Skip to content

Commit f923a32

Browse files
dghgitdghgit
committed
Merge remote-tracking branch 'refs/remotes/origin/master'
2 parents dff00da + 43a686c commit f923a32

File tree

3 files changed

+67
-61
lines changed

3 files changed

+67
-61
lines changed

‎core/src/main/java/org/bouncycastle/pqc/crypto/cmce/BENES.java

Lines changed: 51 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22

33
abstract class BENES
44
{
5+
private static final long[] TRANSPOSE_MASKS = { 0x5555555555555555L, 0x3333333333333333L,
6+
0x0F0F0F0F0F0F0F0FL, 0x00FF00FF00FF00FFL, 0x0000FFFF0000FFFFL, 0x00000000FFFFFFFFL };
7+
58
protected final int SYS_N;
69
protected final int SYS_T;
710
protected final int GFBITS;
@@ -17,77 +20,70 @@ public BENES(int n, int t, int m)
1720
/* output: out, transpose of in */
1821
static void transpose_64x64(long[] out, long[] in)
1922
{
20-
int i, j, s, d;
21-
22-
long x, y;
23-
long[][] masks = {
24-
{0x5555555555555555L, 0xAAAAAAAAAAAAAAAAL},
25-
{0x3333333333333333L, 0xCCCCCCCCCCCCCCCCL},
26-
{0x0F0F0F0F0F0F0F0FL, 0xF0F0F0F0F0F0F0F0L},
27-
{0x00FF00FF00FF00FFL, 0xFF00FF00FF00FF00L},
28-
{0x0000FFFF0000FFFFL, 0xFFFF0000FFFF0000L},
29-
{0x00000000FFFFFFFFL, 0xFFFFFFFF00000000L}
30-
};
23+
transpose_64x64(out, in, 0);
24+
}
3125

32-
for (i = 0; i < 64; i++)
33-
out[i] = in[i];
26+
static void transpose_64x64(long[] out, long[] in, int offset)
27+
{
28+
System.arraycopy(in, offset, out, offset, 64);
3429

35-
for (d = 5; d >= 0; d--)
30+
int d = 5;
31+
do
3632
{
37-
s = 1 << d;
38-
for (i = 0; i < 64; i += s*2)
33+
long m = TRANSPOSE_MASKS[d];
34+
int s = 1 << d;
35+
for (int i = offset; i < offset + 64; i += s * 2)
3936
{
40-
for (j = i; j < i+s; j++)
37+
for (int j = i; j < i + s; j += 4)
4138
{
42-
x = (out[j] & masks[d][0]) | ((out[j+s] & masks[d][0]) << s);
43-
y = ((out[j] & masks[d][1]) >>> s) | (out[j+s] & masks[d][1]);
44-
45-
out[j+0] = x;
46-
out[j+s] = y;
39+
// Bits.bitPermuteStep2(ref out[j + s + 0], ref out[j + 0], m, s);
40+
// Bits.bitPermuteStep2(ref out[j + s + 1], ref out[j + 1], m, s);
41+
// Bits.bitPermuteStep2(ref out[j + s + 2], ref out[j + 2], m, s);
42+
// Bits.bitPermuteStep2(ref out[j + s + 3], ref out[j + 3], m, s);
43+
long lo0 = out[j + 0];
44+
long lo1 = out[j + 1];
45+
long lo2 = out[j + 2];
46+
long lo3 = out[j + 3];
47+
long hi0 = out[j + s + 0];
48+
long hi1 = out[j + s + 1];
49+
long hi2 = out[j + s + 2];
50+
long hi3 = out[j + s + 3];
51+
long t0 = ((lo0 >>> s) ^ hi0) & m;
52+
long t1 = ((lo1 >>> s) ^ hi1) & m;
53+
long t2 = ((lo2 >>> s) ^ hi2) & m;
54+
long t3 = ((lo3 >>> s) ^ hi3) & m;
55+
out[j + 0] = lo0 ^ t0 << s;
56+
out[j + 1] = lo1 ^ t1 << s;
57+
out[j + 2] = lo2 ^ t2 << s;
58+
out[j + 3] = lo3 ^ t3 << s;
59+
out[j + s + 0] = hi0 ^ t0;
60+
out[j + s + 1] = hi1 ^ t1;
61+
out[j + s + 2] = hi2 ^ t2;
62+
out[j + s + 3] = hi3 ^ t3;
4763
}
4864
}
4965
}
66+
while (--d >= 2);
5067

51-
}
52-
53-
static void transpose_64x64(long[] out, long[] in, int offset)
54-
{
55-
int i, j, s, d;
56-
57-
long x, y;
58-
long[][] masks = {
59-
{0x5555555555555555L, 0xAAAAAAAAAAAAAAAAL},
60-
{0x3333333333333333L, 0xCCCCCCCCCCCCCCCCL},
61-
{0x0F0F0F0F0F0F0F0FL, 0xF0F0F0F0F0F0F0F0L},
62-
{0x00FF00FF00FF00FFL, 0xFF00FF00FF00FF00L},
63-
{0x0000FFFF0000FFFFL, 0xFFFF0000FFFF0000L},
64-
{0x00000000FFFFFFFFL, 0xFFFFFFFF00000000L}
65-
};
66-
67-
for (i = 0; i < 64; i++)
68-
out[i + offset] = in[i + offset];
69-
70-
for (d = 5; d >= 0; d--)
68+
do
7169
{
72-
s = 1 << d;
73-
for (i = 0; i < 64; i += s*2)
70+
long m = TRANSPOSE_MASKS[d];
71+
int s = 1 << d;
72+
for (int i = offset; i < offset + 64; i += s * 2)
7473
{
75-
for (j = i; j < i+s; j++)
74+
for (int j = i; j < i + s; ++j)
7675
{
77-
x = (out[j+offset] & masks[d][0]) | ((out[j+s + offset] & masks[d][0]) << s);
78-
y = ((out[j+offset] & masks[d][1]) >>> s) | (out[j+s + offset] & masks[d][1]);
79-
80-
out[j+0 + offset] = x;
81-
out[j+s + offset] = y;
76+
// Bits.bitPermuteStep2(ref out[j + s], ref out[j], m, s);
77+
long lo = out[j + 0];
78+
long hi = out[j + s];
79+
long t = ((lo >>> s) ^ hi) & m;
80+
out[j + 0] = lo ^ t << s;
81+
out[j + s] = hi ^ t;
8282
}
8383
}
8484
}
85-
85+
while (--d >= 0);
8686
}
8787

88-
8988
abstract protected void support_gen(short[] s, byte[] c);
90-
91-
92-
9389
}

‎core/src/main/java/org/bouncycastle/pqc/crypto/cmce/CMCEEngine.java

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1532,13 +1532,21 @@ private int pk_gen(byte[] pk, byte[] sk, int[] perm, short[] pi, long[] pivots)
15321532
if (usePadding)
15331533
{
15341534
int pk_index = 0, tail = PK_NROWS % 8;
1535-
for (i = 0; i < PK_NROWS; i++)
1535+
if (tail == 0)
1536+
{
1537+
System.arraycopy(mat[i], (PK_NROWS - 1) / 8, pk, pk_index, SYS_N / 8);
1538+
pk_index += SYS_N / 8;
1539+
}
1540+
else
15361541
{
1537-
for (j = (PK_NROWS - 1) / 8; j < SYS_N / 8 - 1; j++)
1542+
for (i = 0; i < PK_NROWS; i++)
15381543
{
1539-
pk[pk_index++] = (byte)(((mat[i][j] & 0xff) >>> tail) | (mat[i][j + 1] << (8 - tail)));
1544+
for (j = (PK_NROWS - 1) / 8; j < SYS_N / 8 - 1; j++)
1545+
{
1546+
pk[pk_index++] = (byte)(((mat[i][j] & 0xff) >>> tail) | (mat[i][j + 1] << (8 - tail)));
1547+
}
1548+
pk[pk_index++] = (byte)((mat[i][j] & 0xff) >>> tail);
15401549
}
1541-
pk[pk_index++] = (byte)((mat[i][j] & 0xff) >>> tail);
15421550
}
15431551
}
15441552
else

‎core/src/main/java/org/bouncycastle/pqc/crypto/cmce/GF12.java

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,8 @@ protected void gf_mul_poly(int length, int[] poly, short[] out, short[] left, sh
3737
temp[i - length + poly[j]] ^= temp_i;
3838
}
3939
{
40-
temp[i - length] ^= gf_mul_ext(gf_reduce(temp_i), (short)2);
40+
// NOTE: Safe because gf_reduce allows up to 24 bits, but gf_mul_ext(_par) only produces 23.
41+
temp[i - length] ^= temp_i << 1;
4142
}
4243
}
4344

@@ -66,7 +67,8 @@ protected void gf_sqr_poly(int length, int[] poly, short[] out, short[] input, i
6667
temp[i - length + poly[j]] ^= temp_i;
6768
}
6869
{
69-
temp[i - length] ^= gf_mul_ext(gf_reduce(temp_i), (short)2);
70+
// NOTE: Safe because gf_reduce allows up to 24 bits, but gf_sq_ext only produces 23.
71+
temp[i - length] ^= temp_i << 1;
7072
}
7173
}
7274

0 commit comments

Comments
 (0)