Oregami
Repositories/oxedyne/fe2o3

oxedyne/fe2o3/fe2o3_crypto/src/c/kem.c

2.8 KiB, 1 run

created by r1870400018:200, which is this file's identity for as long as the history lasts, whatever it is later renamed to

download · who wrote it · its history

1#include "SABER_params.h"
2#include <string.h>
3#include <stdint.h>
4#include <stdio.h>
5#include "SABER_indcpa.h"
6#include "api.h"
7#include "verify.h"
8#include "rng.h"
9#include "fips202.h"
10#include "pack_unpack.h"
11
12
13int crypto_kem_keypair(unsigned char *pk, unsigned char *sk)
14{
15 int i;
16
17 indcpa_kem_keypair(pk, sk); // sk[0:SABER_INDCPA_SECRETKEYBYTES-1] <-- sk
18
19 for (i = 0; i < SABER_INDCPA_PUBLICKEYBYTES; i++)
20 sk[i + SABER_INDCPA_SECRETKEYBYTES] = pk[i]; // sk[SABER_INDCPA_SECRETKEYBYTES:SABER_INDCPA_SECRETKEYBYTES+SABER_INDCPA_SECRETKEYBYTES-1] <-- pk
21
22 saber_sha3_256(sk + SABER_SECRETKEYBYTES - 64, pk, SABER_INDCPA_PUBLICKEYBYTES); // Then hash(pk) is appended.
23
24 randombytes(sk + SABER_SECRETKEYBYTES - SABER_KEYBYTES, SABER_KEYBYTES); // Remaining part of sk contains a pseudo-random number.
25 // This is output when check in crypto_kem_dec() fails.
26
27 return (0);
28}
29
30int crypto_kem_enc(unsigned char *c, unsigned char *k, const unsigned char *pk)
31{
32
33 unsigned char kr[64]; // Will contain key, coins
34 unsigned char buf[64];
35
36 randombytes(buf, 32);
37
38 saber_sha3_256(buf, buf, 32); // BUF[0:31] <-- random message (will be used as the key for client) Note: hash doesnot release system RNG output
39
40 saber_sha3_256(buf + 32, pk, SABER_INDCPA_PUBLICKEYBYTES); // BUF[32:63] <-- Hash(public key); Multitarget countermeasure for coins + contributory KEM
41
42 saber_sha3_512(kr, buf, 64); // kr[0:63] <-- Hash(buf[0:63]);
43 // K^ <-- kr[0:31]
44 // noiseseed (r) <-- kr[32:63];
45 indcpa_kem_enc(buf, kr + 32, pk, c); // buf[0:31] contains message; kr[32:63] contains randomness r;
46
47 saber_sha3_256(kr + 32, c, SABER_BYTES_CCA_DEC);
48
49 saber_sha3_256(k, kr, 64); // hash concatenation of pre-k and h(c) to k
50
51 return (0);
52}
53
54int crypto_kem_dec(unsigned char *k, const unsigned char *c, const unsigned char *sk)
55{
56 int i, fail;
57 unsigned char cmp[SABER_BYTES_CCA_DEC];
58 unsigned char buf[64];
59 unsigned char kr[64]; // Will contain key, coins
60 const unsigned char *pk = sk + SABER_INDCPA_SECRETKEYBYTES;
61
62 indcpa_kem_dec(sk, c, buf); // buf[0:31] <-- message
63
64 // Multitarget countermeasure for coins + contributory KEM
65 for (i = 0; i < 32; i++) // Save hash by storing h(pk) in sk
66 buf[32 + i] = sk[SABER_SECRETKEYBYTES - 64 + i];
67
68 saber_sha3_512(kr, buf, 64);
69
70 indcpa_kem_enc(buf, kr + 32, pk, cmp);
71
72 fail = verify(c, cmp, SABER_BYTES_CCA_DEC);
73
74 saber_sha3_256(kr + 32, c, SABER_BYTES_CCA_DEC); // overwrite coins in kr with h(c)
75 //hexdump("WEE ", kr, 32, 64);
76
77 cmov(kr, sk + SABER_SECRETKEYBYTES - SABER_KEYBYTES, SABER_KEYBYTES, fail);
78
79 saber_sha3_256(k, kr, 64); // hash concatenation of pre-k and h(c) to k
80
81 return (0);
82}