TestingOnlyNewPrivateKeyFromSemiExpanded creates a PrivateKey from a
semi-expanded private key encoding, for testing purposes. It rejects
inconsistent keys.
[PrivateKey.Bytes] must NOT be called on the resulting key, as it will
produce a random value.
bitPack implements BitPack(r mod± q, γ₁-1, γ₁), which packs the centered
coefficients of r into little-endian γ1+1-bit chunks. It appends to buf.
It must only be applied to r with coefficients in [−γ₁+1, γ₁], as
guaranteed by the rejection conditions in Sign.
bitPack18 implements BitPack(r mod± q, 2¹⁷-1, 2¹⁷), which packs the centered
coefficients of r into little-endian 18-bit chunks. It appends to buf.
It must only be applied to r with coefficients in [−2¹⁷+1, 2¹⁷], as
guaranteed by the rejection conditions in Sign.
bitPack20 implements BitPack(r mod± q, 2¹⁹-1, 2¹⁹), which packs the centered
coefficients of r into little-endian 20-bit chunks. It appends to buf.
It must only be applied to r with coefficients in [−2¹⁹+1, 2¹⁹], as
guaranteed by the rejection conditions in Sign.
constantTimeAbs returns the absolute value of x in constant time.
constantTimeSelectEqual returns yes if a == b, no otherwise, in constant time.
constantTimeSelectLessOrEqual returns yes if a <= b, no otherwise, in constant time.
decompose32 implements Decompose from FIPS 204 for γ2 = (q - 1) / 32.
r1 is in [0, 15].
decompose88 implements Decompose from FIPS 204 for γ2 = (q - 1) / 88.
r1 is in [0, 43].
fieldAdd returns a + b mod q.
fieldCenteredMod returns r mod± q, the value r reduced to the range
[−(q−1)/2, (q−1)/2].
fieldFromMontgomery converts a value a in Montgomery form back to
standard representation.
fieldInfinityNorm returns the infinity norm ||r||∞ of r, or the absolute
value of r centered around 0.
fieldMontgomeryAddMul returns a * b + c * d. This operation is fused to save
a fieldReduceOnce and a fieldReduce.
fieldMontgomeryMul returns a * b * R⁻¹ mod q.
fieldMontgomeryMulSub returns a * (b - c). This operation is fused to save a
fieldReduceOnce after the subtraction.
fieldMontgomeryReduce returns x * R⁻¹ mod q for x < q * R.
fieldReduceOnce reduces a value a < 2q.
fieldSub returns a - b mod q.
fieldSubToMontgomery converts a difference a - b to Montgomery form.
a and b must be < q. (This bound can probably be relaxed.)
fieldToMontgomery checks that a value a is < q, and converts it to
Montgomery form.
fips140CAST covers all rejection sampling paths, as recommended by IG 10.3.A,
and as tested by TestCASTRejectionPaths. It tests only one parameter set as
allowed by Note26. It tests the modified version of Algorithm 7 and 8 with a
fixed mu/μ, as allowed by IG 10.3.A, Resolution 15. It compares sk and not
pk, because H(pk) is part of sk, as allowed by the same Resolution. It
compares the results with hashes instead of values, to avoid embedding several
kilobytes of test vectors in every binary, as allowed by GeneralNote7.
Type Parameters:
T: ~[256]fieldElement polyAdd adds two ringElements or nttElements.
Type Parameters:
T: ~[256]fieldElement polySub subtracts two ringElements or nttElements.
power2Round implements Power2Round from FIPS 204.
It separates the bottom d = 13 bits of each 23-bit coefficient, rounding the
high part based on the low part, and correcting the low part accordingly.
sampleBoundedPoly samples a ringElement with coefficients in [−η, η] from the
seed rho and the index r. It implements RejBoundedPoly and CoeffFromHalfByte
from FIPS 204, passing in ρ and r separately from ExpandS.
sampleInBall samples a ringElement with coefficients in {−1, 0, 1}, and τ
non-zero coefficients. It is not constant-time.
sampleNTT samples an nttElement uniformly at random from the seed rho and the
indices s and r. It implements Step 3 of ExpandA, RejNTTPoly, and
CoeffFromThreeBytes from FIPS 204, passing in ρ, s, and r instead of ρ'.
sliceForAppend takes a slice and a requested number of bytes. It returns a
slice with the contents of the given slice followed by that many bytes and a
second slice that aliases into it and contains only the extra bytes. If the
original slice has sufficient capacity then no allocation is performed.
useHint implements UseHint from FIPS 204.
It is not constant-time.
useHint32 implements UseHint from FIPS 204 for γ2 = (q - 1) / 32.
useHint88 implements UseHint from FIPS 204 for γ2 = (q - 1) / 88.
testingOnlyRejectionReason is set in tests, to ensure that all rejection
paths are covered. If not nil, it is called with a string describing the
reason for rejection: "z", "r0", "ct0", or "h".
zetas are the values ζ^BitRev₈(k) mod q for each index k, converted to the
Montgomery domain.
Package-Level Constants (total 19, in which 9 are exported)