lc_kyber_768.h

Go to the documentation of this file.

/*
 * Copyright (C) 2022 - 2024, Stephan Mueller <smueller@chronox.de>
 *
 * License: see LICENSE file in root directory
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
 * WHICH ARE HEREBY DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
 * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
 * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
 * DAMAGE.
 */
/*
 * This code is derived in parts from the code distribution provided with
 * https://github.com/pq-crystals/kyber
 *
 * That code is released under Public Domain
 * (https://creativecommons.org/share-your-work/public-domain/cc0/).
 */
 
#ifndef LC_KYBER_768_H
#define LC_KYBER_768_H
 
#ifndef __ASSEMBLER__
 
#include "ext_headers.h"
#include "lc_aead.h"
#include "lc_rng.h"
 
#endif /* __ASSEMBLER__ */
 
#ifdef __cplusplus
extern "C" {
#endif
 
/*
 * Kyber 512:  K == 2 - NIST security category 1
 * Kyber 768:  K == 3 - NIST security category 3
 * Kyber 1024: K == 4 - NIST security category 5
 */
#define LC_KYBER_K 3
 
#define LC_KYBER_N 256
#define LC_KYBER_Q 3329
 
#define LC_KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */
#define LC_KYBER_SSBYTES 32 /* size in bytes of shared key */
 
#define LC_KYBER_POLYBYTES 384
#define LC_KYBER_POLYVECBYTES (LC_KYBER_K * LC_KYBER_POLYBYTES)
 
#if LC_KYBER_K == 2
#define LC_KYBER_ETA1 3
#define LC_KYBER_POLYCOMPRESSEDBYTES 128
#define LC_KYBER_POLYVECCOMPRESSEDBYTES (LC_KYBER_K * 320)
#elif LC_KYBER_K == 3
#define LC_KYBER_ETA1 2
#define LC_KYBER_POLYCOMPRESSEDBYTES 128
#define LC_KYBER_POLYVECCOMPRESSEDBYTES (LC_KYBER_K * 320)
#elif LC_KYBER_K == 4
#define LC_KYBER_ETA1 2
#define LC_KYBER_POLYCOMPRESSEDBYTES 160
#define LC_KYBER_POLYVECCOMPRESSEDBYTES (LC_KYBER_K * 352)
#endif
 
#define LC_KYBER_ETA2 2
 
#define LC_KYBER_INDCPA_MSGBYTES (LC_KYBER_SYMBYTES)
#define LC_KYBER_INDCPA_PUBLICKEYBYTES                                         \
        (LC_KYBER_POLYVECBYTES + LC_KYBER_SYMBYTES)
#define LC_KYBER_INDCPA_SECRETKEYBYTES (LC_KYBER_POLYVECBYTES)
#define LC_KYBER_INDCPA_BYTES                                                  \
        (LC_KYBER_POLYVECCOMPRESSEDBYTES + LC_KYBER_POLYCOMPRESSEDBYTES)
 
/*
 * Sizes of the different Kyber buffer types.
 *
 * WARNING: Do not use these defines in your code. If you need the sizes of
 * the different variable sizes, use sizeof of the different variable structs
 * or use the different *_size functions offered below for the particular sizes
 * of a given parameter.
 */
#define LC_KYBER_PUBLICKEYBYTES (LC_KYBER_INDCPA_PUBLICKEYBYTES)
/* 32 bytes of additional space to save H(pk) */
#define LC_KYBER_SECRETKEYBYTES                                                \
        (LC_KYBER_INDCPA_SECRETKEYBYTES + LC_KYBER_INDCPA_PUBLICKEYBYTES +     \
         2 * LC_KYBER_SYMBYTES)
#define LC_KYBER_CIPHERTEXTBYTES (LC_KYBER_INDCPA_BYTES)
 
#define LC_CRYPTO_SECRETKEYBYTES LC_KYBER_SECRETKEYBYTES
#define LC_CRYPTO_PUBLICKEYBYTES LC_KYBER_PUBLICKEYBYTES
#define LC_CRYPTO_CIPHERTEXTBYTES LC_KYBER_CIPHERTEXTBYTES
#define LC_CRYPTO_BYTES LC_KYBER_SSBYTES
 
#ifndef __ASSEMBLER__
/************************************* KEM ************************************/
struct lc_kyber_768_sk {
        uint8_t sk[LC_KYBER_SECRETKEYBYTES];
};
 
struct lc_kyber_768_pk {
        uint8_t pk[LC_KYBER_PUBLICKEYBYTES];
};
 
struct lc_kyber_768_ct {
        uint8_t ct[LC_CRYPTO_CIPHERTEXTBYTES];
};
 
struct lc_kyber_768_ss {
        uint8_t ss[LC_KYBER_SSBYTES];
};
 
LC_PURE
static inline unsigned int lc_kyber_768_sk_size(void)
{
        return lc_member_size(struct lc_kyber_768_sk, sk);
}
 
LC_PURE
static inline unsigned int lc_kyber_768_pk_size(void)
{
        return lc_member_size(struct lc_kyber_768_pk, pk);
}
 
LC_PURE
static inline unsigned int lc_kyber_768_ct_size(void)
{
        return lc_member_size(struct lc_kyber_768_ct, ct);
}
 
LC_PURE
static inline unsigned int lc_kyber_768_ss_size(void)
{
        return lc_member_size(struct lc_kyber_768_ss, ss);
}
 
int lc_kyber_768_keypair(struct lc_kyber_768_pk *pk, struct lc_kyber_768_sk *sk,
                     struct lc_rng_ctx *rng_ctx);
 
int lc_kyber_768_keypair_from_seed(struct lc_kyber_768_pk *pk,
                                   struct lc_kyber_768_sk *sk,
                                   const uint8_t *seed, size_t seedlen);
 
int lc_kyber_768_enc(struct lc_kyber_768_ct *ct, struct lc_kyber_768_ss *ss,
                 const struct lc_kyber_768_pk *pk);
 
int lc_kyber_768_enc_kdf(struct lc_kyber_768_ct *ct, uint8_t *ss, size_t ss_len,
                     const struct lc_kyber_768_pk *pk);
 
int lc_kyber_768_dec(struct lc_kyber_768_ss *ss, const struct lc_kyber_768_ct *ct,
                 const struct lc_kyber_768_sk *sk);
 
int lc_kyber_768_dec_kdf(uint8_t *ss, size_t ss_len, const struct lc_kyber_768_ct *ct,
                     const struct lc_kyber_768_sk *sk);
 
/************************************* KEX ************************************/
 
int lc_kex_768_uake_initiator_init(struct lc_kyber_768_pk *pk_e_i,
                               struct lc_kyber_768_ct *ct_e_i,
                               struct lc_kyber_768_ss *tk, struct lc_kyber_768_sk *sk_e,
                               const struct lc_kyber_768_pk *pk_r);
 
int lc_kex_768_uake_responder_ss(struct lc_kyber_768_ct *ct_e_r, uint8_t *shared_secret,
                             size_t shared_secret_len, const uint8_t *kdf_nonce,
                             size_t kdf_nonce_len,
                             const struct lc_kyber_768_pk *pk_e_i,
                             const struct lc_kyber_768_ct *ct_e_i,
                             const struct lc_kyber_768_sk *sk_r);
 
int lc_kex_768_uake_initiator_ss(uint8_t *shared_secret, size_t shared_secret_len,
                             const uint8_t *kdf_nonce, size_t kdf_nonce_len,
                             const struct lc_kyber_768_ct *ct_e_r,
                             const struct lc_kyber_768_ss *tk,
                             const struct lc_kyber_768_sk *sk_e);
 
int lc_kex_768_ake_initiator_init(struct lc_kyber_768_pk *pk_e_i,
                              struct lc_kyber_768_ct *ct_e_i,
                              struct lc_kyber_768_ss *tk, struct lc_kyber_768_sk *sk_e,
                              const struct lc_kyber_768_pk *pk_r);
 
int lc_kex_768_ake_responder_ss(struct lc_kyber_768_ct *ct_e_r_1,
                            struct lc_kyber_768_ct *ct_e_r_2,
                            uint8_t *shared_secret, size_t shared_secret_len,
                            const uint8_t *kdf_nonce, size_t kdf_nonce_len,
                            const struct lc_kyber_768_pk *pk_e_i,
                            const struct lc_kyber_768_ct *ct_e_i,
                            const struct lc_kyber_768_sk *sk_r,
                            const struct lc_kyber_768_pk *pk_i);
 
int lc_kex_768_ake_initiator_ss(uint8_t *shared_secret, size_t shared_secret_len,
                            const uint8_t *kdf_nonce, size_t kdf_nonce_len,
                            const struct lc_kyber_768_ct *ct_e_r_1,
                            const struct lc_kyber_768_ct *ct_e_r_2,
                            const struct lc_kyber_768_ss *tk,
                            const struct lc_kyber_768_sk *sk_e,
                            const struct lc_kyber_768_sk *sk_i);
 
/************************************* IES ************************************/
 
int lc_kyber_768_ies_enc(const struct lc_kyber_768_pk *pk, struct lc_kyber_768_ct *ct,
                     const uint8_t *plaintext, uint8_t *ciphertext,
                     size_t datalen, const uint8_t *aad, size_t aadlen,
                     uint8_t *tag, size_t taglen, struct lc_aead_ctx *aead);
 
int lc_kyber_768_ies_enc_init(struct lc_aead_ctx *aead,
                          const struct lc_kyber_768_pk *pk, struct lc_kyber_768_ct *ct,
                          const uint8_t *aad, size_t aadlen);
 
static inline int lc_kyber_768_ies_enc_update(struct lc_aead_ctx *aead,
                                          const uint8_t *plaintext,
                                          uint8_t *ciphertext, size_t datalen)
{
        return lc_aead_enc_update(aead, plaintext, ciphertext, datalen);
}
 
static inline int lc_kyber_768_ies_enc_final(struct lc_aead_ctx *aead,
                                         uint8_t *tag, size_t taglen)
{
        return lc_aead_enc_final(aead, tag, taglen);
}
 
int lc_kyber_768_ies_dec(const struct lc_kyber_768_sk *sk, const struct lc_kyber_768_ct *ct,
                     const uint8_t *ciphertext, uint8_t *plaintext,
                     size_t datalen, const uint8_t *aad, size_t aadlen,
                     const uint8_t *tag, size_t taglen,
                     struct lc_aead_ctx *aead);
 
int lc_kyber_768_ies_dec_init(struct lc_aead_ctx *aead,
                          const struct lc_kyber_768_sk *sk,
                          const struct lc_kyber_768_ct *ct,
                          const uint8_t *aad, size_t aadlen);
 
static inline int lc_kyber_768_ies_dec_update(struct lc_aead_ctx *aead,
                                          const uint8_t *ciphertext,
                                          uint8_t *plaintext, size_t datalen)
{
        return lc_aead_dec_update(aead, ciphertext, plaintext, datalen);
}
 
static inline int lc_kyber_768_ies_dec_final(struct lc_aead_ctx *aead,
                                         const uint8_t *tag, size_t taglen)
{
        return lc_aead_dec_final(aead, tag, taglen);
}
 
/****************************** Kyber X25510 KEM ******************************/
 
/*
 * The double KEM implements Kyber KEM together with the X25519 elliptic curve
 * KEX. The use is identical as the Kyber KEM. The only difference is that
 * the transmitted pk and ct has a different content.
 */
/* Macro set during leancrypto compile time for target platform */
#define LC_KYBER_X25519_KEM
#ifdef LC_KYBER_X25519_KEM
 
#include "lc_x25519.h"
 
struct lc_kyber_768_x25519_sk {
        struct lc_kyber_768_sk sk;
        struct lc_x25519_sk sk_x25519;
};
 
struct lc_kyber_768_x25519_pk {
        struct lc_kyber_768_pk pk;
        struct lc_x25519_pk pk_x25519;
};
 
struct lc_kyber_768_x25519_ct {
        struct lc_kyber_768_ct ct;
        struct lc_x25519_pk pk_x25519;
};
 
struct lc_kyber_768_x25519_ss {
        struct lc_kyber_768_ss ss;
        struct lc_x25519_ss ss_x25519;
};
 
int lc_kyber_768_x25519_keypair(struct lc_kyber_768_x25519_pk *pk,
                            struct lc_kyber_768_x25519_sk *sk,
                            struct lc_rng_ctx *rng_ctx);
 
int lc_kyber_768_x25519_enc_kdf(struct lc_kyber_768_x25519_ct *ct, uint8_t *ss,
                            size_t ss_len, const struct lc_kyber_768_x25519_pk *pk);
 
int lc_kyber_768_x25519_dec_kdf(uint8_t *ss, size_t ss_len,
                            const struct lc_kyber_768_x25519_ct *ct,
                            const struct lc_kyber_768_x25519_sk *sk);
 
/****************************** Kyber X25510 KEX ******************************/
 
int lc_kex_768_x25519_uake_initiator_init(struct lc_kyber_768_x25519_pk *pk_e_i,
                                      struct lc_kyber_768_x25519_ct *ct_e_i,
                                      struct lc_kyber_768_x25519_ss *tk,
                                      struct lc_kyber_768_x25519_sk *sk_e,
                                      const struct lc_kyber_768_x25519_pk *pk_r);
 
int lc_kex_768_x25519_uake_responder_ss(struct lc_kyber_768_x25519_ct *ct_e_r,
                                    uint8_t *shared_secret,
                                    size_t shared_secret_len,
                                    const uint8_t *kdf_nonce,
                                    size_t kdf_nonce_len,
                                    const struct lc_kyber_768_x25519_pk *pk_e_i,
                                    const struct lc_kyber_768_x25519_ct *ct_e_i,
                                    const struct lc_kyber_768_x25519_sk *sk_r);
 
int lc_kex_768_x25519_uake_initiator_ss(uint8_t *shared_secret,
                                    size_t shared_secret_len,
                                    const uint8_t *kdf_nonce,
                                    size_t kdf_nonce_len,
                                    const struct lc_kyber_768_x25519_ct *ct_e_r,
                                    const struct lc_kyber_768_x25519_ss *tk,
                                    const struct lc_kyber_768_x25519_sk *sk_e);
 
int lc_kex_768_x25519_ake_initiator_init(struct lc_kyber_768_x25519_pk *pk_e_i,
                                     struct lc_kyber_768_x25519_ct *ct_e_i,
                                     struct lc_kyber_768_x25519_ss *tk,
                                     struct lc_kyber_768_x25519_sk *sk_e,
                                     const struct lc_kyber_768_x25519_pk *pk_r);
 
int lc_kex_768_x25519_ake_responder_ss(struct lc_kyber_768_x25519_ct *ct_e_r_1,
                                   struct lc_kyber_768_x25519_ct *ct_e_r_2,
                                   uint8_t *shared_secret,
                                   size_t shared_secret_len,
                                   const uint8_t *kdf_nonce,
                                   size_t kdf_nonce_len,
                                   const struct lc_kyber_768_x25519_pk *pk_e_i,
                                   const struct lc_kyber_768_x25519_ct *ct_e_i,
                                   const struct lc_kyber_768_x25519_sk *sk_r,
                                   const struct lc_kyber_768_x25519_pk *pk_i);
 
int lc_kex_768_x25519_ake_initiator_ss(uint8_t *shared_secret,
                                   size_t shared_secret_len,
                                   const uint8_t *kdf_nonce,
                                   size_t kdf_nonce_len,
                                   const struct lc_kyber_768_x25519_ct *ct_e_r_1,
                                   const struct lc_kyber_768_x25519_ct *ct_e_r_2,
                                   const struct lc_kyber_768_x25519_ss *tk,
                                   const struct lc_kyber_768_x25519_sk *sk_e,
                                   const struct lc_kyber_768_x25519_sk *sk_i);
 
/****************************** Kyber X25519 IES ******************************/
int lc_kyber_768_x25519_ies_enc(const struct lc_kyber_768_x25519_pk *pk,
                            struct lc_kyber_768_x25519_ct *ct,
                            const uint8_t *plaintext, uint8_t *ciphertext,
                            size_t datalen, const uint8_t *aad, size_t aadlen,
                            uint8_t *tag, size_t taglen,
                            struct lc_aead_ctx *aead);
 
int lc_kyber_768_x25519_ies_enc_init(struct lc_aead_ctx *aead,
                                 const struct lc_kyber_768_x25519_pk *pk,
                                 struct lc_kyber_768_x25519_ct *ct,
                                 const uint8_t *aad, size_t aadlen);
 
static inline int lc_kyber_768_x25519_ies_enc_update(struct lc_aead_ctx *aead,
                                                 const uint8_t *plaintext,
                                                 uint8_t *ciphertext,
                                                 size_t datalen)
{
        return lc_aead_enc_update(aead, plaintext, ciphertext, datalen);
}
 
static inline int lc_kyber_768_x25519_ies_enc_final(struct lc_aead_ctx *aead,
                                                uint8_t *tag, size_t taglen)
{
        return lc_aead_enc_final(aead, tag, taglen);
}
 
int lc_kyber_768_x25519_ies_dec(const struct lc_kyber_768_x25519_sk *sk,
                            const struct lc_kyber_768_x25519_ct *ct,
                            const uint8_t *ciphertext, uint8_t *plaintext,
                            size_t datalen, const uint8_t *aad, size_t aadlen,
                            const uint8_t *tag, size_t taglen,
                            struct lc_aead_ctx *aead);
 
int lc_kyber_768_x25519_ies_dec_init(struct lc_aead_ctx *aead,
                                 const struct lc_kyber_768_x25519_sk *sk,
                                 const struct lc_kyber_768_x25519_ct *ct,
                                 const uint8_t *aad, size_t aadlen);
 
static inline int lc_kyber_768_x25519_ies_dec_update(struct lc_aead_ctx *aead,
                                                 const uint8_t *ciphertext,
                                                 uint8_t *plaintext,
                                                 size_t datalen)
{
        return lc_aead_dec_update(aead, ciphertext, plaintext, datalen);
}
 
static inline int lc_kyber_768_x25519_ies_dec_final(struct lc_aead_ctx *aead,
                                                const uint8_t *tag,
                                                size_t taglen)
{
        return lc_aead_dec_final(aead, tag, taglen);
}
 
#endif /* LC_KYBER_X25519_KEM */
 
#endif /* __ASSEMBLER__ */
 
/*
 * To allow including the different lc_kyber_*.h files, these macros need to be
 * undefined. Only during compilation of leancrypto, these macros remain defined
 * as this header file is not included multiple times.
 */
#ifndef LC_KYBER_INTERNAL
#undef LC_KYBER_K
#undef LC_KYBER_N
#undef LC_KYBER_Q
#undef LC_KYBER_SYMBYTES
#undef LC_KYBER_SSBYTES
#undef LC_KYBER_POLYBYTES
#undef LC_KYBER_POLYVECBYTES
#undef LC_KYBER_ETA1
#undef LC_KYBER_POLYCOMPRESSEDBYTES
#undef LC_KYBER_POLYVECCOMPRESSEDBYTES
#undef LC_KYBER_ETA2
#undef LC_KYBER_INDCPA_MSGBYTES
#undef LC_KYBER_INDCPA_PUBLICKEYBYTES
#undef LC_KYBER_INDCPA_SECRETKEYBYTES
#undef LC_KYBER_INDCPA_BYTES
#undef LC_KYBER_PUBLICKEYBYTES
#undef LC_KYBER_SECRETKEYBYTES
#undef LC_KYBER_CIPHERTEXTBYTES
#undef LC_CRYPTO_SECRETKEYBYTES
#undef LC_CRYPTO_PUBLICKEYBYTES
#undef LC_CRYPTO_CIPHERTEXTBYTES
#undef LC_CRYPTO_BYTES
#endif /* LC_KYBER_INTERNAL */
 
#ifdef __cplusplus
}
#endif
 
#endif /* LC_KYBER_768_H */