lc_dilithium_44.h

Go to the documentation of this file.

/*
 * Copyright (C) 2022 - 2024, Stephan Mueller <smueller@chronox.de>
 *
 * License: see LICENSE file in root directory
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
 * WHICH ARE HEREBY DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
 * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
 * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
 * DAMAGE.
 */
/*
 * This code is derived in parts from the code distribution provided with
 * https://github.com/pq-crystals/dilithium
 *
 * That code is released under Public Domain
 * (https://creativecommons.org/share-your-work/public-domain/cc0/);
 * or Apache 2.0 License (https://www.apache.org/licenses/LICENSE-2.0.html).
 */
 
#ifndef LC_DILITHIUM_44_H
#define LC_DILITHIUM_44_H
 
#ifndef __ASSEMBLER__
 
#include "ext_headers.h"
#include "lc_hash.h"
#include "lc_rng.h"
#include "lc_sha3.h"
 
#endif /* __ASSEMBLER__ */
 
#ifdef __cplusplus
extern "C" {
#endif
 
/*
 * Dilithium Security Levels
 * 2 -> 192 bits of security strength
 * 3 -> 225 bits of security strength
 * 5 -> 257 bits of security strength
 */
#define LC_DILITHIUM_MODE 2
 
#define LC_DILITHIUM_SEEDBYTES 32
#define LC_DILITHIUM_CRHBYTES 64
#define LC_DILITHIUM_TRBYTES 64
#define LC_DILITHIUM_RNDBYTES 32
#define LC_DILITHIUM_N 256
#define LC_DILITHIUM_Q 8380417
#define LC_DILITHIUM_D 13
#define LC_DILITHIUM_ROOT_OF_UNITY 1753
 
#if LC_DILITHIUM_MODE == 2
#define LC_DILITHIUM_LAMBDA 128
#define LC_DILITHIUM_K 4
#define LC_DILITHIUM_L 4
#define LC_DILITHIUM_ETA 2
#define LC_DILITHIUM_TAU 39
#define LC_DILITHIUM_BETA 78
#define LC_DILITHIUM_GAMMA1 (1 << 17)
#define LC_DILITHIUM_GAMMA2 ((LC_DILITHIUM_Q - 1) / 88)
#define LC_DILITHIUM_OMEGA 80
 
#elif LC_DILITHIUM_MODE == 3
#define LC_DILITHIUM_LAMBDA 192
#define LC_DILITHIUM_K 6
#define LC_DILITHIUM_L 5
#define LC_DILITHIUM_ETA 4
#define LC_DILITHIUM_TAU 49
#define LC_DILITHIUM_BETA 196
#define LC_DILITHIUM_GAMMA1 (1 << 19)
#define LC_DILITHIUM_GAMMA2 ((LC_DILITHIUM_Q - 1) / 32)
#define LC_DILITHIUM_OMEGA 55
 
#elif LC_DILITHIUM_MODE == 5
#define LC_DILITHIUM_LAMBDA 256
#define LC_DILITHIUM_K 8
#define LC_DILITHIUM_L 7
#define LC_DILITHIUM_ETA 2
#define LC_DILITHIUM_TAU 60
#define LC_DILITHIUM_BETA 120
#define LC_DILITHIUM_GAMMA1 (1 << 19)
#define LC_DILITHIUM_GAMMA2 ((LC_DILITHIUM_Q - 1) / 32)
#define LC_DILITHIUM_OMEGA 75
 
#endif
 
#define LC_DILITHIUM_CTILDE_BYTES (LC_DILITHIUM_LAMBDA * 2 / 8)
#define LC_DILITHIUM_POLYT1_PACKEDBYTES 320
#define LC_DILITHIUM_POLYT0_PACKEDBYTES 416
#define LC_DILITHIUM_POLYVECH_PACKEDBYTES (LC_DILITHIUM_OMEGA + LC_DILITHIUM_K)
 
#if LC_DILITHIUM_GAMMA1 == (1 << 17)
#define LC_DILITHIUM_POLYZ_PACKEDBYTES 576
#elif LC_DILITHIUM_GAMMA1 == (1 << 19)
#define LC_DILITHIUM_POLYZ_PACKEDBYTES 640
#endif
 
#if LC_DILITHIUM_GAMMA2 == (LC_DILITHIUM_Q - 1) / 88
#define LC_DILITHIUM_POLYW1_PACKEDBYTES 192
#elif LC_DILITHIUM_GAMMA2 == (LC_DILITHIUM_Q - 1) / 32
#define LC_DILITHIUM_POLYW1_PACKEDBYTES 128
#endif
 
#if LC_DILITHIUM_ETA == 2
#define LC_DILITHIUM_POLYETA_PACKEDBYTES 96
#elif LC_DILITHIUM_ETA == 4
#define LC_DILITHIUM_POLYETA_PACKEDBYTES 128
#endif
 
/*
 * Sizes of the different Dilithium buffer types.
 *
 * WARNING: Do not use these defines in your code. If you need the sizes of
 * the different variable sizes, use sizeof of the different variable structs or
 * use the different *_size functions documented below to retrieve the data size
 * of a particular Dilithium component.
 */
#define LC_DILITHIUM_PUBLICKEYBYTES                                            \
        (LC_DILITHIUM_SEEDBYTES +                                              \
         LC_DILITHIUM_K * LC_DILITHIUM_POLYT1_PACKEDBYTES)
#define LC_DILITHIUM_SECRETKEYBYTES                                            \
        (2 * LC_DILITHIUM_SEEDBYTES + LC_DILITHIUM_TRBYTES +                   \
         LC_DILITHIUM_L * LC_DILITHIUM_POLYETA_PACKEDBYTES +                   \
         LC_DILITHIUM_K * LC_DILITHIUM_POLYETA_PACKEDBYTES +                   \
         LC_DILITHIUM_K * LC_DILITHIUM_POLYT0_PACKEDBYTES)
 
#define LC_DILITHIUM_CRYPTO_BYTES                                              \
        (LC_DILITHIUM_CTILDE_BYTES +                                           \
         LC_DILITHIUM_L * LC_DILITHIUM_POLYZ_PACKEDBYTES +                     \
         LC_DILITHIUM_POLYVECH_PACKEDBYTES)
 
#ifndef __ASSEMBLER__
struct lc_dilithium_44_sk {
        uint8_t sk[LC_DILITHIUM_SECRETKEYBYTES];
};
 
struct lc_dilithium_44_pk {
        uint8_t pk[LC_DILITHIUM_PUBLICKEYBYTES];
};
 
struct lc_dilithium_44_sig {
        uint8_t sig[LC_DILITHIUM_CRYPTO_BYTES];
};
 
#ifndef LC_DILITHIUM_CTX_ON_STACK
struct lc_dilithium_ctx {
        struct lc_hash_ctx dilithium_hash_ctx;
        uint8_t shake_state[LC_SHA3_STATE_SIZE_ALIGN(LC_SHA3_256_CTX_SIZE)];
};
#endif
 
#ifndef LC_DILITHIUM_CTX_ON_STACK
#define LC_DILITHIUM_CTX_SIZE                                                  \
        sizeof(struct lc_dilithium_ctx)
#endif
 
#ifndef LC_DILITHIUM_CTX_ON_STACK
#define LC_DILITHIUM_CTX_ON_STACK(name)                                        \
        _Pragma("GCC diagnostic push") _Pragma(                                \
                "GCC diagnostic ignored \"-Wdeclaration-after-statement\"")    \
                LC_ALIGNED_BUFFER(                                             \
                        name##_ctx_buf, LC_DILITHIUM_ED25519_CTX_SIZE,         \
                        LC_HASH_COMMON_ALIGNMENT);                             \
        struct lc_dilithium_ctx *name =                                        \
                (struct lc_dilithium_ctx *)name##_ctx_buf;                     \
        LC_SHAKE_256_CTX((&(name)->dilithium_hash_ctx));                       \
        _Pragma("GCC diagnostic pop")
#endif
 
static inline void lc_dilithium_44_ctx_zero(struct lc_dilithium_ctx *ctx)
{
        if (!ctx)
                return;
        lc_hash_zero(&ctx->dilithium_hash_ctx);
}
 
int lc_dilithium_44_ctx_alloc(struct lc_dilithium_ctx **ctx);
 
void lc_dilithium_44_ctx_zero_free(struct lc_dilithium_ctx *ctx);
 
LC_PURE
static inline unsigned int lc_dilithium_44_sk_size(void)
{
        return lc_member_size(struct lc_dilithium_44_sk, sk);
}
 
LC_PURE
static inline unsigned int lc_dilithium_44_pk_size(void)
{
        return lc_member_size(struct lc_dilithium_44_pk, pk);
}
 
LC_PURE
static inline unsigned int lc_dilithium_44_sig_size(void)
{
        return lc_member_size(struct lc_dilithium_44_sig, sig);
}
 
int lc_dilithium_44_keypair(struct lc_dilithium_44_pk *pk, struct lc_dilithium_44_sk *sk,
                         struct lc_rng_ctx *rng_ctx);
 
int lc_dilithium_44_keypair_from_seed(struct lc_dilithium_44_pk *pk,
                                       struct lc_dilithium_44_sk *sk,
                                       const uint8_t *seed, size_t seedlen);
 
int lc_dilithium_44_sign(struct lc_dilithium_44_sig *sig, const uint8_t *m,
                      size_t mlen, const struct lc_dilithium_44_sk *sk,
                      struct lc_rng_ctx *rng_ctx);
 
int lc_dilithium_44_sign_init(struct lc_dilithium_ctx *ctx,
                           const struct lc_dilithium_44_sk *sk);
 
int lc_dilithium_44_sign_update(struct lc_dilithium_ctx *ctx, const uint8_t *m,
                             size_t mlen);
 
int lc_dilithium_44_sign_final(struct lc_dilithium_44_sig *sig,
                            struct lc_dilithium_ctx *ctx,
                            const struct lc_dilithium_44_sk *sk,
                            struct lc_rng_ctx *rng_ctx);
 
int lc_dilithium_44_verify(const struct lc_dilithium_44_sig *sig, const uint8_t *m,
                        size_t mlen, const struct lc_dilithium_44_pk *pk);
 
int lc_dilithium_44_verify_init(struct lc_dilithium_ctx *ctx,
                             const struct lc_dilithium_44_pk *pk);
 
int lc_dilithium_44_verify_update(struct lc_dilithium_ctx *ctx, const uint8_t *m,
                               size_t mlen);
 
int lc_dilithium_44_verify_final(const struct lc_dilithium_44_sig *sig,
                              struct lc_dilithium_ctx *ctx,
                              const struct lc_dilithium_44_pk *pk);
 
/****************************** Dilithium ED25510 *****************************/
/* Macro set during leancrypto compile time for target platform */
#define LC_DILITHIUM_ED25519_SIG
#ifdef LC_DILITHIUM_ED25519_SIG
 
#include "lc_ed25519.h"
#include "lc_sha512.h"
 
struct lc_dilithium_44_ed25519_sk {
        struct lc_dilithium_44_sk sk;
        struct lc_ed25519_sk sk_ed25519;
};
 
struct lc_dilithium_44_ed25519_pk {
        struct lc_dilithium_44_pk pk;
        struct lc_ed25519_pk pk_ed25519;
};
 
struct lc_dilithium_44_ed25519_sig {
        struct lc_dilithium_44_sig sig;
        struct lc_ed25519_sig sig_ed25519;
};
 
#ifndef LC_DILITHIUM_ED25519_CTX_ON_STACK
struct lc_dilithium_ed25519_ctx {
        struct lc_dilithium_ctx dilithium_ctx;
        struct lc_hash_ctx ed25519_hash_ctx;
        uint8_t sha512_state[LC_SHA512_STATE_SIZE + LC_HASH_COMMON_ALIGNMENT];
};
#endif
 
#ifndef LC_DILITHIUM_ED25519_CTX_ON_STACK
#define LC_DILITHIUM_ED25519_CTX_SIZE                                          \
        sizeof(struct lc_dilithium_ed25519_ctx)
#endif
 
#ifndef LC_DILITHIUM_ED25519_CTX_ON_STACK
#define LC_DILITHIUM_ED25519_CTX_ON_STACK(name)                                \
        _Pragma("GCC diagnostic push") _Pragma(                                \
                "GCC diagnostic ignored \"-Wdeclaration-after-statement\"")    \
                LC_ALIGNED_BUFFER(                                             \
                        name##_ctx_buf, LC_DILITHIUM_ED25519_CTX_SIZE,         \
                        LC_HASH_COMMON_ALIGNMENT);                             \
        struct lc_dilithium_ed25519_ctx *name =                                \
                (struct lc_dilithium_ed25519_ctx *)name##_ctx_buf;             \
        LC_SHAKE_256_CTX((&(name)->dilithium_ctx.dilithium_hash_ctx));         \
        LC_SHA512_CTX((&(name)->ed25519_hash_ctx));                            \
        _Pragma("GCC diagnostic pop")
#endif
 
static inline void lc_dilithium_44_ed25519_ctx_zero(
        struct lc_dilithium_ed25519_ctx *ctx)
{
        if (!ctx)
                return;
        lc_dilithium_44_ctx_zero(&ctx->dilithium_ctx);
        lc_hash_zero(&ctx->ed25519_hash_ctx);
}
 
int lc_dilithium_44_ed25519_ctx_alloc(
        struct lc_dilithium_ed25519_ctx **ctx);
 
void lc_dilithium_44_ed25519_ctx_zero_free(
        struct lc_dilithium_ed25519_ctx *ctx);
 
int lc_dilithium_44_ed25519_keypair(struct lc_dilithium_44_ed25519_pk *pk,
                                 struct lc_dilithium_44_ed25519_sk *sk,
                                 struct lc_rng_ctx *rng_ctx);
 
int lc_dilithium_44_ed25519_sign(struct lc_dilithium_44_ed25519_sig *sig,
                              const uint8_t *m, size_t mlen,
                              const struct lc_dilithium_44_ed25519_sk *sk,
                              struct lc_rng_ctx *rng_ctx);
 
int lc_dilithium_44_ed25519_sign_init(
        struct lc_dilithium_ed25519_ctx *ctx,
        const struct lc_dilithium_44_ed25519_sk *sk);
 
int lc_dilithium_44_ed25519_sign_update(
        struct lc_dilithium_ed25519_ctx *ctx, const uint8_t *m,
        size_t mlen);
 
int  lc_dilithium_44_ed25519_sign_final(
        struct lc_dilithium_44_ed25519_sig *sig,
        struct lc_dilithium_ed25519_ctx *ctx,
        const struct lc_dilithium_44_ed25519_sk *sk,
        struct lc_rng_ctx *rng_ctx);
 
int lc_dilithium_44_ed25519_verify(const struct lc_dilithium_44_ed25519_sig *sig,
                                const uint8_t *m, size_t mlen,
                                const struct lc_dilithium_44_ed25519_pk *pk);
 
int lc_dilithium_44_ed25519_verify_init(
        struct lc_dilithium_ed25519_ctx *ctx,
        const struct lc_dilithium_44_ed25519_pk *pk);
int lc_dilithium_44_ed25519_verify_update(
        struct lc_dilithium_ed25519_ctx *ctx, const uint8_t *m,
        size_t mlen);
int lc_dilithium_44_ed25519_verify_final(
        const struct lc_dilithium_44_ed25519_sig *sig,
        struct lc_dilithium_ed25519_ctx *ctx,
        const struct lc_dilithium_44_ed25519_pk *pk);
 
#endif /* LC_DILITHIUM_ED25519_SIG */
 
#endif /* __ASSEMBLER__ */
 
/*
 * To allow including the different lc_dilithium_*.h files, these macros need to
 * be undefined. Only during compilation of leancrypto, these macros remain
 * defined as this header file is not included multiple times.
 */
#ifndef LC_DILITHIUM_INTERNAL
#undef LC_DILITHIUM_MODE
#undef LC_DILITHIUM_SEEDBYTES
#undef LC_DILITHIUM_CRHBYTES
#undef LC_DILITHIUM_TRBYTES
#undef LC_DILITHIUM_RNDBYTES
#undef LC_DILITHIUM_N
#undef LC_DILITHIUM_Q
#undef LC_DILITHIUM_D
#undef LC_DILITHIUM_ROOT_OF_UNITY
#undef LC_DILITHIUM_LAMBDA
#undef LC_DILITHIUM_K
#undef LC_DILITHIUM_L
#undef LC_DILITHIUM_ETA
#undef LC_DILITHIUM_TAU
#undef LC_DILITHIUM_BETA
#undef LC_DILITHIUM_GAMMA1
#undef LC_DILITHIUM_GAMMA2
#undef LC_DILITHIUM_OMEGA
#undef LC_DILITHIUM_CTILDE_BYTES
#undef LC_DILITHIUM_POLYT1_PACKEDBYTES
#undef LC_DILITHIUM_POLYT0_PACKEDBYTES
#undef LC_DILITHIUM_POLYVECH_PACKEDBYTES
#undef LC_DILITHIUM_POLYZ_PACKEDBYTES
#undef LC_DILITHIUM_POLYW1_PACKEDBYTES
#undef LC_DILITHIUM_POLYETA_PACKEDBYTES
#undef LC_DILITHIUM_PUBLICKEYBYTES
#undef LC_DILITHIUM_SECRETKEYBYTES
#undef LC_DILITHIUM_CRYPTO_BYTES
#endif /* LC_DILITHIUM_INTERNAL */
 
#ifdef __cplusplus
}
#endif
 
#endif /* LC_DILITHIUM_44_H */