 * y_packed_buflen_gamma1_217 : Li2_pack_zlen_gamma1_217]); - f_4x[2 * Li2_polydeg : Li2_polydeg] = f; - - f = f_4x[3 * Li2_polydeg : Li2_polydeg]; - f = polyz_unpack_gamma1_217(f, y_packed[3 * y_packed_buflen_gamma1_217 : Li2_pack_zlen_gamma1_217]); - f_4x[3 * Li2_polydeg : Li2_polydeg] = f; - - return f_4x; -} - - -inline -fn expandMask_poly_gamma1_219_4x( - reg ptr u32[4 * Li2_polydeg] f_4x, - reg ptr u8[64] rho_prime, - stack u16 kappa) - -> reg ptr u32[4 * Li2_polydeg] -{ - // TODO: change kappa type to u64 - // TODO: un-inline this function - // TODO: Ethan wrote this function to always copy complete SHAKE256 - // blocks to the packed-y buffer. However, we do not have to copy - // the complete last block. Fix this. - reg ptr u32[Li2_polydeg] f; - stack u8[4 * y_packed_buflen_gamma1_219] y_packed; - stack u64 y_packed_filled; - stack u64 output_squeeze_counter; - stack u256[25] xof; - - reg u64 addr v64; - reg u64 i j; - reg u8 c; - - inline int total_blocks; - - - v64 = (64u) kappa; - xof = expandMask_poly_xof_init(xof, rho_prime, v64); - - y_packed_filled = 0; - output_squeeze_counter = 0; - total_blocks = Li2_pack_zlen_gamma1_219 / SHAKE256_RATE + 1; - while (output_squeeze_counter < total_blocks) { - xof = _keccakf1600_4x_avx2(xof); - - ?{}, i = #set0_64(); - while (i < SHAKE256_RATE) { - ?{}, j = #set0_64(); - while (j < 4) { - addr = i; - v64 = j; - addr = expandMask_xof_addr(addr, v64); - c = xof[:u8 addr]; - addr = y_packed_buflen_gamma1_219; - addr *= j; - addr += y_packed_filled; - addr += i; - y_packed[addr] = c; - j += 1; - } - i += 1; - } - y_packed_filled += SHAKE256_RATE; - output_squeeze_counter += 1; - } - - f = f_4x[0 * Li2_polydeg : Li2_polydeg]; - f = polyz_unpack_gamma1_219(f, y_packed[0 * y_packed_buflen_gamma1_219 : Li2_pack_zlen_gamma1_219]); - f_4x[0 * Li2_polydeg : Li2_polydeg] = f; - - f = f_4x[1 * Li2_polydeg : Li2_polydeg]; - f = polyz_unpack_gamma1_219(f, y_packed[1 * y_packed_buflen_gamma1_219 : Li2_pack_zlen_gamma1_219]); - f_4x[1 * Li2_polydeg : Li2_polydeg] = f; - - f = f_4x[2 * Li2_polydeg : Li2_polydeg]; - f = polyz_unpack_gamma1_219(f, y_packed[2 * y_packed_buflen_gamma1_219 : Li2_pack_zlen_gamma1_219]); - f_4x[2 * Li2_polydeg : Li2_polydeg] = f; - - f = f_4x[3 * Li2_polydeg : Li2_polydeg]; - f = polyz_unpack_gamma1_219(f, y_packed[3 * y_packed_buflen_gamma1_219 : Li2_pack_zlen_gamma1_219]); - f_4x[3 * Li2_polydeg : Li2_polydeg] = f; - - return f_4x; -} - -inline -fn expandMask_poly_gamma1_219(reg ptr u32[Li2_polydeg] f, reg ptr u8[64] rho_prime, stack u16 kappa) - -> reg ptr u32[Li2_polydeg] -{ - reg u64 i; - reg u8 c; - stack u64[25] state; - stack u8[(Li2_pack_zlen_gamma1_219 / SHAKE256_RATE) * SHAKE256_RATE + SHAKE256_RATE] y_packed; - stack u64 y_loc; - stack u64 output_squeeze_counter; - reg u64 addr; - - state = expandMask_poly_shake_init(state, rho_prime, kappa); - - y_loc = 0; - output_squeeze_counter = 0; - while(output_squeeze_counter < (Li2_pack_zlen_gamma1_219 / SHAKE256_RATE + 1)) { - state = __keccakf1600_ref(state); - - i = 0; - while(i < SHAKE256_RATE) { - addr = i; - c = state[:u8 addr]; - addr = y_loc; - y_packed[addr] = c; - y_loc += 1; - i += 1; - } - - output_squeeze_counter += 1; - } - - f = polyz_unpack_gamma1_219(f, y_packed[0 : Li2_pack_zlen_gamma1_219]); - - return f; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/expandMask_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/expandMask_end.jinc deleted file mode 100644 index b33e5e31..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/expandMask_end.jinc +++ /dev/null @@ -1,40 +0,0 @@ -inline -fn expandMask_buffered( - reg ptr u8[64] rho_prime, - reg u16 kappa, - reg ptr u32[4 * Li2_polydeg] buffer, - stack u64 buffer_offset) - -> stack u32[Li2_l * Li2_polydeg], reg ptr u32[4 * Li2_polydeg], stack u64 -{ - reg u64 polys_generated; - - stack u32[Li2_l * Li2_polydeg] y; - reg u64 i addr; - - reg u32 v32; - - ?{}, polys_generated = #set0_64(); - while (polys_generated < Li2_l) { - if buffer_offset >= 4 { - buffer = expandMask_poly_4x(buffer, rho_prime, kappa); - buffer_offset = 0; - } - - ?{}, i = #set0_64(); - while (i < Li2_polydeg) { - addr = buffer_offset; - addr <<= Li2_log2polydeg; - addr += i; - v32 = buffer[addr]; - addr = polys_generated; - addr <<= Li2_log2polydeg; - addr += i; - y[addr] = v32; - i += 1; - } - buffer_offset += 1; - kappa += 1; - polys_generated += 1; - } - return y, buffer, buffer_offset; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/keccak1600.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/keccak1600.jinc deleted file mode 100644 index 8fadac7e..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/keccak1600.jinc +++ /dev/null @@ -1,274 +0,0 @@ -param int KECCAK_ROUNDS=24; - -require "keccakf1600.jinc" - -inline fn __keccak_init_avx2() -> reg u256[7] -{ - inline int i; - reg u256[7] state; - - for i=0 to 7 - { state[i] = #set0_256(); } - - return state; -} - - -inline fn __init_s_state_avx2() -> stack u64[28] -{ - inline int i; - stack u64[28] s_state; - reg u256 zero; - - zero = #set0_256(); - for i=0 to 7 - { s_state[:u256 i] = zero; } - - return s_state; -} - - -inline fn __add_full_block_avx2( - reg u256[7] state, - stack u64[28] s_state, - reg ptr u64[25] a_jagged_p, - reg u64 in inlen, - reg u64 rate -) -> reg u256[7], stack u64[28], reg u64, reg u64 -{ - - inline int i; - reg u64 j l t rate8; - reg u8 c; - - rate8 = rate; - rate8 >>= 3; - j = 0; - while ( j < rate8 ) - { - t = [in + 8*j]; - l = a_jagged_p[j]; - s_state[l] = t; - j += 1; - } - - //TODO: check & change to #VPBROADCAST_4u64 - t = s_state[0]; - s_state[1] = t; - s_state[2] = t; - s_state[3] = t; - - for i = 0 to 7 - { state[i] ^= s_state[:u256 i]; } - - in += rate; - inlen -= rate; - - return state, s_state, in, inlen; -} - - -// TODO: refactor when this feature is available: https://github.com/haslab/libjbn/wiki/Feature-request-%231#procedural-parameters -inline fn __add_final_block_avx2( - reg u256[7] state, - stack u64[28] s_state, - reg ptr u64[25] a_jagged_p, - reg u64 in inlen, - reg u8 trail_byte, - reg u64 rate -) -> reg u256[7] -{ - inline int i; - reg u64 j l t inlen8; - reg u8 c; - - s_state = __init_s_state_avx2(); - - inlen8 = inlen; - inlen8 >>= 3; - j = 0; - while ( j < inlen8 ) - { - t = [in + 8*j]; - l = a_jagged_p[j]; - s_state[l] = t; - j += 1; - } - l = a_jagged_p[j]; - l <<= 3; - j <<= 3; - - while ( j < inlen ) - { - c = [:u8 in + j]; - s_state[:u8 l] = c; - j += 1; - l += 1; - } - - s_state[:u8 l] = trail_byte; - - // j = (rate-1) >> 3; - j = rate; j -= 1; j >>= 3; - l = a_jagged_p[j]; - l <<= 3; - // l += ((rate-1) & 0x7) - j = rate; j -= 1; j &= 0x7; - l += j; - - s_state[:u8 l] ^= 0x80; - - t = s_state[0]; - s_state[1] = t; - s_state[2] = t; - s_state[3] = t; - - for i = 0 to 7 - { state[i] ^= s_state[:u256 i]; } - - return state; -} - - -// obs: @pre: len <= rate_in_bytes -inline fn __xtr_full_block_avx2( - reg u256[7] state, - reg ptr u64[25] a_jagged_p, - reg u64 out, - reg u64 len -) -> reg u64 -{ - inline int i; - stack u64[28] s_state; - reg u64 j l t len8; - reg u8 c; - - for i = 0 to 7 - { s_state[:u256 i] = state[i]; } - - len8 = len; - len8 >>= 3; - j = 0; - while ( j < len8 ) - { - l = a_jagged_p[j]; - t = s_state[l]; - [out + 8*j] = t; - j += 1; - } - - out += len; - - return out; -} - - -// obs: @pre: len <= rate_in_bytes -inline fn __xtr_bytes_avx2( - reg u256[7] state, - reg ptr u64[25] a_jagged_p, - reg u64 out, - reg u64 len -) -> reg u64 -{ - inline int i; - stack u64[28] s_state; - reg u64 j l t len8; - reg u8 c; - - for i = 0 to 7 - { s_state[:u256 i] = state[i]; } - - len8 = len; - len8 >>= 3; - j = 0; - while ( j < len8 ) - { l = a_jagged_p[j]; - t = s_state[l]; - [out + 8*j] = t; - j += 1; - } - l = a_jagged_p[j]; - j <<= 3; - l <<= 3; - - while ( j < len ) - { - c = s_state[:u8 l]; - [:u8 out + j] = c; - j += 1; - l += 1; - } - - out += len; - - return out; -} - - -inline fn __absorb_avx2( - reg u256[7] state, - reg u64 in inlen, - reg u8 trail_byte, - reg u64 rate -) -> reg u256[7] -{ - stack u64[28] s_state; - reg ptr u64[25] a_jagged_p; - - a_jagged_p = KECCAK_A_JAGGED; - s_state = __init_s_state_avx2(); - - // intermediate blocks - while ( inlen >= rate ) - { - state, s_state, in, inlen = __add_full_block_avx2(state, s_state, a_jagged_p, in, inlen, rate); - state = __keccakf1600_avx2(state); - } - - // final block - state = __add_final_block_avx2(state, s_state, a_jagged_p, in, inlen, trail_byte, rate); - - return state; -} - - -inline fn __squeeze_avx2(reg u256[7] state, reg u64 out outlen rate) -{ - reg ptr u64[25] a_jagged_p; - - a_jagged_p = KECCAK_A_JAGGED; - - // intermediate blocks - while ( outlen > rate ) - { - state = __keccakf1600_avx2(state); - out = __xtr_full_block_avx2(state, a_jagged_p, out, rate); - outlen -= rate; - } - - state = __keccakf1600_avx2(state); - out = __xtr_bytes_avx2(state, a_jagged_p, out, outlen); -} - - -inline fn __keccak1600_avx2(reg u64 out outlen in inlen, reg u8 trail_byte, reg u64 rate) -{ - reg u256[7] state; - - state = __keccak_init_avx2(); - - // absorb - state = __absorb_avx2(state, in, inlen, trail_byte, rate); - - // squeeze - __squeeze_avx2(state, out, outlen, rate); -} - - -fn _keccak1600_avx2(reg u64 out outlen in inlen, reg u8 trail_byte, reg u64 rate) -{ - __keccak1600_avx2(out, outlen, in, inlen, trail_byte, rate); -} - - diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/keccakf1600.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/keccakf1600.jinc deleted file mode 100644 index 2ebbd540..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/keccakf1600.jinc +++ /dev/null @@ -1,202 +0,0 @@ - -u256[24] KECCAK_IOTAS = -{ (4u64)[0x0000000000000001, 0x0000000000000001, 0x0000000000000001, 0x0000000000000001] - ,(4u64)[0x0000000000008082, 0x0000000000008082, 0x0000000000008082, 0x0000000000008082] - ,(4u64)[0x800000000000808a, 0x800000000000808a, 0x800000000000808a, 0x800000000000808a] - ,(4u64)[0x8000000080008000, 0x8000000080008000, 0x8000000080008000, 0x8000000080008000] - ,(4u64)[0x000000000000808b, 0x000000000000808b, 0x000000000000808b, 0x000000000000808b] - ,(4u64)[0x0000000080000001, 0x0000000080000001, 0x0000000080000001, 0x0000000080000001] - ,(4u64)[0x8000000080008081, 0x8000000080008081, 0x8000000080008081, 0x8000000080008081] - ,(4u64)[0x8000000000008009, 0x8000000000008009, 0x8000000000008009, 0x8000000000008009] - ,(4u64)[0x000000000000008a, 0x000000000000008a, 0x000000000000008a, 0x000000000000008a] - ,(4u64)[0x0000000000000088, 0x0000000000000088, 0x0000000000000088, 0x0000000000000088] - ,(4u64)[0x0000000080008009, 0x0000000080008009, 0x0000000080008009, 0x0000000080008009] - ,(4u64)[0x000000008000000a, 0x000000008000000a, 0x000000008000000a, 0x000000008000000a] - ,(4u64)[0x000000008000808b, 0x000000008000808b, 0x000000008000808b, 0x000000008000808b] - ,(4u64)[0x800000000000008b, 0x800000000000008b, 0x800000000000008b, 0x800000000000008b] - ,(4u64)[0x8000000000008089, 0x8000000000008089, 0x8000000000008089, 0x8000000000008089] - ,(4u64)[0x8000000000008003, 0x8000000000008003, 0x8000000000008003, 0x8000000000008003] - ,(4u64)[0x8000000000008002, 0x8000000000008002, 0x8000000000008002, 0x8000000000008002] - ,(4u64)[0x8000000000000080, 0x8000000000000080, 0x8000000000000080, 0x8000000000000080] - ,(4u64)[0x000000000000800a, 0x000000000000800a, 0x000000000000800a, 0x000000000000800a] - ,(4u64)[0x800000008000000a, 0x800000008000000a, 0x800000008000000a, 0x800000008000000a] - ,(4u64)[0x8000000080008081, 0x8000000080008081, 0x8000000080008081, 0x8000000080008081] - ,(4u64)[0x8000000000008080, 0x8000000000008080, 0x8000000000008080, 0x8000000000008080] - ,(4u64)[0x0000000080000001, 0x0000000080000001, 0x0000000080000001, 0x0000000080000001] - ,(4u64)[0x8000000080008008, 0x8000000080008008, 0x8000000080008008, 0x8000000080008008] -}; - - -u256[6] KECCAK_RHOTATES_LEFT = -{ - (4u64)[41, 36, 18, 3], - (4u64)[27, 28, 62, 1], - (4u64)[39, 56, 6, 45], - (4u64)[ 8, 55, 61, 10], - (4u64)[20, 25, 15, 2], - (4u64)[14, 21, 43, 44] -}; - - -u256[6] KECCAK_RHOTATES_RIGHT = -{ - (4u64)[64-41, 64-36, 64-18, 64- 3], - (4u64)[64-27, 64-28, 64-62, 64- 1], - (4u64)[64-39, 64-56, 64- 6, 64-45], - (4u64)[64- 8, 64-55, 64-61, 64-10], - (4u64)[64-20, 64-25, 64-15, 64- 2], - (4u64)[64-14, 64-21, 64-43, 64-44] -}; - - -u64[25] KECCAK_A_JAGGED = -{ - 0, 4, 5, 6, 7, - 10, 24, 13, 18, 23, - 8, 16, 25, 22, 15, - 11, 12, 21, 26, 19, - 9, 20, 17, 14, 27 -}; - - -inline fn __keccakf1600_avx2(reg u256[7] state) -> reg u256[7] -{ - reg u256[9] t; - reg u256 c00 c14 d00 d14; - - reg bool zf; - reg u64 r iotas_o; - - reg ptr u256[24] iotas_p; - reg ptr u256[6] rhotates_left_p; - reg ptr u256[6] rhotates_right_p; - - iotas_p = KECCAK_IOTAS; - iotas_o = 0; - rhotates_left_p = KECCAK_RHOTATES_LEFT; - rhotates_right_p = KECCAK_RHOTATES_RIGHT; - - r = KECCAK_ROUNDS; - while - { - //######################################## Theta - c00 = #VPSHUFD_256(state[2], (4u2)[1,0,3,2]); - c14 = state[5] ^ state[3]; - t[2] = state[4] ^ state[6]; - c14 = c14 ^ state[1]; - c14 = c14 ^ t[2]; - t[4] = #VPERMQ(c14, (4u2)[2,1,0,3]); - c00 = c00 ^ state[2]; - t[0] = #VPERMQ(c00, (4u2)[1,0,3,2]); - t[1] = c14 >>4u64 63; - t[2] = c14 +4u64 c14; - t[1] = t[1] | t[2]; - d14 = #VPERMQ(t[1], (4u2)[0,3,2,1]); - d00 = t[1] ^ t[4]; - d00 = #VPERMQ(d00, (4u2)[0,0,0,0]); - c00 = c00 ^ state[0]; - c00 = c00 ^ t[0]; - t[0] = c00 >>4u64 63; - t[1] = c00 +4u64 c00; - t[1] = t[1] | t[0]; - state[2] = state[2] ^ d00; - state[0] = state[0] ^ d00; - d14 = #VPBLEND_8u32(d14, t[1], (8u1)[1,1,0,0,0,0,0,0]); - t[4] = #VPBLEND_8u32(t[4], c00, (8u1)[0,0,0,0,0,0,1,1]); - d14 = d14 ^ t[4]; - - //######################################## Rho + Pi + pre-Chi shuffle - t[3] = #VPSLLV_4u64(state[2], rhotates_left_p[0] ); - state[2] = #VPSRLV_4u64(state[2], rhotates_right_p[0] ); - state[2] = state[2] | t[3]; - state[3] = state[3] ^ d14; - t[4] = #VPSLLV_4u64(state[3], rhotates_left_p[2] ); - state[3] = #VPSRLV_4u64(state[3], rhotates_right_p[2] ); - state[3] = state[3] | t[4]; - state[4] = state[4] ^ d14; - t[5] = #VPSLLV_4u64(state[4], rhotates_left_p[3] ); - state[4] = #VPSRLV_4u64(state[4], rhotates_right_p[3] ); - state[4] = state[4] | t[5]; - state[5] = state[5] ^ d14; - t[6] = #VPSLLV_4u64(state[5], rhotates_left_p[4] ); - state[5] = #VPSRLV_4u64(state[5], rhotates_right_p[4] ); - state[5] = state[5] | t[6]; - state[6] = state[6] ^ d14; - t[3] = #VPERMQ(state[2], (4u2)[2,0,3,1]); - t[4] = #VPERMQ(state[3], (4u2)[2,0,3,1]); - t[7] = #VPSLLV_4u64(state[6], rhotates_left_p[5] ); - t[1] = #VPSRLV_4u64(state[6], rhotates_right_p[5] ); - t[1] = t[1] | t[7]; - state[1] = state[1] ^ d14; - t[5] = #VPERMQ(state[4], (4u2)[0,1,2,3]); - t[6] = #VPERMQ(state[5], (4u2)[1,3,0,2]); - t[8] = #VPSLLV_4u64(state[1], rhotates_left_p[1] ); - t[2] = #VPSRLV_4u64(state[1], rhotates_right_p[1] ); - t[2] = t[2] | t[8]; - - //######################################## Chi - t[7] = #VPSRLDQ_256(t[1], 8); - t[0] = !t[1] & t[7]; - state[3] = #VPBLEND_8u32(t[2], t[6], (8u1)[0,0,0,0,1,1,0,0]); - t[8] = #VPBLEND_8u32(t[4], t[2], (8u1)[0,0,0,0,1,1,0,0]); - state[5] = #VPBLEND_8u32(t[3], t[4], (8u1)[0,0,0,0,1,1,0,0]); - t[7] = #VPBLEND_8u32(t[2], t[3], (8u1)[0,0,0,0,1,1,0,0]); - state[3] = #VPBLEND_8u32(state[3], t[4], (8u1)[0,0,1,1,0,0,0,0]); - t[8] = #VPBLEND_8u32(t[8], t[5], (8u1)[0,0,1,1,0,0,0,0]); - state[5] = #VPBLEND_8u32(state[5], t[2], (8u1)[0,0,1,1,0,0,0,0]); - t[7] = #VPBLEND_8u32(t[7], t[6], (8u1)[0,0,1,1,0,0,0,0]); - state[3] = #VPBLEND_8u32(state[3], t[5], (8u1)[1,1,0,0,0,0,0,0]); - t[8] = #VPBLEND_8u32(t[8], t[6], (8u1)[1,1,0,0,0,0,0,0]); - state[5] = #VPBLEND_8u32(state[5], t[6], (8u1)[1,1,0,0,0,0,0,0]); - t[7] = #VPBLEND_8u32(t[7], t[4], (8u1)[1,1,0,0,0,0,0,0]); - state[3] = !state[3] & t[8]; - state[5] = !state[5] & t[7]; - state[6] = #VPBLEND_8u32(t[5], t[2], (8u1)[0,0,0,0,1,1,0,0]); - t[8] = #VPBLEND_8u32(t[3], t[5], (8u1)[0,0,0,0,1,1,0,0]); - state[3] = state[3] ^ t[3]; - state[6] = #VPBLEND_8u32(state[6], t[3], (8u1)[0,0,1,1,0,0,0,0]); - t[8] = #VPBLEND_8u32(t[8], t[4], (8u1)[0,0,1,1,0,0,0,0]); - state[5] = state[5] ^ t[5]; - state[6] = #VPBLEND_8u32(state[6], t[4], (8u1)[1,1,0,0,0,0,0,0]); - t[8] = #VPBLEND_8u32(t[8], t[2], (8u1)[1,1,0,0,0,0,0,0]); - state[6] = !state[6] & t[8]; - state[6] = state[6] ^ t[6]; - state[4] = #VPERMQ(t[1], (4u2)[0,1,3,2]); - t[8] = #VPBLEND_8u32(state[4], state[0], (8u1)[0,0,1,1,0,0,0,0]); - state[1] = #VPERMQ(t[1], (4u2)[0,3,2,1]); - state[1] = #VPBLEND_8u32(state[1], state[0], (8u1)[1,1,0,0,0,0,0,0]); - state[1] = !state[1] & t[8]; - state[2] = #VPBLEND_8u32(t[4], t[5], (8u1)[0,0,0,0,1,1,0,0]); - t[7] = #VPBLEND_8u32(t[6], t[4], (8u1)[0,0,0,0,1,1,0,0]); - state[2] = #VPBLEND_8u32(state[2], t[6], (8u1)[0,0,1,1,0,0,0,0]); - t[7] = #VPBLEND_8u32(t[7], t[3], (8u1)[0,0,1,1,0,0,0,0]); - state[2] = #VPBLEND_8u32(state[2], t[3], (8u1)[1,1,0,0,0,0,0,0]); - t[7] = #VPBLEND_8u32(t[7], t[5], (8u1)[1,1,0,0,0,0,0,0]); - state[2] = !state[2] & t[7]; - state[2] = state[2] ^ t[2]; - t[0] = #VPERMQ(t[0], (4u2)[0,0,0,0]); - state[3] = #VPERMQ(state[3], (4u2)[0,1,2,3]); - state[5] = #VPERMQ(state[5], (4u2)[2,0,3,1]); - state[6] = #VPERMQ(state[6], (4u2)[1,3,0,2]); - state[4] = #VPBLEND_8u32(t[6], t[3], (8u1)[0,0,0,0,1,1,0,0]); - t[7] = #VPBLEND_8u32(t[5], t[6], (8u1)[0,0,0,0,1,1,0,0]); - state[4] = #VPBLEND_8u32(state[4], t[5], (8u1)[0,0,1,1,0,0,0,0]); - t[7] = #VPBLEND_8u32(t[7], t[2], (8u1)[0,0,1,1,0,0,0,0]); - state[4] = #VPBLEND_8u32(state[4], t[2], (8u1)[1,1,0,0,0,0,0,0]); - t[7] = #VPBLEND_8u32(t[7], t[3], (8u1)[1,1,0,0,0,0,0,0]); - state[4] = !state[4] & t[7]; - state[0] = state[0] ^ t[0]; - state[1] = state[1] ^ t[1]; - state[4] = state[4] ^ t[4]; - - //######################################## Iota - state[0] = state[0] ^ iotas_p.[iotas_o]; - iotas_o += 32; - - _,_,_,zf,r = #DEC_64(r); - }(!zf) - - return state; -} - - diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/ntt.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/ntt.jinc deleted file mode 100644 index 717d1249..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/ntt.jinc +++ /dev/null @@ -1,733 +0,0 @@ -// TODO: s/VMOVDQU_256/VMOVDQA_256/ when https://github.com/jasmin-lang/jasmin/pull/279 gets merged / released - -// This ntt code is based on the official avx2 NTT code from Gregor Seiler. -// https://github.com/pq-crystals/dilithium/blob/3e9b9f1412f6c7435dbeb4e10692ea58f181ee51/avx2/ntt.S - -require "../params.jinc" - -// TODO: Use slices instead of raw pointer for easier EC proving. -// TODO: Namespace these constants a little better s.t. they don't collide -// with local variables. -// TODO: Merge zetas_qinv and zetas for better sequential access - -u32 const_q = 0x007FE001; -u32 const_div256_qinv = 0xFF7FE3FA; -u32 const_div256 = 0x0000A3FA; - -u32[1] ntt_level0_zetas_qinv = {0x6D1F44F7}; -u32[1] ntt_level0_zetas = {0x000064F7}; - -u32[1] invntt_level0_zetas_qinv = {0xF6FF35DF}; -u32[1] invntt_level0_zetas = {0xFFC355DF}; - -u32[2] level1_zetas_qinv = {0x8CF87102, 0x8D187503}; -u32[2] level1_zetas = {0xFFD83102, 0xFFF81503}; - -u32[4] level2_zetas_qinv = {0x61CC1E44, 0x58172118, 0x6017A128, 0x61CB9E24}; -u32[4] level2_zetas = {0x00039E44, 0xFFF42118, 0xFFF2A128, 0x00071E24}; - -u256[36] level3t7_zetas_qinv = { - // Level 3 - (8u32) [0x93C9492B, 0x93C9492B, 0x93C9492B, 0x93C9492B, 0x12613E2B, 0x12613E2B, 0x12613E2B, 0x12613E2B], - (8u32) [0xBEEFF47F, 0xBEEFF47F, 0xBEEFF47F, 0xBEEFF47F, 0xAE1024AD, 0xAE1024AD, 0xAE1024AD, 0xAE1024AD], - (8u32) [0x1EB51B09, 0x1EB51B09, 0x1EB51B09, 0x1EB51B09, 0x8CFE3A75, 0x8CFE3A75, 0x8CFE3A75, 0x8CFE3A75], - (8u32) [0x254DC527, 0x254DC527, 0x254DC527, 0x254DC527, 0xEEF89A49, 0xEEF89A49, 0xEEF89A49, 0xEEF89A49], - // Level 4 - (8u32) [0x3327B788, 0x3327B788, 0xAEA405A4, 0xAEA405A4, 0x7C1DA070, 0x7C1DA070, 0x66F49658, 0x66F49658], - (8u32) [0x28CF337B, 0x28CF337B, 0xEB54F968, 0xEB54F968, 0x0D42EAA0, 0x0D42EAA0, 0x6BA99D90, 0x6BA99D90], - (8u32) [0xD360FC98, 0xD360FC98, 0xB50984F7, 0xB50984F7, 0xCBA1FAE7, 0xCBA1FAE7, 0x629A6DD6, 0x629A6DD6], - (8u32) [0xBA3CE5C5, 0xBA3CE5C5, 0xA9FD5201, 0xA9FD5201, 0x6D83F422, 0x6D83F422, 0x13A17035, 0x13A17035], - // Level 5 - (8u32) [0xDC919EAF, 0x8ED3C7D4, 0xBFCEB02C, 0x5F070503, 0x6D8E7EC5, 0xAC4894CD, 0x9EC57620, 0x91F62A67], - (8u32) [0xBE23655D, 0x9CF7569C, 0x7AC50A4D, 0xC0B60400, 0x6B1C5E41, 0xDE894A96, 0xE3A10E7C, 0xF3F5B585], - (8u32) [0x78A9F38C, 0x3473145C, 0x3B223617, 0x8D3D643F, 0x6D30CF59, 0x18F93E1E, 0xCA41AAD6, 0x97ADB23D], - (8u32) [0xC73AEF2D, 0x99CA1D54, 0xC75EFC30, 0xA6E20534, 0x89C59853, 0xEEFD4F76, 0x9E7B5B9A, 0x588163A8], - // Level 6 - (8u32) [0x21E490E0, 0xAA1F5280, 0xC4CFF072, 0xB35B6F75, 0x5F5A15C7, 0x8035765D, 0x5081C1CF, 0xA220A6E5], - (8u32) [0x6348A563, 0xCAF5CBDD, 0xC347063B, 0x7F460282, 0xB4C75A6D, 0x114717A3, 0xDCE7C638, 0xD15250F2], - (8u32) [0xA69FB8A1, 0x88D1F56C, 0xA3423948, 0x28406BCA, 0x27B64D44, 0x95A0AD00, 0x490AA417, 0x4ECA1BE9], - (8u32) [0x44538057, 0x74A62EA2, 0xE11C1944, 0xF5583E25, 0x13F4B305, 0x69ED9C93, 0xAE0876C2, 0xD690646C], - (8u32) [0x80FB2FCA, 0x5B2592AE, 0x748F7CF6, 0xC20BD772, 0x085F2FBB, 0x6272C9EE, 0x8A54B819, 0xD8F8CC81], - (8u32) [0x9C766C62, 0xF8CF15D4, 0x61AAE9F7, 0x6A8FA113, 0x65DB5409, 0xFAD1044B, 0x5A7D4E9F, 0xF1419E85], - (8u32) [0x98ECE808, 0x2578A7DF, 0xED0669C0, 0xB4CF9E7E, 0x4827A75A, 0x7FC6F6BE, 0x44E04588, 0xC9620AF0], - (8u32) [0xCAB5B7D9, 0x3AB8479C, 0x47EA4802, 0x0A03D0E0, 0x0E06B792, 0xB9594AE0, 0x54E27FF6, 0x54CAC808], - // Level 7 - (8u32) [0x6C79597D, 0x337A2021, 0x3C77EF83, 0x00D97E5E, 0x78DE48A0, 0xDBE2B2F5, 0xAEBB3F72, 0xFFF24A93], - (8u32) [0xC1B59DE4, 0x0E0368BE, 0x29637089, 0xA4698518, 0x9E61611C, 0x8D87FEE5, 0xB71152E7, 0x7EA85919], - (8u32) [0xCD20FCA5, 0x86672CBE, 0x4FD0DD98, 0x5CAC4658, 0xF07BF11B, 0x2D1E3934, 0xEE178405, 0x3196D953], - (8u32) [0xC5F555CA, 0x09418A50, 0x5C152C93, 0x42BFA764, 0xE5B98E98, 0xA1221D45, 0x9940A4F7, 0x85F9213C], - (8u32) [0xEC92BCD6, 0x682F1AF6, 0xCF38A28A, 0xE6DF9E1A, 0x462622FC, 0xFD560587, 0x36619DFB, 0x3B1F3F5A], - (8u32) [0x396CE6C7, 0x3AB6411B, 0xED44653F, 0xFBAAD4BE, 0xAF438984, 0xB9DC3199, 0x6E54603B, 0x3625E10C], - (8u32) [0xC20C779A, 0xB185FC1C, 0x81466898, 0x0A567D8B, 0x24496C12, 0xC3164A0C, 0x2408BBE7, 0xBFB06099], - (8u32) [0x17E25E68, 0x94214F2C, 0x3471B805, 0xA093C1AF, 0x97358633, 0x21B44CD0, 0xF96F9BF4, 0x005CE539], - (8u32) [0x07A68592, 0xAE2F8084, 0x78DFD704, 0xE12AA0E6, 0x64587B56, 0xEC8B24F0, 0x01CE8B9F, 0x513DD8D4], - (8u32) [0x1902D283, 0x84951E3E, 0x28066B4B, 0x02BA5891, 0xD9B01051, 0xDA1FBA3A, 0x08335CC7, 0xBD02ED41], - (8u32) [0xDC748167, 0x3159AA08, 0xE91A34BB, 0xAF1C53B7, 0x162410D8, 0xB3E57FF8, 0xEFDF1DE8, 0x48882578], - (8u32) [0xDFC9D6B6, 0x7969034E, 0xA69DDC2A, 0xB7F533DD, 0xFBB745DA, 0xF07A3CAE, 0xEF5715E7, 0x29DDA115], - (8u32) [0x4B0161C2, 0x7321AF86, 0x72D786FC, 0x4AF7BF5A, 0x718B05DE, 0x79213B5D, 0xAB4DE422, 0x2C7941F8], - (8u32) [0x428FCD6E, 0x6A100D2F, 0x43C4B6A6, 0xB33BDB90, 0x00611A46, 0x75416D71, 0x61279924, 0x34C2101B], - (8u32) [0x66EC2C3D, 0xCB5C1D71, 0x7AE273A7, 0xA40F5C8F, 0x380A3E1F, 0x2A8EB157, 0x53CDD8CF, 0x3E20A5AD], - (8u32) [0x1657E9CE, 0x734716DF, 0x0BFF05A9, 0x42FE3D09, 0x2E40DFDB, 0x10EA2668, 0x1788F40E, 0xA3BC1DC0] -}; -u256[36] level3t7_zetas = { - // Level 3 - (8u32) [0x0023E92B, 0x0023E92B, 0x0023E92B, 0x0023E92B, 0x001BDE2B, 0x001BDE2B, 0x001BDE2B, 0x001BDE2B], - (8u32) [0xFFE0147F, 0xFFE0147F, 0xFFE0147F, 0xFFE0147F, 0xFFFA84AD, 0xFFFA84AD, 0xFFFA84AD, 0xFFFA84AD], - (8u32) [0xFFD3FB09, 0xFFD3FB09, 0xFFD3FB09, 0xFFD3FB09, 0x002F9A75, 0x002F9A75, 0x002F9A75, 0x002F9A75], - (8u32) [0x0028E527, 0x0028E527, 0x0028E527, 0x0028E527, 0x002F7A49, 0x002F7A49, 0x002F7A49, 0x002F7A49], - // Level 4 - (8u32) [0x0036B788, 0x0036B788, 0xFFEF85A4, 0xFFEF85A4, 0x000FA070, 0x000FA070, 0x00299658, 0x00299658], - (8u32) [0xFFDFD37B, 0xFFDFD37B, 0x0027F968, 0x0027F968, 0xFFEEEAA0, 0xFFEEEAA0, 0xFFF79D90, 0xFFF79D90], - (8u32) [0xFFCDFC98, 0xFFCDFC98, 0xFFEAA4F7, 0xFFEAA4F7, 0xFFC51AE7, 0xFFC51AE7, 0xFFDFADD6, 0xFFDFADD6], - (8u32) [0x000445C5, 0x000445C5, 0x003D3201, 0x003D3201, 0xFFFFB422, 0xFFFFB422, 0x001AD035, 0x001AD035], - // Level 5 - (8u32) [0x003BBEAF, 0xFFD947D4, 0xFFC9302C, 0xFFE6A503, 0x0035DEC5, 0x002EF4CD, 0x00017620, 0x00294A67], - (8u32) [0xFFF7C55D, 0x0023D69C, 0xFFFB6A4D, 0x00360400, 0xFFD43E41, 0x00368A96, 0xFFD18E7C, 0xFFC51585], - (8u32) [0x0038738C, 0xFFE7945C, 0xFFDF5617, 0x0035843F, 0xFFC5AF59, 0x00357E1E, 0xFFE6EAD6, 0xFFE6123D], - (8u32) [0xFFD54F2D, 0x001F9D54, 0xFFD8FC30, 0x003B8534, 0x003B3853, 0x000E8F76, 0x00081B9A, 0x000C63A8], - // Level 6 - (8u32) [0xFFC890E0, 0xFFCF5280, 0xFFC1B072, 0xFFECCF75, 0x002135C7, 0xFFE9D65D, 0xFFC7E1CF, 0xFFC406E5], - (8u32) [0x001C4563, 0xFFFA2BDD, 0xFFFFA63B, 0xFFF5C282, 0xFFF9BA6D, 0xFFD2B7A3, 0x0020C638, 0x003410F2], - (8u32) [0x000B98A1, 0x0024756C, 0x00193948, 0xFFC72BCA, 0x000DCD44, 0x0000AD00, 0x0007C417, 0xFFCCFBE9], - (8u32) [0xFFC8A057, 0xFFD1EEA2, 0xFFF39944, 0x00139E25, 0x00141305, 0xFFDB3C93, 0x003036C2, 0x0002E46C], - (8u32) [0x0001EFCA, 0xFFCFD2AE, 0xFFF0BCF6, 0x001D9772, 0xFFE7CFBB, 0x003509EE, 0xFFD19819, 0xFFE8AC81], - (8u32) [0xFFEA2C62, 0x001495D4, 0xFFEC09F7, 0xFFED4113, 0xFFDA3409, 0xFFC7A44B, 0x00296E9F, 0xFFF0FE85], - (8u32) [0xFFEBE808, 0xFFFCC7DF, 0xFFCE69C0, 0xFFFFDE7E, 0x003C675A, 0xFFEF36BE, 0x002F4588, 0x00040AF0], - (8u32) [0x003A97D9, 0xFFC4C79C, 0xFFEA0802, 0xFFE7D0E0, 0x00147792, 0xFFFD4AE0, 0xFFE3BFF6, 0xFFC9C808], - // Level 7 - (8u32) [0xFFC9B97D, 0xFFF60021, 0x00078F83, 0x000DBE5E, 0xFFCA48A0, 0x000412F5, 0xFFCCFF72, 0x001FEA93], - (8u32) [0xFFF91DE4, 0xFFEBA8BE, 0xFFD25089, 0xFFC68518, 0x003DE11C, 0x002B5EE5, 0x003472E7, 0x00053919], - (8u32) [0x000C5CA5, 0xFFCF6CBE, 0x001DDD98, 0xFFE14658, 0xFFD8911B, 0xFFF7B934, 0x0016E405, 0xFFEC7953], - (8u32) [0x003C15CA, 0xFFF78A50, 0x0002CC93, 0xFFD32764, 0xFFE68E98, 0xFFF97D45, 0x0021C4F7, 0xFFD1A13C], - (8u32) [0xFFF7FCD6, 0xFFD05AF6, 0xFFE7628A, 0x001C5E1A, 0xFFC6A2FC, 0x00252587, 0x00223DFB, 0x0033FF5A], - (8u32) [0x001406C7, 0x0012E11B, 0x001C853F, 0x001314BE, 0x00130984, 0x00291199, 0xFFCD003B, 0x0004610C], - (8u32) [0x0019379A, 0x00027C1C, 0x00336898, 0x00251D8B, 0xFFC72C12, 0xFFD4CA0C, 0x000BDBE7, 0x001D4099], - (8u32) [0x00155E68, 0x003BCF2C, 0xFFF11805, 0xFFDDE1AF, 0xFFEF2633, 0x001A4CD0, 0xFFF11BF4, 0x0035C539], - (8u32) [0xFFF44592, 0x001F0084, 0xFFFF5704, 0x000DE0E6, 0xFFEDBB56, 0xFFED24F0, 0xFFDAAB9F, 0x002358D4], - (8u32) [0x00327283, 0xFFCD5E3E, 0x001D0B4B, 0x00283891, 0x0025F051, 0xFFD87A3A, 0x001A7CC7, 0xFFDACD41], - (8u32) [0xFFC7A167, 0x0018AA08, 0x0002D4BB, 0x002573B7, 0x000910D8, 0xFFE67FF8, 0x00221DE8, 0xFFD92578], - (8u32) [0xFFF316B6, 0xFFFF434E, 0x00189C2A, 0xFFF993DD, 0xFFFC05DA, 0xFFE47CAE, 0x001A35E7, 0x003B0115], - (8u32) [0xFFC921C2, 0x0030EF86, 0xFFF806FC, 0x000C7F5A, 0xFFCF45DE, 0x00359B5D, 0xFFC9A422, 0x003A41F8], - (8u32) [0xFFE20D6E, 0xFFEA2D2F, 0xFFEFF6A6, 0xFFC9DB90, 0x00185A46, 0x00134D71, 0x00031924, 0x003EB01B], - (8u32) [0xFFE48C3D, 0x002DFD71, 0xFFED93A7, 0xFFFD7C8F, 0xFFC65E1F, 0xFFE3D157, 0x0033F8CF, 0xFFEB05AD], - (8u32) [0x001E29CE, 0xFFEB36DF, 0xFFC9E5A9, 0xFFDD1D09, 0xFFC57FDB, 0x001D2668, 0x0007340E, 0x00041DC0] -}; - -inline -fn shuffle8(reg u256 r0 r1) --> reg u256, reg u256 { - // TESTED [2022-11-02 13:00] - reg u256 r2 r3; - r3 = #VPERM2I128(r0, r1, 0x31); - r2 = #VPERM2I128(r0, r1, 0x20); - return r2, r3; -} - -inline -fn shuffle4(reg u256 r0 r1) --> reg u256, reg u256 { - // TESTED [2022-11-02 13:00] - reg u256 r2 r3; - - r2 = #VPUNPCKL_4u64(r0, r1); - r3 = #VPUNPCKH_4u64(r0, r1); - return r2, r3; -} - -inline -fn shuffle2(reg u256 r0 r1) --> reg u256, reg u256 { - // TESTED [2022-11-02 13:00] - // Open question: is r0 an output of this macro? Why does Gregor - // clobber r0, cause you don't have to (you could use r3 immediately). - // Open question: There are two commented alternatives for DUP'ing - // values. The uncommented instructions seems to be quite good in - // terms of port pressure when we look at this macro in isolation. - // However, the butterfly operation puts a lot of pressure on p0, so - // I'd argue to use a DUP instruction instead of shift. - // Instruction refs: - // [icelake] mul p01, srl p15, dup p5, blend p015 - // [zen3] mul p03, srl p0, dup p12, blend p0123 - - reg u256 r2 r3; - r2 = #VMOVSLDUP_256(r1); - r2 = #VPBLEND_8u32(r0, r2, 0xAA); - r0 = #VPSRL_4u64(r0, 32); - r3 = #VPBLEND_8u32(r0, r1, 0xAA); - return r2, r3; -} - -inline -fn shuffle1(reg u256 r0 r1) --> reg u256, reg u256 { - // TESTED [2022-11-02 13:00] - reg u256 r2 r3; - r2 = #VPSLL_8u32(r1, 16); - r2 = #VPBLEND_16u16(r0, r2, 0xAA); - r0 = #VPSRL_8u32(r0, 16); - r3 = #VPBLEND_16u16(r0, r1, 0xAA); - return r2, r3; -} - -inline -fn ntt_butterfly(reg u256 l h zl0 zl1 zh0 zh1 q) --> reg u256, reg u256 { - // TESTED [2022-11-01 14:15] - reg u256 ymm12 ymm13 ymm14; - - // NOTE: [electricdusk] This looks like a simple radix-2^32 - // Montgomery-based butterfly op. - - // TODO: [electricdusk] Should we not apply the course-grained - // parallelization principle to Dilithium optimization as well? - // I.e., parallelize complete NTTs instead of inside NTTs? - // Count the number of shuffle instructions compared to other - // instructions in the NTT to get a coarse idea. - - ymm12 = #VMOVSHDUP_256(h); - - ymm13 = #VPMUL_256(h, zl0); // (*) - ymm13 = #VPMUL_256(ymm13, q); // (*) - - ymm14 = #VPMUL_256(ymm12, zl1); // (**) - ymm14 = #VPMUL_256(ymm14, q); // (**) - - h = #VPMUL_256(h, zh0); - ymm12 = #VPMUL_256(ymm12, zh1); - - h = #VMOVSHDUP_256(h); - h = #VPBLEND_8u32(h, ymm12, 0xAA); - - ymm12 = #VPSUB_8u32(l, h); - l = #VPADD_8u32(l, h); - - ymm13 = #VMOVSHDUP_256(ymm13); - ymm13 = #VPBLEND_8u32(ymm13, ymm14, 0xAA); - - h = #VPADD_8u32(ymm12, ymm13); - l = #VPSUB_8u32(l, ymm13); - - return l, h; -} - -// Level 0 -inline -fn ntt_levels0t1(reg ptr u32[256] poly_ptr, reg u256 q, inline int offset) --> reg ptr u32[256] { - // TODO: Interleave loads/stores with arithmetic ops - - reg u256 zeta_qinv zeta; - reg u256 poly0 poly1 poly2 poly3 poly4 poly5 poly6 poly7; - - poly0 = #VMOVDQU_256(poly_ptr.[:u256 (32 * (0*4 + offset))]); - poly1 = #VMOVDQU_256(poly_ptr.[:u256 (32 * (1*4 + offset))]); - poly2 = #VMOVDQU_256(poly_ptr.[:u256 (32 * (2*4 + offset))]); - poly3 = #VMOVDQU_256(poly_ptr.[:u256 (32 * (3*4 + offset))]); - poly4 = #VMOVDQU_256(poly_ptr.[:u256 (32 * (4*4 + offset))]); - poly5 = #VMOVDQU_256(poly_ptr.[:u256 (32 * (5*4 + offset))]); - poly6 = #VMOVDQU_256(poly_ptr.[:u256 (32 * (6*4 + offset))]); - poly7 = #VMOVDQU_256(poly_ptr.[:u256 (32 * (7*4 + offset))]); - - // Level 0 - zeta_qinv = #VPBROADCAST_8u32(ntt_level0_zetas_qinv[0]); - zeta = #VPBROADCAST_8u32(ntt_level0_zetas[0]); - poly0, poly4 = ntt_butterfly(poly0, poly4, zeta_qinv, zeta_qinv, zeta, zeta, q); - poly1, poly5 = ntt_butterfly(poly1, poly5, zeta_qinv, zeta_qinv, zeta, zeta, q); - poly2, poly6 = ntt_butterfly(poly2, poly6, zeta_qinv, zeta_qinv, zeta, zeta, q); - poly3, poly7 = ntt_butterfly(poly3, poly7, zeta_qinv, zeta_qinv, zeta, zeta, q); - - // Level 1 - zeta_qinv = #VPBROADCAST_8u32(level1_zetas_qinv[0]); - zeta = #VPBROADCAST_8u32(level1_zetas[0]); - poly0, poly2 = ntt_butterfly(poly0, poly2, zeta_qinv, zeta_qinv, zeta, zeta, q); - poly1, poly3 = ntt_butterfly(poly1, poly3, zeta_qinv, zeta_qinv, zeta, zeta, q); - - zeta_qinv = #VPBROADCAST_8u32(level1_zetas_qinv[1]); - zeta = #VPBROADCAST_8u32(level1_zetas[1]); - poly4, poly6 = ntt_butterfly(poly4, poly6, zeta_qinv, zeta_qinv, zeta, zeta, q); - poly5, poly7 = ntt_butterfly(poly5, poly7, zeta_qinv, zeta_qinv, zeta, zeta, q); - - poly_ptr.[:u256 (32 * (0*4 + offset))] = poly0; - poly_ptr.[:u256 (32 * (1*4 + offset))] = poly1; - poly_ptr.[:u256 (32 * (2*4 + offset))] = poly2; - poly_ptr.[:u256 (32 * (3*4 + offset))] = poly3; - poly_ptr.[:u256 (32 * (4*4 + offset))] = poly4; - poly_ptr.[:u256 (32 * (5*4 + offset))] = poly5; - poly_ptr.[:u256 (32 * (6*4 + offset))] = poly6; - poly_ptr.[:u256 (32 * (7*4 + offset))] = poly7; - - return poly_ptr; -} - -inline -fn ntt_levels2t7(reg ptr u32[256] poly_ptr, reg u256 q, inline int offset) --> reg ptr u32[256] { - // TODO: Interleave shuffles with butterflies - - reg u256 zeta_qinv0 zeta_qinv1 zeta0 zeta1; - reg u256 poly0 poly1 poly2 poly3 poly4 poly5 poly6 poly7 polyx; - - poly0 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8*offset + 0)]); - poly1 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8*offset + 1)]); - poly2 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8*offset + 2)]); - poly3 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8*offset + 3)]); - poly4 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8*offset + 4)]); - poly5 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8*offset + 5)]); - poly6 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8*offset + 6)]); - poly7 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8*offset + 7)]); - - // Level 2 - zeta_qinv0 = #VPBROADCAST_8u32(level2_zetas_qinv[offset]); - zeta0 = #VPBROADCAST_8u32(level2_zetas[offset]); - poly0, poly4 = ntt_butterfly(poly0, poly4, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - poly1, poly5 = ntt_butterfly(poly1, poly5, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - poly2, poly6 = ntt_butterfly(poly2, poly6, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - poly3, poly7 = ntt_butterfly(poly3, poly7, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - - polyx, poly4 = shuffle8(poly0, poly4); - poly0, poly5 = shuffle8(poly1, poly5); - poly1, poly6 = shuffle8(poly2, poly6); - poly2, poly7 = shuffle8(poly3, poly7); - - // Level 3 - zeta_qinv0 = #VMOVDQU_256(level3t7_zetas_qinv[offset]); - zeta0 = #VMOVDQU_256(level3t7_zetas[offset]); - - polyx, poly1 = ntt_butterfly(polyx, poly1, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - poly4, poly6 = ntt_butterfly(poly4, poly6, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - poly0, poly2 = ntt_butterfly(poly0, poly2, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - poly5, poly7 = ntt_butterfly(poly5, poly7, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - - poly3, poly1 = shuffle4(polyx, poly1); - polyx, poly6 = shuffle4(poly4, poly6); - poly4, poly2 = shuffle4(poly0, poly2); - poly0, poly7 = shuffle4(poly5, poly7); - - // Level 4 - zeta_qinv0 = #VMOVDQU_256(level3t7_zetas_qinv[4 + offset]); - zeta0 = #VMOVDQU_256(level3t7_zetas[4 + offset]); - - poly3, poly4 = ntt_butterfly(poly3, poly4, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - poly1, poly2 = ntt_butterfly(poly1, poly2, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - polyx, poly0 = ntt_butterfly(polyx, poly0, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - poly6, poly7 = ntt_butterfly(poly6, poly7, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - - poly5, poly4 = shuffle2(poly3, poly4); - poly3, poly2 = shuffle2(poly1, poly2); - poly1, poly0 = shuffle2(polyx, poly0); - polyx, poly7 = shuffle2(poly6, poly7); - - // Level 5 - zeta_qinv0 = #VMOVDQU_256(level3t7_zetas_qinv[8 + offset]); - zeta0 = #VMOVDQU_256(level3t7_zetas[8 + offset]); - // TODO: [electricdusk] unneccesary data hazards; precompute this - // NOTE: [electricdusk] Double-check whether the table would still fit - // in L1 cache (and whether that matters). - zeta_qinv1 = #VPSRL_4u64(zeta_qinv0, 32); - zeta1 = #VMOVSHDUP_256(zeta0); - - poly5, poly1 = ntt_butterfly(poly5, poly1, zeta_qinv0, zeta_qinv1, zeta0, zeta1, q); - poly4, poly0 = ntt_butterfly(poly4, poly0, zeta_qinv0, zeta_qinv1, zeta0, zeta1, q); - poly3, polyx = ntt_butterfly(poly3, polyx, zeta_qinv0, zeta_qinv1, zeta0, zeta1, q); - poly2, poly7 = ntt_butterfly(poly2, poly7, zeta_qinv0, zeta_qinv1, zeta0, zeta1, q); - - // Level 6 - zeta_qinv0 = #VMOVDQU_256(level3t7_zetas_qinv[12 + offset]); - zeta0 = #VMOVDQU_256(level3t7_zetas[12 + offset]); - zeta_qinv1 = #VPSRL_4u64(zeta_qinv0, 32); - zeta1 = #VMOVSHDUP_256(zeta0); - - poly5, poly3 = ntt_butterfly(poly5, poly3, zeta_qinv0, zeta_qinv1, zeta0, zeta1, q); - poly4, poly2 = ntt_butterfly(poly4, poly2, zeta_qinv0, zeta_qinv1, zeta0, zeta1, q); - - zeta_qinv0 = #VMOVDQU_256(level3t7_zetas_qinv[16 + offset]); - zeta0 = #VMOVDQU_256(level3t7_zetas[16 + offset]); - zeta_qinv1 = #VPSRL_4u64(zeta_qinv0, 32); - zeta1 = #VMOVSHDUP_256(zeta0); - - poly1, polyx = ntt_butterfly(poly1, polyx, zeta_qinv0, zeta_qinv1, zeta0, zeta1, q); - poly0, poly7 = ntt_butterfly(poly0, poly7, zeta_qinv0, zeta_qinv1, zeta0, zeta1, q); - - // Level 7 - // TODO: [electricdusk] Write a butterfly that loads the twiddle - // factors as immediates from memory (instead of buffering them in - // registers). - zeta_qinv0 = #VMOVDQU_256(level3t7_zetas_qinv[20 + offset]); - zeta0 = #VMOVDQU_256(level3t7_zetas[20 + offset]); - zeta_qinv1 = #VPSRL_4u64(zeta_qinv0, 32); - zeta1 = #VMOVSHDUP_256(zeta0); - poly5, poly4 = ntt_butterfly(poly5, poly4, zeta_qinv0, zeta_qinv1, zeta0, zeta1, q); - - zeta_qinv0 = #VMOVDQU_256(level3t7_zetas_qinv[24 + offset]); - zeta0 = #VMOVDQU_256(level3t7_zetas[24 + offset]); - zeta_qinv1 = #VPSRL_4u64(zeta_qinv0, 32); - zeta1 = #VMOVSHDUP_256(zeta0); - poly3, poly2 = ntt_butterfly(poly3, poly2, zeta_qinv0, zeta_qinv1, zeta0, zeta1, q); - - zeta_qinv0 = #VMOVDQU_256(level3t7_zetas_qinv[28 + offset]); - zeta0 = #VMOVDQU_256(level3t7_zetas[28 + offset]); - zeta_qinv1 = #VPSRL_4u64(zeta_qinv0, 32); - zeta1 = #VMOVSHDUP_256(zeta0); - poly1, poly0 = ntt_butterfly(poly1, poly0, zeta_qinv0, zeta_qinv1, zeta0, zeta1, q); - - zeta_qinv0 = #VMOVDQU_256(level3t7_zetas_qinv[32 + offset]); - zeta0 = #VMOVDQU_256(level3t7_zetas[32 + offset]); - zeta_qinv1 = #VPSRL_4u64(zeta_qinv0, 32); - zeta1 = #VMOVSHDUP_256(zeta0); - polyx, poly7 = ntt_butterfly(polyx, poly7, zeta_qinv0, zeta_qinv1, zeta0, zeta1, q); - - poly_ptr.[:u256 32 * (8*offset + 0)] = poly5; - poly_ptr.[:u256 32 * (8*offset + 1)] = poly4; - poly_ptr.[:u256 32 * (8*offset + 2)] = poly3; - poly_ptr.[:u256 32 * (8*offset + 3)] = poly2; - poly_ptr.[:u256 32 * (8*offset + 4)] = poly1; - poly_ptr.[:u256 32 * (8*offset + 5)] = poly0; - poly_ptr.[:u256 32 * (8*offset + 6)] = polyx; - poly_ptr.[:u256 32 * (8*offset + 7)] = poly7; - - return poly_ptr; -} - -fn ntt_avx2(reg ptr u32[256] poly) -> reg ptr u32[256] { - reg u256 q; - - q = #VPBROADCAST_8u32(const_q); - - poly = ntt_levels0t1(poly, q, 0); - poly = ntt_levels0t1(poly, q, 1); - poly = ntt_levels0t1(poly, q, 2); - poly = ntt_levels0t1(poly, q, 3); - - poly = ntt_levels2t7(poly, q, 0); - poly = ntt_levels2t7(poly, q, 1); - poly = ntt_levels2t7(poly, q, 2); - poly = ntt_levels2t7(poly, q, 3); - - return poly; -} - -inline -fn invntt_butterfly(reg u256 l h zl0 zl1 zh0 zh1 q) --> reg u256, reg u256 { - reg u256 ymm12 ymm13 ymm14; - - ymm12 = #VPSUB_8u32(h, l); - l = #VPADD_8u32(l, h); - - ymm13 = #VPMUL_256(ymm12, zl0); - h = #VMOVSHDUP_256(ymm12); - ymm14 = #VPMUL_256(h, zl1); - - ymm12 = #VPMUL_256(ymm12, zh0); - h = #VPMUL_256(h, zh1); - - ymm13 = #VPMUL_256(ymm13, q); - ymm14 = #VPMUL_256(ymm14, q); - - ymm12 = #VPSUB_8u32(ymm12, ymm13); - h = #VPSUB_8u32(h, ymm14); - - ymm12 = #VMOVSHDUP_256(ymm12); - h = #VPBLEND_8u32(ymm12, h, 0xAA); - - return l, h; -} - -inline -fn invntt_levels0t5(reg ptr u32[256] poly_ptr, reg u256 q, inline int offset) -> reg ptr u32[256] { - reg u256 zeta_qinv0 zeta_qinv1 zeta0 zeta1; - reg u256 poly0 poly1 poly2 poly3 poly4 poly5 poly6 poly7 polyx; - - poly0 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8*offset + 0)]); - poly1 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8*offset + 1)]); - poly2 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8*offset + 2)]); - poly3 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8*offset + 3)]); - poly4 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8*offset + 4)]); - poly5 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8*offset + 5)]); - poly6 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8*offset + 6)]); - poly7 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8*offset + 7)]); - - // Level 0 - // TODO: [electricdusk] This code might be unneccesarily hazardous. - // Consider storing the already-permuted tables in memory. - zeta_qinv0 = #VPERMQ(level3t7_zetas_qinv[35 - offset], 0x1B); - zeta0 = #VPERMQ(level3t7_zetas[35 - offset], 0x1B); - zeta_qinv1 = #VMOVSHDUP_256(zeta_qinv0); - zeta1 = #VMOVSHDUP_256(zeta0); - poly0, poly1 = invntt_butterfly(poly0, poly1, zeta_qinv1, zeta_qinv0, zeta1, zeta0, q); - - zeta_qinv0 = #VPERMQ(level3t7_zetas_qinv[31 - offset], 0x1B); - zeta0 = #VPERMQ(level3t7_zetas[31 - offset], 0x1B); - zeta_qinv1 = #VMOVSHDUP_256(zeta_qinv0); - zeta1 = #VMOVSHDUP_256(zeta0); - poly2, poly3 = invntt_butterfly(poly2, poly3, zeta_qinv1, zeta_qinv0, zeta1, zeta0, q); - - zeta_qinv0 = #VPERMQ(level3t7_zetas_qinv[27 - offset], 0x1B); - zeta0 = #VPERMQ(level3t7_zetas[27 - offset], 0x1B); - zeta_qinv1 = #VMOVSHDUP_256(zeta_qinv0); - zeta1 = #VMOVSHDUP_256(zeta0); - poly4, poly5 = invntt_butterfly(poly4, poly5, zeta_qinv1, zeta_qinv0, zeta1, zeta0, q); - - zeta_qinv0 = #VPERMQ(level3t7_zetas_qinv[23 - offset], 0x1B); - zeta0 = #VPERMQ(level3t7_zetas[23 - offset], 0x1B); - zeta_qinv1 = #VMOVSHDUP_256(zeta_qinv0); - zeta1 = #VMOVSHDUP_256(zeta0); - poly6, poly7 = invntt_butterfly(poly6, poly7, zeta_qinv1, zeta_qinv0, zeta1, zeta0, q); - - // Level 1 - zeta_qinv0 = #VPERMQ(level3t7_zetas_qinv[19 - offset], 0x1B); - zeta0 = #VPERMQ(level3t7_zetas[19 - offset], 0x1B); - zeta_qinv1 = #VMOVSHDUP_256(zeta_qinv0); - zeta1 = #VMOVSHDUP_256(zeta0); - poly0, poly2 = invntt_butterfly(poly0, poly2, zeta_qinv1, zeta_qinv0, zeta1, zeta0, q); - poly1, poly3 = invntt_butterfly(poly1, poly3, zeta_qinv1, zeta_qinv0, zeta1, zeta0, q); - - zeta_qinv0 = #VPERMQ(level3t7_zetas_qinv[15 - offset], 0x1B); - zeta0 = #VPERMQ(level3t7_zetas[15 - offset], 0x1B); - zeta_qinv1 = #VMOVSHDUP_256(zeta_qinv0); - zeta1 = #VMOVSHDUP_256(zeta0); - poly4, poly6 = invntt_butterfly(poly4, poly6, zeta_qinv1, zeta_qinv0, zeta1, zeta0, q); - poly5, poly7 = invntt_butterfly(poly5, poly7, zeta_qinv1, zeta_qinv0, zeta1, zeta0, q); - - // Level 2 - zeta_qinv0 = #VPERMQ(level3t7_zetas_qinv[11 - offset], 0x1B); - zeta0 = #VPERMQ(level3t7_zetas[11 - offset], 0x1B); - zeta_qinv1 = #VMOVSHDUP_256(zeta_qinv0); - zeta1 = #VMOVSHDUP_256(zeta0); - poly0, poly4 = invntt_butterfly(poly0, poly4, zeta_qinv1, zeta_qinv0, zeta1, zeta0, q); - poly1, poly5 = invntt_butterfly(poly1, poly5, zeta_qinv1, zeta_qinv0, zeta1, zeta0, q); - poly2, poly6 = invntt_butterfly(poly2, poly6, zeta_qinv1, zeta_qinv0, zeta1, zeta0, q); - poly3, poly7 = invntt_butterfly(poly3, poly7, zeta_qinv1, zeta_qinv0, zeta1, zeta0, q); - - // Level 3 - polyx, poly1 = shuffle2(poly0, poly1); - poly0, poly3 = shuffle2(poly2, poly3); - poly2, poly5 = shuffle2(poly4, poly5); - poly4, poly7 = shuffle2(poly6, poly7); - - zeta_qinv0 = #VPERMQ(level3t7_zetas_qinv[7 - offset], 0x1B); - zeta0 = #VPERMQ(level3t7_zetas[7 - offset], 0x1B); - polyx, poly1 = invntt_butterfly(polyx, poly1, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - poly0, poly3 = invntt_butterfly(poly0, poly3, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - poly2, poly5 = invntt_butterfly(poly2, poly5, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - poly4, poly7 = invntt_butterfly(poly4, poly7, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - - // Level 4 - poly6, poly0 = shuffle4(polyx, poly0); - polyx, poly4 = shuffle4(poly2, poly4); - poly2, poly3 = shuffle4(poly1, poly3); - poly1, poly7 = shuffle4(poly5, poly7); - - zeta_qinv0 = #VPERMQ(level3t7_zetas_qinv[3 - offset], 0x1B); - zeta0 = #VPERMQ(level3t7_zetas[3 - offset], 0x1B); - poly6, poly0 = invntt_butterfly(poly6, poly0, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - polyx, poly4 = invntt_butterfly(polyx, poly4, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - poly2, poly3 = invntt_butterfly(poly2, poly3, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - poly1, poly7 = invntt_butterfly(poly1, poly7, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - - // Level 5 - poly5, polyx = shuffle8(poly6, polyx); - poly6, poly1 = shuffle8(poly2, poly1); - poly2, poly4 = shuffle8(poly0, poly4); - poly0, poly7 = shuffle8(poly3, poly7); - - zeta_qinv0 = #VPBROADCAST_8u32(level2_zetas_qinv[3 - offset]); - zeta0 = #VPBROADCAST_8u32(level2_zetas[3 - offset]); - poly5, polyx = invntt_butterfly(poly5, polyx, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - poly6, poly1 = invntt_butterfly(poly6, poly1, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - poly2, poly4 = invntt_butterfly(poly2, poly4, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - poly0, poly7 = invntt_butterfly(poly0, poly7, zeta_qinv0, zeta_qinv0, zeta0, zeta0, q); - - poly_ptr.[:u256 32 * (8*offset + 0)] = poly5; - poly_ptr.[:u256 32 * (8*offset + 1)] = poly6; - poly_ptr.[:u256 32 * (8*offset + 2)] = poly2; - poly_ptr.[:u256 32 * (8*offset + 3)] = poly0; - poly_ptr.[:u256 32 * (8*offset + 4)] = polyx; - poly_ptr.[:u256 32 * (8*offset + 5)] = poly1; - poly_ptr.[:u256 32 * (8*offset + 6)] = poly4; - poly_ptr.[:u256 32 * (8*offset + 7)] = poly7; - - return poly_ptr; -} - -inline -fn invntt_levels6t7(reg ptr u32[256] poly_ptr, reg u256 q, inline int offset) -> reg ptr u32[256] { - reg u256 zeta_qinv zeta; - reg u256 div div_qinv; - reg u256 ymm12 ymm13 ymm14 ymm15; - reg u256 poly0 poly1 poly2 poly3 poly4 poly5 poly6 poly7; - - poly0 = #VMOVDQU_256(poly_ptr.[:u256 32 * (0 + offset)]); - poly1 = #VMOVDQU_256(poly_ptr.[:u256 32 * (4 + offset)]); - poly2 = #VMOVDQU_256(poly_ptr.[:u256 32 * (8 + offset)]); - poly3 = #VMOVDQU_256(poly_ptr.[:u256 32 * (12 + offset)]); - poly4 = #VMOVDQU_256(poly_ptr.[:u256 32 * (16 + offset)]); - poly5 = #VMOVDQU_256(poly_ptr.[:u256 32 * (20 + offset)]); - poly6 = #VMOVDQU_256(poly_ptr.[:u256 32 * (24 + offset)]); - poly7 = #VMOVDQU_256(poly_ptr.[:u256 32 * (28 + offset)]); - - // Level 6 - zeta_qinv = #VPBROADCAST_8u32(level1_zetas_qinv[1]); - zeta = #VPBROADCAST_8u32(level1_zetas[1]); - poly0, poly2 = invntt_butterfly(poly0, poly2, zeta_qinv, zeta_qinv, zeta, zeta, q); - poly1, poly3 = invntt_butterfly(poly1, poly3, zeta_qinv, zeta_qinv, zeta, zeta, q); - - zeta_qinv = #VPBROADCAST_8u32(level1_zetas_qinv[0]); - zeta = #VPBROADCAST_8u32(level1_zetas[0]); - poly4, poly6 = invntt_butterfly(poly4, poly6, zeta_qinv, zeta_qinv, zeta, zeta, q); - poly5, poly7 = invntt_butterfly(poly5, poly7, zeta_qinv, zeta_qinv, zeta, zeta, q); - - // Level 7 - zeta_qinv = #VPBROADCAST_8u32(invntt_level0_zetas_qinv[0]); - zeta = #VPBROADCAST_8u32(invntt_level0_zetas[0]); - poly0, poly4 = invntt_butterfly(poly0, poly4, zeta_qinv, zeta_qinv, zeta, zeta, q); - poly1, poly5 = invntt_butterfly(poly1, poly5, zeta_qinv, zeta_qinv, zeta, zeta, q); - poly2, poly6 = invntt_butterfly(poly2, poly6, zeta_qinv, zeta_qinv, zeta, zeta, q); - poly3, poly7 = invntt_butterfly(poly3, poly7, zeta_qinv, zeta_qinv, zeta, zeta, q); - - poly_ptr.[:u256 32 * (16 + offset)] = poly4; - poly_ptr.[:u256 32 * (20 + offset)] = poly5; - poly_ptr.[:u256 32 * (24 + offset)] = poly6; - poly_ptr.[:u256 32 * (28 + offset)] = poly7; - - // Divide by 256 and map to Montgomery domain - // TODO: Understand why we only have to do this with half of the - // polynomial coefficients. - div_qinv = #VPBROADCAST_8u32(const_div256_qinv); // ymm1 - div = #VPBROADCAST_8u32(const_div256); // ymm2 - - ymm12 = #VPMUL_256(poly0, div_qinv); - ymm13 = #VPMUL_256(poly1, div_qinv); - poly4 = #VMOVSHDUP_256(poly0); - poly5 = #VMOVSHDUP_256(poly1); - ymm14 = #VPMUL_256(poly4, div_qinv); - ymm15 = #VPMUL_256(poly5, div_qinv); - poly0 = #VPMUL_256(poly0, div); - poly1 = #VPMUL_256(poly1, div); - poly4 = #VPMUL_256(poly4, div); - poly5 = #VPMUL_256(poly5, div); - ymm12 = #VPMUL_256(ymm12, q); - ymm13 = #VPMUL_256(ymm13, q); - ymm14 = #VPMUL_256(ymm14, q); - ymm15 = #VPMUL_256(ymm15, q); - poly0 = #VPSUB_8u32(poly0, ymm12); - poly1 = #VPSUB_8u32(poly1, ymm13); - poly4 = #VPSUB_8u32(poly4, ymm14); - poly5 = #VPSUB_8u32(poly5, ymm15); - poly0 = #VMOVSHDUP_256(poly0); - poly1 = #VMOVSHDUP_256(poly1); - poly0 = #VPBLEND_8u32(poly0, poly4, 0xAA); - poly1 = #VPBLEND_8u32(poly1, poly5, 0xAA); - ymm12 = #VPMUL_256(poly2, div_qinv); - ymm13 = #VPMUL_256(poly3, div_qinv); - poly4 = #VMOVSHDUP_256(poly2); - poly5 = #VMOVSHDUP_256(poly3); - ymm14 = #VPMUL_256(poly4, div_qinv); - ymm15 = #VPMUL_256(poly5, div_qinv); - poly2 = #VPMUL_256(poly2, div); - poly3 = #VPMUL_256(poly3, div); - poly4 = #VPMUL_256(poly4, div); - poly5 = #VPMUL_256(poly5, div); - ymm12 = #VPMUL_256(ymm12, q); - ymm13 = #VPMUL_256(ymm13, q); - ymm14 = #VPMUL_256(ymm14, q); - ymm15 = #VPMUL_256(ymm15, q); - poly2 = #VPSUB_8u32(poly2, ymm12); - poly3 = #VPSUB_8u32(poly3, ymm13); - poly4 = #VPSUB_8u32(poly4, ymm14); - poly5 = #VPSUB_8u32(poly5, ymm15); - poly2 = #VMOVSHDUP_256(poly2); - poly3 = #VMOVSHDUP_256(poly3); - poly2 = #VPBLEND_8u32(poly2, poly4, 0xAA); - poly3 = #VPBLEND_8u32(poly3, poly5, 0xAA); - - poly_ptr.[:u256 32 * (0 + offset)] = poly0; - poly_ptr.[:u256 32 * (4 + offset)] = poly1; - poly_ptr.[:u256 32 * (8 + offset)] = poly2; - poly_ptr.[:u256 32 * (12 + offset)] = poly3; - - return poly_ptr; -} - -fn invntt_tomont_avx2(reg ptr u32[256] poly) -> reg ptr u32[256] { - reg u256 q; - - q = #VPBROADCAST_8u32(const_q); - - poly = invntt_levels0t5(poly, q, 0); - poly = invntt_levels0t5(poly, q, 1); - poly = invntt_levels0t5(poly, q, 2); - poly = invntt_levels0t5(poly, q, 3); - - poly = invntt_levels6t7(poly, q, 0); - poly = invntt_levels6t7(poly, q, 1); - poly = invntt_levels6t7(poly, q, 2); - poly = invntt_levels6t7(poly, q, 3); - - return poly; -} - -fn ntt_transpose_inner_avx2(reg ptr u32[256] poly_ptr, reg u64 offset) -> reg ptr u32[256] { - reg u256 ymm3 ymm4 ymm5 ymm6 ymm7 ymm8 ymm9 ymm10 ymm11; - - ymm4 = #VMOVDQU_256(poly_ptr.[:u256 32 * 0 + (uint) offset]); - ymm5 = #VMOVDQU_256(poly_ptr.[:u256 32 * 1 + (uint) offset]); - ymm6 = #VMOVDQU_256(poly_ptr.[:u256 32 * 2 + (uint) offset]); - ymm7 = #VMOVDQU_256(poly_ptr.[:u256 32 * 3 + (uint) offset]); - ymm8 = #VMOVDQU_256(poly_ptr.[:u256 32 * 4 + (uint) offset]); - ymm9 = #VMOVDQU_256(poly_ptr.[:u256 32 * 5 + (uint) offset]); - ymm10 = #VMOVDQU_256(poly_ptr.[:u256 32 * 6 + (uint) offset]); - ymm11 = #VMOVDQU_256(poly_ptr.[:u256 32 * 7 + (uint) offset]); - - ymm3, ymm8 = shuffle8(ymm4, ymm8); - ymm4, ymm9 = shuffle8(ymm5, ymm9); - ymm5, ymm10 = shuffle8(ymm6, ymm10); - ymm6, ymm11 = shuffle8(ymm7, ymm11); - - ymm7, ymm5 = shuffle4(ymm3, ymm5); - ymm3, ymm10 = shuffle4(ymm8, ymm10); - ymm8, ymm6 = shuffle4(ymm4, ymm6); - ymm4, ymm11 = shuffle4(ymm9, ymm11); - - ymm9, ymm8 = shuffle2(ymm7, ymm8); - ymm7, ymm6 = shuffle2(ymm5, ymm6); - ymm5, ymm4 = shuffle2(ymm3, ymm4); - ymm3, ymm11 = shuffle2(ymm10, ymm11); - - poly_ptr.[:u256 32 * 0 + (uint) offset] = ymm9; - poly_ptr.[:u256 32 * 1 + (uint) offset] = ymm8; - poly_ptr.[:u256 32 * 2 + (uint) offset] = ymm7; - poly_ptr.[:u256 32 * 3 + (uint) offset] = ymm6; - poly_ptr.[:u256 32 * 4 + (uint) offset] = ymm5; - poly_ptr.[:u256 32 * 5 + (uint) offset] = ymm4; - poly_ptr.[:u256 32 * 6 + (uint) offset] = ymm3; - poly_ptr.[:u256 32 * 7 + (uint) offset] = ymm11; - - return poly_ptr; -} - -fn ntt_transpose_avx2(reg ptr u32[Li2_polydeg] poly) -> reg ptr u32[Li2_polydeg] { - reg u64 offset; - - ?{}, offset = #set0_64(); - poly = ntt_transpose_inner_avx2(poly, offset); - offset = Li2_polydeg; - poly = ntt_transpose_inner_avx2(poly, offset); - offset = 2 * Li2_polydeg; - poly = ntt_transpose_inner_avx2(poly, offset); - offset = 3 * Li2_polydeg; - poly = ntt_transpose_inner_avx2(poly, offset); - return poly; -} - -// This function currently glues the avx2 ntt code to the ref-based code -fn fft(reg ptr u32[Li2_polydeg] poly) -> reg ptr u32[Li2_polydeg] { - poly = ntt_avx2(poly); - return poly; -} - -// This function currently glues the avx2 ntt code to the ref-based code -fn ifft_to_mont(reg ptr u32[Li2_polydeg] poly) -> reg ptr u32[Li2_polydeg] { - poly = invntt_tomont_avx2(poly); - return poly; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/poly.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/poly.jinc deleted file mode 100644 index 597606c6..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/poly.jinc +++ /dev/null @@ -1,214 +0,0 @@ -// TODO: s/VMOVDQU_256/VMOVDQA_256/ when https://github.com/jasmin-lang/jasmin/pull/279 gets merged / released - -require "../params.jinc" - -u256[1] poly_reduce32_2_22 = { - (8u32) [0x00400000, 0x00400000, 0x00400000, 0x00400000, 0x00400000, 0x00400000, 0x00400000, 0x00400000] -}; -u256[1] poly_pointwise_qinv = { - (8u32) [58728449, 58728449, 58728449, 58728449, 58728449, 58728449, 58728449, 58728449] -}; -u256[1] poly_pointwise_q = { - (8u32) [8380417, 8380417, 8380417, 8380417, 8380417, 8380417, 8380417, 8380417] -}; - -fn poly_add(reg ptr u32[Li2_polydeg] f g result) - -> reg ptr u32[Li2_polydeg] -{ - reg u256 v256; - reg u64 offset; - - ?{}, offset = #set0_64(); - while (offset < 4 * Li2_polydeg) { - v256 = #VMOVDQU_256(f.[:u256 offset]); - v256 = #VPADD_8u32(v256, g.[:u256 offset]); - result.[:u256 offset] = v256; - - offset += 32; - } - return result; -} - -fn poly_subtract(reg ptr u32[Li2_polydeg] f g result) - -> reg ptr u32[Li2_polydeg] -{ - reg u256 v256; - reg u64 offset; - - ?{}, offset = #set0_64(); - while (offset < 4 * Li2_polydeg) { - v256 = #VMOVDQU_256(f.[:u256 offset]); - v256 = #VPSUB_8u32(v256, g.[:u256 offset]); - result.[:u256 offset] = v256; - - offset += 32; - } - return result; -} - -fn poly_accumulate(reg ptr u32[Li2_polydeg] f acc) - -> reg ptr u32[Li2_polydeg] -{ - reg u256 v256; - reg u64 offset; - - ?{}, offset = #set0_64(); - while (offset < 4 * Li2_polydeg) { - v256 = #VMOVDQU_256(acc.[:u256 offset]); - v256 = #VPADD_8u32(v256, f.[:u256 offset]); - acc.[:u256 offset] = v256; - - offset += 32; - } - return acc; -} - -fn poly_reduce32(reg ptr u32[Li2_polydeg] poly) - -> reg ptr u32[Li2_polydeg] -{ - // TODO [electricdusk] Vectorize this function - reg u256 a t const_2_22 q; - - reg u64 offset; - - const_2_22 = #VMOVDQU_256(poly_reduce32_2_22[0]); - q = #VMOVDQU_256(poly_pointwise_q[0]); - - ?{}, offset = #set0_64(); - while(offset < 4 * Li2_polydeg) { - // t = (a + (1 << 22)) >> 23 - a = #VMOVDQU_256(poly.[:u256 offset]); - t = #VPADD_8u32(a, const_2_22); - t = #VPSRA_8u32(t, 23); - // t = a - t*Q - t = #VPMULL_8u32(t, q); - a = #VPSUB_8u32(a, t); - poly.[:u256 offset] = a; - - offset += 32; - } - - return poly; -} - -fn poly_pointwise_montgomery(reg ptr u32[Li2_polydeg] fft_f fft_g fft_prod) - -> reg ptr u32[Li2_polydeg] -{ - // TODO: [electricdusk] This loop can be unrolled more to do 3 chunks - // in parallel each time. - // TODO: [electricdusk] Have the caller provide qinv and q. - - reg u256 qinv q; - reg u256 f_lo f_hi; - reg u256 g_lo g_hi; - reg u256 prod_lo prod_hi; - reg u256 t_lo t_hi; - - reg u64 offset; - - qinv = #VMOVDQU_256(poly_pointwise_qinv[0]); - q = #VMOVDQU_256(poly_pointwise_q[0]); - - ?{}, offset = #set0_64(); - while (offset < 4 * Li2_polydeg) { - f_lo = #VMOVDQU_256(fft_f.[:u256 offset]); - g_lo = #VMOVDQU_256(fft_g.[:u256 offset]); - f_hi = #VMOVSHDUP_256(f_lo); - g_hi = #VMOVSHDUP_256(g_lo); - - // Multiply - prod_lo = #VPMUL_256(f_lo, g_lo); - prod_hi = #VPMUL_256(f_hi, g_hi); - - // Reduce - t_lo = #VPMUL_256(prod_lo, qinv); - t_hi = #VPMUL_256(prod_hi, qinv); - t_lo = #VPMUL_256(t_lo, q); - t_hi = #VPMUL_256(t_hi, q); - prod_lo = #VPSUB_4u64(prod_lo, t_lo); - prod_hi = #VPSUB_4u64(prod_hi, t_hi); - - prod_lo = #VMOVSHDUP_256(prod_lo); - prod_lo = #VPBLEND_8u32(prod_lo, prod_hi, 0xAA); - fft_prod.[:u256 offset] = prod_lo; - - offset += 32; - } - return fft_prod; -} - -fn zero_poly(reg ptr u32[Li2_polydeg] f) - -> reg ptr u32[Li2_polydeg] -{ - reg u256 zero; - reg u64 offset; - - ?{}, zero = #set0_256(); - ?{}, offset = #set0_64(); - - while (offset < 4 * Li2_polydeg) { - f.[:u256 offset] = zero; - offset += 32; - } - return f; -} - -fn poly_caddq(reg ptr u32[Li2_polydeg] poly) - -> reg ptr u32[Li2_polydeg] -{ - reg u256 zero v256 mask q add; - reg u64 offset; - - ?{}, zero = #set0_256(); - q = #VMOVDQU_256(poly_pointwise_q[0]); - - ?{}, offset = #set0_64(); - while (offset < 4 * Li2_polydeg) { - v256 = #VMOVDQU_256(poly.[:u256 offset]); - mask = #VPCMPGT_8u32(zero, v256); - add = #VPAND_256(q, mask); - v256 = #VPADD_8u32(v256, add); - poly.[:u256 offset] = v256; - - offset += 32; - } - return poly; -} - -inline -fn poly_checknorm(reg ptr u32[Li2_polydeg] poly, inline int threshold) - -> reg u8 -{ - reg u256 v256 v256_zero v256_threshold; - reg u256 exceeds_pos exceeds_neg exceeds_any; - reg u64 v64; - reg u64 movmskb; - reg u8 v8 ret; - reg bool zf; - - reg u64 offset; - - ?{}, ret = #set0_8(); - - v64 = threshold - 1; - v256_threshold = (256u) #VMOV(v64); - v256_threshold = #VPBROADCAST_8u32(v256_threshold); - ?{}, v256_zero = #set0_256(); - - ?{}, offset = #set0_64(); - while (offset < 4 * Li2_polydeg) { - v256 = #VMOVDQU_256(poly.[:u256 offset]); - exceeds_pos = #VPCMPGT_8u32(v256, v256_threshold); - v256 = #VPSUB_8u32(v256_zero, v256); - exceeds_neg = #VPCMPGT_8u32(v256, v256_threshold); - exceeds_any = #VPOR_256(exceeds_pos, exceeds_neg); - movmskb = (64u)#MOVEMASK_32u8(exceeds_any); - _,_,_,_,zf = #TEST_64(movmskb, movmskb); - v8 = #SETcc(!zf); - ret |= v8; - - offset += 32; - } - - return ret; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/poly_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/poly_end.jinc deleted file mode 100644 index 37528621..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/poly_end.jinc +++ /dev/null @@ -1,47 +0,0 @@ -require "../rounding_end.jinc" // TODO: Merge this dependency - -inline -fn poly_make_hint(reg ptr u32[Li2_polydeg] f0 f1 hints) - -> stack u32, reg ptr u32[Li2_polydeg] -{ - stack u32 weight; - reg u64 i; - reg u32 a0 a1; - reg u32 h; - - i = 0; - while(i < Li2_polydeg) { - hints[i] = 0; - i += 1; - } - - weight = 0; - i = 0; - while(i < Li2_polydeg) { - a0 = f0[i]; - a1 = f1[i]; - h = make_hint(a0, a1); - hints[i] = h; - weight += h; - i += 1; - } - - return weight, hints; -} - -fn poly_use_hint(reg ptr u32[Li2_polydeg] w1 hints) - -> reg ptr u32[Li2_polydeg] -{ - reg u64 i; - reg u32 a h; - - i = 0; - while (i < Li2_polydeg) { - h = hints[i]; - a = w1[i]; - a = use_hint(a, h); - w1[i] = a; - i += 1; - } - return w1; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/polyvec_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/polyvec_end.jinc deleted file mode 100644 index 9e08a4f6..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/polyvec_end.jinc +++ /dev/null @@ -1,462 +0,0 @@ -require "poly.jinc" -require "../rounding.jinc" - -fn reduce32_vecl(reg ptr u32[Li2_l * Li2_polydeg] vec) - -> reg ptr u32[Li2_l * Li2_polydeg] -{ - reg u64 i; - reg u32 val res; - - ?{}, i = #set0_64(); - while(i < Li2_l * Li2_polydeg) { - val = vec[i]; - res = reduce32(val); - vec[i] = res; - i += 1; - } - - return vec; -} - -fn reduce32_veck(reg ptr u32[Li2_k * Li2_polydeg] vec) - -> reg ptr u32[Li2_k * Li2_polydeg] -{ - reg u64 i; - reg u32 val res; - - ?{}, i = #set0_64(); - while(i < Li2_k * Li2_polydeg) { - val = vec[i]; - res = reduce32(val); - vec[i] = res; - i += 1; - } - - return vec; -} - -//TODO rename to reflect this is vecl -fn fft_vec(reg ptr u32[Li2_l * Li2_polydeg] vec) - -> reg ptr u32[Li2_l * Li2_polydeg] -{ - inline int i; - reg ptr u32[Li2_polydeg] entry; - - for i = 0 to Li2_l { - entry = vec[i * Li2_polydeg : Li2_polydeg]; - entry = fft(entry); - vec[i * Li2_polydeg : Li2_polydeg] = entry; - } - - return vec; -} - -fn fft_veck(reg ptr u32[Li2_k * Li2_polydeg] vec) - -> reg ptr u32[Li2_k * Li2_polydeg] -{ - inline int i; - reg ptr u32[Li2_polydeg] entry; - - for i = 0 to Li2_k { - entry = vec[i * Li2_polydeg : Li2_polydeg]; - entry = fft(entry); - vec[i * Li2_polydeg : Li2_polydeg] = entry; - } - - return vec; -} - -fn ifft_to_mont_vec(reg ptr u32[Li2_k * Li2_polydeg] vec) - -> reg ptr u32[Li2_k * Li2_polydeg] -{ - inline int i; - reg ptr u32[Li2_polydeg] entry; - - for i = 0 to Li2_k { - entry = vec[i * Li2_polydeg : Li2_polydeg]; - entry = ifft_to_mont(entry); - vec[i * Li2_polydeg : Li2_polydeg] = entry; - } - - return vec; -} - -fn ifft_to_mont_vecl(reg ptr u32[Li2_l * Li2_polydeg] vec) - -> reg ptr u32[Li2_l * Li2_polydeg] -{ - inline int i; - reg ptr u32[Li2_polydeg] entry; - - for i = 0 to Li2_l { - entry = vec[i * Li2_polydeg : Li2_polydeg]; - entry = ifft_to_mont(entry); - vec[i * Li2_polydeg : Li2_polydeg] = entry; - } - - return vec; -} - - -inline -fn power2round_vec(reg ptr u32[Li2_k * Li2_polydeg] v) - -> stack u32[Li2_k * Li2_polydeg], stack u32[Li2_k * Li2_polydeg] -{ - stack u32[Li2_k * Li2_polydeg] t1 t0; - reg u64 i; - reg u32 x y1 y2; - - ?{}, i = #set0_64(); - while(i < Li2_k * Li2_polydeg) { - x = v[i]; - y1, y2 = power2round(x); - t1[i] = y1; - t0[i] = y2; - i += 1; - } - - return t1, t0; -} - -inline -fn sum_vecs(reg ptr u32[Li2_k * Li2_polydeg] v1 v2) - -> stack u32[Li2_k * Li2_polydeg] -{ - stack u32[Li2_k * Li2_polydeg] vsum; - inline int i; - reg ptr u32[Li2_polydeg] v1_term v2_term vsum_term; - - for i = 0 to Li2_k { - v1_term = v1[Li2_polydeg * i : Li2_polydeg]; - v2_term = v2[Li2_polydeg * i : Li2_polydeg]; - vsum_term = vsum[Li2_polydeg * i : Li2_polydeg]; - vsum_term = poly_add(v1_term, v2_term, vsum_term); - vsum[Li2_polydeg * i : Li2_polydeg] = vsum_term; - } - return vsum; -} - -inline -fn sum_vecl(stack u32[Li2_l * Li2_polydeg] v1 v2) - -> stack u32[Li2_l * Li2_polydeg] -{ - stack u32[Li2_l * Li2_polydeg] vsum; - inline int i; - reg ptr u32[Li2_polydeg] v1_term v2_term vsum_term; - - for i = 0 to Li2_l { - v1_term = v1[Li2_polydeg * i : Li2_polydeg]; - v2_term = v2[Li2_polydeg * i : Li2_polydeg]; - vsum_term = vsum[Li2_polydeg * i : Li2_polydeg]; - vsum_term = poly_add(v1_term, v2_term, vsum_term); - vsum[Li2_polydeg * i : Li2_polydeg] = vsum_term; - } - return vsum; -} - -inline -fn subtract_vecl(stack u32[Li2_l * Li2_polydeg] v1 v2) - -> stack u32[Li2_l * Li2_polydeg] -{ - stack u32[Li2_l * Li2_polydeg] vdiff; - inline int i; - reg ptr u32[Li2_polydeg] v1_term v2_term vdiff_term; - - for i = 0 to Li2_l { - v1_term = v1[Li2_polydeg * i : Li2_polydeg]; - v2_term = v2[Li2_polydeg * i : Li2_polydeg]; - vdiff_term = vdiff[Li2_polydeg * i : Li2_polydeg]; - vdiff_term = poly_subtract(v1_term, v2_term, vdiff_term); - vdiff[Li2_polydeg * i : Li2_polydeg] = vdiff_term; - } - return vdiff; -} - -inline -fn subtract_veck(stack u32[Li2_k * Li2_polydeg] v1 v2) - -> stack u32[Li2_k * Li2_polydeg] -{ - stack u32[Li2_k * Li2_polydeg] vdiff; - inline int i; - reg ptr u32[Li2_polydeg] v1_term v2_term vdiff_term; - - for i = 0 to Li2_k { - v1_term = v1[Li2_polydeg * i : Li2_polydeg]; - v2_term = v2[Li2_polydeg * i : Li2_polydeg]; - vdiff_term = vdiff[Li2_polydeg * i : Li2_polydeg]; - vdiff_term = poly_subtract(v1_term, v2_term, vdiff_term); - vdiff[Li2_polydeg * i : Li2_polydeg] = vdiff_term; - } - return vdiff; -} - - -inline -fn dot_prod_vecs(stack u32[Li2_l * Li2_polydeg] v1 v2, reg ptr u32[Li2_polydeg] dotprod) - -> reg ptr u32[Li2_polydeg] -{ - stack u32[Li2_polydeg] term_prod; - reg ptr u32[Li2_polydeg] term_prod_rsp; - - reg ptr u32[Li2_polydeg] v1_term v2_term; - - inline int i; - - dotprod = zero_poly(dotprod); - for i = 0 to Li2_l { - v1_term = v1[Li2_polydeg * i : Li2_polydeg]; - v2_term = v2[Li2_polydeg * i : Li2_polydeg]; - term_prod_rsp = term_prod; - term_prod_rsp = poly_pointwise_montgomery(v1_term, v2_term, term_prod_rsp); - dotprod = poly_accumulate(term_prod_rsp, dotprod); - term_prod = term_prod_rsp; - } - - return dotprod; -} - -inline -fn mult_mat_vec(reg ptr u32[Li2_k * Li2_l * Li2_polydeg] mat, - reg ptr u32[Li2_l * Li2_polydeg] vec) - -> stack u32[Li2_k * Li2_polydeg] -{ - stack u32[Li2_k * Li2_polydeg] out; - reg ptr u32[Li2_polydeg] out_rsp; - - inline int i; - for i = 0 to Li2_k { - out_rsp = out[Li2_polydeg * i : Li2_polydeg]; - out_rsp = dot_prod_vecs( - mat[Li2_l * Li2_polydeg * i : Li2_l * Li2_polydeg], - vec, out_rsp); - out[Li2_polydeg * i : Li2_polydeg] = out_rsp; - } - - return out; -} - -inline -fn pointwise_mont_mult(reg ptr u32[Li2_polydeg] f g fg) - -> reg ptr u32[Li2_polydeg] -{ - reg u64 i; - reg u32 v32; - reg u64 result gv_64; - reg u32 prod_redc; - ?{}, i = #set0_64(); - while(i < Li2_polydeg) { - v32 = f[i]; - result = (64s) v32; - v32 = g[i]; - gv_64 = (64s) v32; - result *= gv_64; - prod_redc = montgomery_REDC(result); - fg[i] = prod_redc; - i += 1; - } - return fg; -} - -// why am I doing this again? -inline -fn deep_copy_vecl(reg ptr u32[Li2_l * Li2_polydeg] vec) - -> stack u32[Li2_l * Li2_polydeg] -{ - stack u32[Li2_l * Li2_polydeg] dest; - reg u64 i; - reg u32 entry; - - ?{}, i = #set0_64(); - while(i < Li2_l * Li2_polydeg) { - entry = vec[i]; - dest[i] = entry; - i += 1; - } - return dest; -} - -inline -fn decompose_vec(reg ptr u32[Li2_k * Li2_polydeg] vec) - -> stack u32[Li2_k * Li2_polydeg], stack u32[Li2_k * Li2_polydeg] -{ - stack u32[Li2_k * Li2_polydeg] vec0 vec1; - reg u64 i; - reg u64 addr; - reg u32 a a0 a1; - - ?{}, i = #set0_64(); - while(i < Li2_k * Li2_polydeg) { - addr = i; - a = vec[addr]; - - a0, a1 = decompose(a); - - addr = i; - vec0[addr] = a0; - vec1[addr] = a1; - - i += 1; - } - - return vec0, vec1; -} - -inline -fn checknorm_veck(reg ptr u32[Li2_k * Li2_polydeg] vec, inline int threshold) - -> stack u8 -{ - reg u8 result; - stack u8 result_s; - stack u8 r; - reg u8 c; - inline int ii; - - result = 0; - for ii = 0 to Li2_k { - r = poly_checknorm(vec[ii * Li2_polydeg : Li2_polydeg], threshold); - c = r; - result |= c; - } - - result_s = result; - return result_s; -} - -inline -fn checknorm_vecl(reg ptr u32[Li2_l * Li2_polydeg] vec, inline int threshold) - -> stack u8 -{ - reg ptr u32[Li2_polydeg] vec_elem; - stack u8 result_s; - reg u8 result; - - stack u8 r; - reg u8 c; - - inline int ii; - - result = 0; - for ii = 0 to Li2_l { - vec_elem = vec[ii * Li2_polydeg : Li2_polydeg]; - r = poly_checknorm(vec_elem, threshold); - c = r; - result |= c; - } - - result_s = result; - return result_s; -} - -inline -fn mult_scalar_vec(reg ptr u32[Li2_polydeg] f, - reg ptr u32[Li2_l * Li2_polydeg] vec) - -> stack u32[Li2_l * Li2_polydeg] -{ - stack u32[Li2_l * Li2_polydeg] fvec; - - inline int ii; - reg ptr u32[Li2_polydeg] fg g; - - for ii = 0 to Li2_l { - fg = fvec[ii * Li2_polydeg : Li2_polydeg]; - g = vec[ii * Li2_polydeg : Li2_polydeg]; - fg = poly_pointwise_montgomery(f, g, fg); - fvec[ii * Li2_polydeg : Li2_polydeg] = fg; - } - - return fvec; -} - -inline -fn mult_scalar_veck(reg ptr u32[Li2_polydeg] f, - reg ptr u32[Li2_k * Li2_polydeg] vec) - -> stack u32[Li2_k * Li2_polydeg] -{ - stack u32[Li2_k * Li2_polydeg] fvec; - - inline int ii; - reg ptr u32[Li2_polydeg] fg g; - - for ii = 0 to Li2_k { - fg = fvec[ii * Li2_polydeg : Li2_polydeg]; - g = vec[ii * Li2_polydeg : Li2_polydeg]; - fg = poly_pointwise_montgomery(f, g, fg); - fvec[ii * Li2_polydeg : Li2_polydeg] = fg; - } - - return fvec; -} - -inline -fn polyveck_make_hint(reg ptr u32[Li2_k * Li2_polydeg] v0 v1) - -> stack u32, stack u32[Li2_k * Li2_polydeg] -{ - stack u32 total_weight weight_comp; - reg u32 reg_weight_comp; - reg u32 reg_total_weight; - stack u32[Li2_k * Li2_polydeg] hints; - - inline int i; - reg ptr u32[Li2_polydeg] hints_comp v0_comp v1_comp; - - total_weight = 0; - for i = 0 to Li2_k { - v0_comp = v0[i * Li2_polydeg : Li2_polydeg]; - v1_comp = v1[i * Li2_polydeg : Li2_polydeg]; - hints_comp = hints[i * Li2_polydeg : Li2_polydeg]; - - weight_comp, hints_comp = poly_make_hint(v0_comp, v1_comp, hints_comp); - - reg_weight_comp = weight_comp; - reg_total_weight = total_weight; - reg_total_weight += reg_weight_comp; - total_weight = reg_total_weight; - - hints[i * Li2_polydeg : Li2_polydeg] = hints_comp; - } - - return total_weight, hints; -} - -inline -fn polyvecl_caddq(reg ptr u32[Li2_l * Li2_polydeg] vec) - -> reg ptr u32[Li2_l * Li2_polydeg] -{ - inline int ii; - for ii = 0 to Li2_l { - vec[ii * Li2_polydeg : Li2_polydeg] = - poly_caddq(vec[ii * Li2_polydeg : Li2_polydeg]); - } - return vec; -} - -inline -fn polyveck_caddq(reg ptr u32[Li2_k * Li2_polydeg] vec) - -> reg ptr u32[Li2_k * Li2_polydeg] -{ - inline int ii; - for ii = 0 to Li2_k { - vec[ii * Li2_polydeg : Li2_polydeg] = - poly_caddq(vec[ii * Li2_polydeg : Li2_polydeg]); - } - return vec; -} - -/* -inline -fn polyvec_use_hint(reg ptr u32[Li2_k * Li2_polydeg] u hints) - -> stack u32[Li2_k * Li2_polydeg] -{ - reg ptr u32[Li2_polydeg] hints_comp u_comp; - inline int i; - stack u32 result_comp; - stack u32[Li2_k * Li2_polydeg] result; - - for i = 0 to Li2_k { - hints_comp = hints[i * Li2_polydeg : Li2_polydeg]; - u_comp = u[i * Li2_polydeg : Li2_polydeg]; - result_comp = poly_use_hint(hints_comp, u_comp); - result[i * Li2_polydeg : Li2_polydeg] = result_comp; - } - return result; -} -*/ diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/sign_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/sign_end.jinc deleted file mode 100644 index fb90c07a..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/avx2/sign_end.jinc +++ /dev/null @@ -1,238 +0,0 @@ - -inline -fn compute_mu(reg u64 ptr_m, reg u64 m_len, reg ptr u8[Li2_SK_LEN] sk) - -> stack u8[64] -{ - stack u8[64] mu; - mu = hash_tr_m(sk[64:32], m_len, ptr_m); - return mu; -} - -inline -fn compute_rho_prime(reg ptr u8[32] k, reg ptr u8[64] mu) - -> stack u8[64] -{ - stack u8[64] rho_prime; - reg u8 c; - reg u64 i; - stack u64[25] state; - reg u64 mu_loc; - - state = st0(state); - ?{}, i = #set0_64(); - while(i < 32) { - c = k[i]; - state[:u8 i] = c; - i += 1; - } - while(i < 96) { - mu_loc = i; - mu_loc -= 32; - c = mu[mu_loc]; - state[:u8 i] = c; - i += 1; - } - - state[:u8 96] ^= 0x1f; - state[:u8 SHAKE256_RATE - 1] ^= 0x80; - - state = __keccakf1600_ref(state); - - ?{}, i = #set0_64(); - while(i < 64) { - c = state[:u8 i]; - rho_prime[i] = c; - i += 1; - } - return rho_prime; -} - -inline -fn sign_inner(reg u64 ptr_m, - reg u64 m_len, - reg ptr u8[Li2_SK_LEN] sk) - -> stack u8[Li2_SIGN_LEN], stack u32 -{ - stack u8[Li2_SIGN_LEN] signature; - - // parts of sk - stack u32[Li2_l * Li2_polydeg] s1; - stack u32[Li2_k * Li2_polydeg] s2; - stack u32[Li2_k * Li2_polydeg] t0; - - // automatic variables in spec - stack u32[Li2_k * Li2_l * Li2_polydeg] fft_matA; - stack u8[64] mu; - stack u16 kappa; - reg u16 kappa_reg; - stack u8[64] rho_prime; - stack u32[Li2_l * Li2_polydeg] z; - stack u32[Li2_k * Li2_polydeg] h; - // w probably isn't necessary - can use w1 wherever w appears? - stack u32[Li2_k * Li2_polydeg] w0 w1; - stack u8[Li2_pack_w1len] packed_w1; - stack u32[Li2_k * Li2_polydeg] r0; - - // c-tilde unnecessary - // can just use signature[0:32] - // might need to redo pack_signature though - // not sure if pack_sig will go through otherwise - // with input and output overlapping - stack u8[32] c_tilde; - - //from SampleInBall - stack u32[Li2_polydeg] challenge; - - // done: nonzero when we have finished the rejection-sampling loop - stack u8 done; - // attempt: abort with error if we have tried too many times - stack u16 attempt; - // return status: ok == 0, err == -1 - stack u32 status; - // temporary bools used for while loop condition - reg bool tmpbool; - reg bool zf; - reg u8 tmpboolu8; - - // extra intermediate values - // not space-efficient... - // but this is reference impl so we're fine? - stack u32[4 * Li2_polydeg] expandMask_buffer; - stack u64 expandMask_buffer_offset; - stack u32[Li2_l * Li2_polydeg] y; - stack u32[Li2_k * Li2_polydeg] w; - stack u32[Li2_l * Li2_polydeg] fft_y; - stack u32[Li2_l * Li2_polydeg] cs1; - stack u32[Li2_k * Li2_polydeg] cs2; - stack u32[Li2_k * Li2_polydeg] ct0; - stack u32[Li2_k * Li2_polydeg] r0_plus_ct0; - - stack u32 hints_weight; - stack u8 normcheck_result; - - s1, s2, t0 = unpack_sk(sk); - mu = compute_mu(ptr_m, m_len, sk); - rho_prime = compute_rho_prime(sk[32:32], mu); - - fft_matA = expandA(sk[0:32]); - - s1 = fft_vec(s1); - s2 = fft_veck(s2); - t0 = fft_veck(t0); - - expandMask_buffer_offset = 4; - kappa = 0; - done = 0; - attempt = 1; - status = -1; - while { - // The probability of a single attempt failing is, according to - // Equation (5) from the spec approximate to - // - // Pr[reject] = 1 - exp[ -256*beta * (l/gamma1 + k/gamma2) ] - // - // We can rewrite this equation in order to find the number of attempts - // for which the probability becomes so small that we should not - // expect that it ever happens: - // - // 128 - // #attempts = - --------------- - // log2 Pr[reject] - // - // The resulting value for the maximum number of attempts is set in - // the Li2_max_attempts param. - tmpbool = attempt > Li2_max_attempts; - tmpboolu8 = #SETcc(tmpbool); - tmpboolu8 |= done; - _, _, _, _, zf = #TEST_8(tmpboolu8, tmpboolu8); - } (zf) { - attempt += 1; - - kappa_reg = kappa; - y, expandMask_buffer, expandMask_buffer_offset = expandMask_buffered( - rho_prime, kappa_reg, expandMask_buffer, expandMask_buffer_offset); - kappa += Li2_l; - - fft_y = deep_copy_vecl(y); - fft_y = fft_vec(fft_y); - w = mult_mat_vec(fft_matA, fft_y); - w = reduce32_veck(w); - w = ifft_to_mont_vec(w); - - w = polyveck_caddq(w); - w0, w1 = decompose_vec(w); - packed_w1 = pack_w1(w1); - - c_tilde = hash_mu_w1(mu, packed_w1); - - challenge = sampleInBall(challenge, c_tilde); - challenge = fft(challenge); - - cs1 = mult_scalar_vec(challenge, s1); - cs1 = ifft_to_mont_vecl(cs1); - z = sum_vecl(cs1, y); - z = reduce32_vecl(z); - normcheck_result = checknorm_vecl(z, (int) (Li2_gamma1 - Li2_beta)); - - if(normcheck_result == 0) { - cs2 = mult_scalar_veck(challenge, s2); - cs2 = ifft_to_mont_vec(cs2); - r0 = subtract_veck(w0, cs2); - w0 = reduce32_veck(w0); - normcheck_result = checknorm_veck(r0, (int) (Li2_gamma2 - Li2_beta)); - if(normcheck_result == 0) { - ct0 = mult_scalar_veck(challenge, t0); - ct0 = ifft_to_mont_vec(ct0); - ct0 = reduce32_veck(ct0); - normcheck_result = checknorm_veck(ct0, Li2_gamma2); - if(normcheck_result == 0) { - r0_plus_ct0 = sum_vecs(r0, ct0); - - hints_weight, h = polyveck_make_hint(r0_plus_ct0, w1); - if(hints_weight < Li2_omega) { - done = 1; - status = 0; - } - } - } - } - } - - signature = pack_signature(c_tilde, z, h); - return signature, status; -} - -inline -fn sign(reg u64 ptr_signature, reg u64 ptr_m, reg u64 m_len, reg u64 ptr_sk) -> stack u32 { - stack u8[Li2_SK_LEN] sk; - reg u8 c; - stack u32 status; - reg u64 i; - stack u8[Li2_SIGN_LEN] signature; - - stack u64 s_ptr_signature; - reg u64 sig_addr; - - // spilling this - s_ptr_signature = ptr_signature; - - ?{}, i = #set0_64(); - while(i < Li2_SK_LEN) { - c = [:u8 ptr_sk + i]; - sk[i] = c; - i += 1; - } - - signature, status = sign_inner(ptr_m, m_len, sk); - - sig_addr = s_ptr_signature; - - ?{}, i = #set0_64(); - while(i < Li2_SIGN_LEN) { - c = signature[i]; - [:u8 sig_addr + i] = c; - i += 1; - } - - return status; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandA_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandA_end.jinc deleted file mode 100644 index 411667d9..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandA_end.jinc +++ /dev/null @@ -1,86 +0,0 @@ -require "fips202.jinc" - -inline -fn expandA_poly(reg ptr u8[32] rho, inline int i, inline int j, - reg ptr u32[Li2_polydeg] result) -> reg ptr u32[Li2_polydeg] -{ - stack u32 term; - stack u8[3] vs; - reg u32 value v; - reg u64 offset; - stack u64[25] state; - reg ptr u64[25] state_rsp; - inline int k; - reg u8 c; - reg u64 addr; - - stack u8[34] seed; - reg ptr u8[34] seed_rsp; - for k = 0 to 32 { - c = rho[k]; - seed[k] = c; - } - seed[32] = j; - seed[33] = i; - - state_rsp = state; - seed_rsp = seed; - state_rsp = shake128_absorb34(state_rsp, seed_rsp); - state_rsp = __keccakf1600_ref(state_rsp); - - offset = 0; - term = 0; - while(term < Li2_polydeg) { - for k = 0 to 3 { - if(offset >= SHAKE128_RATE) { - state_rsp = __keccakf1600_ref(state_rsp); - offset = 0; - } - c = state_rsp[:u8 offset]; - vs[k] = c; - offset += 1; - } - - //remove highest bit - c = vs[2]; - c &= 127; - vs[2] = c; - - //assemble value in little endian - value = (32u) vs[2]; - for k = 1 to 3 { - value <<= 8; - v = (32u) vs[2 - k]; - value += v; - } - - if(value < Li2_q) { - addr = (64u) term; - result[addr] = value; - term += 1; - } - } - - return result; -} - -inline -fn expandA(stack u8[32] rho) -> stack u32[Li2_k * Li2_l * Li2_polydeg] -{ - reg ptr u8[32] rho_rsp; - reg ptr u32[Li2_polydeg] poly; - stack u32[Li2_k * Li2_l * Li2_polydeg] matrix; - - inline int i j; - - for i = 0 to Li2_k { - for j = 0 to Li2_l { - rho_rsp = rho; - poly = matrix[(i * Li2_l + j) * Li2_polydeg : Li2_polydeg]; - poly = expandA_poly(rho_rsp, i, j, poly); - matrix[(i * Li2_l + j) * Li2_polydeg : Li2_polydeg] = poly; - } - } - - return matrix; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandMask.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandMask.jinc deleted file mode 100644 index 74cfbd7a..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandMask.jinc +++ /dev/null @@ -1,107 +0,0 @@ -require "fips202.jinc" -require "packing.jinc" -require "params.jinc" - -inline -fn expandMask_poly_shake_init(stack u64[25] state, reg ptr u8[64] rho_prime, stack u16 kappa) - -> stack u64[25] { - reg u64 i; - reg u8 c; - reg u16 v; - - state = st0(state); - i = 0; - while(i < 64) { - c = rho_prime[i]; - state[:u8 i] = c; - i += 1; - } - - v = kappa; - v &= 255; - c = (8u) v; - state[:u8 64] = c; - - v = kappa; - v >>= 8; - c = (8u) v; - state[:u8 65] = c; - state[:u8 66] ^= 0x1f; - state[:u8 SHAKE256_RATE - 1] ^= 0x80; - - return state; -} - -inline -fn expandMask_poly_gamma1_217(reg ptr u32[Li2_polydeg] f, reg ptr u8[64] rho_prime, stack u16 kappa) - -> reg ptr u32[Li2_polydeg] -{ - reg u64 i; - reg u8 c; - stack u64[25] state; - stack u8[(Li2_pack_zlen_gamma1_217 / SHAKE256_RATE) * SHAKE256_RATE + SHAKE256_RATE] y_packed; - stack u64 y_loc; - stack u64 output_squeeze_counter; - reg u64 addr; - - state = expandMask_poly_shake_init(state, rho_prime, kappa); - - y_loc = 0; - output_squeeze_counter = 0; - while(output_squeeze_counter < (Li2_pack_zlen_gamma1_217 / SHAKE256_RATE + 1)) { - state = __keccakf1600_ref(state); - - i = 0; - while(i < SHAKE256_RATE) { - addr = i; - c = state[:u8 addr]; - addr = y_loc; - y_packed[addr] = c; - y_loc += 1; - i += 1; - } - - output_squeeze_counter += 1; - } - - f = polyz_unpack_gamma1_217(f, y_packed[0 : Li2_pack_zlen_gamma1_217]); - - return f; -} - -inline -fn expandMask_poly_gamma1_219(reg ptr u32[Li2_polydeg] f, reg ptr u8[64] rho_prime, stack u16 kappa) - -> reg ptr u32[Li2_polydeg] -{ - reg u64 i; - reg u8 c; - stack u64[25] state; - stack u8[(Li2_pack_zlen_gamma1_219 / SHAKE256_RATE) * SHAKE256_RATE + SHAKE256_RATE] y_packed; - stack u64 y_loc; - stack u64 output_squeeze_counter; - reg u64 addr; - - state = expandMask_poly_shake_init(state, rho_prime, kappa); - - y_loc = 0; - output_squeeze_counter = 0; - while(output_squeeze_counter < (Li2_pack_zlen_gamma1_219 / SHAKE256_RATE + 1)) { - state = __keccakf1600_ref(state); - - i = 0; - while(i < SHAKE256_RATE) { - addr = i; - c = state[:u8 addr]; - addr = y_loc; - y_packed[addr] = c; - y_loc += 1; - i += 1; - } - - output_squeeze_counter += 1; - } - - f = polyz_unpack_gamma1_219(f, y_packed[0 : Li2_pack_zlen_gamma1_219]); - - return f; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandMask_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandMask_end.jinc deleted file mode 100644 index 299c576b..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandMask_end.jinc +++ /dev/null @@ -1,20 +0,0 @@ -inline -fn expandMask(reg ptr u8[64] rho_prime, reg u16 nonce) - -> stack u32[Li2_l * Li2_polydeg] -{ - stack u32[Li2_l * Li2_polydeg] y; - inline int i; - stack u16 kappa; - reg u16 v; - reg ptr u32[Li2_polydeg] poly; - for i = 0 to Li2_l { - v = nonce; - v *= Li2_l; - v += i; - kappa = v; - poly = y[Li2_polydeg * i : Li2_polydeg]; - poly = expandMask_poly(poly, rho_prime, kappa); - y[Li2_polydeg * i : Li2_polydeg] = poly; - } - return y; -} \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandS.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandS.jinc deleted file mode 100644 index 68eec895..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandS.jinc +++ /dev/null @@ -1,144 +0,0 @@ -require "params.jinc" - -inline -fn expandSEta2_poly(stack u8[64] rho_prime, reg u16 elem_idx, reg ptr u32[Li2_polydeg] poly) - -> reg ptr u32[Li2_polydeg] -{ - reg u64 coeffs_generated; - - // SHA3 state - stack u64[25] state; - reg u64 offset; - - // temps - reg u64 i; - - reg u8 c; - reg u32 c32 t0 t1; - - state = st0(state); - - i = 0; - while(i < 64) { - c = rho_prime[i]; - state[:u8 i] = c; - i += 1; - } - c = (8u) elem_idx; - state[:u8 64] = c; - state[:u8 65] = 0; - state[:u8 66] = 0x1F; - state[:u8 SHAKE256_RATE - 1] = 0x80; - - state = __keccakf1600_ref(state); - coeffs_generated = 0; - ?{}, offset = #set0_64(); - while (coeffs_generated < Li2_polydeg) { - if (offset >= SHAKE256_RATE) { - state = __keccakf1600_ref(state); - ?{}, offset = #set0_64(); - } - - t0 = (32u)state[:u8 offset]; - t1 = t0; - offset += 1; - - // t0 = buf[pos] & 0x0F; - t0 &= 0x0F; - if t0 < 15 { - // t0 = t0 - (205*t0 >> 10)*5; - // a[ctr++] = 2 - t0; - c32 = t0; - c32 *= 205; - c32 >>= 10; - c32 = #LEA_32(4 * c32 + c32); - t0 -= 2; - c32 -= t0; - poly[coeffs_generated] = c32; - coeffs_generated += 1; - } - if coeffs_generated < Li2_polydeg { - t0 = t1 >> 4; - if t0 < 15 { - // t0 = t0 - (205*t0 >> 10)*5; - // a[ctr++] = 2 - t0; - c32 = t0; - c32 *= 205; - c32 >>= 10; - c32 = #LEA_32(4 * c32 + c32); - t0 -= 2; - c32 -= t0; - poly[coeffs_generated] = c32; - coeffs_generated += 1; - } - } - } - return poly; -} - -inline -fn expandSEta4_poly(stack u8[64] rho_prime, reg u16 elem_idx, reg ptr u32[Li2_polydeg] poly) - -> reg ptr u32[Li2_polydeg] -{ - reg u64 coeffs_generated; - - // SHA3 state - stack u64[25] state; - reg u64 offset; - - // temps - reg u64 i; - reg u8 c1; - reg u32 v; - - reg u8 c; - reg u32 c32; - - state = st0(state); - - ?{}, i = #set0_64(); - while(i < 64) { - c1 = rho_prime[i]; - state[:u8 i] = c1; - i += 1; - } - c = (8u) elem_idx; - state[:u8 64] = c; - state[:u8 65] = 0; - state[:u8 66] = 0x1F; - state[:u8 SHAKE256_RATE - 1] = 0x80; - - state = __keccakf1600_ref(state); - ?{}, coeffs_generated = #set0_64(); - ?{}, offset = #set0_64(); - while (coeffs_generated < Li2_polydeg) { - if(offset >= SHAKE256_RATE) { - state = __keccakf1600_ref(state); - ?{}, offset = #set0_64(); - } - - c = state[:u8 offset]; - offset += 1; - - c32 = (32u) c; - c32 &= 0x0F; - if (c32 < 9) { - v = 4; - v -= c32; - poly[coeffs_generated] = v; - coeffs_generated += 1; - } - - if (coeffs_generated < Li2_polydeg) { - c32 = (32u) c; - c32 >>= 4; - if(c32 < 9) { - v = 4; - v -= c32; - poly[coeffs_generated] = v; - coeffs_generated += 1; - } - } - } - return poly; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandS_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandS_end.jinc deleted file mode 100644 index 6cfcf364..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/expandS_end.jinc +++ /dev/null @@ -1,28 +0,0 @@ - -//reminder to self -//param int SHAKE256_RATE = 136; - -inline -fn expandS(stack u8[64] rho_prime) - -> stack u32[Li2_l * Li2_polydeg], stack u32[Li2_k * Li2_polydeg] -{ - reg ptr u32[Li2_polydeg] entry; - stack u32[Li2_l * Li2_polydeg] s1; - stack u32[Li2_k * Li2_polydeg] s2; - - inline int i; - - for i = 0 to Li2_l { - entry = s1[Li2_polydeg * i : Li2_polydeg]; - entry = expandS_poly(rho_prime, i, entry); - s1[Li2_polydeg * i : Li2_polydeg] = entry; - } - - for i = 0 to Li2_k { - entry = s2[Li2_polydeg * i : Li2_polydeg]; - entry = expandS_poly(rho_prime, Li2_l + i, entry); - s2[Li2_polydeg * i : Li2_polydeg] = entry; - } - - return s1, s2; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/fips202.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/fips202.jinc deleted file mode 100644 index 5ab2e7c4..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/fips202.jinc +++ /dev/null @@ -1,229 +0,0 @@ -/* -- Stolen and modified from the Kyber repo -- */ - -param int SHAKE128_RATE = 168; -param int SHAKE256_RATE = 136; - -inline -fn index(inline int x, inline int y) -> inline int { - inline int r; - r = (x % 5) + 5 * (y % 5); - return r; -} - -inline -fn theta(reg ptr u64[25] a) -> reg ptr u64[25] { - inline int x, y; - reg u64[5] c, d; - - for x = 0 to 5 { - c[x] = 0; - for y = 0 to 5 { - c[x] ^= a[x + 5 * y]; - } - } - - for x = 0 to 5 { - d[x] = c[(x + 1) % 5]; - ?{}, d[x] = #ROL_64(d[x], 1); - d[x] ^= c[(x + 4) % 5]; - } - - for x = 0 to 5 { - for y = 0 to 5 { - a[x + 5 * y] ^= d[x]; - } - } - - return a; -} - - -inline -fn keccakRhoOffsets(inline int i) -> inline int { - inline int r, x, y, z, t; - - r = 0; - x = 1; - y = 0; - for t = 0 to 24 { - if (i == x + 5 * y) { - r = ((t + 1) * (t + 2) / 2) % 64; - } - z = (2 * x + 3 * y) % 5; - x = y; - y = z; - } - - return r; -} - - -inline -fn rho(reg ptr u64[25] a) -> reg ptr u64[25] { - inline int x, y, i, z; - - for x = 0 to 5 { - for y = 0 to 5 { - i = index(x, y); - z = keccakRhoOffsets(i); - _, _, a[i] = #ROL_64(a[i], z); - } - } - - return a; -} - - -inline -fn pi(reg ptr u64[25] a) -> reg ptr u64[25] { - stack u64[25] b; - reg u64 t; - inline int x, y, i; - for i = 0 to 25 { t = a[i]; b[i] = t; } - - for x = 0 to 5 { - for y = 0 to 5 { - t = b[x + 5 * y]; - i = index(y, 2 * x + 3 * y); - a[i] = t; - } - } - return a; -} - -inline -fn chi(reg ptr u64[25] a) -> reg ptr u64[25] { - inline int x, y, i; - reg u64[5] c; - for y = 0 to 5 { - for x = 0 to 5 { - i = index(x + 1, y); - c[x] = a[i]; - c[x] = !c[x]; - i = index(x + 2, y); - c[x] &= a[i]; - i = index(x, y); - c[x] ^= a[i]; - } - for x = 0 to 5 { - a[x + 5 * y] = c[x]; - } - } - return a; -} - -inline -fn iota(reg ptr u64[25] a, reg u64 c) -> reg ptr u64[25] { - a[0] ^= c; - return a; -} - -u64[24] roundconstants = {0x0000000000000001, 0x0000000000008082, 0x800000000000808a, 0x8000000080008000, - 0x000000000000808b, 0x0000000080000001, 0x8000000080008081, 0x8000000000008009, - 0x000000000000008a, 0x0000000000000088, 0x0000000080008009, 0x000000008000000a, - 0x000000008000808b, 0x800000000000008b, 0x8000000000008089, 0x8000000000008003, - 0x8000000000008002, 0x8000000000000080, 0x000000000000800a, 0x800000008000000a, - 0x8000000080008081, 0x8000000000008080, 0x0000000080000001, 0x8000000080008008}; - -fn __keccakf1600_ref(reg ptr u64[25] state) -> reg ptr u64[25] { - reg ptr u64[24] constptr; - - reg u64 rctr; - reg u64 c; - - // TODO: want to use this one instead of the one inside the loop... - // but I get one-varmap error if I do that. - // constptr = roundconstants; - ?{}, rctr = #set0_64(); - while (rctr < 192) { - state = theta(state); - state = rho(state); - state = pi(state); - state = chi(state); - constptr = roundconstants; - c = constptr.[rctr]; - state = iota(state, c); - rctr += 8; - } - - return state; -} - - -inline -fn st0(reg ptr u64[25] state) -> reg ptr u64[25] -{ - inline int i; - - for i = 0 to 25 { - state[i] = 0; - } - - return state; -} - -fn shake128_absorb34(reg ptr u64[25] state, reg const ptr u8[34] in) -> reg ptr u64[25] -{ - reg u8 c; - inline int i; - - state = st0(state); - // TODO: Inefficient to load one byte at a time. Optimize this. - for i = 0 to 34 { - c = in[i]; - state[:u8 i] ^= c; - } - state[:u8 34] ^= 0x1f; - state[:u8 SHAKE128_RATE - 1] ^= 0x80; - - return state; -} - -/* -- end content from Kyber repo -- */ - -/* -- Below are added for Dilithium -- */ - -// Dilithium keygen inputs 32 bytes to SHAKE256 -inline -fn shake256_absorb32(stack u8[32] in) -> stack u64[25] -{ - reg u8 c; - inline int i; - stack u64[25] state; - reg ptr u64[25] state_rsp; - - state_rsp = state; - state_rsp = st0(state_rsp); - // TODO: Inefficient to load one byte at a time. Optimize this. - for i = 0 to 32 { - c = in[i]; - state_rsp[:u8 i] ^= c; - } - - state_rsp[:u8 32] ^= 0x1f; - state_rsp[:u8 SHAKE256_RATE - 1] ^= 0x80; - - state = state_rsp; - return state; -} - -//Maybe should allow squeezing partial blocks -//for performance? -inline -fn shake256_squeezeblock(stack u64[25] state, stack u8[SHAKE256_RATE] out) - -> stack u64[25], stack u8[SHAKE256_RATE] -{ - reg u8 c; - reg u64 i; - - state = __keccakf1600_ref(state); - - ?{}, i = #set0_64(); - while(i < SHAKE256_RATE) { - c = state[:u8 i]; - out[i] = c; - i += 1; - } - - return state, out; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/hashing_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/hashing_end.jinc deleted file mode 100644 index 44f525dc..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/hashing_end.jinc +++ /dev/null @@ -1,249 +0,0 @@ -require "rounding.jinc" - -inline -fn shake256_consider_permute(reg ptr u64[25] state, reg u64 offset) -> reg ptr u64[25], reg u64 { - if (offset >= SHAKE256_RATE) { - state = __keccakf1600_ref(state); - ?{}, offset = #set0_64(); - } - return state, offset; -} - -inline -fn shake256_of_pk(reg ptr u8[Li2_PK_LEN] pk, reg ptr u8[32] out) - -> reg ptr u8[32] -{ - // FIXME: This function is smelly and should check more consistently - // whether the SHA3 buffer is full. - stack u64[25] state; - reg ptr u64[25] state_rsp; - stack u64 ptr_pk; - stack u64 ptr_state; - - reg u64 addr; - reg u8 c; - - state_rsp = state; - state_rsp = st0(state_rsp); - - ptr_pk = 0; - - while(ptr_pk < Li2_PK_LEN - SHAKE256_RATE) { - ptr_state = 0; - while(ptr_state < SHAKE256_RATE) { - addr = ptr_pk; - c = pk[addr]; - - addr = ptr_state; - state_rsp[:u8 addr] ^= c; - - ptr_pk += 1; - ptr_state += 1; - } - state_rsp = __keccakf1600_ref(state_rsp); - } - - ptr_state = 0; - while(ptr_pk < Li2_PK_LEN) { - addr = ptr_pk; - c = pk[addr]; - - addr = ptr_state; - state_rsp[:u8 addr] ^= c; - - ptr_pk += 1; - ptr_state += 1; - } - - addr = ptr_state; - state_rsp[:u8 addr] ^= 0x1f; - state_rsp[:u8 SHAKE256_RATE-1] ^= 0x80; - - state_rsp = __keccakf1600_ref(state_rsp); - - // Extract... - - addr = 0; - while(addr < 32) { - c = state_rsp[:u8 addr]; - out[addr] = c; - addr += 1; - } - return out; -} - -// TODO can simplify signature -inline -fn sampleInBall(reg ptr u32[Li2_polydeg] f, reg ptr u8[32] seed) - -> reg ptr u32[Li2_polydeg] -{ - stack u64[25] state; - reg ptr u64[25] state_rsp; - - reg u64 i; - reg u64 b; - reg u64 offset; - reg u64 signs; - inline int ii; - reg u8 c; - reg u64 v; - reg u32 v32 fb; - - state = shake256_absorb32(seed); - state_rsp = state; - state_rsp = __keccakf1600_ref(state_rsp); - - signs = 0; - for ii = 0 to 8 { - c = state_rsp[:u8 ii]; - v = (64u) c; - v <<= 8 * ii; - signs |= v; - } - - offset = 8; - - i = 0; - while(i < Li2_polydeg) { - f[i] = 0; - i += 1; - } - - i = Li2_polydeg - Li2_tau; - while(i < Li2_polydeg) { - // do-while - while { - if(offset >= SHAKE256_RATE) { - state_rsp = __keccakf1600_ref(state_rsp); - offset = 0; - } - c = state_rsp[:u8 offset]; - b = (64u) c; - offset += 1; - } (b > i) - - v32 = f[b]; - f[i] = v32; - - //f[b] = 1 - 2 * (signs & 1); - v32 = (32u) signs; - v32 &= 1; - fb = 1; - fb -= v32; - fb -= v32; - f[b] = fb; - - signs >>= 1; - - i += 1; - } - - return f; -} - -inline -fn hash_tr_m(reg ptr u8[32] tr, reg u64 m_len, reg u64 m) - -> stack u8[64] -{ - // FIXME: This function is smelly and should check more consistently when - // the SHA3 buffer is full. - stack u8[64] mu; - stack u64[25] state; - reg u8 c; - reg u64 offset; - reg u64 m_loc; - reg u64 space_required; - - state = st0(state); - offset = 0; - while(offset < 32) { - c = tr[offset]; - state[:u8 offset] ^= c; - offset += 1; - } - - m_loc = 0; - space_required = m_len; - space_required += 32; //edge case correction - while(space_required >= SHAKE256_RATE) { - while(offset < SHAKE256_RATE) { - c = [:u8 m + m_loc]; - state[:u8 offset] ^= c; - m_loc += 1; - offset += 1; - } - state = __keccakf1600_ref(state); - offset = 0; - space_required = m_len; - space_required -= m_loc; - } - - //last block - while(m_loc < m_len) { - c = [:u8 m + m_loc]; - state[:u8 offset] ^= c; - m_loc += 1; - offset += 1; - } - state[:u8 offset] ^= 0x1f; - state[:u8 SHAKE256_RATE-1] ^= 0x80; - - state = __keccakf1600_ref(state); - - offset = 0; - while(offset < 64) { - c = state[:u8 offset]; - mu[offset] = c; - offset += 1; - } - return mu; -} - -inline -fn hash_mu_w1(reg ptr u8[64] mu, reg ptr u8[Li2_pack_w1len] w1_packed) - -> stack u8[32] -{ - stack u8[32] c_tilde; - stack u64[25] state; - reg u8 c; - reg u64 offset; - reg u64 w1_loc; - - state = st0(state); - ?{}, offset = #set0_64(); - - // Absorb mu - while(offset < 64) { - state, offset = shake256_consider_permute(state, offset); - c = mu[offset]; - state[:u8 offset] ^= c; - offset += 1; - } - - // Absorb w1 - ?{}, w1_loc = #set0_64(); - while(w1_loc < Li2_pack_w1len) { - state, offset = shake256_consider_permute(state, offset); - c = w1_packed[w1_loc]; - state[:u8 offset] ^= c; - w1_loc += 1; - offset += 1; - } - - // Absorb separator byte - state, offset = shake256_consider_permute(state, offset); - state[:u8 offset] ^= 0x1f; - - // Finish - state, offset = shake256_consider_permute(state, offset); - state[:u8 SHAKE256_RATE-1] ^= 0x80; - state = __keccakf1600_ref(state); - ?{}, offset = #set0_64(); - - while(offset < 32) { - c = state[:u8 offset]; - c_tilde[offset] = c; - offset += 1; - } - return c_tilde; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/keygen_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/keygen_end.jinc deleted file mode 100644 index 4a98c0ea..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/keygen_end.jinc +++ /dev/null @@ -1,142 +0,0 @@ -require "fips202.jinc" - -inline -fn keygen_inner(reg ptr u8[32] random_zeta) - -> stack u8[Li2_PK_LEN], stack u8[Li2_SK_LEN] -{ - // keys - stack u8[Li2_PK_LEN] pk; - stack u8[Li2_SK_LEN] sk; - // PRF - stack u64[25] state; - stack u8[SHAKE256_RATE] s256_out; - // PRF outputs - stack u8[32] rho; - reg ptr u8[32] rho_rsp; - stack u8[64] rho_prime; - stack u8[32] k; - // FFTs - stack u32[Li2_k * Li2_l * Li2_polydeg] fft_matA; - stack u32[Li2_l * Li2_polydeg] s1; - reg ptr u32[Li2_l * Li2_polydeg] s1_rsp; - stack u32[Li2_k * Li2_polydeg] s2; - - stack u32[Li2_k * Li2_polydeg] t t1 t0; - - reg ptr u8[Li2_pack_s1len] s1_in_sk; - reg ptr u8[Li2_pack_s2len] s2_in_sk; - reg ptr u8[Li2_pack_t0len] t0_in_sk; - reg ptr u8[Li2_pack_t1len] t1_in_pk; - reg ptr u32[Li2_polydeg] t0_to_pack t1_to_pack; - - //temp variables - reg u64 i; - inline int j; - reg u8 c; - - state = shake256_absorb32(random_zeta); - state, s256_out = shake256_squeezeblock(state, s256_out); - - //TODO Maybe can load 8 bytes at a time using u64? - i = 0; - while(i < 32) { - c = s256_out[i]; - rho[i] = c; - i += 1; - } - while(i < 96) { - c = s256_out[i]; - rho_prime[i - 32] = c; - i += 1; - } - while(i < 128) { - c = s256_out[i]; - k[i - 96] = c; - i += 1; - } - - rho_rsp = rho; - sk[0:32] = rho_pack(rho_rsp, sk[0:32]); - sk[32:32] = rho_pack(k, sk[32:32]); - - s1, s2 = expandS(rho_prime); - - // save secret key - s1_rsp = s1; - s1_in_sk = sk[96 : Li2_pack_s1len]; - sk[96 : Li2_pack_s1len] = pack_s1(s1_rsp, s1_in_sk); - s2_in_sk = sk[Li2_pack_s2loc : Li2_pack_s2len]; - sk[Li2_pack_s2loc : Li2_pack_s2len] = pack_s2(s2, s2_in_sk); - - s1 = fft_vec(s1_rsp); - - rho_rsp = rho; - fft_matA = expandA(rho_rsp); - s1_rsp = s1; - t = mult_mat_vec(fft_matA, s1_rsp); - t = reduce32_veck(t); - t = ifft_to_mont_vec(t); - - t = sum_vecs(t, s2); - - t = polyveck_caddq(t); - t1, t0 = power2round_vec(t); - - rho_rsp = rho; - pk[0:32] = rho_pack(rho_rsp, pk[0:32]); - - for j = 0 to Li2_k { - t1_to_pack = t1[Li2_polydeg * j : Li2_polydeg]; - t1_in_pk = pk[32 + j * Li2_pack_t1len : Li2_pack_t1len]; - t1_in_pk = polyt1_pack(t1_to_pack , t1_in_pk); - pk[32 + j * Li2_pack_t1len : Li2_pack_t1len] = t1_in_pk; - } - - sk[64:32] = shake256_of_pk(pk, sk[64:32]); - - for j = 0 to Li2_k { - t0_to_pack = t0[Li2_polydeg * j : Li2_polydeg]; - t0_in_sk = sk[Li2_pack_t0loc + j * Li2_pack_t0len : Li2_pack_t0len]; - sk[Li2_pack_t0loc + j * Li2_pack_t0len : Li2_pack_t0len] = polyt0_pack(t0_to_pack, t0_in_sk); - } - - return pk, sk; -} - -//zeta is 32 bytes -inline -fn keygen(reg u64 pk_ptr sk_ptr) -{ - stack u64 pk_ptr_s sk_ptr_s; - - stack u8[Li2_PK_LEN] pk; - stack u8[Li2_SK_LEN] sk; - stack u8[32] random_zeta; - reg ptr u8[32] random_zeta_p; - reg u8 c; - reg u64 i; - - pk_ptr_s = pk_ptr; - sk_ptr_s = sk_ptr; - - random_zeta_p = random_zeta; - random_zeta_p = #randombytes(random_zeta_p); - - pk, sk = keygen_inner(random_zeta_p); - - pk_ptr = pk_ptr_s; - i = 0; - while(i < Li2_PK_LEN) { - c = pk[i]; - [:u8 pk_ptr + i] = c; - i += 1; - } - - sk_ptr = sk_ptr_s; - i = 0; - while(i < Li2_SK_LEN) { - c = sk[i]; - [:u8 sk_ptr + i] = c; - i += 1; - } -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/montgomery.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/montgomery.jinc deleted file mode 100644 index 9da7607e..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/montgomery.jinc +++ /dev/null @@ -1,84 +0,0 @@ -require "params.jinc" - -//Maybe combine into params.jinc? -param int twoTo32 = 4294967296; -param int twoTo32Minus1 = 4294967295; -param int dilithium_modulo = 8380417; -param int dilithium_modulo_left_shift_41 = 18428731874223325184; -param int dilithium_modulo_inv = 58728449; -param int dilithium_modulo_inv_neg = 4236238847; -param int dilithium_primitive_root = 1753; -param int m_1 = 4193792; -param int m_root = 2091667; - -param int Li2_QINV = 58728449; - -inline -fn montgomery_REDC(reg u64 a) -> reg u32 -{ - reg u32 a32; - reg u64 v64; - reg u32 t; - - /* t = (int64_t)(int32_t)a*QINV; */ - a32 = (32s) a; - v64 = (64s) a32; - v64 *= dilithium_modulo_inv; - t = (32s) v64; - - /* t = (a - (int64_t)t*Q) >> 32; */ - v64 = (64s) t; - v64 *= -Li2_q; - v64 += a; - v64 >>= 32; - t = (32s) v64; - - return t; -} - -// Add Q if input coefficient is negative. -inline -fn caddq(reg u32 a) -> reg u32 { - - reg u32 a_add_q; - - a_add_q = a; - a_add_q += Li2_q; - - a = a_add_q if(a stack u8 -{ - stack u8 result; - result = 0; - if(val >=s threshold) { - result = 1; - } - if(val <=s -threshold) { - result = 1; - } - return result; -} - -inline -fn reduce32(reg u32 a) -> reg u32 -{ - reg u32 t v32; - - //t = (a + (1 << 22)) >> 23; - t = a; - t += (1 << 22); - t = t >>s 23; - - //t = a - t*Q; - v32 = t; - v32 *= Li2_q; - t = a; - t -= v32; - return t; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/ntt.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/ntt.jinc deleted file mode 100644 index 34cf3b7e..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/ntt.jinc +++ /dev/null @@ -1,190 +0,0 @@ -require "montgomery.jinc" -require "params.jinc" -require "twiddle_factors.jinc" - -fn fft(reg ptr u32[Li2_polydeg] f) -> reg ptr u32[Li2_polydeg] -{ - inline int log_len; - inline int len; - stack u32 start j k; - stack u32 zeta; - reg u64 zeta_reg; - reg u32 t; - - //inner loop bound - stack u32 bound; - reg u32 rbound; - - //temps - reg u32 v32; - reg u64 v64 addr; - reg ptr u32[256] tfs; - - stack u32 left right; - - /* - k = 0; - for(len = 128; len > 0; len >>= 1) { - */ - k = 0; - for log_len = 7 downto -1 { - len = 1 << log_len; - - //for(start = 0; start < N; start = j + len) { - start = 0; - while(start < Li2_polydeg) { - - //zeta = zetas[k++]; - tfs = twiddle_factors; - addr = (64u) k; - v32 = tfs[addr]; - zeta = v32; - k += 1; - - //for(j = start; j < start + len; ++j) { - j = start; - bound = start; - bound += len; - while { - addr = (64u) j; - v32 = f[addr]; - left = v32; - addr += len; - v32 = f[addr]; - right = v32; - - //t = montgomery_reduce((int64_t)zeta * a[j + len]); - v64 = (64s) right; - zeta_reg = (64s) zeta; - v64 *= zeta_reg; - t = montgomery_REDC(v64); - - // a[j + len] = a[j] - t; - v32 = left; - v32 -= t; - right = v32; - - // a[j] = a[j] + t; - v32 = left; - v32 += t; - left = v32; - - addr = (64u) j; - v32 = left; - f[addr] = v32; - addr += len; - v32 = right; - f[addr] = v32; - - j += 1; - rbound = bound; - } (j < rbound) - - v64 = (64u) j; - v64 += len; - start = v64; - } - } - - return f; -} - -param int mont_sq_over_256 = 41978; - -fn ifft_to_mont(reg ptr u32[Li2_polydeg] f) -> reg ptr u32[Li2_polydeg] -{ - inline int log_len; - inline int len; - stack u32 start j k; - stack u32 zeta t; - reg u64 zeta_reg; - - //inner loop bound - stack u32 bound; - reg u32 rbound; - - //temps - reg u32 v32; - reg u64 v64 addr; - reg ptr u32[256] tfs; - - stack u32 left right; - - k = 255; - for log_len = 0 to 8 { - len = 1 << log_len; - start = 0; - while(start < Li2_polydeg) { - k -= 1; - - tfs = twiddle_factors; - addr = (64u) k; - v32 = tfs[addr]; - v32 *= -1; - zeta = v32; - - j = start; - bound = start; - bound += len; - while { - addr = (64u) j; - v32 = f[addr]; - left = v32; - addr += len; - v32 = f[addr]; - right = v32; - - // t = a[j]; - v32 = left; - t = v32; - - //a[j] = t + a[j + len]; - v32 = t; - v32 += right; - left = v32; - - //a[j + len] = t - a[j + len]; - v32 = t; - v32 -= right; - right = v32; - - //a[j + len] = montgomery_reduce((int64_t)zeta * a[j + len]); - v64 = (64s) right; - zeta_reg = (64s) zeta; - v64 *= zeta_reg; - v32 = montgomery_REDC(v64); - right = v32; - - addr = (64u) j; - v32 = left; - f[addr] = v32; - addr += len; - v32 = right; - f[addr] = v32; - - j += 1; - rbound = bound; - } (j < rbound) - - v32 = j; - v32 += len; - start = v32; - } - } - - j = 0; - while(j < Li2_polydeg) { - //a[j] = montgomery_reduce((int64_t)f * a[j]); - addr = (64u) j; - v32 = f[addr]; - - v64 = (64s) v32; - v64 *= mont_sq_over_256; - v32 = montgomery_REDC(v64); - - f[addr] = v32; - j += 1; - } - - return f; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/packing.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/packing.jinc deleted file mode 100644 index 511e7e14..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/packing.jinc +++ /dev/null @@ -1,1168 +0,0 @@ -require "params.jinc" - -inline -fn rho_pack(reg ptr u8[32] in out) - -> reg ptr u8[32] -{ - inline int i; - reg u8 c; - for i = 0 to 32 { - c = in[i]; - out[i] = c; - } - return out; -} - -fn polyeta_2_pack(reg ptr u32[Li2_polydeg] s1, reg ptr u8[Li2_pack_eta_2_len] dest) - -> reg ptr u8[Li2_pack_eta_2_len] -{ - inline int _eta; - reg u32 dest0 dest1 dest2; - reg u32 t1 t2 t3 t4 t5 t6 t7; - reg u64 i addr; - - _eta = 2; - ?{}, i = #set0_64(); - while (i < Li2_polydeg) { - addr = i; - addr >>= 3; - addr = #LEA_64(2*addr + addr); - - // r[3*i+0] = (t[0] >> 0) | (t[1] << 3) | (t[2] << 6); - dest0 = _eta; // t0 - dest0 -= s1[i]; - t1 = _eta; - t1 -= s1[(uint) i + 1]; - t1 <<= 3; - dest0 |= t1; - t2 = _eta; - t2 -= s1[(uint) i + 2]; - dest1 = t2; - t2 <<= 6; - dest0 |= t2; - dest[(uint) addr + 0] = (8u) dest0; - - // r[3*i+1] = (t[2] >> 2) | (t[3] << 1) | (t[4] << 4) | (t[5] << 7); - dest1 >>= 2; - t3 = _eta; - t3 -= s1[(uint) i + 3]; - t3 += t3; - dest1 |= t3; - t4 = _eta; - t4 -= s1[(uint) i + 4]; - t4 <<= 4; - dest1 |= t4; - t5 = _eta; - t5 -= s1[(uint) i + 5]; - dest2 = t5; - t5 <<= 7; - dest1 |= t5; - dest[(uint) addr + 1] = (8u) dest1; - - // r[3*i+2] = (t[5] >> 1) | (t[6] << 2) | (t[7] << 5); - dest2 >>= 1; - t6 = _eta; - t6 -= s1[(uint) i + 6]; - t6 <<= 2; - dest2 |= t6; - t7 = _eta; - t7 -= s1[(uint) i + 7]; - t7 <<= 5; - dest2 |= t7; - dest[(uint) addr + 2] = (8u) dest2; - - i += 8; - } - return dest; -} - -fn polyeta_4_pack(reg ptr u32[Li2_polydeg] s1, reg ptr u8[Li2_pack_eta_4_len] dest) - -> reg ptr u8[Li2_pack_eta_4_len] -{ - inline int _eta; - - reg u32 lo hi; - reg u32 coeff; - - reg u64 i addr; - - _eta = 4; - ?{}, i = #set0_64(); - while (i < Li2_polydeg) { - coeff = s1[i]; - lo = _eta; - lo -= coeff; - - coeff = s1[(uint) i + 1]; - hi = _eta; - hi -= coeff; - - hi <<= 4; - hi |= lo; - - addr = i; - addr >>= 1; - dest[addr] = hi; - - i += 2; - } - return dest; -} - -fn polyeta_2_unpack(reg ptr u32[Li2_polydeg] r, reg ptr u8[Li2_pack_eta_2_len] a) - -> reg ptr u32[Li2_polydeg] -{ - inline int _eta; - reg u64 i; - reg u32 a0 a1 a2; - reg u32 c32_0; - reg u32 coeff; - reg u64 dest_addr src_addr; - - _eta = 2; - ?{}, i = #set0_64(); - ?{}, src_addr = #set0_64(); - ?{}, dest_addr = #set0_64(); - while (i < Li2_polydeg / 8) { - // r->coeffs[8*i+0] = (a[3*i+0] >> 0) & 7; - a0 = (32u) a[(uint) src_addr + 0]; - a1 = (32u) a[(uint) src_addr + 1]; - a2 = (32u) a[(uint) src_addr + 2]; - // r->coeffs[8*i+0] = ETA - r->coeffs[8*i+0]; - c32_0 = a0; - c32_0 &= 0x7; - coeff = _eta; - coeff -= c32_0; - r[dest_addr] = coeff; - // r->coeffs[8*i+1] = (a[3*i+0] >> 3) & 7; - c32_0 = a0; - c32_0 >>= 3; - c32_0 &= 0x7; - // r->coeffs[8*i+1] = ETA - r->coeffs[8*i+1]; - coeff = _eta; - coeff -= c32_0; - r[(uint) dest_addr + 1] = coeff; - // r->coeffs[8*i+2] = ((a[3*i+0] >> 6) | (a[3*i+1] << 2)) & 7; - c32_0 = a0 >> 6; - c32_0 = #LEA_32(4 * a1 + c32_0); - c32_0 &= 0x7; - // r->coeffs[8*i+2] = ETA - r->coeffs[8*i+2]; - coeff = _eta; - coeff -= c32_0; - r[(uint) dest_addr + 2] = coeff; - // r->coeffs[8*i+3] = (a[3*i+1] >> 1) & 7; - c32_0 = a1; - c32_0 >>= 1; - c32_0 &= 0x7; - // r->coeffs[8*i+3] = ETA - r->coeffs[8*i+3]; - coeff = _eta; - coeff -= c32_0; - r[(uint) dest_addr + 3] = coeff; - // r->coeffs[8*i+4] = (a[3*i+1] >> 4) & 7; - c32_0 = a1; - c32_0 >>= 4; - c32_0 &= 0x7; - // r->coeffs[8*i+4] = ETA - r->coeffs[8*i+4]; - coeff = _eta; - coeff -= c32_0; - r[(uint) dest_addr + 4] = coeff; - // r->coeffs[8*i+5] = ((a[3*i+1] >> 7) | (a[3*i+2] << 1)) & 7; - c32_0 = a1 >> 7; - c32_0 = #LEA_32(2 * a2 + c32_0); - c32_0 &= 0x7; - // r->coeffs[8*i+5] = ETA - r->coeffs[8*i+5]; - coeff = _eta; - coeff -= c32_0; - r[(uint) dest_addr + 5] = coeff; - // r->coeffs[8*i+6] = (a[3*i+2] >> 2) & 7; - c32_0 = a2; - c32_0 >>= 2; - c32_0 &= 0x7; - // r->coeffs[8*i+6] = ETA - r->coeffs[8*i+6]; - coeff = _eta; - coeff -= c32_0; - r[(uint) dest_addr + 6] = coeff; - // r->coeffs[8*i+7] = (a[3*i+2] >> 5) & 7; - c32_0 = a2 >> 5; - c32_0 &= 0x7; - // r->coeffs[8*i+7] = ETA - r->coeffs[8*i+7]; - coeff = _eta; - coeff -= c32_0; - r[(uint) dest_addr + 7] = coeff; - - i += 1; - src_addr += 3; - dest_addr += 8; - } - return r; -} - -fn polyeta_4_unpack(reg ptr u32[Li2_polydeg] r, reg ptr u8[Li2_pack_eta_4_len] a) - -> reg ptr u32[Li2_polydeg] -{ - inline int _eta; - reg u64 i; - reg u32 x; - - _eta = 4; - ?{}, i = #set0_64(); - while (i < Li2_polydeg / 2) { - // r->coeffs[2*i+0] = a[i] & 0x0F; - x = (32u) a[i]; - x &= 0x0F; - // r->coeffs[2*i+0] = ETA - r->coeffs[2*i+0]; - x = -x; - x += _eta; - r[2 * ((uint) i)] = x; - - // r->coeffs[2*i+1] = a[i] >> 4; - x = (32u) a[i]; - x >>= 4; - // r->coeffs[2*i+1] = ETA - r->coeffs[2*i+1]; - x = -x; - x += _eta; - r[2 * ((uint) i) + 1] = x; - - i += 1; - } - return r; -} - -inline -fn polyz_pack_gamma1_217(reg ptr u8[Li2_pack_zlen_gamma1_217] r, reg ptr u32[Li2_polydeg] a) - -> reg ptr u8[Li2_pack_zlen_gamma1_217] -{ - inline int gamma1; - reg u64 i dest_addr src_addr; - reg u32 t0 t1 t2 t3 c32_0 c32_1; - - gamma1 = 1 << 17; - ?{}, i = #set0_64(); - ?{}, src_addr = #set0_64(); - ?{}, dest_addr = #set0_64(); - while (i < Li2_polydeg / 4) { - // t[0] = GAMMA1 - a->coeffs[4*i+0]; - t0 = gamma1; - t0 -= a[(uint) src_addr + 0]; - // r[9*i+0] = t[0]; - r[(uint) dest_addr + 0] = (8u) t0; - // r[9*i+1] = t[0] >> 8; - c32_0 = t0; - c32_0 >>= 8; - r[(uint) dest_addr + 1] = (8u) c32_0; - // r[9*i+2] = t[0] >> 16; - c32_0 = t0 >> 16; - // t[1] = GAMMA1 - a->coeffs[4*i+1]; - t1 = gamma1; - t1 -= a[(uint) src_addr + 1]; - // r[9*i+2] |= t[1] << 2; - c32_1 = t1; - c32_1 <<= 2; // TODO: opt - c32_0 |= c32_1; - r[(uint) dest_addr + 2] = (8u) c32_0; - // r[9*i+3] = t[1] >> 6; - c32_0 = t1; - c32_0 >>= 6; - r[(uint) dest_addr + 3] = (8u) c32_0; - // r[9*i+4] = t[1] >> 14; - c32_0 = t1 >> 14; - // t[2] = GAMMA1 - a->coeffs[4*i+2]; - t2 = gamma1; - t2 -= a[(uint) src_addr + 2]; - // r[9*i+4] |= t[2] << 4; - c32_1 = t2; - c32_1 <<= 4; - c32_0 |= c32_1; - r[(uint) dest_addr + 4] = (8u) c32_0; - // r[9*i+5] = t[2] >> 4; - c32_0 = t2; - c32_0 >>= 4; - r[(uint) dest_addr + 5] = (8u) c32_0; - // r[9*i+6] = t[2] >> 12; - c32_0 = t2; - c32_0 >>= 12; - // t[3] = GAMMA1 - a->coeffs[4*i+3]; - t3 = gamma1; - t3 -= a[(uint) src_addr + 3]; - // r[9*i+6] |= t[3] << 6; - c32_1 = t3; - c32_1 <<= 6; - c32_0 |= c32_1; - r[(uint) dest_addr + 6] = (8u) c32_0; - // r[9*i+7] = t[3] >> 2; - c32_0 = t3; - c32_0 >>= 2; - r[(uint) dest_addr + 7] = (8u) c32_0; - // r[9*i+8] = t[3] >> 10; - c32_0 = t3 >> 10; - r[(uint) dest_addr + 8] = (8u) c32_0; - - i += 1; - src_addr += 4; - dest_addr += 9; - } - return r; -} - -fn polyz_unpack_gamma1_217(reg ptr u32[Li2_polydeg] r, reg ptr u8[Li2_pack_zlen_gamma1_217] a) - -> reg ptr u32[Li2_polydeg] -{ - reg u64 i in_addr out_addr; - reg u32 x c32; - - ?{}, i = #set0_64(); - while (i < Li2_polydeg / 4) { - in_addr = #LEA_64(8*i + i); - out_addr = #LEA_64(4*i); - - // r->coeffs[4*i+0] = a[9*i+0]; - x = (32u) a[(uint) in_addr + 0]; - - // r->coeffs[4*i+0] |= (uint32_t)a[9*i+1] << 8; - c32 = (32u) a[(uint) in_addr + 1]; - c32 <<= 8; - x |= c32; - - // r->coeffs[4*i+0] |= (uint32_t)a[9*i+2] << 16; - c32 = (32u) a[(uint) in_addr + 2]; - c32 <<= 16; - x |= c32; - - // r->coeffs[4*i+0] &= 0x3FFFF; - x &= 0x3FFFF; - - // r->coeffs[4*i+0] = GAMMA1 - r->coeffs[4*i+0]; - x -= 1 << 17; - x = -x; - r[out_addr + 0] = x; - - // r->coeffs[4*i+1] = a[9*i+2] >> 2; - x = (32u) a[(uint) in_addr + 2]; - x >>= 2; - - // r->coeffs[4*i+1] |= (uint32_t)a[9*i+3] << 6; - c32 = (32u) a[(uint) in_addr + 3]; - c32 <<= 6; - x |= c32; - - // r->coeffs[4*i+1] |= (uint32_t)a[9*i+4] << 14; - c32 = (32u) a[(uint) in_addr + 4]; - c32 <<= 14; - x |= c32; - - // r->coeffs[4*i+1] &= 0x3FFFF; - x &= 0x3FFFF; - - // r->coeffs[4*i+1] = GAMMA1 - r->coeffs[4*i+1]; - x -= 1 << 17; - x = -x; - r[out_addr + 1] = x; - - // r->coeffs[4*i+2] = a[9*i+4] >> 4; - x = (32u) a[(uint) in_addr + 4]; - x >>= 4; - - // r->coeffs[4*i+2] |= (uint32_t)a[9*i+5] << 4; - c32 = (32u) a[(uint) in_addr + 5]; - c32 <<= 4; - x |= c32; - - // r->coeffs[4*i+2] |= (uint32_t)a[9*i+6] << 12; - c32 = (32u) a[(uint) in_addr + 6]; - c32 <<= 12; - x |= c32; - - // r->coeffs[4*i+2] &= 0x3FFFF; - x &= 0x3FFFF; - - // r->coeffs[4*i+2] = GAMMA1 - r->coeffs[4*i+2]; - x -= 1 << 17; - x = -x; - r[out_addr + 2] = x; - - // r->coeffs[4*i+3] = a[9*i+6] >> 6; - x = (32u) a[(uint) in_addr + 6]; - x >>= 6; - - // r->coeffs[4*i+3] |= (uint32_t)a[9*i+7] << 2; - c32 = (32u) a[(uint) in_addr + 7]; - c32 <<= 2; - x |= c32; - - // r->coeffs[4*i+3] |= (uint32_t)a[9*i+8] << 10; - c32 = (32u) a[(uint) in_addr + 8]; - c32 <<= 10; - x |= c32; - - // r->coeffs[4*i+3] &= 0x3FFFF; - x &= 0x3FFFF; - - // r->coeffs[4*i+3] = GAMMA1 - r->coeffs[4*i+3]; - x -= 1 << 17; - x = -x; - r[out_addr + 3] = x; - - i += 1; - } - - return r; -} - -inline -fn polyz_pack_gamma1_219(reg ptr u8[Li2_pack_zlen_gamma1_219] r, reg ptr u32[Li2_polydeg] a) - -> reg ptr u8[Li2_pack_zlen_gamma1_219] -{ - inline int gamma1; - reg u64 i; - reg u32 x; - reg u8 c; - reg u32 t0 t1; - reg u64 dest_addr src_addr; - - gamma1 = 1 << 19; - ?{}, i = #set0_64(); - ?{}, src_addr = #set0_64(); - ?{}, dest_addr = #set0_64(); - while (i < Li2_polydeg / 2) { - // t[0] = GAMMA1 - a->coeffs[2*i+0]; - t0 = gamma1; - t0 -= a[(uint) src_addr + 0]; - - // t[1] = GAMMA1 - a->coeffs[2*i+1]; - t1 = gamma1; - t1 -= a[(uint) src_addr + 1]; - - // r[5*i+0] = t[0]; - x = t0; - r[dest_addr] = (8u) x; - - // r[5*i+1] = t[0] >> 8; - x = t0; - x >>= 8; - r[(uint) dest_addr + 1] = (8u) x; - - // r[5*i+2] = t[0] >> 16; - x = t0; - x >>= 16; - c = (8u) x; - - // r[5*i+2] |= t[1] << 4; - x = t1; - x <<= 4; - c |= (8u) x; - r[(uint) dest_addr + 2] = c; - - // r[5*i+3] = t[1] >> 4; - x = t1; - x >>= 4; - r[(uint) dest_addr + 3] = (8u) x; - - // r[5*i+4] = t[1] >> 12; - x = t1; - x >>= 12; - r[(uint) dest_addr + 4] = (8u) x; - - i += 1; - src_addr += 2; - dest_addr += 5; - } - return r; -} - -fn polyz_unpack_gamma1_219(reg ptr u32[Li2_polydeg] r, reg ptr u8[Li2_pack_zlen_gamma1_219] a) - -> reg ptr u32[Li2_polydeg] -{ - reg u64 i; - reg u32 x c32; - reg u64 addr; - - i = 0; - while(i < Li2_polydeg / 2) { - // TODO: replace with: addr = #LEA_64(4*i + i); - addr = i; - addr *= 5; - - //r->coeffs[2*i+0] = a[5*i+0]; - x = (32u) a[addr]; - - //r->coeffs[2*i+0] |= (uint32_t)a[5*i+1] << 8; - addr = i; - addr *= 5; - addr += 1; - c32 = (32u) a[addr]; - c32 <<= 8; - x |= c32; - - //r->coeffs[2*i+0] |= (uint32_t)a[5*i+2] << 16; - addr = i; - addr *= 5; - addr += 2; - c32 = (32u) a[addr]; - c32 <<= 16; - x |= c32; - - //r->coeffs[2*i+0] = GAMMA1 - r->coeffs[2*i+0]; - - x &= 0xFFFFF; - x = -x; - x += 1 << 19; - addr = i; - addr *= 2; - r[addr] = x; - - //r->coeffs[2*i+1] = a[5*i+2] >> 4; - addr = i; - addr *= 5; - addr += 2; - x = (32u) a[addr]; - x >>= 4; - - //r->coeffs[2*i+1] |= (uint32_t)a[5*i+3] << 4; - addr = i; - addr *= 5; - addr += 3; - c32 = (32u) a[addr]; - c32 <<= 4; - x |= c32; - - //r->coeffs[2*i+1] |= (uint32_t)a[5*i+4] << 12; - addr = i; - addr *= 5; - addr += 4; - c32 = (32u) a[addr]; - c32 <<= 12; - x |= c32; - - //r->coeffs[2*i+1] = GAMMA1 - r->coeffs[2*i+1]; - x = -x; - x += 1 << 19; - addr = i; - addr *= 2; - addr += 1; - r[addr] = x; - - i += 1; - } - return r; -} - -fn polyt1_pack(reg ptr u32[Li2_polydeg] t1, reg ptr u8[Li2_pack_t1len] buf) - -> reg ptr u8[Li2_pack_t1len] -{ - reg u64 i; - reg u64 addr; - reg u32 x x1; - reg u8 c; - - i = 0; - while(i < Li2_polydeg / 4) { - // buf[5*i+0] = t1[4*i+0] >> 0; - - addr = 4; - addr *= i; - x = t1[addr]; - c = (8u) x; - - addr = 5; - addr *= i; - buf[addr] = c; - - // buf[5*i+1] = (t1[4*i+0] >> 8) | (t1[4*i+1] << 2); - - addr = 4; - addr *= i; - x = t1[addr]; - x >>= 8; - - addr = 4; - addr *= i; - addr += 1; - x1 = t1[addr]; - x1 <<= 2; - x |= x1; - - addr = 5; - addr *= i; - addr += 1; - c = (8u) x; - buf[addr] = c; - - // buf[5*i+2] = (t1[4*i+1] >> 6) | (t1[4*i+2] << 4); - - addr = 4; - addr *= i; - addr += 1; - x = t1[addr]; - x >>= 6; - - addr = 4; - addr *= i; - addr += 2; - x1 = t1[addr]; - x1 <<= 4; - x |= x1; - - addr = 5; - addr *= i; - addr += 2; - c = (8u) x; - buf[addr] = c; - - // buf[5*i+3] = (t1[4*i+2] >> 4) | (t1[4*i+3] << 6); - - addr = 4; - addr *= i; - addr += 2; - x = t1[addr]; - x >>= 4; - - addr = 4; - addr *= i; - addr += 3; - x1 = t1[addr]; - x1 <<= 6; - x |= x1; - - addr = 5; - addr *= i; - addr += 3; - c = (8u) x; - buf[addr] = c; - - // buf[5*i+4] = (t1[4*i+3] >> 2); - - addr = 4; - addr *= i; - addr += 3; - x = t1[addr]; - x >>= 2; - - addr = 5; - addr *= i; - addr += 4; - c = (8u) x; - buf[addr] = c; - - i += 1; - } - - return buf; -} - -fn polyt1_unpack(reg ptr u32[Li2_polydeg] t1, reg ptr u8[Li2_pack_t1len] buf) - -> reg ptr u32[Li2_polydeg] -{ - reg u64 i i4 i5; - reg u32 x0 x1 x2 x3; - reg u32 xtmp1 xtmp2; - - i = 0; - while (i < Li2_polydeg / 4) { - // FIXME: opt: make i4 loop counter - i4 = #LEA_64(4 * i); // i4 = 4 * i - i5 = #LEA_64(4 * i + i); // i5 = 5 * i - - x0 = (32u)buf[(uint) i5 + 0]; - xtmp1 = (32u)buf[(uint) i5 + 1]; - xtmp2 = xtmp1; - xtmp1 <<= 8; - x0 |= xtmp1; - x0 &= 0x3FF; - t1[(uint) i4 + 0] = x0; - - x1 = xtmp2 >> 2; - xtmp1 = (32u)buf[(uint) i5 + 2]; - xtmp2 = xtmp1; - xtmp1 <<= 6; - x1 |= xtmp1; - x1 &= 0x3FF; - t1[(uint) i4 + 1] = x1; - - x2 = xtmp2 >> 4; - xtmp1 = (32u)buf[(uint) i5 + 3]; - xtmp2 = xtmp1; - xtmp1 <<= 4; - x2 |= xtmp1; - x2 &= 0x3FF; - t1[(uint) i4 + 2] = x2; - - x3 = xtmp2 >> 6; - xtmp1 = (32u)buf[(uint) i5 + 4]; - xtmp1 <<= 2; - x3 |= xtmp1; - x3 &= 0x3FF; // FIXME: opt: redundant operation - t1[(uint) i4 + 3] = x3; - - i += 1; - } - return t1; -} - -fn polyt0_pack(reg ptr u32[Li2_polydeg] t0, reg ptr u8[Li2_pack_t0len] dest) - -> reg ptr u8[Li2_pack_t0len] -{ - // TODO: This function needs some superficial optimization - - inline int max_t0; - max_t0 = Li2_expd / 2; - - stack u32 t0_term; - stack u32[8] t; - - reg u64 i j; - reg u64 addr; - - reg u32 v32; - - reg u8 c c1; - - ?{}, i = #set0_64(); - while(i < Li2_polydeg / 8) { - ?{}, j = #set0_64(); - while (j < 8) { - addr = #LEA_64(8*i + j); - v32 = t0[addr]; - t0_term = v32; - v32 = max_t0; - v32 -= t0_term; - t[j] = v32; - j += 1; - } - - // Get ready. - // Here be typos. - // TODO: Check if there are indeed no typos - - //r[13*i+ 0] = t[0]; - - v32 = t[0]; - c = (8u) v32; - addr = i; - addr *= 13; - dest[addr] = c; - - //r[13*i+ 1] = t[0] >> 8; - //r[13*i+ 1] |= t[1] << 5; - - v32 = t[0]; - v32 >>= 8; - c = (8u) v32; - v32 = t[1]; - v32 <<= 5; - c1 = (8u) v32; - c |= c1; - addr = i; - addr *= 13; - addr += 1; - dest[addr] = c; - - //r[13*i+ 2] = t[1] >> 3; - - v32 = t[1]; - v32 >>= 3; - c = (8u) v32; - addr = i; - addr *= 13; - addr += 2; - dest[addr] = c; - - //r[13*i+ 3] = t[1] >> 11; - //r[13*i+ 3] |= t[2] << 2; - - v32 = t[1]; - v32 >>= 11; - c = (8u) v32; - v32 = t[2]; - v32 <<= 2; - c1 = (8u) v32; - c |= c1; - addr = i; - addr *= 13; - addr += 3; - dest[addr] = c; - - //r[13*i+ 4] = t[2] >> 6; - //r[13*i+ 4] |= t[3] << 7; - - v32 = t[2]; - v32 >>= 6; - c = (8u) v32; - v32 = t[3]; - v32 <<= 7; - c1 = (8u) v32; - c |= c1; - addr = i; - addr *= 13; - addr += 4; - dest[addr] = c; - - //r[13*i+ 5] = t[3] >> 1; - - v32 = t[3]; - v32 >>= 1; - c = (8u) v32; - addr = i; - addr *= 13; - addr += 5; - dest[addr] = c; - - //r[13*i+ 6] = t[3] >> 9; - //r[13*i+ 6] |= t[4] << 4; - - v32 = t[3]; - v32 >>= 9; - c = (8u) v32; - v32 = t[4]; - v32 <<= 4; - c1 = (8u) v32; - c |= c1; - addr = i; - addr *= 13; - addr += 6; - dest[addr] = c; - - //r[13*i+ 7] = t[4] >> 4; - - v32 = t[4]; - v32 >>= 4; - c = (8u) v32; - addr = i; - addr *= 13; - addr += 7; - dest[addr] = c; - - //r[13*i+ 8] = t[4] >> 12; - //r[13*i+ 8] |= t[5] << 1; - - v32 = t[4]; - v32 >>= 12; - c = (8u) v32; - v32 = t[5]; - v32 <<= 1; - c1 = (8u) v32; - c |= c1; - addr = i; - addr *= 13; - addr += 8; - dest[addr] = c; - - //r[13*i+ 9] = t[5] >> 7; - //r[13*i+ 9] |= t[6] << 6; - - v32 = t[5]; - v32 >>= 7; - c = (8u) v32; - v32 = t[6]; - v32 <<= 6; - c1 = (8u) v32; - c |= c1; - addr = i; - addr *= 13; - addr += 9; - dest[addr] = c; - - //r[13*i+10] = t[6] >> 2; - - v32 = t[6]; - v32 >>= 2; - c = (8u) v32; - addr = i; - addr *= 13; - addr += 10; - dest[addr] = c; - - //r[13*i+11] = t[6] >> 10; - //r[13*i+11] |= t[7] << 3; - - v32 = t[6]; - v32 >>= 10; - c = (8u) v32; - v32 = t[7]; - v32 <<= 3; - c1 = (8u) v32; - c |= c1; - addr = i; - addr *= 13; - addr += 11; - dest[addr] = c; - - //r[13*i+12] = t[7] >> 5; - - v32 = t[7]; - v32 >>= 5; - c = (8u) v32; - addr = i; - addr *= 13; - addr += 12; - dest[addr] = c; - - i += 1; - } - - - return dest; -} - -fn polyt0_unpack(reg ptr u32[Li2_polydeg] t0, reg ptr u8[Li2_pack_t0len] src) - -> reg ptr u32[Li2_polydeg] -{ - // TODO: This function needs some superficial optimization - - inline int max_t0; - max_t0 = Li2_expd / 2; - - reg u64 i; - reg u64 addr; - reg u32 x; - reg u32 v; - reg u64 term; - - ?{}, i = #set0_64(); - while(i < Li2_polydeg / 8) { - // r->coeffs[8*i+0] = a[13*i+0]; - addr = (64u) i; - addr *= 13; - x = (32u) src[addr]; - - // r->coeffs[8*i+0] |= (uint32_t)a[13*i+1] << 8; - addr += 1; - v = (32u) src[addr]; - v <<= 8; - x |= v; - - // r->coeffs[8*i+0] &= 0x1FFF; - x &= 0x1FFF; - - // r->coeffs[8*i+0] = (1 << (D-1)) - r->coeffs[8*i+0]; - x = -x; - x += max_t0; - term = (64u) i; - term *= 8; - t0[term] = x; - - // r->coeffs[8*i+1] = a[13*i+1] >> 5; - x = (32u) src[addr]; - x >>= 5; - - // r->coeffs[8*i+1] |= (uint32_t)a[13*i+2] << 3; - addr += 1; - v = (32u) src[addr]; - v <<= 3; - x |= v; - - // r->coeffs[8*i+1] |= (uint32_t)a[13*i+3] << 11; - addr += 1; - v = (32u) src[addr]; - v <<= 11; - x |= v; - - // r->coeffs[8*i+1] &= 0x1FFF; - x &= 0x1FFF; - - // r->coeffs[8*i+1] = (1 << (D-1)) - r->coeffs[8*i+1]; - x = -x; - x += max_t0; - term += 1; - t0[term] = x; - - // r->coeffs[8*i+2] = a[13*i+3] >> 2; - x = (32u) src[addr]; - x >>= 2; - - // r->coeffs[8*i+2] |= (uint32_t)a[13*i+4] << 6; - addr += 1; - v = (32u) src[addr]; - v <<= 6; - x |= v; - - // r->coeffs[8*i+2] &= 0x1FFF; - x &= 0x1FFF; - - // r->coeffs[8*i+2] = (1 << (D-1)) - r->coeffs[8*i+2]; - x = -x; - x += max_t0; - term += 1; - t0[term] = x; - - // r->coeffs[8*i+3] = a[13*i+4] >> 7; - x = (32u) src[addr]; - x >>= 7; - - // r->coeffs[8*i+3] |= (uint32_t)a[13*i+5] << 1; - addr += 1; - v = (32u) src[addr]; - v <<= 1; - x |= v; - - // r->coeffs[8*i+3] |= (uint32_t)a[13*i+6] << 9; - addr += 1; - v = (32u) src[addr]; - v <<= 9; - x |= v; - - // r->coeffs[8*i+3] &= 0x1FFF; - x &= 0x1FFF; - - // r->coeffs[8*i+3] = (1 << (D-1)) - r->coeffs[8*i+3]; - x = -x; - x += max_t0; - term += 1; - t0[term] = x; - - // r->coeffs[8*i+4] = a[13*i+6] >> 4; - x = (32u) src[addr]; - x >>= 4; - - // r->coeffs[8*i+4] |= (uint32_t)a[13*i+7] << 4; - addr += 1; - v = (32u) src[addr]; - v <<= 4; - x |= v; - - // r->coeffs[8*i+4] |= (uint32_t)a[13*i+8] << 12; - addr += 1; - v = (32u) src[addr]; - v <<= 12; - x |= v; - - // r->coeffs[8*i+4] &= 0x1FFF; - x &= 0x1FFF; - - // r->coeffs[8*i+4] = (1 << (D-1)) - r->coeffs[8*i+4]; - x = -x; - x += max_t0; - term += 1; - t0[term] = x; - - // r->coeffs[8*i+5] = a[13*i+8] >> 1; - x = (32u) src[addr]; - x >>= 1; - - // r->coeffs[8*i+5] |= (uint32_t)a[13*i+9] << 7; - addr += 1; - v = (32u) src[addr]; - v <<= 7; - x |= v; - - // r->coeffs[8*i+5] &= 0x1FFF; - x &= 0x1FFF; - - // r->coeffs[8*i+5] = (1 << (D-1)) - r->coeffs[8*i+5]; - x = -x; - x += max_t0; - term += 1; - t0[term] = x; - - // r->coeffs[8*i+6] = a[13*i+9] >> 6; - x = (32u) src[addr]; - x >>= 6; - - // r->coeffs[8*i+6] |= (uint32_t)a[13*i+10] << 2; - addr += 1; - v = (32u) src[addr]; - v <<= 2; - x |= v; - - // r->coeffs[8*i+6] |= (uint32_t)a[13*i+11] << 10; - addr += 1; - v = (32u) src[addr]; - v <<= 10; - x |= v; - - // r->coeffs[8*i+6] &= 0x1FFF; - x &= 0x1FFF; - - // r->coeffs[8*i+6] = (1 << (D-1)) - r->coeffs[8*i+6]; - x = -x; - x += max_t0; - term += 1; - t0[term] = x; - - // r->coeffs[8*i+7] = a[13*i+11] >> 3; - x = (32u) src[addr]; - x >>= 3; - - // r->coeffs[8*i+7] |= (uint32_t)a[13*i+12] << 5; - addr += 1; - v = (32u) src[addr]; - v <<= 5; - x |= v; - - // r->coeffs[8*i+7] &= 0x1FFF; - x &= 0x1FFF; - - // r->coeffs[8*i+7] = (1 << (D-1)) - r->coeffs[8*i+7]; - x = -x; - x += max_t0; - term += 1; - t0[term] = x; - - i += 1; - } - return t0; -} - -fn polyw1_pack_gamma2_88(reg ptr u32[Li2_polydeg] w1, reg ptr u8[Li2_pack_highbitslen_gamma2_88] w1_buf) - -> reg ptr u8[Li2_pack_highbitslen_gamma2_88] -{ - reg u64 i dest_addr src_addr; - reg u32 t1 t2 t3 c32_0 c32_1; - - ?{}, i = #set0_64(); - ?{}, src_addr = #set0_64(); - ?{}, dest_addr = #set0_64(); - while (i < Li2_polydeg / 4) { - t2 = w1[(uint) src_addr + 2]; - t3 = w1[(uint) src_addr + 3]; - - // r[3*i+0] = a->coeffs[4*i+0]; - // r[3*i+0] |= a->coeffs[4*i+1] << 6; - c32_0 = w1[(uint) src_addr + 1]; - t1 = c32_0; - c32_0 <<= 6; - c32_0 |= w1[(uint) src_addr + 0]; - w1_buf[(uint) dest_addr + 0] = c32_0; - // r[3*i+1] = a->coeffs[4*i+1] >> 2; - // r[3*i+1] |= a->coeffs[4*i+2] << 4; - c32_0 = t1 >> 2; - c32_1 = w1[(uint) src_addr + 2]; - t2 = c32_1; - c32_1 <<= 4; - c32_0 |= c32_1; - w1_buf[(uint) dest_addr + 1] = c32_0; - // r[3*i+2] = a->coeffs[4*i+2] >> 4; - // r[3*i+2] |= a->coeffs[4*i+3] << 2; - c32_0 = t2 >> 4; - c32_1 = w1[(uint) src_addr + 3]; - c32_1 <<= 2; // TODO: opt: use LEA instruction - c32_0 |= c32_1; - w1_buf[(uint) dest_addr + 2] = c32_0; - - i += 1; - src_addr += 4; - dest_addr += 3; - } - - return w1_buf; -} - -fn polyw1_pack_gamma2_32(reg ptr u32[Li2_polydeg] w1, reg ptr u8[Li2_pack_highbitslen_gamma2_32] w1_buf) - -> reg ptr u8[Li2_pack_highbitslen_gamma2_32] -{ - reg u64 i src_addr; - reg u32 c32; - - ?{}, i = #set0_64(); - ?{}, src_addr = #set0_64(); - while (i < Li2_polydeg / 2) { - // r[i] = a->coeffs[2*i+0] | (a->coeffs[2*i+1] << 4); - c32 = w1[(uint) src_addr + 1]; - c32 <<= 4; - c32 |= w1[(uint) src_addr + 0]; - w1_buf[i] = (8u) c32; - - i += 1; - src_addr += 2; - } - return w1_buf; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/packing_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/packing_end.jinc deleted file mode 100644 index 30c0ff79..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/packing_end.jinc +++ /dev/null @@ -1,116 +0,0 @@ -inline -fn pack_w1(reg ptr u32[Li2_k * Li2_polydeg] w1) - -> stack u8[Li2_pack_w1len] -{ - inline int ii; - stack u8[Li2_pack_w1len] dest; - reg ptr u8[Li2_pack_highbitslen] buf; - reg ptr u32[Li2_polydeg] poly; - - for ii = 0 to Li2_k { - buf = dest[Li2_pack_highbitslen * ii : Li2_pack_highbitslen]; - poly = w1[Li2_polydeg * ii : Li2_polydeg]; - dest[Li2_pack_highbitslen * ii : Li2_pack_highbitslen] = polyw1_pack(poly, buf); - } - return dest; -} - -inline -fn unpack_sk(reg ptr u8[Li2_SK_LEN] sk) - -> stack u32[Li2_l * Li2_polydeg], //s1 - stack u32[Li2_k * Li2_polydeg], //s2 - stack u32[Li2_k * Li2_polydeg] //t0 -{ - stack u32[Li2_l * Li2_polydeg] s1; - stack u32[Li2_k * Li2_polydeg] s2; - stack u32[Li2_k * Li2_polydeg] t0; - - reg ptr u32[Li2_polydeg] poly_to_unpack; - reg ptr u8[Li2_pack_etalen] sx_in_sk; - reg ptr u8[Li2_pack_t0len] t0_in_sk; - - inline int ii; - - // unpack sk where needed - for ii = 0 to Li2_l { - poly_to_unpack = s1[ii * Li2_polydeg : Li2_polydeg]; - sx_in_sk = sk[96 + ii * Li2_pack_etalen : Li2_pack_etalen]; - poly_to_unpack = polyeta_unpack(poly_to_unpack, sx_in_sk); - s1[ii * Li2_polydeg : Li2_polydeg] = poly_to_unpack; - } - - for ii = 0 to Li2_k { - poly_to_unpack = s2[ii * Li2_polydeg : Li2_polydeg]; - sx_in_sk = sk[Li2_pack_s2loc + ii * Li2_pack_etalen : Li2_pack_etalen]; - poly_to_unpack = polyeta_unpack(poly_to_unpack, sx_in_sk); - s2[ii * Li2_polydeg : Li2_polydeg] = poly_to_unpack; - } - - for ii = 0 to Li2_k { - poly_to_unpack = t0[ii * Li2_polydeg : Li2_polydeg]; - t0_in_sk = sk[Li2_SK_LEN - (Li2_k - ii) * Li2_pack_t0len : Li2_pack_t0len]; - poly_to_unpack = polyt0_unpack(poly_to_unpack, t0_in_sk); - t0[ii * Li2_polydeg : Li2_polydeg] = poly_to_unpack; - } - - return s1, s2, t0; -} - -inline -fn pack_signature(reg ptr u8[32] c_tilde, - reg ptr u32[Li2_l * Li2_polydeg] z, - reg ptr u32[Li2_k * Li2_polydeg] h) - -> stack u8[Li2_SIGN_LEN] -{ - stack u8[Li2_SIGN_LEN] signature; - reg ptr u8[Li2_pack_zlen] z_buf; - reg ptr u32[Li2_polydeg] z_to_pack; - - inline int ii; - reg u64 i j k addr; - reg u32 coeff; - reg u8 c; - - ?{}, i = #set0_64(); - while (i < 32) { - c = c_tilde[i]; - signature[i] = c; - i += 1; - } - - for ii = 0 to Li2_l { - z_buf = signature[32 + Li2_pack_zlen * ii : Li2_pack_zlen]; - z_to_pack = z[ii * Li2_polydeg : Li2_polydeg]; - z_buf = polyz_pack(z_buf, z_to_pack); - signature[32 + Li2_pack_zlen * ii : Li2_pack_zlen] = z_buf; - } - - // Clear the hints buffer - ?{}, i = #set0_64(); - while (i < Li2_omega + Li2_k) { - signature[Li2_pack_hstart + i] = 0; - i += 1; - } - - // Write hints - ?{}, k = #set0_64(); // The amounts of hints that were written - ?{}, i = #set0_64(); - while (i < Li2_k) { - ?{}, j = #set0_64(); - while (j < Li2_polydeg) { - addr = i; - addr <<= Li2_log2polydeg; - addr += j; - coeff = h[addr]; - if coeff != 0 { - signature[Li2_pack_hstart + k] = (8u) j; - k += 1; - } - j += 1; - } - signature[Li2_pack_hstart + Li2_omega + i] = (8u) k; - i += 1; - } - - return signature; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/params.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/params.jinc deleted file mode 100644 index 04eaa40e..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/params.jinc +++ /dev/null @@ -1,28 +0,0 @@ -// Modulus -param int Li2_q = 8380417; -// Dropped bits from t -param int Li2_d = 13; -// exp(d) -param int Li2_expd = 1 << Li2_d; -// poly degrees -param int Li2_polydeg = 256; -param int Li2_log2polydeg = 8; - -// byte-length of a packed t0/t1 polynomial -param int Li2_pack_t1len = 10 * Li2_polydeg / 8; -param int Li2_pack_t0len = 13 * Li2_polydeg / 8; - -// packed length of z for some specific gamma1 -param int Li2_pack_zlen_gamma1_217 = Li2_polydeg * 18 / 8; -param int Li2_pack_zlen_gamma1_219 = Li2_polydeg * 20 / 8; - -// packed length of mod-eta arrays -param int Li2_pack_eta_2_len = 96; -param int Li2_pack_eta_4_len = 128; - -// packed length of mod-gamma2 arrays -param int Li2_pack_highbitslen_gamma2_88 = 192; -param int Li2_pack_highbitslen_gamma2_32 = 128; - -// byte-lenth of a seed -param int Li2_seedbytes = 32; \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/params_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/params_end.jinc deleted file mode 100644 index 16aae53a..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/params_end.jinc +++ /dev/null @@ -1,19 +0,0 @@ -// This file is special. With the goal of moving as much code as possible -// into the common/ diretory, this file initialized all Diltihium params that -// are specific to one variant, but are based on other parameters. -// -// This file should be "required" at the end of each variant's "params.jinc" -// file. - -param int Li2_beta = Li2_tau * Li2_eta; - -//packing-related -param int Li2_pack_w1len = Li2_k * Li2_pack_highbitslen; -param int Li2_pack_s1len = Li2_l * Li2_pack_etalen; -param int Li2_pack_s2len = Li2_k * Li2_pack_etalen; -param int Li2_pack_s2loc = 3 * Li2_seedbytes + Li2_pack_s1len; -param int Li2_pack_t0loc = Li2_pack_s2loc + Li2_pack_s2len; - -param int Li2_PK_LEN = Li2_seedbytes + Li2_k * Li2_pack_t1len; -param int Li2_SK_LEN = 3 * Li2_seedbytes + Li2_l * Li2_pack_etalen + Li2_k * Li2_pack_etalen + Li2_k * Li2_pack_t0len; -param int Li2_SIGN_LEN = Li2_seedbytes + Li2_l * Li2_pack_zlen + Li2_omega + Li2_k; \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/poly.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/poly.jinc deleted file mode 100644 index 622913a8..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/poly.jinc +++ /dev/null @@ -1,147 +0,0 @@ -require "params.jinc" -require "montgomery.jinc" - -fn poly_add(reg ptr u32[Li2_polydeg] f g sum) - -> reg ptr u32[Li2_polydeg] -{ - reg u32 result v32; - - reg u64 i; - ?{}, i = #set0_64(); - while(i < Li2_polydeg) { - result = f[i]; - v32 = g[i]; - result += v32; - sum[i] = result; - i += 1; - } - return sum; -} - -fn poly_subtract(reg ptr u32[Li2_polydeg] f g difference) - -> reg ptr u32[Li2_polydeg] -{ - reg u32 result v32; - - reg u64 i; - ?{}, i = #set0_64(); - while(i < Li2_polydeg) { - result = f[i]; - v32 = g[i]; - result -= v32; - difference[i] = result; - i += 1; - } - return difference; -} - -fn poly_accumulate(reg ptr u32[Li2_polydeg] f sum) - -> reg ptr u32[Li2_polydeg] -{ - reg u32 v32 result; - - reg u64 i; - ?{}, i = #set0_64(); - while(i < Li2_polydeg) { - v32 = f[i]; - result = sum[i]; - result += v32; - sum[i] = result; - i += 1; - } - return sum; -} - -fn poly_reduce32(reg ptr u32[Li2_polydeg] poly) - -> reg ptr u32[Li2_polydeg] -{ - reg u64 i; - reg u32 val res; - - ?{}, i = #set0_64(); - while(i < Li2_polydeg) { - val = poly[i]; - res = reduce32(val); - poly[i] = res; - i += 1; - } - - return poly; -} - -fn poly_pointwise_montgomery(reg ptr u32[Li2_polydeg] fft_f fft_g fft_prod) - -> reg ptr u32[Li2_polydeg] -{ - reg u64 i; - reg u32 x1 x2; - reg u64 prod x2_64; - reg u32 prod_redc; - - ?{}, i = #set0_64(); - while(i < Li2_polydeg) { - x1 = fft_f[i]; - prod = (64s) x1; - x2 = fft_g[i]; - x2_64 = (64s) x2; - prod *= x2_64; - - prod_redc = montgomery_REDC(prod); - fft_prod[i] = prod_redc; - i += 1; - } - return fft_prod; -} - -fn zero_poly(reg ptr u32[Li2_polydeg] f) - -> reg ptr u32[Li2_polydeg] -{ - reg u64 i; - ?{}, i = #set0_64(); - while(i < Li2_polydeg) { - // Montgomery of 0 is 0 - f[i] = 0; - i += 1; - } - return f; -} - -fn poly_caddq(reg ptr u32[Li2_polydeg] f) - -> reg ptr u32[Li2_polydeg] -{ - reg u64 i; - reg u32 val; - ?{}, i = #set0_64(); - while(i < Li2_polydeg) { - val = f[i]; - val = caddq(val); - f[i] = val; - i += 1; - } - return f; -} - -inline -fn poly_checknorm(reg ptr u32[Li2_polydeg] f, inline int threshold) - -> stack u8 -{ - stack u8 r; - reg u8 result; - stack u8 result_s; - reg u8 c; - reg u64 i; - reg u32 val; - - result = 0; - - ?{}, i = #set0_64(); - while(i < Li2_polydeg) { - val = f[i]; - r = checknorm(val, threshold); - c = r; - result |= c; - i += 1; - } - - result_s = result; - return result_s; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/poly_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/poly_end.jinc deleted file mode 100644 index 605388dd..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/poly_end.jinc +++ /dev/null @@ -1,47 +0,0 @@ -require "rounding_end.jinc" - -inline -fn poly_make_hint(reg ptr u32[Li2_polydeg] f0 f1 hints) - -> stack u32, reg ptr u32[Li2_polydeg] -{ - stack u32 weight; - reg u64 i; - reg u32 a0 a1; - reg u32 h; - - i = 0; - while(i < Li2_polydeg) { - hints[i] = 0; - i += 1; - } - - weight = 0; - i = 0; - while(i < Li2_polydeg) { - a0 = f0[i]; - a1 = f1[i]; - h = make_hint(a0, a1); - hints[i] = h; - weight += h; - i += 1; - } - - return weight, hints; -} - -fn poly_use_hint(reg ptr u32[Li2_polydeg] w1 hints) - -> reg ptr u32[Li2_polydeg] -{ - reg u64 i; - reg u32 a h; - - i = 0; - while (i < Li2_polydeg) { - h = hints[i]; - a = w1[i]; - a = use_hint(a, h); - w1[i] = a; - i += 1; - } - return w1; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/polyvec_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/polyvec_end.jinc deleted file mode 100644 index afa6dc41..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/polyvec_end.jinc +++ /dev/null @@ -1,463 +0,0 @@ -require "poly.jinc" -require "rounding.jinc" - -fn reduce32_vecl(reg ptr u32[Li2_l * Li2_polydeg] vec) - -> reg ptr u32[Li2_l * Li2_polydeg] -{ - reg u64 i; - reg u32 val res; - - ?{}, i = #set0_64(); - while(i < Li2_l * Li2_polydeg) { - val = vec[i]; - res = reduce32(val); - vec[i] = res; - i += 1; - } - - return vec; -} - -fn reduce32_veck(reg ptr u32[Li2_k * Li2_polydeg] vec) - -> reg ptr u32[Li2_k * Li2_polydeg] -{ - reg u64 i; - reg u32 val res; - - ?{}, i = #set0_64(); - while(i < Li2_k * Li2_polydeg) { - val = vec[i]; - res = reduce32(val); - vec[i] = res; - i += 1; - } - - return vec; -} - -//TODO rename to reflect this is vecl -fn fft_vec(reg ptr u32[Li2_l * Li2_polydeg] vec) - -> reg ptr u32[Li2_l * Li2_polydeg] -{ - inline int i; - reg ptr u32[Li2_polydeg] entry; - - for i = 0 to Li2_l { - entry = vec[i * Li2_polydeg : Li2_polydeg]; - entry = fft(entry); - vec[i * Li2_polydeg : Li2_polydeg] = entry; - } - - return vec; -} - -fn fft_veck(reg ptr u32[Li2_k * Li2_polydeg] vec) - -> reg ptr u32[Li2_k * Li2_polydeg] -{ - inline int i; - reg ptr u32[Li2_polydeg] entry; - - for i = 0 to Li2_k { - entry = vec[i * Li2_polydeg : Li2_polydeg]; - entry = fft(entry); - vec[i * Li2_polydeg : Li2_polydeg] = entry; - } - - return vec; -} - -fn ifft_to_mont_vec(reg ptr u32[Li2_k * Li2_polydeg] vec) - -> reg ptr u32[Li2_k * Li2_polydeg] -{ - inline int i; - reg ptr u32[Li2_polydeg] entry; - - for i = 0 to Li2_k { - entry = vec[i * Li2_polydeg : Li2_polydeg]; - entry = ifft_to_mont(entry); - vec[i * Li2_polydeg : Li2_polydeg] = entry; - } - - return vec; -} - -fn ifft_to_mont_vecl(reg ptr u32[Li2_l * Li2_polydeg] vec) - -> reg ptr u32[Li2_l * Li2_polydeg] -{ - inline int i; - reg ptr u32[Li2_polydeg] entry; - - for i = 0 to Li2_l { - entry = vec[i * Li2_polydeg : Li2_polydeg]; - entry = ifft_to_mont(entry); - vec[i * Li2_polydeg : Li2_polydeg] = entry; - } - - return vec; -} - - -inline -fn power2round_vec(reg ptr u32[Li2_k * Li2_polydeg] v) - -> stack u32[Li2_k * Li2_polydeg], stack u32[Li2_k * Li2_polydeg] -{ - stack u32[Li2_k * Li2_polydeg] t1 t0; - reg u64 i; - reg u32 x y1 y2; - - ?{}, i = #set0_64(); - while(i < Li2_k * Li2_polydeg) { - x = v[i]; - y1, y2 = power2round(x); - t1[i] = y1; - t0[i] = y2; - i += 1; - } - - return t1, t0; -} - -inline -fn sum_vecs(reg ptr u32[Li2_k * Li2_polydeg] v1 v2) - -> stack u32[Li2_k * Li2_polydeg] -{ - stack u32[Li2_k * Li2_polydeg] vsum; - inline int i; - reg ptr u32[Li2_polydeg] v1_term v2_term vsum_term; - - for i = 0 to Li2_k { - v1_term = v1[Li2_polydeg * i : Li2_polydeg]; - v2_term = v2[Li2_polydeg * i : Li2_polydeg]; - vsum_term = vsum[Li2_polydeg * i : Li2_polydeg]; - vsum_term = poly_add(v1_term, v2_term, vsum_term); - vsum[Li2_polydeg * i : Li2_polydeg] = vsum_term; - } - return vsum; -} - -inline -fn sum_vecl(stack u32[Li2_l * Li2_polydeg] v1 v2) - -> stack u32[Li2_l * Li2_polydeg] -{ - stack u32[Li2_l * Li2_polydeg] vsum; - inline int i; - reg ptr u32[Li2_polydeg] v1_term v2_term vsum_term; - - for i = 0 to Li2_l { - v1_term = v1[Li2_polydeg * i : Li2_polydeg]; - v2_term = v2[Li2_polydeg * i : Li2_polydeg]; - vsum_term = vsum[Li2_polydeg * i : Li2_polydeg]; - vsum_term = poly_add(v1_term, v2_term, vsum_term); - vsum[Li2_polydeg * i : Li2_polydeg] = vsum_term; - } - return vsum; -} - -inline -fn subtract_vecl(stack u32[Li2_l * Li2_polydeg] v1 v2) - -> stack u32[Li2_l * Li2_polydeg] -{ - stack u32[Li2_l * Li2_polydeg] vdiff; - inline int i; - reg ptr u32[Li2_polydeg] v1_term v2_term vdiff_term; - - for i = 0 to Li2_l { - v1_term = v1[Li2_polydeg * i : Li2_polydeg]; - v2_term = v2[Li2_polydeg * i : Li2_polydeg]; - vdiff_term = vdiff[Li2_polydeg * i : Li2_polydeg]; - vdiff_term = poly_subtract(v1_term, v2_term, vdiff_term); - vdiff[Li2_polydeg * i : Li2_polydeg] = vdiff_term; - } - return vdiff; -} - -inline -fn subtract_veck(stack u32[Li2_k * Li2_polydeg] v1 v2) - -> stack u32[Li2_k * Li2_polydeg] -{ - stack u32[Li2_k * Li2_polydeg] vdiff; - inline int i; - reg ptr u32[Li2_polydeg] v1_term v2_term vdiff_term; - - for i = 0 to Li2_k { - v1_term = v1[Li2_polydeg * i : Li2_polydeg]; - v2_term = v2[Li2_polydeg * i : Li2_polydeg]; - vdiff_term = vdiff[Li2_polydeg * i : Li2_polydeg]; - vdiff_term = poly_subtract(v1_term, v2_term, vdiff_term); - vdiff[Li2_polydeg * i : Li2_polydeg] = vdiff_term; - } - return vdiff; -} - - - -inline -fn dot_prod_vecs(stack u32[Li2_l * Li2_polydeg] v1 v2, reg ptr u32[Li2_polydeg] dotprod) - -> reg ptr u32[Li2_polydeg] -{ - stack u32[Li2_polydeg] term_prod; - reg ptr u32[Li2_polydeg] term_prod_rsp; - - reg ptr u32[Li2_polydeg] v1_term v2_term; - - inline int i; - - dotprod = zero_poly(dotprod); - for i = 0 to Li2_l { - v1_term = v1[Li2_polydeg * i : Li2_polydeg]; - v2_term = v2[Li2_polydeg * i : Li2_polydeg]; - term_prod_rsp = term_prod; - term_prod_rsp = poly_pointwise_montgomery(v1_term, v2_term, term_prod_rsp); - dotprod = poly_accumulate(term_prod_rsp, dotprod); - term_prod = term_prod_rsp; - } - - return dotprod; -} - -inline -fn mult_mat_vec(reg ptr u32[Li2_k * Li2_l * Li2_polydeg] mat, - reg ptr u32[Li2_l * Li2_polydeg] vec) - -> stack u32[Li2_k * Li2_polydeg] -{ - stack u32[Li2_k * Li2_polydeg] out; - reg ptr u32[Li2_polydeg] out_rsp; - - inline int i; - for i = 0 to Li2_k { - out_rsp = out[Li2_polydeg * i : Li2_polydeg]; - out_rsp = dot_prod_vecs( - mat[Li2_l * Li2_polydeg * i : Li2_l * Li2_polydeg], - vec, out_rsp); - out[Li2_polydeg * i : Li2_polydeg] = out_rsp; - } - - return out; -} - -inline -fn pointwise_mont_mult(reg ptr u32[Li2_polydeg] f g fg) - -> reg ptr u32[Li2_polydeg] -{ - reg u64 i; - reg u32 v32; - reg u64 result gv_64; - reg u32 prod_redc; - ?{}, i = #set0_64(); - while(i < Li2_polydeg) { - v32 = f[i]; - result = (64s) v32; - v32 = g[i]; - gv_64 = (64s) v32; - result *= gv_64; - prod_redc = montgomery_REDC(result); - fg[i] = prod_redc; - i += 1; - } - return fg; -} - -// why am I doing this again? -inline -fn deep_copy_vecl(reg ptr u32[Li2_l * Li2_polydeg] vec) - -> stack u32[Li2_l * Li2_polydeg] -{ - stack u32[Li2_l * Li2_polydeg] dest; - reg u64 i; - reg u32 entry; - - ?{}, i = #set0_64(); - while(i < Li2_l * Li2_polydeg) { - entry = vec[i]; - dest[i] = entry; - i += 1; - } - return dest; -} - -inline -fn decompose_vec(reg ptr u32[Li2_k * Li2_polydeg] vec) - -> stack u32[Li2_k * Li2_polydeg], stack u32[Li2_k * Li2_polydeg] -{ - stack u32[Li2_k * Li2_polydeg] vec0 vec1; - reg u64 i; - reg u64 addr; - reg u32 a a0 a1; - - ?{}, i = #set0_64(); - while(i < Li2_k * Li2_polydeg) { - addr = i; - a = vec[addr]; - - a0, a1 = decompose(a); - - addr = i; - vec0[addr] = a0; - vec1[addr] = a1; - - i += 1; - } - - return vec0, vec1; -} - -inline -fn checknorm_veck(reg ptr u32[Li2_k * Li2_polydeg] vec, inline int threshold) - -> stack u8 -{ - reg u8 result; - stack u8 result_s; - stack u8 r; - reg u8 c; - inline int ii; - - result = 0; - for ii = 0 to Li2_k { - r = poly_checknorm(vec[ii * Li2_polydeg : Li2_polydeg], threshold); - c = r; - result |= c; - } - - result_s = result; - return result_s; -} - -inline -fn checknorm_vecl(reg ptr u32[Li2_l * Li2_polydeg] vec, inline int threshold) - -> stack u8 -{ - reg ptr u32[Li2_polydeg] vec_elem; - stack u8 result_s; - reg u8 result; - - stack u8 r; - reg u8 c; - - inline int ii; - - result = 0; - for ii = 0 to Li2_l { - vec_elem = vec[ii * Li2_polydeg : Li2_polydeg]; - r = poly_checknorm(vec_elem, threshold); - c = r; - result |= c; - } - - result_s = result; - return result_s; -} - -inline -fn mult_scalar_vec(reg ptr u32[Li2_polydeg] f, - reg ptr u32[Li2_l * Li2_polydeg] vec) - -> stack u32[Li2_l * Li2_polydeg] -{ - stack u32[Li2_l * Li2_polydeg] fvec; - - inline int ii; - reg ptr u32[Li2_polydeg] fg g; - - for ii = 0 to Li2_l { - fg = fvec[ii * Li2_polydeg : Li2_polydeg]; - g = vec[ii * Li2_polydeg : Li2_polydeg]; - fg = poly_pointwise_montgomery(f, g, fg); - fvec[ii * Li2_polydeg : Li2_polydeg] = fg; - } - - return fvec; -} - -inline -fn mult_scalar_veck(reg ptr u32[Li2_polydeg] f, - reg ptr u32[Li2_k * Li2_polydeg] vec) - -> stack u32[Li2_k * Li2_polydeg] -{ - stack u32[Li2_k * Li2_polydeg] fvec; - - inline int ii; - reg ptr u32[Li2_polydeg] fg g; - - for ii = 0 to Li2_k { - fg = fvec[ii * Li2_polydeg : Li2_polydeg]; - g = vec[ii * Li2_polydeg : Li2_polydeg]; - fg = poly_pointwise_montgomery(f, g, fg); - fvec[ii * Li2_polydeg : Li2_polydeg] = fg; - } - - return fvec; -} - -inline -fn polyveck_make_hint(reg ptr u32[Li2_k * Li2_polydeg] v0 v1) - -> stack u32, stack u32[Li2_k * Li2_polydeg] -{ - stack u32 total_weight weight_comp; - reg u32 reg_weight_comp; - reg u32 reg_total_weight; - stack u32[Li2_k * Li2_polydeg] hints; - - inline int i; - reg ptr u32[Li2_polydeg] hints_comp v0_comp v1_comp; - - total_weight = 0; - for i = 0 to Li2_k { - v0_comp = v0[i * Li2_polydeg : Li2_polydeg]; - v1_comp = v1[i * Li2_polydeg : Li2_polydeg]; - hints_comp = hints[i * Li2_polydeg : Li2_polydeg]; - - weight_comp, hints_comp = poly_make_hint(v0_comp, v1_comp, hints_comp); - - reg_weight_comp = weight_comp; - reg_total_weight = total_weight; - reg_total_weight += reg_weight_comp; - total_weight = reg_total_weight; - - hints[i * Li2_polydeg : Li2_polydeg] = hints_comp; - } - - return total_weight, hints; -} - -inline -fn polyvecl_caddq(reg ptr u32[Li2_l * Li2_polydeg] vec) - -> reg ptr u32[Li2_l * Li2_polydeg] -{ - inline int ii; - for ii = 0 to Li2_l { - vec[ii * Li2_polydeg : Li2_polydeg] = - poly_caddq(vec[ii * Li2_polydeg : Li2_polydeg]); - } - return vec; -} - -inline -fn polyveck_caddq(reg ptr u32[Li2_k * Li2_polydeg] vec) - -> reg ptr u32[Li2_k * Li2_polydeg] -{ - inline int ii; - for ii = 0 to Li2_k { - vec[ii * Li2_polydeg : Li2_polydeg] = - poly_caddq(vec[ii * Li2_polydeg : Li2_polydeg]); - } - return vec; -} - -/* -inline -fn polyvec_use_hint(reg ptr u32[Li2_k * Li2_polydeg] u hints) - -> stack u32[Li2_k * Li2_polydeg] -{ - reg ptr u32[Li2_polydeg] hints_comp u_comp; - inline int i; - stack u32 result_comp; - stack u32[Li2_k * Li2_polydeg] result; - - for i = 0 to Li2_k { - hints_comp = hints[i * Li2_polydeg : Li2_polydeg]; - u_comp = u[i * Li2_polydeg : Li2_polydeg]; - result_comp = poly_use_hint(hints_comp, u_comp); - result[i * Li2_polydeg : Li2_polydeg] = result_comp; - } - return result; -} -*/ diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/rounding.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/rounding.jinc deleted file mode 100644 index aafada34..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/rounding.jinc +++ /dev/null @@ -1,147 +0,0 @@ -require "params.jinc" - -fn power2round(reg u32 r) - -> reg u32, reg u32 -{ - /* - int32_t a1; //high bits - - a1 = (a + (1 << (D-1)) - 1) >> D; - *a0 = a - (a1 << D); - */ - - reg u32 highbits, lowbits; - reg u32 v32; - - highbits = r; - highbits += (1 << (Li2_d - 1)) - 1; - highbits >>= Li2_d; - - v32 = highbits; - v32 <<= Li2_d; - - lowbits = r; - lowbits -= v32; - - return highbits, lowbits; -} - -// high bits = a0, low bits = a1 -fn decompose_gamma2_88(reg u32 a) -> reg u32, reg u32 { - reg u64 a0 a1; - reg u32 a0_32 a1_32; - reg u64 v; - reg u64 v64; - - // a1 = (a + 127) >> 7; - a1 = (64u) a; - a1 += 127; - a1 >>= 7; - - // a1 = (a1*11275 + (1 << 23)) >> 24; - a1 *= 11275; - a1 += 1 << 23; - a1 >>= 24; - - // a1 ^= ((43 - a1) >> 31) & a1; - v = 43; - v -= a1; - v >>= 31; - v &= a1; - a1 ^= v; - - // *a0 = a - a1*2*GAMMA2; - v64 = (64u) a1; - v64 *= 2 * Li2_q / 88; - a0 = (64u) a; - a0 -= v64; - - // *a0 -= (((Q-1)/2 - *a0) >> 31) & Q; - v64 = (Li2_q - 1) / 2; - v64 -= a0; - v64 >>= 31; - v64 &= Li2_q; - a0 -= v64; - - a0_32 = (32u) a0; - a1_32 = (32u) a1; - return a0_32, a1_32; -} - -// high bits = a0, low bits = a1 -fn decompose_gamma2_32(reg u32 a) -> reg u32, reg u32 { - reg u64 a0; - reg u32 a0_32; - reg u32 a1; - reg u32 v; - reg u64 v64; - - // a1 = (a + 127) >> 7; - a1 = a; - a1 += 127; - a1 >>= 7; - - // a1 = (a1*1025 + (1 << 21)) >> 22; - v = a1; - a1 <<= 10; - a1 += v; - a1 += (int) (1 << 21); - a1 >>= 22; - - // a1 &= 15; - a1 &= 15; - - // *a0 = a - a1*2*GAMMA2; - v64 = (64u) a1; - v64 *= 2 * Li2_q / 32; - a0 = (64u) a; - a0 -= v64; - - // *a0 -= (((Q-1)/2 - *a0) >> 31) & Q; - v64 = (Li2_q - 1) / 2; - v64 -= a0; - v64 >>= 31; - v64 &= Li2_q; - a0 -= v64; - - a0_32 = (32u) a0; - return a0_32, a1; -} - -fn use_hint_gamma2_88(reg u32 a hint) - -> reg u32 -{ - reg u32 a0 a1 c32; - reg bool zf cf; - - a0, a1 = decompose_gamma2_88(a); - if (hint == 0) {} - else if (a0 >s 0) { - ?{}, c32 = #set0_32(); - a1 += 1; - zf = a1 == 44; - a1 = c32 if zf; - } else { - c32 = 43; - _, cf, _, _, _, a1 = #SUB_32(a1, 1); - a1 = c32 if cf; - } - return a1; -} - -fn use_hint_gamma2_32(reg u32 a hint) - -> reg u32 -{ - reg u32 a0; - reg u32 a1; - a0, a1 = decompose_gamma2_32(a); - if (hint == 0) {} - else if (a0 >s 0) { - a1 += 1; - a1 &= 15; - } else { - a1 -= 1; - a1 &= 15; - } - return a1; -} \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/rounding_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/rounding_end.jinc deleted file mode 100644 index e7e6e1b9..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/rounding_end.jinc +++ /dev/null @@ -1,17 +0,0 @@ -fn make_hint(reg u32 a0, reg u32 a1) -> reg u32 { - reg u32 result; - - result = 0; - - if a0 >s Li2_gamma2 { - result = 1; - } else if a0 reg u64 -{ - stack u64 s_sm; - - stack u8[Li2_SK_LEN] secret_key; // we need these two bc of testing overlapping pointers but double-checkme - stack u8[Li2_SIGN_LEN] signature; - reg u8 c; - reg u64 i r smlen; - stack u32 status; - reg u32 r_status; - - // - s_sm = sm; - - // copy secret key - ?{}, i = #set0(); - while(i < Li2_SK_LEN) { - c = [:u8 sk + i]; - secret_key[i] = c; - i += 1; - } // sk dead. - - // write smlen_p - smlen = mlen; - smlen += Li2_SIGN_LEN; - [:u64 smlen_p + 0] = smlen; // smlen_p dead. - - // copy message - sm = #LEA(sm + mlen + Li2_SIGN_LEN); - m = #LEA(m + mlen); - - ?{}, i = #set0(); - while(i < mlen) - { m -= 1; - c = [:u8 m + 0]; - sm -= 1; - [:u8 sm + 0] = c; - i += 1; - } - - signature, status = sign_inner(sm, mlen, secret_key); - - // copy signature - sm = s_sm; - ?{}, i = #set0(); - while(i < Li2_SIGN_LEN) - { c = signature[i]; - [:u8 sm + i] = c; - i += 1; - } - - // - r_status = status; - r = (64s) r_status; - return r; -} - -// -inline fn __open(reg u64 m mlen_p sm smlen pk) -> reg u64 -{ - stack u64 s_sm s_m; - reg u8 c; - reg u32 r32; - reg u64 i r mlen; - - // - s_sm = sm; - s_m = m; - - // write mlen_p - mlen = smlen - Li2_SIGN_LEN; // this is a variable renaming (mlen and smlen are merged) - [:u64 mlen_p + 0] = mlen; // mlen_p dead - m = #LEA(sm + Li2_SIGN_LEN); - - // verify - r32 = verify(sm, m, mlen, pk); - r = (64s) r32; - - // copy message from sm to m - sm = s_sm; - m = s_m; - - sm = #LEA(sm + Li2_SIGN_LEN); - ?{}, i = #set0(); - while(i < mlen) { - c = [:u8 sm + i]; - [:u8 m + i] = c; - i += 1; - } - - return r; -} - diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/sign_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/sign_end.jinc deleted file mode 100644 index 9aeda258..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/sign_end.jinc +++ /dev/null @@ -1,235 +0,0 @@ - -inline -fn compute_mu(reg u64 ptr_m, reg u64 m_len, reg ptr u8[Li2_SK_LEN] sk) - -> stack u8[64] -{ - stack u8[64] mu; - mu = hash_tr_m(sk[64:32], m_len, ptr_m); - return mu; -} - -inline -fn compute_rho_prime(reg ptr u8[32] k, reg ptr u8[64] mu) - -> stack u8[64] -{ - stack u8[64] rho_prime; - reg u8 c; - reg u64 i; - stack u64[25] state; - reg u64 mu_loc; - - state = st0(state); - ?{}, i = #set0_64(); - while(i < 32) { - c = k[i]; - state[:u8 i] = c; - i += 1; - } - while(i < 96) { - mu_loc = i; - mu_loc -= 32; - c = mu[mu_loc]; - state[:u8 i] = c; - i += 1; - } - - state[:u8 96] ^= 0x1f; - state[:u8 SHAKE256_RATE - 1] ^= 0x80; - - state = __keccakf1600_ref(state); - - ?{}, i = #set0_64(); - while(i < 64) { - c = state[:u8 i]; - rho_prime[i] = c; - i += 1; - } - return rho_prime; -} - -inline -fn sign_inner(reg u64 ptr_m, - reg u64 m_len, - reg ptr u8[Li2_SK_LEN] sk) - -> stack u8[Li2_SIGN_LEN], stack u32 -{ - stack u8[Li2_SIGN_LEN] signature; - - // parts of sk - stack u32[Li2_l * Li2_polydeg] s1; - stack u32[Li2_k * Li2_polydeg] s2; - stack u32[Li2_k * Li2_polydeg] t0; - - // automatic variables in spec - stack u32[Li2_k * Li2_l * Li2_polydeg] fft_matA; - stack u8[64] mu; - // corresponds to kappa/l in spec - stack u16 nonce; - reg u16 reg_nonce; - stack u8[64] rho_prime; - stack u32[Li2_l * Li2_polydeg] z; - stack u32[Li2_k * Li2_polydeg] h; - // w probably isn't necessary - can use w1 wherever w appears? - stack u32[Li2_k * Li2_polydeg] w0 w1; - stack u8[Li2_pack_w1len] packed_w1; - stack u32[Li2_k * Li2_polydeg] r0; - - // c-tilde unnecessary - // can just use signature[0:32] - // might need to redo pack_signature though - // not sure if pack_sig will go through otherwise - // with input and output overlapping - stack u8[32] c_tilde; - - //from SampleInBall - stack u32[Li2_polydeg] challenge; - - // while loop condition - stack u8 done; - // attempt: abort with error if we have tried too many times - stack u16 attempt; - // return status: ok == 0, err == -1 - stack u32 status; - // temporary bools used for while loop condition - reg bool tmpbool; - reg bool zf; - reg u8 tmpboolu8; - - // extra intermediate values - // not space-efficient... - // but this is reference impl so we're fine? - stack u32[Li2_l * Li2_polydeg] y; - stack u32[Li2_k * Li2_polydeg] w; - stack u32[Li2_l * Li2_polydeg] fft_y; - stack u32[Li2_l * Li2_polydeg] cs1; - stack u32[Li2_k * Li2_polydeg] cs2; - stack u32[Li2_k * Li2_polydeg] ct0; - stack u32[Li2_k * Li2_polydeg] r0_plus_ct0; - - stack u32 hints_weight; - stack u8 normcheck_result; - - s1, s2, t0 = unpack_sk(sk); - mu = compute_mu(ptr_m, m_len, sk); - rho_prime = compute_rho_prime(sk[32:32], mu); - - fft_matA = expandA(sk[0:32]); - - s1 = fft_vec(s1); - s2 = fft_veck(s2); - t0 = fft_veck(t0); - - nonce = 0; - done = 0; - attempt = 1; - status = -1; - while { - // The probability of a single attempt failing is, according to - // Equation (5) from the spec approximate to - // - // Pr[reject] = 1 - exp[ -256*beta * (l/gamma1 + k/gamma2) ] - // - // We can rewrite this equation in order to find the number of attempts - // for which the probability becomes so small that we should not - // expect that it ever happens: - // - // 128 - // #attempts = - --------------- - // log2 Pr[reject] - // - // The resulting value for the maximum number of attempts is set in - // the Li2_max_attempts param. - tmpbool = attempt > Li2_max_attempts; - tmpboolu8 = #SETcc(tmpbool); - tmpboolu8 |= done; - _, _, _, _, zf = #TEST_8(tmpboolu8, tmpboolu8); - } (zf) { - attempt += 1; - - reg_nonce = nonce; - y = expandMask(rho_prime, reg_nonce); - - nonce += 1; - fft_y = deep_copy_vecl(y); - fft_y = fft_vec(fft_y); - w = mult_mat_vec(fft_matA, fft_y); - w = reduce32_veck(w); - w = ifft_to_mont_vec(w); - - w = polyveck_caddq(w); - w0, w1 = decompose_vec(w); - packed_w1 = pack_w1(w1); - - c_tilde = hash_mu_w1(mu, packed_w1); - - challenge = sampleInBall(challenge, c_tilde); - challenge = fft(challenge); - - cs1 = mult_scalar_vec(challenge, s1); - cs1 = ifft_to_mont_vecl(cs1); - z = sum_vecl(cs1, y); - z = reduce32_vecl(z); - normcheck_result = checknorm_vecl(z, (int) (Li2_gamma1 - Li2_beta)); - - if(normcheck_result == 0) { - cs2 = mult_scalar_veck(challenge, s2); - cs2 = ifft_to_mont_vec(cs2); - r0 = subtract_veck(w0, cs2); - w0 = reduce32_veck(w0); - normcheck_result = checknorm_veck(r0, (int) (Li2_gamma2 - Li2_beta)); - if(normcheck_result == 0) { - ct0 = mult_scalar_veck(challenge, t0); - ct0 = ifft_to_mont_vec(ct0); - ct0 = reduce32_veck(ct0); - normcheck_result = checknorm_veck(ct0, Li2_gamma2); - if(normcheck_result == 0) { - r0_plus_ct0 = sum_vecs(r0, ct0); - - hints_weight, h = polyveck_make_hint(r0_plus_ct0, w1); - if(hints_weight < Li2_omega) { - done = 1; - status = 0; - } - } - } - } - } - - signature = pack_signature(c_tilde, z, h); - return signature, status; -} - -inline -fn sign(reg u64 ptr_signature, reg u64 ptr_m, reg u64 m_len, reg u64 ptr_sk) -> stack u32 { - stack u8[Li2_SK_LEN] sk; - reg u8 c; - stack u32 status; - reg u64 i; - stack u8[Li2_SIGN_LEN] signature; - - stack u64 s_ptr_signature; - reg u64 sig_addr; - - // spilling this - s_ptr_signature = ptr_signature; - - ?{}, i = #set0_64(); - while(i < Li2_SK_LEN) { - c = [:u8 ptr_sk + i]; - sk[i] = c; - i += 1; - } - - signature, status = sign_inner(ptr_m, m_len, sk); - - sig_addr = s_ptr_signature; - - ?{}, i = #set0_64(); - while(i < Li2_SIGN_LEN) { - c = signature[i]; - [:u8 sig_addr + i] = c; - i += 1; - } - - return status; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/twiddle_factors.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/twiddle_factors.jinc deleted file mode 100644 index d88bc5a9..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/twiddle_factors.jinc +++ /dev/null @@ -1,19 +0,0 @@ -u32[256] twiddle_factors = { - 25847, -2608894, -518909, 237124, -777960, -876248, 466468, 1826347, 2353451, -359251, -2091905, 3119733, -2884855, 3111497, 2680103, 2725464, - 1024112, -1079900, 3585928, -549488, -1119584, 2619752, -2108549, -2118186, -3859737, -1399561, -3277672, 1757237, -19422, 4010497, 280005, 2706023, - 95776, 3077325, 3530437, -1661693, -3592148, -2537516, 3915439, -3861115, -3043716, 3574422, -2867647, 3539968, -300467, 2348700, -539299, -1699267, - -1643818, 3505694, -3821735, 3507263, -2140649, -1600420, 3699596, 811944, 531354, 954230, 3881043, 3900724, -2556880, 2071892, -2797779, -3930395, - -1528703, -3677745, -3041255, -1452451, 3475950, 2176455, -1585221, -1257611, 1939314, -4083598, -1000202, -3190144, -3157330, -3632928, 126922, 3412210, - -983419, 2147896, 2715295, -2967645, -3693493, -411027, -2477047, -671102, -1228525, -22981, -1308169, -381987, 1349076, 1852771, -1430430, -3343383, - 264944, 508951, 3097992, 44288, -1100098, 904516, 3958618, -3724342, -8578, 1653064, -3249728, 2389356, -210977, 759969, -1316856, 189548, - -3553272, 3159746, -1851402, -2409325, -177440, 1315589, 1341330, 1285669, -1584928, -812732, -1439742, -3019102, -3881060, -3628969, 3839961, 2091667, - - 3407706, 2316500, 3817976, -3342478, 2244091, -2446433, -3562462, 266997, 2434439, -1235728, 3513181, -3520352, -3759364, -1197226, -3193378, 900702, - 1859098, 909542, 819034, 495491, -1613174, -43260, -522500, -655327, -3122442, 2031748, 3207046, -3556995, -525098, -768622, -3595838, 342297, - 286988, -2437823, 4108315, 3437287, -3342277, 1735879, 203044, 2842341, 2691481, -2590150, 1265009, 4055324, 1247620, 2486353, 1595974, -3767016, - 1250494, 2635921, -3548272, -2994039, 1869119, 1903435, -1050970, -1333058, 1237275, -3318210, -1430225, -451100, 1312455, 3306115, -1962642, -1279661, - 1917081, -2546312, -1374803, 1500165, 777191, 2235880, 3406031, -542412, -2831860, -1671176, -1846953, -2584293, -3724270, 594136, -3776993, -2013608, - 2432395, 2454455, -164721, 1957272, 3369112, 185531, -1207385, -3183426, 162844, 1616392, 3014001, 810149, 1652634, -3694233, -1799107, -3038916, - 3523897, 3866901, 269760, 2213111, -975884, 1717735, 472078, -426683, 1723600, -1803090, 1910376, -1667432, -1104333, -260646, -3833893, -2939036, - -2235985, -420899, -2286327, 183443, -976891, 1612842, -3545687, -554416, 3919660, -48306, -1362209, 3937738, 1400424, -846154, 1976782, 0 -}; diff --git a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/verify_end.jinc b/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/verify_end.jinc deleted file mode 100644 index 4384e1e9..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/common/amd64/verify_end.jinc +++ /dev/null @@ -1,260 +0,0 @@ -inline -fn poly_shiftl(reg ptr u32[Li2_polydeg] f) -> reg ptr u32[Li2_polydeg] { - reg u64 i; - reg u32 coeff; - - ?{}, i = #set0_64(); - while (i < Li2_polydeg) { - coeff = f[i]; - coeff <<= Li2_d; - f[i] = coeff; - i += 1; - } - - return f; -} - -fn unpack_hints(reg ptr u8[Li2_omega + Li2_k] hints_buf, reg ptr u32[Li2_k * Li2_polydeg] hints) - -> reg ptr u32[Li2_k * Li2_polydeg], reg u8 { - // This function is not inline, because I have had experiences with the - // register allocation failing (when it should be able to succeed) when - // this function was inlined. - - reg u64 i j; - reg u8 done fail status; - reg bool tmp; - reg u32 zero; - reg u64 k hints_elem_offset idx idx1 idx2 idxtmp; - reg u64 hints_cumpop; // cumulative popcount of hints - - // Unpack h - ?{}, fail = #set0_8(); - ?{}, k = #set0_64(); - ?{}, i = #set0_64(); - while { - tmp = i >= Li2_k; - done = #SETcc(tmp); - done |= fail; - } (done == 0) { - hints_elem_offset = i; - hints_elem_offset <<= Li2_log2polydeg; - ?{}, j = #set0_64(); - ?{}, zero = #set0_32(); - while (j < Li2_polydeg) { - idx = #LEA_64(hints_elem_offset + j); - hints[idx] = zero; - j += 1; - } - - // if (sig[OMEGA + i] < k || sig[OMEGA + i] > OMEGA) { return 1; } - hints_cumpop = (64u)hints_buf[Li2_omega + i]; - if (hints_cumpop < k) { - fail = 1; - } else { - if (hints_cumpop > Li2_omega) { - fail = 1; - } else { - j = k; - while { - tmp = j >= hints_cumpop; - done = #SETcc(tmp); - done = done | fail; - } (done == 0) { - // Coefficients are ordered for strong unforgeability - // if(j > k && sig[j] <= sig[j-1]) return 1; - idx1 = (64u)hints_buf[j]; - if (j > k) { - idx2 = (64u)hints_buf[(uint) j-1]; - if (idx1 <= idx2) { - fail = 1; - } - } - if (fail == 0) { - // h->vec[i].coeffs[sig[j]] = 1; - idxtmp = #LEA_64(hints_elem_offset + idx1); - hints[idxtmp] = 1; - - j += 1; - - } - } - } - } - // k = sig[OMEGA + i]; - k = hints_cumpop; - i += 1; - } - - // fail is `0` or `1`. Map it to a `0` or `-1` status code. - status = -fail; - return hints, status; -} - - -inline -fn cmp_ctilde(stack u8[32] c_tilde1 c_tilde2) -> reg u8 { - // TODO: Short circuit on failure - - reg u64 i; - reg u8 b1 b2 result; - - ?{}, result = #set0_8(); - ?{}, i = #set0_64(); - while (i < 32) { - b1 = c_tilde1[i]; - b2 = c_tilde2[i]; - if (b1 != b2) { - result |= 0xFF; - } - i += 1; - } - return result; -} - -inline -fn verify_inner(stack ptr u8[Li2_SIGN_LEN] sig, reg u64 m, reg u64 m_len, stack ptr u8[Li2_PK_LEN] pk) -> stack u32 { - // TODO: Go through the code and check for all operators - // whether they should be signed or unsigned. - - reg u32 r_status; - stack u32 status; - stack u8 z_normcheck_fail c_tilde_result; - reg u64 i; - reg u8 byte; - reg u8 hints_popcount_fail; - - reg ptr u8[Li2_SIGN_LEN] sig_rsp; - reg ptr u8[Li2_PK_LEN] pk_rsp; - - stack u64[25] keccak_state; - reg ptr u64[25] keccak_state_rsp; - stack u8[32] tr c_tilde c_tilde2; - reg ptr u8[32] tr_rsp; - stack u8[64] mu; - - stack u32[Li2_k * Li2_l * Li2_polydeg] fft_matA; - stack u32[Li2_polydeg] challenge t1_elem ct1_elem; - stack u32[Li2_l * Li2_polydeg] z; - stack u32[Li2_k * Li2_polydeg] az w1 hints; - - stack u8[Li2_pack_w1len] w1_buf; - reg ptr u32[Li2_polydeg] z_to_unpack az_elem w1_elem hints_elem; - reg ptr u8[Li2_pack_zlen] z_buf; - reg ptr u8[Li2_pack_t1len] t1_buf; - reg ptr u8[Li2_omega + Li2_k] hints_buf; - - inline int ii; - - //status = 0xFF; - r_status = -1; - status = r_status; - - // Sample A - fft_matA = expandA(pk[0:32]); - - // Compute mu - keccak_state_rsp = keccak_state; - keccak_state = st0(keccak_state_rsp); - keccak_state = keccak_state_rsp; - pk_rsp = pk; - tr_rsp = tr; - tr_rsp = shake256_of_pk(pk_rsp, tr_rsp); - tr = tr_rsp; - mu = hash_tr_m(tr, m_len, m); - - // Unpack z - sig_rsp = sig; - for ii = 0 to Li2_l { - z_buf = sig_rsp[32 + ii * Li2_pack_zlen : Li2_pack_zlen]; - z_to_unpack = z[ii * Li2_polydeg : Li2_polydeg]; - z_to_unpack = polyz_unpack(z_to_unpack, z_buf); - z[ii * Li2_polydeg : Li2_polydeg] = z_to_unpack; - } - z_normcheck_fail = checknorm_vecl(z, (uint) (Li2_gamma1 - Li2_beta)); - if (z_normcheck_fail == 0) { - z = fft_vec(z); - - sig_rsp = sig; - hints_buf = sig_rsp[Li2_pack_hstart : Li2_omega + Li2_k]; - hints, hints_popcount_fail = unpack_hints(hints_buf, hints); - if (hints_popcount_fail == 0) { - - // Compute A * z - az = mult_mat_vec(fft_matA, z); - - // Sample challenge - sig_rsp = sig; - ?{}, i = #set0_64(); - while (i < 32) { - byte = sig_rsp[i]; - c_tilde[i] = byte; - i += 1; - } - challenge = sampleInBall(challenge, c_tilde); - - // Compute c*t1 and add to w1 - challenge = fft(challenge); - - for ii = 0 to Li2_k { - pk_rsp = pk; - t1_buf = pk_rsp[32 + ii * Li2_pack_t1len : Li2_pack_t1len]; - t1_elem = polyt1_unpack(t1_elem, t1_buf); - t1_elem = poly_shiftl(t1_elem); - t1_elem = fft(t1_elem); - ct1_elem = pointwise_mont_mult(challenge, t1_elem, ct1_elem); - az_elem = az[ii * Li2_polydeg : Li2_polydeg]; - w1_elem = w1[ii * Li2_polydeg : Li2_polydeg]; - w1_elem = poly_subtract(az_elem, ct1_elem, w1_elem); - w1_elem = poly_reduce32(w1_elem); - w1_elem = ifft_to_mont(w1_elem); - w1_elem = poly_caddq(w1_elem); - hints_elem = hints[ii * Li2_polydeg : Li2_polydeg]; - w1_elem = poly_use_hint(w1_elem, hints_elem); - w1[ii * Li2_polydeg : Li2_polydeg] = w1_elem; - } - w1_buf = pack_w1(w1); - c_tilde2 = hash_mu_w1(mu, w1_buf); - c_tilde_result = cmp_ctilde(c_tilde, c_tilde2); - if (c_tilde_result == 0) { - status = 0; - } - } - } - return status; -} - -inline -fn verify(reg u64 ptr_sig, reg u64 ptr_m, reg u64 m_len, reg u64 ptr_pk) -> reg u32 { - stack u8[Li2_PK_LEN] pk; - reg ptr u8[Li2_PK_LEN] pk_rsp; - stack u8[Li2_SIGN_LEN] sig; - reg ptr u8[Li2_SIGN_LEN] sig_rsp; - - reg u8 byte; - reg u64 i; - reg u32 status; - - pk_rsp = pk; - sig_rsp = sig; - - ?{}, i = #set0_64(); - while(i < Li2_PK_LEN) { - byte = [:u8 ptr_pk + i]; - pk_rsp[i] = byte; - i += 1; - } - - ?{}, i = #set0_64(); - while(i < Li2_SIGN_LEN) { - byte = [:u8 ptr_sig + i]; - sig_rsp[i] = byte; - i += 1; - } - - status = verify_inner(sig_rsp, ptr_m, m_len, pk_rsp); - - pk = pk_rsp; - sig = sig_rsp; - - return status; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/META.yml b/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/META.yml deleted file mode 100644 index 9414649e..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/META.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: Dilithium2 -type: sign -checksumsmall: 4797f974ea6e9e7fd018abbaf70efe2f1d10f6c2e6b172c55f371f0793ec3929 -checksumbig: 640685e7cb128c2c14057138cf0217ade007b19a99c037634b8a8fdfa55eb74c -claimed-nist-level: 3 -implementations: - - name: amd64/ref - version: 0.1 - supported_platforms: - - architecture: x86_64 - operating_systems: - - Linux - - Darwin - - name: amd64/avx2 - version: 0.1 - supported_platforms: - - architecture: x86_64 - operating_systems: - - Linux - - Darwin diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/Makefile b/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/Makefile deleted file mode 100644 index d6efc98e..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/Makefile +++ /dev/null @@ -1,2 +0,0 @@ -SRCS := sign.jazz -include ../../../../../Makefile.common diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/common.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/common.jinc deleted file mode 100644 index d8f19529..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/common.jinc +++ /dev/null @@ -1,54 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/avx2/expandMask.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/expandS.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/fips202.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/avx2/poly.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/rounding.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/avx2/ntt.jinc" - -require "params.jinc" -require "packing.jinc" - -inline -fn decompose(reg u32 a) -> reg u32, reg u32 { - reg u32 a0; - reg u32 a1; - a0, a1 = decompose_gamma2_88(a); - return a0, a1; -} - -inline -fn use_hint(reg u32 a hint) - -> reg u32 -{ - reg u32 a1; - a1 = use_hint_gamma2_88(a, hint); - return a1; -} - -inline -fn expandMask_poly_4x(reg ptr u32[4 * Li2_polydeg] f_4x, reg ptr u8[64] rho_prime, stack u16 kappa) - -> reg ptr u32[4 * Li2_polydeg] { - f_4x = expandMask_poly_gamma1_217_4x(f_4x, rho_prime, kappa); - return f_4x; -} - -inline -fn expandS_poly(stack u8[64] rho_prime, reg u16 elem_idx, reg ptr u32[Li2_polydeg] buf) - -> reg ptr u32[Li2_polydeg] { - buf = expandSEta2_poly(rho_prime, elem_idx, buf); - return buf; -} - -from Jade require "crypto_sign/dilithium/common/amd64/avx2/expandA_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/avx2/expandMask_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/expandS_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/hashing_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/avx2/poly_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/avx2/polyvec_end.jinc" - -inline -fn expandA(stack u8[32] rho) -> stack u32[Li2_k * Li2_l * Li2_polydeg] { - stack u32[Li2_k * Li2_l * Li2_polydeg] matrix; - matrix = expandA_aligned(rho); - return matrix; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/include/api.h b/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/include/api.h deleted file mode 100644 index 75250f54..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/include/api.h +++ /dev/null @@ -1,37 +0,0 @@ -#ifndef JADE_SIGN_dilithium_dilithium2_amd64_avx2_API_H -#define JADE_SIGN_dilithium_dilithium2_amd64_avx2_API_H - -#define JADE_SIGN_dilithium_dilithium2_amd64_avx2_PUBLICKEYBYTES 1312 -#define JADE_SIGN_dilithium_dilithium2_amd64_avx2_SECRETKEYBYTES 2528 -#define JADE_SIGN_dilithium_dilithium2_amd64_avx2_BYTES 2420 -#define JADE_SIGN_dilithium_dilithium2_amd64_avx2_DETERMINISTIC 1 - -#define JADE_SIGN_dilithium_dilithium2_amd64_avx2_ALGNAME "Dilithium2" -#define JADE_SIGN_dilithium_dilithium2_amd64_avx2_ARCH "amd64" -#define JADE_SIGN_dilithium_dilithium2_amd64_avx2_IMPL "avx2" - -#include - -int jade_sign_dilithium_dilithium2_amd64_avx2_keypair( - uint8_t *public_key, - uint8_t *secret_key -); - -int jade_sign_dilithium_dilithium2_amd64_avx2( - uint8_t *signed_message, - uint64_t *signed_message_length, - const uint8_t *message, - uint64_t message_length, - const uint8_t *secret_key -); - -int jade_sign_dilithium_dilithium2_amd64_avx2_open( - uint8_t *message, - uint64_t *message_length, - const uint8_t *signed_message, - uint64_t signed_message_length, - const uint8_t *public_key -); - -#endif - diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/packing.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/packing.jinc deleted file mode 100644 index 7bb9182b..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/packing.jinc +++ /dev/null @@ -1,67 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/montgomery.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/packing.jinc" - -require "params.jinc" - -fn pack_s1(reg ptr u32[Li2_l * Li2_polydeg] s1, reg ptr u8[Li2_pack_s1len] dest) - -> reg ptr u8[Li2_pack_s1len] -{ - inline int ii; - reg ptr u8[Li2_pack_etalen] buf; - reg ptr u32[Li2_polydeg] poly; - - for ii = 0 to Li2_l { - buf = dest[Li2_pack_etalen * ii : Li2_pack_etalen]; - poly = s1[Li2_polydeg * ii : Li2_polydeg]; - dest[Li2_pack_etalen * ii : Li2_pack_etalen] = polyeta_2_pack(poly, buf); - } - return dest; -} - -fn pack_s2(reg ptr u32[Li2_k * Li2_polydeg] s1, reg ptr u8[Li2_pack_s2len] dest) - -> reg ptr u8[Li2_pack_s2len] -{ - inline int ii; - reg ptr u8[Li2_pack_etalen] buf; - reg ptr u32[Li2_polydeg] poly; - - for ii = 0 to Li2_k { - buf = dest[Li2_pack_etalen * ii : Li2_pack_etalen]; - poly = s1[Li2_polydeg * ii : Li2_polydeg]; - dest[Li2_pack_etalen * ii : Li2_pack_etalen] = polyeta_2_pack(poly, buf); - } - return dest; -} - -fn polyeta_unpack(reg ptr u32[Li2_polydeg] r, reg ptr u8[Li2_pack_etalen] a) - -> reg ptr u32[Li2_polydeg] -{ - r = polyeta_2_unpack(r, a); - return r; -} - -inline -fn polyz_pack(reg ptr u8[Li2_pack_zlen] r, reg ptr u32[Li2_polydeg] a) - -> reg ptr u8[Li2_pack_zlen] -{ - r = polyz_pack_gamma1_217(r, a); - return r; -} - -inline -fn polyz_unpack(reg ptr u32[Li2_polydeg] r, reg ptr u8[Li2_pack_zlen] a) - -> reg ptr u32[Li2_polydeg] -{ - r = polyz_unpack_gamma1_217(r, a); - return r; -} - -inline -fn polyw1_pack(reg ptr u32[Li2_polydeg] w1, reg ptr u8[Li2_pack_highbitslen] w1_buf) - -> reg ptr u8[Li2_pack_highbitslen] -{ - w1_buf = polyw1_pack_gamma2_88(w1, w1_buf); - return w1_buf; -} - -from Jade require "crypto_sign/dilithium/common/amd64/packing_end.jinc" \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/params.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/params.jinc deleted file mode 100644 index 861653fd..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/params.jinc +++ /dev/null @@ -1,19 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/params.jinc" - -param int Li2_k = 4; -param int Li2_l = 4; -param int Li2_gamma1 = (1 << 17); -param int Li2_gamma2 = (Li2_q - 1) / 88; -param int Li2_tau = 39; -param int Li2_eta = 2; -param int Li2_omega = 80; -param int Li2_max_attempts = 331; - -// naming taken from C ref -// actual lengths are K times the above... -param int Li2_pack_etalen = Li2_pack_eta_2_len; -param int Li2_pack_highbitslen = Li2_pack_highbitslen_gamma2_88; -param int Li2_pack_zlen = Li2_pack_zlen_gamma1_217; -param int Li2_pack_hstart = Li2_seedbytes + Li2_l * Li2_pack_zlen; - -from Jade require "crypto_sign/dilithium/common/amd64/params_end.jinc" \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/sign.jazz b/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/sign.jazz deleted file mode 100644 index 784391d6..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/avx2/sign.jazz +++ /dev/null @@ -1,52 +0,0 @@ -require "common.jinc" -require "packing.jinc" -require "params.jinc" - -from Jade require "crypto_sign/dilithium/common/amd64/keygen_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/avx2/sign_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/verify_end.jinc" - -from Jade require "crypto_sign/dilithium/common/amd64/sign.jinc" - -export fn jade_sign_dilithium_dilithium2_amd64_avx2_keypair( - reg u64 public_key - secret_key - ) -> reg u64 -{ - reg u64 r; - keygen(public_key, secret_key); - ?{}, r = #set0(); - return r; -} - - -export fn jade_sign_dilithium_dilithium2_amd64_avx2( - reg u64 signed_message - signed_message_length - message - message_length - secret_key - ) -> reg u64 -{ - reg u64 r; - r = __sign(signed_message, signed_message_length, - message, message_length, secret_key); - return r; -} - - -export fn jade_sign_dilithium_dilithium2_amd64_avx2_open( - reg u64 message - message_length - signed_message - signed_message_length - public_key - ) -> reg u64 -{ - reg u64 r; - r = __open(message, message_length, - signed_message, signed_message_length, public_key); - return r; -} - - diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/Makefile b/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/Makefile deleted file mode 100644 index d6efc98e..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/Makefile +++ /dev/null @@ -1,2 +0,0 @@ -SRCS := sign.jazz -include ../../../../../Makefile.common diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/common.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/common.jinc deleted file mode 100644 index ae39ae2f..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/common.jinc +++ /dev/null @@ -1,47 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/expandMask.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/expandS.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/fips202.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/ntt.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/poly.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/rounding.jinc" - -require "params.jinc" -require "packing.jinc" - -inline -fn decompose(reg u32 a) -> reg u32, reg u32 { - reg u32 a0; - reg u32 a1; - a0, a1 = decompose_gamma2_88(a); - return a0, a1; -} - -inline -fn use_hint(reg u32 a hint) - -> reg u32 -{ - reg u32 a1; - a1 = use_hint_gamma2_88(a, hint); - return a1; -} - -inline -fn expandMask_poly(reg ptr u32[Li2_polydeg] f, reg ptr u8[64] rho_prime, stack u16 kappa) - -> reg ptr u32[Li2_polydeg] { - f = expandMask_poly_gamma1_217(f, rho_prime, kappa); - return f; -} - -inline -fn expandS_poly(stack u8[64] rho_prime, reg u16 elem_idx, reg ptr u32[Li2_polydeg] buf) - -> reg ptr u32[Li2_polydeg] { - buf = expandSEta2_poly(rho_prime, elem_idx, buf); - return buf; -} - -from Jade require "crypto_sign/dilithium/common/amd64/expandA_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/expandMask_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/expandS_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/hashing_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/poly_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/polyvec_end.jinc" diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/include/api.h b/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/include/api.h deleted file mode 100644 index 6d4ff35b..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/include/api.h +++ /dev/null @@ -1,37 +0,0 @@ -#ifndef JADE_SIGN_dilithium_dilithium2_amd64_ref_API_H -#define JADE_SIGN_dilithium_dilithium2_amd64_ref_API_H - -#define JADE_SIGN_dilithium_dilithium2_amd64_ref_PUBLICKEYBYTES 1312 -#define JADE_SIGN_dilithium_dilithium2_amd64_ref_SECRETKEYBYTES 2528 -#define JADE_SIGN_dilithium_dilithium2_amd64_ref_BYTES 2420 -#define JADE_SIGN_dilithium_dilithium2_amd64_ref_DETERMINISTIC 1 - -#define JADE_SIGN_dilithium_dilithium2_amd64_ref_ALGNAME "Dilithium2" -#define JADE_SIGN_dilithium_dilithium2_amd64_ref_ARCH "amd64" -#define JADE_SIGN_dilithium_dilithium2_amd64_ref_IMPL "ref" - -#include - -int jade_sign_dilithium_dilithium2_amd64_ref_keypair( - uint8_t *public_key, - uint8_t *secret_key -); - -int jade_sign_dilithium_dilithium2_amd64_ref( - uint8_t *signed_message, - uint64_t *signed_message_length, - const uint8_t *message, - uint64_t message_length, - const uint8_t *secret_key -); - -int jade_sign_dilithium_dilithium2_amd64_ref_open( - uint8_t *message, - uint64_t *message_length, - const uint8_t *signed_message, - uint64_t signed_message_length, - const uint8_t *public_key -); - -#endif - diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/packing.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/packing.jinc deleted file mode 100644 index 7bb9182b..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/packing.jinc +++ /dev/null @@ -1,67 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/montgomery.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/packing.jinc" - -require "params.jinc" - -fn pack_s1(reg ptr u32[Li2_l * Li2_polydeg] s1, reg ptr u8[Li2_pack_s1len] dest) - -> reg ptr u8[Li2_pack_s1len] -{ - inline int ii; - reg ptr u8[Li2_pack_etalen] buf; - reg ptr u32[Li2_polydeg] poly; - - for ii = 0 to Li2_l { - buf = dest[Li2_pack_etalen * ii : Li2_pack_etalen]; - poly = s1[Li2_polydeg * ii : Li2_polydeg]; - dest[Li2_pack_etalen * ii : Li2_pack_etalen] = polyeta_2_pack(poly, buf); - } - return dest; -} - -fn pack_s2(reg ptr u32[Li2_k * Li2_polydeg] s1, reg ptr u8[Li2_pack_s2len] dest) - -> reg ptr u8[Li2_pack_s2len] -{ - inline int ii; - reg ptr u8[Li2_pack_etalen] buf; - reg ptr u32[Li2_polydeg] poly; - - for ii = 0 to Li2_k { - buf = dest[Li2_pack_etalen * ii : Li2_pack_etalen]; - poly = s1[Li2_polydeg * ii : Li2_polydeg]; - dest[Li2_pack_etalen * ii : Li2_pack_etalen] = polyeta_2_pack(poly, buf); - } - return dest; -} - -fn polyeta_unpack(reg ptr u32[Li2_polydeg] r, reg ptr u8[Li2_pack_etalen] a) - -> reg ptr u32[Li2_polydeg] -{ - r = polyeta_2_unpack(r, a); - return r; -} - -inline -fn polyz_pack(reg ptr u8[Li2_pack_zlen] r, reg ptr u32[Li2_polydeg] a) - -> reg ptr u8[Li2_pack_zlen] -{ - r = polyz_pack_gamma1_217(r, a); - return r; -} - -inline -fn polyz_unpack(reg ptr u32[Li2_polydeg] r, reg ptr u8[Li2_pack_zlen] a) - -> reg ptr u32[Li2_polydeg] -{ - r = polyz_unpack_gamma1_217(r, a); - return r; -} - -inline -fn polyw1_pack(reg ptr u32[Li2_polydeg] w1, reg ptr u8[Li2_pack_highbitslen] w1_buf) - -> reg ptr u8[Li2_pack_highbitslen] -{ - w1_buf = polyw1_pack_gamma2_88(w1, w1_buf); - return w1_buf; -} - -from Jade require "crypto_sign/dilithium/common/amd64/packing_end.jinc" \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/params.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/params.jinc deleted file mode 100644 index 861653fd..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/params.jinc +++ /dev/null @@ -1,19 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/params.jinc" - -param int Li2_k = 4; -param int Li2_l = 4; -param int Li2_gamma1 = (1 << 17); -param int Li2_gamma2 = (Li2_q - 1) / 88; -param int Li2_tau = 39; -param int Li2_eta = 2; -param int Li2_omega = 80; -param int Li2_max_attempts = 331; - -// naming taken from C ref -// actual lengths are K times the above... -param int Li2_pack_etalen = Li2_pack_eta_2_len; -param int Li2_pack_highbitslen = Li2_pack_highbitslen_gamma2_88; -param int Li2_pack_zlen = Li2_pack_zlen_gamma1_217; -param int Li2_pack_hstart = Li2_seedbytes + Li2_l * Li2_pack_zlen; - -from Jade require "crypto_sign/dilithium/common/amd64/params_end.jinc" \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/sign.jazz b/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/sign.jazz deleted file mode 100644 index c09eae2e..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium2/amd64/ref/sign.jazz +++ /dev/null @@ -1,50 +0,0 @@ -require "common.jinc" -require "packing.jinc" -require "params.jinc" - -from Jade require "crypto_sign/dilithium/common/amd64/keygen_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/sign_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/verify_end.jinc" - -from Jade require "crypto_sign/dilithium/common/amd64/sign.jinc" - -export fn jade_sign_dilithium_dilithium2_amd64_ref_keypair( - reg u64 public_key - secret_key - ) -> reg u64 -{ - reg u64 r; - keygen(public_key, secret_key); - ?{}, r = #set0(); - return r; -} - -export fn jade_sign_dilithium_dilithium2_amd64_ref( - reg u64 signed_message - signed_message_length - message - message_length - secret_key - ) -> reg u64 -{ - reg u64 r; - r = __sign(signed_message, signed_message_length, - message, message_length, secret_key); - return r; -} - - -export fn jade_sign_dilithium_dilithium2_amd64_ref_open( - reg u64 message - message_length - signed_message - signed_message_length - public_key - ) -> reg u64 -{ - reg u64 r; - r = __open(message, message_length, - signed_message, signed_message_length, public_key); - return r; -} - diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/META.yml b/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/META.yml deleted file mode 100644 index f10ececa..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/META.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: Dilithium3 -type: sign -checksumsmall: b9541847294ba0b1f721468d44890d155f3a62e3bf752ceea6e9f136902654d9 -checksumbig: 31b34edde2d0b1151e2c662d94c773a48432fbb9e32f22f0b29e861f32a70bc8 -claimed-nist-level: 3 -implementations: - - name: amd64/ref - version: 0.1 - supported_platforms: - - architecture: x86_64 - operating_systems: - - Linux - - Darwin - - name: amd64/avx2 - version: 0.1 - supported_platforms: - - architecture: x86_64 - operating_systems: - - Linux - - Darwin diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/Makefile b/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/Makefile deleted file mode 100644 index d6efc98e..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/Makefile +++ /dev/null @@ -1,2 +0,0 @@ -SRCS := sign.jazz -include ../../../../../Makefile.common diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/common.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/common.jinc deleted file mode 100644 index 614e4a78..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/common.jinc +++ /dev/null @@ -1,54 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/avx2/expandMask.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/expandS.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/fips202.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/avx2/poly.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/rounding.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/avx2/ntt.jinc" - -require "params.jinc" -require "packing.jinc" - -inline -fn decompose(reg u32 a) -> reg u32, reg u32 { - reg u32 a0; - reg u32 a1; - a0, a1 = decompose_gamma2_32(a); - return a0, a1; -} - -inline -fn use_hint(reg u32 a hint) - -> reg u32 -{ - reg u32 a1; - a1 = use_hint_gamma2_32(a, hint); - return a1; -} - -inline -fn expandMask_poly_4x(reg ptr u32[4 * Li2_polydeg] f_4x, reg ptr u8[64] rho_prime, stack u16 kappa) - -> reg ptr u32[4 * Li2_polydeg] { - f_4x = expandMask_poly_gamma1_219_4x(f_4x, rho_prime, kappa); - return f_4x; -} - -inline -fn expandS_poly(stack u8[64] rho_prime, reg u16 elem_idx, reg ptr u32[Li2_polydeg] buf) - -> reg ptr u32[Li2_polydeg] { - buf = expandSEta4_poly(rho_prime, elem_idx, buf); - return buf; -} - -from Jade require "crypto_sign/dilithium/common/amd64/avx2/expandA_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/avx2/expandMask_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/expandS_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/hashing_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/avx2/poly_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/avx2/polyvec_end.jinc" - -inline -fn expandA(stack u8[32] rho) -> stack u32[Li2_k * Li2_l * Li2_polydeg] { - stack u32[Li2_k * Li2_l * Li2_polydeg] matrix; - matrix = expandA_unaligned2(rho); - return matrix; -} diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/include/api.h b/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/include/api.h deleted file mode 100644 index 1d49bbef..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/include/api.h +++ /dev/null @@ -1,37 +0,0 @@ -#ifndef JADE_SIGN_dilithium_dilithium3_amd64_avx2_API_H -#define JADE_SIGN_dilithium_dilithium3_amd64_avx2_API_H - -#define JADE_SIGN_dilithium_dilithium3_amd64_avx2_PUBLICKEYBYTES 1952 -#define JADE_SIGN_dilithium_dilithium3_amd64_avx2_SECRETKEYBYTES 4016 -#define JADE_SIGN_dilithium_dilithium3_amd64_avx2_BYTES 3293 -#define JADE_SIGN_dilithium_dilithium3_amd64_avx2_DETERMINISTIC 1 - -#define JADE_SIGN_dilithium_dilithium3_amd64_avx2_ALGNAME "Dilithium3" -#define JADE_SIGN_dilithium_dilithium3_amd64_avx2_ARCH "amd64" -#define JADE_SIGN_dilithium_dilithium3_amd64_avx2_IMPL "avx2" - -#include - -int jade_sign_dilithium_dilithium3_amd64_avx2_keypair( - uint8_t *public_key, - uint8_t *secret_key -); - -int jade_sign_dilithium_dilithium3_amd64_avx2( - uint8_t *signed_message, - uint64_t *signed_message_length, - const uint8_t *message, - uint64_t message_length, - const uint8_t *secret_key -); - -int jade_sign_dilithium_dilithium3_amd64_avx2_open( - uint8_t *message, - uint64_t *message_length, - const uint8_t *signed_message, - uint64_t signed_message_length, - const uint8_t *public_key -); - -#endif - diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/packing.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/packing.jinc deleted file mode 100644 index db6dfbd1..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/packing.jinc +++ /dev/null @@ -1,68 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/montgomery.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/packing.jinc" - -require "params.jinc" - -inline -fn pack_s1(reg ptr u32[Li2_l * Li2_polydeg] s1, reg ptr u8[Li2_pack_s1len] dest) - -> reg ptr u8[Li2_pack_s1len] -{ - inline int ii; - reg ptr u8[Li2_pack_etalen] buf; - reg ptr u32[Li2_polydeg] poly; - - for ii = 0 to Li2_l { - buf = dest[Li2_pack_etalen * ii : Li2_pack_etalen]; - poly = s1[Li2_polydeg * ii : Li2_polydeg]; - dest[Li2_pack_etalen * ii : Li2_pack_etalen] = polyeta_4_pack(poly, buf); - } - return dest; -} - -inline -fn pack_s2(reg ptr u32[Li2_k * Li2_polydeg] s1, reg ptr u8[Li2_pack_s2len] dest) - -> reg ptr u8[Li2_pack_s2len] -{ - inline int ii; - reg ptr u8[Li2_pack_etalen] buf; - reg ptr u32[Li2_polydeg] poly; - - for ii = 0 to Li2_k { - buf = dest[Li2_pack_etalen * ii : Li2_pack_etalen]; - poly = s1[Li2_polydeg * ii : Li2_polydeg]; - dest[Li2_pack_etalen * ii : Li2_pack_etalen] = polyeta_4_pack(poly, buf); - } - return dest; -} - -inline -fn polyeta_unpack(reg ptr u32[Li2_polydeg] r, reg ptr u8[Li2_pack_etalen] a) - -> reg ptr u32[Li2_polydeg] -{ - r = polyeta_4_unpack(r, a); - return r; -} - -inline -fn polyz_pack(reg ptr u8[Li2_pack_zlen] r, reg ptr u32[Li2_polydeg] a) - -> reg ptr u8[Li2_pack_zlen] -{ - r = polyz_pack_gamma1_219(r, a); - return r; -} - -inline -fn polyz_unpack(reg ptr u32[Li2_polydeg] r, reg ptr u8[Li2_pack_zlen] a) - -> reg ptr u32[Li2_polydeg] -{ - r = polyz_unpack_gamma1_219(r, a); - return r; -} - -inline -fn polyw1_pack(reg ptr u32[Li2_polydeg] w1, reg ptr u8[Li2_pack_highbitslen] w1_buf) -> reg ptr u8[Li2_pack_highbitslen] { - w1_buf = polyw1_pack_gamma2_32(w1, w1_buf); - return w1_buf; -} - -from Jade require "crypto_sign/dilithium/common/amd64/packing_end.jinc" \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/params.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/params.jinc deleted file mode 100644 index f8847526..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/params.jinc +++ /dev/null @@ -1,19 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/params.jinc" - -param int Li2_k = 6; -param int Li2_l = 5; -param int Li2_gamma1 = (1 << 19); -param int Li2_gamma2 = (Li2_q - 1) / 32; -param int Li2_tau = 49; -param int Li2_eta = 4; -param int Li2_omega = 55; -param int Li2_max_attempts = 406; - -// naming taken from C ref -// actual lengths are K times the above... -param int Li2_pack_etalen = Li2_pack_eta_4_len; -param int Li2_pack_highbitslen = Li2_pack_highbitslen_gamma2_32; -param int Li2_pack_zlen = Li2_pack_zlen_gamma1_219; -param int Li2_pack_hstart = Li2_seedbytes + Li2_l * Li2_pack_zlen; - -from Jade require "crypto_sign/dilithium/common/amd64/params_end.jinc" \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/sign.jazz b/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/sign.jazz deleted file mode 100644 index b488b830..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/avx2/sign.jazz +++ /dev/null @@ -1,52 +0,0 @@ -require "common.jinc" -require "packing.jinc" -require "params.jinc" - -from Jade require "crypto_sign/dilithium/common/amd64/keygen_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/avx2/sign_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/verify_end.jinc" - -from Jade require "crypto_sign/dilithium/common/amd64/sign.jinc" - -export fn jade_sign_dilithium_dilithium3_amd64_avx2_keypair( - reg u64 public_key - secret_key - ) -> reg u64 -{ - reg u64 r; - keygen(public_key, secret_key); - ?{}, r = #set0(); - return r; -} - - -export fn jade_sign_dilithium_dilithium3_amd64_avx2( - reg u64 signed_message - signed_message_length - message - message_length - secret_key - ) -> reg u64 -{ - reg u64 r; - r = __sign(signed_message, signed_message_length, - message, message_length, secret_key); - return r; -} - - -export fn jade_sign_dilithium_dilithium3_amd64_avx2_open( - reg u64 message - message_length - signed_message - signed_message_length - public_key - ) -> reg u64 -{ - reg u64 r; - r = __open(message, message_length, - signed_message, signed_message_length, public_key); - return r; -} - - diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/Makefile b/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/Makefile deleted file mode 100644 index d6efc98e..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/Makefile +++ /dev/null @@ -1,2 +0,0 @@ -SRCS := sign.jazz -include ../../../../../Makefile.common diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/common.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/common.jinc deleted file mode 100644 index 96768ffa..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/common.jinc +++ /dev/null @@ -1,47 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/expandMask.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/expandS.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/fips202.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/ntt.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/poly.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/rounding.jinc" - -require "params.jinc" -require "packing.jinc" - -inline -fn decompose(reg u32 a) -> reg u32, reg u32 { - reg u32 a0; - reg u32 a1; - a0, a1 = decompose_gamma2_32(a); - return a0, a1; -} - -inline -fn use_hint(reg u32 a hint) - -> reg u32 -{ - reg u32 a1; - a1 = use_hint_gamma2_32(a, hint); - return a1; -} - -inline -fn expandMask_poly(reg ptr u32[Li2_polydeg] f, reg ptr u8[64] rho_prime, stack u16 kappa) - -> reg ptr u32[Li2_polydeg] { - f = expandMask_poly_gamma1_219(f, rho_prime, kappa); - return f; -} - -inline -fn expandS_poly(stack u8[64] rho_prime, reg u16 elem_idx, reg ptr u32[Li2_polydeg] buf) - -> reg ptr u32[Li2_polydeg] { - buf = expandSEta4_poly(rho_prime, elem_idx, buf); - return buf; -} - -from Jade require "crypto_sign/dilithium/common/amd64/expandA_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/expandMask_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/expandS_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/hashing_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/poly_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/polyvec_end.jinc" diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/include/api.h b/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/include/api.h deleted file mode 100644 index 6f98ef9a..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/include/api.h +++ /dev/null @@ -1,37 +0,0 @@ -#ifndef JADE_SIGN_dilithium_dilithium3_amd64_ref_API_H -#define JADE_SIGN_dilithium_dilithium3_amd64_ref_API_H - -#define JADE_SIGN_dilithium_dilithium3_amd64_ref_PUBLICKEYBYTES 1952 -#define JADE_SIGN_dilithium_dilithium3_amd64_ref_SECRETKEYBYTES 4016 -#define JADE_SIGN_dilithium_dilithium3_amd64_ref_BYTES 3293 -#define JADE_SIGN_dilithium_dilithium3_amd64_ref_DETERMINISTIC 1 - -#define JADE_SIGN_dilithium_dilithium3_amd64_ref_ALGNAME "Dilithium3" -#define JADE_SIGN_dilithium_dilithium3_amd64_ref_ARCH "amd64" -#define JADE_SIGN_dilithium_dilithium3_amd64_ref_IMPL "ref" - -#include - -int jade_sign_dilithium_dilithium3_amd64_ref_keypair( - uint8_t *public_key, - uint8_t *secret_key -); - -int jade_sign_dilithium_dilithium3_amd64_ref( - uint8_t *signed_message, - uint64_t *signed_message_length, - const uint8_t *message, - uint64_t message_length, - const uint8_t *secret_key -); - -int jade_sign_dilithium_dilithium3_amd64_ref_open( - uint8_t *message, - uint64_t *message_length, - const uint8_t *signed_message, - uint64_t signed_message_length, - const uint8_t *public_key -); - -#endif - diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/packing.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/packing.jinc deleted file mode 100644 index db6dfbd1..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/packing.jinc +++ /dev/null @@ -1,68 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/montgomery.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/packing.jinc" - -require "params.jinc" - -inline -fn pack_s1(reg ptr u32[Li2_l * Li2_polydeg] s1, reg ptr u8[Li2_pack_s1len] dest) - -> reg ptr u8[Li2_pack_s1len] -{ - inline int ii; - reg ptr u8[Li2_pack_etalen] buf; - reg ptr u32[Li2_polydeg] poly; - - for ii = 0 to Li2_l { - buf = dest[Li2_pack_etalen * ii : Li2_pack_etalen]; - poly = s1[Li2_polydeg * ii : Li2_polydeg]; - dest[Li2_pack_etalen * ii : Li2_pack_etalen] = polyeta_4_pack(poly, buf); - } - return dest; -} - -inline -fn pack_s2(reg ptr u32[Li2_k * Li2_polydeg] s1, reg ptr u8[Li2_pack_s2len] dest) - -> reg ptr u8[Li2_pack_s2len] -{ - inline int ii; - reg ptr u8[Li2_pack_etalen] buf; - reg ptr u32[Li2_polydeg] poly; - - for ii = 0 to Li2_k { - buf = dest[Li2_pack_etalen * ii : Li2_pack_etalen]; - poly = s1[Li2_polydeg * ii : Li2_polydeg]; - dest[Li2_pack_etalen * ii : Li2_pack_etalen] = polyeta_4_pack(poly, buf); - } - return dest; -} - -inline -fn polyeta_unpack(reg ptr u32[Li2_polydeg] r, reg ptr u8[Li2_pack_etalen] a) - -> reg ptr u32[Li2_polydeg] -{ - r = polyeta_4_unpack(r, a); - return r; -} - -inline -fn polyz_pack(reg ptr u8[Li2_pack_zlen] r, reg ptr u32[Li2_polydeg] a) - -> reg ptr u8[Li2_pack_zlen] -{ - r = polyz_pack_gamma1_219(r, a); - return r; -} - -inline -fn polyz_unpack(reg ptr u32[Li2_polydeg] r, reg ptr u8[Li2_pack_zlen] a) - -> reg ptr u32[Li2_polydeg] -{ - r = polyz_unpack_gamma1_219(r, a); - return r; -} - -inline -fn polyw1_pack(reg ptr u32[Li2_polydeg] w1, reg ptr u8[Li2_pack_highbitslen] w1_buf) -> reg ptr u8[Li2_pack_highbitslen] { - w1_buf = polyw1_pack_gamma2_32(w1, w1_buf); - return w1_buf; -} - -from Jade require "crypto_sign/dilithium/common/amd64/packing_end.jinc" \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/params.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/params.jinc deleted file mode 100644 index f8847526..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/params.jinc +++ /dev/null @@ -1,19 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/params.jinc" - -param int Li2_k = 6; -param int Li2_l = 5; -param int Li2_gamma1 = (1 << 19); -param int Li2_gamma2 = (Li2_q - 1) / 32; -param int Li2_tau = 49; -param int Li2_eta = 4; -param int Li2_omega = 55; -param int Li2_max_attempts = 406; - -// naming taken from C ref -// actual lengths are K times the above... -param int Li2_pack_etalen = Li2_pack_eta_4_len; -param int Li2_pack_highbitslen = Li2_pack_highbitslen_gamma2_32; -param int Li2_pack_zlen = Li2_pack_zlen_gamma1_219; -param int Li2_pack_hstart = Li2_seedbytes + Li2_l * Li2_pack_zlen; - -from Jade require "crypto_sign/dilithium/common/amd64/params_end.jinc" \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/sign.jazz b/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/sign.jazz deleted file mode 100644 index 4e7618aa..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium3/amd64/ref/sign.jazz +++ /dev/null @@ -1,50 +0,0 @@ -require "common.jinc" -require "packing.jinc" -require "params.jinc" - -from Jade require "crypto_sign/dilithium/common/amd64/keygen_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/sign_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/verify_end.jinc" - -from Jade require "crypto_sign/dilithium/common/amd64/sign.jinc" - -export fn jade_sign_dilithium_dilithium3_amd64_ref_keypair( - reg u64 public_key - secret_key - ) -> reg u64 -{ - reg u64 r; - keygen(public_key, secret_key); - ?{}, r = #set0(); - return r; -} - -export fn jade_sign_dilithium_dilithium3_amd64_ref( - reg u64 signed_message - signed_message_length - message - message_length - secret_key - ) -> reg u64 -{ - reg u64 r; - r = __sign(signed_message, signed_message_length, - message, message_length, secret_key); - return r; -} - - -export fn jade_sign_dilithium_dilithium3_amd64_ref_open( - reg u64 message - message_length - signed_message - signed_message_length - public_key - ) -> reg u64 -{ - reg u64 r; - r = __open(message, message_length, - signed_message, signed_message_length, public_key); - return r; -} - diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/META.yml b/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/META.yml deleted file mode 100644 index f7e7d3ab..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/META.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: Dilithium5 -type: sign -checksumsmall: b1fd5d7815befbe9a254f4d3fd274f90f8b5f3ad245e33e9d4f88c5cdb925af2 -checksumbig: d18ce3c4014818331e8ccd6df9730700f2377926caeb86505dd8b35706af4533 -claimed-nist-level: 3 -implementations: - - name: amd64/ref - version: 0.1 - supported_platforms: - - architecture: x86_64 - operating_systems: - - Linux - - Darwin - - name: amd64/avx2 - version: 0.1 - supported_platforms: - - architecture: x86_64 - operating_systems: - - Linux - - Darwin diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/Makefile b/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/Makefile deleted file mode 100644 index d6efc98e..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/Makefile +++ /dev/null @@ -1,2 +0,0 @@ -SRCS := sign.jazz -include ../../../../../Makefile.common diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/common.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/common.jinc deleted file mode 100644 index 7c15c72d..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/common.jinc +++ /dev/null @@ -1,54 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/expandMask.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/expandS.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/fips202.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/avx2/poly.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/rounding.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/avx2/ntt.jinc" - -require "params.jinc" -require "packing.jinc" - -inline -fn decompose(reg u32 a) -> reg u32, reg u32 { - reg u32 a0; - reg u32 a1; - a0, a1 = decompose_gamma2_32(a); - return a0, a1; -} - -inline -fn use_hint(reg u32 a hint) - -> reg u32 -{ - reg u32 a1; - a1 = use_hint_gamma2_32(a, hint); - return a1; -} - -inline -fn expandMask_poly(reg ptr u32[Li2_polydeg] f, reg ptr u8[64] rho_prime, stack u16 kappa) - -> reg ptr u32[Li2_polydeg] { - f = expandMask_poly_gamma1_219(f, rho_prime, kappa); - return f; -} - -inline -fn expandS_poly(stack u8[64] rho_prime, reg u16 elem_idx, reg ptr u32[Li2_polydeg] buf) - -> reg ptr u32[Li2_polydeg] { - buf = expandSEta2_poly(rho_prime, elem_idx, buf); - return buf; -} - -from Jade require "crypto_sign/dilithium/common/amd64/avx2/expandA_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/expandMask_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/expandS_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/hashing_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/avx2/poly_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/avx2/polyvec_end.jinc" - -inline -fn expandA(stack u8[32] rho) -> stack u32[Li2_k * Li2_l * Li2_polydeg] { - stack u32[Li2_k * Li2_l * Li2_polydeg] matrix; - matrix = expandA_aligned(rho); - return matrix; -} \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/include/api.h b/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/include/api.h deleted file mode 100644 index df82c2e0..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/include/api.h +++ /dev/null @@ -1,37 +0,0 @@ -#ifndef JADE_SIGN_dilithium_dilithium5_amd64_avx2_API_H -#define JADE_SIGN_dilithium_dilithium5_amd64_avx2_API_H - -#define JADE_SIGN_dilithium_dilithium5_amd64_avx2_PUBLICKEYBYTES 2592 -#define JADE_SIGN_dilithium_dilithium5_amd64_avx2_SECRETKEYBYTES 4864 -#define JADE_SIGN_dilithium_dilithium5_amd64_avx2_BYTES 4595 -#define JADE_SIGN_dilithium_dilithium5_amd64_avx2_DETERMINISTIC 1 - -#define JADE_SIGN_dilithium_dilithium5_amd64_avx2_ALGNAME "Dilithium5" -#define JADE_SIGN_dilithium_dilithium5_amd64_avx2_ARCH "amd64" -#define JADE_SIGN_dilithium_dilithium5_amd64_avx2_IMPL "avx2" - -#include - -int jade_sign_dilithium_dilithium5_amd64_avx2_keypair( - uint8_t *public_key, - uint8_t *secret_key -); - -int jade_sign_dilithium_dilithium5_amd64_avx2( - uint8_t *signed_message, - uint64_t *signed_message_length, - const uint8_t *message, - uint64_t message_length, - const uint8_t *secret_key -); - -int jade_sign_dilithium_dilithium5_amd64_avx2_open( - uint8_t *message, - uint64_t *message_length, - const uint8_t *signed_message, - uint64_t signed_message_length, - const uint8_t *public_key -); - -#endif - diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/packing.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/packing.jinc deleted file mode 100644 index 79ff450b..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/packing.jinc +++ /dev/null @@ -1,67 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/montgomery.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/packing.jinc" - -require "params.jinc" - -fn pack_s1(reg ptr u32[Li2_l * Li2_polydeg] s1, reg ptr u8[Li2_pack_s1len] dest) - -> reg ptr u8[Li2_pack_s1len] -{ - inline int ii; - reg ptr u8[Li2_pack_etalen] buf; - reg ptr u32[Li2_polydeg] poly; - - for ii = 0 to Li2_l { - buf = dest[Li2_pack_etalen * ii : Li2_pack_etalen]; - poly = s1[Li2_polydeg * ii : Li2_polydeg]; - dest[Li2_pack_etalen * ii : Li2_pack_etalen] = polyeta_2_pack(poly, buf); - } - return dest; -} - -fn pack_s2(reg ptr u32[Li2_k * Li2_polydeg] s1, reg ptr u8[Li2_pack_s2len] dest) - -> reg ptr u8[Li2_pack_s2len] -{ - inline int ii; - reg ptr u8[Li2_pack_etalen] buf; - reg ptr u32[Li2_polydeg] poly; - - for ii = 0 to Li2_k { - buf = dest[Li2_pack_etalen * ii : Li2_pack_etalen]; - poly = s1[Li2_polydeg * ii : Li2_polydeg]; - dest[Li2_pack_etalen * ii : Li2_pack_etalen] = polyeta_2_pack(poly, buf); - } - return dest; -} - -fn polyeta_unpack(reg ptr u32[Li2_polydeg] r, reg ptr u8[Li2_pack_etalen] a) - -> reg ptr u32[Li2_polydeg] -{ - r = polyeta_2_unpack(r, a); - return r; -} - -inline -fn polyz_pack(reg ptr u8[Li2_pack_zlen] r, reg ptr u32[Li2_polydeg] a) - -> reg ptr u8[Li2_pack_zlen] -{ - r = polyz_pack_gamma1_219(r, a); - return r; -} - -inline -fn polyz_unpack(reg ptr u32[Li2_polydeg] r, reg ptr u8[Li2_pack_zlen] a) - -> reg ptr u32[Li2_polydeg] -{ - r = polyz_unpack_gamma1_219(r, a); - return r; -} - -inline -fn polyw1_pack(reg ptr u32[Li2_polydeg] w1, reg ptr u8[Li2_pack_highbitslen] w1_buf) - -> reg ptr u8[Li2_pack_highbitslen] -{ - w1_buf = polyw1_pack_gamma2_32(w1, w1_buf); - return w1_buf; -} - -from Jade require "crypto_sign/dilithium/common/amd64/packing_end.jinc" \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/params.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/params.jinc deleted file mode 100644 index fbe29f85..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/params.jinc +++ /dev/null @@ -1,19 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/params.jinc" - -param int Li2_k = 8; -param int Li2_l = 7; -param int Li2_gamma1 = (1 << 19); -param int Li2_gamma2 = (Li2_q - 1) / 32; -param int Li2_tau = 60; -param int Li2_eta = 2; -param int Li2_omega = 75; -param int Li2_max_attempts = 295; - -// naming taken from C ref -// actual lengths are K times the above... -param int Li2_pack_etalen = Li2_pack_eta_2_len; -param int Li2_pack_highbitslen = Li2_pack_highbitslen_gamma2_32; -param int Li2_pack_zlen = Li2_pack_zlen_gamma1_219; -param int Li2_pack_hstart = Li2_seedbytes + Li2_l * Li2_pack_zlen; - -from Jade require "crypto_sign/dilithium/common/amd64/params_end.jinc" \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/sign.jazz b/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/sign.jazz deleted file mode 100644 index 4ac46640..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/avx2/sign.jazz +++ /dev/null @@ -1,52 +0,0 @@ -require "common.jinc" -require "packing.jinc" -require "params.jinc" - -from Jade require "crypto_sign/dilithium/common/amd64/keygen_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/sign_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/verify_end.jinc" - -from Jade require "crypto_sign/dilithium/common/amd64/sign.jinc" - -export fn jade_sign_dilithium_dilithium5_amd64_avx2_keypair( - reg u64 public_key - secret_key - ) -> reg u64 -{ - reg u64 r; - keygen(public_key, secret_key); - ?{}, r = #set0(); - return r; -} - - -export fn jade_sign_dilithium_dilithium5_amd64_avx2( - reg u64 signed_message - signed_message_length - message - message_length - secret_key - ) -> reg u64 -{ - reg u64 r; - r = __sign(signed_message, signed_message_length, - message, message_length, secret_key); - return r; -} - - -export fn jade_sign_dilithium_dilithium5_amd64_avx2_open( - reg u64 message - message_length - signed_message - signed_message_length - public_key - ) -> reg u64 -{ - reg u64 r; - r = __open(message, message_length, - signed_message, signed_message_length, public_key); - return r; -} - - diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/Makefile b/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/Makefile deleted file mode 100644 index d6efc98e..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/Makefile +++ /dev/null @@ -1,2 +0,0 @@ -SRCS := sign.jazz -include ../../../../../Makefile.common diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/common.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/common.jinc deleted file mode 100644 index a97844c8..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/common.jinc +++ /dev/null @@ -1,47 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/expandMask.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/expandS.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/fips202.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/ntt.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/poly.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/rounding.jinc" - -require "params.jinc" -require "packing.jinc" - -inline -fn decompose(reg u32 a) -> reg u32, reg u32 { - reg u32 a0; - reg u32 a1; - a0, a1 = decompose_gamma2_32(a); - return a0, a1; -} - -inline -fn use_hint(reg u32 a hint) - -> reg u32 -{ - reg u32 a1; - a1 = use_hint_gamma2_32(a, hint); - return a1; -} - -inline -fn expandMask_poly(reg ptr u32[Li2_polydeg] f, reg ptr u8[64] rho_prime, stack u16 kappa) - -> reg ptr u32[Li2_polydeg] { - f = expandMask_poly_gamma1_219(f, rho_prime, kappa); - return f; -} - -inline -fn expandS_poly(stack u8[64] rho_prime, reg u16 elem_idx, reg ptr u32[Li2_polydeg] buf) - -> reg ptr u32[Li2_polydeg] { - buf = expandSEta2_poly(rho_prime, elem_idx, buf); - return buf; -} - -from Jade require "crypto_sign/dilithium/common/amd64/expandA_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/expandMask_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/expandS_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/hashing_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/poly_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/polyvec_end.jinc" diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/include/api.h b/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/include/api.h deleted file mode 100644 index 1abe9612..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/include/api.h +++ /dev/null @@ -1,37 +0,0 @@ -#ifndef JADE_SIGN_dilithium_dilithium5_amd64_ref_API_H -#define JADE_SIGN_dilithium_dilithium5_amd64_ref_API_H - -#define JADE_SIGN_dilithium_dilithium5_amd64_ref_PUBLICKEYBYTES 2592 -#define JADE_SIGN_dilithium_dilithium5_amd64_ref_SECRETKEYBYTES 4864 -#define JADE_SIGN_dilithium_dilithium5_amd64_ref_BYTES 4595 -#define JADE_SIGN_dilithium_dilithium5_amd64_ref_DETERMINISTIC 1 - -#define JADE_SIGN_dilithium_dilithium5_amd64_ref_ALGNAME "Dilithium5" -#define JADE_SIGN_dilithium_dilithium5_amd64_ref_ARCH "amd64" -#define JADE_SIGN_dilithium_dilithium5_amd64_ref_IMPL "ref" - -#include - -int jade_sign_dilithium_dilithium5_amd64_ref_keypair( - uint8_t *public_key, - uint8_t *secret_key -); - -int jade_sign_dilithium_dilithium5_amd64_ref( - uint8_t *signed_message, - uint64_t *signed_message_length, - const uint8_t *message, - uint64_t message_length, - const uint8_t *secret_key -); - -int jade_sign_dilithium_dilithium5_amd64_ref_open( - uint8_t *message, - uint64_t *message_length, - const uint8_t *signed_message, - uint64_t signed_message_length, - const uint8_t *public_key -); - -#endif - diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/packing.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/packing.jinc deleted file mode 100644 index 79ff450b..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/packing.jinc +++ /dev/null @@ -1,67 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/montgomery.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/packing.jinc" - -require "params.jinc" - -fn pack_s1(reg ptr u32[Li2_l * Li2_polydeg] s1, reg ptr u8[Li2_pack_s1len] dest) - -> reg ptr u8[Li2_pack_s1len] -{ - inline int ii; - reg ptr u8[Li2_pack_etalen] buf; - reg ptr u32[Li2_polydeg] poly; - - for ii = 0 to Li2_l { - buf = dest[Li2_pack_etalen * ii : Li2_pack_etalen]; - poly = s1[Li2_polydeg * ii : Li2_polydeg]; - dest[Li2_pack_etalen * ii : Li2_pack_etalen] = polyeta_2_pack(poly, buf); - } - return dest; -} - -fn pack_s2(reg ptr u32[Li2_k * Li2_polydeg] s1, reg ptr u8[Li2_pack_s2len] dest) - -> reg ptr u8[Li2_pack_s2len] -{ - inline int ii; - reg ptr u8[Li2_pack_etalen] buf; - reg ptr u32[Li2_polydeg] poly; - - for ii = 0 to Li2_k { - buf = dest[Li2_pack_etalen * ii : Li2_pack_etalen]; - poly = s1[Li2_polydeg * ii : Li2_polydeg]; - dest[Li2_pack_etalen * ii : Li2_pack_etalen] = polyeta_2_pack(poly, buf); - } - return dest; -} - -fn polyeta_unpack(reg ptr u32[Li2_polydeg] r, reg ptr u8[Li2_pack_etalen] a) - -> reg ptr u32[Li2_polydeg] -{ - r = polyeta_2_unpack(r, a); - return r; -} - -inline -fn polyz_pack(reg ptr u8[Li2_pack_zlen] r, reg ptr u32[Li2_polydeg] a) - -> reg ptr u8[Li2_pack_zlen] -{ - r = polyz_pack_gamma1_219(r, a); - return r; -} - -inline -fn polyz_unpack(reg ptr u32[Li2_polydeg] r, reg ptr u8[Li2_pack_zlen] a) - -> reg ptr u32[Li2_polydeg] -{ - r = polyz_unpack_gamma1_219(r, a); - return r; -} - -inline -fn polyw1_pack(reg ptr u32[Li2_polydeg] w1, reg ptr u8[Li2_pack_highbitslen] w1_buf) - -> reg ptr u8[Li2_pack_highbitslen] -{ - w1_buf = polyw1_pack_gamma2_32(w1, w1_buf); - return w1_buf; -} - -from Jade require "crypto_sign/dilithium/common/amd64/packing_end.jinc" \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/params.jinc b/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/params.jinc deleted file mode 100644 index fbe29f85..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/params.jinc +++ /dev/null @@ -1,19 +0,0 @@ -from Jade require "crypto_sign/dilithium/common/amd64/params.jinc" - -param int Li2_k = 8; -param int Li2_l = 7; -param int Li2_gamma1 = (1 << 19); -param int Li2_gamma2 = (Li2_q - 1) / 32; -param int Li2_tau = 60; -param int Li2_eta = 2; -param int Li2_omega = 75; -param int Li2_max_attempts = 295; - -// naming taken from C ref -// actual lengths are K times the above... -param int Li2_pack_etalen = Li2_pack_eta_2_len; -param int Li2_pack_highbitslen = Li2_pack_highbitslen_gamma2_32; -param int Li2_pack_zlen = Li2_pack_zlen_gamma1_219; -param int Li2_pack_hstart = Li2_seedbytes + Li2_l * Li2_pack_zlen; - -from Jade require "crypto_sign/dilithium/common/amd64/params_end.jinc" \ No newline at end of file diff --git a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/sign.jazz b/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/sign.jazz deleted file mode 100644 index 8f23d74b..00000000 --- a/oldsrc-should-delete/crypto_sign/dilithium/dilithium5/amd64/ref/sign.jazz +++ /dev/null @@ -1,50 +0,0 @@ -require "common.jinc" -require "packing.jinc" -require "params.jinc" - -from Jade require "crypto_sign/dilithium/common/amd64/keygen_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/sign_end.jinc" -from Jade require "crypto_sign/dilithium/common/amd64/verify_end.jinc" - -from Jade require "crypto_sign/dilithium/common/amd64/sign.jinc" - -export fn jade_sign_dilithium_dilithium5_amd64_ref_keypair( - reg u64 public_key - secret_key - ) -> reg u64 -{ - reg u64 r; - keygen(public_key, secret_key); - ?{}, r = #set0(); - return r; -} - -export fn jade_sign_dilithium_dilithium5_amd64_ref( - reg u64 signed_message - signed_message_length - message - message_length - secret_key - ) -> reg u64 -{ - reg u64 r; - r = __sign(signed_message, signed_message_length, - message, message_length, secret_key); - return r; -} - - -export fn jade_sign_dilithium_dilithium5_amd64_ref_open( - reg u64 message - message_length - signed_message - signed_message_length - public_key - ) -> reg u64 -{ - reg u64 r; - r = __open(message, message_length, - signed_message, signed_message_length, public_key); - return r; -} -