1 /* $NetBSD: libcrux_mlkem768_sha3.h,v 1.6 2026/09/21 23:01:54 christos Exp $ */ 2 /* $OpenBSD: libcrux_mlkem768_sha3.h,v 1.4 2025/11/13 05:13:06 djm Exp $ */ 3 4 /* Extracted from libcrux revision 026a87ab6d88ad3626b9fbbf3710d1e0483c1849 */ 5 6 /* 7 * MIT License 8 * 9 * Copyright (c) 2024 Cryspen 10 * 11 * Permission is hereby granted, free of charge, to any person obtaining a copy 12 * of this software and associated documentation files (the "Software"), to deal 13 * in the Software without restriction, including without limitation the rights 14 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 15 * copies of the Software, and to permit persons to whom the Software is 16 * furnished to do so, subject to the following conditions: 17 * 18 * The above copyright notice and this permission notice shall be included in all 19 * copies or substantial portions of the Software. 20 * 21 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 22 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 23 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 24 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 25 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 26 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 27 * SOFTWARE. 28 */ 29 30 #if !defined(__GNUC__) || (__GNUC__ < 2) 31 # define __attribute__(x) 32 #endif 33 #define KRML_MUSTINLINE inline 34 #define KRML_NOINLINE __attribute__((noinline, unused)) 35 #define KRML_HOST_EPRINTF(...) 36 #define KRML_HOST_EXIT(x) fatal_f("internal error") 37 38 static inline void 39 store64_le(uint8_t dst[8], uint64_t src) 40 { 41 dst[0] = src & 0xff; 42 dst[1] = (src >> 8) & 0xff; 43 dst[2] = (src >> 16) & 0xff; 44 dst[3] = (src >> 24) & 0xff; 45 dst[4] = (src >> 32) & 0xff; 46 dst[5] = (src >> 40) & 0xff; 47 dst[6] = (src >> 48) & 0xff; 48 dst[7] = (src >> 56) & 0xff; 49 } 50 51 static inline void 52 store32_le(uint8_t dst[4], uint32_t src) 53 { 54 dst[0] = src & 0xff; 55 dst[1] = (src >> 8) & 0xff; 56 dst[2] = (src >> 16) & 0xff; 57 dst[3] = (src >> 24) & 0xff; 58 } 59 60 static inline void 61 store32_be(uint8_t dst[4], uint32_t src) 62 { 63 dst[0] = (src >> 24) & 0xff; 64 dst[1] = (src >> 16) & 0xff; 65 dst[2] = (src >> 8) & 0xff; 66 dst[3] = src & 0xff; 67 } 68 69 static inline uint64_t 70 load64_le(uint8_t src[8]) 71 { 72 return (uint64_t)(src[0]) | 73 ((uint64_t)(src[1]) << 8) | 74 ((uint64_t)(src[2]) << 16) | 75 ((uint64_t)(src[3]) << 24) | 76 ((uint64_t)(src[4]) << 32) | 77 ((uint64_t)(src[5]) << 40) | 78 ((uint64_t)(src[6]) << 48) | 79 ((uint64_t)(src[7]) << 56); 80 } 81 82 static inline uint32_t 83 load32_le(uint8_t src[4]) 84 { 85 return (uint32_t)(src[0]) | 86 ((uint32_t)(src[1]) << 8) | 87 ((uint32_t)(src[2]) << 16) | 88 ((uint32_t)(src[3]) << 24); 89 } 90 91 #ifdef MISSING_BUILTIN_POPCOUNT 92 static inline unsigned int 93 __builtin_popcount(unsigned int num) 94 { 95 const int v[16] = { 0, 1, 1, 2, 1, 2, 2, 3, 1, 2, 2, 3, 2, 3, 3, 4 }; 96 return v[num & 0xf] + v[(num >> 4) & 0xf]; 97 } 98 #endif 99 100 /* from libcrux/libcrux-ml-kem/extracts/c_header_only/generated/eurydice_glue.h */ 101 #pragma once 102 103 104 #ifdef _MSC_VER 105 // For __popcnt 106 #endif 107 108 109 // C++ HELPERS 110 111 #if defined(__cplusplus) 112 113 #ifndef KRML_HOST_EPRINTF 114 #define KRML_HOST_EPRINTF(...) fprintf(stderr, __VA_ARGS__) 115 #endif 116 117 118 #ifndef __cpp_lib_type_identity 119 template <class T> 120 struct type_identity { 121 using type = T; 122 }; 123 124 template <class T> 125 using type_identity_t = typename type_identity<T>::type; 126 #else 127 using std::type_identity_t; 128 #endif 129 130 #define KRML_UNION_CONSTRUCTOR(T) \ 131 template <typename V> \ 132 constexpr T(int t, V U::*m, type_identity_t<V> v) : tag(t) { \ 133 val.*m = std::move(v); \ 134 } \ 135 T() = default; 136 137 #endif 138 139 // GENERAL-PURPOSE STUFF 140 141 #define LowStar_Ignore_ignore(e, t, _ret_t) ((void)e) 142 143 #define EURYDICE_ASSERT(test, msg) \ 144 do { \ 145 if (!(test)) { \ 146 fprintf(stderr, "assertion \"%s\" failed: file \"%s\", line %d\n", msg, \ 147 __FILE__, __LINE__); \ 148 exit(255); \ 149 } \ 150 } while (0) 151 152 // SLICES, ARRAYS, ETC. 153 154 // We represent a slice as a pair of an (untyped) pointer, along with the length 155 // of the slice, i.e. the number of elements in the slice (this is NOT the 156 // number of bytes). This design choice has two important consequences. 157 // - if you need to use `ptr`, you MUST cast it to a proper type *before* 158 // performing pointer arithmetic on it (remember that C desugars pointer 159 // arithmetic based on the type of the address) 160 // - if you need to use `len` for a C style function (e.g. memcpy, memcmp), you 161 // need to multiply it by sizeof t, where t is the type of the elements. 162 // 163 // Empty slices have `len == 0` and `ptr` always needs to be a valid pointer 164 // that is not NULL (otherwise the construction in EURYDICE_SLICE computes `NULL 165 // + start`). 166 typedef struct { 167 void *ptr; 168 size_t len; 169 } Eurydice_slice; 170 171 #if defined(__cplusplus) 172 #define KRML_CLITERAL(type) type 173 #else 174 #define KRML_CLITERAL(type) (type) 175 #endif 176 177 #if defined(__cplusplus) && defined(__cpp_designated_initializers) || \ 178 !(defined(__cplusplus)) 179 #define EURYDICE_CFIELD(X) X 180 #else 181 #define EURYDICE_CFIELD(X) 182 #endif 183 184 // Helper macro to create a slice out of a pointer x, a start index in x 185 // (included), and an end index in x (excluded). The argument x must be suitably 186 // cast to something that can decay (see remark above about how pointer 187 // arithmetic works in C), meaning either pointer or array type. 188 #define EURYDICE_SLICE(x, start, end) \ 189 (KRML_CLITERAL(Eurydice_slice){(void *)(x + start), end - start}) 190 191 // Slice length 192 #define EURYDICE_SLICE_LEN(s, _) (s).len 193 #define Eurydice_slice_len(s, _) (s).len 194 195 // This macro is a pain because in case the dereferenced element type is an 196 // array, you cannot simply write `t x` as it would yield `int[4] x` instead, 197 // which is NOT correct C syntax, so we add a dedicated phase in Eurydice that 198 // adds an extra argument to this macro at the last minute so that we have the 199 // correct type of *pointers* to elements. 200 #define Eurydice_slice_index(s, i, t, t_ptr_t) (((t_ptr_t)s.ptr)[i]) 201 202 // The following functions get sub slices from a slice. 203 204 #define Eurydice_slice_subslice(s, r, t, _0, _1) \ 205 EURYDICE_SLICE((t *)s.ptr, r.start, r.end) 206 207 // Variant for when the start and end indices are statically known (i.e., the 208 // range argument `r` is a literal). 209 #define Eurydice_slice_subslice2(s, start, end, t) \ 210 EURYDICE_SLICE((t *)s.ptr, (start), (end)) 211 212 // Previous version above does not work when t is an array type (as usual). Will 213 // be deprecated soon. 214 #define Eurydice_slice_subslice3(s, start, end, t_ptr) \ 215 EURYDICE_SLICE((t_ptr)s.ptr, (start), (end)) 216 217 #define Eurydice_slice_subslice_to(s, subslice_end_pos, t, _0, _1) \ 218 EURYDICE_SLICE((t *)s.ptr, 0, subslice_end_pos) 219 220 #define Eurydice_slice_subslice_from(s, subslice_start_pos, t, _0, _1) \ 221 EURYDICE_SLICE((t *)s.ptr, subslice_start_pos, s.len) 222 223 #define Eurydice_array_to_slice(end, x, t) \ 224 EURYDICE_SLICE(x, 0, \ 225 end) /* x is already at an array type, no need for cast */ 226 #define Eurydice_array_to_subslice(_arraylen, x, r, t, _0, _1) \ 227 EURYDICE_SLICE((t *)x, r.start, r.end) 228 229 // Same as above, variant for when start and end are statically known 230 #define Eurydice_array_to_subslice2(x, start, end, t) \ 231 EURYDICE_SLICE((t *)x, (start), (end)) 232 233 // Same as above, variant for when start and end are statically known 234 #define Eurydice_array_to_subslice3(x, start, end, t_ptr) \ 235 EURYDICE_SLICE((t_ptr)x, (start), (end)) 236 237 #define Eurydice_array_repeat(dst, len, init, t) \ 238 ERROR "should've been desugared" 239 240 // The following functions convert an array into a slice. 241 242 #define Eurydice_array_to_subslice_to(_size, x, r, t, _range_t, _0) \ 243 EURYDICE_SLICE((t *)x, 0, r) 244 #define Eurydice_array_to_subslice_from(size, x, r, t, _range_t, _0) \ 245 EURYDICE_SLICE((t *)x, r, size) 246 247 // Copy a slice with memcopy 248 #define Eurydice_slice_copy(dst, src, t) \ 249 memcpy(dst.ptr, src.ptr, dst.len * sizeof(t)) 250 251 #define core_array___Array_T__N___as_slice(len_, ptr_, t, _ret_t) \ 252 KRML_CLITERAL(Eurydice_slice) { ptr_, len_ } 253 254 #define core_array__core__clone__Clone_for__Array_T__N___clone( \ 255 len, src, dst, elem_type, _ret_t) \ 256 (memcpy(dst, src, len * sizeof(elem_type))) 257 #define TryFromSliceError uint8_t 258 #define core_array_TryFromSliceError uint8_t 259 260 #define Eurydice_array_eq(sz, a1, a2, t) (memcmp(a1, a2, sz * sizeof(t)) == 0) 261 262 // core::cmp::PartialEq<&0 (@Slice<U>)> for @Array<T, N> 263 #define Eurydice_array_eq_slice(sz, a1, s2, t, _) \ 264 (memcmp(a1, (s2)->ptr, sz * sizeof(t)) == 0) 265 266 #define core_array_equality___core__cmp__PartialEq__Array_U__N___for__Array_T__N____eq( \ 267 sz, a1, a2, t, _, _ret_t) \ 268 Eurydice_array_eq(sz, a1, a2, t, _) 269 #define core_array_equality___core__cmp__PartialEq__0___Slice_U____for__Array_T__N___3__eq( \ 270 sz, a1, a2, t, _, _ret_t) \ 271 Eurydice_array_eq(sz, a1, ((a2)->ptr), t, _) 272 273 #define Eurydice_slice_split_at(slice, mid, element_type, ret_t) \ 274 KRML_CLITERAL(ret_t) { \ 275 EURYDICE_CFIELD(.fst =) \ 276 EURYDICE_SLICE((element_type *)(slice).ptr, 0, mid), \ 277 EURYDICE_CFIELD(.snd =) \ 278 EURYDICE_SLICE((element_type *)(slice).ptr, mid, (slice).len) \ 279 } 280 281 #define Eurydice_slice_split_at_mut(slice, mid, element_type, ret_t) \ 282 KRML_CLITERAL(ret_t) { \ 283 EURYDICE_CFIELD(.fst =) \ 284 KRML_CLITERAL(Eurydice_slice){EURYDICE_CFIELD(.ptr =)(slice.ptr), \ 285 EURYDICE_CFIELD(.len =) mid}, \ 286 EURYDICE_CFIELD(.snd =) KRML_CLITERAL(Eurydice_slice) { \ 287 EURYDICE_CFIELD(.ptr =) \ 288 ((char *)slice.ptr + mid * sizeof(element_type)), \ 289 EURYDICE_CFIELD(.len =)(slice.len - mid) \ 290 } \ 291 } 292 293 // Conversion of slice to an array, rewritten (by Eurydice) to name the 294 // destination array, since arrays are not values in C. 295 // N.B.: see note in karamel/lib/Inlining.ml if you change this. 296 #define Eurydice_slice_to_array2(dst, src, _0, t_arr, _1) \ 297 Eurydice_slice_to_array3(&(dst)->tag, (char *)&(dst)->val.case_Ok, src, \ 298 sizeof(t_arr)) 299 300 static inline void Eurydice_slice_to_array3(uint8_t *dst_tag, char *dst_ok, 301 Eurydice_slice src, size_t sz) { 302 *dst_tag = 0; 303 memcpy(dst_ok, src.ptr, sz); 304 } 305 306 // SUPPORT FOR DSTs (Dynamically-Sized Types) 307 308 // A DST is a fat pointer that keeps tracks of the size of it flexible array 309 // member. Slices are a specific case of DSTs, where [T; N] implements 310 // Unsize<[T]>, meaning an array of statically known size can be converted to a 311 // fat pointer, i.e. a slice. 312 // 313 // Unlike slices, DSTs have a built-in definition that gets monomorphized, of 314 // the form: 315 // 316 // typedef struct { 317 // T *ptr; 318 // size_t len; // number of elements 319 // } Eurydice_dst; 320 // 321 // Furthermore, T = T0<[U0]> where `struct T0<U: ?Sized>`, where the `U` is the 322 // last field. This means that there are two monomorphizations of T0 in the 323 // program. One is `T0<[V; N]>` 324 // -- this is directly converted to a Eurydice_dst via suitable codegen (no 325 // macro). The other is `T = T0<[U]>`, where `[U]` gets emitted to 326 // `Eurydice_derefed_slice`, a type that only appears in that precise situation 327 // and is thus defined to give rise to a flexible array member. 328 329 typedef char Eurydice_derefed_slice[]; 330 331 #define Eurydice_slice_of_dst(fam_ptr, len_, t, _) \ 332 ((Eurydice_slice){.ptr = (void *)(fam_ptr), .len = len_}) 333 334 #define Eurydice_slice_of_boxed_array(ptr_, len_, t, _) \ 335 ((Eurydice_slice){.ptr = (void *)(ptr_), .len = len_}) 336 337 // CORE STUFF (conversions, endianness, ...) 338 339 // We slap extern "C" on declarations that intend to implement a prototype 340 // generated by Eurydice, because Eurydice prototypes are always emitted within 341 // an extern "C" block, UNLESS you use -fcxx17-compat, in which case, you must 342 // pass -DKRML_CXX17_COMPAT="" to your C++ compiler. 343 #if defined(__cplusplus) && !defined(KRML_CXX17_COMPAT) 344 extern "C" { 345 #endif 346 347 static inline void core_num__u32__to_be_bytes(uint32_t src, uint8_t dst[4]) { 348 store32_be(dst, src); 349 } 350 351 static inline void core_num__u32__to_le_bytes(uint32_t src, uint8_t dst[4]) { 352 store32_le(dst, src); 353 } 354 355 static inline uint32_t core_num__u32__from_le_bytes(uint8_t buf[4]) { 356 return load32_le(buf); 357 } 358 359 static inline void core_num__u64__to_le_bytes(uint64_t v, uint8_t buf[8]) { 360 store64_le(buf, v); 361 } 362 363 static inline uint64_t core_num__u64__from_le_bytes(uint8_t buf[8]) { 364 return load64_le(buf); 365 } 366 367 static inline int64_t core_convert_num___core__convert__From_i32__for_i64__from( 368 int32_t x) { 369 return x; 370 } 371 372 static inline uint64_t core_convert_num___core__convert__From_u8__for_u64__from( 373 uint8_t x) { 374 return x; 375 } 376 377 static inline uint64_t 378 core_convert_num___core__convert__From_u16__for_u64__from(uint16_t x) { 379 return x; 380 } 381 382 static inline size_t 383 core_convert_num___core__convert__From_u16__for_usize__from(uint16_t x) { 384 return x; 385 } 386 387 static inline uint32_t core_num__u8__count_ones(uint8_t x0) { 388 #ifdef _MSC_VER 389 return __popcnt(x0); 390 #else 391 return __builtin_popcount(x0); 392 #endif 393 } 394 395 static inline uint32_t core_num__i32__count_ones(int32_t x0) { 396 #ifdef _MSC_VER 397 return __popcnt(x0); 398 #else 399 return __builtin_popcount(x0); 400 #endif 401 } 402 403 static inline size_t core_cmp_impls___core__cmp__Ord_for_usize__min(size_t a, 404 size_t b) { 405 if (a <= b) 406 return a; 407 else 408 return b; 409 } 410 411 // unsigned overflow wraparound semantics in C 412 static inline uint16_t core_num__u16__wrapping_add(uint16_t x, uint16_t y) { 413 return x + y; 414 } 415 static inline uint8_t core_num__u8__wrapping_sub(uint8_t x, uint8_t y) { 416 return x - y; 417 } 418 static inline uint64_t core_num__u64__rotate_left(uint64_t x0, uint32_t x1) { 419 return (x0 << x1 | x0 >> (64 - x1)); 420 } 421 422 static inline void core_ops_arith__i32__add_assign(int32_t *x0, int32_t *x1) { 423 *x0 = *x0 + *x1; 424 } 425 426 static inline uint8_t Eurydice_bitand_pv_u8(uint8_t *p, uint8_t v) { 427 return (*p) & v; 428 } 429 static inline uint8_t Eurydice_shr_pv_u8(uint8_t *p, int32_t v) { 430 return (*p) >> v; 431 } 432 static inline uint32_t Eurydice_min_u32(uint32_t x, uint32_t y) { 433 return x < y ? x : y; 434 } 435 436 static inline uint8_t 437 core_ops_bit___core__ops__bit__BitAnd_u8__u8__for___a__u8___46__bitand( 438 uint8_t *x0, uint8_t x1) { 439 return Eurydice_bitand_pv_u8(x0, x1); 440 } 441 442 static inline uint8_t 443 core_ops_bit___core__ops__bit__Shr_i32__u8__for___a__u8___792__shr(uint8_t *x0, 444 int32_t x1) { 445 return Eurydice_shr_pv_u8(x0, x1); 446 } 447 448 #define core_num_nonzero_private_NonZeroUsizeInner size_t 449 static inline core_num_nonzero_private_NonZeroUsizeInner 450 core_num_nonzero_private___core__clone__Clone_for_core__num__nonzero__private__NonZeroUsizeInner__26__clone( 451 core_num_nonzero_private_NonZeroUsizeInner *x0) { 452 return *x0; 453 } 454 455 #if defined(__cplusplus) && !defined(KRML_CXX17_COMPAT) 456 } 457 #endif 458 459 // ITERATORS 460 461 #define Eurydice_range_iter_next(iter_ptr, t, ret_t) \ 462 (((iter_ptr)->start >= (iter_ptr)->end) \ 463 ? (KRML_CLITERAL(ret_t){EURYDICE_CFIELD(.tag =) 0, \ 464 EURYDICE_CFIELD(.f0 =) 0}) \ 465 : (KRML_CLITERAL(ret_t){EURYDICE_CFIELD(.tag =) 1, \ 466 EURYDICE_CFIELD(.f0 =)(iter_ptr)->start++})) 467 468 #define core_iter_range___core__iter__traits__iterator__Iterator_A__for_core__ops__range__Range_A__TraitClause_0___6__next \ 469 Eurydice_range_iter_next 470 471 // See note in karamel/lib/Inlining.ml if you change this 472 #define Eurydice_into_iter(x, t, _ret_t, _) (x) 473 #define core_iter_traits_collect___core__iter__traits__collect__IntoIterator_Clause1_Item__I__for_I__1__into_iter \ 474 Eurydice_into_iter 475 476 typedef struct { 477 Eurydice_slice slice; 478 size_t chunk_size; 479 } Eurydice_chunks; 480 481 // Can't use macros Eurydice_slice_subslice_{to,from} because they require a 482 // type, and this static inline function cannot receive a type as an argument. 483 // Instead, we receive the element size and use it to peform manual offset 484 // computations rather than going through the macros. 485 static inline Eurydice_slice chunk_next(Eurydice_chunks *chunks, 486 size_t element_size) { 487 size_t chunk_size = chunks->slice.len >= chunks->chunk_size 488 ? chunks->chunk_size 489 : chunks->slice.len; 490 Eurydice_slice curr_chunk; 491 curr_chunk.ptr = chunks->slice.ptr; 492 curr_chunk.len = chunk_size; 493 chunks->slice.ptr = (char *)(chunks->slice.ptr) + chunk_size * element_size; 494 chunks->slice.len = chunks->slice.len - chunk_size; 495 return curr_chunk; 496 } 497 498 #define core_slice___Slice_T___chunks(slice_, sz_, t, _ret_t) \ 499 ((Eurydice_chunks){.slice = slice_, .chunk_size = sz_}) 500 #define core_slice___Slice_T___chunks_exact(slice_, sz_, t, _ret_t) \ 501 ((Eurydice_chunks){ \ 502 .slice = {.ptr = slice_.ptr, .len = slice_.len - (slice_.len % sz_)}, \ 503 .chunk_size = sz_}) 504 #define core_slice_iter_Chunks Eurydice_chunks 505 #define core_slice_iter_ChunksExact Eurydice_chunks 506 #define Eurydice_chunks_next(iter, t, ret_t) \ 507 (((iter)->slice.len == 0) ? ((ret_t){.tag = core_option_None}) \ 508 : ((ret_t){.tag = core_option_Some, \ 509 .f0 = chunk_next(iter, sizeof(t))})) 510 #define core_slice_iter___core__iter__traits__iterator__Iterator_for_core__slice__iter__Chunks__a__T___70__next \ 511 Eurydice_chunks_next 512 // This name changed on 20240627 513 #define core_slice_iter___core__iter__traits__iterator__Iterator_for_core__slice__iter__Chunks__a__T___71__next \ 514 Eurydice_chunks_next 515 #define core_slice_iter__core__slice__iter__ChunksExact__a__T__89__next( \ 516 iter, t, _ret_t) \ 517 core_slice_iter__core__slice__iter__Chunks__a__T__70__next(iter, t) 518 519 typedef struct { 520 Eurydice_slice s; 521 size_t index; 522 } Eurydice_slice_iterator; 523 524 #define core_slice___Slice_T___iter(x, t, _ret_t) \ 525 ((Eurydice_slice_iterator){.s = x, .index = 0}) 526 #define core_slice_iter_Iter Eurydice_slice_iterator 527 #define core_slice_iter__core__slice__iter__Iter__a__T__181__next(iter, t, \ 528 ret_t) \ 529 (((iter)->index == (iter)->s.len) \ 530 ? (KRML_CLITERAL(ret_t){.tag = core_option_None}) \ 531 : (KRML_CLITERAL(ret_t){ \ 532 .tag = core_option_Some, \ 533 .f0 = ((iter)->index++, \ 534 &((t *)((iter)->s.ptr))[(iter)->index - 1])})) 535 #define core_option__core__option__Option_T__TraitClause_0___is_some(X, _0, \ 536 _1) \ 537 ((X)->tag == 1) 538 // STRINGS 539 540 typedef const char *Prims_string; 541 542 // MISC (UNTESTED) 543 544 typedef void *core_fmt_Formatter; 545 typedef void *core_fmt_Arguments; 546 typedef void *core_fmt_rt_Argument; 547 #define core_fmt_rt__core__fmt__rt__Argument__a__1__new_display(x1, x2, x3, \ 548 x4) \ 549 NULL 550 551 // BOXES 552 553 // Crimes. 554 static inline char *malloc_and_init(size_t sz, char *init) { 555 char *ptr = (char *)malloc(sz); 556 memcpy(ptr, init, sz); 557 return ptr; 558 } 559 560 #define Eurydice_box_new(init, t, t_dst) \ 561 ((t_dst)(malloc_and_init(sizeof(t), (char *)(&init)))) 562 563 #define Eurydice_box_new_array(len, ptr, t, t_dst) \ 564 ((t_dst)(malloc_and_init(len * sizeof(t), (char *)(ptr)))) 565 566 /* from libcrux/libcrux-ml-kem/extracts/c_header_only/generated/libcrux_mlkem_core.h */ 567 /* 568 * SPDX-FileCopyrightText: 2025 Cryspen Sarl <info (at) cryspen.com> 569 * 570 * SPDX-License-Identifier: MIT or Apache-2.0 571 * 572 * This code was generated with the following revisions: 573 * Charon: 667d2fc98984ff7f3df989c2367e6c1fa4a000e7 574 * Eurydice: 2381cbc416ef2ad0b561c362c500bc84f36b6785 575 * Karamel: 80f5435f2fc505973c469a4afcc8d875cddd0d8b 576 * F*: 71d8221589d4d438af3706d89cb653cf53e18aab 577 * Libcrux: 68dfed5a4a9e40277f62828471c029afed1ecdcc 578 */ 579 580 #ifndef libcrux_mlkem_core_H 581 #define libcrux_mlkem_core_H 582 583 584 #if defined(__cplusplus) 585 extern "C" { 586 #endif 587 588 /** 589 A monomorphic instance of core.ops.range.Range 590 with types size_t 591 592 */ 593 typedef struct core_ops_range_Range_08_s { 594 size_t start; 595 size_t end; 596 } core_ops_range_Range_08; 597 598 static inline uint16_t core_num__u16__wrapping_add(uint16_t x0, uint16_t x1); 599 600 static inline uint64_t core_num__u64__from_le_bytes(uint8_t x0[8U]); 601 602 static inline uint64_t core_num__u64__rotate_left(uint64_t x0, uint32_t x1); 603 604 static inline void core_num__u64__to_le_bytes(uint64_t x0, uint8_t x1[8U]); 605 606 static inline uint32_t core_num__u8__count_ones(uint8_t x0); 607 608 static inline uint8_t core_num__u8__wrapping_sub(uint8_t x0, uint8_t x1); 609 610 #define LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE ((size_t)32U) 611 612 #define LIBCRUX_ML_KEM_CONSTANTS_BITS_PER_COEFFICIENT ((size_t)12U) 613 614 #define LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT ((size_t)256U) 615 616 #define LIBCRUX_ML_KEM_CONSTANTS_BITS_PER_RING_ELEMENT \ 617 (LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * (size_t)12U) 618 619 #define LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT \ 620 (LIBCRUX_ML_KEM_CONSTANTS_BITS_PER_RING_ELEMENT / (size_t)8U) 621 622 #define LIBCRUX_ML_KEM_CONSTANTS_CPA_PKE_KEY_GENERATION_SEED_SIZE ((size_t)32U) 623 624 #define LIBCRUX_ML_KEM_CONSTANTS_G_DIGEST_SIZE ((size_t)64U) 625 626 #define LIBCRUX_ML_KEM_CONSTANTS_H_DIGEST_SIZE ((size_t)32U) 627 628 /** 629 K * BITS_PER_RING_ELEMENT / 8 630 631 [eurydice] Note that we can't use const generics here because that breaks 632 C extraction with eurydice. 633 */ 634 static inline size_t libcrux_ml_kem_constants_ranked_bytes_per_ring_element( 635 size_t rank) { 636 return rank * LIBCRUX_ML_KEM_CONSTANTS_BITS_PER_RING_ELEMENT / (size_t)8U; 637 } 638 639 /** 640 This function found in impl {libcrux_secrets::traits::Classify<T> for T} 641 */ 642 /** 643 A monomorphic instance of libcrux_secrets.int.public_integers.classify_27 644 with types uint8_t 645 646 */ 647 static KRML_MUSTINLINE uint8_t 648 libcrux_secrets_int_public_integers_classify_27_90(uint8_t self) { 649 return self; 650 } 651 652 /** 653 This function found in impl {libcrux_secrets::traits::Declassify<T> for T} 654 */ 655 /** 656 A monomorphic instance of libcrux_secrets.int.public_integers.declassify_d8 657 with types int16_t 658 659 */ 660 static KRML_MUSTINLINE int16_t 661 libcrux_secrets_int_public_integers_declassify_d8_39(int16_t self) { 662 return self; 663 } 664 665 /** 666 This function found in impl {libcrux_secrets::int::CastOps for i16} 667 */ 668 static KRML_MUSTINLINE uint8_t libcrux_secrets_int_as_u8_f5(int16_t self) { 669 return libcrux_secrets_int_public_integers_classify_27_90( 670 (uint8_t)libcrux_secrets_int_public_integers_declassify_d8_39(self)); 671 } 672 673 /** 674 This function found in impl {libcrux_secrets::traits::Classify<T> for T} 675 */ 676 /** 677 A monomorphic instance of libcrux_secrets.int.public_integers.classify_27 678 with types int16_t 679 680 */ 681 static KRML_MUSTINLINE int16_t 682 libcrux_secrets_int_public_integers_classify_27_39(int16_t self) { 683 return self; 684 } 685 686 /** 687 This function found in impl {libcrux_secrets::traits::Declassify<T> for T} 688 */ 689 /** 690 A monomorphic instance of libcrux_secrets.int.public_integers.declassify_d8 691 with types uint8_t 692 693 */ 694 static KRML_MUSTINLINE uint8_t 695 libcrux_secrets_int_public_integers_declassify_d8_90(uint8_t self) { 696 return self; 697 } 698 699 /** 700 This function found in impl {libcrux_secrets::int::CastOps for u8} 701 */ 702 static KRML_MUSTINLINE int16_t libcrux_secrets_int_as_i16_59(uint8_t self) { 703 return libcrux_secrets_int_public_integers_classify_27_39( 704 (int16_t)libcrux_secrets_int_public_integers_declassify_d8_90(self)); 705 } 706 707 /** 708 This function found in impl {libcrux_secrets::traits::Classify<T> for T} 709 */ 710 /** 711 A monomorphic instance of libcrux_secrets.int.public_integers.classify_27 712 with types int32_t 713 714 */ 715 static KRML_MUSTINLINE int32_t 716 libcrux_secrets_int_public_integers_classify_27_a8(int32_t self) { 717 return self; 718 } 719 720 /** 721 This function found in impl {libcrux_secrets::int::CastOps for i16} 722 */ 723 static KRML_MUSTINLINE int32_t libcrux_secrets_int_as_i32_f5(int16_t self) { 724 return libcrux_secrets_int_public_integers_classify_27_a8( 725 (int32_t)libcrux_secrets_int_public_integers_declassify_d8_39(self)); 726 } 727 728 /** 729 This function found in impl {libcrux_secrets::traits::Declassify<T> for T} 730 */ 731 /** 732 A monomorphic instance of libcrux_secrets.int.public_integers.declassify_d8 733 with types int32_t 734 735 */ 736 static KRML_MUSTINLINE int32_t 737 libcrux_secrets_int_public_integers_declassify_d8_a8(int32_t self) { 738 return self; 739 } 740 741 /** 742 This function found in impl {libcrux_secrets::int::CastOps for i32} 743 */ 744 static KRML_MUSTINLINE int16_t libcrux_secrets_int_as_i16_36(int32_t self) { 745 return libcrux_secrets_int_public_integers_classify_27_39( 746 (int16_t)libcrux_secrets_int_public_integers_declassify_d8_a8(self)); 747 } 748 749 /** 750 This function found in impl {libcrux_secrets::traits::Declassify<T> for T} 751 */ 752 /** 753 A monomorphic instance of libcrux_secrets.int.public_integers.declassify_d8 754 with types uint32_t 755 756 */ 757 static KRML_MUSTINLINE uint32_t 758 libcrux_secrets_int_public_integers_declassify_d8_df(uint32_t self) { 759 return self; 760 } 761 762 /** 763 This function found in impl {libcrux_secrets::int::CastOps for u32} 764 */ 765 static KRML_MUSTINLINE int32_t libcrux_secrets_int_as_i32_b8(uint32_t self) { 766 return libcrux_secrets_int_public_integers_classify_27_a8( 767 (int32_t)libcrux_secrets_int_public_integers_declassify_d8_df(self)); 768 } 769 770 /** 771 This function found in impl {libcrux_secrets::traits::Classify<T> for T} 772 */ 773 /** 774 A monomorphic instance of libcrux_secrets.int.public_integers.classify_27 775 with types uint16_t 776 777 */ 778 static KRML_MUSTINLINE uint16_t 779 libcrux_secrets_int_public_integers_classify_27_de(uint16_t self) { 780 return self; 781 } 782 783 /** 784 This function found in impl {libcrux_secrets::int::CastOps for i16} 785 */ 786 static KRML_MUSTINLINE uint16_t libcrux_secrets_int_as_u16_f5(int16_t self) { 787 return libcrux_secrets_int_public_integers_classify_27_de( 788 (uint16_t)libcrux_secrets_int_public_integers_declassify_d8_39(self)); 789 } 790 791 /** 792 This function found in impl {libcrux_secrets::traits::Declassify<T> for T} 793 */ 794 /** 795 A monomorphic instance of libcrux_secrets.int.public_integers.declassify_d8 796 with types uint16_t 797 798 */ 799 static KRML_MUSTINLINE uint16_t 800 libcrux_secrets_int_public_integers_declassify_d8_de(uint16_t self) { 801 return self; 802 } 803 804 /** 805 This function found in impl {libcrux_secrets::int::CastOps for u16} 806 */ 807 static KRML_MUSTINLINE int16_t libcrux_secrets_int_as_i16_ca(uint16_t self) { 808 return libcrux_secrets_int_public_integers_classify_27_39( 809 (int16_t)libcrux_secrets_int_public_integers_declassify_d8_de(self)); 810 } 811 812 /** 813 This function found in impl {libcrux_secrets::traits::Classify<T> for T} 814 */ 815 /** 816 A monomorphic instance of libcrux_secrets.int.public_integers.classify_27 817 with types uint64_t 818 819 */ 820 static KRML_MUSTINLINE uint64_t 821 libcrux_secrets_int_public_integers_classify_27_49(uint64_t self) { 822 return self; 823 } 824 825 /** 826 This function found in impl {libcrux_secrets::int::CastOps for u16} 827 */ 828 static KRML_MUSTINLINE uint64_t libcrux_secrets_int_as_u64_ca(uint16_t self) { 829 return libcrux_secrets_int_public_integers_classify_27_49( 830 (uint64_t)libcrux_secrets_int_public_integers_declassify_d8_de(self)); 831 } 832 833 /** 834 This function found in impl {libcrux_secrets::traits::Classify<T> for T} 835 */ 836 /** 837 A monomorphic instance of libcrux_secrets.int.public_integers.classify_27 838 with types uint32_t 839 840 */ 841 static KRML_MUSTINLINE uint32_t 842 libcrux_secrets_int_public_integers_classify_27_df(uint32_t self) { 843 return self; 844 } 845 846 /** 847 This function found in impl {libcrux_secrets::traits::Declassify<T> for T} 848 */ 849 /** 850 A monomorphic instance of libcrux_secrets.int.public_integers.declassify_d8 851 with types uint64_t 852 853 */ 854 static KRML_MUSTINLINE uint64_t 855 libcrux_secrets_int_public_integers_declassify_d8_49(uint64_t self) { 856 return self; 857 } 858 859 /** 860 This function found in impl {libcrux_secrets::int::CastOps for u64} 861 */ 862 static KRML_MUSTINLINE uint32_t libcrux_secrets_int_as_u32_a3(uint64_t self) { 863 return libcrux_secrets_int_public_integers_classify_27_df( 864 (uint32_t)libcrux_secrets_int_public_integers_declassify_d8_49(self)); 865 } 866 867 /** 868 This function found in impl {libcrux_secrets::int::CastOps for u32} 869 */ 870 static KRML_MUSTINLINE int16_t libcrux_secrets_int_as_i16_b8(uint32_t self) { 871 return libcrux_secrets_int_public_integers_classify_27_39( 872 (int16_t)libcrux_secrets_int_public_integers_declassify_d8_df(self)); 873 } 874 875 /** 876 This function found in impl {libcrux_secrets::int::CastOps for i16} 877 */ 878 static KRML_MUSTINLINE int16_t libcrux_secrets_int_as_i16_f5(int16_t self) { 879 return libcrux_secrets_int_public_integers_classify_27_39( 880 libcrux_secrets_int_public_integers_declassify_d8_39(self)); 881 } 882 883 typedef struct libcrux_ml_kem_utils_extraction_helper_Keypair768_s { 884 uint8_t fst[1152U]; 885 uint8_t snd[1184U]; 886 } libcrux_ml_kem_utils_extraction_helper_Keypair768; 887 888 #define Ok 0 889 #define Err 1 890 891 typedef uint8_t Result_b2_tags; 892 893 /** 894 A monomorphic instance of core.result.Result 895 with types uint8_t[24size_t], core_array_TryFromSliceError 896 897 */ 898 typedef struct Result_b2_s { 899 Result_b2_tags tag; 900 union { 901 uint8_t case_Ok[24U]; 902 TryFromSliceError case_Err; 903 } val; 904 } Result_b2; 905 906 /** 907 This function found in impl {core::result::Result<T, E>[TraitClause@0, 908 TraitClause@1]} 909 */ 910 /** 911 A monomorphic instance of core.result.unwrap_26 912 with types uint8_t[24size_t], core_array_TryFromSliceError 913 914 */ 915 static inline void unwrap_26_70(Result_b2 self, uint8_t ret[24U]) { 916 if (self.tag == Ok) { 917 uint8_t f0[24U]; 918 memcpy(f0, self.val.case_Ok, (size_t)24U * sizeof(uint8_t)); 919 memcpy(ret, f0, (size_t)24U * sizeof(uint8_t)); 920 } else { 921 KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, 922 "unwrap not Ok"); 923 KRML_HOST_EXIT(255U); 924 } 925 } 926 927 /** 928 A monomorphic instance of core.result.Result 929 with types uint8_t[20size_t], core_array_TryFromSliceError 930 931 */ 932 typedef struct Result_e1_s { 933 Result_b2_tags tag; 934 union { 935 uint8_t case_Ok[20U]; 936 TryFromSliceError case_Err; 937 } val; 938 } Result_e1; 939 940 /** 941 This function found in impl {core::result::Result<T, E>[TraitClause@0, 942 TraitClause@1]} 943 */ 944 /** 945 A monomorphic instance of core.result.unwrap_26 946 with types uint8_t[20size_t], core_array_TryFromSliceError 947 948 */ 949 static inline void unwrap_26_20(Result_e1 self, uint8_t ret[20U]) { 950 if (self.tag == Ok) { 951 uint8_t f0[20U]; 952 memcpy(f0, self.val.case_Ok, (size_t)20U * sizeof(uint8_t)); 953 memcpy(ret, f0, (size_t)20U * sizeof(uint8_t)); 954 } else { 955 KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, 956 "unwrap not Ok"); 957 KRML_HOST_EXIT(255U); 958 } 959 } 960 961 /** 962 Pad the `slice` with `0`s at the end. 963 */ 964 /** 965 A monomorphic instance of libcrux_ml_kem.utils.into_padded_array 966 with const generics 967 - LEN= 32 968 */ 969 static KRML_MUSTINLINE void libcrux_ml_kem_utils_into_padded_array_9e( 970 Eurydice_slice slice, uint8_t ret[32U]) { 971 uint8_t out[32U] = {0U}; 972 uint8_t *uu____0 = out; 973 Eurydice_slice_copy( 974 Eurydice_array_to_subslice3( 975 uu____0, (size_t)0U, Eurydice_slice_len(slice, uint8_t), uint8_t *), 976 slice, uint8_t); 977 memcpy(ret, out, (size_t)32U * sizeof(uint8_t)); 978 } 979 980 /** 981 A monomorphic instance of libcrux_ml_kem.types.MlKemPrivateKey 982 with const generics 983 - $2400size_t 984 */ 985 typedef struct libcrux_ml_kem_types_MlKemPrivateKey_d9_s { 986 uint8_t value[2400U]; 987 } libcrux_ml_kem_types_MlKemPrivateKey_d9; 988 989 /** 990 This function found in impl {core::default::Default for 991 libcrux_ml_kem::types::MlKemPrivateKey<SIZE>} 992 */ 993 /** 994 A monomorphic instance of libcrux_ml_kem.types.default_d3 995 with const generics 996 - SIZE= 2400 997 */ 998 static inline libcrux_ml_kem_types_MlKemPrivateKey_d9 999 libcrux_ml_kem_types_default_d3_28(void) { 1000 return ( 1001 KRML_CLITERAL(libcrux_ml_kem_types_MlKemPrivateKey_d9){.value = {0U}}); 1002 } 1003 1004 /** 1005 A monomorphic instance of libcrux_ml_kem.types.MlKemPublicKey 1006 with const generics 1007 - $1184size_t 1008 */ 1009 typedef struct libcrux_ml_kem_types_MlKemPublicKey_30_s { 1010 uint8_t value[1184U]; 1011 } libcrux_ml_kem_types_MlKemPublicKey_30; 1012 1013 /** 1014 This function found in impl {core::convert::From<@Array<u8, SIZE>> for 1015 libcrux_ml_kem::types::MlKemPublicKey<SIZE>} 1016 */ 1017 /** 1018 A monomorphic instance of libcrux_ml_kem.types.from_fd 1019 with const generics 1020 - SIZE= 1184 1021 */ 1022 static inline libcrux_ml_kem_types_MlKemPublicKey_30 1023 libcrux_ml_kem_types_from_fd_d0(uint8_t value[1184U]) { 1024 /* Passing arrays by value in Rust generates a copy in C */ 1025 uint8_t copy_of_value[1184U]; 1026 memcpy(copy_of_value, value, (size_t)1184U * sizeof(uint8_t)); 1027 libcrux_ml_kem_types_MlKemPublicKey_30 lit; 1028 memcpy(lit.value, copy_of_value, (size_t)1184U * sizeof(uint8_t)); 1029 return lit; 1030 } 1031 1032 typedef struct libcrux_ml_kem_mlkem768_MlKem768KeyPair_s { 1033 libcrux_ml_kem_types_MlKemPrivateKey_d9 sk; 1034 libcrux_ml_kem_types_MlKemPublicKey_30 pk; 1035 } libcrux_ml_kem_mlkem768_MlKem768KeyPair; 1036 1037 /** 1038 This function found in impl 1039 {libcrux_ml_kem::types::MlKemKeyPair<PRIVATE_KEY_SIZE, PUBLIC_KEY_SIZE>} 1040 */ 1041 /** 1042 A monomorphic instance of libcrux_ml_kem.types.from_17 1043 with const generics 1044 - PRIVATE_KEY_SIZE= 2400 1045 - PUBLIC_KEY_SIZE= 1184 1046 */ 1047 static inline libcrux_ml_kem_mlkem768_MlKem768KeyPair 1048 libcrux_ml_kem_types_from_17_74(libcrux_ml_kem_types_MlKemPrivateKey_d9 sk, 1049 libcrux_ml_kem_types_MlKemPublicKey_30 pk) { 1050 return (KRML_CLITERAL(libcrux_ml_kem_mlkem768_MlKem768KeyPair){.sk = sk, 1051 .pk = pk}); 1052 } 1053 1054 /** 1055 This function found in impl {core::convert::From<@Array<u8, SIZE>> for 1056 libcrux_ml_kem::types::MlKemPrivateKey<SIZE>} 1057 */ 1058 /** 1059 A monomorphic instance of libcrux_ml_kem.types.from_77 1060 with const generics 1061 - SIZE= 2400 1062 */ 1063 static inline libcrux_ml_kem_types_MlKemPrivateKey_d9 1064 libcrux_ml_kem_types_from_77_28(uint8_t value[2400U]) { 1065 /* Passing arrays by value in Rust generates a copy in C */ 1066 uint8_t copy_of_value[2400U]; 1067 memcpy(copy_of_value, value, (size_t)2400U * sizeof(uint8_t)); 1068 libcrux_ml_kem_types_MlKemPrivateKey_d9 lit; 1069 memcpy(lit.value, copy_of_value, (size_t)2400U * sizeof(uint8_t)); 1070 return lit; 1071 } 1072 1073 /** 1074 A monomorphic instance of core.result.Result 1075 with types uint8_t[32size_t], core_array_TryFromSliceError 1076 1077 */ 1078 typedef struct Result_fb_s { 1079 Result_b2_tags tag; 1080 union { 1081 uint8_t case_Ok[32U]; 1082 TryFromSliceError case_Err; 1083 } val; 1084 } Result_fb; 1085 1086 /** 1087 This function found in impl {core::result::Result<T, E>[TraitClause@0, 1088 TraitClause@1]} 1089 */ 1090 /** 1091 A monomorphic instance of core.result.unwrap_26 1092 with types uint8_t[32size_t], core_array_TryFromSliceError 1093 1094 */ 1095 static inline void unwrap_26_b3(Result_fb self, uint8_t ret[32U]) { 1096 if (self.tag == Ok) { 1097 uint8_t f0[32U]; 1098 memcpy(f0, self.val.case_Ok, (size_t)32U * sizeof(uint8_t)); 1099 memcpy(ret, f0, (size_t)32U * sizeof(uint8_t)); 1100 } else { 1101 KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, 1102 "unwrap not Ok"); 1103 KRML_HOST_EXIT(255U); 1104 } 1105 } 1106 1107 typedef struct libcrux_ml_kem_mlkem768_MlKem768Ciphertext_s { 1108 uint8_t value[1088U]; 1109 } libcrux_ml_kem_mlkem768_MlKem768Ciphertext; 1110 1111 /** 1112 A monomorphic instance of K. 1113 with types libcrux_ml_kem_types_MlKemCiphertext[[$1088size_t]], 1114 uint8_t[32size_t] 1115 1116 */ 1117 typedef struct tuple_c2_s { 1118 libcrux_ml_kem_mlkem768_MlKem768Ciphertext fst; 1119 uint8_t snd[32U]; 1120 } tuple_c2; 1121 1122 /** 1123 This function found in impl {core::convert::From<@Array<u8, SIZE>> for 1124 libcrux_ml_kem::types::MlKemCiphertext<SIZE>} 1125 */ 1126 /** 1127 A monomorphic instance of libcrux_ml_kem.types.from_e0 1128 with const generics 1129 - SIZE= 1088 1130 */ 1131 static inline libcrux_ml_kem_mlkem768_MlKem768Ciphertext 1132 libcrux_ml_kem_types_from_e0_80(uint8_t value[1088U]) { 1133 /* Passing arrays by value in Rust generates a copy in C */ 1134 uint8_t copy_of_value[1088U]; 1135 memcpy(copy_of_value, value, (size_t)1088U * sizeof(uint8_t)); 1136 libcrux_ml_kem_mlkem768_MlKem768Ciphertext lit; 1137 memcpy(lit.value, copy_of_value, (size_t)1088U * sizeof(uint8_t)); 1138 return lit; 1139 } 1140 1141 /** 1142 This function found in impl {libcrux_ml_kem::types::MlKemPublicKey<SIZE>} 1143 */ 1144 /** 1145 A monomorphic instance of libcrux_ml_kem.types.as_slice_e6 1146 with const generics 1147 - SIZE= 1184 1148 */ 1149 static inline uint8_t *libcrux_ml_kem_types_as_slice_e6_d0( 1150 libcrux_ml_kem_types_MlKemPublicKey_30 *self) { 1151 return self->value; 1152 } 1153 1154 /** 1155 This function found in impl {libcrux_ml_kem::types::MlKemCiphertext<SIZE>} 1156 */ 1157 /** 1158 A monomorphic instance of libcrux_ml_kem.types.as_slice_a9 1159 with const generics 1160 - SIZE= 1088 1161 */ 1162 static inline uint8_t *libcrux_ml_kem_types_as_slice_a9_80( 1163 libcrux_ml_kem_mlkem768_MlKem768Ciphertext *self) { 1164 return self->value; 1165 } 1166 1167 /** 1168 A monomorphic instance of libcrux_ml_kem.utils.prf_input_inc 1169 with const generics 1170 - K= 3 1171 */ 1172 static KRML_MUSTINLINE uint8_t libcrux_ml_kem_utils_prf_input_inc_e0( 1173 uint8_t (*prf_inputs)[33U], uint8_t domain_separator) { 1174 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 1175 size_t i0 = i; 1176 prf_inputs[i0][32U] = domain_separator; 1177 domain_separator = (uint32_t)domain_separator + 1U; 1178 } 1179 return domain_separator; 1180 } 1181 1182 /** 1183 Pad the `slice` with `0`s at the end. 1184 */ 1185 /** 1186 A monomorphic instance of libcrux_ml_kem.utils.into_padded_array 1187 with const generics 1188 - LEN= 33 1189 */ 1190 static KRML_MUSTINLINE void libcrux_ml_kem_utils_into_padded_array_c8( 1191 Eurydice_slice slice, uint8_t ret[33U]) { 1192 uint8_t out[33U] = {0U}; 1193 uint8_t *uu____0 = out; 1194 Eurydice_slice_copy( 1195 Eurydice_array_to_subslice3( 1196 uu____0, (size_t)0U, Eurydice_slice_len(slice, uint8_t), uint8_t *), 1197 slice, uint8_t); 1198 memcpy(ret, out, (size_t)33U * sizeof(uint8_t)); 1199 } 1200 1201 /** 1202 Pad the `slice` with `0`s at the end. 1203 */ 1204 /** 1205 A monomorphic instance of libcrux_ml_kem.utils.into_padded_array 1206 with const generics 1207 - LEN= 34 1208 */ 1209 static KRML_MUSTINLINE void libcrux_ml_kem_utils_into_padded_array_b6( 1210 Eurydice_slice slice, uint8_t ret[34U]) { 1211 uint8_t out[34U] = {0U}; 1212 uint8_t *uu____0 = out; 1213 Eurydice_slice_copy( 1214 Eurydice_array_to_subslice3( 1215 uu____0, (size_t)0U, Eurydice_slice_len(slice, uint8_t), uint8_t *), 1216 slice, uint8_t); 1217 memcpy(ret, out, (size_t)34U * sizeof(uint8_t)); 1218 } 1219 1220 /** 1221 This function found in impl {core::convert::AsRef<@Slice<u8>> for 1222 libcrux_ml_kem::types::MlKemCiphertext<SIZE>} 1223 */ 1224 /** 1225 A monomorphic instance of libcrux_ml_kem.types.as_ref_d3 1226 with const generics 1227 - SIZE= 1088 1228 */ 1229 static inline Eurydice_slice libcrux_ml_kem_types_as_ref_d3_80( 1230 libcrux_ml_kem_mlkem768_MlKem768Ciphertext *self) { 1231 return Eurydice_array_to_slice((size_t)1088U, self->value, uint8_t); 1232 } 1233 1234 /** 1235 Pad the `slice` with `0`s at the end. 1236 */ 1237 /** 1238 A monomorphic instance of libcrux_ml_kem.utils.into_padded_array 1239 with const generics 1240 - LEN= 1120 1241 */ 1242 static KRML_MUSTINLINE void libcrux_ml_kem_utils_into_padded_array_15( 1243 Eurydice_slice slice, uint8_t ret[1120U]) { 1244 uint8_t out[1120U] = {0U}; 1245 uint8_t *uu____0 = out; 1246 Eurydice_slice_copy( 1247 Eurydice_array_to_subslice3( 1248 uu____0, (size_t)0U, Eurydice_slice_len(slice, uint8_t), uint8_t *), 1249 slice, uint8_t); 1250 memcpy(ret, out, (size_t)1120U * sizeof(uint8_t)); 1251 } 1252 1253 /** 1254 Pad the `slice` with `0`s at the end. 1255 */ 1256 /** 1257 A monomorphic instance of libcrux_ml_kem.utils.into_padded_array 1258 with const generics 1259 - LEN= 64 1260 */ 1261 static KRML_MUSTINLINE void libcrux_ml_kem_utils_into_padded_array_24( 1262 Eurydice_slice slice, uint8_t ret[64U]) { 1263 uint8_t out[64U] = {0U}; 1264 uint8_t *uu____0 = out; 1265 Eurydice_slice_copy( 1266 Eurydice_array_to_subslice3( 1267 uu____0, (size_t)0U, Eurydice_slice_len(slice, uint8_t), uint8_t *), 1268 slice, uint8_t); 1269 memcpy(ret, out, (size_t)64U * sizeof(uint8_t)); 1270 } 1271 1272 typedef struct Eurydice_slice_uint8_t_x4_s { 1273 Eurydice_slice fst; 1274 Eurydice_slice snd; 1275 Eurydice_slice thd; 1276 Eurydice_slice f3; 1277 } Eurydice_slice_uint8_t_x4; 1278 1279 typedef struct Eurydice_slice_uint8_t_x2_s { 1280 Eurydice_slice fst; 1281 Eurydice_slice snd; 1282 } Eurydice_slice_uint8_t_x2; 1283 1284 /** 1285 Unpack an incoming private key into it's different parts. 1286 1287 We have this here in types to extract into a common core for C. 1288 */ 1289 /** 1290 A monomorphic instance of libcrux_ml_kem.types.unpack_private_key 1291 with const generics 1292 - CPA_SECRET_KEY_SIZE= 1152 1293 - PUBLIC_KEY_SIZE= 1184 1294 */ 1295 static inline Eurydice_slice_uint8_t_x4 1296 libcrux_ml_kem_types_unpack_private_key_b4(Eurydice_slice private_key) { 1297 Eurydice_slice_uint8_t_x2 uu____0 = Eurydice_slice_split_at( 1298 private_key, (size_t)1152U, uint8_t, Eurydice_slice_uint8_t_x2); 1299 Eurydice_slice ind_cpa_secret_key = uu____0.fst; 1300 Eurydice_slice secret_key0 = uu____0.snd; 1301 Eurydice_slice_uint8_t_x2 uu____1 = Eurydice_slice_split_at( 1302 secret_key0, (size_t)1184U, uint8_t, Eurydice_slice_uint8_t_x2); 1303 Eurydice_slice ind_cpa_public_key = uu____1.fst; 1304 Eurydice_slice secret_key = uu____1.snd; 1305 Eurydice_slice_uint8_t_x2 uu____2 = Eurydice_slice_split_at( 1306 secret_key, LIBCRUX_ML_KEM_CONSTANTS_H_DIGEST_SIZE, uint8_t, 1307 Eurydice_slice_uint8_t_x2); 1308 Eurydice_slice ind_cpa_public_key_hash = uu____2.fst; 1309 Eurydice_slice implicit_rejection_value = uu____2.snd; 1310 return ( 1311 KRML_CLITERAL(Eurydice_slice_uint8_t_x4){.fst = ind_cpa_secret_key, 1312 .snd = ind_cpa_public_key, 1313 .thd = ind_cpa_public_key_hash, 1314 .f3 = implicit_rejection_value}); 1315 } 1316 1317 /** 1318 This function found in impl {libcrux_secrets::traits::Declassify<T> for T} 1319 */ 1320 /** 1321 A monomorphic instance of libcrux_secrets.int.public_integers.declassify_d8 1322 with types uint8_t[24size_t] 1323 1324 */ 1325 static KRML_MUSTINLINE void 1326 libcrux_secrets_int_public_integers_declassify_d8_d2(uint8_t self[24U], 1327 uint8_t ret[24U]) { 1328 memcpy(ret, self, (size_t)24U * sizeof(uint8_t)); 1329 } 1330 1331 /** 1332 This function found in impl {libcrux_secrets::traits::Declassify<T> for T} 1333 */ 1334 /** 1335 A monomorphic instance of libcrux_secrets.int.public_integers.declassify_d8 1336 with types uint8_t[20size_t] 1337 1338 */ 1339 static KRML_MUSTINLINE void 1340 libcrux_secrets_int_public_integers_declassify_d8_57(uint8_t self[20U], 1341 uint8_t ret[20U]) { 1342 memcpy(ret, self, (size_t)20U * sizeof(uint8_t)); 1343 } 1344 1345 /** 1346 This function found in impl {libcrux_secrets::traits::Declassify<T> for T} 1347 */ 1348 /** 1349 A monomorphic instance of libcrux_secrets.int.public_integers.declassify_d8 1350 with types uint8_t[8size_t] 1351 1352 */ 1353 static KRML_MUSTINLINE void 1354 libcrux_secrets_int_public_integers_declassify_d8_76(uint8_t self[8U], 1355 uint8_t ret[8U]) { 1356 memcpy(ret, self, (size_t)8U * sizeof(uint8_t)); 1357 } 1358 1359 /** 1360 This function found in impl {libcrux_secrets::traits::Declassify<T> for T} 1361 */ 1362 /** 1363 A monomorphic instance of libcrux_secrets.int.public_integers.declassify_d8 1364 with types uint8_t[2size_t] 1365 1366 */ 1367 static KRML_MUSTINLINE void 1368 libcrux_secrets_int_public_integers_declassify_d8_d4(uint8_t self[2U], 1369 uint8_t ret[2U]) { 1370 memcpy(ret, self, (size_t)2U * sizeof(uint8_t)); 1371 } 1372 1373 /** 1374 This function found in impl {libcrux_secrets::traits::Classify<T> for T} 1375 */ 1376 /** 1377 A monomorphic instance of libcrux_secrets.int.public_integers.classify_27 1378 with types int16_t[16size_t] 1379 1380 */ 1381 static KRML_MUSTINLINE void libcrux_secrets_int_public_integers_classify_27_46( 1382 int16_t self[16U], int16_t ret[16U]) { 1383 memcpy(ret, self, (size_t)16U * sizeof(int16_t)); 1384 } 1385 1386 /** 1387 This function found in impl {libcrux_secrets::traits::ClassifyRef<&'a 1388 (@Slice<T>)> for &'a (@Slice<T>)} 1389 */ 1390 /** 1391 A monomorphic instance of libcrux_secrets.int.classify_public.classify_ref_9b 1392 with types uint8_t 1393 1394 */ 1395 static KRML_MUSTINLINE Eurydice_slice 1396 libcrux_secrets_int_classify_public_classify_ref_9b_90(Eurydice_slice self) { 1397 return self; 1398 } 1399 1400 /** 1401 This function found in impl {libcrux_secrets::traits::ClassifyRef<&'a 1402 (@Slice<T>)> for &'a (@Slice<T>)} 1403 */ 1404 /** 1405 A monomorphic instance of libcrux_secrets.int.classify_public.classify_ref_9b 1406 with types int16_t 1407 1408 */ 1409 static KRML_MUSTINLINE Eurydice_slice 1410 libcrux_secrets_int_classify_public_classify_ref_9b_39(Eurydice_slice self) { 1411 return self; 1412 } 1413 1414 /** 1415 A monomorphic instance of core.result.Result 1416 with types int16_t[16size_t], core_array_TryFromSliceError 1417 1418 */ 1419 typedef struct Result_0a_s { 1420 Result_b2_tags tag; 1421 union { 1422 int16_t case_Ok[16U]; 1423 TryFromSliceError case_Err; 1424 } val; 1425 } Result_0a; 1426 1427 /** 1428 This function found in impl {core::result::Result<T, E>[TraitClause@0, 1429 TraitClause@1]} 1430 */ 1431 /** 1432 A monomorphic instance of core.result.unwrap_26 1433 with types int16_t[16size_t], core_array_TryFromSliceError 1434 1435 */ 1436 static inline void unwrap_26_00(Result_0a self, int16_t ret[16U]) { 1437 if (self.tag == Ok) { 1438 int16_t f0[16U]; 1439 memcpy(f0, self.val.case_Ok, (size_t)16U * sizeof(int16_t)); 1440 memcpy(ret, f0, (size_t)16U * sizeof(int16_t)); 1441 } else { 1442 KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, 1443 "unwrap not Ok"); 1444 KRML_HOST_EXIT(255U); 1445 } 1446 } 1447 1448 /** 1449 A monomorphic instance of core.result.Result 1450 with types uint8_t[8size_t], core_array_TryFromSliceError 1451 1452 */ 1453 typedef struct Result_15_s { 1454 Result_b2_tags tag; 1455 union { 1456 uint8_t case_Ok[8U]; 1457 TryFromSliceError case_Err; 1458 } val; 1459 } Result_15; 1460 1461 /** 1462 This function found in impl {core::result::Result<T, E>[TraitClause@0, 1463 TraitClause@1]} 1464 */ 1465 /** 1466 A monomorphic instance of core.result.unwrap_26 1467 with types uint8_t[8size_t], core_array_TryFromSliceError 1468 1469 */ 1470 static inline void unwrap_26_68(Result_15 self, uint8_t ret[8U]) { 1471 if (self.tag == Ok) { 1472 uint8_t f0[8U]; 1473 memcpy(f0, self.val.case_Ok, (size_t)8U * sizeof(uint8_t)); 1474 memcpy(ret, f0, (size_t)8U * sizeof(uint8_t)); 1475 } else { 1476 KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, 1477 "unwrap not Ok"); 1478 KRML_HOST_EXIT(255U); 1479 } 1480 } 1481 1482 #if defined(__cplusplus) 1483 } 1484 #endif 1485 1486 #define libcrux_mlkem_core_H_DEFINED 1487 #endif /* libcrux_mlkem_core_H */ 1488 1489 /* from libcrux/libcrux-ml-kem/extracts/c_header_only/generated/libcrux_ct_ops.h */ 1490 /* 1491 * SPDX-FileCopyrightText: 2025 Cryspen Sarl <info (at) cryspen.com> 1492 * 1493 * SPDX-License-Identifier: MIT or Apache-2.0 1494 * 1495 * This code was generated with the following revisions: 1496 * Charon: 667d2fc98984ff7f3df989c2367e6c1fa4a000e7 1497 * Eurydice: 2381cbc416ef2ad0b561c362c500bc84f36b6785 1498 * Karamel: 80f5435f2fc505973c469a4afcc8d875cddd0d8b 1499 * F*: 71d8221589d4d438af3706d89cb653cf53e18aab 1500 * Libcrux: 68dfed5a4a9e40277f62828471c029afed1ecdcc 1501 */ 1502 1503 #ifndef libcrux_ct_ops_H 1504 #define libcrux_ct_ops_H 1505 1506 1507 #if defined(__cplusplus) 1508 extern "C" { 1509 #endif 1510 1511 1512 /** 1513 Return 1 if `value` is not zero and 0 otherwise. 1514 */ 1515 static KRML_NOINLINE uint8_t 1516 libcrux_ml_kem_constant_time_ops_inz(uint8_t value) { 1517 uint16_t value0 = (uint16_t)value; 1518 uint8_t result = 1519 (uint8_t)((uint32_t)core_num__u16__wrapping_add(~value0, 1U) >> 8U); 1520 return (uint32_t)result & 1U; 1521 } 1522 1523 static KRML_NOINLINE uint8_t 1524 libcrux_ml_kem_constant_time_ops_is_non_zero(uint8_t value) { 1525 return libcrux_ml_kem_constant_time_ops_inz(value); 1526 } 1527 1528 /** 1529 Return 1 if the bytes of `lhs` and `rhs` do not exactly 1530 match and 0 otherwise. 1531 */ 1532 static KRML_NOINLINE uint8_t libcrux_ml_kem_constant_time_ops_compare( 1533 Eurydice_slice lhs, Eurydice_slice rhs) { 1534 uint8_t r = 0U; 1535 for (size_t i = (size_t)0U; i < Eurydice_slice_len(lhs, uint8_t); i++) { 1536 size_t i0 = i; 1537 uint8_t nr = (uint32_t)r | 1538 ((uint32_t)Eurydice_slice_index(lhs, i0, uint8_t, uint8_t *) ^ 1539 (uint32_t)Eurydice_slice_index(rhs, i0, uint8_t, uint8_t *)); 1540 r = nr; 1541 } 1542 return libcrux_ml_kem_constant_time_ops_is_non_zero(r); 1543 } 1544 1545 static KRML_NOINLINE uint8_t 1546 libcrux_ml_kem_constant_time_ops_compare_ciphertexts_in_constant_time( 1547 Eurydice_slice lhs, Eurydice_slice rhs) { 1548 return libcrux_ml_kem_constant_time_ops_compare(lhs, rhs); 1549 } 1550 1551 /** 1552 If `selector` is not zero, return the bytes in `rhs`; return the bytes in 1553 `lhs` otherwise. 1554 */ 1555 static KRML_NOINLINE void libcrux_ml_kem_constant_time_ops_select_ct( 1556 Eurydice_slice lhs, Eurydice_slice rhs, uint8_t selector, 1557 uint8_t ret[32U]) { 1558 uint8_t mask = core_num__u8__wrapping_sub( 1559 libcrux_ml_kem_constant_time_ops_is_non_zero(selector), 1U); 1560 uint8_t out[32U] = {0U}; 1561 for (size_t i = (size_t)0U; i < LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE; 1562 i++) { 1563 size_t i0 = i; 1564 uint8_t outi = 1565 ((uint32_t)Eurydice_slice_index(lhs, i0, uint8_t, uint8_t *) & 1566 (uint32_t)mask) | 1567 ((uint32_t)Eurydice_slice_index(rhs, i0, uint8_t, uint8_t *) & 1568 (uint32_t)~mask); 1569 out[i0] = outi; 1570 } 1571 memcpy(ret, out, (size_t)32U * sizeof(uint8_t)); 1572 } 1573 1574 static KRML_NOINLINE void 1575 libcrux_ml_kem_constant_time_ops_select_shared_secret_in_constant_time( 1576 Eurydice_slice lhs, Eurydice_slice rhs, uint8_t selector, 1577 uint8_t ret[32U]) { 1578 libcrux_ml_kem_constant_time_ops_select_ct(lhs, rhs, selector, ret); 1579 } 1580 1581 static KRML_NOINLINE void 1582 libcrux_ml_kem_constant_time_ops_compare_ciphertexts_select_shared_secret_in_constant_time( 1583 Eurydice_slice lhs_c, Eurydice_slice rhs_c, Eurydice_slice lhs_s, 1584 Eurydice_slice rhs_s, uint8_t ret[32U]) { 1585 uint8_t selector = 1586 libcrux_ml_kem_constant_time_ops_compare_ciphertexts_in_constant_time( 1587 lhs_c, rhs_c); 1588 uint8_t ret0[32U]; 1589 libcrux_ml_kem_constant_time_ops_select_shared_secret_in_constant_time( 1590 lhs_s, rhs_s, selector, ret0); 1591 memcpy(ret, ret0, (size_t)32U * sizeof(uint8_t)); 1592 } 1593 1594 #if defined(__cplusplus) 1595 } 1596 #endif 1597 1598 #define libcrux_ct_ops_H_DEFINED 1599 #endif /* libcrux_ct_ops_H */ 1600 1601 /* from libcrux/libcrux-ml-kem/extracts/c_header_only/generated/libcrux_sha3_portable.h */ 1602 /* 1603 * SPDX-FileCopyrightText: 2025 Cryspen Sarl <info (at) cryspen.com> 1604 * 1605 * SPDX-License-Identifier: MIT or Apache-2.0 1606 * 1607 * This code was generated with the following revisions: 1608 * Charon: 667d2fc98984ff7f3df989c2367e6c1fa4a000e7 1609 * Eurydice: 2381cbc416ef2ad0b561c362c500bc84f36b6785 1610 * Karamel: 80f5435f2fc505973c469a4afcc8d875cddd0d8b 1611 * F*: 71d8221589d4d438af3706d89cb653cf53e18aab 1612 * Libcrux: 68dfed5a4a9e40277f62828471c029afed1ecdcc 1613 */ 1614 1615 #ifndef libcrux_sha3_portable_H 1616 #define libcrux_sha3_portable_H 1617 1618 1619 #if defined(__cplusplus) 1620 extern "C" { 1621 #endif 1622 1623 1624 /** 1625 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 1626 */ 1627 static KRML_MUSTINLINE uint64_t libcrux_sha3_simd_portable_zero_d2(void) { 1628 return 0ULL; 1629 } 1630 1631 static KRML_MUSTINLINE uint64_t libcrux_sha3_simd_portable__veor5q_u64( 1632 uint64_t a, uint64_t b, uint64_t c, uint64_t d, uint64_t e) { 1633 return (((a ^ b) ^ c) ^ d) ^ e; 1634 } 1635 1636 /** 1637 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 1638 */ 1639 static KRML_MUSTINLINE uint64_t libcrux_sha3_simd_portable_xor5_d2( 1640 uint64_t a, uint64_t b, uint64_t c, uint64_t d, uint64_t e) { 1641 return libcrux_sha3_simd_portable__veor5q_u64(a, b, c, d, e); 1642 } 1643 1644 /** 1645 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 1646 with const generics 1647 - LEFT= 1 1648 - RIGHT= 63 1649 */ 1650 static KRML_MUSTINLINE uint64_t 1651 libcrux_sha3_simd_portable_rotate_left_76(uint64_t x) { 1652 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)1); 1653 } 1654 1655 static KRML_MUSTINLINE uint64_t 1656 libcrux_sha3_simd_portable__vrax1q_u64(uint64_t a, uint64_t b) { 1657 uint64_t uu____0 = a; 1658 return uu____0 ^ libcrux_sha3_simd_portable_rotate_left_76(b); 1659 } 1660 1661 /** 1662 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 1663 */ 1664 static KRML_MUSTINLINE uint64_t 1665 libcrux_sha3_simd_portable_rotate_left1_and_xor_d2(uint64_t a, uint64_t b) { 1666 return libcrux_sha3_simd_portable__vrax1q_u64(a, b); 1667 } 1668 1669 static KRML_MUSTINLINE uint64_t 1670 libcrux_sha3_simd_portable__vbcaxq_u64(uint64_t a, uint64_t b, uint64_t c) { 1671 return a ^ (b & ~c); 1672 } 1673 1674 /** 1675 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 1676 */ 1677 static KRML_MUSTINLINE uint64_t 1678 libcrux_sha3_simd_portable_and_not_xor_d2(uint64_t a, uint64_t b, uint64_t c) { 1679 return libcrux_sha3_simd_portable__vbcaxq_u64(a, b, c); 1680 } 1681 1682 static KRML_MUSTINLINE uint64_t 1683 libcrux_sha3_simd_portable__veorq_n_u64(uint64_t a, uint64_t c) { 1684 return a ^ c; 1685 } 1686 1687 /** 1688 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 1689 */ 1690 static KRML_MUSTINLINE uint64_t 1691 libcrux_sha3_simd_portable_xor_constant_d2(uint64_t a, uint64_t c) { 1692 return libcrux_sha3_simd_portable__veorq_n_u64(a, c); 1693 } 1694 1695 /** 1696 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 1697 */ 1698 static KRML_MUSTINLINE uint64_t libcrux_sha3_simd_portable_xor_d2(uint64_t a, 1699 uint64_t b) { 1700 return a ^ b; 1701 } 1702 1703 static const uint64_t 1704 libcrux_sha3_generic_keccak_constants_ROUNDCONSTANTS[24U] = { 1705 1ULL, 1706 32898ULL, 1707 9223372036854808714ULL, 1708 9223372039002292224ULL, 1709 32907ULL, 1710 2147483649ULL, 1711 9223372039002292353ULL, 1712 9223372036854808585ULL, 1713 138ULL, 1714 136ULL, 1715 2147516425ULL, 1716 2147483658ULL, 1717 2147516555ULL, 1718 9223372036854775947ULL, 1719 9223372036854808713ULL, 1720 9223372036854808579ULL, 1721 9223372036854808578ULL, 1722 9223372036854775936ULL, 1723 32778ULL, 1724 9223372039002259466ULL, 1725 9223372039002292353ULL, 1726 9223372036854808704ULL, 1727 2147483649ULL, 1728 9223372039002292232ULL}; 1729 1730 typedef struct size_t_x2_s { 1731 size_t fst; 1732 size_t snd; 1733 } size_t_x2; 1734 1735 /** 1736 A monomorphic instance of libcrux_sha3.generic_keccak.KeccakState 1737 with types uint64_t 1738 with const generics 1739 - $1size_t 1740 */ 1741 typedef struct libcrux_sha3_generic_keccak_KeccakState_17_s { 1742 uint64_t st[25U]; 1743 } libcrux_sha3_generic_keccak_KeccakState_17; 1744 1745 /** 1746 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 1747 N>[TraitClause@0, TraitClause@1]} 1748 */ 1749 /** 1750 A monomorphic instance of libcrux_sha3.generic_keccak.new_80 1751 with types uint64_t 1752 with const generics 1753 - N= 1 1754 */ 1755 static KRML_MUSTINLINE libcrux_sha3_generic_keccak_KeccakState_17 1756 libcrux_sha3_generic_keccak_new_80_04(void) { 1757 libcrux_sha3_generic_keccak_KeccakState_17 lit; 1758 uint64_t repeat_expression[25U]; 1759 for (size_t i = (size_t)0U; i < (size_t)25U; i++) { 1760 repeat_expression[i] = libcrux_sha3_simd_portable_zero_d2(); 1761 } 1762 memcpy(lit.st, repeat_expression, (size_t)25U * sizeof(uint64_t)); 1763 return lit; 1764 } 1765 1766 /** 1767 A monomorphic instance of libcrux_sha3.traits.get_ij 1768 with types uint64_t 1769 with const generics 1770 - N= 1 1771 */ 1772 static KRML_MUSTINLINE uint64_t *libcrux_sha3_traits_get_ij_04(uint64_t *arr, 1773 size_t i, 1774 size_t j) { 1775 return &arr[(size_t)5U * j + i]; 1776 } 1777 1778 /** 1779 A monomorphic instance of libcrux_sha3.traits.set_ij 1780 with types uint64_t 1781 with const generics 1782 - N= 1 1783 */ 1784 static KRML_MUSTINLINE void libcrux_sha3_traits_set_ij_04(uint64_t *arr, 1785 size_t i, size_t j, 1786 uint64_t value) { 1787 arr[(size_t)5U * j + i] = value; 1788 } 1789 1790 /** 1791 A monomorphic instance of libcrux_sha3.simd.portable.load_block 1792 with const generics 1793 - RATE= 72 1794 */ 1795 static KRML_MUSTINLINE void libcrux_sha3_simd_portable_load_block_f8( 1796 uint64_t *state, Eurydice_slice blocks, size_t start) { 1797 uint64_t state_flat[25U] = {0U}; 1798 for (size_t i = (size_t)0U; i < (size_t)72U / (size_t)8U; i++) { 1799 size_t i0 = i; 1800 size_t offset = start + (size_t)8U * i0; 1801 uint8_t uu____0[8U]; 1802 Result_15 dst; 1803 Eurydice_slice_to_array2( 1804 &dst, 1805 Eurydice_slice_subslice3(blocks, offset, offset + (size_t)8U, 1806 uint8_t *), 1807 Eurydice_slice, uint8_t[8U], TryFromSliceError); 1808 unwrap_26_68(dst, uu____0); 1809 state_flat[i0] = core_num__u64__from_le_bytes(uu____0); 1810 } 1811 for (size_t i = (size_t)0U; i < (size_t)72U / (size_t)8U; i++) { 1812 size_t i0 = i; 1813 libcrux_sha3_traits_set_ij_04( 1814 state, i0 / (size_t)5U, i0 % (size_t)5U, 1815 libcrux_sha3_traits_get_ij_04(state, i0 / (size_t)5U, 1816 i0 % (size_t)5U)[0U] ^ 1817 state_flat[i0]); 1818 } 1819 } 1820 1821 /** 1822 This function found in impl {libcrux_sha3::traits::Absorb<1usize> for 1823 libcrux_sha3::generic_keccak::KeccakState<u64, 1usize>[core::marker::Sized<u64>, 1824 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 1825 u64}]} 1826 */ 1827 /** 1828 A monomorphic instance of libcrux_sha3.simd.portable.load_block_a1 1829 with const generics 1830 - RATE= 72 1831 */ 1832 static inline void libcrux_sha3_simd_portable_load_block_a1_f8( 1833 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *input, 1834 size_t start) { 1835 libcrux_sha3_simd_portable_load_block_f8(self->st, input[0U], start); 1836 } 1837 1838 /** 1839 This function found in impl {core::ops::index::Index<(usize, usize), T> for 1840 libcrux_sha3::generic_keccak::KeccakState<T, N>[TraitClause@0, TraitClause@1]} 1841 */ 1842 /** 1843 A monomorphic instance of libcrux_sha3.generic_keccak.index_c2 1844 with types uint64_t 1845 with const generics 1846 - N= 1 1847 */ 1848 static inline uint64_t *libcrux_sha3_generic_keccak_index_c2_04( 1849 libcrux_sha3_generic_keccak_KeccakState_17 *self, size_t_x2 index) { 1850 return libcrux_sha3_traits_get_ij_04(self->st, index.fst, index.snd); 1851 } 1852 1853 /** 1854 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 1855 N>[TraitClause@0, TraitClause@1]} 1856 */ 1857 /** 1858 A monomorphic instance of libcrux_sha3.generic_keccak.theta_80 1859 with types uint64_t 1860 with const generics 1861 - N= 1 1862 */ 1863 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_theta_80_04( 1864 libcrux_sha3_generic_keccak_KeccakState_17 *self, uint64_t ret[5U]) { 1865 uint64_t c[5U] = { 1866 libcrux_sha3_simd_portable_xor5_d2( 1867 libcrux_sha3_generic_keccak_index_c2_04( 1868 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)0U, 1869 .snd = (size_t)0U}))[0U], 1870 libcrux_sha3_generic_keccak_index_c2_04( 1871 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)1U, 1872 .snd = (size_t)0U}))[0U], 1873 libcrux_sha3_generic_keccak_index_c2_04( 1874 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)2U, 1875 .snd = (size_t)0U}))[0U], 1876 libcrux_sha3_generic_keccak_index_c2_04( 1877 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)3U, 1878 .snd = (size_t)0U}))[0U], 1879 libcrux_sha3_generic_keccak_index_c2_04( 1880 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)4U, 1881 .snd = (size_t)0U}))[0U]), 1882 libcrux_sha3_simd_portable_xor5_d2( 1883 libcrux_sha3_generic_keccak_index_c2_04( 1884 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)0U, 1885 .snd = (size_t)1U}))[0U], 1886 libcrux_sha3_generic_keccak_index_c2_04( 1887 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)1U, 1888 .snd = (size_t)1U}))[0U], 1889 libcrux_sha3_generic_keccak_index_c2_04( 1890 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)2U, 1891 .snd = (size_t)1U}))[0U], 1892 libcrux_sha3_generic_keccak_index_c2_04( 1893 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)3U, 1894 .snd = (size_t)1U}))[0U], 1895 libcrux_sha3_generic_keccak_index_c2_04( 1896 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)4U, 1897 .snd = (size_t)1U}))[0U]), 1898 libcrux_sha3_simd_portable_xor5_d2( 1899 libcrux_sha3_generic_keccak_index_c2_04( 1900 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)0U, 1901 .snd = (size_t)2U}))[0U], 1902 libcrux_sha3_generic_keccak_index_c2_04( 1903 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)1U, 1904 .snd = (size_t)2U}))[0U], 1905 libcrux_sha3_generic_keccak_index_c2_04( 1906 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)2U, 1907 .snd = (size_t)2U}))[0U], 1908 libcrux_sha3_generic_keccak_index_c2_04( 1909 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)3U, 1910 .snd = (size_t)2U}))[0U], 1911 libcrux_sha3_generic_keccak_index_c2_04( 1912 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)4U, 1913 .snd = (size_t)2U}))[0U]), 1914 libcrux_sha3_simd_portable_xor5_d2( 1915 libcrux_sha3_generic_keccak_index_c2_04( 1916 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)0U, 1917 .snd = (size_t)3U}))[0U], 1918 libcrux_sha3_generic_keccak_index_c2_04( 1919 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)1U, 1920 .snd = (size_t)3U}))[0U], 1921 libcrux_sha3_generic_keccak_index_c2_04( 1922 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)2U, 1923 .snd = (size_t)3U}))[0U], 1924 libcrux_sha3_generic_keccak_index_c2_04( 1925 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)3U, 1926 .snd = (size_t)3U}))[0U], 1927 libcrux_sha3_generic_keccak_index_c2_04( 1928 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)4U, 1929 .snd = (size_t)3U}))[0U]), 1930 libcrux_sha3_simd_portable_xor5_d2( 1931 libcrux_sha3_generic_keccak_index_c2_04( 1932 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)0U, 1933 .snd = (size_t)4U}))[0U], 1934 libcrux_sha3_generic_keccak_index_c2_04( 1935 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)1U, 1936 .snd = (size_t)4U}))[0U], 1937 libcrux_sha3_generic_keccak_index_c2_04( 1938 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)2U, 1939 .snd = (size_t)4U}))[0U], 1940 libcrux_sha3_generic_keccak_index_c2_04( 1941 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)3U, 1942 .snd = (size_t)4U}))[0U], 1943 libcrux_sha3_generic_keccak_index_c2_04( 1944 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)4U, 1945 .snd = (size_t)4U}))[0U])}; 1946 uint64_t uu____0 = libcrux_sha3_simd_portable_rotate_left1_and_xor_d2( 1947 c[((size_t)0U + (size_t)4U) % (size_t)5U], 1948 c[((size_t)0U + (size_t)1U) % (size_t)5U]); 1949 uint64_t uu____1 = libcrux_sha3_simd_portable_rotate_left1_and_xor_d2( 1950 c[((size_t)1U + (size_t)4U) % (size_t)5U], 1951 c[((size_t)1U + (size_t)1U) % (size_t)5U]); 1952 uint64_t uu____2 = libcrux_sha3_simd_portable_rotate_left1_and_xor_d2( 1953 c[((size_t)2U + (size_t)4U) % (size_t)5U], 1954 c[((size_t)2U + (size_t)1U) % (size_t)5U]); 1955 uint64_t uu____3 = libcrux_sha3_simd_portable_rotate_left1_and_xor_d2( 1956 c[((size_t)3U + (size_t)4U) % (size_t)5U], 1957 c[((size_t)3U + (size_t)1U) % (size_t)5U]); 1958 ret[0U] = uu____0; 1959 ret[1U] = uu____1; 1960 ret[2U] = uu____2; 1961 ret[3U] = uu____3; 1962 ret[4U] = libcrux_sha3_simd_portable_rotate_left1_and_xor_d2( 1963 c[((size_t)4U + (size_t)4U) % (size_t)5U], 1964 c[((size_t)4U + (size_t)1U) % (size_t)5U]); 1965 } 1966 1967 /** 1968 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 1969 N>[TraitClause@0, TraitClause@1]} 1970 */ 1971 /** 1972 A monomorphic instance of libcrux_sha3.generic_keccak.set_80 1973 with types uint64_t 1974 with const generics 1975 - N= 1 1976 */ 1977 static inline void libcrux_sha3_generic_keccak_set_80_04( 1978 libcrux_sha3_generic_keccak_KeccakState_17 *self, size_t i, size_t j, 1979 uint64_t v) { 1980 libcrux_sha3_traits_set_ij_04(self->st, i, j, v); 1981 } 1982 1983 /** 1984 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 1985 with const generics 1986 - LEFT= 36 1987 - RIGHT= 28 1988 */ 1989 static KRML_MUSTINLINE uint64_t 1990 libcrux_sha3_simd_portable_rotate_left_02(uint64_t x) { 1991 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)36); 1992 } 1993 1994 /** 1995 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 1996 with const generics 1997 - LEFT= 36 1998 - RIGHT= 28 1999 */ 2000 static KRML_MUSTINLINE uint64_t 2001 libcrux_sha3_simd_portable__vxarq_u64_02(uint64_t a, uint64_t b) { 2002 return libcrux_sha3_simd_portable_rotate_left_02(a ^ b); 2003 } 2004 2005 /** 2006 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2007 */ 2008 /** 2009 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2010 with const generics 2011 - LEFT= 36 2012 - RIGHT= 28 2013 */ 2014 static KRML_MUSTINLINE uint64_t 2015 libcrux_sha3_simd_portable_xor_and_rotate_d2_02(uint64_t a, uint64_t b) { 2016 return libcrux_sha3_simd_portable__vxarq_u64_02(a, b); 2017 } 2018 2019 /** 2020 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2021 with const generics 2022 - LEFT= 3 2023 - RIGHT= 61 2024 */ 2025 static KRML_MUSTINLINE uint64_t 2026 libcrux_sha3_simd_portable_rotate_left_ac(uint64_t x) { 2027 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)3); 2028 } 2029 2030 /** 2031 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2032 with const generics 2033 - LEFT= 3 2034 - RIGHT= 61 2035 */ 2036 static KRML_MUSTINLINE uint64_t 2037 libcrux_sha3_simd_portable__vxarq_u64_ac(uint64_t a, uint64_t b) { 2038 return libcrux_sha3_simd_portable_rotate_left_ac(a ^ b); 2039 } 2040 2041 /** 2042 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2043 */ 2044 /** 2045 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2046 with const generics 2047 - LEFT= 3 2048 - RIGHT= 61 2049 */ 2050 static KRML_MUSTINLINE uint64_t 2051 libcrux_sha3_simd_portable_xor_and_rotate_d2_ac(uint64_t a, uint64_t b) { 2052 return libcrux_sha3_simd_portable__vxarq_u64_ac(a, b); 2053 } 2054 2055 /** 2056 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2057 with const generics 2058 - LEFT= 41 2059 - RIGHT= 23 2060 */ 2061 static KRML_MUSTINLINE uint64_t 2062 libcrux_sha3_simd_portable_rotate_left_020(uint64_t x) { 2063 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)41); 2064 } 2065 2066 /** 2067 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2068 with const generics 2069 - LEFT= 41 2070 - RIGHT= 23 2071 */ 2072 static KRML_MUSTINLINE uint64_t 2073 libcrux_sha3_simd_portable__vxarq_u64_020(uint64_t a, uint64_t b) { 2074 return libcrux_sha3_simd_portable_rotate_left_020(a ^ b); 2075 } 2076 2077 /** 2078 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2079 */ 2080 /** 2081 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2082 with const generics 2083 - LEFT= 41 2084 - RIGHT= 23 2085 */ 2086 static KRML_MUSTINLINE uint64_t 2087 libcrux_sha3_simd_portable_xor_and_rotate_d2_020(uint64_t a, uint64_t b) { 2088 return libcrux_sha3_simd_portable__vxarq_u64_020(a, b); 2089 } 2090 2091 /** 2092 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2093 with const generics 2094 - LEFT= 18 2095 - RIGHT= 46 2096 */ 2097 static KRML_MUSTINLINE uint64_t 2098 libcrux_sha3_simd_portable_rotate_left_a9(uint64_t x) { 2099 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)18); 2100 } 2101 2102 /** 2103 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2104 with const generics 2105 - LEFT= 18 2106 - RIGHT= 46 2107 */ 2108 static KRML_MUSTINLINE uint64_t 2109 libcrux_sha3_simd_portable__vxarq_u64_a9(uint64_t a, uint64_t b) { 2110 return libcrux_sha3_simd_portable_rotate_left_a9(a ^ b); 2111 } 2112 2113 /** 2114 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2115 */ 2116 /** 2117 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2118 with const generics 2119 - LEFT= 18 2120 - RIGHT= 46 2121 */ 2122 static KRML_MUSTINLINE uint64_t 2123 libcrux_sha3_simd_portable_xor_and_rotate_d2_a9(uint64_t a, uint64_t b) { 2124 return libcrux_sha3_simd_portable__vxarq_u64_a9(a, b); 2125 } 2126 2127 /** 2128 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2129 with const generics 2130 - LEFT= 1 2131 - RIGHT= 63 2132 */ 2133 static KRML_MUSTINLINE uint64_t 2134 libcrux_sha3_simd_portable__vxarq_u64_76(uint64_t a, uint64_t b) { 2135 return libcrux_sha3_simd_portable_rotate_left_76(a ^ b); 2136 } 2137 2138 /** 2139 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2140 */ 2141 /** 2142 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2143 with const generics 2144 - LEFT= 1 2145 - RIGHT= 63 2146 */ 2147 static KRML_MUSTINLINE uint64_t 2148 libcrux_sha3_simd_portable_xor_and_rotate_d2_76(uint64_t a, uint64_t b) { 2149 return libcrux_sha3_simd_portable__vxarq_u64_76(a, b); 2150 } 2151 2152 /** 2153 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2154 with const generics 2155 - LEFT= 44 2156 - RIGHT= 20 2157 */ 2158 static KRML_MUSTINLINE uint64_t 2159 libcrux_sha3_simd_portable_rotate_left_58(uint64_t x) { 2160 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)44); 2161 } 2162 2163 /** 2164 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2165 with const generics 2166 - LEFT= 44 2167 - RIGHT= 20 2168 */ 2169 static KRML_MUSTINLINE uint64_t 2170 libcrux_sha3_simd_portable__vxarq_u64_58(uint64_t a, uint64_t b) { 2171 return libcrux_sha3_simd_portable_rotate_left_58(a ^ b); 2172 } 2173 2174 /** 2175 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2176 */ 2177 /** 2178 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2179 with const generics 2180 - LEFT= 44 2181 - RIGHT= 20 2182 */ 2183 static KRML_MUSTINLINE uint64_t 2184 libcrux_sha3_simd_portable_xor_and_rotate_d2_58(uint64_t a, uint64_t b) { 2185 return libcrux_sha3_simd_portable__vxarq_u64_58(a, b); 2186 } 2187 2188 /** 2189 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2190 with const generics 2191 - LEFT= 10 2192 - RIGHT= 54 2193 */ 2194 static KRML_MUSTINLINE uint64_t 2195 libcrux_sha3_simd_portable_rotate_left_e0(uint64_t x) { 2196 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)10); 2197 } 2198 2199 /** 2200 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2201 with const generics 2202 - LEFT= 10 2203 - RIGHT= 54 2204 */ 2205 static KRML_MUSTINLINE uint64_t 2206 libcrux_sha3_simd_portable__vxarq_u64_e0(uint64_t a, uint64_t b) { 2207 return libcrux_sha3_simd_portable_rotate_left_e0(a ^ b); 2208 } 2209 2210 /** 2211 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2212 */ 2213 /** 2214 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2215 with const generics 2216 - LEFT= 10 2217 - RIGHT= 54 2218 */ 2219 static KRML_MUSTINLINE uint64_t 2220 libcrux_sha3_simd_portable_xor_and_rotate_d2_e0(uint64_t a, uint64_t b) { 2221 return libcrux_sha3_simd_portable__vxarq_u64_e0(a, b); 2222 } 2223 2224 /** 2225 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2226 with const generics 2227 - LEFT= 45 2228 - RIGHT= 19 2229 */ 2230 static KRML_MUSTINLINE uint64_t 2231 libcrux_sha3_simd_portable_rotate_left_63(uint64_t x) { 2232 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)45); 2233 } 2234 2235 /** 2236 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2237 with const generics 2238 - LEFT= 45 2239 - RIGHT= 19 2240 */ 2241 static KRML_MUSTINLINE uint64_t 2242 libcrux_sha3_simd_portable__vxarq_u64_63(uint64_t a, uint64_t b) { 2243 return libcrux_sha3_simd_portable_rotate_left_63(a ^ b); 2244 } 2245 2246 /** 2247 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2248 */ 2249 /** 2250 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2251 with const generics 2252 - LEFT= 45 2253 - RIGHT= 19 2254 */ 2255 static KRML_MUSTINLINE uint64_t 2256 libcrux_sha3_simd_portable_xor_and_rotate_d2_63(uint64_t a, uint64_t b) { 2257 return libcrux_sha3_simd_portable__vxarq_u64_63(a, b); 2258 } 2259 2260 /** 2261 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2262 with const generics 2263 - LEFT= 2 2264 - RIGHT= 62 2265 */ 2266 static KRML_MUSTINLINE uint64_t 2267 libcrux_sha3_simd_portable_rotate_left_6a(uint64_t x) { 2268 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)2); 2269 } 2270 2271 /** 2272 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2273 with const generics 2274 - LEFT= 2 2275 - RIGHT= 62 2276 */ 2277 static KRML_MUSTINLINE uint64_t 2278 libcrux_sha3_simd_portable__vxarq_u64_6a(uint64_t a, uint64_t b) { 2279 return libcrux_sha3_simd_portable_rotate_left_6a(a ^ b); 2280 } 2281 2282 /** 2283 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2284 */ 2285 /** 2286 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2287 with const generics 2288 - LEFT= 2 2289 - RIGHT= 62 2290 */ 2291 static KRML_MUSTINLINE uint64_t 2292 libcrux_sha3_simd_portable_xor_and_rotate_d2_6a(uint64_t a, uint64_t b) { 2293 return libcrux_sha3_simd_portable__vxarq_u64_6a(a, b); 2294 } 2295 2296 /** 2297 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2298 with const generics 2299 - LEFT= 62 2300 - RIGHT= 2 2301 */ 2302 static KRML_MUSTINLINE uint64_t 2303 libcrux_sha3_simd_portable_rotate_left_ab(uint64_t x) { 2304 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)62); 2305 } 2306 2307 /** 2308 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2309 with const generics 2310 - LEFT= 62 2311 - RIGHT= 2 2312 */ 2313 static KRML_MUSTINLINE uint64_t 2314 libcrux_sha3_simd_portable__vxarq_u64_ab(uint64_t a, uint64_t b) { 2315 return libcrux_sha3_simd_portable_rotate_left_ab(a ^ b); 2316 } 2317 2318 /** 2319 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2320 */ 2321 /** 2322 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2323 with const generics 2324 - LEFT= 62 2325 - RIGHT= 2 2326 */ 2327 static KRML_MUSTINLINE uint64_t 2328 libcrux_sha3_simd_portable_xor_and_rotate_d2_ab(uint64_t a, uint64_t b) { 2329 return libcrux_sha3_simd_portable__vxarq_u64_ab(a, b); 2330 } 2331 2332 /** 2333 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2334 with const generics 2335 - LEFT= 6 2336 - RIGHT= 58 2337 */ 2338 static KRML_MUSTINLINE uint64_t 2339 libcrux_sha3_simd_portable_rotate_left_5b(uint64_t x) { 2340 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)6); 2341 } 2342 2343 /** 2344 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2345 with const generics 2346 - LEFT= 6 2347 - RIGHT= 58 2348 */ 2349 static KRML_MUSTINLINE uint64_t 2350 libcrux_sha3_simd_portable__vxarq_u64_5b(uint64_t a, uint64_t b) { 2351 return libcrux_sha3_simd_portable_rotate_left_5b(a ^ b); 2352 } 2353 2354 /** 2355 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2356 */ 2357 /** 2358 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2359 with const generics 2360 - LEFT= 6 2361 - RIGHT= 58 2362 */ 2363 static KRML_MUSTINLINE uint64_t 2364 libcrux_sha3_simd_portable_xor_and_rotate_d2_5b(uint64_t a, uint64_t b) { 2365 return libcrux_sha3_simd_portable__vxarq_u64_5b(a, b); 2366 } 2367 2368 /** 2369 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2370 with const generics 2371 - LEFT= 43 2372 - RIGHT= 21 2373 */ 2374 static KRML_MUSTINLINE uint64_t 2375 libcrux_sha3_simd_portable_rotate_left_6f(uint64_t x) { 2376 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)43); 2377 } 2378 2379 /** 2380 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2381 with const generics 2382 - LEFT= 43 2383 - RIGHT= 21 2384 */ 2385 static KRML_MUSTINLINE uint64_t 2386 libcrux_sha3_simd_portable__vxarq_u64_6f(uint64_t a, uint64_t b) { 2387 return libcrux_sha3_simd_portable_rotate_left_6f(a ^ b); 2388 } 2389 2390 /** 2391 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2392 */ 2393 /** 2394 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2395 with const generics 2396 - LEFT= 43 2397 - RIGHT= 21 2398 */ 2399 static KRML_MUSTINLINE uint64_t 2400 libcrux_sha3_simd_portable_xor_and_rotate_d2_6f(uint64_t a, uint64_t b) { 2401 return libcrux_sha3_simd_portable__vxarq_u64_6f(a, b); 2402 } 2403 2404 /** 2405 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2406 with const generics 2407 - LEFT= 15 2408 - RIGHT= 49 2409 */ 2410 static KRML_MUSTINLINE uint64_t 2411 libcrux_sha3_simd_portable_rotate_left_62(uint64_t x) { 2412 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)15); 2413 } 2414 2415 /** 2416 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2417 with const generics 2418 - LEFT= 15 2419 - RIGHT= 49 2420 */ 2421 static KRML_MUSTINLINE uint64_t 2422 libcrux_sha3_simd_portable__vxarq_u64_62(uint64_t a, uint64_t b) { 2423 return libcrux_sha3_simd_portable_rotate_left_62(a ^ b); 2424 } 2425 2426 /** 2427 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2428 */ 2429 /** 2430 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2431 with const generics 2432 - LEFT= 15 2433 - RIGHT= 49 2434 */ 2435 static KRML_MUSTINLINE uint64_t 2436 libcrux_sha3_simd_portable_xor_and_rotate_d2_62(uint64_t a, uint64_t b) { 2437 return libcrux_sha3_simd_portable__vxarq_u64_62(a, b); 2438 } 2439 2440 /** 2441 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2442 with const generics 2443 - LEFT= 61 2444 - RIGHT= 3 2445 */ 2446 static KRML_MUSTINLINE uint64_t 2447 libcrux_sha3_simd_portable_rotate_left_23(uint64_t x) { 2448 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)61); 2449 } 2450 2451 /** 2452 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2453 with const generics 2454 - LEFT= 61 2455 - RIGHT= 3 2456 */ 2457 static KRML_MUSTINLINE uint64_t 2458 libcrux_sha3_simd_portable__vxarq_u64_23(uint64_t a, uint64_t b) { 2459 return libcrux_sha3_simd_portable_rotate_left_23(a ^ b); 2460 } 2461 2462 /** 2463 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2464 */ 2465 /** 2466 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2467 with const generics 2468 - LEFT= 61 2469 - RIGHT= 3 2470 */ 2471 static KRML_MUSTINLINE uint64_t 2472 libcrux_sha3_simd_portable_xor_and_rotate_d2_23(uint64_t a, uint64_t b) { 2473 return libcrux_sha3_simd_portable__vxarq_u64_23(a, b); 2474 } 2475 2476 /** 2477 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2478 with const generics 2479 - LEFT= 28 2480 - RIGHT= 36 2481 */ 2482 static KRML_MUSTINLINE uint64_t 2483 libcrux_sha3_simd_portable_rotate_left_37(uint64_t x) { 2484 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)28); 2485 } 2486 2487 /** 2488 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2489 with const generics 2490 - LEFT= 28 2491 - RIGHT= 36 2492 */ 2493 static KRML_MUSTINLINE uint64_t 2494 libcrux_sha3_simd_portable__vxarq_u64_37(uint64_t a, uint64_t b) { 2495 return libcrux_sha3_simd_portable_rotate_left_37(a ^ b); 2496 } 2497 2498 /** 2499 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2500 */ 2501 /** 2502 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2503 with const generics 2504 - LEFT= 28 2505 - RIGHT= 36 2506 */ 2507 static KRML_MUSTINLINE uint64_t 2508 libcrux_sha3_simd_portable_xor_and_rotate_d2_37(uint64_t a, uint64_t b) { 2509 return libcrux_sha3_simd_portable__vxarq_u64_37(a, b); 2510 } 2511 2512 /** 2513 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2514 with const generics 2515 - LEFT= 55 2516 - RIGHT= 9 2517 */ 2518 static KRML_MUSTINLINE uint64_t 2519 libcrux_sha3_simd_portable_rotate_left_bb(uint64_t x) { 2520 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)55); 2521 } 2522 2523 /** 2524 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2525 with const generics 2526 - LEFT= 55 2527 - RIGHT= 9 2528 */ 2529 static KRML_MUSTINLINE uint64_t 2530 libcrux_sha3_simd_portable__vxarq_u64_bb(uint64_t a, uint64_t b) { 2531 return libcrux_sha3_simd_portable_rotate_left_bb(a ^ b); 2532 } 2533 2534 /** 2535 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2536 */ 2537 /** 2538 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2539 with const generics 2540 - LEFT= 55 2541 - RIGHT= 9 2542 */ 2543 static KRML_MUSTINLINE uint64_t 2544 libcrux_sha3_simd_portable_xor_and_rotate_d2_bb(uint64_t a, uint64_t b) { 2545 return libcrux_sha3_simd_portable__vxarq_u64_bb(a, b); 2546 } 2547 2548 /** 2549 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2550 with const generics 2551 - LEFT= 25 2552 - RIGHT= 39 2553 */ 2554 static KRML_MUSTINLINE uint64_t 2555 libcrux_sha3_simd_portable_rotate_left_b9(uint64_t x) { 2556 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)25); 2557 } 2558 2559 /** 2560 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2561 with const generics 2562 - LEFT= 25 2563 - RIGHT= 39 2564 */ 2565 static KRML_MUSTINLINE uint64_t 2566 libcrux_sha3_simd_portable__vxarq_u64_b9(uint64_t a, uint64_t b) { 2567 return libcrux_sha3_simd_portable_rotate_left_b9(a ^ b); 2568 } 2569 2570 /** 2571 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2572 */ 2573 /** 2574 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2575 with const generics 2576 - LEFT= 25 2577 - RIGHT= 39 2578 */ 2579 static KRML_MUSTINLINE uint64_t 2580 libcrux_sha3_simd_portable_xor_and_rotate_d2_b9(uint64_t a, uint64_t b) { 2581 return libcrux_sha3_simd_portable__vxarq_u64_b9(a, b); 2582 } 2583 2584 /** 2585 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2586 with const generics 2587 - LEFT= 21 2588 - RIGHT= 43 2589 */ 2590 static KRML_MUSTINLINE uint64_t 2591 libcrux_sha3_simd_portable_rotate_left_54(uint64_t x) { 2592 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)21); 2593 } 2594 2595 /** 2596 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2597 with const generics 2598 - LEFT= 21 2599 - RIGHT= 43 2600 */ 2601 static KRML_MUSTINLINE uint64_t 2602 libcrux_sha3_simd_portable__vxarq_u64_54(uint64_t a, uint64_t b) { 2603 return libcrux_sha3_simd_portable_rotate_left_54(a ^ b); 2604 } 2605 2606 /** 2607 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2608 */ 2609 /** 2610 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2611 with const generics 2612 - LEFT= 21 2613 - RIGHT= 43 2614 */ 2615 static KRML_MUSTINLINE uint64_t 2616 libcrux_sha3_simd_portable_xor_and_rotate_d2_54(uint64_t a, uint64_t b) { 2617 return libcrux_sha3_simd_portable__vxarq_u64_54(a, b); 2618 } 2619 2620 /** 2621 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2622 with const generics 2623 - LEFT= 56 2624 - RIGHT= 8 2625 */ 2626 static KRML_MUSTINLINE uint64_t 2627 libcrux_sha3_simd_portable_rotate_left_4c(uint64_t x) { 2628 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)56); 2629 } 2630 2631 /** 2632 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2633 with const generics 2634 - LEFT= 56 2635 - RIGHT= 8 2636 */ 2637 static KRML_MUSTINLINE uint64_t 2638 libcrux_sha3_simd_portable__vxarq_u64_4c(uint64_t a, uint64_t b) { 2639 return libcrux_sha3_simd_portable_rotate_left_4c(a ^ b); 2640 } 2641 2642 /** 2643 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2644 */ 2645 /** 2646 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2647 with const generics 2648 - LEFT= 56 2649 - RIGHT= 8 2650 */ 2651 static KRML_MUSTINLINE uint64_t 2652 libcrux_sha3_simd_portable_xor_and_rotate_d2_4c(uint64_t a, uint64_t b) { 2653 return libcrux_sha3_simd_portable__vxarq_u64_4c(a, b); 2654 } 2655 2656 /** 2657 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2658 with const generics 2659 - LEFT= 27 2660 - RIGHT= 37 2661 */ 2662 static KRML_MUSTINLINE uint64_t 2663 libcrux_sha3_simd_portable_rotate_left_ce(uint64_t x) { 2664 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)27); 2665 } 2666 2667 /** 2668 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2669 with const generics 2670 - LEFT= 27 2671 - RIGHT= 37 2672 */ 2673 static KRML_MUSTINLINE uint64_t 2674 libcrux_sha3_simd_portable__vxarq_u64_ce(uint64_t a, uint64_t b) { 2675 return libcrux_sha3_simd_portable_rotate_left_ce(a ^ b); 2676 } 2677 2678 /** 2679 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2680 */ 2681 /** 2682 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2683 with const generics 2684 - LEFT= 27 2685 - RIGHT= 37 2686 */ 2687 static KRML_MUSTINLINE uint64_t 2688 libcrux_sha3_simd_portable_xor_and_rotate_d2_ce(uint64_t a, uint64_t b) { 2689 return libcrux_sha3_simd_portable__vxarq_u64_ce(a, b); 2690 } 2691 2692 /** 2693 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2694 with const generics 2695 - LEFT= 20 2696 - RIGHT= 44 2697 */ 2698 static KRML_MUSTINLINE uint64_t 2699 libcrux_sha3_simd_portable_rotate_left_77(uint64_t x) { 2700 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)20); 2701 } 2702 2703 /** 2704 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2705 with const generics 2706 - LEFT= 20 2707 - RIGHT= 44 2708 */ 2709 static KRML_MUSTINLINE uint64_t 2710 libcrux_sha3_simd_portable__vxarq_u64_77(uint64_t a, uint64_t b) { 2711 return libcrux_sha3_simd_portable_rotate_left_77(a ^ b); 2712 } 2713 2714 /** 2715 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2716 */ 2717 /** 2718 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2719 with const generics 2720 - LEFT= 20 2721 - RIGHT= 44 2722 */ 2723 static KRML_MUSTINLINE uint64_t 2724 libcrux_sha3_simd_portable_xor_and_rotate_d2_77(uint64_t a, uint64_t b) { 2725 return libcrux_sha3_simd_portable__vxarq_u64_77(a, b); 2726 } 2727 2728 /** 2729 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2730 with const generics 2731 - LEFT= 39 2732 - RIGHT= 25 2733 */ 2734 static KRML_MUSTINLINE uint64_t 2735 libcrux_sha3_simd_portable_rotate_left_25(uint64_t x) { 2736 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)39); 2737 } 2738 2739 /** 2740 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2741 with const generics 2742 - LEFT= 39 2743 - RIGHT= 25 2744 */ 2745 static KRML_MUSTINLINE uint64_t 2746 libcrux_sha3_simd_portable__vxarq_u64_25(uint64_t a, uint64_t b) { 2747 return libcrux_sha3_simd_portable_rotate_left_25(a ^ b); 2748 } 2749 2750 /** 2751 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2752 */ 2753 /** 2754 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2755 with const generics 2756 - LEFT= 39 2757 - RIGHT= 25 2758 */ 2759 static KRML_MUSTINLINE uint64_t 2760 libcrux_sha3_simd_portable_xor_and_rotate_d2_25(uint64_t a, uint64_t b) { 2761 return libcrux_sha3_simd_portable__vxarq_u64_25(a, b); 2762 } 2763 2764 /** 2765 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2766 with const generics 2767 - LEFT= 8 2768 - RIGHT= 56 2769 */ 2770 static KRML_MUSTINLINE uint64_t 2771 libcrux_sha3_simd_portable_rotate_left_af(uint64_t x) { 2772 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)8); 2773 } 2774 2775 /** 2776 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2777 with const generics 2778 - LEFT= 8 2779 - RIGHT= 56 2780 */ 2781 static KRML_MUSTINLINE uint64_t 2782 libcrux_sha3_simd_portable__vxarq_u64_af(uint64_t a, uint64_t b) { 2783 return libcrux_sha3_simd_portable_rotate_left_af(a ^ b); 2784 } 2785 2786 /** 2787 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2788 */ 2789 /** 2790 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2791 with const generics 2792 - LEFT= 8 2793 - RIGHT= 56 2794 */ 2795 static KRML_MUSTINLINE uint64_t 2796 libcrux_sha3_simd_portable_xor_and_rotate_d2_af(uint64_t a, uint64_t b) { 2797 return libcrux_sha3_simd_portable__vxarq_u64_af(a, b); 2798 } 2799 2800 /** 2801 A monomorphic instance of libcrux_sha3.simd.portable.rotate_left 2802 with const generics 2803 - LEFT= 14 2804 - RIGHT= 50 2805 */ 2806 static KRML_MUSTINLINE uint64_t 2807 libcrux_sha3_simd_portable_rotate_left_fd(uint64_t x) { 2808 return core_num__u64__rotate_left(x, (uint32_t)(int32_t)14); 2809 } 2810 2811 /** 2812 A monomorphic instance of libcrux_sha3.simd.portable._vxarq_u64 2813 with const generics 2814 - LEFT= 14 2815 - RIGHT= 50 2816 */ 2817 static KRML_MUSTINLINE uint64_t 2818 libcrux_sha3_simd_portable__vxarq_u64_fd(uint64_t a, uint64_t b) { 2819 return libcrux_sha3_simd_portable_rotate_left_fd(a ^ b); 2820 } 2821 2822 /** 2823 This function found in impl {libcrux_sha3::traits::KeccakItem<1usize> for u64} 2824 */ 2825 /** 2826 A monomorphic instance of libcrux_sha3.simd.portable.xor_and_rotate_d2 2827 with const generics 2828 - LEFT= 14 2829 - RIGHT= 50 2830 */ 2831 static KRML_MUSTINLINE uint64_t 2832 libcrux_sha3_simd_portable_xor_and_rotate_d2_fd(uint64_t a, uint64_t b) { 2833 return libcrux_sha3_simd_portable__vxarq_u64_fd(a, b); 2834 } 2835 2836 /** 2837 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 2838 N>[TraitClause@0, TraitClause@1]} 2839 */ 2840 /** 2841 A monomorphic instance of libcrux_sha3.generic_keccak.rho_80 2842 with types uint64_t 2843 with const generics 2844 - N= 1 2845 */ 2846 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_rho_80_04( 2847 libcrux_sha3_generic_keccak_KeccakState_17 *self, uint64_t t[5U]) { 2848 libcrux_sha3_generic_keccak_set_80_04( 2849 self, (size_t)0U, (size_t)0U, 2850 libcrux_sha3_simd_portable_xor_d2( 2851 libcrux_sha3_generic_keccak_index_c2_04( 2852 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)0U, 2853 .snd = (size_t)0U}))[0U], 2854 t[0U])); 2855 libcrux_sha3_generic_keccak_KeccakState_17 *uu____0 = self; 2856 libcrux_sha3_generic_keccak_set_80_04( 2857 uu____0, (size_t)1U, (size_t)0U, 2858 libcrux_sha3_simd_portable_xor_and_rotate_d2_02( 2859 libcrux_sha3_generic_keccak_index_c2_04( 2860 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)1U, 2861 .snd = (size_t)0U}))[0U], 2862 t[0U])); 2863 libcrux_sha3_generic_keccak_KeccakState_17 *uu____1 = self; 2864 libcrux_sha3_generic_keccak_set_80_04( 2865 uu____1, (size_t)2U, (size_t)0U, 2866 libcrux_sha3_simd_portable_xor_and_rotate_d2_ac( 2867 libcrux_sha3_generic_keccak_index_c2_04( 2868 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)2U, 2869 .snd = (size_t)0U}))[0U], 2870 t[0U])); 2871 libcrux_sha3_generic_keccak_KeccakState_17 *uu____2 = self; 2872 libcrux_sha3_generic_keccak_set_80_04( 2873 uu____2, (size_t)3U, (size_t)0U, 2874 libcrux_sha3_simd_portable_xor_and_rotate_d2_020( 2875 libcrux_sha3_generic_keccak_index_c2_04( 2876 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)3U, 2877 .snd = (size_t)0U}))[0U], 2878 t[0U])); 2879 libcrux_sha3_generic_keccak_KeccakState_17 *uu____3 = self; 2880 libcrux_sha3_generic_keccak_set_80_04( 2881 uu____3, (size_t)4U, (size_t)0U, 2882 libcrux_sha3_simd_portable_xor_and_rotate_d2_a9( 2883 libcrux_sha3_generic_keccak_index_c2_04( 2884 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)4U, 2885 .snd = (size_t)0U}))[0U], 2886 t[0U])); 2887 libcrux_sha3_generic_keccak_KeccakState_17 *uu____4 = self; 2888 libcrux_sha3_generic_keccak_set_80_04( 2889 uu____4, (size_t)0U, (size_t)1U, 2890 libcrux_sha3_simd_portable_xor_and_rotate_d2_76( 2891 libcrux_sha3_generic_keccak_index_c2_04( 2892 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)0U, 2893 .snd = (size_t)1U}))[0U], 2894 t[1U])); 2895 libcrux_sha3_generic_keccak_KeccakState_17 *uu____5 = self; 2896 libcrux_sha3_generic_keccak_set_80_04( 2897 uu____5, (size_t)1U, (size_t)1U, 2898 libcrux_sha3_simd_portable_xor_and_rotate_d2_58( 2899 libcrux_sha3_generic_keccak_index_c2_04( 2900 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)1U, 2901 .snd = (size_t)1U}))[0U], 2902 t[1U])); 2903 libcrux_sha3_generic_keccak_KeccakState_17 *uu____6 = self; 2904 libcrux_sha3_generic_keccak_set_80_04( 2905 uu____6, (size_t)2U, (size_t)1U, 2906 libcrux_sha3_simd_portable_xor_and_rotate_d2_e0( 2907 libcrux_sha3_generic_keccak_index_c2_04( 2908 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)2U, 2909 .snd = (size_t)1U}))[0U], 2910 t[1U])); 2911 libcrux_sha3_generic_keccak_KeccakState_17 *uu____7 = self; 2912 libcrux_sha3_generic_keccak_set_80_04( 2913 uu____7, (size_t)3U, (size_t)1U, 2914 libcrux_sha3_simd_portable_xor_and_rotate_d2_63( 2915 libcrux_sha3_generic_keccak_index_c2_04( 2916 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)3U, 2917 .snd = (size_t)1U}))[0U], 2918 t[1U])); 2919 libcrux_sha3_generic_keccak_KeccakState_17 *uu____8 = self; 2920 libcrux_sha3_generic_keccak_set_80_04( 2921 uu____8, (size_t)4U, (size_t)1U, 2922 libcrux_sha3_simd_portable_xor_and_rotate_d2_6a( 2923 libcrux_sha3_generic_keccak_index_c2_04( 2924 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)4U, 2925 .snd = (size_t)1U}))[0U], 2926 t[1U])); 2927 libcrux_sha3_generic_keccak_KeccakState_17 *uu____9 = self; 2928 libcrux_sha3_generic_keccak_set_80_04( 2929 uu____9, (size_t)0U, (size_t)2U, 2930 libcrux_sha3_simd_portable_xor_and_rotate_d2_ab( 2931 libcrux_sha3_generic_keccak_index_c2_04( 2932 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)0U, 2933 .snd = (size_t)2U}))[0U], 2934 t[2U])); 2935 libcrux_sha3_generic_keccak_KeccakState_17 *uu____10 = self; 2936 libcrux_sha3_generic_keccak_set_80_04( 2937 uu____10, (size_t)1U, (size_t)2U, 2938 libcrux_sha3_simd_portable_xor_and_rotate_d2_5b( 2939 libcrux_sha3_generic_keccak_index_c2_04( 2940 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)1U, 2941 .snd = (size_t)2U}))[0U], 2942 t[2U])); 2943 libcrux_sha3_generic_keccak_KeccakState_17 *uu____11 = self; 2944 libcrux_sha3_generic_keccak_set_80_04( 2945 uu____11, (size_t)2U, (size_t)2U, 2946 libcrux_sha3_simd_portable_xor_and_rotate_d2_6f( 2947 libcrux_sha3_generic_keccak_index_c2_04( 2948 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)2U, 2949 .snd = (size_t)2U}))[0U], 2950 t[2U])); 2951 libcrux_sha3_generic_keccak_KeccakState_17 *uu____12 = self; 2952 libcrux_sha3_generic_keccak_set_80_04( 2953 uu____12, (size_t)3U, (size_t)2U, 2954 libcrux_sha3_simd_portable_xor_and_rotate_d2_62( 2955 libcrux_sha3_generic_keccak_index_c2_04( 2956 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)3U, 2957 .snd = (size_t)2U}))[0U], 2958 t[2U])); 2959 libcrux_sha3_generic_keccak_KeccakState_17 *uu____13 = self; 2960 libcrux_sha3_generic_keccak_set_80_04( 2961 uu____13, (size_t)4U, (size_t)2U, 2962 libcrux_sha3_simd_portable_xor_and_rotate_d2_23( 2963 libcrux_sha3_generic_keccak_index_c2_04( 2964 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)4U, 2965 .snd = (size_t)2U}))[0U], 2966 t[2U])); 2967 libcrux_sha3_generic_keccak_KeccakState_17 *uu____14 = self; 2968 libcrux_sha3_generic_keccak_set_80_04( 2969 uu____14, (size_t)0U, (size_t)3U, 2970 libcrux_sha3_simd_portable_xor_and_rotate_d2_37( 2971 libcrux_sha3_generic_keccak_index_c2_04( 2972 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)0U, 2973 .snd = (size_t)3U}))[0U], 2974 t[3U])); 2975 libcrux_sha3_generic_keccak_KeccakState_17 *uu____15 = self; 2976 libcrux_sha3_generic_keccak_set_80_04( 2977 uu____15, (size_t)1U, (size_t)3U, 2978 libcrux_sha3_simd_portable_xor_and_rotate_d2_bb( 2979 libcrux_sha3_generic_keccak_index_c2_04( 2980 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)1U, 2981 .snd = (size_t)3U}))[0U], 2982 t[3U])); 2983 libcrux_sha3_generic_keccak_KeccakState_17 *uu____16 = self; 2984 libcrux_sha3_generic_keccak_set_80_04( 2985 uu____16, (size_t)2U, (size_t)3U, 2986 libcrux_sha3_simd_portable_xor_and_rotate_d2_b9( 2987 libcrux_sha3_generic_keccak_index_c2_04( 2988 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)2U, 2989 .snd = (size_t)3U}))[0U], 2990 t[3U])); 2991 libcrux_sha3_generic_keccak_KeccakState_17 *uu____17 = self; 2992 libcrux_sha3_generic_keccak_set_80_04( 2993 uu____17, (size_t)3U, (size_t)3U, 2994 libcrux_sha3_simd_portable_xor_and_rotate_d2_54( 2995 libcrux_sha3_generic_keccak_index_c2_04( 2996 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)3U, 2997 .snd = (size_t)3U}))[0U], 2998 t[3U])); 2999 libcrux_sha3_generic_keccak_KeccakState_17 *uu____18 = self; 3000 libcrux_sha3_generic_keccak_set_80_04( 3001 uu____18, (size_t)4U, (size_t)3U, 3002 libcrux_sha3_simd_portable_xor_and_rotate_d2_4c( 3003 libcrux_sha3_generic_keccak_index_c2_04( 3004 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)4U, 3005 .snd = (size_t)3U}))[0U], 3006 t[3U])); 3007 libcrux_sha3_generic_keccak_KeccakState_17 *uu____19 = self; 3008 libcrux_sha3_generic_keccak_set_80_04( 3009 uu____19, (size_t)0U, (size_t)4U, 3010 libcrux_sha3_simd_portable_xor_and_rotate_d2_ce( 3011 libcrux_sha3_generic_keccak_index_c2_04( 3012 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)0U, 3013 .snd = (size_t)4U}))[0U], 3014 t[4U])); 3015 libcrux_sha3_generic_keccak_KeccakState_17 *uu____20 = self; 3016 libcrux_sha3_generic_keccak_set_80_04( 3017 uu____20, (size_t)1U, (size_t)4U, 3018 libcrux_sha3_simd_portable_xor_and_rotate_d2_77( 3019 libcrux_sha3_generic_keccak_index_c2_04( 3020 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)1U, 3021 .snd = (size_t)4U}))[0U], 3022 t[4U])); 3023 libcrux_sha3_generic_keccak_KeccakState_17 *uu____21 = self; 3024 libcrux_sha3_generic_keccak_set_80_04( 3025 uu____21, (size_t)2U, (size_t)4U, 3026 libcrux_sha3_simd_portable_xor_and_rotate_d2_25( 3027 libcrux_sha3_generic_keccak_index_c2_04( 3028 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)2U, 3029 .snd = (size_t)4U}))[0U], 3030 t[4U])); 3031 libcrux_sha3_generic_keccak_KeccakState_17 *uu____22 = self; 3032 libcrux_sha3_generic_keccak_set_80_04( 3033 uu____22, (size_t)3U, (size_t)4U, 3034 libcrux_sha3_simd_portable_xor_and_rotate_d2_af( 3035 libcrux_sha3_generic_keccak_index_c2_04( 3036 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)3U, 3037 .snd = (size_t)4U}))[0U], 3038 t[4U])); 3039 libcrux_sha3_generic_keccak_KeccakState_17 *uu____23 = self; 3040 libcrux_sha3_generic_keccak_set_80_04( 3041 uu____23, (size_t)4U, (size_t)4U, 3042 libcrux_sha3_simd_portable_xor_and_rotate_d2_fd( 3043 libcrux_sha3_generic_keccak_index_c2_04( 3044 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)4U, 3045 .snd = (size_t)4U}))[0U], 3046 t[4U])); 3047 } 3048 3049 /** 3050 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 3051 N>[TraitClause@0, TraitClause@1]} 3052 */ 3053 /** 3054 A monomorphic instance of libcrux_sha3.generic_keccak.pi_80 3055 with types uint64_t 3056 with const generics 3057 - N= 1 3058 */ 3059 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_pi_80_04( 3060 libcrux_sha3_generic_keccak_KeccakState_17 *self) { 3061 libcrux_sha3_generic_keccak_KeccakState_17 old = self[0U]; 3062 libcrux_sha3_generic_keccak_set_80_04( 3063 self, (size_t)1U, (size_t)0U, 3064 libcrux_sha3_generic_keccak_index_c2_04( 3065 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)0U, 3066 .snd = (size_t)3U}))[0U]); 3067 libcrux_sha3_generic_keccak_set_80_04( 3068 self, (size_t)2U, (size_t)0U, 3069 libcrux_sha3_generic_keccak_index_c2_04( 3070 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)0U, 3071 .snd = (size_t)1U}))[0U]); 3072 libcrux_sha3_generic_keccak_set_80_04( 3073 self, (size_t)3U, (size_t)0U, 3074 libcrux_sha3_generic_keccak_index_c2_04( 3075 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)0U, 3076 .snd = (size_t)4U}))[0U]); 3077 libcrux_sha3_generic_keccak_set_80_04( 3078 self, (size_t)4U, (size_t)0U, 3079 libcrux_sha3_generic_keccak_index_c2_04( 3080 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)0U, 3081 .snd = (size_t)2U}))[0U]); 3082 libcrux_sha3_generic_keccak_set_80_04( 3083 self, (size_t)0U, (size_t)1U, 3084 libcrux_sha3_generic_keccak_index_c2_04( 3085 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)1U, 3086 .snd = (size_t)1U}))[0U]); 3087 libcrux_sha3_generic_keccak_set_80_04( 3088 self, (size_t)1U, (size_t)1U, 3089 libcrux_sha3_generic_keccak_index_c2_04( 3090 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)1U, 3091 .snd = (size_t)4U}))[0U]); 3092 libcrux_sha3_generic_keccak_set_80_04( 3093 self, (size_t)2U, (size_t)1U, 3094 libcrux_sha3_generic_keccak_index_c2_04( 3095 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)1U, 3096 .snd = (size_t)2U}))[0U]); 3097 libcrux_sha3_generic_keccak_set_80_04( 3098 self, (size_t)3U, (size_t)1U, 3099 libcrux_sha3_generic_keccak_index_c2_04( 3100 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)1U, 3101 .snd = (size_t)0U}))[0U]); 3102 libcrux_sha3_generic_keccak_set_80_04( 3103 self, (size_t)4U, (size_t)1U, 3104 libcrux_sha3_generic_keccak_index_c2_04( 3105 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)1U, 3106 .snd = (size_t)3U}))[0U]); 3107 libcrux_sha3_generic_keccak_set_80_04( 3108 self, (size_t)0U, (size_t)2U, 3109 libcrux_sha3_generic_keccak_index_c2_04( 3110 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)2U, 3111 .snd = (size_t)2U}))[0U]); 3112 libcrux_sha3_generic_keccak_set_80_04( 3113 self, (size_t)1U, (size_t)2U, 3114 libcrux_sha3_generic_keccak_index_c2_04( 3115 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)2U, 3116 .snd = (size_t)0U}))[0U]); 3117 libcrux_sha3_generic_keccak_set_80_04( 3118 self, (size_t)2U, (size_t)2U, 3119 libcrux_sha3_generic_keccak_index_c2_04( 3120 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)2U, 3121 .snd = (size_t)3U}))[0U]); 3122 libcrux_sha3_generic_keccak_set_80_04( 3123 self, (size_t)3U, (size_t)2U, 3124 libcrux_sha3_generic_keccak_index_c2_04( 3125 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)2U, 3126 .snd = (size_t)1U}))[0U]); 3127 libcrux_sha3_generic_keccak_set_80_04( 3128 self, (size_t)4U, (size_t)2U, 3129 libcrux_sha3_generic_keccak_index_c2_04( 3130 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)2U, 3131 .snd = (size_t)4U}))[0U]); 3132 libcrux_sha3_generic_keccak_set_80_04( 3133 self, (size_t)0U, (size_t)3U, 3134 libcrux_sha3_generic_keccak_index_c2_04( 3135 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)3U, 3136 .snd = (size_t)3U}))[0U]); 3137 libcrux_sha3_generic_keccak_set_80_04( 3138 self, (size_t)1U, (size_t)3U, 3139 libcrux_sha3_generic_keccak_index_c2_04( 3140 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)3U, 3141 .snd = (size_t)1U}))[0U]); 3142 libcrux_sha3_generic_keccak_set_80_04( 3143 self, (size_t)2U, (size_t)3U, 3144 libcrux_sha3_generic_keccak_index_c2_04( 3145 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)3U, 3146 .snd = (size_t)4U}))[0U]); 3147 libcrux_sha3_generic_keccak_set_80_04( 3148 self, (size_t)3U, (size_t)3U, 3149 libcrux_sha3_generic_keccak_index_c2_04( 3150 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)3U, 3151 .snd = (size_t)2U}))[0U]); 3152 libcrux_sha3_generic_keccak_set_80_04( 3153 self, (size_t)4U, (size_t)3U, 3154 libcrux_sha3_generic_keccak_index_c2_04( 3155 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)3U, 3156 .snd = (size_t)0U}))[0U]); 3157 libcrux_sha3_generic_keccak_set_80_04( 3158 self, (size_t)0U, (size_t)4U, 3159 libcrux_sha3_generic_keccak_index_c2_04( 3160 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)4U, 3161 .snd = (size_t)4U}))[0U]); 3162 libcrux_sha3_generic_keccak_set_80_04( 3163 self, (size_t)1U, (size_t)4U, 3164 libcrux_sha3_generic_keccak_index_c2_04( 3165 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)4U, 3166 .snd = (size_t)2U}))[0U]); 3167 libcrux_sha3_generic_keccak_set_80_04( 3168 self, (size_t)2U, (size_t)4U, 3169 libcrux_sha3_generic_keccak_index_c2_04( 3170 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)4U, 3171 .snd = (size_t)0U}))[0U]); 3172 libcrux_sha3_generic_keccak_set_80_04( 3173 self, (size_t)3U, (size_t)4U, 3174 libcrux_sha3_generic_keccak_index_c2_04( 3175 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)4U, 3176 .snd = (size_t)3U}))[0U]); 3177 libcrux_sha3_generic_keccak_set_80_04( 3178 self, (size_t)4U, (size_t)4U, 3179 libcrux_sha3_generic_keccak_index_c2_04( 3180 &old, (KRML_CLITERAL(size_t_x2){.fst = (size_t)4U, 3181 .snd = (size_t)1U}))[0U]); 3182 } 3183 3184 /** 3185 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 3186 N>[TraitClause@0, TraitClause@1]} 3187 */ 3188 /** 3189 A monomorphic instance of libcrux_sha3.generic_keccak.chi_80 3190 with types uint64_t 3191 with const generics 3192 - N= 1 3193 */ 3194 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_chi_80_04( 3195 libcrux_sha3_generic_keccak_KeccakState_17 *self) { 3196 libcrux_sha3_generic_keccak_KeccakState_17 old = self[0U]; 3197 for (size_t i0 = (size_t)0U; i0 < (size_t)5U; i0++) { 3198 size_t i1 = i0; 3199 for (size_t i = (size_t)0U; i < (size_t)5U; i++) { 3200 size_t j = i; 3201 libcrux_sha3_generic_keccak_set_80_04( 3202 self, i1, j, 3203 libcrux_sha3_simd_portable_and_not_xor_d2( 3204 libcrux_sha3_generic_keccak_index_c2_04( 3205 self, (KRML_CLITERAL(size_t_x2){.fst = i1, .snd = j}))[0U], 3206 libcrux_sha3_generic_keccak_index_c2_04( 3207 &old, 3208 (KRML_CLITERAL(size_t_x2){ 3209 .fst = i1, .snd = (j + (size_t)2U) % (size_t)5U}))[0U], 3210 libcrux_sha3_generic_keccak_index_c2_04( 3211 &old, 3212 (KRML_CLITERAL(size_t_x2){ 3213 .fst = i1, .snd = (j + (size_t)1U) % (size_t)5U}))[0U])); 3214 } 3215 } 3216 } 3217 3218 /** 3219 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 3220 N>[TraitClause@0, TraitClause@1]} 3221 */ 3222 /** 3223 A monomorphic instance of libcrux_sha3.generic_keccak.iota_80 3224 with types uint64_t 3225 with const generics 3226 - N= 1 3227 */ 3228 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_iota_80_04( 3229 libcrux_sha3_generic_keccak_KeccakState_17 *self, size_t i) { 3230 libcrux_sha3_generic_keccak_set_80_04( 3231 self, (size_t)0U, (size_t)0U, 3232 libcrux_sha3_simd_portable_xor_constant_d2( 3233 libcrux_sha3_generic_keccak_index_c2_04( 3234 self, (KRML_CLITERAL(size_t_x2){.fst = (size_t)0U, 3235 .snd = (size_t)0U}))[0U], 3236 libcrux_sha3_generic_keccak_constants_ROUNDCONSTANTS[i])); 3237 } 3238 3239 /** 3240 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 3241 N>[TraitClause@0, TraitClause@1]} 3242 */ 3243 /** 3244 A monomorphic instance of libcrux_sha3.generic_keccak.keccakf1600_80 3245 with types uint64_t 3246 with const generics 3247 - N= 1 3248 */ 3249 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_keccakf1600_80_04( 3250 libcrux_sha3_generic_keccak_KeccakState_17 *self) { 3251 for (size_t i = (size_t)0U; i < (size_t)24U; i++) { 3252 size_t i0 = i; 3253 uint64_t t[5U]; 3254 libcrux_sha3_generic_keccak_theta_80_04(self, t); 3255 libcrux_sha3_generic_keccak_KeccakState_17 *uu____0 = self; 3256 uint64_t uu____1[5U]; 3257 memcpy(uu____1, t, (size_t)5U * sizeof(uint64_t)); 3258 libcrux_sha3_generic_keccak_rho_80_04(uu____0, uu____1); 3259 libcrux_sha3_generic_keccak_pi_80_04(self); 3260 libcrux_sha3_generic_keccak_chi_80_04(self); 3261 libcrux_sha3_generic_keccak_iota_80_04(self, i0); 3262 } 3263 } 3264 3265 /** 3266 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 3267 N>[TraitClause@0, TraitClause@1]} 3268 */ 3269 /** 3270 A monomorphic instance of libcrux_sha3.generic_keccak.absorb_block_80 3271 with types uint64_t 3272 with const generics 3273 - N= 1 3274 - RATE= 72 3275 */ 3276 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_block_80_c6( 3277 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *blocks, 3278 size_t start) { 3279 libcrux_sha3_simd_portable_load_block_a1_f8(self, blocks, start); 3280 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 3281 } 3282 3283 /** 3284 A monomorphic instance of libcrux_sha3.simd.portable.load_last 3285 with const generics 3286 - RATE= 72 3287 - DELIMITER= 6 3288 */ 3289 static KRML_MUSTINLINE void libcrux_sha3_simd_portable_load_last_96( 3290 uint64_t *state, Eurydice_slice blocks, size_t start, size_t len) { 3291 uint8_t buffer[72U] = {0U}; 3292 Eurydice_slice_copy( 3293 Eurydice_array_to_subslice3(buffer, (size_t)0U, len, uint8_t *), 3294 Eurydice_slice_subslice3(blocks, start, start + len, uint8_t *), uint8_t); 3295 buffer[len] = 6U; 3296 size_t uu____0 = (size_t)72U - (size_t)1U; 3297 buffer[uu____0] = (uint32_t)buffer[uu____0] | 128U; 3298 libcrux_sha3_simd_portable_load_block_f8( 3299 state, Eurydice_array_to_slice((size_t)72U, buffer, uint8_t), (size_t)0U); 3300 } 3301 3302 /** 3303 This function found in impl {libcrux_sha3::traits::Absorb<1usize> for 3304 libcrux_sha3::generic_keccak::KeccakState<u64, 1usize>[core::marker::Sized<u64>, 3305 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 3306 u64}]} 3307 */ 3308 /** 3309 A monomorphic instance of libcrux_sha3.simd.portable.load_last_a1 3310 with const generics 3311 - RATE= 72 3312 - DELIMITER= 6 3313 */ 3314 static inline void libcrux_sha3_simd_portable_load_last_a1_96( 3315 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *input, 3316 size_t start, size_t len) { 3317 libcrux_sha3_simd_portable_load_last_96(self->st, input[0U], start, len); 3318 } 3319 3320 /** 3321 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 3322 N>[TraitClause@0, TraitClause@1]} 3323 */ 3324 /** 3325 A monomorphic instance of libcrux_sha3.generic_keccak.absorb_final_80 3326 with types uint64_t 3327 with const generics 3328 - N= 1 3329 - RATE= 72 3330 - DELIM= 6 3331 */ 3332 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_final_80_9e( 3333 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *last, 3334 size_t start, size_t len) { 3335 libcrux_sha3_simd_portable_load_last_a1_96(self, last, start, len); 3336 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 3337 } 3338 3339 /** 3340 A monomorphic instance of libcrux_sha3.simd.portable.store_block 3341 with const generics 3342 - RATE= 72 3343 */ 3344 static KRML_MUSTINLINE void libcrux_sha3_simd_portable_store_block_f8( 3345 uint64_t *s, Eurydice_slice out, size_t start, size_t len) { 3346 size_t octets = len / (size_t)8U; 3347 for (size_t i = (size_t)0U; i < octets; i++) { 3348 size_t i0 = i; 3349 Eurydice_slice uu____0 = Eurydice_slice_subslice3( 3350 out, start + (size_t)8U * i0, start + (size_t)8U * i0 + (size_t)8U, 3351 uint8_t *); 3352 uint8_t ret[8U]; 3353 core_num__u64__to_le_bytes( 3354 libcrux_sha3_traits_get_ij_04(s, i0 / (size_t)5U, i0 % (size_t)5U)[0U], 3355 ret); 3356 Eurydice_slice_copy( 3357 uu____0, Eurydice_array_to_slice((size_t)8U, ret, uint8_t), uint8_t); 3358 } 3359 size_t remaining = len % (size_t)8U; 3360 if (remaining > (size_t)0U) { 3361 Eurydice_slice uu____1 = Eurydice_slice_subslice3( 3362 out, start + len - remaining, start + len, uint8_t *); 3363 uint8_t ret[8U]; 3364 core_num__u64__to_le_bytes( 3365 libcrux_sha3_traits_get_ij_04(s, octets / (size_t)5U, 3366 octets % (size_t)5U)[0U], 3367 ret); 3368 Eurydice_slice_copy( 3369 uu____1, 3370 Eurydice_array_to_subslice3(ret, (size_t)0U, remaining, uint8_t *), 3371 uint8_t); 3372 } 3373 } 3374 3375 /** 3376 This function found in impl {libcrux_sha3::traits::Squeeze1<u64> for 3377 libcrux_sha3::generic_keccak::KeccakState<u64, 1usize>[core::marker::Sized<u64>, 3378 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 3379 u64}]} 3380 */ 3381 /** 3382 A monomorphic instance of libcrux_sha3.simd.portable.squeeze_13 3383 with const generics 3384 - RATE= 72 3385 */ 3386 static inline void libcrux_sha3_simd_portable_squeeze_13_f8( 3387 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice out, 3388 size_t start, size_t len) { 3389 libcrux_sha3_simd_portable_store_block_f8(self->st, out, start, len); 3390 } 3391 3392 /** 3393 A monomorphic instance of libcrux_sha3.generic_keccak.portable.keccak1 3394 with const generics 3395 - RATE= 72 3396 - DELIM= 6 3397 */ 3398 static inline void libcrux_sha3_generic_keccak_portable_keccak1_96( 3399 Eurydice_slice data, Eurydice_slice out) { 3400 libcrux_sha3_generic_keccak_KeccakState_17 s = 3401 libcrux_sha3_generic_keccak_new_80_04(); 3402 size_t data_len = Eurydice_slice_len(data, uint8_t); 3403 for (size_t i = (size_t)0U; i < data_len / (size_t)72U; i++) { 3404 size_t i0 = i; 3405 Eurydice_slice buf[1U] = {data}; 3406 libcrux_sha3_generic_keccak_absorb_block_80_c6(&s, buf, i0 * (size_t)72U); 3407 } 3408 size_t rem = data_len % (size_t)72U; 3409 Eurydice_slice buf[1U] = {data}; 3410 libcrux_sha3_generic_keccak_absorb_final_80_9e(&s, buf, data_len - rem, rem); 3411 size_t outlen = Eurydice_slice_len(out, uint8_t); 3412 size_t blocks = outlen / (size_t)72U; 3413 size_t last = outlen - outlen % (size_t)72U; 3414 if (blocks == (size_t)0U) { 3415 libcrux_sha3_simd_portable_squeeze_13_f8(&s, out, (size_t)0U, outlen); 3416 } else { 3417 libcrux_sha3_simd_portable_squeeze_13_f8(&s, out, (size_t)0U, (size_t)72U); 3418 for (size_t i = (size_t)1U; i < blocks; i++) { 3419 size_t i0 = i; 3420 libcrux_sha3_generic_keccak_keccakf1600_80_04(&s); 3421 libcrux_sha3_simd_portable_squeeze_13_f8(&s, out, i0 * (size_t)72U, 3422 (size_t)72U); 3423 } 3424 if (last < outlen) { 3425 libcrux_sha3_generic_keccak_keccakf1600_80_04(&s); 3426 libcrux_sha3_simd_portable_squeeze_13_f8(&s, out, last, outlen - last); 3427 } 3428 } 3429 } 3430 3431 /** 3432 A portable SHA3 512 implementation. 3433 */ 3434 static KRML_MUSTINLINE void libcrux_sha3_portable_sha512(Eurydice_slice digest, 3435 Eurydice_slice data) { 3436 libcrux_sha3_generic_keccak_portable_keccak1_96(data, digest); 3437 } 3438 3439 /** 3440 A monomorphic instance of libcrux_sha3.simd.portable.load_block 3441 with const generics 3442 - RATE= 136 3443 */ 3444 static KRML_MUSTINLINE void libcrux_sha3_simd_portable_load_block_5b( 3445 uint64_t *state, Eurydice_slice blocks, size_t start) { 3446 uint64_t state_flat[25U] = {0U}; 3447 for (size_t i = (size_t)0U; i < (size_t)136U / (size_t)8U; i++) { 3448 size_t i0 = i; 3449 size_t offset = start + (size_t)8U * i0; 3450 uint8_t uu____0[8U]; 3451 Result_15 dst; 3452 Eurydice_slice_to_array2( 3453 &dst, 3454 Eurydice_slice_subslice3(blocks, offset, offset + (size_t)8U, 3455 uint8_t *), 3456 Eurydice_slice, uint8_t[8U], TryFromSliceError); 3457 unwrap_26_68(dst, uu____0); 3458 state_flat[i0] = core_num__u64__from_le_bytes(uu____0); 3459 } 3460 for (size_t i = (size_t)0U; i < (size_t)136U / (size_t)8U; i++) { 3461 size_t i0 = i; 3462 libcrux_sha3_traits_set_ij_04( 3463 state, i0 / (size_t)5U, i0 % (size_t)5U, 3464 libcrux_sha3_traits_get_ij_04(state, i0 / (size_t)5U, 3465 i0 % (size_t)5U)[0U] ^ 3466 state_flat[i0]); 3467 } 3468 } 3469 3470 /** 3471 This function found in impl {libcrux_sha3::traits::Absorb<1usize> for 3472 libcrux_sha3::generic_keccak::KeccakState<u64, 1usize>[core::marker::Sized<u64>, 3473 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 3474 u64}]} 3475 */ 3476 /** 3477 A monomorphic instance of libcrux_sha3.simd.portable.load_block_a1 3478 with const generics 3479 - RATE= 136 3480 */ 3481 static inline void libcrux_sha3_simd_portable_load_block_a1_5b( 3482 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *input, 3483 size_t start) { 3484 libcrux_sha3_simd_portable_load_block_5b(self->st, input[0U], start); 3485 } 3486 3487 /** 3488 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 3489 N>[TraitClause@0, TraitClause@1]} 3490 */ 3491 /** 3492 A monomorphic instance of libcrux_sha3.generic_keccak.absorb_block_80 3493 with types uint64_t 3494 with const generics 3495 - N= 1 3496 - RATE= 136 3497 */ 3498 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_block_80_c60( 3499 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *blocks, 3500 size_t start) { 3501 libcrux_sha3_simd_portable_load_block_a1_5b(self, blocks, start); 3502 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 3503 } 3504 3505 /** 3506 A monomorphic instance of libcrux_sha3.simd.portable.load_last 3507 with const generics 3508 - RATE= 136 3509 - DELIMITER= 6 3510 */ 3511 static KRML_MUSTINLINE void libcrux_sha3_simd_portable_load_last_ad( 3512 uint64_t *state, Eurydice_slice blocks, size_t start, size_t len) { 3513 uint8_t buffer[136U] = {0U}; 3514 Eurydice_slice_copy( 3515 Eurydice_array_to_subslice3(buffer, (size_t)0U, len, uint8_t *), 3516 Eurydice_slice_subslice3(blocks, start, start + len, uint8_t *), uint8_t); 3517 buffer[len] = 6U; 3518 size_t uu____0 = (size_t)136U - (size_t)1U; 3519 buffer[uu____0] = (uint32_t)buffer[uu____0] | 128U; 3520 libcrux_sha3_simd_portable_load_block_5b( 3521 state, Eurydice_array_to_slice((size_t)136U, buffer, uint8_t), 3522 (size_t)0U); 3523 } 3524 3525 /** 3526 This function found in impl {libcrux_sha3::traits::Absorb<1usize> for 3527 libcrux_sha3::generic_keccak::KeccakState<u64, 1usize>[core::marker::Sized<u64>, 3528 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 3529 u64}]} 3530 */ 3531 /** 3532 A monomorphic instance of libcrux_sha3.simd.portable.load_last_a1 3533 with const generics 3534 - RATE= 136 3535 - DELIMITER= 6 3536 */ 3537 static inline void libcrux_sha3_simd_portable_load_last_a1_ad( 3538 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *input, 3539 size_t start, size_t len) { 3540 libcrux_sha3_simd_portable_load_last_ad(self->st, input[0U], start, len); 3541 } 3542 3543 /** 3544 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 3545 N>[TraitClause@0, TraitClause@1]} 3546 */ 3547 /** 3548 A monomorphic instance of libcrux_sha3.generic_keccak.absorb_final_80 3549 with types uint64_t 3550 with const generics 3551 - N= 1 3552 - RATE= 136 3553 - DELIM= 6 3554 */ 3555 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_final_80_9e0( 3556 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *last, 3557 size_t start, size_t len) { 3558 libcrux_sha3_simd_portable_load_last_a1_ad(self, last, start, len); 3559 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 3560 } 3561 3562 /** 3563 A monomorphic instance of libcrux_sha3.simd.portable.store_block 3564 with const generics 3565 - RATE= 136 3566 */ 3567 static KRML_MUSTINLINE void libcrux_sha3_simd_portable_store_block_5b( 3568 uint64_t *s, Eurydice_slice out, size_t start, size_t len) { 3569 size_t octets = len / (size_t)8U; 3570 for (size_t i = (size_t)0U; i < octets; i++) { 3571 size_t i0 = i; 3572 Eurydice_slice uu____0 = Eurydice_slice_subslice3( 3573 out, start + (size_t)8U * i0, start + (size_t)8U * i0 + (size_t)8U, 3574 uint8_t *); 3575 uint8_t ret[8U]; 3576 core_num__u64__to_le_bytes( 3577 libcrux_sha3_traits_get_ij_04(s, i0 / (size_t)5U, i0 % (size_t)5U)[0U], 3578 ret); 3579 Eurydice_slice_copy( 3580 uu____0, Eurydice_array_to_slice((size_t)8U, ret, uint8_t), uint8_t); 3581 } 3582 size_t remaining = len % (size_t)8U; 3583 if (remaining > (size_t)0U) { 3584 Eurydice_slice uu____1 = Eurydice_slice_subslice3( 3585 out, start + len - remaining, start + len, uint8_t *); 3586 uint8_t ret[8U]; 3587 core_num__u64__to_le_bytes( 3588 libcrux_sha3_traits_get_ij_04(s, octets / (size_t)5U, 3589 octets % (size_t)5U)[0U], 3590 ret); 3591 Eurydice_slice_copy( 3592 uu____1, 3593 Eurydice_array_to_subslice3(ret, (size_t)0U, remaining, uint8_t *), 3594 uint8_t); 3595 } 3596 } 3597 3598 /** 3599 This function found in impl {libcrux_sha3::traits::Squeeze1<u64> for 3600 libcrux_sha3::generic_keccak::KeccakState<u64, 1usize>[core::marker::Sized<u64>, 3601 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 3602 u64}]} 3603 */ 3604 /** 3605 A monomorphic instance of libcrux_sha3.simd.portable.squeeze_13 3606 with const generics 3607 - RATE= 136 3608 */ 3609 static inline void libcrux_sha3_simd_portable_squeeze_13_5b( 3610 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice out, 3611 size_t start, size_t len) { 3612 libcrux_sha3_simd_portable_store_block_5b(self->st, out, start, len); 3613 } 3614 3615 /** 3616 A monomorphic instance of libcrux_sha3.generic_keccak.portable.keccak1 3617 with const generics 3618 - RATE= 136 3619 - DELIM= 6 3620 */ 3621 static inline void libcrux_sha3_generic_keccak_portable_keccak1_ad( 3622 Eurydice_slice data, Eurydice_slice out) { 3623 libcrux_sha3_generic_keccak_KeccakState_17 s = 3624 libcrux_sha3_generic_keccak_new_80_04(); 3625 size_t data_len = Eurydice_slice_len(data, uint8_t); 3626 for (size_t i = (size_t)0U; i < data_len / (size_t)136U; i++) { 3627 size_t i0 = i; 3628 Eurydice_slice buf[1U] = {data}; 3629 libcrux_sha3_generic_keccak_absorb_block_80_c60(&s, buf, i0 * (size_t)136U); 3630 } 3631 size_t rem = data_len % (size_t)136U; 3632 Eurydice_slice buf[1U] = {data}; 3633 libcrux_sha3_generic_keccak_absorb_final_80_9e0(&s, buf, data_len - rem, rem); 3634 size_t outlen = Eurydice_slice_len(out, uint8_t); 3635 size_t blocks = outlen / (size_t)136U; 3636 size_t last = outlen - outlen % (size_t)136U; 3637 if (blocks == (size_t)0U) { 3638 libcrux_sha3_simd_portable_squeeze_13_5b(&s, out, (size_t)0U, outlen); 3639 } else { 3640 libcrux_sha3_simd_portable_squeeze_13_5b(&s, out, (size_t)0U, (size_t)136U); 3641 for (size_t i = (size_t)1U; i < blocks; i++) { 3642 size_t i0 = i; 3643 libcrux_sha3_generic_keccak_keccakf1600_80_04(&s); 3644 libcrux_sha3_simd_portable_squeeze_13_5b(&s, out, i0 * (size_t)136U, 3645 (size_t)136U); 3646 } 3647 if (last < outlen) { 3648 libcrux_sha3_generic_keccak_keccakf1600_80_04(&s); 3649 libcrux_sha3_simd_portable_squeeze_13_5b(&s, out, last, outlen - last); 3650 } 3651 } 3652 } 3653 3654 /** 3655 A portable SHA3 256 implementation. 3656 */ 3657 static KRML_MUSTINLINE void libcrux_sha3_portable_sha256(Eurydice_slice digest, 3658 Eurydice_slice data) { 3659 libcrux_sha3_generic_keccak_portable_keccak1_ad(data, digest); 3660 } 3661 3662 /** 3663 A monomorphic instance of libcrux_sha3.simd.portable.load_last 3664 with const generics 3665 - RATE= 136 3666 - DELIMITER= 31 3667 */ 3668 static KRML_MUSTINLINE void libcrux_sha3_simd_portable_load_last_ad0( 3669 uint64_t *state, Eurydice_slice blocks, size_t start, size_t len) { 3670 uint8_t buffer[136U] = {0U}; 3671 Eurydice_slice_copy( 3672 Eurydice_array_to_subslice3(buffer, (size_t)0U, len, uint8_t *), 3673 Eurydice_slice_subslice3(blocks, start, start + len, uint8_t *), uint8_t); 3674 buffer[len] = 31U; 3675 size_t uu____0 = (size_t)136U - (size_t)1U; 3676 buffer[uu____0] = (uint32_t)buffer[uu____0] | 128U; 3677 libcrux_sha3_simd_portable_load_block_5b( 3678 state, Eurydice_array_to_slice((size_t)136U, buffer, uint8_t), 3679 (size_t)0U); 3680 } 3681 3682 /** 3683 This function found in impl {libcrux_sha3::traits::Absorb<1usize> for 3684 libcrux_sha3::generic_keccak::KeccakState<u64, 1usize>[core::marker::Sized<u64>, 3685 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 3686 u64}]} 3687 */ 3688 /** 3689 A monomorphic instance of libcrux_sha3.simd.portable.load_last_a1 3690 with const generics 3691 - RATE= 136 3692 - DELIMITER= 31 3693 */ 3694 static inline void libcrux_sha3_simd_portable_load_last_a1_ad0( 3695 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *input, 3696 size_t start, size_t len) { 3697 libcrux_sha3_simd_portable_load_last_ad0(self->st, input[0U], start, len); 3698 } 3699 3700 /** 3701 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 3702 N>[TraitClause@0, TraitClause@1]} 3703 */ 3704 /** 3705 A monomorphic instance of libcrux_sha3.generic_keccak.absorb_final_80 3706 with types uint64_t 3707 with const generics 3708 - N= 1 3709 - RATE= 136 3710 - DELIM= 31 3711 */ 3712 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_final_80_9e1( 3713 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *last, 3714 size_t start, size_t len) { 3715 libcrux_sha3_simd_portable_load_last_a1_ad0(self, last, start, len); 3716 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 3717 } 3718 3719 /** 3720 A monomorphic instance of libcrux_sha3.generic_keccak.portable.keccak1 3721 with const generics 3722 - RATE= 136 3723 - DELIM= 31 3724 */ 3725 static inline void libcrux_sha3_generic_keccak_portable_keccak1_ad0( 3726 Eurydice_slice data, Eurydice_slice out) { 3727 libcrux_sha3_generic_keccak_KeccakState_17 s = 3728 libcrux_sha3_generic_keccak_new_80_04(); 3729 size_t data_len = Eurydice_slice_len(data, uint8_t); 3730 for (size_t i = (size_t)0U; i < data_len / (size_t)136U; i++) { 3731 size_t i0 = i; 3732 Eurydice_slice buf[1U] = {data}; 3733 libcrux_sha3_generic_keccak_absorb_block_80_c60(&s, buf, i0 * (size_t)136U); 3734 } 3735 size_t rem = data_len % (size_t)136U; 3736 Eurydice_slice buf[1U] = {data}; 3737 libcrux_sha3_generic_keccak_absorb_final_80_9e1(&s, buf, data_len - rem, rem); 3738 size_t outlen = Eurydice_slice_len(out, uint8_t); 3739 size_t blocks = outlen / (size_t)136U; 3740 size_t last = outlen - outlen % (size_t)136U; 3741 if (blocks == (size_t)0U) { 3742 libcrux_sha3_simd_portable_squeeze_13_5b(&s, out, (size_t)0U, outlen); 3743 } else { 3744 libcrux_sha3_simd_portable_squeeze_13_5b(&s, out, (size_t)0U, (size_t)136U); 3745 for (size_t i = (size_t)1U; i < blocks; i++) { 3746 size_t i0 = i; 3747 libcrux_sha3_generic_keccak_keccakf1600_80_04(&s); 3748 libcrux_sha3_simd_portable_squeeze_13_5b(&s, out, i0 * (size_t)136U, 3749 (size_t)136U); 3750 } 3751 if (last < outlen) { 3752 libcrux_sha3_generic_keccak_keccakf1600_80_04(&s); 3753 libcrux_sha3_simd_portable_squeeze_13_5b(&s, out, last, outlen - last); 3754 } 3755 } 3756 } 3757 3758 /** 3759 A portable SHAKE256 implementation. 3760 */ 3761 static KRML_MUSTINLINE void libcrux_sha3_portable_shake256( 3762 Eurydice_slice digest, Eurydice_slice data) { 3763 libcrux_sha3_generic_keccak_portable_keccak1_ad0(data, digest); 3764 } 3765 3766 typedef libcrux_sha3_generic_keccak_KeccakState_17 3767 libcrux_sha3_portable_KeccakState; 3768 3769 /** 3770 Create a new SHAKE-128 state object. 3771 */ 3772 static KRML_MUSTINLINE libcrux_sha3_generic_keccak_KeccakState_17 3773 libcrux_sha3_portable_incremental_shake128_init(void) { 3774 return libcrux_sha3_generic_keccak_new_80_04(); 3775 } 3776 3777 /** 3778 A monomorphic instance of libcrux_sha3.simd.portable.load_block 3779 with const generics 3780 - RATE= 168 3781 */ 3782 static KRML_MUSTINLINE void libcrux_sha3_simd_portable_load_block_3a( 3783 uint64_t *state, Eurydice_slice blocks, size_t start) { 3784 uint64_t state_flat[25U] = {0U}; 3785 for (size_t i = (size_t)0U; i < (size_t)168U / (size_t)8U; i++) { 3786 size_t i0 = i; 3787 size_t offset = start + (size_t)8U * i0; 3788 uint8_t uu____0[8U]; 3789 Result_15 dst; 3790 Eurydice_slice_to_array2( 3791 &dst, 3792 Eurydice_slice_subslice3(blocks, offset, offset + (size_t)8U, 3793 uint8_t *), 3794 Eurydice_slice, uint8_t[8U], TryFromSliceError); 3795 unwrap_26_68(dst, uu____0); 3796 state_flat[i0] = core_num__u64__from_le_bytes(uu____0); 3797 } 3798 for (size_t i = (size_t)0U; i < (size_t)168U / (size_t)8U; i++) { 3799 size_t i0 = i; 3800 libcrux_sha3_traits_set_ij_04( 3801 state, i0 / (size_t)5U, i0 % (size_t)5U, 3802 libcrux_sha3_traits_get_ij_04(state, i0 / (size_t)5U, 3803 i0 % (size_t)5U)[0U] ^ 3804 state_flat[i0]); 3805 } 3806 } 3807 3808 /** 3809 A monomorphic instance of libcrux_sha3.simd.portable.load_last 3810 with const generics 3811 - RATE= 168 3812 - DELIMITER= 31 3813 */ 3814 static KRML_MUSTINLINE void libcrux_sha3_simd_portable_load_last_c6( 3815 uint64_t *state, Eurydice_slice blocks, size_t start, size_t len) { 3816 uint8_t buffer[168U] = {0U}; 3817 Eurydice_slice_copy( 3818 Eurydice_array_to_subslice3(buffer, (size_t)0U, len, uint8_t *), 3819 Eurydice_slice_subslice3(blocks, start, start + len, uint8_t *), uint8_t); 3820 buffer[len] = 31U; 3821 size_t uu____0 = (size_t)168U - (size_t)1U; 3822 buffer[uu____0] = (uint32_t)buffer[uu____0] | 128U; 3823 libcrux_sha3_simd_portable_load_block_3a( 3824 state, Eurydice_array_to_slice((size_t)168U, buffer, uint8_t), 3825 (size_t)0U); 3826 } 3827 3828 /** 3829 This function found in impl {libcrux_sha3::traits::Absorb<1usize> for 3830 libcrux_sha3::generic_keccak::KeccakState<u64, 1usize>[core::marker::Sized<u64>, 3831 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 3832 u64}]} 3833 */ 3834 /** 3835 A monomorphic instance of libcrux_sha3.simd.portable.load_last_a1 3836 with const generics 3837 - RATE= 168 3838 - DELIMITER= 31 3839 */ 3840 static inline void libcrux_sha3_simd_portable_load_last_a1_c6( 3841 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *input, 3842 size_t start, size_t len) { 3843 libcrux_sha3_simd_portable_load_last_c6(self->st, input[0U], start, len); 3844 } 3845 3846 /** 3847 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 3848 N>[TraitClause@0, TraitClause@1]} 3849 */ 3850 /** 3851 A monomorphic instance of libcrux_sha3.generic_keccak.absorb_final_80 3852 with types uint64_t 3853 with const generics 3854 - N= 1 3855 - RATE= 168 3856 - DELIM= 31 3857 */ 3858 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_final_80_9e2( 3859 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *last, 3860 size_t start, size_t len) { 3861 libcrux_sha3_simd_portable_load_last_a1_c6(self, last, start, len); 3862 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 3863 } 3864 3865 /** 3866 Absorb 3867 */ 3868 static KRML_MUSTINLINE void 3869 libcrux_sha3_portable_incremental_shake128_absorb_final( 3870 libcrux_sha3_generic_keccak_KeccakState_17 *s, Eurydice_slice data0) { 3871 libcrux_sha3_generic_keccak_KeccakState_17 *uu____0 = s; 3872 Eurydice_slice uu____1[1U] = {data0}; 3873 libcrux_sha3_generic_keccak_absorb_final_80_9e2( 3874 uu____0, uu____1, (size_t)0U, Eurydice_slice_len(data0, uint8_t)); 3875 } 3876 3877 /** 3878 A monomorphic instance of libcrux_sha3.simd.portable.store_block 3879 with const generics 3880 - RATE= 168 3881 */ 3882 static KRML_MUSTINLINE void libcrux_sha3_simd_portable_store_block_3a( 3883 uint64_t *s, Eurydice_slice out, size_t start, size_t len) { 3884 size_t octets = len / (size_t)8U; 3885 for (size_t i = (size_t)0U; i < octets; i++) { 3886 size_t i0 = i; 3887 Eurydice_slice uu____0 = Eurydice_slice_subslice3( 3888 out, start + (size_t)8U * i0, start + (size_t)8U * i0 + (size_t)8U, 3889 uint8_t *); 3890 uint8_t ret[8U]; 3891 core_num__u64__to_le_bytes( 3892 libcrux_sha3_traits_get_ij_04(s, i0 / (size_t)5U, i0 % (size_t)5U)[0U], 3893 ret); 3894 Eurydice_slice_copy( 3895 uu____0, Eurydice_array_to_slice((size_t)8U, ret, uint8_t), uint8_t); 3896 } 3897 size_t remaining = len % (size_t)8U; 3898 if (remaining > (size_t)0U) { 3899 Eurydice_slice uu____1 = Eurydice_slice_subslice3( 3900 out, start + len - remaining, start + len, uint8_t *); 3901 uint8_t ret[8U]; 3902 core_num__u64__to_le_bytes( 3903 libcrux_sha3_traits_get_ij_04(s, octets / (size_t)5U, 3904 octets % (size_t)5U)[0U], 3905 ret); 3906 Eurydice_slice_copy( 3907 uu____1, 3908 Eurydice_array_to_subslice3(ret, (size_t)0U, remaining, uint8_t *), 3909 uint8_t); 3910 } 3911 } 3912 3913 /** 3914 This function found in impl {libcrux_sha3::traits::Squeeze1<u64> for 3915 libcrux_sha3::generic_keccak::KeccakState<u64, 1usize>[core::marker::Sized<u64>, 3916 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 3917 u64}]} 3918 */ 3919 /** 3920 A monomorphic instance of libcrux_sha3.simd.portable.squeeze_13 3921 with const generics 3922 - RATE= 168 3923 */ 3924 static inline void libcrux_sha3_simd_portable_squeeze_13_3a( 3925 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice out, 3926 size_t start, size_t len) { 3927 libcrux_sha3_simd_portable_store_block_3a(self->st, out, start, len); 3928 } 3929 3930 /** 3931 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<u64, 3932 1usize>[core::marker::Sized<u64>, 3933 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 3934 u64}]} 3935 */ 3936 /** 3937 A monomorphic instance of 3938 libcrux_sha3.generic_keccak.portable.squeeze_first_three_blocks_b4 with const 3939 generics 3940 - RATE= 168 3941 */ 3942 static KRML_MUSTINLINE void 3943 libcrux_sha3_generic_keccak_portable_squeeze_first_three_blocks_b4_3a( 3944 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice out) { 3945 libcrux_sha3_simd_portable_squeeze_13_3a(self, out, (size_t)0U, (size_t)168U); 3946 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 3947 libcrux_sha3_simd_portable_squeeze_13_3a(self, out, (size_t)168U, 3948 (size_t)168U); 3949 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 3950 libcrux_sha3_simd_portable_squeeze_13_3a(self, out, (size_t)2U * (size_t)168U, 3951 (size_t)168U); 3952 } 3953 3954 /** 3955 Squeeze three blocks 3956 */ 3957 static KRML_MUSTINLINE void 3958 libcrux_sha3_portable_incremental_shake128_squeeze_first_three_blocks( 3959 libcrux_sha3_generic_keccak_KeccakState_17 *s, Eurydice_slice out0) { 3960 libcrux_sha3_generic_keccak_portable_squeeze_first_three_blocks_b4_3a(s, 3961 out0); 3962 } 3963 3964 /** 3965 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<u64, 3966 1usize>[core::marker::Sized<u64>, 3967 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 3968 u64}]} 3969 */ 3970 /** 3971 A monomorphic instance of 3972 libcrux_sha3.generic_keccak.portable.squeeze_next_block_b4 with const generics 3973 - RATE= 168 3974 */ 3975 static KRML_MUSTINLINE void 3976 libcrux_sha3_generic_keccak_portable_squeeze_next_block_b4_3a( 3977 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice out, 3978 size_t start) { 3979 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 3980 libcrux_sha3_simd_portable_squeeze_13_3a(self, out, start, (size_t)168U); 3981 } 3982 3983 /** 3984 Squeeze another block 3985 */ 3986 static KRML_MUSTINLINE void 3987 libcrux_sha3_portable_incremental_shake128_squeeze_next_block( 3988 libcrux_sha3_generic_keccak_KeccakState_17 *s, Eurydice_slice out0) { 3989 libcrux_sha3_generic_keccak_portable_squeeze_next_block_b4_3a(s, out0, 3990 (size_t)0U); 3991 } 3992 3993 #define libcrux_sha3_Algorithm_Sha224 1 3994 #define libcrux_sha3_Algorithm_Sha256 2 3995 #define libcrux_sha3_Algorithm_Sha384 3 3996 #define libcrux_sha3_Algorithm_Sha512 4 3997 3998 typedef uint8_t libcrux_sha3_Algorithm; 3999 4000 typedef uint8_t libcrux_sha3_Sha3_224Digest[28U]; 4001 4002 typedef uint8_t libcrux_sha3_Sha3_256Digest[32U]; 4003 4004 typedef uint8_t libcrux_sha3_Sha3_384Digest[48U]; 4005 4006 typedef uint8_t libcrux_sha3_Sha3_512Digest[64U]; 4007 4008 /** 4009 Returns the output size of a digest. 4010 */ 4011 static inline size_t libcrux_sha3_digest_size(libcrux_sha3_Algorithm mode) { 4012 switch (mode) { 4013 case libcrux_sha3_Algorithm_Sha224: { 4014 break; 4015 } 4016 case libcrux_sha3_Algorithm_Sha256: { 4017 return (size_t)32U; 4018 } 4019 case libcrux_sha3_Algorithm_Sha384: { 4020 return (size_t)48U; 4021 } 4022 case libcrux_sha3_Algorithm_Sha512: { 4023 return (size_t)64U; 4024 } 4025 default: { 4026 KRML_HOST_EPRINTF("KaRaMeL incomplete match at %s:%d\n", __FILE__, 4027 __LINE__); 4028 KRML_HOST_EXIT(253U); 4029 } 4030 } 4031 return (size_t)28U; 4032 } 4033 4034 /** 4035 A monomorphic instance of libcrux_sha3.simd.portable.load_block 4036 with const generics 4037 - RATE= 144 4038 */ 4039 static KRML_MUSTINLINE void libcrux_sha3_simd_portable_load_block_2c( 4040 uint64_t *state, Eurydice_slice blocks, size_t start) { 4041 uint64_t state_flat[25U] = {0U}; 4042 for (size_t i = (size_t)0U; i < (size_t)144U / (size_t)8U; i++) { 4043 size_t i0 = i; 4044 size_t offset = start + (size_t)8U * i0; 4045 uint8_t uu____0[8U]; 4046 Result_15 dst; 4047 Eurydice_slice_to_array2( 4048 &dst, 4049 Eurydice_slice_subslice3(blocks, offset, offset + (size_t)8U, 4050 uint8_t *), 4051 Eurydice_slice, uint8_t[8U], TryFromSliceError); 4052 unwrap_26_68(dst, uu____0); 4053 state_flat[i0] = core_num__u64__from_le_bytes(uu____0); 4054 } 4055 for (size_t i = (size_t)0U; i < (size_t)144U / (size_t)8U; i++) { 4056 size_t i0 = i; 4057 libcrux_sha3_traits_set_ij_04( 4058 state, i0 / (size_t)5U, i0 % (size_t)5U, 4059 libcrux_sha3_traits_get_ij_04(state, i0 / (size_t)5U, 4060 i0 % (size_t)5U)[0U] ^ 4061 state_flat[i0]); 4062 } 4063 } 4064 4065 /** 4066 This function found in impl {libcrux_sha3::traits::Absorb<1usize> for 4067 libcrux_sha3::generic_keccak::KeccakState<u64, 1usize>[core::marker::Sized<u64>, 4068 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 4069 u64}]} 4070 */ 4071 /** 4072 A monomorphic instance of libcrux_sha3.simd.portable.load_block_a1 4073 with const generics 4074 - RATE= 144 4075 */ 4076 static inline void libcrux_sha3_simd_portable_load_block_a1_2c( 4077 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *input, 4078 size_t start) { 4079 libcrux_sha3_simd_portable_load_block_2c(self->st, input[0U], start); 4080 } 4081 4082 /** 4083 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 4084 N>[TraitClause@0, TraitClause@1]} 4085 */ 4086 /** 4087 A monomorphic instance of libcrux_sha3.generic_keccak.absorb_block_80 4088 with types uint64_t 4089 with const generics 4090 - N= 1 4091 - RATE= 144 4092 */ 4093 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_block_80_c61( 4094 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *blocks, 4095 size_t start) { 4096 libcrux_sha3_simd_portable_load_block_a1_2c(self, blocks, start); 4097 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 4098 } 4099 4100 /** 4101 A monomorphic instance of libcrux_sha3.simd.portable.load_last 4102 with const generics 4103 - RATE= 144 4104 - DELIMITER= 6 4105 */ 4106 static KRML_MUSTINLINE void libcrux_sha3_simd_portable_load_last_1e( 4107 uint64_t *state, Eurydice_slice blocks, size_t start, size_t len) { 4108 uint8_t buffer[144U] = {0U}; 4109 Eurydice_slice_copy( 4110 Eurydice_array_to_subslice3(buffer, (size_t)0U, len, uint8_t *), 4111 Eurydice_slice_subslice3(blocks, start, start + len, uint8_t *), uint8_t); 4112 buffer[len] = 6U; 4113 size_t uu____0 = (size_t)144U - (size_t)1U; 4114 buffer[uu____0] = (uint32_t)buffer[uu____0] | 128U; 4115 libcrux_sha3_simd_portable_load_block_2c( 4116 state, Eurydice_array_to_slice((size_t)144U, buffer, uint8_t), 4117 (size_t)0U); 4118 } 4119 4120 /** 4121 This function found in impl {libcrux_sha3::traits::Absorb<1usize> for 4122 libcrux_sha3::generic_keccak::KeccakState<u64, 1usize>[core::marker::Sized<u64>, 4123 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 4124 u64}]} 4125 */ 4126 /** 4127 A monomorphic instance of libcrux_sha3.simd.portable.load_last_a1 4128 with const generics 4129 - RATE= 144 4130 - DELIMITER= 6 4131 */ 4132 static inline void libcrux_sha3_simd_portable_load_last_a1_1e( 4133 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *input, 4134 size_t start, size_t len) { 4135 libcrux_sha3_simd_portable_load_last_1e(self->st, input[0U], start, len); 4136 } 4137 4138 /** 4139 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 4140 N>[TraitClause@0, TraitClause@1]} 4141 */ 4142 /** 4143 A monomorphic instance of libcrux_sha3.generic_keccak.absorb_final_80 4144 with types uint64_t 4145 with const generics 4146 - N= 1 4147 - RATE= 144 4148 - DELIM= 6 4149 */ 4150 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_final_80_9e3( 4151 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *last, 4152 size_t start, size_t len) { 4153 libcrux_sha3_simd_portable_load_last_a1_1e(self, last, start, len); 4154 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 4155 } 4156 4157 /** 4158 A monomorphic instance of libcrux_sha3.simd.portable.store_block 4159 with const generics 4160 - RATE= 144 4161 */ 4162 static KRML_MUSTINLINE void libcrux_sha3_simd_portable_store_block_2c( 4163 uint64_t *s, Eurydice_slice out, size_t start, size_t len) { 4164 size_t octets = len / (size_t)8U; 4165 for (size_t i = (size_t)0U; i < octets; i++) { 4166 size_t i0 = i; 4167 Eurydice_slice uu____0 = Eurydice_slice_subslice3( 4168 out, start + (size_t)8U * i0, start + (size_t)8U * i0 + (size_t)8U, 4169 uint8_t *); 4170 uint8_t ret[8U]; 4171 core_num__u64__to_le_bytes( 4172 libcrux_sha3_traits_get_ij_04(s, i0 / (size_t)5U, i0 % (size_t)5U)[0U], 4173 ret); 4174 Eurydice_slice_copy( 4175 uu____0, Eurydice_array_to_slice((size_t)8U, ret, uint8_t), uint8_t); 4176 } 4177 size_t remaining = len % (size_t)8U; 4178 if (remaining > (size_t)0U) { 4179 Eurydice_slice uu____1 = Eurydice_slice_subslice3( 4180 out, start + len - remaining, start + len, uint8_t *); 4181 uint8_t ret[8U]; 4182 core_num__u64__to_le_bytes( 4183 libcrux_sha3_traits_get_ij_04(s, octets / (size_t)5U, 4184 octets % (size_t)5U)[0U], 4185 ret); 4186 Eurydice_slice_copy( 4187 uu____1, 4188 Eurydice_array_to_subslice3(ret, (size_t)0U, remaining, uint8_t *), 4189 uint8_t); 4190 } 4191 } 4192 4193 /** 4194 This function found in impl {libcrux_sha3::traits::Squeeze1<u64> for 4195 libcrux_sha3::generic_keccak::KeccakState<u64, 1usize>[core::marker::Sized<u64>, 4196 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 4197 u64}]} 4198 */ 4199 /** 4200 A monomorphic instance of libcrux_sha3.simd.portable.squeeze_13 4201 with const generics 4202 - RATE= 144 4203 */ 4204 static inline void libcrux_sha3_simd_portable_squeeze_13_2c( 4205 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice out, 4206 size_t start, size_t len) { 4207 libcrux_sha3_simd_portable_store_block_2c(self->st, out, start, len); 4208 } 4209 4210 /** 4211 A monomorphic instance of libcrux_sha3.generic_keccak.portable.keccak1 4212 with const generics 4213 - RATE= 144 4214 - DELIM= 6 4215 */ 4216 static inline void libcrux_sha3_generic_keccak_portable_keccak1_1e( 4217 Eurydice_slice data, Eurydice_slice out) { 4218 libcrux_sha3_generic_keccak_KeccakState_17 s = 4219 libcrux_sha3_generic_keccak_new_80_04(); 4220 size_t data_len = Eurydice_slice_len(data, uint8_t); 4221 for (size_t i = (size_t)0U; i < data_len / (size_t)144U; i++) { 4222 size_t i0 = i; 4223 Eurydice_slice buf[1U] = {data}; 4224 libcrux_sha3_generic_keccak_absorb_block_80_c61(&s, buf, i0 * (size_t)144U); 4225 } 4226 size_t rem = data_len % (size_t)144U; 4227 Eurydice_slice buf[1U] = {data}; 4228 libcrux_sha3_generic_keccak_absorb_final_80_9e3(&s, buf, data_len - rem, rem); 4229 size_t outlen = Eurydice_slice_len(out, uint8_t); 4230 size_t blocks = outlen / (size_t)144U; 4231 size_t last = outlen - outlen % (size_t)144U; 4232 if (blocks == (size_t)0U) { 4233 libcrux_sha3_simd_portable_squeeze_13_2c(&s, out, (size_t)0U, outlen); 4234 } else { 4235 libcrux_sha3_simd_portable_squeeze_13_2c(&s, out, (size_t)0U, (size_t)144U); 4236 for (size_t i = (size_t)1U; i < blocks; i++) { 4237 size_t i0 = i; 4238 libcrux_sha3_generic_keccak_keccakf1600_80_04(&s); 4239 libcrux_sha3_simd_portable_squeeze_13_2c(&s, out, i0 * (size_t)144U, 4240 (size_t)144U); 4241 } 4242 if (last < outlen) { 4243 libcrux_sha3_generic_keccak_keccakf1600_80_04(&s); 4244 libcrux_sha3_simd_portable_squeeze_13_2c(&s, out, last, outlen - last); 4245 } 4246 } 4247 } 4248 4249 /** 4250 A portable SHA3 224 implementation. 4251 */ 4252 static KRML_MUSTINLINE void libcrux_sha3_portable_sha224(Eurydice_slice digest, 4253 Eurydice_slice data) { 4254 libcrux_sha3_generic_keccak_portable_keccak1_1e(data, digest); 4255 } 4256 4257 /** 4258 A monomorphic instance of libcrux_sha3.simd.portable.load_block 4259 with const generics 4260 - RATE= 104 4261 */ 4262 static KRML_MUSTINLINE void libcrux_sha3_simd_portable_load_block_7a( 4263 uint64_t *state, Eurydice_slice blocks, size_t start) { 4264 uint64_t state_flat[25U] = {0U}; 4265 for (size_t i = (size_t)0U; i < (size_t)104U / (size_t)8U; i++) { 4266 size_t i0 = i; 4267 size_t offset = start + (size_t)8U * i0; 4268 uint8_t uu____0[8U]; 4269 Result_15 dst; 4270 Eurydice_slice_to_array2( 4271 &dst, 4272 Eurydice_slice_subslice3(blocks, offset, offset + (size_t)8U, 4273 uint8_t *), 4274 Eurydice_slice, uint8_t[8U], TryFromSliceError); 4275 unwrap_26_68(dst, uu____0); 4276 state_flat[i0] = core_num__u64__from_le_bytes(uu____0); 4277 } 4278 for (size_t i = (size_t)0U; i < (size_t)104U / (size_t)8U; i++) { 4279 size_t i0 = i; 4280 libcrux_sha3_traits_set_ij_04( 4281 state, i0 / (size_t)5U, i0 % (size_t)5U, 4282 libcrux_sha3_traits_get_ij_04(state, i0 / (size_t)5U, 4283 i0 % (size_t)5U)[0U] ^ 4284 state_flat[i0]); 4285 } 4286 } 4287 4288 /** 4289 This function found in impl {libcrux_sha3::traits::Absorb<1usize> for 4290 libcrux_sha3::generic_keccak::KeccakState<u64, 1usize>[core::marker::Sized<u64>, 4291 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 4292 u64}]} 4293 */ 4294 /** 4295 A monomorphic instance of libcrux_sha3.simd.portable.load_block_a1 4296 with const generics 4297 - RATE= 104 4298 */ 4299 static inline void libcrux_sha3_simd_portable_load_block_a1_7a( 4300 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *input, 4301 size_t start) { 4302 libcrux_sha3_simd_portable_load_block_7a(self->st, input[0U], start); 4303 } 4304 4305 /** 4306 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 4307 N>[TraitClause@0, TraitClause@1]} 4308 */ 4309 /** 4310 A monomorphic instance of libcrux_sha3.generic_keccak.absorb_block_80 4311 with types uint64_t 4312 with const generics 4313 - N= 1 4314 - RATE= 104 4315 */ 4316 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_block_80_c62( 4317 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *blocks, 4318 size_t start) { 4319 libcrux_sha3_simd_portable_load_block_a1_7a(self, blocks, start); 4320 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 4321 } 4322 4323 /** 4324 A monomorphic instance of libcrux_sha3.simd.portable.load_last 4325 with const generics 4326 - RATE= 104 4327 - DELIMITER= 6 4328 */ 4329 static KRML_MUSTINLINE void libcrux_sha3_simd_portable_load_last_7c( 4330 uint64_t *state, Eurydice_slice blocks, size_t start, size_t len) { 4331 uint8_t buffer[104U] = {0U}; 4332 Eurydice_slice_copy( 4333 Eurydice_array_to_subslice3(buffer, (size_t)0U, len, uint8_t *), 4334 Eurydice_slice_subslice3(blocks, start, start + len, uint8_t *), uint8_t); 4335 buffer[len] = 6U; 4336 size_t uu____0 = (size_t)104U - (size_t)1U; 4337 buffer[uu____0] = (uint32_t)buffer[uu____0] | 128U; 4338 libcrux_sha3_simd_portable_load_block_7a( 4339 state, Eurydice_array_to_slice((size_t)104U, buffer, uint8_t), 4340 (size_t)0U); 4341 } 4342 4343 /** 4344 This function found in impl {libcrux_sha3::traits::Absorb<1usize> for 4345 libcrux_sha3::generic_keccak::KeccakState<u64, 1usize>[core::marker::Sized<u64>, 4346 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 4347 u64}]} 4348 */ 4349 /** 4350 A monomorphic instance of libcrux_sha3.simd.portable.load_last_a1 4351 with const generics 4352 - RATE= 104 4353 - DELIMITER= 6 4354 */ 4355 static inline void libcrux_sha3_simd_portable_load_last_a1_7c( 4356 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *input, 4357 size_t start, size_t len) { 4358 libcrux_sha3_simd_portable_load_last_7c(self->st, input[0U], start, len); 4359 } 4360 4361 /** 4362 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 4363 N>[TraitClause@0, TraitClause@1]} 4364 */ 4365 /** 4366 A monomorphic instance of libcrux_sha3.generic_keccak.absorb_final_80 4367 with types uint64_t 4368 with const generics 4369 - N= 1 4370 - RATE= 104 4371 - DELIM= 6 4372 */ 4373 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_final_80_9e4( 4374 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *last, 4375 size_t start, size_t len) { 4376 libcrux_sha3_simd_portable_load_last_a1_7c(self, last, start, len); 4377 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 4378 } 4379 4380 /** 4381 A monomorphic instance of libcrux_sha3.simd.portable.store_block 4382 with const generics 4383 - RATE= 104 4384 */ 4385 static KRML_MUSTINLINE void libcrux_sha3_simd_portable_store_block_7a( 4386 uint64_t *s, Eurydice_slice out, size_t start, size_t len) { 4387 size_t octets = len / (size_t)8U; 4388 for (size_t i = (size_t)0U; i < octets; i++) { 4389 size_t i0 = i; 4390 Eurydice_slice uu____0 = Eurydice_slice_subslice3( 4391 out, start + (size_t)8U * i0, start + (size_t)8U * i0 + (size_t)8U, 4392 uint8_t *); 4393 uint8_t ret[8U]; 4394 core_num__u64__to_le_bytes( 4395 libcrux_sha3_traits_get_ij_04(s, i0 / (size_t)5U, i0 % (size_t)5U)[0U], 4396 ret); 4397 Eurydice_slice_copy( 4398 uu____0, Eurydice_array_to_slice((size_t)8U, ret, uint8_t), uint8_t); 4399 } 4400 size_t remaining = len % (size_t)8U; 4401 if (remaining > (size_t)0U) { 4402 Eurydice_slice uu____1 = Eurydice_slice_subslice3( 4403 out, start + len - remaining, start + len, uint8_t *); 4404 uint8_t ret[8U]; 4405 core_num__u64__to_le_bytes( 4406 libcrux_sha3_traits_get_ij_04(s, octets / (size_t)5U, 4407 octets % (size_t)5U)[0U], 4408 ret); 4409 Eurydice_slice_copy( 4410 uu____1, 4411 Eurydice_array_to_subslice3(ret, (size_t)0U, remaining, uint8_t *), 4412 uint8_t); 4413 } 4414 } 4415 4416 /** 4417 This function found in impl {libcrux_sha3::traits::Squeeze1<u64> for 4418 libcrux_sha3::generic_keccak::KeccakState<u64, 1usize>[core::marker::Sized<u64>, 4419 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 4420 u64}]} 4421 */ 4422 /** 4423 A monomorphic instance of libcrux_sha3.simd.portable.squeeze_13 4424 with const generics 4425 - RATE= 104 4426 */ 4427 static inline void libcrux_sha3_simd_portable_squeeze_13_7a( 4428 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice out, 4429 size_t start, size_t len) { 4430 libcrux_sha3_simd_portable_store_block_7a(self->st, out, start, len); 4431 } 4432 4433 /** 4434 A monomorphic instance of libcrux_sha3.generic_keccak.portable.keccak1 4435 with const generics 4436 - RATE= 104 4437 - DELIM= 6 4438 */ 4439 static inline void libcrux_sha3_generic_keccak_portable_keccak1_7c( 4440 Eurydice_slice data, Eurydice_slice out) { 4441 libcrux_sha3_generic_keccak_KeccakState_17 s = 4442 libcrux_sha3_generic_keccak_new_80_04(); 4443 size_t data_len = Eurydice_slice_len(data, uint8_t); 4444 for (size_t i = (size_t)0U; i < data_len / (size_t)104U; i++) { 4445 size_t i0 = i; 4446 Eurydice_slice buf[1U] = {data}; 4447 libcrux_sha3_generic_keccak_absorb_block_80_c62(&s, buf, i0 * (size_t)104U); 4448 } 4449 size_t rem = data_len % (size_t)104U; 4450 Eurydice_slice buf[1U] = {data}; 4451 libcrux_sha3_generic_keccak_absorb_final_80_9e4(&s, buf, data_len - rem, rem); 4452 size_t outlen = Eurydice_slice_len(out, uint8_t); 4453 size_t blocks = outlen / (size_t)104U; 4454 size_t last = outlen - outlen % (size_t)104U; 4455 if (blocks == (size_t)0U) { 4456 libcrux_sha3_simd_portable_squeeze_13_7a(&s, out, (size_t)0U, outlen); 4457 } else { 4458 libcrux_sha3_simd_portable_squeeze_13_7a(&s, out, (size_t)0U, (size_t)104U); 4459 for (size_t i = (size_t)1U; i < blocks; i++) { 4460 size_t i0 = i; 4461 libcrux_sha3_generic_keccak_keccakf1600_80_04(&s); 4462 libcrux_sha3_simd_portable_squeeze_13_7a(&s, out, i0 * (size_t)104U, 4463 (size_t)104U); 4464 } 4465 if (last < outlen) { 4466 libcrux_sha3_generic_keccak_keccakf1600_80_04(&s); 4467 libcrux_sha3_simd_portable_squeeze_13_7a(&s, out, last, outlen - last); 4468 } 4469 } 4470 } 4471 4472 /** 4473 A portable SHA3 384 implementation. 4474 */ 4475 static KRML_MUSTINLINE void libcrux_sha3_portable_sha384(Eurydice_slice digest, 4476 Eurydice_slice data) { 4477 libcrux_sha3_generic_keccak_portable_keccak1_7c(data, digest); 4478 } 4479 4480 /** 4481 SHA3 224 4482 4483 Preconditions: 4484 - `digest.len() == 28` 4485 */ 4486 static inline void libcrux_sha3_sha224_ema(Eurydice_slice digest, 4487 Eurydice_slice payload) { 4488 libcrux_sha3_portable_sha224(digest, payload); 4489 } 4490 4491 /** 4492 SHA3 224 4493 */ 4494 static inline void libcrux_sha3_sha224(Eurydice_slice data, uint8_t ret[28U]) { 4495 uint8_t out[28U] = {0U}; 4496 libcrux_sha3_sha224_ema(Eurydice_array_to_slice((size_t)28U, out, uint8_t), 4497 data); 4498 memcpy(ret, out, (size_t)28U * sizeof(uint8_t)); 4499 } 4500 4501 /** 4502 SHA3 256 4503 */ 4504 static inline void libcrux_sha3_sha256_ema(Eurydice_slice digest, 4505 Eurydice_slice payload) { 4506 libcrux_sha3_portable_sha256(digest, payload); 4507 } 4508 4509 /** 4510 SHA3 256 4511 */ 4512 static inline void libcrux_sha3_sha256(Eurydice_slice data, uint8_t ret[32U]) { 4513 uint8_t out[32U] = {0U}; 4514 libcrux_sha3_sha256_ema(Eurydice_array_to_slice((size_t)32U, out, uint8_t), 4515 data); 4516 memcpy(ret, out, (size_t)32U * sizeof(uint8_t)); 4517 } 4518 4519 /** 4520 SHA3 384 4521 */ 4522 static inline void libcrux_sha3_sha384_ema(Eurydice_slice digest, 4523 Eurydice_slice payload) { 4524 libcrux_sha3_portable_sha384(digest, payload); 4525 } 4526 4527 /** 4528 SHA3 384 4529 */ 4530 static inline void libcrux_sha3_sha384(Eurydice_slice data, uint8_t ret[48U]) { 4531 uint8_t out[48U] = {0U}; 4532 libcrux_sha3_sha384_ema(Eurydice_array_to_slice((size_t)48U, out, uint8_t), 4533 data); 4534 memcpy(ret, out, (size_t)48U * sizeof(uint8_t)); 4535 } 4536 4537 /** 4538 SHA3 512 4539 */ 4540 static inline void libcrux_sha3_sha512_ema(Eurydice_slice digest, 4541 Eurydice_slice payload) { 4542 libcrux_sha3_portable_sha512(digest, payload); 4543 } 4544 4545 /** 4546 SHA3 512 4547 */ 4548 static inline void libcrux_sha3_sha512(Eurydice_slice data, uint8_t ret[64U]) { 4549 uint8_t out[64U] = {0U}; 4550 libcrux_sha3_sha512_ema(Eurydice_array_to_slice((size_t)64U, out, uint8_t), 4551 data); 4552 memcpy(ret, out, (size_t)64U * sizeof(uint8_t)); 4553 } 4554 4555 /** 4556 This function found in impl {libcrux_sha3::traits::Absorb<1usize> for 4557 libcrux_sha3::generic_keccak::KeccakState<u64, 1usize>[core::marker::Sized<u64>, 4558 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 4559 u64}]} 4560 */ 4561 /** 4562 A monomorphic instance of libcrux_sha3.simd.portable.load_block_a1 4563 with const generics 4564 - RATE= 168 4565 */ 4566 static inline void libcrux_sha3_simd_portable_load_block_a1_3a( 4567 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *input, 4568 size_t start) { 4569 libcrux_sha3_simd_portable_load_block_3a(self->st, input[0U], start); 4570 } 4571 4572 /** 4573 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<T, 4574 N>[TraitClause@0, TraitClause@1]} 4575 */ 4576 /** 4577 A monomorphic instance of libcrux_sha3.generic_keccak.absorb_block_80 4578 with types uint64_t 4579 with const generics 4580 - N= 1 4581 - RATE= 168 4582 */ 4583 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_block_80_c63( 4584 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice *blocks, 4585 size_t start) { 4586 libcrux_sha3_simd_portable_load_block_a1_3a(self, blocks, start); 4587 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 4588 } 4589 4590 /** 4591 A monomorphic instance of libcrux_sha3.generic_keccak.portable.keccak1 4592 with const generics 4593 - RATE= 168 4594 - DELIM= 31 4595 */ 4596 static inline void libcrux_sha3_generic_keccak_portable_keccak1_c6( 4597 Eurydice_slice data, Eurydice_slice out) { 4598 libcrux_sha3_generic_keccak_KeccakState_17 s = 4599 libcrux_sha3_generic_keccak_new_80_04(); 4600 size_t data_len = Eurydice_slice_len(data, uint8_t); 4601 for (size_t i = (size_t)0U; i < data_len / (size_t)168U; i++) { 4602 size_t i0 = i; 4603 Eurydice_slice buf[1U] = {data}; 4604 libcrux_sha3_generic_keccak_absorb_block_80_c63(&s, buf, i0 * (size_t)168U); 4605 } 4606 size_t rem = data_len % (size_t)168U; 4607 Eurydice_slice buf[1U] = {data}; 4608 libcrux_sha3_generic_keccak_absorb_final_80_9e2(&s, buf, data_len - rem, rem); 4609 size_t outlen = Eurydice_slice_len(out, uint8_t); 4610 size_t blocks = outlen / (size_t)168U; 4611 size_t last = outlen - outlen % (size_t)168U; 4612 if (blocks == (size_t)0U) { 4613 libcrux_sha3_simd_portable_squeeze_13_3a(&s, out, (size_t)0U, outlen); 4614 } else { 4615 libcrux_sha3_simd_portable_squeeze_13_3a(&s, out, (size_t)0U, (size_t)168U); 4616 for (size_t i = (size_t)1U; i < blocks; i++) { 4617 size_t i0 = i; 4618 libcrux_sha3_generic_keccak_keccakf1600_80_04(&s); 4619 libcrux_sha3_simd_portable_squeeze_13_3a(&s, out, i0 * (size_t)168U, 4620 (size_t)168U); 4621 } 4622 if (last < outlen) { 4623 libcrux_sha3_generic_keccak_keccakf1600_80_04(&s); 4624 libcrux_sha3_simd_portable_squeeze_13_3a(&s, out, last, outlen - last); 4625 } 4626 } 4627 } 4628 4629 /** 4630 A portable SHAKE128 implementation. 4631 */ 4632 static KRML_MUSTINLINE void libcrux_sha3_portable_shake128( 4633 Eurydice_slice digest, Eurydice_slice data) { 4634 libcrux_sha3_generic_keccak_portable_keccak1_c6(data, digest); 4635 } 4636 4637 /** 4638 SHAKE 128 4639 4640 Writes `out.len()` bytes. 4641 */ 4642 static inline void libcrux_sha3_shake128_ema(Eurydice_slice out, 4643 Eurydice_slice data) { 4644 libcrux_sha3_portable_shake128(out, data); 4645 } 4646 4647 /** 4648 SHAKE 256 4649 4650 Writes `out.len()` bytes. 4651 */ 4652 static inline void libcrux_sha3_shake256_ema(Eurydice_slice out, 4653 Eurydice_slice data) { 4654 libcrux_sha3_portable_shake256(out, data); 4655 } 4656 4657 /** 4658 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<u64, 4659 1usize>[core::marker::Sized<u64>, 4660 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 4661 u64}]} 4662 */ 4663 /** 4664 A monomorphic instance of 4665 libcrux_sha3.generic_keccak.portable.squeeze_first_five_blocks_b4 with const 4666 generics 4667 - RATE= 168 4668 */ 4669 static KRML_MUSTINLINE void 4670 libcrux_sha3_generic_keccak_portable_squeeze_first_five_blocks_b4_3a( 4671 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice out) { 4672 libcrux_sha3_simd_portable_squeeze_13_3a(self, out, (size_t)0U, (size_t)168U); 4673 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 4674 libcrux_sha3_simd_portable_squeeze_13_3a(self, out, (size_t)168U, 4675 (size_t)168U); 4676 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 4677 libcrux_sha3_simd_portable_squeeze_13_3a(self, out, (size_t)2U * (size_t)168U, 4678 (size_t)168U); 4679 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 4680 libcrux_sha3_simd_portable_squeeze_13_3a(self, out, (size_t)3U * (size_t)168U, 4681 (size_t)168U); 4682 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 4683 libcrux_sha3_simd_portable_squeeze_13_3a(self, out, (size_t)4U * (size_t)168U, 4684 (size_t)168U); 4685 } 4686 4687 /** 4688 Squeeze five blocks 4689 */ 4690 static KRML_MUSTINLINE void 4691 libcrux_sha3_portable_incremental_shake128_squeeze_first_five_blocks( 4692 libcrux_sha3_generic_keccak_KeccakState_17 *s, Eurydice_slice out0) { 4693 libcrux_sha3_generic_keccak_portable_squeeze_first_five_blocks_b4_3a(s, out0); 4694 } 4695 4696 /** 4697 Absorb some data for SHAKE-256 for the last time 4698 */ 4699 static KRML_MUSTINLINE void 4700 libcrux_sha3_portable_incremental_shake256_absorb_final( 4701 libcrux_sha3_generic_keccak_KeccakState_17 *s, Eurydice_slice data) { 4702 libcrux_sha3_generic_keccak_KeccakState_17 *uu____0 = s; 4703 Eurydice_slice uu____1[1U] = {data}; 4704 libcrux_sha3_generic_keccak_absorb_final_80_9e1( 4705 uu____0, uu____1, (size_t)0U, Eurydice_slice_len(data, uint8_t)); 4706 } 4707 4708 /** 4709 Create a new SHAKE-256 state object. 4710 */ 4711 static KRML_MUSTINLINE libcrux_sha3_generic_keccak_KeccakState_17 4712 libcrux_sha3_portable_incremental_shake256_init(void) { 4713 return libcrux_sha3_generic_keccak_new_80_04(); 4714 } 4715 4716 /** 4717 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<u64, 4718 1usize>[core::marker::Sized<u64>, 4719 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 4720 u64}]} 4721 */ 4722 /** 4723 A monomorphic instance of 4724 libcrux_sha3.generic_keccak.portable.squeeze_first_block_b4 with const generics 4725 - RATE= 136 4726 */ 4727 static KRML_MUSTINLINE void 4728 libcrux_sha3_generic_keccak_portable_squeeze_first_block_b4_5b( 4729 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice out) { 4730 libcrux_sha3_simd_portable_squeeze_13_5b(self, out, (size_t)0U, (size_t)136U); 4731 } 4732 4733 /** 4734 Squeeze the first SHAKE-256 block 4735 */ 4736 static KRML_MUSTINLINE void 4737 libcrux_sha3_portable_incremental_shake256_squeeze_first_block( 4738 libcrux_sha3_generic_keccak_KeccakState_17 *s, Eurydice_slice out) { 4739 libcrux_sha3_generic_keccak_portable_squeeze_first_block_b4_5b(s, out); 4740 } 4741 4742 /** 4743 This function found in impl {libcrux_sha3::generic_keccak::KeccakState<u64, 4744 1usize>[core::marker::Sized<u64>, 4745 libcrux_sha3::simd::portable::{libcrux_sha3::traits::KeccakItem<1usize> for 4746 u64}]} 4747 */ 4748 /** 4749 A monomorphic instance of 4750 libcrux_sha3.generic_keccak.portable.squeeze_next_block_b4 with const generics 4751 - RATE= 136 4752 */ 4753 static KRML_MUSTINLINE void 4754 libcrux_sha3_generic_keccak_portable_squeeze_next_block_b4_5b( 4755 libcrux_sha3_generic_keccak_KeccakState_17 *self, Eurydice_slice out, 4756 size_t start) { 4757 libcrux_sha3_generic_keccak_keccakf1600_80_04(self); 4758 libcrux_sha3_simd_portable_squeeze_13_5b(self, out, start, (size_t)136U); 4759 } 4760 4761 /** 4762 Squeeze the next SHAKE-256 block 4763 */ 4764 static KRML_MUSTINLINE void 4765 libcrux_sha3_portable_incremental_shake256_squeeze_next_block( 4766 libcrux_sha3_generic_keccak_KeccakState_17 *s, Eurydice_slice out) { 4767 libcrux_sha3_generic_keccak_portable_squeeze_next_block_b4_5b(s, out, 4768 (size_t)0U); 4769 } 4770 4771 /** 4772 A monomorphic instance of libcrux_sha3.generic_keccak.xof.KeccakXofState 4773 with types uint64_t 4774 with const generics 4775 - $1size_t 4776 - $136size_t 4777 */ 4778 typedef struct libcrux_sha3_generic_keccak_xof_KeccakXofState_e2_s { 4779 libcrux_sha3_generic_keccak_KeccakState_17 inner; 4780 uint8_t buf[1U][136U]; 4781 size_t buf_len; 4782 bool sponge; 4783 } libcrux_sha3_generic_keccak_xof_KeccakXofState_e2; 4784 4785 typedef libcrux_sha3_generic_keccak_xof_KeccakXofState_e2 4786 libcrux_sha3_portable_incremental_Shake256Xof; 4787 4788 /** 4789 This function found in impl 4790 {libcrux_sha3::generic_keccak::xof::KeccakXofState<STATE, PARALLEL_LANES, 4791 RATE>[TraitClause@0, TraitClause@1]} 4792 */ 4793 /** 4794 A monomorphic instance of libcrux_sha3.generic_keccak.xof.fill_buffer_35 4795 with types uint64_t 4796 with const generics 4797 - PARALLEL_LANES= 1 4798 - RATE= 136 4799 */ 4800 static inline size_t libcrux_sha3_generic_keccak_xof_fill_buffer_35_c6( 4801 libcrux_sha3_generic_keccak_xof_KeccakXofState_e2 *self, 4802 Eurydice_slice *inputs) { 4803 size_t input_len = Eurydice_slice_len(inputs[0U], uint8_t); 4804 size_t consumed = (size_t)0U; 4805 if (self->buf_len > (size_t)0U) { 4806 if (self->buf_len + input_len >= (size_t)136U) { 4807 consumed = (size_t)136U - self->buf_len; 4808 for (size_t i = (size_t)0U; i < (size_t)1U; i++) { 4809 size_t i0 = i; 4810 Eurydice_slice uu____0 = Eurydice_array_to_subslice_from( 4811 (size_t)136U, self->buf[i0], self->buf_len, uint8_t, size_t, 4812 uint8_t[]); 4813 Eurydice_slice_copy( 4814 uu____0, 4815 Eurydice_slice_subslice_to(inputs[i0], consumed, uint8_t, size_t, 4816 uint8_t[]), 4817 uint8_t); 4818 } 4819 self->buf_len = self->buf_len + consumed; 4820 } 4821 } 4822 return consumed; 4823 } 4824 4825 /** 4826 This function found in impl 4827 {libcrux_sha3::generic_keccak::xof::KeccakXofState<STATE, PARALLEL_LANES, 4828 RATE>[TraitClause@0, TraitClause@1]} 4829 */ 4830 /** 4831 A monomorphic instance of libcrux_sha3.generic_keccak.xof.absorb_full_35 4832 with types uint64_t 4833 with const generics 4834 - PARALLEL_LANES= 1 4835 - RATE= 136 4836 */ 4837 static inline size_t libcrux_sha3_generic_keccak_xof_absorb_full_35_c6( 4838 libcrux_sha3_generic_keccak_xof_KeccakXofState_e2 *self, 4839 Eurydice_slice *inputs) { 4840 size_t input_consumed = 4841 libcrux_sha3_generic_keccak_xof_fill_buffer_35_c6(self, inputs); 4842 if (input_consumed > (size_t)0U) { 4843 Eurydice_slice borrowed[1U]; 4844 for (size_t i = (size_t)0U; i < (size_t)1U; i++) { 4845 uint8_t buf[136U] = {0U}; 4846 borrowed[i] = core_array___Array_T__N___as_slice((size_t)136U, buf, 4847 uint8_t, Eurydice_slice); 4848 } 4849 for (size_t i = (size_t)0U; i < (size_t)1U; i++) { 4850 size_t i0 = i; 4851 borrowed[i0] = 4852 Eurydice_array_to_slice((size_t)136U, self->buf[i0], uint8_t); 4853 } 4854 libcrux_sha3_simd_portable_load_block_a1_5b(&self->inner, borrowed, 4855 (size_t)0U); 4856 libcrux_sha3_generic_keccak_keccakf1600_80_04(&self->inner); 4857 self->buf_len = (size_t)0U; 4858 } 4859 size_t input_to_consume = 4860 Eurydice_slice_len(inputs[0U], uint8_t) - input_consumed; 4861 size_t num_blocks = input_to_consume / (size_t)136U; 4862 size_t remainder = input_to_consume % (size_t)136U; 4863 for (size_t i = (size_t)0U; i < num_blocks; i++) { 4864 size_t i0 = i; 4865 libcrux_sha3_simd_portable_load_block_a1_5b( 4866 &self->inner, inputs, input_consumed + i0 * (size_t)136U); 4867 libcrux_sha3_generic_keccak_keccakf1600_80_04(&self->inner); 4868 } 4869 return remainder; 4870 } 4871 4872 /** 4873 This function found in impl 4874 {libcrux_sha3::generic_keccak::xof::KeccakXofState<STATE, PARALLEL_LANES, 4875 RATE>[TraitClause@0, TraitClause@1]} 4876 */ 4877 /** 4878 A monomorphic instance of libcrux_sha3.generic_keccak.xof.absorb_35 4879 with types uint64_t 4880 with const generics 4881 - PARALLEL_LANES= 1 4882 - RATE= 136 4883 */ 4884 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_xof_absorb_35_c6( 4885 libcrux_sha3_generic_keccak_xof_KeccakXofState_e2 *self, 4886 Eurydice_slice *inputs) { 4887 size_t input_remainder_len = 4888 libcrux_sha3_generic_keccak_xof_absorb_full_35_c6(self, inputs); 4889 if (input_remainder_len > (size_t)0U) { 4890 size_t input_len = Eurydice_slice_len(inputs[0U], uint8_t); 4891 for (size_t i = (size_t)0U; i < (size_t)1U; i++) { 4892 size_t i0 = i; 4893 Eurydice_slice_copy(Eurydice_array_to_subslice3( 4894 self->buf[i0], self->buf_len, 4895 self->buf_len + input_remainder_len, uint8_t *), 4896 Eurydice_slice_subslice_from( 4897 inputs[i0], input_len - input_remainder_len, 4898 uint8_t, size_t, uint8_t[]), 4899 uint8_t); 4900 } 4901 self->buf_len = self->buf_len + input_remainder_len; 4902 } 4903 } 4904 4905 /** 4906 Shake256 absorb 4907 */ 4908 /** 4909 This function found in impl {libcrux_sha3::portable::incremental::Xof<136usize> 4910 for libcrux_sha3::portable::incremental::Shake256Xof} 4911 */ 4912 static inline void libcrux_sha3_portable_incremental_absorb_42( 4913 libcrux_sha3_generic_keccak_xof_KeccakXofState_e2 *self, 4914 Eurydice_slice input) { 4915 Eurydice_slice buf[1U] = {input}; 4916 libcrux_sha3_generic_keccak_xof_absorb_35_c6(self, buf); 4917 } 4918 4919 /** 4920 This function found in impl 4921 {libcrux_sha3::generic_keccak::xof::KeccakXofState<STATE, PARALLEL_LANES, 4922 RATE>[TraitClause@0, TraitClause@1]} 4923 */ 4924 /** 4925 A monomorphic instance of libcrux_sha3.generic_keccak.xof.absorb_final_35 4926 with types uint64_t 4927 with const generics 4928 - PARALLEL_LANES= 1 4929 - RATE= 136 4930 - DELIMITER= 31 4931 */ 4932 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_xof_absorb_final_35_9e( 4933 libcrux_sha3_generic_keccak_xof_KeccakXofState_e2 *self, 4934 Eurydice_slice *inputs) { 4935 libcrux_sha3_generic_keccak_xof_absorb_35_c6(self, inputs); 4936 Eurydice_slice borrowed[1U]; 4937 for (size_t i = (size_t)0U; i < (size_t)1U; i++) { 4938 uint8_t buf[136U] = {0U}; 4939 borrowed[i] = core_array___Array_T__N___as_slice((size_t)136U, buf, uint8_t, 4940 Eurydice_slice); 4941 } 4942 for (size_t i = (size_t)0U; i < (size_t)1U; i++) { 4943 size_t i0 = i; 4944 borrowed[i0] = 4945 Eurydice_array_to_slice((size_t)136U, self->buf[i0], uint8_t); 4946 } 4947 libcrux_sha3_simd_portable_load_last_a1_ad0(&self->inner, borrowed, 4948 (size_t)0U, self->buf_len); 4949 libcrux_sha3_generic_keccak_keccakf1600_80_04(&self->inner); 4950 } 4951 4952 /** 4953 Shake256 absorb final 4954 */ 4955 /** 4956 This function found in impl {libcrux_sha3::portable::incremental::Xof<136usize> 4957 for libcrux_sha3::portable::incremental::Shake256Xof} 4958 */ 4959 static inline void libcrux_sha3_portable_incremental_absorb_final_42( 4960 libcrux_sha3_generic_keccak_xof_KeccakXofState_e2 *self, 4961 Eurydice_slice input) { 4962 Eurydice_slice buf[1U] = {input}; 4963 libcrux_sha3_generic_keccak_xof_absorb_final_35_9e(self, buf); 4964 } 4965 4966 /** 4967 This function found in impl 4968 {libcrux_sha3::generic_keccak::xof::KeccakXofState<STATE, PARALLEL_LANES, 4969 RATE>[TraitClause@0, TraitClause@1]} 4970 */ 4971 /** 4972 A monomorphic instance of libcrux_sha3.generic_keccak.xof.zero_block_35 4973 with types uint64_t 4974 with const generics 4975 - PARALLEL_LANES= 1 4976 - RATE= 136 4977 */ 4978 static inline void libcrux_sha3_generic_keccak_xof_zero_block_35_c6( 4979 uint8_t ret[136U]) { 4980 memset(ret, 0U, 136U * sizeof(uint8_t)); 4981 } 4982 4983 /** 4984 This function found in impl 4985 {libcrux_sha3::generic_keccak::xof::KeccakXofState<STATE, PARALLEL_LANES, 4986 RATE>[TraitClause@0, TraitClause@1]} 4987 */ 4988 /** 4989 A monomorphic instance of libcrux_sha3.generic_keccak.xof.new_35 4990 with types uint64_t 4991 with const generics 4992 - PARALLEL_LANES= 1 4993 - RATE= 136 4994 */ 4995 static inline libcrux_sha3_generic_keccak_xof_KeccakXofState_e2 4996 libcrux_sha3_generic_keccak_xof_new_35_c6(void) { 4997 libcrux_sha3_generic_keccak_xof_KeccakXofState_e2 lit; 4998 lit.inner = libcrux_sha3_generic_keccak_new_80_04(); 4999 uint8_t repeat_expression[1U][136U]; 5000 for (size_t i = (size_t)0U; i < (size_t)1U; i++) { 5001 libcrux_sha3_generic_keccak_xof_zero_block_35_c6(repeat_expression[i]); 5002 } 5003 memcpy(lit.buf, repeat_expression, (size_t)1U * sizeof(uint8_t[136U])); 5004 lit.buf_len = (size_t)0U; 5005 lit.sponge = false; 5006 return lit; 5007 } 5008 5009 /** 5010 Shake256 new state 5011 */ 5012 /** 5013 This function found in impl {libcrux_sha3::portable::incremental::Xof<136usize> 5014 for libcrux_sha3::portable::incremental::Shake256Xof} 5015 */ 5016 static inline libcrux_sha3_generic_keccak_xof_KeccakXofState_e2 5017 libcrux_sha3_portable_incremental_new_42(void) { 5018 return libcrux_sha3_generic_keccak_xof_new_35_c6(); 5019 } 5020 5021 /** 5022 Squeeze `N` x `LEN` bytes. Only `N = 1` for now. 5023 */ 5024 /** 5025 This function found in impl 5026 {libcrux_sha3::generic_keccak::xof::KeccakXofState<STATE, 1usize, 5027 RATE>[TraitClause@0, TraitClause@1]} 5028 */ 5029 /** 5030 A monomorphic instance of libcrux_sha3.generic_keccak.xof.squeeze_85 5031 with types uint64_t 5032 with const generics 5033 - RATE= 136 5034 */ 5035 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_xof_squeeze_85_c7( 5036 libcrux_sha3_generic_keccak_xof_KeccakXofState_e2 *self, 5037 Eurydice_slice out) { 5038 if (self->sponge) { 5039 libcrux_sha3_generic_keccak_keccakf1600_80_04(&self->inner); 5040 } 5041 size_t out_len = Eurydice_slice_len(out, uint8_t); 5042 if (out_len > (size_t)0U) { 5043 if (out_len <= (size_t)136U) { 5044 libcrux_sha3_simd_portable_squeeze_13_5b(&self->inner, out, (size_t)0U, 5045 out_len); 5046 } else { 5047 size_t blocks = out_len / (size_t)136U; 5048 for (size_t i = (size_t)0U; i < blocks; i++) { 5049 size_t i0 = i; 5050 libcrux_sha3_generic_keccak_keccakf1600_80_04(&self->inner); 5051 libcrux_sha3_simd_portable_squeeze_13_5b( 5052 &self->inner, out, i0 * (size_t)136U, (size_t)136U); 5053 } 5054 size_t remaining = out_len % (size_t)136U; 5055 if (remaining > (size_t)0U) { 5056 libcrux_sha3_generic_keccak_keccakf1600_80_04(&self->inner); 5057 libcrux_sha3_simd_portable_squeeze_13_5b( 5058 &self->inner, out, blocks * (size_t)136U, remaining); 5059 } 5060 } 5061 self->sponge = true; 5062 } 5063 } 5064 5065 /** 5066 Shake256 squeeze 5067 */ 5068 /** 5069 This function found in impl {libcrux_sha3::portable::incremental::Xof<136usize> 5070 for libcrux_sha3::portable::incremental::Shake256Xof} 5071 */ 5072 static inline void libcrux_sha3_portable_incremental_squeeze_42( 5073 libcrux_sha3_generic_keccak_xof_KeccakXofState_e2 *self, 5074 Eurydice_slice out) { 5075 libcrux_sha3_generic_keccak_xof_squeeze_85_c7(self, out); 5076 } 5077 5078 /** 5079 A monomorphic instance of libcrux_sha3.generic_keccak.xof.KeccakXofState 5080 with types uint64_t 5081 with const generics 5082 - $1size_t 5083 - $168size_t 5084 */ 5085 typedef struct libcrux_sha3_generic_keccak_xof_KeccakXofState_97_s { 5086 libcrux_sha3_generic_keccak_KeccakState_17 inner; 5087 uint8_t buf[1U][168U]; 5088 size_t buf_len; 5089 bool sponge; 5090 } libcrux_sha3_generic_keccak_xof_KeccakXofState_97; 5091 5092 typedef libcrux_sha3_generic_keccak_xof_KeccakXofState_97 5093 libcrux_sha3_portable_incremental_Shake128Xof; 5094 5095 /** 5096 This function found in impl 5097 {libcrux_sha3::generic_keccak::xof::KeccakXofState<STATE, PARALLEL_LANES, 5098 RATE>[TraitClause@0, TraitClause@1]} 5099 */ 5100 /** 5101 A monomorphic instance of libcrux_sha3.generic_keccak.xof.fill_buffer_35 5102 with types uint64_t 5103 with const generics 5104 - PARALLEL_LANES= 1 5105 - RATE= 168 5106 */ 5107 static inline size_t libcrux_sha3_generic_keccak_xof_fill_buffer_35_c60( 5108 libcrux_sha3_generic_keccak_xof_KeccakXofState_97 *self, 5109 Eurydice_slice *inputs) { 5110 size_t input_len = Eurydice_slice_len(inputs[0U], uint8_t); 5111 size_t consumed = (size_t)0U; 5112 if (self->buf_len > (size_t)0U) { 5113 if (self->buf_len + input_len >= (size_t)168U) { 5114 consumed = (size_t)168U - self->buf_len; 5115 for (size_t i = (size_t)0U; i < (size_t)1U; i++) { 5116 size_t i0 = i; 5117 Eurydice_slice uu____0 = Eurydice_array_to_subslice_from( 5118 (size_t)168U, self->buf[i0], self->buf_len, uint8_t, size_t, 5119 uint8_t[]); 5120 Eurydice_slice_copy( 5121 uu____0, 5122 Eurydice_slice_subslice_to(inputs[i0], consumed, uint8_t, size_t, 5123 uint8_t[]), 5124 uint8_t); 5125 } 5126 self->buf_len = self->buf_len + consumed; 5127 } 5128 } 5129 return consumed; 5130 } 5131 5132 /** 5133 This function found in impl 5134 {libcrux_sha3::generic_keccak::xof::KeccakXofState<STATE, PARALLEL_LANES, 5135 RATE>[TraitClause@0, TraitClause@1]} 5136 */ 5137 /** 5138 A monomorphic instance of libcrux_sha3.generic_keccak.xof.absorb_full_35 5139 with types uint64_t 5140 with const generics 5141 - PARALLEL_LANES= 1 5142 - RATE= 168 5143 */ 5144 static inline size_t libcrux_sha3_generic_keccak_xof_absorb_full_35_c60( 5145 libcrux_sha3_generic_keccak_xof_KeccakXofState_97 *self, 5146 Eurydice_slice *inputs) { 5147 size_t input_consumed = 5148 libcrux_sha3_generic_keccak_xof_fill_buffer_35_c60(self, inputs); 5149 if (input_consumed > (size_t)0U) { 5150 Eurydice_slice borrowed[1U]; 5151 for (size_t i = (size_t)0U; i < (size_t)1U; i++) { 5152 uint8_t buf[168U] = {0U}; 5153 borrowed[i] = core_array___Array_T__N___as_slice((size_t)168U, buf, 5154 uint8_t, Eurydice_slice); 5155 } 5156 for (size_t i = (size_t)0U; i < (size_t)1U; i++) { 5157 size_t i0 = i; 5158 borrowed[i0] = 5159 Eurydice_array_to_slice((size_t)168U, self->buf[i0], uint8_t); 5160 } 5161 libcrux_sha3_simd_portable_load_block_a1_3a(&self->inner, borrowed, 5162 (size_t)0U); 5163 libcrux_sha3_generic_keccak_keccakf1600_80_04(&self->inner); 5164 self->buf_len = (size_t)0U; 5165 } 5166 size_t input_to_consume = 5167 Eurydice_slice_len(inputs[0U], uint8_t) - input_consumed; 5168 size_t num_blocks = input_to_consume / (size_t)168U; 5169 size_t remainder = input_to_consume % (size_t)168U; 5170 for (size_t i = (size_t)0U; i < num_blocks; i++) { 5171 size_t i0 = i; 5172 libcrux_sha3_simd_portable_load_block_a1_3a( 5173 &self->inner, inputs, input_consumed + i0 * (size_t)168U); 5174 libcrux_sha3_generic_keccak_keccakf1600_80_04(&self->inner); 5175 } 5176 return remainder; 5177 } 5178 5179 /** 5180 This function found in impl 5181 {libcrux_sha3::generic_keccak::xof::KeccakXofState<STATE, PARALLEL_LANES, 5182 RATE>[TraitClause@0, TraitClause@1]} 5183 */ 5184 /** 5185 A monomorphic instance of libcrux_sha3.generic_keccak.xof.absorb_35 5186 with types uint64_t 5187 with const generics 5188 - PARALLEL_LANES= 1 5189 - RATE= 168 5190 */ 5191 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_xof_absorb_35_c60( 5192 libcrux_sha3_generic_keccak_xof_KeccakXofState_97 *self, 5193 Eurydice_slice *inputs) { 5194 size_t input_remainder_len = 5195 libcrux_sha3_generic_keccak_xof_absorb_full_35_c60(self, inputs); 5196 if (input_remainder_len > (size_t)0U) { 5197 size_t input_len = Eurydice_slice_len(inputs[0U], uint8_t); 5198 for (size_t i = (size_t)0U; i < (size_t)1U; i++) { 5199 size_t i0 = i; 5200 Eurydice_slice_copy(Eurydice_array_to_subslice3( 5201 self->buf[i0], self->buf_len, 5202 self->buf_len + input_remainder_len, uint8_t *), 5203 Eurydice_slice_subslice_from( 5204 inputs[i0], input_len - input_remainder_len, 5205 uint8_t, size_t, uint8_t[]), 5206 uint8_t); 5207 } 5208 self->buf_len = self->buf_len + input_remainder_len; 5209 } 5210 } 5211 5212 /** 5213 This function found in impl {libcrux_sha3::portable::incremental::Xof<168usize> 5214 for libcrux_sha3::portable::incremental::Shake128Xof} 5215 */ 5216 static inline void libcrux_sha3_portable_incremental_absorb_26( 5217 libcrux_sha3_generic_keccak_xof_KeccakXofState_97 *self, 5218 Eurydice_slice input) { 5219 Eurydice_slice buf[1U] = {input}; 5220 libcrux_sha3_generic_keccak_xof_absorb_35_c60(self, buf); 5221 } 5222 5223 /** 5224 This function found in impl 5225 {libcrux_sha3::generic_keccak::xof::KeccakXofState<STATE, PARALLEL_LANES, 5226 RATE>[TraitClause@0, TraitClause@1]} 5227 */ 5228 /** 5229 A monomorphic instance of libcrux_sha3.generic_keccak.xof.absorb_final_35 5230 with types uint64_t 5231 with const generics 5232 - PARALLEL_LANES= 1 5233 - RATE= 168 5234 - DELIMITER= 31 5235 */ 5236 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_xof_absorb_final_35_9e0( 5237 libcrux_sha3_generic_keccak_xof_KeccakXofState_97 *self, 5238 Eurydice_slice *inputs) { 5239 libcrux_sha3_generic_keccak_xof_absorb_35_c60(self, inputs); 5240 Eurydice_slice borrowed[1U]; 5241 for (size_t i = (size_t)0U; i < (size_t)1U; i++) { 5242 uint8_t buf[168U] = {0U}; 5243 borrowed[i] = core_array___Array_T__N___as_slice((size_t)168U, buf, uint8_t, 5244 Eurydice_slice); 5245 } 5246 for (size_t i = (size_t)0U; i < (size_t)1U; i++) { 5247 size_t i0 = i; 5248 borrowed[i0] = 5249 Eurydice_array_to_slice((size_t)168U, self->buf[i0], uint8_t); 5250 } 5251 libcrux_sha3_simd_portable_load_last_a1_c6(&self->inner, borrowed, (size_t)0U, 5252 self->buf_len); 5253 libcrux_sha3_generic_keccak_keccakf1600_80_04(&self->inner); 5254 } 5255 5256 /** 5257 This function found in impl {libcrux_sha3::portable::incremental::Xof<168usize> 5258 for libcrux_sha3::portable::incremental::Shake128Xof} 5259 */ 5260 static inline void libcrux_sha3_portable_incremental_absorb_final_26( 5261 libcrux_sha3_generic_keccak_xof_KeccakXofState_97 *self, 5262 Eurydice_slice input) { 5263 Eurydice_slice buf[1U] = {input}; 5264 libcrux_sha3_generic_keccak_xof_absorb_final_35_9e0(self, buf); 5265 } 5266 5267 /** 5268 This function found in impl 5269 {libcrux_sha3::generic_keccak::xof::KeccakXofState<STATE, PARALLEL_LANES, 5270 RATE>[TraitClause@0, TraitClause@1]} 5271 */ 5272 /** 5273 A monomorphic instance of libcrux_sha3.generic_keccak.xof.zero_block_35 5274 with types uint64_t 5275 with const generics 5276 - PARALLEL_LANES= 1 5277 - RATE= 168 5278 */ 5279 static inline void libcrux_sha3_generic_keccak_xof_zero_block_35_c60( 5280 uint8_t ret[168U]) { 5281 memset(ret, 0U, 168U * sizeof(uint8_t)); 5282 } 5283 5284 /** 5285 This function found in impl 5286 {libcrux_sha3::generic_keccak::xof::KeccakXofState<STATE, PARALLEL_LANES, 5287 RATE>[TraitClause@0, TraitClause@1]} 5288 */ 5289 /** 5290 A monomorphic instance of libcrux_sha3.generic_keccak.xof.new_35 5291 with types uint64_t 5292 with const generics 5293 - PARALLEL_LANES= 1 5294 - RATE= 168 5295 */ 5296 static inline libcrux_sha3_generic_keccak_xof_KeccakXofState_97 5297 libcrux_sha3_generic_keccak_xof_new_35_c60(void) { 5298 libcrux_sha3_generic_keccak_xof_KeccakXofState_97 lit; 5299 lit.inner = libcrux_sha3_generic_keccak_new_80_04(); 5300 uint8_t repeat_expression[1U][168U]; 5301 for (size_t i = (size_t)0U; i < (size_t)1U; i++) { 5302 libcrux_sha3_generic_keccak_xof_zero_block_35_c60(repeat_expression[i]); 5303 } 5304 memcpy(lit.buf, repeat_expression, (size_t)1U * sizeof(uint8_t[168U])); 5305 lit.buf_len = (size_t)0U; 5306 lit.sponge = false; 5307 return lit; 5308 } 5309 5310 /** 5311 This function found in impl {libcrux_sha3::portable::incremental::Xof<168usize> 5312 for libcrux_sha3::portable::incremental::Shake128Xof} 5313 */ 5314 static inline libcrux_sha3_generic_keccak_xof_KeccakXofState_97 5315 libcrux_sha3_portable_incremental_new_26(void) { 5316 return libcrux_sha3_generic_keccak_xof_new_35_c60(); 5317 } 5318 5319 /** 5320 Squeeze `N` x `LEN` bytes. Only `N = 1` for now. 5321 */ 5322 /** 5323 This function found in impl 5324 {libcrux_sha3::generic_keccak::xof::KeccakXofState<STATE, 1usize, 5325 RATE>[TraitClause@0, TraitClause@1]} 5326 */ 5327 /** 5328 A monomorphic instance of libcrux_sha3.generic_keccak.xof.squeeze_85 5329 with types uint64_t 5330 with const generics 5331 - RATE= 168 5332 */ 5333 static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_xof_squeeze_85_13( 5334 libcrux_sha3_generic_keccak_xof_KeccakXofState_97 *self, 5335 Eurydice_slice out) { 5336 if (self->sponge) { 5337 libcrux_sha3_generic_keccak_keccakf1600_80_04(&self->inner); 5338 } 5339 size_t out_len = Eurydice_slice_len(out, uint8_t); 5340 if (out_len > (size_t)0U) { 5341 if (out_len <= (size_t)168U) { 5342 libcrux_sha3_simd_portable_squeeze_13_3a(&self->inner, out, (size_t)0U, 5343 out_len); 5344 } else { 5345 size_t blocks = out_len / (size_t)168U; 5346 for (size_t i = (size_t)0U; i < blocks; i++) { 5347 size_t i0 = i; 5348 libcrux_sha3_generic_keccak_keccakf1600_80_04(&self->inner); 5349 libcrux_sha3_simd_portable_squeeze_13_3a( 5350 &self->inner, out, i0 * (size_t)168U, (size_t)168U); 5351 } 5352 size_t remaining = out_len % (size_t)168U; 5353 if (remaining > (size_t)0U) { 5354 libcrux_sha3_generic_keccak_keccakf1600_80_04(&self->inner); 5355 libcrux_sha3_simd_portable_squeeze_13_3a( 5356 &self->inner, out, blocks * (size_t)168U, remaining); 5357 } 5358 } 5359 self->sponge = true; 5360 } 5361 } 5362 5363 /** 5364 Shake128 squeeze 5365 */ 5366 /** 5367 This function found in impl {libcrux_sha3::portable::incremental::Xof<168usize> 5368 for libcrux_sha3::portable::incremental::Shake128Xof} 5369 */ 5370 static inline void libcrux_sha3_portable_incremental_squeeze_26( 5371 libcrux_sha3_generic_keccak_xof_KeccakXofState_97 *self, 5372 Eurydice_slice out) { 5373 libcrux_sha3_generic_keccak_xof_squeeze_85_13(self, out); 5374 } 5375 5376 /** 5377 This function found in impl {core::clone::Clone for 5378 libcrux_sha3::portable::KeccakState} 5379 */ 5380 static inline libcrux_sha3_generic_keccak_KeccakState_17 5381 libcrux_sha3_portable_clone_fe( 5382 libcrux_sha3_generic_keccak_KeccakState_17 *self) { 5383 return self[0U]; 5384 } 5385 5386 /** 5387 This function found in impl {core::convert::From<libcrux_sha3::Algorithm> for 5388 u32} 5389 */ 5390 static inline uint32_t libcrux_sha3_from_6c(libcrux_sha3_Algorithm v) { 5391 switch (v) { 5392 case libcrux_sha3_Algorithm_Sha224: { 5393 break; 5394 } 5395 case libcrux_sha3_Algorithm_Sha256: { 5396 return 2U; 5397 } 5398 case libcrux_sha3_Algorithm_Sha384: { 5399 return 3U; 5400 } 5401 case libcrux_sha3_Algorithm_Sha512: { 5402 return 4U; 5403 } 5404 default: { 5405 KRML_HOST_EPRINTF("KaRaMeL incomplete match at %s:%d\n", __FILE__, 5406 __LINE__); 5407 KRML_HOST_EXIT(253U); 5408 } 5409 } 5410 return 1U; 5411 } 5412 5413 /** 5414 This function found in impl {core::convert::From<u32> for 5415 libcrux_sha3::Algorithm} 5416 */ 5417 static inline libcrux_sha3_Algorithm libcrux_sha3_from_29(uint32_t v) { 5418 switch (v) { 5419 case 1U: { 5420 break; 5421 } 5422 case 2U: { 5423 return libcrux_sha3_Algorithm_Sha256; 5424 } 5425 case 3U: { 5426 return libcrux_sha3_Algorithm_Sha384; 5427 } 5428 case 4U: { 5429 return libcrux_sha3_Algorithm_Sha512; 5430 } 5431 default: { 5432 KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, 5433 "panic!"); 5434 KRML_HOST_EXIT(255U); 5435 } 5436 } 5437 return libcrux_sha3_Algorithm_Sha224; 5438 } 5439 5440 #if defined(__cplusplus) 5441 } 5442 #endif 5443 5444 #define libcrux_sha3_portable_H_DEFINED 5445 #endif /* libcrux_sha3_portable_H */ 5446 5447 /* from libcrux/libcrux-ml-kem/extracts/c_header_only/generated/libcrux_mlkem768_portable.h */ 5448 /* 5449 * SPDX-FileCopyrightText: 2025 Cryspen Sarl <info (at) cryspen.com> 5450 * 5451 * SPDX-License-Identifier: MIT or Apache-2.0 5452 * 5453 * This code was generated with the following revisions: 5454 * Charon: 667d2fc98984ff7f3df989c2367e6c1fa4a000e7 5455 * Eurydice: 2381cbc416ef2ad0b561c362c500bc84f36b6785 5456 * Karamel: 80f5435f2fc505973c469a4afcc8d875cddd0d8b 5457 * F*: 71d8221589d4d438af3706d89cb653cf53e18aab 5458 * Libcrux: 68dfed5a4a9e40277f62828471c029afed1ecdcc 5459 */ 5460 5461 #ifndef libcrux_mlkem768_portable_H 5462 #define libcrux_mlkem768_portable_H 5463 5464 5465 #if defined(__cplusplus) 5466 extern "C" { 5467 #endif 5468 5469 5470 static inline void libcrux_ml_kem_hash_functions_portable_G( 5471 Eurydice_slice input, uint8_t ret[64U]) { 5472 uint8_t digest[64U] = {0U}; 5473 libcrux_sha3_portable_sha512( 5474 Eurydice_array_to_slice((size_t)64U, digest, uint8_t), input); 5475 memcpy(ret, digest, (size_t)64U * sizeof(uint8_t)); 5476 } 5477 5478 static inline void libcrux_ml_kem_hash_functions_portable_H( 5479 Eurydice_slice input, uint8_t ret[32U]) { 5480 uint8_t digest[32U] = {0U}; 5481 libcrux_sha3_portable_sha256( 5482 Eurydice_array_to_slice((size_t)32U, digest, uint8_t), input); 5483 memcpy(ret, digest, (size_t)32U * sizeof(uint8_t)); 5484 } 5485 5486 static const int16_t libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[128U] = 5487 {(int16_t)-1044, (int16_t)-758, (int16_t)-359, (int16_t)-1517, 5488 (int16_t)1493, (int16_t)1422, (int16_t)287, (int16_t)202, 5489 (int16_t)-171, (int16_t)622, (int16_t)1577, (int16_t)182, 5490 (int16_t)962, (int16_t)-1202, (int16_t)-1474, (int16_t)1468, 5491 (int16_t)573, (int16_t)-1325, (int16_t)264, (int16_t)383, 5492 (int16_t)-829, (int16_t)1458, (int16_t)-1602, (int16_t)-130, 5493 (int16_t)-681, (int16_t)1017, (int16_t)732, (int16_t)608, 5494 (int16_t)-1542, (int16_t)411, (int16_t)-205, (int16_t)-1571, 5495 (int16_t)1223, (int16_t)652, (int16_t)-552, (int16_t)1015, 5496 (int16_t)-1293, (int16_t)1491, (int16_t)-282, (int16_t)-1544, 5497 (int16_t)516, (int16_t)-8, (int16_t)-320, (int16_t)-666, 5498 (int16_t)-1618, (int16_t)-1162, (int16_t)126, (int16_t)1469, 5499 (int16_t)-853, (int16_t)-90, (int16_t)-271, (int16_t)830, 5500 (int16_t)107, (int16_t)-1421, (int16_t)-247, (int16_t)-951, 5501 (int16_t)-398, (int16_t)961, (int16_t)-1508, (int16_t)-725, 5502 (int16_t)448, (int16_t)-1065, (int16_t)677, (int16_t)-1275, 5503 (int16_t)-1103, (int16_t)430, (int16_t)555, (int16_t)843, 5504 (int16_t)-1251, (int16_t)871, (int16_t)1550, (int16_t)105, 5505 (int16_t)422, (int16_t)587, (int16_t)177, (int16_t)-235, 5506 (int16_t)-291, (int16_t)-460, (int16_t)1574, (int16_t)1653, 5507 (int16_t)-246, (int16_t)778, (int16_t)1159, (int16_t)-147, 5508 (int16_t)-777, (int16_t)1483, (int16_t)-602, (int16_t)1119, 5509 (int16_t)-1590, (int16_t)644, (int16_t)-872, (int16_t)349, 5510 (int16_t)418, (int16_t)329, (int16_t)-156, (int16_t)-75, 5511 (int16_t)817, (int16_t)1097, (int16_t)603, (int16_t)610, 5512 (int16_t)1322, (int16_t)-1285, (int16_t)-1465, (int16_t)384, 5513 (int16_t)-1215, (int16_t)-136, (int16_t)1218, (int16_t)-1335, 5514 (int16_t)-874, (int16_t)220, (int16_t)-1187, (int16_t)-1659, 5515 (int16_t)-1185, (int16_t)-1530, (int16_t)-1278, (int16_t)794, 5516 (int16_t)-1510, (int16_t)-854, (int16_t)-870, (int16_t)478, 5517 (int16_t)-108, (int16_t)-308, (int16_t)996, (int16_t)991, 5518 (int16_t)958, (int16_t)-1460, (int16_t)1522, (int16_t)1628}; 5519 5520 static KRML_MUSTINLINE int16_t libcrux_ml_kem_polynomial_zeta(size_t i) { 5521 return libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[i]; 5522 } 5523 5524 #define LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT ((size_t)16U) 5525 5526 #define LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR ((size_t)16U) 5527 5528 #define LIBCRUX_ML_KEM_VECTOR_TRAITS_MONTGOMERY_R_SQUARED_MOD_FIELD_MODULUS \ 5529 ((int16_t)1353) 5530 5531 #define LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS ((int16_t)3329) 5532 5533 #define LIBCRUX_ML_KEM_VECTOR_TRAITS_INVERSE_OF_MODULUS_MOD_MONTGOMERY_R \ 5534 (62209U) 5535 5536 typedef struct libcrux_ml_kem_vector_portable_vector_type_PortableVector_s { 5537 int16_t elements[16U]; 5538 } libcrux_ml_kem_vector_portable_vector_type_PortableVector; 5539 5540 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 5541 libcrux_ml_kem_vector_portable_vector_type_from_i16_array( 5542 Eurydice_slice array) { 5543 libcrux_ml_kem_vector_portable_vector_type_PortableVector lit; 5544 int16_t ret[16U]; 5545 Result_0a dst; 5546 Eurydice_slice_to_array2( 5547 &dst, Eurydice_slice_subslice3(array, (size_t)0U, (size_t)16U, int16_t *), 5548 Eurydice_slice, int16_t[16U], TryFromSliceError); 5549 unwrap_26_00(dst, ret); 5550 memcpy(lit.elements, ret, (size_t)16U * sizeof(int16_t)); 5551 return lit; 5552 } 5553 5554 /** 5555 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 5556 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 5557 */ 5558 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 5559 libcrux_ml_kem_vector_portable_from_i16_array_b8(Eurydice_slice array) { 5560 return libcrux_ml_kem_vector_portable_vector_type_from_i16_array( 5561 libcrux_secrets_int_classify_public_classify_ref_9b_39(array)); 5562 } 5563 5564 typedef struct int16_t_x8_s { 5565 int16_t fst; 5566 int16_t snd; 5567 int16_t thd; 5568 int16_t f3; 5569 int16_t f4; 5570 int16_t f5; 5571 int16_t f6; 5572 int16_t f7; 5573 } int16_t_x8; 5574 5575 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 5576 libcrux_ml_kem_vector_portable_vector_type_zero(void) { 5577 libcrux_ml_kem_vector_portable_vector_type_PortableVector lit; 5578 int16_t ret[16U]; 5579 int16_t buf[16U] = {0U}; 5580 libcrux_secrets_int_public_integers_classify_27_46(buf, ret); 5581 memcpy(lit.elements, ret, (size_t)16U * sizeof(int16_t)); 5582 return lit; 5583 } 5584 5585 /** 5586 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 5587 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 5588 */ 5589 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 5590 libcrux_ml_kem_vector_portable_ZERO_b8(void) { 5591 return libcrux_ml_kem_vector_portable_vector_type_zero(); 5592 } 5593 5594 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 5595 libcrux_ml_kem_vector_portable_arithmetic_add( 5596 libcrux_ml_kem_vector_portable_vector_type_PortableVector lhs, 5597 libcrux_ml_kem_vector_portable_vector_type_PortableVector *rhs) { 5598 for (size_t i = (size_t)0U; 5599 i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { 5600 size_t i0 = i; 5601 size_t uu____0 = i0; 5602 lhs.elements[uu____0] = lhs.elements[uu____0] + rhs->elements[i0]; 5603 } 5604 return lhs; 5605 } 5606 5607 /** 5608 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 5609 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 5610 */ 5611 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 5612 libcrux_ml_kem_vector_portable_add_b8( 5613 libcrux_ml_kem_vector_portable_vector_type_PortableVector lhs, 5614 libcrux_ml_kem_vector_portable_vector_type_PortableVector *rhs) { 5615 return libcrux_ml_kem_vector_portable_arithmetic_add(lhs, rhs); 5616 } 5617 5618 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 5619 libcrux_ml_kem_vector_portable_arithmetic_sub( 5620 libcrux_ml_kem_vector_portable_vector_type_PortableVector lhs, 5621 libcrux_ml_kem_vector_portable_vector_type_PortableVector *rhs) { 5622 for (size_t i = (size_t)0U; 5623 i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { 5624 size_t i0 = i; 5625 size_t uu____0 = i0; 5626 lhs.elements[uu____0] = lhs.elements[uu____0] - rhs->elements[i0]; 5627 } 5628 return lhs; 5629 } 5630 5631 /** 5632 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 5633 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 5634 */ 5635 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 5636 libcrux_ml_kem_vector_portable_sub_b8( 5637 libcrux_ml_kem_vector_portable_vector_type_PortableVector lhs, 5638 libcrux_ml_kem_vector_portable_vector_type_PortableVector *rhs) { 5639 return libcrux_ml_kem_vector_portable_arithmetic_sub(lhs, rhs); 5640 } 5641 5642 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 5643 libcrux_ml_kem_vector_portable_arithmetic_multiply_by_constant( 5644 libcrux_ml_kem_vector_portable_vector_type_PortableVector vec, int16_t c) { 5645 for (size_t i = (size_t)0U; 5646 i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { 5647 size_t i0 = i; 5648 size_t uu____0 = i0; 5649 vec.elements[uu____0] = vec.elements[uu____0] * c; 5650 } 5651 return vec; 5652 } 5653 5654 /** 5655 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 5656 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 5657 */ 5658 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 5659 libcrux_ml_kem_vector_portable_multiply_by_constant_b8( 5660 libcrux_ml_kem_vector_portable_vector_type_PortableVector vec, int16_t c) { 5661 return libcrux_ml_kem_vector_portable_arithmetic_multiply_by_constant(vec, c); 5662 } 5663 5664 /** 5665 Note: This function is not secret independent 5666 Only use with public values. 5667 */ 5668 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 5669 libcrux_ml_kem_vector_portable_arithmetic_cond_subtract_3329( 5670 libcrux_ml_kem_vector_portable_vector_type_PortableVector vec) { 5671 for (size_t i = (size_t)0U; 5672 i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { 5673 size_t i0 = i; 5674 if (libcrux_secrets_int_public_integers_declassify_d8_39( 5675 vec.elements[i0]) >= (int16_t)3329) { 5676 size_t uu____0 = i0; 5677 vec.elements[uu____0] = vec.elements[uu____0] - (int16_t)3329; 5678 } 5679 } 5680 return vec; 5681 } 5682 5683 /** 5684 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 5685 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 5686 */ 5687 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 5688 libcrux_ml_kem_vector_portable_cond_subtract_3329_b8( 5689 libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { 5690 return libcrux_ml_kem_vector_portable_arithmetic_cond_subtract_3329(v); 5691 } 5692 5693 #define LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_BARRETT_MULTIPLIER \ 5694 ((int32_t)20159) 5695 5696 #define LIBCRUX_ML_KEM_VECTOR_TRAITS_BARRETT_SHIFT ((int32_t)26) 5697 5698 #define LIBCRUX_ML_KEM_VECTOR_TRAITS_BARRETT_R \ 5699 ((int32_t)1 << (uint32_t)LIBCRUX_ML_KEM_VECTOR_TRAITS_BARRETT_SHIFT) 5700 5701 /** 5702 Signed Barrett Reduction 5703 5704 Given an input `value`, `barrett_reduce` outputs a representative `result` 5705 such that: 5706 5707 - result value (mod FIELD_MODULUS) 5708 - the absolute value of `result` is bound as follows: 5709 5710 `|result| FIELD_MODULUS / 2 (|value|/BARRETT_R + 1) 5711 5712 Note: The input bound is 28296 to prevent overflow in the multiplication of 5713 quotient by FIELD_MODULUS 5714 5715 */ 5716 static inline int16_t 5717 libcrux_ml_kem_vector_portable_arithmetic_barrett_reduce_element( 5718 int16_t value) { 5719 int32_t t = libcrux_secrets_int_as_i32_f5(value) * 5720 LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_BARRETT_MULTIPLIER + 5721 (LIBCRUX_ML_KEM_VECTOR_TRAITS_BARRETT_R >> 1U); 5722 int16_t quotient = libcrux_secrets_int_as_i16_36( 5723 t >> (uint32_t)LIBCRUX_ML_KEM_VECTOR_TRAITS_BARRETT_SHIFT); 5724 return value - quotient * LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS; 5725 } 5726 5727 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 5728 libcrux_ml_kem_vector_portable_arithmetic_barrett_reduce( 5729 libcrux_ml_kem_vector_portable_vector_type_PortableVector vec) { 5730 for (size_t i = (size_t)0U; 5731 i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { 5732 size_t i0 = i; 5733 int16_t vi = 5734 libcrux_ml_kem_vector_portable_arithmetic_barrett_reduce_element( 5735 vec.elements[i0]); 5736 vec.elements[i0] = vi; 5737 } 5738 return vec; 5739 } 5740 5741 /** 5742 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 5743 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 5744 */ 5745 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 5746 libcrux_ml_kem_vector_portable_barrett_reduce_b8( 5747 libcrux_ml_kem_vector_portable_vector_type_PortableVector vector) { 5748 return libcrux_ml_kem_vector_portable_arithmetic_barrett_reduce(vector); 5749 } 5750 5751 #define LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_MONTGOMERY_SHIFT (16U) 5752 5753 /** 5754 Signed Montgomery Reduction 5755 5756 Given an input `value`, `montgomery_reduce` outputs a representative `o` 5757 such that: 5758 5759 - o value MONTGOMERY_R^(-1) (mod FIELD_MODULUS) 5760 - the absolute value of `o` is bound as follows: 5761 5762 `|result| ceil(|value| / MONTGOMERY_R) + 1665 5763 5764 In particular, if `|value| FIELD_MODULUS-1 * FIELD_MODULUS-1`, then `|o| <= 5765 FIELD_MODULUS-1`. And, if `|value| pow2 16 * FIELD_MODULUS-1`, then `|o| <= 5766 FIELD_MODULUS + 1664 5767 5768 */ 5769 static inline int16_t 5770 libcrux_ml_kem_vector_portable_arithmetic_montgomery_reduce_element( 5771 int32_t value) { 5772 int32_t k = 5773 libcrux_secrets_int_as_i32_f5(libcrux_secrets_int_as_i16_36(value)) * 5774 libcrux_secrets_int_as_i32_b8( 5775 libcrux_secrets_int_public_integers_classify_27_df( 5776 LIBCRUX_ML_KEM_VECTOR_TRAITS_INVERSE_OF_MODULUS_MOD_MONTGOMERY_R)); 5777 int32_t k_times_modulus = 5778 libcrux_secrets_int_as_i32_f5(libcrux_secrets_int_as_i16_36(k)) * 5779 libcrux_secrets_int_as_i32_f5( 5780 libcrux_secrets_int_public_integers_classify_27_39( 5781 LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS)); 5782 int16_t c = libcrux_secrets_int_as_i16_36( 5783 k_times_modulus >> 5784 (uint32_t)LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_MONTGOMERY_SHIFT); 5785 int16_t value_high = libcrux_secrets_int_as_i16_36( 5786 value >> 5787 (uint32_t)LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_MONTGOMERY_SHIFT); 5788 return value_high - c; 5789 } 5790 5791 /** 5792 If `fe` is some field element 'x' of the Kyber field and `fer` is congruent to 5793 `y MONTGOMERY_R`, this procedure outputs a value that is congruent to 5794 `x y`, as follows: 5795 5796 `fe fer x y MONTGOMERY_R (mod FIELD_MODULUS)` 5797 5798 `montgomery_reduce` takes the value `x y MONTGOMERY_R` and outputs a 5799 representative `x y MONTGOMERY_R * MONTGOMERY_R^{-1} x y (mod 5800 FIELD_MODULUS)`. 5801 */ 5802 static KRML_MUSTINLINE int16_t 5803 libcrux_ml_kem_vector_portable_arithmetic_montgomery_multiply_fe_by_fer( 5804 int16_t fe, int16_t fer) { 5805 int32_t product = 5806 libcrux_secrets_int_as_i32_f5(fe) * libcrux_secrets_int_as_i32_f5(fer); 5807 return libcrux_ml_kem_vector_portable_arithmetic_montgomery_reduce_element( 5808 product); 5809 } 5810 5811 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 5812 libcrux_ml_kem_vector_portable_arithmetic_montgomery_multiply_by_constant( 5813 libcrux_ml_kem_vector_portable_vector_type_PortableVector vec, int16_t c) { 5814 for (size_t i = (size_t)0U; 5815 i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { 5816 size_t i0 = i; 5817 vec.elements[i0] = 5818 libcrux_ml_kem_vector_portable_arithmetic_montgomery_multiply_fe_by_fer( 5819 vec.elements[i0], c); 5820 } 5821 return vec; 5822 } 5823 5824 /** 5825 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 5826 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 5827 */ 5828 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 5829 libcrux_ml_kem_vector_portable_montgomery_multiply_by_constant_b8( 5830 libcrux_ml_kem_vector_portable_vector_type_PortableVector vector, 5831 int16_t constant) { 5832 return libcrux_ml_kem_vector_portable_arithmetic_montgomery_multiply_by_constant( 5833 vector, libcrux_secrets_int_public_integers_classify_27_39(constant)); 5834 } 5835 5836 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 5837 libcrux_ml_kem_vector_portable_arithmetic_bitwise_and_with_constant( 5838 libcrux_ml_kem_vector_portable_vector_type_PortableVector vec, int16_t c) { 5839 for (size_t i = (size_t)0U; 5840 i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { 5841 size_t i0 = i; 5842 size_t uu____0 = i0; 5843 vec.elements[uu____0] = vec.elements[uu____0] & c; 5844 } 5845 return vec; 5846 } 5847 5848 /** 5849 A monomorphic instance of libcrux_ml_kem.vector.portable.arithmetic.shift_right 5850 with const generics 5851 - SHIFT_BY= 15 5852 */ 5853 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 5854 libcrux_ml_kem_vector_portable_arithmetic_shift_right_ef( 5855 libcrux_ml_kem_vector_portable_vector_type_PortableVector vec) { 5856 for (size_t i = (size_t)0U; 5857 i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { 5858 size_t i0 = i; 5859 vec.elements[i0] = vec.elements[i0] >> (uint32_t)(int32_t)15; 5860 } 5861 return vec; 5862 } 5863 5864 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 5865 libcrux_ml_kem_vector_portable_arithmetic_to_unsigned_representative( 5866 libcrux_ml_kem_vector_portable_vector_type_PortableVector a) { 5867 libcrux_ml_kem_vector_portable_vector_type_PortableVector t = 5868 libcrux_ml_kem_vector_portable_arithmetic_shift_right_ef(a); 5869 libcrux_ml_kem_vector_portable_vector_type_PortableVector fm = 5870 libcrux_ml_kem_vector_portable_arithmetic_bitwise_and_with_constant( 5871 t, LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS); 5872 return libcrux_ml_kem_vector_portable_arithmetic_add(a, &fm); 5873 } 5874 5875 /** 5876 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 5877 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 5878 */ 5879 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 5880 libcrux_ml_kem_vector_portable_to_unsigned_representative_b8( 5881 libcrux_ml_kem_vector_portable_vector_type_PortableVector a) { 5882 return libcrux_ml_kem_vector_portable_arithmetic_to_unsigned_representative( 5883 a); 5884 } 5885 5886 /** 5887 The `compress_*` functions implement the `Compress` function specified in the 5888 NIST FIPS 203 standard (Page 18, Expression 4.5), which is defined as: 5889 5890 ```plaintext 5891 Compress_d: q -> _{2} 5892 Compress_d(x) = (2/q)x 5893 ``` 5894 5895 Since `x = x + 1/2` we have: 5896 5897 ```plaintext 5898 Compress_d(x) = (2/q)x + 1/2 5899 = (2^{d+1}x + q) / 2q 5900 ``` 5901 5902 For further information about the function implementations, consult the 5903 `implementation_notes.pdf` document in this directory. 5904 5905 The NIST FIPS 203 standard can be found at 5906 <https://csrc.nist.gov/pubs/fips/203/ipd>. 5907 */ 5908 static inline uint8_t 5909 libcrux_ml_kem_vector_portable_compress_compress_message_coefficient( 5910 uint16_t fe) { 5911 int16_t shifted = 5912 libcrux_secrets_int_public_integers_classify_27_39((int16_t)1664) - 5913 libcrux_secrets_int_as_i16_ca(fe); 5914 int16_t mask = shifted >> 15U; 5915 int16_t shifted_to_positive = mask ^ shifted; 5916 int16_t shifted_positive_in_range = shifted_to_positive - (int16_t)832; 5917 int16_t r0 = shifted_positive_in_range >> 15U; 5918 int16_t r1 = r0 & (int16_t)1; 5919 return libcrux_secrets_int_as_u8_f5(r1); 5920 } 5921 5922 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 5923 libcrux_ml_kem_vector_portable_compress_compress_1( 5924 libcrux_ml_kem_vector_portable_vector_type_PortableVector a) { 5925 for (size_t i = (size_t)0U; 5926 i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { 5927 size_t i0 = i; 5928 a.elements[i0] = libcrux_secrets_int_as_i16_59( 5929 libcrux_ml_kem_vector_portable_compress_compress_message_coefficient( 5930 libcrux_secrets_int_as_u16_f5(a.elements[i0]))); 5931 } 5932 return a; 5933 } 5934 5935 /** 5936 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 5937 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 5938 */ 5939 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 5940 libcrux_ml_kem_vector_portable_compress_1_b8( 5941 libcrux_ml_kem_vector_portable_vector_type_PortableVector a) { 5942 return libcrux_ml_kem_vector_portable_compress_compress_1(a); 5943 } 5944 5945 static KRML_MUSTINLINE uint32_t 5946 libcrux_ml_kem_vector_portable_arithmetic_get_n_least_significant_bits( 5947 uint8_t n, uint32_t value) { 5948 return value & ((1U << (uint32_t)n) - 1U); 5949 } 5950 5951 static inline int16_t 5952 libcrux_ml_kem_vector_portable_compress_compress_ciphertext_coefficient( 5953 uint8_t coefficient_bits, uint16_t fe) { 5954 uint64_t compressed = libcrux_secrets_int_as_u64_ca(fe) 5955 << (uint32_t)coefficient_bits; 5956 compressed = compressed + 1664ULL; 5957 compressed = compressed * 10321340ULL; 5958 compressed = compressed >> 35U; 5959 return libcrux_secrets_int_as_i16_b8( 5960 libcrux_ml_kem_vector_portable_arithmetic_get_n_least_significant_bits( 5961 coefficient_bits, libcrux_secrets_int_as_u32_a3(compressed))); 5962 } 5963 5964 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 5965 libcrux_ml_kem_vector_portable_compress_decompress_1( 5966 libcrux_ml_kem_vector_portable_vector_type_PortableVector a) { 5967 libcrux_ml_kem_vector_portable_vector_type_PortableVector z = 5968 libcrux_ml_kem_vector_portable_vector_type_zero(); 5969 libcrux_ml_kem_vector_portable_vector_type_PortableVector s = 5970 libcrux_ml_kem_vector_portable_arithmetic_sub(z, &a); 5971 libcrux_ml_kem_vector_portable_vector_type_PortableVector res = 5972 libcrux_ml_kem_vector_portable_arithmetic_bitwise_and_with_constant( 5973 s, (int16_t)1665); 5974 return res; 5975 } 5976 5977 /** 5978 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 5979 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 5980 */ 5981 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 5982 libcrux_ml_kem_vector_portable_decompress_1_b8( 5983 libcrux_ml_kem_vector_portable_vector_type_PortableVector a) { 5984 return libcrux_ml_kem_vector_portable_compress_decompress_1(a); 5985 } 5986 5987 static KRML_MUSTINLINE void libcrux_ml_kem_vector_portable_ntt_ntt_step( 5988 libcrux_ml_kem_vector_portable_vector_type_PortableVector *vec, 5989 int16_t zeta, size_t i, size_t j) { 5990 int16_t t = 5991 libcrux_ml_kem_vector_portable_arithmetic_montgomery_multiply_fe_by_fer( 5992 vec->elements[j], 5993 libcrux_secrets_int_public_integers_classify_27_39(zeta)); 5994 int16_t a_minus_t = vec->elements[i] - t; 5995 int16_t a_plus_t = vec->elements[i] + t; 5996 vec->elements[j] = a_minus_t; 5997 vec->elements[i] = a_plus_t; 5998 } 5999 6000 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 6001 libcrux_ml_kem_vector_portable_ntt_ntt_layer_1_step( 6002 libcrux_ml_kem_vector_portable_vector_type_PortableVector vec, 6003 int16_t zeta0, int16_t zeta1, int16_t zeta2, int16_t zeta3) { 6004 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta0, (size_t)0U, 6005 (size_t)2U); 6006 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta0, (size_t)1U, 6007 (size_t)3U); 6008 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta1, (size_t)4U, 6009 (size_t)6U); 6010 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta1, (size_t)5U, 6011 (size_t)7U); 6012 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta2, (size_t)8U, 6013 (size_t)10U); 6014 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta2, (size_t)9U, 6015 (size_t)11U); 6016 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta3, (size_t)12U, 6017 (size_t)14U); 6018 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta3, (size_t)13U, 6019 (size_t)15U); 6020 return vec; 6021 } 6022 6023 /** 6024 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 6025 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 6026 */ 6027 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 6028 libcrux_ml_kem_vector_portable_ntt_layer_1_step_b8( 6029 libcrux_ml_kem_vector_portable_vector_type_PortableVector a, int16_t zeta0, 6030 int16_t zeta1, int16_t zeta2, int16_t zeta3) { 6031 return libcrux_ml_kem_vector_portable_ntt_ntt_layer_1_step(a, zeta0, zeta1, 6032 zeta2, zeta3); 6033 } 6034 6035 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 6036 libcrux_ml_kem_vector_portable_ntt_ntt_layer_2_step( 6037 libcrux_ml_kem_vector_portable_vector_type_PortableVector vec, 6038 int16_t zeta0, int16_t zeta1) { 6039 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta0, (size_t)0U, 6040 (size_t)4U); 6041 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta0, (size_t)1U, 6042 (size_t)5U); 6043 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta0, (size_t)2U, 6044 (size_t)6U); 6045 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta0, (size_t)3U, 6046 (size_t)7U); 6047 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta1, (size_t)8U, 6048 (size_t)12U); 6049 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta1, (size_t)9U, 6050 (size_t)13U); 6051 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta1, (size_t)10U, 6052 (size_t)14U); 6053 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta1, (size_t)11U, 6054 (size_t)15U); 6055 return vec; 6056 } 6057 6058 /** 6059 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 6060 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 6061 */ 6062 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 6063 libcrux_ml_kem_vector_portable_ntt_layer_2_step_b8( 6064 libcrux_ml_kem_vector_portable_vector_type_PortableVector a, int16_t zeta0, 6065 int16_t zeta1) { 6066 return libcrux_ml_kem_vector_portable_ntt_ntt_layer_2_step(a, zeta0, zeta1); 6067 } 6068 6069 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 6070 libcrux_ml_kem_vector_portable_ntt_ntt_layer_3_step( 6071 libcrux_ml_kem_vector_portable_vector_type_PortableVector vec, 6072 int16_t zeta) { 6073 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta, (size_t)0U, 6074 (size_t)8U); 6075 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta, (size_t)1U, 6076 (size_t)9U); 6077 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta, (size_t)2U, 6078 (size_t)10U); 6079 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta, (size_t)3U, 6080 (size_t)11U); 6081 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta, (size_t)4U, 6082 (size_t)12U); 6083 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta, (size_t)5U, 6084 (size_t)13U); 6085 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta, (size_t)6U, 6086 (size_t)14U); 6087 libcrux_ml_kem_vector_portable_ntt_ntt_step(&vec, zeta, (size_t)7U, 6088 (size_t)15U); 6089 return vec; 6090 } 6091 6092 /** 6093 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 6094 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 6095 */ 6096 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 6097 libcrux_ml_kem_vector_portable_ntt_layer_3_step_b8( 6098 libcrux_ml_kem_vector_portable_vector_type_PortableVector a, int16_t zeta) { 6099 return libcrux_ml_kem_vector_portable_ntt_ntt_layer_3_step(a, zeta); 6100 } 6101 6102 static KRML_MUSTINLINE void libcrux_ml_kem_vector_portable_ntt_inv_ntt_step( 6103 libcrux_ml_kem_vector_portable_vector_type_PortableVector *vec, 6104 int16_t zeta, size_t i, size_t j) { 6105 int16_t a_minus_b = vec->elements[j] - vec->elements[i]; 6106 int16_t a_plus_b = vec->elements[j] + vec->elements[i]; 6107 int16_t o0 = libcrux_ml_kem_vector_portable_arithmetic_barrett_reduce_element( 6108 a_plus_b); 6109 int16_t o1 = 6110 libcrux_ml_kem_vector_portable_arithmetic_montgomery_multiply_fe_by_fer( 6111 a_minus_b, libcrux_secrets_int_public_integers_classify_27_39(zeta)); 6112 vec->elements[i] = o0; 6113 vec->elements[j] = o1; 6114 } 6115 6116 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 6117 libcrux_ml_kem_vector_portable_ntt_inv_ntt_layer_1_step( 6118 libcrux_ml_kem_vector_portable_vector_type_PortableVector vec, 6119 int16_t zeta0, int16_t zeta1, int16_t zeta2, int16_t zeta3) { 6120 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta0, (size_t)0U, 6121 (size_t)2U); 6122 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta0, (size_t)1U, 6123 (size_t)3U); 6124 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta1, (size_t)4U, 6125 (size_t)6U); 6126 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta1, (size_t)5U, 6127 (size_t)7U); 6128 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta2, (size_t)8U, 6129 (size_t)10U); 6130 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta2, (size_t)9U, 6131 (size_t)11U); 6132 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta3, (size_t)12U, 6133 (size_t)14U); 6134 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta3, (size_t)13U, 6135 (size_t)15U); 6136 return vec; 6137 } 6138 6139 /** 6140 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 6141 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 6142 */ 6143 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 6144 libcrux_ml_kem_vector_portable_inv_ntt_layer_1_step_b8( 6145 libcrux_ml_kem_vector_portable_vector_type_PortableVector a, int16_t zeta0, 6146 int16_t zeta1, int16_t zeta2, int16_t zeta3) { 6147 return libcrux_ml_kem_vector_portable_ntt_inv_ntt_layer_1_step( 6148 a, zeta0, zeta1, zeta2, zeta3); 6149 } 6150 6151 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 6152 libcrux_ml_kem_vector_portable_ntt_inv_ntt_layer_2_step( 6153 libcrux_ml_kem_vector_portable_vector_type_PortableVector vec, 6154 int16_t zeta0, int16_t zeta1) { 6155 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta0, (size_t)0U, 6156 (size_t)4U); 6157 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta0, (size_t)1U, 6158 (size_t)5U); 6159 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta0, (size_t)2U, 6160 (size_t)6U); 6161 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta0, (size_t)3U, 6162 (size_t)7U); 6163 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta1, (size_t)8U, 6164 (size_t)12U); 6165 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta1, (size_t)9U, 6166 (size_t)13U); 6167 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta1, (size_t)10U, 6168 (size_t)14U); 6169 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta1, (size_t)11U, 6170 (size_t)15U); 6171 return vec; 6172 } 6173 6174 /** 6175 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 6176 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 6177 */ 6178 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 6179 libcrux_ml_kem_vector_portable_inv_ntt_layer_2_step_b8( 6180 libcrux_ml_kem_vector_portable_vector_type_PortableVector a, int16_t zeta0, 6181 int16_t zeta1) { 6182 return libcrux_ml_kem_vector_portable_ntt_inv_ntt_layer_2_step(a, zeta0, 6183 zeta1); 6184 } 6185 6186 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 6187 libcrux_ml_kem_vector_portable_ntt_inv_ntt_layer_3_step( 6188 libcrux_ml_kem_vector_portable_vector_type_PortableVector vec, 6189 int16_t zeta) { 6190 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta, (size_t)0U, 6191 (size_t)8U); 6192 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta, (size_t)1U, 6193 (size_t)9U); 6194 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta, (size_t)2U, 6195 (size_t)10U); 6196 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta, (size_t)3U, 6197 (size_t)11U); 6198 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta, (size_t)4U, 6199 (size_t)12U); 6200 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta, (size_t)5U, 6201 (size_t)13U); 6202 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta, (size_t)6U, 6203 (size_t)14U); 6204 libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&vec, zeta, (size_t)7U, 6205 (size_t)15U); 6206 return vec; 6207 } 6208 6209 /** 6210 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 6211 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 6212 */ 6213 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 6214 libcrux_ml_kem_vector_portable_inv_ntt_layer_3_step_b8( 6215 libcrux_ml_kem_vector_portable_vector_type_PortableVector a, int16_t zeta) { 6216 return libcrux_ml_kem_vector_portable_ntt_inv_ntt_layer_3_step(a, zeta); 6217 } 6218 6219 /** 6220 Compute the product of two Kyber binomials with respect to the 6221 modulus `X - zeta`. 6222 6223 This function almost implements <strong>Algorithm 11</strong> of the 6224 NIST FIPS 203 standard, which is reproduced below: 6225 6226 ```plaintext 6227 Input: a, a, b, b q. 6228 Input: q. 6229 Output: c, c q. 6230 6231 c ab + ab 6232 c ab + ab 6233 return c, c 6234 ``` 6235 We say "almost" because the coefficients output by this function are in 6236 the Montgomery domain (unlike in the specification). 6237 6238 The NIST FIPS 203 standard can be found at 6239 <https://csrc.nist.gov/pubs/fips/203/ipd>. 6240 */ 6241 static KRML_MUSTINLINE void 6242 libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( 6243 libcrux_ml_kem_vector_portable_vector_type_PortableVector *a, 6244 libcrux_ml_kem_vector_portable_vector_type_PortableVector *b, int16_t zeta, 6245 size_t i, libcrux_ml_kem_vector_portable_vector_type_PortableVector *out) { 6246 int16_t ai = a->elements[(size_t)2U * i]; 6247 int16_t bi = b->elements[(size_t)2U * i]; 6248 int16_t aj = a->elements[(size_t)2U * i + (size_t)1U]; 6249 int16_t bj = b->elements[(size_t)2U * i + (size_t)1U]; 6250 int32_t ai_bi = 6251 libcrux_secrets_int_as_i32_f5(ai) * libcrux_secrets_int_as_i32_f5(bi); 6252 int32_t aj_bj_ = 6253 libcrux_secrets_int_as_i32_f5(aj) * libcrux_secrets_int_as_i32_f5(bj); 6254 int16_t aj_bj = 6255 libcrux_ml_kem_vector_portable_arithmetic_montgomery_reduce_element( 6256 aj_bj_); 6257 int32_t aj_bj_zeta = libcrux_secrets_int_as_i32_f5(aj_bj) * 6258 libcrux_secrets_int_as_i32_f5(zeta); 6259 int32_t ai_bi_aj_bj = ai_bi + aj_bj_zeta; 6260 int16_t o0 = 6261 libcrux_ml_kem_vector_portable_arithmetic_montgomery_reduce_element( 6262 ai_bi_aj_bj); 6263 int32_t ai_bj = 6264 libcrux_secrets_int_as_i32_f5(ai) * libcrux_secrets_int_as_i32_f5(bj); 6265 int32_t aj_bi = 6266 libcrux_secrets_int_as_i32_f5(aj) * libcrux_secrets_int_as_i32_f5(bi); 6267 int32_t ai_bj_aj_bi = ai_bj + aj_bi; 6268 int16_t o1 = 6269 libcrux_ml_kem_vector_portable_arithmetic_montgomery_reduce_element( 6270 ai_bj_aj_bi); 6271 out->elements[(size_t)2U * i] = o0; 6272 out->elements[(size_t)2U * i + (size_t)1U] = o1; 6273 } 6274 6275 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 6276 libcrux_ml_kem_vector_portable_ntt_ntt_multiply( 6277 libcrux_ml_kem_vector_portable_vector_type_PortableVector *lhs, 6278 libcrux_ml_kem_vector_portable_vector_type_PortableVector *rhs, 6279 int16_t zeta0, int16_t zeta1, int16_t zeta2, int16_t zeta3) { 6280 int16_t nzeta0 = -zeta0; 6281 int16_t nzeta1 = -zeta1; 6282 int16_t nzeta2 = -zeta2; 6283 int16_t nzeta3 = -zeta3; 6284 libcrux_ml_kem_vector_portable_vector_type_PortableVector out = 6285 libcrux_ml_kem_vector_portable_vector_type_zero(); 6286 libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( 6287 lhs, rhs, libcrux_secrets_int_public_integers_classify_27_39(zeta0), 6288 (size_t)0U, &out); 6289 libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( 6290 lhs, rhs, libcrux_secrets_int_public_integers_classify_27_39(nzeta0), 6291 (size_t)1U, &out); 6292 libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( 6293 lhs, rhs, libcrux_secrets_int_public_integers_classify_27_39(zeta1), 6294 (size_t)2U, &out); 6295 libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( 6296 lhs, rhs, libcrux_secrets_int_public_integers_classify_27_39(nzeta1), 6297 (size_t)3U, &out); 6298 libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( 6299 lhs, rhs, libcrux_secrets_int_public_integers_classify_27_39(zeta2), 6300 (size_t)4U, &out); 6301 libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( 6302 lhs, rhs, libcrux_secrets_int_public_integers_classify_27_39(nzeta2), 6303 (size_t)5U, &out); 6304 libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( 6305 lhs, rhs, libcrux_secrets_int_public_integers_classify_27_39(zeta3), 6306 (size_t)6U, &out); 6307 libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( 6308 lhs, rhs, libcrux_secrets_int_public_integers_classify_27_39(nzeta3), 6309 (size_t)7U, &out); 6310 return out; 6311 } 6312 6313 /** 6314 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 6315 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 6316 */ 6317 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 6318 libcrux_ml_kem_vector_portable_ntt_multiply_b8( 6319 libcrux_ml_kem_vector_portable_vector_type_PortableVector *lhs, 6320 libcrux_ml_kem_vector_portable_vector_type_PortableVector *rhs, 6321 int16_t zeta0, int16_t zeta1, int16_t zeta2, int16_t zeta3) { 6322 return libcrux_ml_kem_vector_portable_ntt_ntt_multiply(lhs, rhs, zeta0, zeta1, 6323 zeta2, zeta3); 6324 } 6325 6326 static KRML_MUSTINLINE void 6327 libcrux_ml_kem_vector_portable_serialize_serialize_1( 6328 libcrux_ml_kem_vector_portable_vector_type_PortableVector v, 6329 uint8_t ret[2U]) { 6330 uint8_t result0 = 6331 (((((((uint32_t)libcrux_secrets_int_as_u8_f5(v.elements[0U]) | 6332 (uint32_t)libcrux_secrets_int_as_u8_f5(v.elements[1U]) << 1U) | 6333 (uint32_t)libcrux_secrets_int_as_u8_f5(v.elements[2U]) << 2U) | 6334 (uint32_t)libcrux_secrets_int_as_u8_f5(v.elements[3U]) << 3U) | 6335 (uint32_t)libcrux_secrets_int_as_u8_f5(v.elements[4U]) << 4U) | 6336 (uint32_t)libcrux_secrets_int_as_u8_f5(v.elements[5U]) << 5U) | 6337 (uint32_t)libcrux_secrets_int_as_u8_f5(v.elements[6U]) << 6U) | 6338 (uint32_t)libcrux_secrets_int_as_u8_f5(v.elements[7U]) << 7U; 6339 uint8_t result1 = 6340 (((((((uint32_t)libcrux_secrets_int_as_u8_f5(v.elements[8U]) | 6341 (uint32_t)libcrux_secrets_int_as_u8_f5(v.elements[9U]) << 1U) | 6342 (uint32_t)libcrux_secrets_int_as_u8_f5(v.elements[10U]) << 2U) | 6343 (uint32_t)libcrux_secrets_int_as_u8_f5(v.elements[11U]) << 3U) | 6344 (uint32_t)libcrux_secrets_int_as_u8_f5(v.elements[12U]) << 4U) | 6345 (uint32_t)libcrux_secrets_int_as_u8_f5(v.elements[13U]) << 5U) | 6346 (uint32_t)libcrux_secrets_int_as_u8_f5(v.elements[14U]) << 6U) | 6347 (uint32_t)libcrux_secrets_int_as_u8_f5(v.elements[15U]) << 7U; 6348 ret[0U] = result0; 6349 ret[1U] = result1; 6350 } 6351 6352 static inline void libcrux_ml_kem_vector_portable_serialize_1( 6353 libcrux_ml_kem_vector_portable_vector_type_PortableVector a, 6354 uint8_t ret[2U]) { 6355 uint8_t ret0[2U]; 6356 libcrux_ml_kem_vector_portable_serialize_serialize_1(a, ret0); 6357 libcrux_secrets_int_public_integers_declassify_d8_d4(ret0, ret); 6358 } 6359 6360 /** 6361 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 6362 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 6363 */ 6364 static inline void libcrux_ml_kem_vector_portable_serialize_1_b8( 6365 libcrux_ml_kem_vector_portable_vector_type_PortableVector a, 6366 uint8_t ret[2U]) { 6367 libcrux_ml_kem_vector_portable_serialize_1(a, ret); 6368 } 6369 6370 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 6371 libcrux_ml_kem_vector_portable_serialize_deserialize_1(Eurydice_slice v) { 6372 int16_t result0 = libcrux_secrets_int_as_i16_59( 6373 (uint32_t)Eurydice_slice_index(v, (size_t)0U, uint8_t, uint8_t *) & 1U); 6374 int16_t result1 = libcrux_secrets_int_as_i16_59( 6375 (uint32_t)Eurydice_slice_index(v, (size_t)0U, uint8_t, uint8_t *) >> 1U & 6376 1U); 6377 int16_t result2 = libcrux_secrets_int_as_i16_59( 6378 (uint32_t)Eurydice_slice_index(v, (size_t)0U, uint8_t, uint8_t *) >> 2U & 6379 1U); 6380 int16_t result3 = libcrux_secrets_int_as_i16_59( 6381 (uint32_t)Eurydice_slice_index(v, (size_t)0U, uint8_t, uint8_t *) >> 3U & 6382 1U); 6383 int16_t result4 = libcrux_secrets_int_as_i16_59( 6384 (uint32_t)Eurydice_slice_index(v, (size_t)0U, uint8_t, uint8_t *) >> 4U & 6385 1U); 6386 int16_t result5 = libcrux_secrets_int_as_i16_59( 6387 (uint32_t)Eurydice_slice_index(v, (size_t)0U, uint8_t, uint8_t *) >> 5U & 6388 1U); 6389 int16_t result6 = libcrux_secrets_int_as_i16_59( 6390 (uint32_t)Eurydice_slice_index(v, (size_t)0U, uint8_t, uint8_t *) >> 6U & 6391 1U); 6392 int16_t result7 = libcrux_secrets_int_as_i16_59( 6393 (uint32_t)Eurydice_slice_index(v, (size_t)0U, uint8_t, uint8_t *) >> 7U & 6394 1U); 6395 int16_t result8 = libcrux_secrets_int_as_i16_59( 6396 (uint32_t)Eurydice_slice_index(v, (size_t)1U, uint8_t, uint8_t *) & 1U); 6397 int16_t result9 = libcrux_secrets_int_as_i16_59( 6398 (uint32_t)Eurydice_slice_index(v, (size_t)1U, uint8_t, uint8_t *) >> 1U & 6399 1U); 6400 int16_t result10 = libcrux_secrets_int_as_i16_59( 6401 (uint32_t)Eurydice_slice_index(v, (size_t)1U, uint8_t, uint8_t *) >> 2U & 6402 1U); 6403 int16_t result11 = libcrux_secrets_int_as_i16_59( 6404 (uint32_t)Eurydice_slice_index(v, (size_t)1U, uint8_t, uint8_t *) >> 3U & 6405 1U); 6406 int16_t result12 = libcrux_secrets_int_as_i16_59( 6407 (uint32_t)Eurydice_slice_index(v, (size_t)1U, uint8_t, uint8_t *) >> 4U & 6408 1U); 6409 int16_t result13 = libcrux_secrets_int_as_i16_59( 6410 (uint32_t)Eurydice_slice_index(v, (size_t)1U, uint8_t, uint8_t *) >> 5U & 6411 1U); 6412 int16_t result14 = libcrux_secrets_int_as_i16_59( 6413 (uint32_t)Eurydice_slice_index(v, (size_t)1U, uint8_t, uint8_t *) >> 6U & 6414 1U); 6415 int16_t result15 = libcrux_secrets_int_as_i16_59( 6416 (uint32_t)Eurydice_slice_index(v, (size_t)1U, uint8_t, uint8_t *) >> 7U & 6417 1U); 6418 return ( 6419 KRML_CLITERAL(libcrux_ml_kem_vector_portable_vector_type_PortableVector){ 6420 .elements = {result0, result1, result2, result3, result4, result5, 6421 result6, result7, result8, result9, result10, result11, 6422 result12, result13, result14, result15}}); 6423 } 6424 6425 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 6426 libcrux_ml_kem_vector_portable_deserialize_1(Eurydice_slice a) { 6427 return libcrux_ml_kem_vector_portable_serialize_deserialize_1( 6428 libcrux_secrets_int_classify_public_classify_ref_9b_90(a)); 6429 } 6430 6431 /** 6432 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 6433 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 6434 */ 6435 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 6436 libcrux_ml_kem_vector_portable_deserialize_1_b8(Eurydice_slice a) { 6437 return libcrux_ml_kem_vector_portable_deserialize_1(a); 6438 } 6439 6440 typedef struct uint8_t_x4_s { 6441 uint8_t fst; 6442 uint8_t snd; 6443 uint8_t thd; 6444 uint8_t f3; 6445 } uint8_t_x4; 6446 6447 static KRML_MUSTINLINE uint8_t_x4 6448 libcrux_ml_kem_vector_portable_serialize_serialize_4_int(Eurydice_slice v) { 6449 uint8_t result0 = (uint32_t)libcrux_secrets_int_as_u8_f5( 6450 Eurydice_slice_index(v, (size_t)1U, int16_t, int16_t *)) 6451 << 4U | 6452 (uint32_t)libcrux_secrets_int_as_u8_f5(Eurydice_slice_index( 6453 v, (size_t)0U, int16_t, int16_t *)); 6454 uint8_t result1 = (uint32_t)libcrux_secrets_int_as_u8_f5( 6455 Eurydice_slice_index(v, (size_t)3U, int16_t, int16_t *)) 6456 << 4U | 6457 (uint32_t)libcrux_secrets_int_as_u8_f5(Eurydice_slice_index( 6458 v, (size_t)2U, int16_t, int16_t *)); 6459 uint8_t result2 = (uint32_t)libcrux_secrets_int_as_u8_f5( 6460 Eurydice_slice_index(v, (size_t)5U, int16_t, int16_t *)) 6461 << 4U | 6462 (uint32_t)libcrux_secrets_int_as_u8_f5(Eurydice_slice_index( 6463 v, (size_t)4U, int16_t, int16_t *)); 6464 uint8_t result3 = (uint32_t)libcrux_secrets_int_as_u8_f5( 6465 Eurydice_slice_index(v, (size_t)7U, int16_t, int16_t *)) 6466 << 4U | 6467 (uint32_t)libcrux_secrets_int_as_u8_f5(Eurydice_slice_index( 6468 v, (size_t)6U, int16_t, int16_t *)); 6469 return (KRML_CLITERAL(uint8_t_x4){ 6470 .fst = result0, .snd = result1, .thd = result2, .f3 = result3}); 6471 } 6472 6473 static KRML_MUSTINLINE void 6474 libcrux_ml_kem_vector_portable_serialize_serialize_4( 6475 libcrux_ml_kem_vector_portable_vector_type_PortableVector v, 6476 uint8_t ret[8U]) { 6477 uint8_t_x4 result0_3 = 6478 libcrux_ml_kem_vector_portable_serialize_serialize_4_int( 6479 Eurydice_array_to_subslice3(v.elements, (size_t)0U, (size_t)8U, 6480 int16_t *)); 6481 uint8_t_x4 result4_7 = 6482 libcrux_ml_kem_vector_portable_serialize_serialize_4_int( 6483 Eurydice_array_to_subslice3(v.elements, (size_t)8U, (size_t)16U, 6484 int16_t *)); 6485 ret[0U] = result0_3.fst; 6486 ret[1U] = result0_3.snd; 6487 ret[2U] = result0_3.thd; 6488 ret[3U] = result0_3.f3; 6489 ret[4U] = result4_7.fst; 6490 ret[5U] = result4_7.snd; 6491 ret[6U] = result4_7.thd; 6492 ret[7U] = result4_7.f3; 6493 } 6494 6495 static inline void libcrux_ml_kem_vector_portable_serialize_4( 6496 libcrux_ml_kem_vector_portable_vector_type_PortableVector a, 6497 uint8_t ret[8U]) { 6498 uint8_t ret0[8U]; 6499 libcrux_ml_kem_vector_portable_serialize_serialize_4(a, ret0); 6500 libcrux_secrets_int_public_integers_declassify_d8_76(ret0, ret); 6501 } 6502 6503 /** 6504 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 6505 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 6506 */ 6507 static inline void libcrux_ml_kem_vector_portable_serialize_4_b8( 6508 libcrux_ml_kem_vector_portable_vector_type_PortableVector a, 6509 uint8_t ret[8U]) { 6510 libcrux_ml_kem_vector_portable_serialize_4(a, ret); 6511 } 6512 6513 static KRML_MUSTINLINE int16_t_x8 6514 libcrux_ml_kem_vector_portable_serialize_deserialize_4_int( 6515 Eurydice_slice bytes) { 6516 int16_t v0 = libcrux_secrets_int_as_i16_59( 6517 (uint32_t)Eurydice_slice_index(bytes, (size_t)0U, uint8_t, uint8_t *) & 6518 15U); 6519 int16_t v1 = libcrux_secrets_int_as_i16_59( 6520 (uint32_t)Eurydice_slice_index(bytes, (size_t)0U, uint8_t, uint8_t *) >> 6521 4U & 6522 15U); 6523 int16_t v2 = libcrux_secrets_int_as_i16_59( 6524 (uint32_t)Eurydice_slice_index(bytes, (size_t)1U, uint8_t, uint8_t *) & 6525 15U); 6526 int16_t v3 = libcrux_secrets_int_as_i16_59( 6527 (uint32_t)Eurydice_slice_index(bytes, (size_t)1U, uint8_t, uint8_t *) >> 6528 4U & 6529 15U); 6530 int16_t v4 = libcrux_secrets_int_as_i16_59( 6531 (uint32_t)Eurydice_slice_index(bytes, (size_t)2U, uint8_t, uint8_t *) & 6532 15U); 6533 int16_t v5 = libcrux_secrets_int_as_i16_59( 6534 (uint32_t)Eurydice_slice_index(bytes, (size_t)2U, uint8_t, uint8_t *) >> 6535 4U & 6536 15U); 6537 int16_t v6 = libcrux_secrets_int_as_i16_59( 6538 (uint32_t)Eurydice_slice_index(bytes, (size_t)3U, uint8_t, uint8_t *) & 6539 15U); 6540 int16_t v7 = libcrux_secrets_int_as_i16_59( 6541 (uint32_t)Eurydice_slice_index(bytes, (size_t)3U, uint8_t, uint8_t *) >> 6542 4U & 6543 15U); 6544 return (KRML_CLITERAL(int16_t_x8){.fst = v0, 6545 .snd = v1, 6546 .thd = v2, 6547 .f3 = v3, 6548 .f4 = v4, 6549 .f5 = v5, 6550 .f6 = v6, 6551 .f7 = v7}); 6552 } 6553 6554 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 6555 libcrux_ml_kem_vector_portable_serialize_deserialize_4(Eurydice_slice bytes) { 6556 int16_t_x8 v0_7 = libcrux_ml_kem_vector_portable_serialize_deserialize_4_int( 6557 Eurydice_slice_subslice3(bytes, (size_t)0U, (size_t)4U, uint8_t *)); 6558 int16_t_x8 v8_15 = libcrux_ml_kem_vector_portable_serialize_deserialize_4_int( 6559 Eurydice_slice_subslice3(bytes, (size_t)4U, (size_t)8U, uint8_t *)); 6560 return ( 6561 KRML_CLITERAL(libcrux_ml_kem_vector_portable_vector_type_PortableVector){ 6562 .elements = {v0_7.fst, v0_7.snd, v0_7.thd, v0_7.f3, v0_7.f4, v0_7.f5, 6563 v0_7.f6, v0_7.f7, v8_15.fst, v8_15.snd, v8_15.thd, 6564 v8_15.f3, v8_15.f4, v8_15.f5, v8_15.f6, v8_15.f7}}); 6565 } 6566 6567 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 6568 libcrux_ml_kem_vector_portable_deserialize_4(Eurydice_slice a) { 6569 return libcrux_ml_kem_vector_portable_serialize_deserialize_4( 6570 libcrux_secrets_int_classify_public_classify_ref_9b_90(a)); 6571 } 6572 6573 /** 6574 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 6575 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 6576 */ 6577 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 6578 libcrux_ml_kem_vector_portable_deserialize_4_b8(Eurydice_slice a) { 6579 return libcrux_ml_kem_vector_portable_deserialize_4(a); 6580 } 6581 6582 typedef struct uint8_t_x5_s { 6583 uint8_t fst; 6584 uint8_t snd; 6585 uint8_t thd; 6586 uint8_t f3; 6587 uint8_t f4; 6588 } uint8_t_x5; 6589 6590 static KRML_MUSTINLINE uint8_t_x5 6591 libcrux_ml_kem_vector_portable_serialize_serialize_10_int(Eurydice_slice v) { 6592 uint8_t r0 = libcrux_secrets_int_as_u8_f5( 6593 Eurydice_slice_index(v, (size_t)0U, int16_t, int16_t *) & (int16_t)255); 6594 uint8_t r1 = 6595 (uint32_t)libcrux_secrets_int_as_u8_f5( 6596 Eurydice_slice_index(v, (size_t)1U, int16_t, int16_t *) & (int16_t)63) 6597 << 2U | 6598 (uint32_t)libcrux_secrets_int_as_u8_f5( 6599 Eurydice_slice_index(v, (size_t)0U, int16_t, int16_t *) >> 8U & 6600 (int16_t)3); 6601 uint8_t r2 = 6602 (uint32_t)libcrux_secrets_int_as_u8_f5( 6603 Eurydice_slice_index(v, (size_t)2U, int16_t, int16_t *) & (int16_t)15) 6604 << 4U | 6605 (uint32_t)libcrux_secrets_int_as_u8_f5( 6606 Eurydice_slice_index(v, (size_t)1U, int16_t, int16_t *) >> 6U & 6607 (int16_t)15); 6608 uint8_t r3 = 6609 (uint32_t)libcrux_secrets_int_as_u8_f5( 6610 Eurydice_slice_index(v, (size_t)3U, int16_t, int16_t *) & (int16_t)3) 6611 << 6U | 6612 (uint32_t)libcrux_secrets_int_as_u8_f5( 6613 Eurydice_slice_index(v, (size_t)2U, int16_t, int16_t *) >> 4U & 6614 (int16_t)63); 6615 uint8_t r4 = libcrux_secrets_int_as_u8_f5( 6616 Eurydice_slice_index(v, (size_t)3U, int16_t, int16_t *) >> 2U & 6617 (int16_t)255); 6618 return (KRML_CLITERAL(uint8_t_x5){ 6619 .fst = r0, .snd = r1, .thd = r2, .f3 = r3, .f4 = r4}); 6620 } 6621 6622 static KRML_MUSTINLINE void 6623 libcrux_ml_kem_vector_portable_serialize_serialize_10( 6624 libcrux_ml_kem_vector_portable_vector_type_PortableVector v, 6625 uint8_t ret[20U]) { 6626 uint8_t_x5 r0_4 = libcrux_ml_kem_vector_portable_serialize_serialize_10_int( 6627 Eurydice_array_to_subslice3(v.elements, (size_t)0U, (size_t)4U, 6628 int16_t *)); 6629 uint8_t_x5 r5_9 = libcrux_ml_kem_vector_portable_serialize_serialize_10_int( 6630 Eurydice_array_to_subslice3(v.elements, (size_t)4U, (size_t)8U, 6631 int16_t *)); 6632 uint8_t_x5 r10_14 = libcrux_ml_kem_vector_portable_serialize_serialize_10_int( 6633 Eurydice_array_to_subslice3(v.elements, (size_t)8U, (size_t)12U, 6634 int16_t *)); 6635 uint8_t_x5 r15_19 = libcrux_ml_kem_vector_portable_serialize_serialize_10_int( 6636 Eurydice_array_to_subslice3(v.elements, (size_t)12U, (size_t)16U, 6637 int16_t *)); 6638 ret[0U] = r0_4.fst; 6639 ret[1U] = r0_4.snd; 6640 ret[2U] = r0_4.thd; 6641 ret[3U] = r0_4.f3; 6642 ret[4U] = r0_4.f4; 6643 ret[5U] = r5_9.fst; 6644 ret[6U] = r5_9.snd; 6645 ret[7U] = r5_9.thd; 6646 ret[8U] = r5_9.f3; 6647 ret[9U] = r5_9.f4; 6648 ret[10U] = r10_14.fst; 6649 ret[11U] = r10_14.snd; 6650 ret[12U] = r10_14.thd; 6651 ret[13U] = r10_14.f3; 6652 ret[14U] = r10_14.f4; 6653 ret[15U] = r15_19.fst; 6654 ret[16U] = r15_19.snd; 6655 ret[17U] = r15_19.thd; 6656 ret[18U] = r15_19.f3; 6657 ret[19U] = r15_19.f4; 6658 } 6659 6660 static inline void libcrux_ml_kem_vector_portable_serialize_10( 6661 libcrux_ml_kem_vector_portable_vector_type_PortableVector a, 6662 uint8_t ret[20U]) { 6663 uint8_t ret0[20U]; 6664 libcrux_ml_kem_vector_portable_serialize_serialize_10(a, ret0); 6665 libcrux_secrets_int_public_integers_declassify_d8_57(ret0, ret); 6666 } 6667 6668 /** 6669 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 6670 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 6671 */ 6672 static inline void libcrux_ml_kem_vector_portable_serialize_10_b8( 6673 libcrux_ml_kem_vector_portable_vector_type_PortableVector a, 6674 uint8_t ret[20U]) { 6675 libcrux_ml_kem_vector_portable_serialize_10(a, ret); 6676 } 6677 6678 static KRML_MUSTINLINE int16_t_x8 6679 libcrux_ml_kem_vector_portable_serialize_deserialize_10_int( 6680 Eurydice_slice bytes) { 6681 int16_t r0 = libcrux_secrets_int_as_i16_f5( 6682 (libcrux_secrets_int_as_i16_59( 6683 Eurydice_slice_index(bytes, (size_t)1U, uint8_t, uint8_t *)) & 6684 (int16_t)3) 6685 << 8U | 6686 (libcrux_secrets_int_as_i16_59( 6687 Eurydice_slice_index(bytes, (size_t)0U, uint8_t, uint8_t *)) & 6688 (int16_t)255)); 6689 int16_t r1 = libcrux_secrets_int_as_i16_f5( 6690 (libcrux_secrets_int_as_i16_59( 6691 Eurydice_slice_index(bytes, (size_t)2U, uint8_t, uint8_t *)) & 6692 (int16_t)15) 6693 << 6U | 6694 libcrux_secrets_int_as_i16_59( 6695 Eurydice_slice_index(bytes, (size_t)1U, uint8_t, uint8_t *)) >> 6696 2U); 6697 int16_t r2 = libcrux_secrets_int_as_i16_f5( 6698 (libcrux_secrets_int_as_i16_59( 6699 Eurydice_slice_index(bytes, (size_t)3U, uint8_t, uint8_t *)) & 6700 (int16_t)63) 6701 << 4U | 6702 libcrux_secrets_int_as_i16_59( 6703 Eurydice_slice_index(bytes, (size_t)2U, uint8_t, uint8_t *)) >> 6704 4U); 6705 int16_t r3 = libcrux_secrets_int_as_i16_f5( 6706 libcrux_secrets_int_as_i16_59( 6707 Eurydice_slice_index(bytes, (size_t)4U, uint8_t, uint8_t *)) 6708 << 2U | 6709 libcrux_secrets_int_as_i16_59( 6710 Eurydice_slice_index(bytes, (size_t)3U, uint8_t, uint8_t *)) >> 6711 6U); 6712 int16_t r4 = libcrux_secrets_int_as_i16_f5( 6713 (libcrux_secrets_int_as_i16_59( 6714 Eurydice_slice_index(bytes, (size_t)6U, uint8_t, uint8_t *)) & 6715 (int16_t)3) 6716 << 8U | 6717 (libcrux_secrets_int_as_i16_59( 6718 Eurydice_slice_index(bytes, (size_t)5U, uint8_t, uint8_t *)) & 6719 (int16_t)255)); 6720 int16_t r5 = libcrux_secrets_int_as_i16_f5( 6721 (libcrux_secrets_int_as_i16_59( 6722 Eurydice_slice_index(bytes, (size_t)7U, uint8_t, uint8_t *)) & 6723 (int16_t)15) 6724 << 6U | 6725 libcrux_secrets_int_as_i16_59( 6726 Eurydice_slice_index(bytes, (size_t)6U, uint8_t, uint8_t *)) >> 6727 2U); 6728 int16_t r6 = libcrux_secrets_int_as_i16_f5( 6729 (libcrux_secrets_int_as_i16_59( 6730 Eurydice_slice_index(bytes, (size_t)8U, uint8_t, uint8_t *)) & 6731 (int16_t)63) 6732 << 4U | 6733 libcrux_secrets_int_as_i16_59( 6734 Eurydice_slice_index(bytes, (size_t)7U, uint8_t, uint8_t *)) >> 6735 4U); 6736 int16_t r7 = libcrux_secrets_int_as_i16_f5( 6737 libcrux_secrets_int_as_i16_59( 6738 Eurydice_slice_index(bytes, (size_t)9U, uint8_t, uint8_t *)) 6739 << 2U | 6740 libcrux_secrets_int_as_i16_59( 6741 Eurydice_slice_index(bytes, (size_t)8U, uint8_t, uint8_t *)) >> 6742 6U); 6743 return (KRML_CLITERAL(int16_t_x8){.fst = r0, 6744 .snd = r1, 6745 .thd = r2, 6746 .f3 = r3, 6747 .f4 = r4, 6748 .f5 = r5, 6749 .f6 = r6, 6750 .f7 = r7}); 6751 } 6752 6753 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 6754 libcrux_ml_kem_vector_portable_serialize_deserialize_10(Eurydice_slice bytes) { 6755 int16_t_x8 v0_7 = libcrux_ml_kem_vector_portable_serialize_deserialize_10_int( 6756 Eurydice_slice_subslice3(bytes, (size_t)0U, (size_t)10U, uint8_t *)); 6757 int16_t_x8 v8_15 = 6758 libcrux_ml_kem_vector_portable_serialize_deserialize_10_int( 6759 Eurydice_slice_subslice3(bytes, (size_t)10U, (size_t)20U, uint8_t *)); 6760 return ( 6761 KRML_CLITERAL(libcrux_ml_kem_vector_portable_vector_type_PortableVector){ 6762 .elements = {v0_7.fst, v0_7.snd, v0_7.thd, v0_7.f3, v0_7.f4, v0_7.f5, 6763 v0_7.f6, v0_7.f7, v8_15.fst, v8_15.snd, v8_15.thd, 6764 v8_15.f3, v8_15.f4, v8_15.f5, v8_15.f6, v8_15.f7}}); 6765 } 6766 6767 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 6768 libcrux_ml_kem_vector_portable_deserialize_10(Eurydice_slice a) { 6769 return libcrux_ml_kem_vector_portable_serialize_deserialize_10( 6770 libcrux_secrets_int_classify_public_classify_ref_9b_90(a)); 6771 } 6772 6773 /** 6774 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 6775 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 6776 */ 6777 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 6778 libcrux_ml_kem_vector_portable_deserialize_10_b8(Eurydice_slice a) { 6779 return libcrux_ml_kem_vector_portable_deserialize_10(a); 6780 } 6781 6782 typedef struct uint8_t_x3_s { 6783 uint8_t fst; 6784 uint8_t snd; 6785 uint8_t thd; 6786 } uint8_t_x3; 6787 6788 static KRML_MUSTINLINE uint8_t_x3 6789 libcrux_ml_kem_vector_portable_serialize_serialize_12_int(Eurydice_slice v) { 6790 uint8_t r0 = libcrux_secrets_int_as_u8_f5( 6791 Eurydice_slice_index(v, (size_t)0U, int16_t, int16_t *) & (int16_t)255); 6792 uint8_t r1 = libcrux_secrets_int_as_u8_f5( 6793 Eurydice_slice_index(v, (size_t)0U, int16_t, int16_t *) >> 8U | 6794 (Eurydice_slice_index(v, (size_t)1U, int16_t, int16_t *) & (int16_t)15) 6795 << 4U); 6796 uint8_t r2 = libcrux_secrets_int_as_u8_f5( 6797 Eurydice_slice_index(v, (size_t)1U, int16_t, int16_t *) >> 4U & 6798 (int16_t)255); 6799 return (KRML_CLITERAL(uint8_t_x3){.fst = r0, .snd = r1, .thd = r2}); 6800 } 6801 6802 static KRML_MUSTINLINE void 6803 libcrux_ml_kem_vector_portable_serialize_serialize_12( 6804 libcrux_ml_kem_vector_portable_vector_type_PortableVector v, 6805 uint8_t ret[24U]) { 6806 uint8_t_x3 r0_2 = libcrux_ml_kem_vector_portable_serialize_serialize_12_int( 6807 Eurydice_array_to_subslice3(v.elements, (size_t)0U, (size_t)2U, 6808 int16_t *)); 6809 uint8_t_x3 r3_5 = libcrux_ml_kem_vector_portable_serialize_serialize_12_int( 6810 Eurydice_array_to_subslice3(v.elements, (size_t)2U, (size_t)4U, 6811 int16_t *)); 6812 uint8_t_x3 r6_8 = libcrux_ml_kem_vector_portable_serialize_serialize_12_int( 6813 Eurydice_array_to_subslice3(v.elements, (size_t)4U, (size_t)6U, 6814 int16_t *)); 6815 uint8_t_x3 r9_11 = libcrux_ml_kem_vector_portable_serialize_serialize_12_int( 6816 Eurydice_array_to_subslice3(v.elements, (size_t)6U, (size_t)8U, 6817 int16_t *)); 6818 uint8_t_x3 r12_14 = libcrux_ml_kem_vector_portable_serialize_serialize_12_int( 6819 Eurydice_array_to_subslice3(v.elements, (size_t)8U, (size_t)10U, 6820 int16_t *)); 6821 uint8_t_x3 r15_17 = libcrux_ml_kem_vector_portable_serialize_serialize_12_int( 6822 Eurydice_array_to_subslice3(v.elements, (size_t)10U, (size_t)12U, 6823 int16_t *)); 6824 uint8_t_x3 r18_20 = libcrux_ml_kem_vector_portable_serialize_serialize_12_int( 6825 Eurydice_array_to_subslice3(v.elements, (size_t)12U, (size_t)14U, 6826 int16_t *)); 6827 uint8_t_x3 r21_23 = libcrux_ml_kem_vector_portable_serialize_serialize_12_int( 6828 Eurydice_array_to_subslice3(v.elements, (size_t)14U, (size_t)16U, 6829 int16_t *)); 6830 ret[0U] = r0_2.fst; 6831 ret[1U] = r0_2.snd; 6832 ret[2U] = r0_2.thd; 6833 ret[3U] = r3_5.fst; 6834 ret[4U] = r3_5.snd; 6835 ret[5U] = r3_5.thd; 6836 ret[6U] = r6_8.fst; 6837 ret[7U] = r6_8.snd; 6838 ret[8U] = r6_8.thd; 6839 ret[9U] = r9_11.fst; 6840 ret[10U] = r9_11.snd; 6841 ret[11U] = r9_11.thd; 6842 ret[12U] = r12_14.fst; 6843 ret[13U] = r12_14.snd; 6844 ret[14U] = r12_14.thd; 6845 ret[15U] = r15_17.fst; 6846 ret[16U] = r15_17.snd; 6847 ret[17U] = r15_17.thd; 6848 ret[18U] = r18_20.fst; 6849 ret[19U] = r18_20.snd; 6850 ret[20U] = r18_20.thd; 6851 ret[21U] = r21_23.fst; 6852 ret[22U] = r21_23.snd; 6853 ret[23U] = r21_23.thd; 6854 } 6855 6856 static inline void libcrux_ml_kem_vector_portable_serialize_12( 6857 libcrux_ml_kem_vector_portable_vector_type_PortableVector a, 6858 uint8_t ret[24U]) { 6859 uint8_t ret0[24U]; 6860 libcrux_ml_kem_vector_portable_serialize_serialize_12(a, ret0); 6861 libcrux_secrets_int_public_integers_declassify_d8_d2(ret0, ret); 6862 } 6863 6864 /** 6865 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 6866 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 6867 */ 6868 static inline void libcrux_ml_kem_vector_portable_serialize_12_b8( 6869 libcrux_ml_kem_vector_portable_vector_type_PortableVector a, 6870 uint8_t ret[24U]) { 6871 libcrux_ml_kem_vector_portable_serialize_12(a, ret); 6872 } 6873 6874 typedef struct int16_t_x2_s { 6875 int16_t fst; 6876 int16_t snd; 6877 } int16_t_x2; 6878 6879 static KRML_MUSTINLINE int16_t_x2 6880 libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( 6881 Eurydice_slice bytes) { 6882 int16_t byte0 = libcrux_secrets_int_as_i16_59( 6883 Eurydice_slice_index(bytes, (size_t)0U, uint8_t, uint8_t *)); 6884 int16_t byte1 = libcrux_secrets_int_as_i16_59( 6885 Eurydice_slice_index(bytes, (size_t)1U, uint8_t, uint8_t *)); 6886 int16_t byte2 = libcrux_secrets_int_as_i16_59( 6887 Eurydice_slice_index(bytes, (size_t)2U, uint8_t, uint8_t *)); 6888 int16_t r0 = (byte1 & (int16_t)15) << 8U | (byte0 & (int16_t)255); 6889 int16_t r1 = byte2 << 4U | (byte1 >> 4U & (int16_t)15); 6890 return (KRML_CLITERAL(int16_t_x2){.fst = r0, .snd = r1}); 6891 } 6892 6893 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 6894 libcrux_ml_kem_vector_portable_serialize_deserialize_12(Eurydice_slice bytes) { 6895 int16_t_x2 v0_1 = libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( 6896 Eurydice_slice_subslice3(bytes, (size_t)0U, (size_t)3U, uint8_t *)); 6897 int16_t_x2 v2_3 = libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( 6898 Eurydice_slice_subslice3(bytes, (size_t)3U, (size_t)6U, uint8_t *)); 6899 int16_t_x2 v4_5 = libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( 6900 Eurydice_slice_subslice3(bytes, (size_t)6U, (size_t)9U, uint8_t *)); 6901 int16_t_x2 v6_7 = libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( 6902 Eurydice_slice_subslice3(bytes, (size_t)9U, (size_t)12U, uint8_t *)); 6903 int16_t_x2 v8_9 = libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( 6904 Eurydice_slice_subslice3(bytes, (size_t)12U, (size_t)15U, uint8_t *)); 6905 int16_t_x2 v10_11 = 6906 libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( 6907 Eurydice_slice_subslice3(bytes, (size_t)15U, (size_t)18U, uint8_t *)); 6908 int16_t_x2 v12_13 = 6909 libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( 6910 Eurydice_slice_subslice3(bytes, (size_t)18U, (size_t)21U, uint8_t *)); 6911 int16_t_x2 v14_15 = 6912 libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( 6913 Eurydice_slice_subslice3(bytes, (size_t)21U, (size_t)24U, uint8_t *)); 6914 return ( 6915 KRML_CLITERAL(libcrux_ml_kem_vector_portable_vector_type_PortableVector){ 6916 .elements = {v0_1.fst, v0_1.snd, v2_3.fst, v2_3.snd, v4_5.fst, 6917 v4_5.snd, v6_7.fst, v6_7.snd, v8_9.fst, v8_9.snd, 6918 v10_11.fst, v10_11.snd, v12_13.fst, v12_13.snd, 6919 v14_15.fst, v14_15.snd}}); 6920 } 6921 6922 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 6923 libcrux_ml_kem_vector_portable_deserialize_12(Eurydice_slice a) { 6924 return libcrux_ml_kem_vector_portable_serialize_deserialize_12( 6925 libcrux_secrets_int_classify_public_classify_ref_9b_90(a)); 6926 } 6927 6928 /** 6929 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 6930 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 6931 */ 6932 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 6933 libcrux_ml_kem_vector_portable_deserialize_12_b8(Eurydice_slice a) { 6934 return libcrux_ml_kem_vector_portable_deserialize_12(a); 6935 } 6936 6937 static KRML_MUSTINLINE size_t 6938 libcrux_ml_kem_vector_portable_sampling_rej_sample(Eurydice_slice a, 6939 Eurydice_slice result) { 6940 size_t sampled = (size_t)0U; 6941 for (size_t i = (size_t)0U; i < Eurydice_slice_len(a, uint8_t) / (size_t)3U; 6942 i++) { 6943 size_t i0 = i; 6944 int16_t b1 = (int16_t)Eurydice_slice_index(a, i0 * (size_t)3U + (size_t)0U, 6945 uint8_t, uint8_t *); 6946 int16_t b2 = (int16_t)Eurydice_slice_index(a, i0 * (size_t)3U + (size_t)1U, 6947 uint8_t, uint8_t *); 6948 int16_t b3 = (int16_t)Eurydice_slice_index(a, i0 * (size_t)3U + (size_t)2U, 6949 uint8_t, uint8_t *); 6950 int16_t d1 = (b2 & (int16_t)15) << 8U | b1; 6951 int16_t d2 = b3 << 4U | b2 >> 4U; 6952 if (d1 < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS) { 6953 if (sampled < (size_t)16U) { 6954 Eurydice_slice_index(result, sampled, int16_t, int16_t *) = d1; 6955 sampled++; 6956 } 6957 } 6958 if (d2 < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS) { 6959 if (sampled < (size_t)16U) { 6960 Eurydice_slice_index(result, sampled, int16_t, int16_t *) = d2; 6961 sampled++; 6962 } 6963 } 6964 } 6965 return sampled; 6966 } 6967 6968 /** 6969 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 6970 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 6971 */ 6972 static inline size_t libcrux_ml_kem_vector_portable_rej_sample_b8( 6973 Eurydice_slice a, Eurydice_slice out) { 6974 return libcrux_ml_kem_vector_portable_sampling_rej_sample(a, out); 6975 } 6976 6977 #define LIBCRUX_ML_KEM_MLKEM768_VECTOR_U_COMPRESSION_FACTOR ((size_t)10U) 6978 6979 #define LIBCRUX_ML_KEM_MLKEM768_C1_BLOCK_SIZE \ 6980 (LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * \ 6981 LIBCRUX_ML_KEM_MLKEM768_VECTOR_U_COMPRESSION_FACTOR / (size_t)8U) 6982 6983 #define LIBCRUX_ML_KEM_MLKEM768_RANK ((size_t)3U) 6984 6985 #define LIBCRUX_ML_KEM_MLKEM768_C1_SIZE \ 6986 (LIBCRUX_ML_KEM_MLKEM768_C1_BLOCK_SIZE * LIBCRUX_ML_KEM_MLKEM768_RANK) 6987 6988 #define LIBCRUX_ML_KEM_MLKEM768_VECTOR_V_COMPRESSION_FACTOR ((size_t)4U) 6989 6990 #define LIBCRUX_ML_KEM_MLKEM768_C2_SIZE \ 6991 (LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * \ 6992 LIBCRUX_ML_KEM_MLKEM768_VECTOR_V_COMPRESSION_FACTOR / (size_t)8U) 6993 6994 #define LIBCRUX_ML_KEM_MLKEM768_CPA_PKE_CIPHERTEXT_SIZE \ 6995 (LIBCRUX_ML_KEM_MLKEM768_C1_SIZE + LIBCRUX_ML_KEM_MLKEM768_C2_SIZE) 6996 6997 #define LIBCRUX_ML_KEM_MLKEM768_T_AS_NTT_ENCODED_SIZE \ 6998 (LIBCRUX_ML_KEM_MLKEM768_RANK * \ 6999 LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * \ 7000 LIBCRUX_ML_KEM_CONSTANTS_BITS_PER_COEFFICIENT / (size_t)8U) 7001 7002 #define LIBCRUX_ML_KEM_MLKEM768_CPA_PKE_PUBLIC_KEY_SIZE \ 7003 (LIBCRUX_ML_KEM_MLKEM768_T_AS_NTT_ENCODED_SIZE + (size_t)32U) 7004 7005 #define LIBCRUX_ML_KEM_MLKEM768_CPA_PKE_SECRET_KEY_SIZE \ 7006 (LIBCRUX_ML_KEM_MLKEM768_RANK * \ 7007 LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * \ 7008 LIBCRUX_ML_KEM_CONSTANTS_BITS_PER_COEFFICIENT / (size_t)8U) 7009 7010 #define LIBCRUX_ML_KEM_MLKEM768_ETA1 ((size_t)2U) 7011 7012 #define LIBCRUX_ML_KEM_MLKEM768_ETA1_RANDOMNESS_SIZE \ 7013 (LIBCRUX_ML_KEM_MLKEM768_ETA1 * (size_t)64U) 7014 7015 #define LIBCRUX_ML_KEM_MLKEM768_ETA2 ((size_t)2U) 7016 7017 #define LIBCRUX_ML_KEM_MLKEM768_ETA2_RANDOMNESS_SIZE \ 7018 (LIBCRUX_ML_KEM_MLKEM768_ETA2 * (size_t)64U) 7019 7020 #define LIBCRUX_ML_KEM_MLKEM768_IMPLICIT_REJECTION_HASH_INPUT_SIZE \ 7021 (LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE + \ 7022 LIBCRUX_ML_KEM_MLKEM768_CPA_PKE_CIPHERTEXT_SIZE) 7023 7024 typedef libcrux_ml_kem_types_MlKemPrivateKey_d9 7025 libcrux_ml_kem_mlkem768_MlKem768PrivateKey; 7026 7027 typedef libcrux_ml_kem_types_MlKemPublicKey_30 7028 libcrux_ml_kem_mlkem768_MlKem768PublicKey; 7029 7030 #define LIBCRUX_ML_KEM_MLKEM768_RANKED_BYTES_PER_RING_ELEMENT \ 7031 (LIBCRUX_ML_KEM_MLKEM768_RANK * \ 7032 LIBCRUX_ML_KEM_CONSTANTS_BITS_PER_RING_ELEMENT / (size_t)8U) 7033 7034 #define LIBCRUX_ML_KEM_MLKEM768_SECRET_KEY_SIZE \ 7035 (LIBCRUX_ML_KEM_MLKEM768_CPA_PKE_SECRET_KEY_SIZE + \ 7036 LIBCRUX_ML_KEM_MLKEM768_CPA_PKE_PUBLIC_KEY_SIZE + \ 7037 LIBCRUX_ML_KEM_CONSTANTS_H_DIGEST_SIZE + \ 7038 LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE) 7039 7040 /** 7041 A monomorphic instance of libcrux_ml_kem.polynomial.PolynomialRingElement 7042 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7043 7044 */ 7045 typedef struct libcrux_ml_kem_polynomial_PolynomialRingElement_1d_s { 7046 libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficients[16U]; 7047 } libcrux_ml_kem_polynomial_PolynomialRingElement_1d; 7048 7049 /** 7050 A monomorphic instance of 7051 libcrux_ml_kem.ind_cpa.unpacked.IndCpaPrivateKeyUnpacked with types 7052 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 7053 - $3size_t 7054 */ 7055 typedef struct libcrux_ml_kem_ind_cpa_unpacked_IndCpaPrivateKeyUnpacked_a0_s { 7056 libcrux_ml_kem_polynomial_PolynomialRingElement_1d secret_as_ntt[3U]; 7057 } libcrux_ml_kem_ind_cpa_unpacked_IndCpaPrivateKeyUnpacked_a0; 7058 7059 /** 7060 This function found in impl 7061 {libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 7062 TraitClause@1]} 7063 */ 7064 /** 7065 A monomorphic instance of libcrux_ml_kem.polynomial.ZERO_d6 7066 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7067 with const generics 7068 7069 */ 7070 static inline libcrux_ml_kem_polynomial_PolynomialRingElement_1d 7071 libcrux_ml_kem_polynomial_ZERO_d6_ea(void) { 7072 libcrux_ml_kem_polynomial_PolynomialRingElement_1d lit; 7073 libcrux_ml_kem_vector_portable_vector_type_PortableVector 7074 repeat_expression[16U]; 7075 for (size_t i = (size_t)0U; i < (size_t)16U; i++) { 7076 repeat_expression[i] = libcrux_ml_kem_vector_portable_ZERO_b8(); 7077 } 7078 memcpy(lit.coefficients, repeat_expression, 7079 (size_t)16U * 7080 sizeof(libcrux_ml_kem_vector_portable_vector_type_PortableVector)); 7081 return lit; 7082 } 7083 7084 /** 7085 This function found in impl {core::ops::function::FnMut<(usize), 7086 libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 7087 TraitClause@1]> for libcrux_ml_kem::ind_cpa::decrypt::closure<Vector, K, 7088 CIPHERTEXT_SIZE, VECTOR_U_ENCODED_SIZE, U_COMPRESSION_FACTOR, 7089 V_COMPRESSION_FACTOR>[TraitClause@0, TraitClause@1]} 7090 */ 7091 /** 7092 A monomorphic instance of libcrux_ml_kem.ind_cpa.decrypt.call_mut_0b 7093 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7094 with const generics 7095 - K= 3 7096 - CIPHERTEXT_SIZE= 1088 7097 - VECTOR_U_ENCODED_SIZE= 960 7098 - U_COMPRESSION_FACTOR= 10 7099 - V_COMPRESSION_FACTOR= 4 7100 */ 7101 static inline libcrux_ml_kem_polynomial_PolynomialRingElement_1d 7102 libcrux_ml_kem_ind_cpa_decrypt_call_mut_0b_42(void **_, size_t tupled_args) { 7103 return libcrux_ml_kem_polynomial_ZERO_d6_ea(); 7104 } 7105 7106 /** 7107 A monomorphic instance of 7108 libcrux_ml_kem.serialize.deserialize_to_uncompressed_ring_element with types 7109 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 7110 7111 */ 7112 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 7113 libcrux_ml_kem_serialize_deserialize_to_uncompressed_ring_element_ea( 7114 Eurydice_slice serialized) { 7115 libcrux_ml_kem_polynomial_PolynomialRingElement_1d re = 7116 libcrux_ml_kem_polynomial_ZERO_d6_ea(); 7117 for (size_t i = (size_t)0U; 7118 i < Eurydice_slice_len(serialized, uint8_t) / (size_t)24U; i++) { 7119 size_t i0 = i; 7120 Eurydice_slice bytes = 7121 Eurydice_slice_subslice3(serialized, i0 * (size_t)24U, 7122 i0 * (size_t)24U + (size_t)24U, uint8_t *); 7123 libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = 7124 libcrux_ml_kem_vector_portable_deserialize_12_b8(bytes); 7125 re.coefficients[i0] = uu____0; 7126 } 7127 return re; 7128 } 7129 7130 /** 7131 Call [`deserialize_to_uncompressed_ring_element`] for each ring element. 7132 */ 7133 /** 7134 A monomorphic instance of libcrux_ml_kem.ind_cpa.deserialize_vector 7135 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7136 with const generics 7137 - K= 3 7138 */ 7139 static KRML_MUSTINLINE void libcrux_ml_kem_ind_cpa_deserialize_vector_1b( 7140 Eurydice_slice secret_key, 7141 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *secret_as_ntt) { 7142 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 7143 size_t i0 = i; 7144 libcrux_ml_kem_polynomial_PolynomialRingElement_1d uu____0 = 7145 libcrux_ml_kem_serialize_deserialize_to_uncompressed_ring_element_ea( 7146 Eurydice_slice_subslice3( 7147 secret_key, 7148 i0 * LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT, 7149 (i0 + (size_t)1U) * 7150 LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT, 7151 uint8_t *)); 7152 secret_as_ntt[i0] = uu____0; 7153 } 7154 } 7155 7156 /** 7157 This function found in impl {core::ops::function::FnMut<(usize), 7158 libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 7159 TraitClause@1]> for 7160 libcrux_ml_kem::ind_cpa::deserialize_then_decompress_u::closure<Vector, K, 7161 CIPHERTEXT_SIZE, U_COMPRESSION_FACTOR>[TraitClause@0, TraitClause@1]} 7162 */ 7163 /** 7164 A monomorphic instance of 7165 libcrux_ml_kem.ind_cpa.deserialize_then_decompress_u.call_mut_35 with types 7166 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 7167 - K= 3 7168 - CIPHERTEXT_SIZE= 1088 7169 - U_COMPRESSION_FACTOR= 10 7170 */ 7171 static inline libcrux_ml_kem_polynomial_PolynomialRingElement_1d 7172 libcrux_ml_kem_ind_cpa_deserialize_then_decompress_u_call_mut_35_6c( 7173 void **_, size_t tupled_args) { 7174 return libcrux_ml_kem_polynomial_ZERO_d6_ea(); 7175 } 7176 7177 /** 7178 A monomorphic instance of 7179 libcrux_ml_kem.vector.portable.compress.decompress_ciphertext_coefficient with 7180 const generics 7181 - COEFFICIENT_BITS= 10 7182 */ 7183 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 7184 libcrux_ml_kem_vector_portable_compress_decompress_ciphertext_coefficient_ef( 7185 libcrux_ml_kem_vector_portable_vector_type_PortableVector a) { 7186 for (size_t i = (size_t)0U; 7187 i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { 7188 size_t i0 = i; 7189 int32_t decompressed = 7190 libcrux_secrets_int_as_i32_f5(a.elements[i0]) * 7191 libcrux_secrets_int_as_i32_f5( 7192 libcrux_secrets_int_public_integers_classify_27_39( 7193 LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS)); 7194 decompressed = (decompressed << 1U) + ((int32_t)1 << (uint32_t)(int32_t)10); 7195 decompressed = decompressed >> (uint32_t)((int32_t)10 + (int32_t)1); 7196 a.elements[i0] = libcrux_secrets_int_as_i16_36(decompressed); 7197 } 7198 return a; 7199 } 7200 7201 /** 7202 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 7203 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 7204 */ 7205 /** 7206 A monomorphic instance of 7207 libcrux_ml_kem.vector.portable.decompress_ciphertext_coefficient_b8 with const 7208 generics 7209 - COEFFICIENT_BITS= 10 7210 */ 7211 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 7212 libcrux_ml_kem_vector_portable_decompress_ciphertext_coefficient_b8_ef( 7213 libcrux_ml_kem_vector_portable_vector_type_PortableVector a) { 7214 return libcrux_ml_kem_vector_portable_compress_decompress_ciphertext_coefficient_ef( 7215 a); 7216 } 7217 7218 /** 7219 A monomorphic instance of 7220 libcrux_ml_kem.serialize.deserialize_then_decompress_10 with types 7221 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 7222 7223 */ 7224 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 7225 libcrux_ml_kem_serialize_deserialize_then_decompress_10_ea( 7226 Eurydice_slice serialized) { 7227 libcrux_ml_kem_polynomial_PolynomialRingElement_1d re = 7228 libcrux_ml_kem_polynomial_ZERO_d6_ea(); 7229 for (size_t i = (size_t)0U; 7230 i < Eurydice_slice_len(serialized, uint8_t) / (size_t)20U; i++) { 7231 size_t i0 = i; 7232 Eurydice_slice bytes = 7233 Eurydice_slice_subslice3(serialized, i0 * (size_t)20U, 7234 i0 * (size_t)20U + (size_t)20U, uint8_t *); 7235 libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficient = 7236 libcrux_ml_kem_vector_portable_deserialize_10_b8(bytes); 7237 libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = 7238 libcrux_ml_kem_vector_portable_decompress_ciphertext_coefficient_b8_ef( 7239 coefficient); 7240 re.coefficients[i0] = uu____0; 7241 } 7242 return re; 7243 } 7244 7245 /** 7246 A monomorphic instance of 7247 libcrux_ml_kem.serialize.deserialize_then_decompress_ring_element_u with types 7248 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 7249 - COMPRESSION_FACTOR= 10 7250 */ 7251 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 7252 libcrux_ml_kem_serialize_deserialize_then_decompress_ring_element_u_0a( 7253 Eurydice_slice serialized) { 7254 return libcrux_ml_kem_serialize_deserialize_then_decompress_10_ea(serialized); 7255 } 7256 7257 typedef struct libcrux_ml_kem_vector_portable_vector_type_PortableVector_x2_s { 7258 libcrux_ml_kem_vector_portable_vector_type_PortableVector fst; 7259 libcrux_ml_kem_vector_portable_vector_type_PortableVector snd; 7260 } libcrux_ml_kem_vector_portable_vector_type_PortableVector_x2; 7261 7262 /** 7263 A monomorphic instance of libcrux_ml_kem.ntt.ntt_layer_int_vec_step 7264 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7265 with const generics 7266 7267 */ 7268 static KRML_MUSTINLINE 7269 libcrux_ml_kem_vector_portable_vector_type_PortableVector_x2 7270 libcrux_ml_kem_ntt_ntt_layer_int_vec_step_ea( 7271 libcrux_ml_kem_vector_portable_vector_type_PortableVector a, 7272 libcrux_ml_kem_vector_portable_vector_type_PortableVector b, 7273 int16_t zeta_r) { 7274 libcrux_ml_kem_vector_portable_vector_type_PortableVector t = 7275 libcrux_ml_kem_vector_portable_montgomery_multiply_by_constant_b8(b, 7276 zeta_r); 7277 b = libcrux_ml_kem_vector_portable_sub_b8(a, &t); 7278 a = libcrux_ml_kem_vector_portable_add_b8(a, &t); 7279 return (KRML_CLITERAL( 7280 libcrux_ml_kem_vector_portable_vector_type_PortableVector_x2){.fst = a, 7281 .snd = b}); 7282 } 7283 7284 /** 7285 A monomorphic instance of libcrux_ml_kem.ntt.ntt_at_layer_4_plus 7286 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7287 with const generics 7288 7289 */ 7290 static KRML_MUSTINLINE void libcrux_ml_kem_ntt_ntt_at_layer_4_plus_ea( 7291 size_t *zeta_i, libcrux_ml_kem_polynomial_PolynomialRingElement_1d *re, 7292 size_t layer, size_t _initial_coefficient_bound) { 7293 size_t step = (size_t)1U << (uint32_t)layer; 7294 for (size_t i0 = (size_t)0U; i0 < (size_t)128U >> (uint32_t)layer; i0++) { 7295 size_t round = i0; 7296 zeta_i[0U] = zeta_i[0U] + (size_t)1U; 7297 size_t offset = round * step * (size_t)2U; 7298 size_t offset_vec = offset / (size_t)16U; 7299 size_t step_vec = step / (size_t)16U; 7300 for (size_t i = offset_vec; i < offset_vec + step_vec; i++) { 7301 size_t j = i; 7302 libcrux_ml_kem_vector_portable_vector_type_PortableVector_x2 uu____0 = 7303 libcrux_ml_kem_ntt_ntt_layer_int_vec_step_ea( 7304 re->coefficients[j], re->coefficients[j + step_vec], 7305 libcrux_ml_kem_polynomial_zeta(zeta_i[0U])); 7306 libcrux_ml_kem_vector_portable_vector_type_PortableVector x = uu____0.fst; 7307 libcrux_ml_kem_vector_portable_vector_type_PortableVector y = uu____0.snd; 7308 re->coefficients[j] = x; 7309 re->coefficients[j + step_vec] = y; 7310 } 7311 } 7312 } 7313 7314 /** 7315 A monomorphic instance of libcrux_ml_kem.ntt.ntt_at_layer_3 7316 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7317 with const generics 7318 7319 */ 7320 static KRML_MUSTINLINE void libcrux_ml_kem_ntt_ntt_at_layer_3_ea( 7321 size_t *zeta_i, libcrux_ml_kem_polynomial_PolynomialRingElement_1d *re, 7322 size_t _initial_coefficient_bound) { 7323 for (size_t i = (size_t)0U; i < (size_t)16U; i++) { 7324 size_t round = i; 7325 zeta_i[0U] = zeta_i[0U] + (size_t)1U; 7326 libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = 7327 libcrux_ml_kem_vector_portable_ntt_layer_3_step_b8( 7328 re->coefficients[round], 7329 libcrux_ml_kem_polynomial_zeta(zeta_i[0U])); 7330 re->coefficients[round] = uu____0; 7331 } 7332 } 7333 7334 /** 7335 A monomorphic instance of libcrux_ml_kem.ntt.ntt_at_layer_2 7336 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7337 with const generics 7338 7339 */ 7340 static KRML_MUSTINLINE void libcrux_ml_kem_ntt_ntt_at_layer_2_ea( 7341 size_t *zeta_i, libcrux_ml_kem_polynomial_PolynomialRingElement_1d *re, 7342 size_t _initial_coefficient_bound) { 7343 for (size_t i = (size_t)0U; i < (size_t)16U; i++) { 7344 size_t round = i; 7345 zeta_i[0U] = zeta_i[0U] + (size_t)1U; 7346 re->coefficients[round] = 7347 libcrux_ml_kem_vector_portable_ntt_layer_2_step_b8( 7348 re->coefficients[round], libcrux_ml_kem_polynomial_zeta(zeta_i[0U]), 7349 libcrux_ml_kem_polynomial_zeta(zeta_i[0U] + (size_t)1U)); 7350 zeta_i[0U] = zeta_i[0U] + (size_t)1U; 7351 } 7352 } 7353 7354 /** 7355 A monomorphic instance of libcrux_ml_kem.ntt.ntt_at_layer_1 7356 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7357 with const generics 7358 7359 */ 7360 static KRML_MUSTINLINE void libcrux_ml_kem_ntt_ntt_at_layer_1_ea( 7361 size_t *zeta_i, libcrux_ml_kem_polynomial_PolynomialRingElement_1d *re, 7362 size_t _initial_coefficient_bound) { 7363 for (size_t i = (size_t)0U; i < (size_t)16U; i++) { 7364 size_t round = i; 7365 zeta_i[0U] = zeta_i[0U] + (size_t)1U; 7366 re->coefficients[round] = 7367 libcrux_ml_kem_vector_portable_ntt_layer_1_step_b8( 7368 re->coefficients[round], libcrux_ml_kem_polynomial_zeta(zeta_i[0U]), 7369 libcrux_ml_kem_polynomial_zeta(zeta_i[0U] + (size_t)1U), 7370 libcrux_ml_kem_polynomial_zeta(zeta_i[0U] + (size_t)2U), 7371 libcrux_ml_kem_polynomial_zeta(zeta_i[0U] + (size_t)3U)); 7372 zeta_i[0U] = zeta_i[0U] + (size_t)3U; 7373 } 7374 } 7375 7376 /** 7377 A monomorphic instance of libcrux_ml_kem.polynomial.poly_barrett_reduce 7378 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7379 with const generics 7380 7381 */ 7382 static KRML_MUSTINLINE void libcrux_ml_kem_polynomial_poly_barrett_reduce_ea( 7383 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *myself) { 7384 for (size_t i = (size_t)0U; 7385 i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { 7386 size_t i0 = i; 7387 libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = 7388 libcrux_ml_kem_vector_portable_barrett_reduce_b8( 7389 myself->coefficients[i0]); 7390 myself->coefficients[i0] = uu____0; 7391 } 7392 } 7393 7394 /** 7395 This function found in impl 7396 {libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 7397 TraitClause@1]} 7398 */ 7399 /** 7400 A monomorphic instance of libcrux_ml_kem.polynomial.poly_barrett_reduce_d6 7401 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7402 with const generics 7403 7404 */ 7405 static KRML_MUSTINLINE void libcrux_ml_kem_polynomial_poly_barrett_reduce_d6_ea( 7406 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *self) { 7407 libcrux_ml_kem_polynomial_poly_barrett_reduce_ea(self); 7408 } 7409 7410 /** 7411 A monomorphic instance of libcrux_ml_kem.ntt.ntt_vector_u 7412 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7413 with const generics 7414 - VECTOR_U_COMPRESSION_FACTOR= 10 7415 */ 7416 static KRML_MUSTINLINE void libcrux_ml_kem_ntt_ntt_vector_u_0a( 7417 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *re) { 7418 size_t zeta_i = (size_t)0U; 7419 libcrux_ml_kem_ntt_ntt_at_layer_4_plus_ea(&zeta_i, re, (size_t)7U, 7420 (size_t)3328U); 7421 libcrux_ml_kem_ntt_ntt_at_layer_4_plus_ea(&zeta_i, re, (size_t)6U, 7422 (size_t)2U * (size_t)3328U); 7423 libcrux_ml_kem_ntt_ntt_at_layer_4_plus_ea(&zeta_i, re, (size_t)5U, 7424 (size_t)3U * (size_t)3328U); 7425 libcrux_ml_kem_ntt_ntt_at_layer_4_plus_ea(&zeta_i, re, (size_t)4U, 7426 (size_t)4U * (size_t)3328U); 7427 libcrux_ml_kem_ntt_ntt_at_layer_3_ea(&zeta_i, re, (size_t)5U * (size_t)3328U); 7428 libcrux_ml_kem_ntt_ntt_at_layer_2_ea(&zeta_i, re, (size_t)6U * (size_t)3328U); 7429 libcrux_ml_kem_ntt_ntt_at_layer_1_ea(&zeta_i, re, (size_t)7U * (size_t)3328U); 7430 libcrux_ml_kem_polynomial_poly_barrett_reduce_d6_ea(re); 7431 } 7432 7433 /** 7434 Call [`deserialize_then_decompress_ring_element_u`] on each ring element 7435 in the `ciphertext`. 7436 */ 7437 /** 7438 A monomorphic instance of libcrux_ml_kem.ind_cpa.deserialize_then_decompress_u 7439 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7440 with const generics 7441 - K= 3 7442 - CIPHERTEXT_SIZE= 1088 7443 - U_COMPRESSION_FACTOR= 10 7444 */ 7445 static KRML_MUSTINLINE void 7446 libcrux_ml_kem_ind_cpa_deserialize_then_decompress_u_6c( 7447 uint8_t *ciphertext, 7448 libcrux_ml_kem_polynomial_PolynomialRingElement_1d ret[3U]) { 7449 libcrux_ml_kem_polynomial_PolynomialRingElement_1d u_as_ntt[3U]; 7450 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 7451 /* original Rust expression is not an lvalue in C */ 7452 void *lvalue = (void *)0U; 7453 u_as_ntt[i] = 7454 libcrux_ml_kem_ind_cpa_deserialize_then_decompress_u_call_mut_35_6c( 7455 &lvalue, i); 7456 } 7457 for (size_t i = (size_t)0U; 7458 i < Eurydice_slice_len( 7459 Eurydice_array_to_slice((size_t)1088U, ciphertext, uint8_t), 7460 uint8_t) / 7461 (LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * 7462 (size_t)10U / (size_t)8U); 7463 i++) { 7464 size_t i0 = i; 7465 Eurydice_slice u_bytes = Eurydice_array_to_subslice3( 7466 ciphertext, 7467 i0 * (LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * 7468 (size_t)10U / (size_t)8U), 7469 i0 * (LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * 7470 (size_t)10U / (size_t)8U) + 7471 LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * 7472 (size_t)10U / (size_t)8U, 7473 uint8_t *); 7474 u_as_ntt[i0] = 7475 libcrux_ml_kem_serialize_deserialize_then_decompress_ring_element_u_0a( 7476 u_bytes); 7477 libcrux_ml_kem_ntt_ntt_vector_u_0a(&u_as_ntt[i0]); 7478 } 7479 memcpy( 7480 ret, u_as_ntt, 7481 (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d)); 7482 } 7483 7484 /** 7485 A monomorphic instance of 7486 libcrux_ml_kem.vector.portable.compress.decompress_ciphertext_coefficient with 7487 const generics 7488 - COEFFICIENT_BITS= 4 7489 */ 7490 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 7491 libcrux_ml_kem_vector_portable_compress_decompress_ciphertext_coefficient_d1( 7492 libcrux_ml_kem_vector_portable_vector_type_PortableVector a) { 7493 for (size_t i = (size_t)0U; 7494 i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { 7495 size_t i0 = i; 7496 int32_t decompressed = 7497 libcrux_secrets_int_as_i32_f5(a.elements[i0]) * 7498 libcrux_secrets_int_as_i32_f5( 7499 libcrux_secrets_int_public_integers_classify_27_39( 7500 LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS)); 7501 decompressed = (decompressed << 1U) + ((int32_t)1 << (uint32_t)(int32_t)4); 7502 decompressed = decompressed >> (uint32_t)((int32_t)4 + (int32_t)1); 7503 a.elements[i0] = libcrux_secrets_int_as_i16_36(decompressed); 7504 } 7505 return a; 7506 } 7507 7508 /** 7509 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 7510 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 7511 */ 7512 /** 7513 A monomorphic instance of 7514 libcrux_ml_kem.vector.portable.decompress_ciphertext_coefficient_b8 with const 7515 generics 7516 - COEFFICIENT_BITS= 4 7517 */ 7518 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 7519 libcrux_ml_kem_vector_portable_decompress_ciphertext_coefficient_b8_d1( 7520 libcrux_ml_kem_vector_portable_vector_type_PortableVector a) { 7521 return libcrux_ml_kem_vector_portable_compress_decompress_ciphertext_coefficient_d1( 7522 a); 7523 } 7524 7525 /** 7526 A monomorphic instance of libcrux_ml_kem.serialize.deserialize_then_decompress_4 7527 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7528 with const generics 7529 7530 */ 7531 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 7532 libcrux_ml_kem_serialize_deserialize_then_decompress_4_ea( 7533 Eurydice_slice serialized) { 7534 libcrux_ml_kem_polynomial_PolynomialRingElement_1d re = 7535 libcrux_ml_kem_polynomial_ZERO_d6_ea(); 7536 for (size_t i = (size_t)0U; 7537 i < Eurydice_slice_len(serialized, uint8_t) / (size_t)8U; i++) { 7538 size_t i0 = i; 7539 Eurydice_slice bytes = Eurydice_slice_subslice3( 7540 serialized, i0 * (size_t)8U, i0 * (size_t)8U + (size_t)8U, uint8_t *); 7541 libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficient = 7542 libcrux_ml_kem_vector_portable_deserialize_4_b8(bytes); 7543 libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = 7544 libcrux_ml_kem_vector_portable_decompress_ciphertext_coefficient_b8_d1( 7545 coefficient); 7546 re.coefficients[i0] = uu____0; 7547 } 7548 return re; 7549 } 7550 7551 /** 7552 A monomorphic instance of 7553 libcrux_ml_kem.serialize.deserialize_then_decompress_ring_element_v with types 7554 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 7555 - K= 3 7556 - COMPRESSION_FACTOR= 4 7557 */ 7558 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 7559 libcrux_ml_kem_serialize_deserialize_then_decompress_ring_element_v_89( 7560 Eurydice_slice serialized) { 7561 return libcrux_ml_kem_serialize_deserialize_then_decompress_4_ea(serialized); 7562 } 7563 7564 /** 7565 A monomorphic instance of libcrux_ml_kem.polynomial.ZERO 7566 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7567 with const generics 7568 7569 */ 7570 static inline libcrux_ml_kem_polynomial_PolynomialRingElement_1d 7571 libcrux_ml_kem_polynomial_ZERO_ea(void) { 7572 libcrux_ml_kem_polynomial_PolynomialRingElement_1d lit; 7573 libcrux_ml_kem_vector_portable_vector_type_PortableVector 7574 repeat_expression[16U]; 7575 for (size_t i = (size_t)0U; i < (size_t)16U; i++) { 7576 repeat_expression[i] = libcrux_ml_kem_vector_portable_ZERO_b8(); 7577 } 7578 memcpy(lit.coefficients, repeat_expression, 7579 (size_t)16U * 7580 sizeof(libcrux_ml_kem_vector_portable_vector_type_PortableVector)); 7581 return lit; 7582 } 7583 7584 /** 7585 Given two `KyberPolynomialRingElement`s in their NTT representations, 7586 compute their product. Given two polynomials in the NTT domain `f^` and ``, 7587 the `i` coefficient of the product `k` is determined by the calculation: 7588 7589 ```plaintext 7590 [2i] + [2i + 1]X = (f^[2i] + f^[2i + 1]X)([2i] + [2i + 1]X) mod (X 7591 - ^(2BitRev(i) + 1)) 7592 ``` 7593 7594 This function almost implements <strong>Algorithm 10</strong> of the 7595 NIST FIPS 203 standard, which is reproduced below: 7596 7597 ```plaintext 7598 Input: Two arrays f and . 7599 Output: An array q. 7600 7601 for(i 0; i < 128; i++) 7602 ([2i], [2i+1]) BaseCaseMultiply(f[2i], f[2i+1], [2i], [2i+1], 7603 ^(2BitRev(i) + 1)) end for return 7604 ``` 7605 We say "almost" because the coefficients of the ring element output by 7606 this function are in the Montgomery domain. 7607 7608 The NIST FIPS 203 standard can be found at 7609 <https://csrc.nist.gov/pubs/fips/203/ipd>. 7610 */ 7611 /** 7612 A monomorphic instance of libcrux_ml_kem.polynomial.ntt_multiply 7613 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7614 with const generics 7615 7616 */ 7617 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 7618 libcrux_ml_kem_polynomial_ntt_multiply_ea( 7619 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *myself, 7620 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *rhs) { 7621 libcrux_ml_kem_polynomial_PolynomialRingElement_1d out = 7622 libcrux_ml_kem_polynomial_ZERO_ea(); 7623 for (size_t i = (size_t)0U; 7624 i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { 7625 size_t i0 = i; 7626 libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = 7627 libcrux_ml_kem_vector_portable_ntt_multiply_b8( 7628 &myself->coefficients[i0], &rhs->coefficients[i0], 7629 libcrux_ml_kem_polynomial_zeta((size_t)64U + (size_t)4U * i0), 7630 libcrux_ml_kem_polynomial_zeta((size_t)64U + (size_t)4U * i0 + 7631 (size_t)1U), 7632 libcrux_ml_kem_polynomial_zeta((size_t)64U + (size_t)4U * i0 + 7633 (size_t)2U), 7634 libcrux_ml_kem_polynomial_zeta((size_t)64U + (size_t)4U * i0 + 7635 (size_t)3U)); 7636 out.coefficients[i0] = uu____0; 7637 } 7638 return out; 7639 } 7640 7641 /** 7642 This function found in impl 7643 {libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 7644 TraitClause@1]} 7645 */ 7646 /** 7647 A monomorphic instance of libcrux_ml_kem.polynomial.ntt_multiply_d6 7648 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7649 with const generics 7650 7651 */ 7652 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 7653 libcrux_ml_kem_polynomial_ntt_multiply_d6_ea( 7654 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *self, 7655 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *rhs) { 7656 return libcrux_ml_kem_polynomial_ntt_multiply_ea(self, rhs); 7657 } 7658 7659 /** 7660 Given two polynomial ring elements `lhs` and `rhs`, compute the pointwise 7661 sum of their constituent coefficients. 7662 */ 7663 /** 7664 A monomorphic instance of libcrux_ml_kem.polynomial.add_to_ring_element 7665 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7666 with const generics 7667 - K= 3 7668 */ 7669 static KRML_MUSTINLINE void libcrux_ml_kem_polynomial_add_to_ring_element_1b( 7670 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *myself, 7671 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *rhs) { 7672 for (size_t i = (size_t)0U; 7673 i < Eurydice_slice_len( 7674 Eurydice_array_to_slice( 7675 (size_t)16U, myself->coefficients, 7676 libcrux_ml_kem_vector_portable_vector_type_PortableVector), 7677 libcrux_ml_kem_vector_portable_vector_type_PortableVector); 7678 i++) { 7679 size_t i0 = i; 7680 libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = 7681 libcrux_ml_kem_vector_portable_add_b8(myself->coefficients[i0], 7682 &rhs->coefficients[i0]); 7683 myself->coefficients[i0] = uu____0; 7684 } 7685 } 7686 7687 /** 7688 This function found in impl 7689 {libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 7690 TraitClause@1]} 7691 */ 7692 /** 7693 A monomorphic instance of libcrux_ml_kem.polynomial.add_to_ring_element_d6 7694 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7695 with const generics 7696 - K= 3 7697 */ 7698 static KRML_MUSTINLINE void libcrux_ml_kem_polynomial_add_to_ring_element_d6_1b( 7699 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *self, 7700 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *rhs) { 7701 libcrux_ml_kem_polynomial_add_to_ring_element_1b(self, rhs); 7702 } 7703 7704 /** 7705 A monomorphic instance of libcrux_ml_kem.invert_ntt.invert_ntt_at_layer_1 7706 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7707 with const generics 7708 7709 */ 7710 static KRML_MUSTINLINE void libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_1_ea( 7711 size_t *zeta_i, libcrux_ml_kem_polynomial_PolynomialRingElement_1d *re) { 7712 for (size_t i = (size_t)0U; i < (size_t)16U; i++) { 7713 size_t round = i; 7714 zeta_i[0U] = zeta_i[0U] - (size_t)1U; 7715 re->coefficients[round] = 7716 libcrux_ml_kem_vector_portable_inv_ntt_layer_1_step_b8( 7717 re->coefficients[round], libcrux_ml_kem_polynomial_zeta(zeta_i[0U]), 7718 libcrux_ml_kem_polynomial_zeta(zeta_i[0U] - (size_t)1U), 7719 libcrux_ml_kem_polynomial_zeta(zeta_i[0U] - (size_t)2U), 7720 libcrux_ml_kem_polynomial_zeta(zeta_i[0U] - (size_t)3U)); 7721 zeta_i[0U] = zeta_i[0U] - (size_t)3U; 7722 } 7723 } 7724 7725 /** 7726 A monomorphic instance of libcrux_ml_kem.invert_ntt.invert_ntt_at_layer_2 7727 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7728 with const generics 7729 7730 */ 7731 static KRML_MUSTINLINE void libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_2_ea( 7732 size_t *zeta_i, libcrux_ml_kem_polynomial_PolynomialRingElement_1d *re) { 7733 for (size_t i = (size_t)0U; i < (size_t)16U; i++) { 7734 size_t round = i; 7735 zeta_i[0U] = zeta_i[0U] - (size_t)1U; 7736 re->coefficients[round] = 7737 libcrux_ml_kem_vector_portable_inv_ntt_layer_2_step_b8( 7738 re->coefficients[round], libcrux_ml_kem_polynomial_zeta(zeta_i[0U]), 7739 libcrux_ml_kem_polynomial_zeta(zeta_i[0U] - (size_t)1U)); 7740 zeta_i[0U] = zeta_i[0U] - (size_t)1U; 7741 } 7742 } 7743 7744 /** 7745 A monomorphic instance of libcrux_ml_kem.invert_ntt.invert_ntt_at_layer_3 7746 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7747 with const generics 7748 7749 */ 7750 static KRML_MUSTINLINE void libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_3_ea( 7751 size_t *zeta_i, libcrux_ml_kem_polynomial_PolynomialRingElement_1d *re) { 7752 for (size_t i = (size_t)0U; i < (size_t)16U; i++) { 7753 size_t round = i; 7754 zeta_i[0U] = zeta_i[0U] - (size_t)1U; 7755 libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = 7756 libcrux_ml_kem_vector_portable_inv_ntt_layer_3_step_b8( 7757 re->coefficients[round], 7758 libcrux_ml_kem_polynomial_zeta(zeta_i[0U])); 7759 re->coefficients[round] = uu____0; 7760 } 7761 } 7762 7763 /** 7764 A monomorphic instance of 7765 libcrux_ml_kem.invert_ntt.inv_ntt_layer_int_vec_step_reduce with types 7766 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 7767 7768 */ 7769 static KRML_MUSTINLINE 7770 libcrux_ml_kem_vector_portable_vector_type_PortableVector_x2 7771 libcrux_ml_kem_invert_ntt_inv_ntt_layer_int_vec_step_reduce_ea( 7772 libcrux_ml_kem_vector_portable_vector_type_PortableVector a, 7773 libcrux_ml_kem_vector_portable_vector_type_PortableVector b, 7774 int16_t zeta_r) { 7775 libcrux_ml_kem_vector_portable_vector_type_PortableVector a_minus_b = 7776 libcrux_ml_kem_vector_portable_sub_b8(b, &a); 7777 a = libcrux_ml_kem_vector_portable_barrett_reduce_b8( 7778 libcrux_ml_kem_vector_portable_add_b8(a, &b)); 7779 b = libcrux_ml_kem_vector_portable_montgomery_multiply_by_constant_b8( 7780 a_minus_b, zeta_r); 7781 return (KRML_CLITERAL( 7782 libcrux_ml_kem_vector_portable_vector_type_PortableVector_x2){.fst = a, 7783 .snd = b}); 7784 } 7785 7786 /** 7787 A monomorphic instance of libcrux_ml_kem.invert_ntt.invert_ntt_at_layer_4_plus 7788 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7789 with const generics 7790 7791 */ 7792 static KRML_MUSTINLINE void 7793 libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_4_plus_ea( 7794 size_t *zeta_i, libcrux_ml_kem_polynomial_PolynomialRingElement_1d *re, 7795 size_t layer) { 7796 size_t step = (size_t)1U << (uint32_t)layer; 7797 for (size_t i0 = (size_t)0U; i0 < (size_t)128U >> (uint32_t)layer; i0++) { 7798 size_t round = i0; 7799 zeta_i[0U] = zeta_i[0U] - (size_t)1U; 7800 size_t offset = round * step * (size_t)2U; 7801 size_t offset_vec = 7802 offset / LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; 7803 size_t step_vec = 7804 step / LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; 7805 for (size_t i = offset_vec; i < offset_vec + step_vec; i++) { 7806 size_t j = i; 7807 libcrux_ml_kem_vector_portable_vector_type_PortableVector_x2 uu____0 = 7808 libcrux_ml_kem_invert_ntt_inv_ntt_layer_int_vec_step_reduce_ea( 7809 re->coefficients[j], re->coefficients[j + step_vec], 7810 libcrux_ml_kem_polynomial_zeta(zeta_i[0U])); 7811 libcrux_ml_kem_vector_portable_vector_type_PortableVector x = uu____0.fst; 7812 libcrux_ml_kem_vector_portable_vector_type_PortableVector y = uu____0.snd; 7813 re->coefficients[j] = x; 7814 re->coefficients[j + step_vec] = y; 7815 } 7816 } 7817 } 7818 7819 /** 7820 A monomorphic instance of libcrux_ml_kem.invert_ntt.invert_ntt_montgomery 7821 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7822 with const generics 7823 - K= 3 7824 */ 7825 static KRML_MUSTINLINE void libcrux_ml_kem_invert_ntt_invert_ntt_montgomery_1b( 7826 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *re) { 7827 size_t zeta_i = 7828 LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT / (size_t)2U; 7829 libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_1_ea(&zeta_i, re); 7830 libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_2_ea(&zeta_i, re); 7831 libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_3_ea(&zeta_i, re); 7832 libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_4_plus_ea(&zeta_i, re, 7833 (size_t)4U); 7834 libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_4_plus_ea(&zeta_i, re, 7835 (size_t)5U); 7836 libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_4_plus_ea(&zeta_i, re, 7837 (size_t)6U); 7838 libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_4_plus_ea(&zeta_i, re, 7839 (size_t)7U); 7840 libcrux_ml_kem_polynomial_poly_barrett_reduce_d6_ea(re); 7841 } 7842 7843 /** 7844 A monomorphic instance of libcrux_ml_kem.polynomial.subtract_reduce 7845 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7846 with const generics 7847 7848 */ 7849 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 7850 libcrux_ml_kem_polynomial_subtract_reduce_ea( 7851 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *myself, 7852 libcrux_ml_kem_polynomial_PolynomialRingElement_1d b) { 7853 for (size_t i = (size_t)0U; 7854 i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { 7855 size_t i0 = i; 7856 libcrux_ml_kem_vector_portable_vector_type_PortableVector 7857 coefficient_normal_form = 7858 libcrux_ml_kem_vector_portable_montgomery_multiply_by_constant_b8( 7859 b.coefficients[i0], (int16_t)1441); 7860 libcrux_ml_kem_vector_portable_vector_type_PortableVector diff = 7861 libcrux_ml_kem_vector_portable_sub_b8(myself->coefficients[i0], 7862 &coefficient_normal_form); 7863 libcrux_ml_kem_vector_portable_vector_type_PortableVector red = 7864 libcrux_ml_kem_vector_portable_barrett_reduce_b8(diff); 7865 b.coefficients[i0] = red; 7866 } 7867 return b; 7868 } 7869 7870 /** 7871 This function found in impl 7872 {libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 7873 TraitClause@1]} 7874 */ 7875 /** 7876 A monomorphic instance of libcrux_ml_kem.polynomial.subtract_reduce_d6 7877 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7878 with const generics 7879 7880 */ 7881 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 7882 libcrux_ml_kem_polynomial_subtract_reduce_d6_ea( 7883 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *self, 7884 libcrux_ml_kem_polynomial_PolynomialRingElement_1d b) { 7885 return libcrux_ml_kem_polynomial_subtract_reduce_ea(self, b); 7886 } 7887 7888 /** 7889 The following functions compute various expressions involving 7890 vectors and matrices. The computation of these expressions has been 7891 abstracted away into these functions in order to save on loop iterations. 7892 Compute v InverseNTT(s NTT(u)) 7893 */ 7894 /** 7895 A monomorphic instance of libcrux_ml_kem.matrix.compute_message 7896 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7897 with const generics 7898 - K= 3 7899 */ 7900 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 7901 libcrux_ml_kem_matrix_compute_message_1b( 7902 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *v, 7903 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *secret_as_ntt, 7904 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *u_as_ntt) { 7905 libcrux_ml_kem_polynomial_PolynomialRingElement_1d result = 7906 libcrux_ml_kem_polynomial_ZERO_d6_ea(); 7907 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 7908 size_t i0 = i; 7909 libcrux_ml_kem_polynomial_PolynomialRingElement_1d product = 7910 libcrux_ml_kem_polynomial_ntt_multiply_d6_ea(&secret_as_ntt[i0], 7911 &u_as_ntt[i0]); 7912 libcrux_ml_kem_polynomial_add_to_ring_element_d6_1b(&result, &product); 7913 } 7914 libcrux_ml_kem_invert_ntt_invert_ntt_montgomery_1b(&result); 7915 return libcrux_ml_kem_polynomial_subtract_reduce_d6_ea(v, result); 7916 } 7917 7918 /** 7919 A monomorphic instance of libcrux_ml_kem.serialize.to_unsigned_field_modulus 7920 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7921 with const generics 7922 7923 */ 7924 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 7925 libcrux_ml_kem_serialize_to_unsigned_field_modulus_ea( 7926 libcrux_ml_kem_vector_portable_vector_type_PortableVector a) { 7927 return libcrux_ml_kem_vector_portable_to_unsigned_representative_b8(a); 7928 } 7929 7930 /** 7931 A monomorphic instance of 7932 libcrux_ml_kem.serialize.compress_then_serialize_message with types 7933 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 7934 7935 */ 7936 static KRML_MUSTINLINE void 7937 libcrux_ml_kem_serialize_compress_then_serialize_message_ea( 7938 libcrux_ml_kem_polynomial_PolynomialRingElement_1d re, uint8_t ret[32U]) { 7939 uint8_t serialized[32U] = {0U}; 7940 for (size_t i = (size_t)0U; i < (size_t)16U; i++) { 7941 size_t i0 = i; 7942 libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficient = 7943 libcrux_ml_kem_serialize_to_unsigned_field_modulus_ea( 7944 re.coefficients[i0]); 7945 libcrux_ml_kem_vector_portable_vector_type_PortableVector 7946 coefficient_compressed = 7947 libcrux_ml_kem_vector_portable_compress_1_b8(coefficient); 7948 uint8_t bytes[2U]; 7949 libcrux_ml_kem_vector_portable_serialize_1_b8(coefficient_compressed, 7950 bytes); 7951 Eurydice_slice_copy( 7952 Eurydice_array_to_subslice3(serialized, (size_t)2U * i0, 7953 (size_t)2U * i0 + (size_t)2U, uint8_t *), 7954 Eurydice_array_to_slice((size_t)2U, bytes, uint8_t), uint8_t); 7955 } 7956 memcpy(ret, serialized, (size_t)32U * sizeof(uint8_t)); 7957 } 7958 7959 /** 7960 This function implements <strong>Algorithm 14</strong> of the 7961 NIST FIPS 203 specification; this is the Kyber CPA-PKE decryption algorithm. 7962 7963 Algorithm 14 is reproduced below: 7964 7965 ```plaintext 7966 Input: decryption key dk ^{384k}. 7967 Input: ciphertext c ^{32(dk + d)}. 7968 Output: message m ^{32}. 7969 7970 c c[0 : 32dk] 7971 c c[32dk : 32(dk + d)] 7972 u Decompress_{d}(ByteDecode_{d}(c)) 7973 v Decompress_{d}(ByteDecode_{d}(c)) 7974 ByteDecode(dk) 7975 w v - NTT-( NTT(u)) 7976 m ByteEncode(Compress(w)) 7977 return m 7978 ``` 7979 7980 The NIST FIPS 203 standard can be found at 7981 <https://csrc.nist.gov/pubs/fips/203/ipd>. 7982 */ 7983 /** 7984 A monomorphic instance of libcrux_ml_kem.ind_cpa.decrypt_unpacked 7985 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 7986 with const generics 7987 - K= 3 7988 - CIPHERTEXT_SIZE= 1088 7989 - VECTOR_U_ENCODED_SIZE= 960 7990 - U_COMPRESSION_FACTOR= 10 7991 - V_COMPRESSION_FACTOR= 4 7992 */ 7993 static KRML_MUSTINLINE void libcrux_ml_kem_ind_cpa_decrypt_unpacked_42( 7994 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPrivateKeyUnpacked_a0 *secret_key, 7995 uint8_t *ciphertext, uint8_t ret[32U]) { 7996 libcrux_ml_kem_polynomial_PolynomialRingElement_1d u_as_ntt[3U]; 7997 libcrux_ml_kem_ind_cpa_deserialize_then_decompress_u_6c(ciphertext, u_as_ntt); 7998 libcrux_ml_kem_polynomial_PolynomialRingElement_1d v = 7999 libcrux_ml_kem_serialize_deserialize_then_decompress_ring_element_v_89( 8000 Eurydice_array_to_subslice_from((size_t)1088U, ciphertext, 8001 (size_t)960U, uint8_t, size_t, 8002 uint8_t[])); 8003 libcrux_ml_kem_polynomial_PolynomialRingElement_1d message = 8004 libcrux_ml_kem_matrix_compute_message_1b(&v, secret_key->secret_as_ntt, 8005 u_as_ntt); 8006 uint8_t ret0[32U]; 8007 libcrux_ml_kem_serialize_compress_then_serialize_message_ea(message, ret0); 8008 memcpy(ret, ret0, (size_t)32U * sizeof(uint8_t)); 8009 } 8010 8011 /** 8012 A monomorphic instance of libcrux_ml_kem.ind_cpa.decrypt 8013 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 8014 with const generics 8015 - K= 3 8016 - CIPHERTEXT_SIZE= 1088 8017 - VECTOR_U_ENCODED_SIZE= 960 8018 - U_COMPRESSION_FACTOR= 10 8019 - V_COMPRESSION_FACTOR= 4 8020 */ 8021 static KRML_MUSTINLINE void libcrux_ml_kem_ind_cpa_decrypt_42( 8022 Eurydice_slice secret_key, uint8_t *ciphertext, uint8_t ret[32U]) { 8023 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPrivateKeyUnpacked_a0 8024 secret_key_unpacked; 8025 libcrux_ml_kem_polynomial_PolynomialRingElement_1d ret0[3U]; 8026 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 8027 /* original Rust expression is not an lvalue in C */ 8028 void *lvalue = (void *)0U; 8029 ret0[i] = libcrux_ml_kem_ind_cpa_decrypt_call_mut_0b_42(&lvalue, i); 8030 } 8031 memcpy( 8032 secret_key_unpacked.secret_as_ntt, ret0, 8033 (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d)); 8034 libcrux_ml_kem_ind_cpa_deserialize_vector_1b( 8035 secret_key, secret_key_unpacked.secret_as_ntt); 8036 uint8_t ret1[32U]; 8037 libcrux_ml_kem_ind_cpa_decrypt_unpacked_42(&secret_key_unpacked, ciphertext, 8038 ret1); 8039 memcpy(ret, ret1, (size_t)32U * sizeof(uint8_t)); 8040 } 8041 8042 /** 8043 This function found in impl {libcrux_ml_kem::hash_functions::Hash<K> for 8044 libcrux_ml_kem::hash_functions::portable::PortableHash<K>} 8045 */ 8046 /** 8047 A monomorphic instance of libcrux_ml_kem.hash_functions.portable.G_4a 8048 with const generics 8049 - K= 3 8050 */ 8051 static inline void libcrux_ml_kem_hash_functions_portable_G_4a_e0( 8052 Eurydice_slice input, uint8_t ret[64U]) { 8053 libcrux_ml_kem_hash_functions_portable_G(input, ret); 8054 } 8055 8056 /** 8057 A monomorphic instance of libcrux_ml_kem.hash_functions.portable.PRF 8058 with const generics 8059 - LEN= 32 8060 */ 8061 static inline void libcrux_ml_kem_hash_functions_portable_PRF_9e( 8062 Eurydice_slice input, uint8_t ret[32U]) { 8063 uint8_t digest[32U] = {0U}; 8064 libcrux_sha3_portable_shake256( 8065 Eurydice_array_to_slice((size_t)32U, digest, uint8_t), input); 8066 memcpy(ret, digest, (size_t)32U * sizeof(uint8_t)); 8067 } 8068 8069 /** 8070 This function found in impl {libcrux_ml_kem::hash_functions::Hash<K> for 8071 libcrux_ml_kem::hash_functions::portable::PortableHash<K>} 8072 */ 8073 /** 8074 A monomorphic instance of libcrux_ml_kem.hash_functions.portable.PRF_4a 8075 with const generics 8076 - K= 3 8077 - LEN= 32 8078 */ 8079 static inline void libcrux_ml_kem_hash_functions_portable_PRF_4a_41( 8080 Eurydice_slice input, uint8_t ret[32U]) { 8081 libcrux_ml_kem_hash_functions_portable_PRF_9e(input, ret); 8082 } 8083 8084 /** 8085 A monomorphic instance of 8086 libcrux_ml_kem.ind_cpa.unpacked.IndCpaPublicKeyUnpacked with types 8087 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 8088 - $3size_t 8089 */ 8090 typedef struct libcrux_ml_kem_ind_cpa_unpacked_IndCpaPublicKeyUnpacked_a0_s { 8091 libcrux_ml_kem_polynomial_PolynomialRingElement_1d t_as_ntt[3U]; 8092 uint8_t seed_for_A[32U]; 8093 libcrux_ml_kem_polynomial_PolynomialRingElement_1d A[3U][3U]; 8094 } libcrux_ml_kem_ind_cpa_unpacked_IndCpaPublicKeyUnpacked_a0; 8095 8096 /** 8097 This function found in impl {core::default::Default for 8098 libcrux_ml_kem::ind_cpa::unpacked::IndCpaPublicKeyUnpacked<Vector, 8099 K>[TraitClause@0, TraitClause@1]} 8100 */ 8101 /** 8102 A monomorphic instance of libcrux_ml_kem.ind_cpa.unpacked.default_8b 8103 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 8104 with const generics 8105 - K= 3 8106 */ 8107 static inline libcrux_ml_kem_ind_cpa_unpacked_IndCpaPublicKeyUnpacked_a0 8108 libcrux_ml_kem_ind_cpa_unpacked_default_8b_1b(void) { 8109 libcrux_ml_kem_polynomial_PolynomialRingElement_1d uu____0[3U]; 8110 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 8111 uu____0[i] = libcrux_ml_kem_polynomial_ZERO_d6_ea(); 8112 } 8113 uint8_t uu____1[32U] = {0U}; 8114 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPublicKeyUnpacked_a0 lit; 8115 memcpy( 8116 lit.t_as_ntt, uu____0, 8117 (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d)); 8118 memcpy(lit.seed_for_A, uu____1, (size_t)32U * sizeof(uint8_t)); 8119 libcrux_ml_kem_polynomial_PolynomialRingElement_1d repeat_expression0[3U][3U]; 8120 for (size_t i0 = (size_t)0U; i0 < (size_t)3U; i0++) { 8121 libcrux_ml_kem_polynomial_PolynomialRingElement_1d repeat_expression[3U]; 8122 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 8123 repeat_expression[i] = libcrux_ml_kem_polynomial_ZERO_d6_ea(); 8124 } 8125 memcpy(repeat_expression0[i0], repeat_expression, 8126 (size_t)3U * 8127 sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d)); 8128 } 8129 memcpy(lit.A, repeat_expression0, 8130 (size_t)3U * 8131 sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d[3U])); 8132 return lit; 8133 } 8134 8135 /** 8136 Only use with public values. 8137 8138 This MUST NOT be used with secret inputs, like its caller 8139 `deserialize_ring_elements_reduced`. 8140 */ 8141 /** 8142 A monomorphic instance of 8143 libcrux_ml_kem.serialize.deserialize_to_reduced_ring_element with types 8144 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 8145 8146 */ 8147 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 8148 libcrux_ml_kem_serialize_deserialize_to_reduced_ring_element_ea( 8149 Eurydice_slice serialized) { 8150 libcrux_ml_kem_polynomial_PolynomialRingElement_1d re = 8151 libcrux_ml_kem_polynomial_ZERO_d6_ea(); 8152 for (size_t i = (size_t)0U; 8153 i < Eurydice_slice_len(serialized, uint8_t) / (size_t)24U; i++) { 8154 size_t i0 = i; 8155 Eurydice_slice bytes = 8156 Eurydice_slice_subslice3(serialized, i0 * (size_t)24U, 8157 i0 * (size_t)24U + (size_t)24U, uint8_t *); 8158 libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficient = 8159 libcrux_ml_kem_vector_portable_deserialize_12_b8(bytes); 8160 libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = 8161 libcrux_ml_kem_vector_portable_cond_subtract_3329_b8(coefficient); 8162 re.coefficients[i0] = uu____0; 8163 } 8164 return re; 8165 } 8166 8167 /** 8168 See [deserialize_ring_elements_reduced_out]. 8169 */ 8170 /** 8171 A monomorphic instance of 8172 libcrux_ml_kem.serialize.deserialize_ring_elements_reduced with types 8173 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 8174 - K= 3 8175 */ 8176 static KRML_MUSTINLINE void 8177 libcrux_ml_kem_serialize_deserialize_ring_elements_reduced_1b( 8178 Eurydice_slice public_key, 8179 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *deserialized_pk) { 8180 for (size_t i = (size_t)0U; 8181 i < Eurydice_slice_len(public_key, uint8_t) / 8182 LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT; 8183 i++) { 8184 size_t i0 = i; 8185 Eurydice_slice ring_element = Eurydice_slice_subslice3( 8186 public_key, i0 * LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT, 8187 i0 * LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT + 8188 LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT, 8189 uint8_t *); 8190 libcrux_ml_kem_polynomial_PolynomialRingElement_1d uu____0 = 8191 libcrux_ml_kem_serialize_deserialize_to_reduced_ring_element_ea( 8192 ring_element); 8193 deserialized_pk[i0] = uu____0; 8194 } 8195 } 8196 8197 /** 8198 A monomorphic instance of libcrux_ml_kem.hash_functions.portable.PortableHash 8199 with const generics 8200 - $3size_t 8201 */ 8202 typedef struct libcrux_ml_kem_hash_functions_portable_PortableHash_88_s { 8203 libcrux_sha3_generic_keccak_KeccakState_17 shake128_state[3U]; 8204 } libcrux_ml_kem_hash_functions_portable_PortableHash_88; 8205 8206 /** 8207 A monomorphic instance of 8208 libcrux_ml_kem.hash_functions.portable.shake128_init_absorb_final with const 8209 generics 8210 - K= 3 8211 */ 8212 static inline libcrux_ml_kem_hash_functions_portable_PortableHash_88 8213 libcrux_ml_kem_hash_functions_portable_shake128_init_absorb_final_e0( 8214 uint8_t (*input)[34U]) { 8215 libcrux_ml_kem_hash_functions_portable_PortableHash_88 shake128_state; 8216 libcrux_sha3_generic_keccak_KeccakState_17 repeat_expression[3U]; 8217 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 8218 repeat_expression[i] = libcrux_sha3_portable_incremental_shake128_init(); 8219 } 8220 memcpy(shake128_state.shake128_state, repeat_expression, 8221 (size_t)3U * sizeof(libcrux_sha3_generic_keccak_KeccakState_17)); 8222 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 8223 size_t i0 = i; 8224 libcrux_sha3_portable_incremental_shake128_absorb_final( 8225 &shake128_state.shake128_state[i0], 8226 Eurydice_array_to_slice((size_t)34U, input[i0], uint8_t)); 8227 } 8228 return shake128_state; 8229 } 8230 8231 /** 8232 This function found in impl {libcrux_ml_kem::hash_functions::Hash<K> for 8233 libcrux_ml_kem::hash_functions::portable::PortableHash<K>} 8234 */ 8235 /** 8236 A monomorphic instance of 8237 libcrux_ml_kem.hash_functions.portable.shake128_init_absorb_final_4a with const 8238 generics 8239 - K= 3 8240 */ 8241 static inline libcrux_ml_kem_hash_functions_portable_PortableHash_88 8242 libcrux_ml_kem_hash_functions_portable_shake128_init_absorb_final_4a_e0( 8243 uint8_t (*input)[34U]) { 8244 return libcrux_ml_kem_hash_functions_portable_shake128_init_absorb_final_e0( 8245 input); 8246 } 8247 8248 /** 8249 A monomorphic instance of 8250 libcrux_ml_kem.hash_functions.portable.shake128_squeeze_first_three_blocks with 8251 const generics 8252 - K= 3 8253 */ 8254 static inline void 8255 libcrux_ml_kem_hash_functions_portable_shake128_squeeze_first_three_blocks_e0( 8256 libcrux_ml_kem_hash_functions_portable_PortableHash_88 *st, 8257 uint8_t ret[3U][504U]) { 8258 uint8_t out[3U][504U] = {{0U}}; 8259 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 8260 size_t i0 = i; 8261 libcrux_sha3_portable_incremental_shake128_squeeze_first_three_blocks( 8262 &st->shake128_state[i0], 8263 Eurydice_array_to_slice((size_t)504U, out[i0], uint8_t)); 8264 } 8265 memcpy(ret, out, (size_t)3U * sizeof(uint8_t[504U])); 8266 } 8267 8268 /** 8269 This function found in impl {libcrux_ml_kem::hash_functions::Hash<K> for 8270 libcrux_ml_kem::hash_functions::portable::PortableHash<K>} 8271 */ 8272 /** 8273 A monomorphic instance of 8274 libcrux_ml_kem.hash_functions.portable.shake128_squeeze_first_three_blocks_4a 8275 with const generics 8276 - K= 3 8277 */ 8278 static inline void 8279 libcrux_ml_kem_hash_functions_portable_shake128_squeeze_first_three_blocks_4a_e0( 8280 libcrux_ml_kem_hash_functions_portable_PortableHash_88 *self, 8281 uint8_t ret[3U][504U]) { 8282 libcrux_ml_kem_hash_functions_portable_shake128_squeeze_first_three_blocks_e0( 8283 self, ret); 8284 } 8285 8286 /** 8287 If `bytes` contains a set of uniformly random bytes, this function 8288 uniformly samples a ring element `` that is treated as being the NTT 8289 representation of the corresponding polynomial `a`. 8290 8291 Since rejection sampling is used, it is possible the supplied bytes are 8292 not enough to sample the element, in which case an `Err` is returned and the 8293 caller must try again with a fresh set of bytes. 8294 8295 This function <strong>partially</strong> implements <strong>Algorithm 8296 6</strong> of the NIST FIPS 203 standard, We say "partially" because this 8297 implementation only accepts a finite set of bytes as input and returns an error 8298 if the set is not enough; Algorithm 6 of the FIPS 203 standard on the other 8299 hand samples from an infinite stream of bytes until the ring element is filled. 8300 Algorithm 6 is reproduced below: 8301 8302 ```plaintext 8303 Input: byte stream B *. 8304 Output: array . 8305 8306 i 0 8307 j 0 8308 while j < 256 do 8309 d B[i] + 256(B[i+1] mod 16) 8310 d B[i+1]/16 + 16B[i+2] 8311 if d < q then 8312 [j] d 8313 j j + 1 8314 end if 8315 if d < q and j < 256 then 8316 [j] d 8317 j j + 1 8318 end if 8319 i i + 3 8320 end while 8321 return 8322 ``` 8323 8324 The NIST FIPS 203 standard can be found at 8325 <https://csrc.nist.gov/pubs/fips/203/ipd>. 8326 */ 8327 /** 8328 A monomorphic instance of 8329 libcrux_ml_kem.sampling.sample_from_uniform_distribution_next with types 8330 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 8331 - K= 3 8332 - N= 504 8333 */ 8334 static KRML_MUSTINLINE bool 8335 libcrux_ml_kem_sampling_sample_from_uniform_distribution_next_89( 8336 uint8_t (*randomness)[504U], size_t *sampled_coefficients, 8337 int16_t (*out)[272U]) { 8338 for (size_t i0 = (size_t)0U; i0 < (size_t)3U; i0++) { 8339 size_t i1 = i0; 8340 for (size_t i = (size_t)0U; i < (size_t)504U / (size_t)24U; i++) { 8341 size_t r = i; 8342 if (sampled_coefficients[i1] < 8343 LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT) { 8344 size_t sampled = libcrux_ml_kem_vector_portable_rej_sample_b8( 8345 Eurydice_array_to_subslice3(randomness[i1], r * (size_t)24U, 8346 r * (size_t)24U + (size_t)24U, 8347 uint8_t *), 8348 Eurydice_array_to_subslice3(out[i1], sampled_coefficients[i1], 8349 sampled_coefficients[i1] + (size_t)16U, 8350 int16_t *)); 8351 size_t uu____0 = i1; 8352 sampled_coefficients[uu____0] = sampled_coefficients[uu____0] + sampled; 8353 } 8354 } 8355 } 8356 bool done = true; 8357 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 8358 size_t i0 = i; 8359 if (sampled_coefficients[i0] >= 8360 LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT) { 8361 sampled_coefficients[i0] = 8362 LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT; 8363 } else { 8364 done = false; 8365 } 8366 } 8367 return done; 8368 } 8369 8370 /** 8371 A monomorphic instance of 8372 libcrux_ml_kem.hash_functions.portable.shake128_squeeze_next_block with const 8373 generics 8374 - K= 3 8375 */ 8376 static inline void 8377 libcrux_ml_kem_hash_functions_portable_shake128_squeeze_next_block_e0( 8378 libcrux_ml_kem_hash_functions_portable_PortableHash_88 *st, 8379 uint8_t ret[3U][168U]) { 8380 uint8_t out[3U][168U] = {{0U}}; 8381 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 8382 size_t i0 = i; 8383 libcrux_sha3_portable_incremental_shake128_squeeze_next_block( 8384 &st->shake128_state[i0], 8385 Eurydice_array_to_slice((size_t)168U, out[i0], uint8_t)); 8386 } 8387 memcpy(ret, out, (size_t)3U * sizeof(uint8_t[168U])); 8388 } 8389 8390 /** 8391 This function found in impl {libcrux_ml_kem::hash_functions::Hash<K> for 8392 libcrux_ml_kem::hash_functions::portable::PortableHash<K>} 8393 */ 8394 /** 8395 A monomorphic instance of 8396 libcrux_ml_kem.hash_functions.portable.shake128_squeeze_next_block_4a with const 8397 generics 8398 - K= 3 8399 */ 8400 static inline void 8401 libcrux_ml_kem_hash_functions_portable_shake128_squeeze_next_block_4a_e0( 8402 libcrux_ml_kem_hash_functions_portable_PortableHash_88 *self, 8403 uint8_t ret[3U][168U]) { 8404 libcrux_ml_kem_hash_functions_portable_shake128_squeeze_next_block_e0(self, 8405 ret); 8406 } 8407 8408 /** 8409 If `bytes` contains a set of uniformly random bytes, this function 8410 uniformly samples a ring element `` that is treated as being the NTT 8411 representation of the corresponding polynomial `a`. 8412 8413 Since rejection sampling is used, it is possible the supplied bytes are 8414 not enough to sample the element, in which case an `Err` is returned and the 8415 caller must try again with a fresh set of bytes. 8416 8417 This function <strong>partially</strong> implements <strong>Algorithm 8418 6</strong> of the NIST FIPS 203 standard, We say "partially" because this 8419 implementation only accepts a finite set of bytes as input and returns an error 8420 if the set is not enough; Algorithm 6 of the FIPS 203 standard on the other 8421 hand samples from an infinite stream of bytes until the ring element is filled. 8422 Algorithm 6 is reproduced below: 8423 8424 ```plaintext 8425 Input: byte stream B *. 8426 Output: array . 8427 8428 i 0 8429 j 0 8430 while j < 256 do 8431 d B[i] + 256(B[i+1] mod 16) 8432 d B[i+1]/16 + 16B[i+2] 8433 if d < q then 8434 [j] d 8435 j j + 1 8436 end if 8437 if d < q and j < 256 then 8438 [j] d 8439 j j + 1 8440 end if 8441 i i + 3 8442 end while 8443 return 8444 ``` 8445 8446 The NIST FIPS 203 standard can be found at 8447 <https://csrc.nist.gov/pubs/fips/203/ipd>. 8448 */ 8449 /** 8450 A monomorphic instance of 8451 libcrux_ml_kem.sampling.sample_from_uniform_distribution_next with types 8452 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 8453 - K= 3 8454 - N= 168 8455 */ 8456 static KRML_MUSTINLINE bool 8457 libcrux_ml_kem_sampling_sample_from_uniform_distribution_next_890( 8458 uint8_t (*randomness)[168U], size_t *sampled_coefficients, 8459 int16_t (*out)[272U]) { 8460 for (size_t i0 = (size_t)0U; i0 < (size_t)3U; i0++) { 8461 size_t i1 = i0; 8462 for (size_t i = (size_t)0U; i < (size_t)168U / (size_t)24U; i++) { 8463 size_t r = i; 8464 if (sampled_coefficients[i1] < 8465 LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT) { 8466 size_t sampled = libcrux_ml_kem_vector_portable_rej_sample_b8( 8467 Eurydice_array_to_subslice3(randomness[i1], r * (size_t)24U, 8468 r * (size_t)24U + (size_t)24U, 8469 uint8_t *), 8470 Eurydice_array_to_subslice3(out[i1], sampled_coefficients[i1], 8471 sampled_coefficients[i1] + (size_t)16U, 8472 int16_t *)); 8473 size_t uu____0 = i1; 8474 sampled_coefficients[uu____0] = sampled_coefficients[uu____0] + sampled; 8475 } 8476 } 8477 } 8478 bool done = true; 8479 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 8480 size_t i0 = i; 8481 if (sampled_coefficients[i0] >= 8482 LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT) { 8483 sampled_coefficients[i0] = 8484 LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT; 8485 } else { 8486 done = false; 8487 } 8488 } 8489 return done; 8490 } 8491 8492 /** 8493 A monomorphic instance of libcrux_ml_kem.polynomial.from_i16_array 8494 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 8495 with const generics 8496 8497 */ 8498 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 8499 libcrux_ml_kem_polynomial_from_i16_array_ea(Eurydice_slice a) { 8500 libcrux_ml_kem_polynomial_PolynomialRingElement_1d result = 8501 libcrux_ml_kem_polynomial_ZERO_ea(); 8502 for (size_t i = (size_t)0U; 8503 i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { 8504 size_t i0 = i; 8505 libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = 8506 libcrux_ml_kem_vector_portable_from_i16_array_b8( 8507 Eurydice_slice_subslice3(a, i0 * (size_t)16U, 8508 (i0 + (size_t)1U) * (size_t)16U, 8509 int16_t *)); 8510 result.coefficients[i0] = uu____0; 8511 } 8512 return result; 8513 } 8514 8515 /** 8516 This function found in impl 8517 {libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 8518 TraitClause@1]} 8519 */ 8520 /** 8521 A monomorphic instance of libcrux_ml_kem.polynomial.from_i16_array_d6 8522 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 8523 with const generics 8524 8525 */ 8526 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 8527 libcrux_ml_kem_polynomial_from_i16_array_d6_ea(Eurydice_slice a) { 8528 return libcrux_ml_kem_polynomial_from_i16_array_ea(a); 8529 } 8530 8531 /** 8532 This function found in impl {core::ops::function::FnMut<(@Array<i16, 272usize>), 8533 libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 8534 TraitClause@2]> for libcrux_ml_kem::sampling::sample_from_xof::closure<Vector, 8535 Hasher, K>[TraitClause@0, TraitClause@1, TraitClause@2, TraitClause@3]} 8536 */ 8537 /** 8538 A monomorphic instance of libcrux_ml_kem.sampling.sample_from_xof.call_mut_e7 8539 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 8540 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const 8541 generics 8542 - K= 3 8543 */ 8544 static inline libcrux_ml_kem_polynomial_PolynomialRingElement_1d 8545 libcrux_ml_kem_sampling_sample_from_xof_call_mut_e7_2b( 8546 void **_, int16_t tupled_args[272U]) { 8547 int16_t s[272U]; 8548 memcpy(s, tupled_args, (size_t)272U * sizeof(int16_t)); 8549 return libcrux_ml_kem_polynomial_from_i16_array_d6_ea( 8550 Eurydice_array_to_subslice3(s, (size_t)0U, (size_t)256U, int16_t *)); 8551 } 8552 8553 /** 8554 A monomorphic instance of libcrux_ml_kem.sampling.sample_from_xof 8555 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 8556 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const 8557 generics 8558 - K= 3 8559 */ 8560 static KRML_MUSTINLINE void libcrux_ml_kem_sampling_sample_from_xof_2b( 8561 uint8_t (*seeds)[34U], 8562 libcrux_ml_kem_polynomial_PolynomialRingElement_1d ret[3U]) { 8563 size_t sampled_coefficients[3U] = {0U}; 8564 int16_t out[3U][272U] = {{0U}}; 8565 libcrux_ml_kem_hash_functions_portable_PortableHash_88 xof_state = 8566 libcrux_ml_kem_hash_functions_portable_shake128_init_absorb_final_4a_e0( 8567 seeds); 8568 uint8_t randomness0[3U][504U]; 8569 libcrux_ml_kem_hash_functions_portable_shake128_squeeze_first_three_blocks_4a_e0( 8570 &xof_state, randomness0); 8571 bool done = libcrux_ml_kem_sampling_sample_from_uniform_distribution_next_89( 8572 randomness0, sampled_coefficients, out); 8573 while (true) { 8574 if (done) { 8575 break; 8576 } else { 8577 uint8_t randomness[3U][168U]; 8578 libcrux_ml_kem_hash_functions_portable_shake128_squeeze_next_block_4a_e0( 8579 &xof_state, randomness); 8580 done = libcrux_ml_kem_sampling_sample_from_uniform_distribution_next_890( 8581 randomness, sampled_coefficients, out); 8582 } 8583 } 8584 /* Passing arrays by value in Rust generates a copy in C */ 8585 int16_t copy_of_out[3U][272U]; 8586 memcpy(copy_of_out, out, (size_t)3U * sizeof(int16_t[272U])); 8587 libcrux_ml_kem_polynomial_PolynomialRingElement_1d ret0[3U]; 8588 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 8589 /* original Rust expression is not an lvalue in C */ 8590 void *lvalue = (void *)0U; 8591 ret0[i] = libcrux_ml_kem_sampling_sample_from_xof_call_mut_e7_2b( 8592 &lvalue, copy_of_out[i]); 8593 } 8594 memcpy( 8595 ret, ret0, 8596 (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d)); 8597 } 8598 8599 /** 8600 A monomorphic instance of libcrux_ml_kem.matrix.sample_matrix_A 8601 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 8602 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const 8603 generics 8604 - K= 3 8605 */ 8606 static KRML_MUSTINLINE void libcrux_ml_kem_matrix_sample_matrix_A_2b( 8607 libcrux_ml_kem_polynomial_PolynomialRingElement_1d (*A_transpose)[3U], 8608 uint8_t *seed, bool transpose) { 8609 for (size_t i0 = (size_t)0U; i0 < (size_t)3U; i0++) { 8610 size_t i1 = i0; 8611 uint8_t seeds[3U][34U]; 8612 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 8613 core_array__core__clone__Clone_for__Array_T__N___clone( 8614 (size_t)34U, seed, seeds[i], uint8_t, void *); 8615 } 8616 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 8617 size_t j = i; 8618 seeds[j][32U] = (uint8_t)i1; 8619 seeds[j][33U] = (uint8_t)j; 8620 } 8621 libcrux_ml_kem_polynomial_PolynomialRingElement_1d sampled[3U]; 8622 libcrux_ml_kem_sampling_sample_from_xof_2b(seeds, sampled); 8623 for (size_t i = (size_t)0U; 8624 i < Eurydice_slice_len( 8625 Eurydice_array_to_slice( 8626 (size_t)3U, sampled, 8627 libcrux_ml_kem_polynomial_PolynomialRingElement_1d), 8628 libcrux_ml_kem_polynomial_PolynomialRingElement_1d); 8629 i++) { 8630 size_t j = i; 8631 libcrux_ml_kem_polynomial_PolynomialRingElement_1d sample = sampled[j]; 8632 if (transpose) { 8633 A_transpose[j][i1] = sample; 8634 } else { 8635 A_transpose[i1][j] = sample; 8636 } 8637 } 8638 } 8639 } 8640 8641 /** 8642 A monomorphic instance of libcrux_ml_kem.ind_cpa.build_unpacked_public_key_mut 8643 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 8644 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const 8645 generics 8646 - K= 3 8647 - T_AS_NTT_ENCODED_SIZE= 1152 8648 */ 8649 static KRML_MUSTINLINE void 8650 libcrux_ml_kem_ind_cpa_build_unpacked_public_key_mut_3f( 8651 Eurydice_slice public_key, 8652 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPublicKeyUnpacked_a0 8653 *unpacked_public_key) { 8654 Eurydice_slice uu____0 = Eurydice_slice_subslice_to( 8655 public_key, (size_t)1152U, uint8_t, size_t, uint8_t[]); 8656 libcrux_ml_kem_serialize_deserialize_ring_elements_reduced_1b( 8657 uu____0, unpacked_public_key->t_as_ntt); 8658 Eurydice_slice seed = Eurydice_slice_subslice_from( 8659 public_key, (size_t)1152U, uint8_t, size_t, uint8_t[]); 8660 libcrux_ml_kem_polynomial_PolynomialRingElement_1d(*uu____1)[3U] = 8661 unpacked_public_key->A; 8662 uint8_t ret[34U]; 8663 libcrux_ml_kem_utils_into_padded_array_b6(seed, ret); 8664 libcrux_ml_kem_matrix_sample_matrix_A_2b(uu____1, ret, false); 8665 } 8666 8667 /** 8668 A monomorphic instance of libcrux_ml_kem.ind_cpa.build_unpacked_public_key 8669 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 8670 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const 8671 generics 8672 - K= 3 8673 - T_AS_NTT_ENCODED_SIZE= 1152 8674 */ 8675 static KRML_MUSTINLINE 8676 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPublicKeyUnpacked_a0 8677 libcrux_ml_kem_ind_cpa_build_unpacked_public_key_3f( 8678 Eurydice_slice public_key) { 8679 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPublicKeyUnpacked_a0 8680 unpacked_public_key = libcrux_ml_kem_ind_cpa_unpacked_default_8b_1b(); 8681 libcrux_ml_kem_ind_cpa_build_unpacked_public_key_mut_3f(public_key, 8682 &unpacked_public_key); 8683 return unpacked_public_key; 8684 } 8685 8686 /** 8687 A monomorphic instance of K. 8688 with types libcrux_ml_kem_polynomial_PolynomialRingElement 8689 libcrux_ml_kem_vector_portable_vector_type_PortableVector[3size_t], 8690 libcrux_ml_kem_polynomial_PolynomialRingElement 8691 libcrux_ml_kem_vector_portable_vector_type_PortableVector 8692 8693 */ 8694 typedef struct tuple_ed_s { 8695 libcrux_ml_kem_polynomial_PolynomialRingElement_1d fst[3U]; 8696 libcrux_ml_kem_polynomial_PolynomialRingElement_1d snd; 8697 } tuple_ed; 8698 8699 /** 8700 This function found in impl {core::ops::function::FnMut<(usize), 8701 libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 8702 TraitClause@2]> for libcrux_ml_kem::ind_cpa::encrypt_c1::closure<Vector, Hasher, 8703 K, C1_LEN, U_COMPRESSION_FACTOR, BLOCK_LEN, ETA1, ETA1_RANDOMNESS_SIZE, ETA2, 8704 ETA2_RANDOMNESS_SIZE>[TraitClause@0, TraitClause@1, TraitClause@2, 8705 TraitClause@3]} 8706 */ 8707 /** 8708 A monomorphic instance of libcrux_ml_kem.ind_cpa.encrypt_c1.call_mut_f1 8709 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 8710 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const 8711 generics 8712 - K= 3 8713 - C1_LEN= 960 8714 - U_COMPRESSION_FACTOR= 10 8715 - BLOCK_LEN= 320 8716 - ETA1= 2 8717 - ETA1_RANDOMNESS_SIZE= 128 8718 - ETA2= 2 8719 - ETA2_RANDOMNESS_SIZE= 128 8720 */ 8721 static inline libcrux_ml_kem_polynomial_PolynomialRingElement_1d 8722 libcrux_ml_kem_ind_cpa_encrypt_c1_call_mut_f1_85(void **_, size_t tupled_args) { 8723 return libcrux_ml_kem_polynomial_ZERO_d6_ea(); 8724 } 8725 8726 /** 8727 A monomorphic instance of libcrux_ml_kem.hash_functions.portable.PRFxN 8728 with const generics 8729 - K= 3 8730 - LEN= 128 8731 */ 8732 static inline void libcrux_ml_kem_hash_functions_portable_PRFxN_41( 8733 uint8_t (*input)[33U], uint8_t ret[3U][128U]) { 8734 uint8_t out[3U][128U] = {{0U}}; 8735 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 8736 size_t i0 = i; 8737 libcrux_sha3_portable_shake256( 8738 Eurydice_array_to_slice((size_t)128U, out[i0], uint8_t), 8739 Eurydice_array_to_slice((size_t)33U, input[i0], uint8_t)); 8740 } 8741 memcpy(ret, out, (size_t)3U * sizeof(uint8_t[128U])); 8742 } 8743 8744 /** 8745 This function found in impl {libcrux_ml_kem::hash_functions::Hash<K> for 8746 libcrux_ml_kem::hash_functions::portable::PortableHash<K>} 8747 */ 8748 /** 8749 A monomorphic instance of libcrux_ml_kem.hash_functions.portable.PRFxN_4a 8750 with const generics 8751 - K= 3 8752 - LEN= 128 8753 */ 8754 static inline void libcrux_ml_kem_hash_functions_portable_PRFxN_4a_41( 8755 uint8_t (*input)[33U], uint8_t ret[3U][128U]) { 8756 libcrux_ml_kem_hash_functions_portable_PRFxN_41(input, ret); 8757 } 8758 8759 /** 8760 Given a series of uniformly random bytes in `randomness`, for some number 8761 `eta`, the `sample_from_binomial_distribution_{eta}` functions sample a ring 8762 element from a binomial distribution centered at 0 that uses two sets of `eta` 8763 coin flips. If, for example, `eta = ETA`, each ring coefficient is a value `v` 8764 such such that `v {-ETA, -ETA + 1, ..., 0, ..., ETA + 1, ETA}` and: 8765 8766 ```plaintext 8767 - If v < 0, Pr[v] = Pr[-v] 8768 - If v >= 0, Pr[v] = BINOMIAL_COEFFICIENT(2 * ETA; ETA - v) / 2 ^ (2 * ETA) 8769 ``` 8770 8771 The values `v < 0` are mapped to the appropriate `KyberFieldElement`. 8772 8773 The expected value is: 8774 8775 ```plaintext 8776 E[X] = (-ETA)Pr[-ETA] + (-(ETA - 1))Pr[-(ETA - 1)] + ... + (ETA - 1)Pr[ETA - 1] 8777 + (ETA)Pr[ETA] = 0 since Pr[-v] = Pr[v] when v < 0. 8778 ``` 8779 8780 And the variance is: 8781 8782 ```plaintext 8783 Var(X) = E[(X - E[X])^2] 8784 = E[X^2] 8785 = sum_(v=-ETA to ETA)v^2 * (BINOMIAL_COEFFICIENT(2 * ETA; ETA - v) / 8786 2^(2 * ETA)) = ETA / 2 8787 ``` 8788 8789 This function implements <strong>Algorithm 7</strong> of the NIST FIPS 203 8790 standard, which is reproduced below: 8791 8792 ```plaintext 8793 Input: byte array B ^{64}. 8794 Output: array f . 8795 8796 b BytesToBits(B) 8797 for (i 0; i < 256; i++) 8798 x (j=0 to - 1) b[2i + j] 8799 y (j=0 to - 1) b[2i + + j] 8800 f[i] xy mod q 8801 end for 8802 return f 8803 ``` 8804 8805 The NIST FIPS 203 standard can be found at 8806 <https://csrc.nist.gov/pubs/fips/203/ipd>. 8807 */ 8808 /** 8809 A monomorphic instance of 8810 libcrux_ml_kem.sampling.sample_from_binomial_distribution_2 with types 8811 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 8812 8813 */ 8814 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 8815 libcrux_ml_kem_sampling_sample_from_binomial_distribution_2_ea( 8816 Eurydice_slice randomness) { 8817 int16_t sampled_i16s[256U] = {0U}; 8818 for (size_t i0 = (size_t)0U; 8819 i0 < Eurydice_slice_len(randomness, uint8_t) / (size_t)4U; i0++) { 8820 size_t chunk_number = i0; 8821 Eurydice_slice byte_chunk = Eurydice_slice_subslice3( 8822 randomness, chunk_number * (size_t)4U, 8823 chunk_number * (size_t)4U + (size_t)4U, uint8_t *); 8824 uint32_t random_bits_as_u32 = 8825 (((uint32_t)Eurydice_slice_index(byte_chunk, (size_t)0U, uint8_t, 8826 uint8_t *) | 8827 (uint32_t)Eurydice_slice_index(byte_chunk, (size_t)1U, uint8_t, 8828 uint8_t *) 8829 << 8U) | 8830 (uint32_t)Eurydice_slice_index(byte_chunk, (size_t)2U, uint8_t, 8831 uint8_t *) 8832 << 16U) | 8833 (uint32_t)Eurydice_slice_index(byte_chunk, (size_t)3U, uint8_t, 8834 uint8_t *) 8835 << 24U; 8836 uint32_t even_bits = random_bits_as_u32 & 1431655765U; 8837 uint32_t odd_bits = random_bits_as_u32 >> 1U & 1431655765U; 8838 uint32_t coin_toss_outcomes = even_bits + odd_bits; 8839 for (uint32_t i = 0U; i < 32U / 4U; i++) { 8840 uint32_t outcome_set = i; 8841 uint32_t outcome_set0 = outcome_set * 4U; 8842 int16_t outcome_1 = 8843 (int16_t)(coin_toss_outcomes >> (uint32_t)outcome_set0 & 3U); 8844 int16_t outcome_2 = 8845 (int16_t)(coin_toss_outcomes >> (uint32_t)(outcome_set0 + 2U) & 3U); 8846 size_t offset = (size_t)(outcome_set0 >> 2U); 8847 sampled_i16s[(size_t)8U * chunk_number + offset] = outcome_1 - outcome_2; 8848 } 8849 } 8850 return libcrux_ml_kem_polynomial_from_i16_array_d6_ea( 8851 Eurydice_array_to_slice((size_t)256U, sampled_i16s, int16_t)); 8852 } 8853 8854 /** 8855 A monomorphic instance of 8856 libcrux_ml_kem.sampling.sample_from_binomial_distribution with types 8857 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 8858 - ETA= 2 8859 */ 8860 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 8861 libcrux_ml_kem_sampling_sample_from_binomial_distribution_a0( 8862 Eurydice_slice randomness) { 8863 return libcrux_ml_kem_sampling_sample_from_binomial_distribution_2_ea( 8864 randomness); 8865 } 8866 8867 /** 8868 A monomorphic instance of libcrux_ml_kem.ntt.ntt_at_layer_7 8869 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 8870 with const generics 8871 8872 */ 8873 static KRML_MUSTINLINE void libcrux_ml_kem_ntt_ntt_at_layer_7_ea( 8874 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *re) { 8875 size_t step = LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT / (size_t)2U; 8876 for (size_t i = (size_t)0U; i < step; i++) { 8877 size_t j = i; 8878 libcrux_ml_kem_vector_portable_vector_type_PortableVector t = 8879 libcrux_ml_kem_vector_portable_multiply_by_constant_b8( 8880 re->coefficients[j + step], (int16_t)-1600); 8881 re->coefficients[j + step] = 8882 libcrux_ml_kem_vector_portable_sub_b8(re->coefficients[j], &t); 8883 libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____1 = 8884 libcrux_ml_kem_vector_portable_add_b8(re->coefficients[j], &t); 8885 re->coefficients[j] = uu____1; 8886 } 8887 } 8888 8889 /** 8890 A monomorphic instance of libcrux_ml_kem.ntt.ntt_binomially_sampled_ring_element 8891 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 8892 with const generics 8893 8894 */ 8895 static KRML_MUSTINLINE void 8896 libcrux_ml_kem_ntt_ntt_binomially_sampled_ring_element_ea( 8897 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *re) { 8898 libcrux_ml_kem_ntt_ntt_at_layer_7_ea(re); 8899 size_t zeta_i = (size_t)1U; 8900 libcrux_ml_kem_ntt_ntt_at_layer_4_plus_ea(&zeta_i, re, (size_t)6U, 8901 (size_t)11207U); 8902 libcrux_ml_kem_ntt_ntt_at_layer_4_plus_ea(&zeta_i, re, (size_t)5U, 8903 (size_t)11207U + (size_t)3328U); 8904 libcrux_ml_kem_ntt_ntt_at_layer_4_plus_ea( 8905 &zeta_i, re, (size_t)4U, (size_t)11207U + (size_t)2U * (size_t)3328U); 8906 libcrux_ml_kem_ntt_ntt_at_layer_3_ea( 8907 &zeta_i, re, (size_t)11207U + (size_t)3U * (size_t)3328U); 8908 libcrux_ml_kem_ntt_ntt_at_layer_2_ea( 8909 &zeta_i, re, (size_t)11207U + (size_t)4U * (size_t)3328U); 8910 libcrux_ml_kem_ntt_ntt_at_layer_1_ea( 8911 &zeta_i, re, (size_t)11207U + (size_t)5U * (size_t)3328U); 8912 libcrux_ml_kem_polynomial_poly_barrett_reduce_d6_ea(re); 8913 } 8914 8915 /** 8916 Sample a vector of ring elements from a centered binomial distribution and 8917 convert them into their NTT representations. 8918 */ 8919 /** 8920 A monomorphic instance of libcrux_ml_kem.ind_cpa.sample_vector_cbd_then_ntt 8921 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 8922 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const 8923 generics 8924 - K= 3 8925 - ETA= 2 8926 - ETA_RANDOMNESS_SIZE= 128 8927 */ 8928 static KRML_MUSTINLINE uint8_t 8929 libcrux_ml_kem_ind_cpa_sample_vector_cbd_then_ntt_3b( 8930 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *re_as_ntt, 8931 uint8_t *prf_input, uint8_t domain_separator) { 8932 uint8_t prf_inputs[3U][33U]; 8933 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 8934 core_array__core__clone__Clone_for__Array_T__N___clone( 8935 (size_t)33U, prf_input, prf_inputs[i], uint8_t, void *); 8936 } 8937 domain_separator = 8938 libcrux_ml_kem_utils_prf_input_inc_e0(prf_inputs, domain_separator); 8939 uint8_t prf_outputs[3U][128U]; 8940 libcrux_ml_kem_hash_functions_portable_PRFxN_4a_41(prf_inputs, prf_outputs); 8941 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 8942 size_t i0 = i; 8943 re_as_ntt[i0] = 8944 libcrux_ml_kem_sampling_sample_from_binomial_distribution_a0( 8945 Eurydice_array_to_slice((size_t)128U, prf_outputs[i0], uint8_t)); 8946 libcrux_ml_kem_ntt_ntt_binomially_sampled_ring_element_ea(&re_as_ntt[i0]); 8947 } 8948 return domain_separator; 8949 } 8950 8951 /** 8952 This function found in impl {core::ops::function::FnMut<(usize), 8953 libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 8954 TraitClause@2]> for libcrux_ml_kem::ind_cpa::encrypt_c1::closure#1<Vector, 8955 Hasher, K, C1_LEN, U_COMPRESSION_FACTOR, BLOCK_LEN, ETA1, ETA1_RANDOMNESS_SIZE, 8956 ETA2, ETA2_RANDOMNESS_SIZE>[TraitClause@0, TraitClause@1, TraitClause@2, 8957 TraitClause@3]} 8958 */ 8959 /** 8960 A monomorphic instance of libcrux_ml_kem.ind_cpa.encrypt_c1.call_mut_dd 8961 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 8962 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const 8963 generics 8964 - K= 3 8965 - C1_LEN= 960 8966 - U_COMPRESSION_FACTOR= 10 8967 - BLOCK_LEN= 320 8968 - ETA1= 2 8969 - ETA1_RANDOMNESS_SIZE= 128 8970 - ETA2= 2 8971 - ETA2_RANDOMNESS_SIZE= 128 8972 */ 8973 static inline libcrux_ml_kem_polynomial_PolynomialRingElement_1d 8974 libcrux_ml_kem_ind_cpa_encrypt_c1_call_mut_dd_85(void **_, size_t tupled_args) { 8975 return libcrux_ml_kem_polynomial_ZERO_d6_ea(); 8976 } 8977 8978 /** 8979 Sample a vector of ring elements from a centered binomial distribution. 8980 */ 8981 /** 8982 A monomorphic instance of libcrux_ml_kem.ind_cpa.sample_ring_element_cbd 8983 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 8984 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const 8985 generics 8986 - K= 3 8987 - ETA2_RANDOMNESS_SIZE= 128 8988 - ETA2= 2 8989 */ 8990 static KRML_MUSTINLINE uint8_t 8991 libcrux_ml_kem_ind_cpa_sample_ring_element_cbd_3b( 8992 uint8_t *prf_input, uint8_t domain_separator, 8993 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *error_1) { 8994 uint8_t prf_inputs[3U][33U]; 8995 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 8996 core_array__core__clone__Clone_for__Array_T__N___clone( 8997 (size_t)33U, prf_input, prf_inputs[i], uint8_t, void *); 8998 } 8999 domain_separator = 9000 libcrux_ml_kem_utils_prf_input_inc_e0(prf_inputs, domain_separator); 9001 uint8_t prf_outputs[3U][128U]; 9002 libcrux_ml_kem_hash_functions_portable_PRFxN_4a_41(prf_inputs, prf_outputs); 9003 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 9004 size_t i0 = i; 9005 libcrux_ml_kem_polynomial_PolynomialRingElement_1d uu____0 = 9006 libcrux_ml_kem_sampling_sample_from_binomial_distribution_a0( 9007 Eurydice_array_to_slice((size_t)128U, prf_outputs[i0], uint8_t)); 9008 error_1[i0] = uu____0; 9009 } 9010 return domain_separator; 9011 } 9012 9013 /** 9014 A monomorphic instance of libcrux_ml_kem.hash_functions.portable.PRF 9015 with const generics 9016 - LEN= 128 9017 */ 9018 static inline void libcrux_ml_kem_hash_functions_portable_PRF_a6( 9019 Eurydice_slice input, uint8_t ret[128U]) { 9020 uint8_t digest[128U] = {0U}; 9021 libcrux_sha3_portable_shake256( 9022 Eurydice_array_to_slice((size_t)128U, digest, uint8_t), input); 9023 memcpy(ret, digest, (size_t)128U * sizeof(uint8_t)); 9024 } 9025 9026 /** 9027 This function found in impl {libcrux_ml_kem::hash_functions::Hash<K> for 9028 libcrux_ml_kem::hash_functions::portable::PortableHash<K>} 9029 */ 9030 /** 9031 A monomorphic instance of libcrux_ml_kem.hash_functions.portable.PRF_4a 9032 with const generics 9033 - K= 3 9034 - LEN= 128 9035 */ 9036 static inline void libcrux_ml_kem_hash_functions_portable_PRF_4a_410( 9037 Eurydice_slice input, uint8_t ret[128U]) { 9038 libcrux_ml_kem_hash_functions_portable_PRF_a6(input, ret); 9039 } 9040 9041 /** 9042 This function found in impl {core::ops::function::FnMut<(usize), 9043 libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 9044 TraitClause@1]> for libcrux_ml_kem::matrix::compute_vector_u::closure<Vector, 9045 K>[TraitClause@0, TraitClause@1]} 9046 */ 9047 /** 9048 A monomorphic instance of libcrux_ml_kem.matrix.compute_vector_u.call_mut_a8 9049 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 9050 with const generics 9051 - K= 3 9052 */ 9053 static inline libcrux_ml_kem_polynomial_PolynomialRingElement_1d 9054 libcrux_ml_kem_matrix_compute_vector_u_call_mut_a8_1b(void **_, 9055 size_t tupled_args) { 9056 return libcrux_ml_kem_polynomial_ZERO_d6_ea(); 9057 } 9058 9059 /** 9060 A monomorphic instance of libcrux_ml_kem.polynomial.add_error_reduce 9061 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 9062 with const generics 9063 9064 */ 9065 static KRML_MUSTINLINE void libcrux_ml_kem_polynomial_add_error_reduce_ea( 9066 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *myself, 9067 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *error) { 9068 for (size_t i = (size_t)0U; 9069 i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { 9070 size_t j = i; 9071 libcrux_ml_kem_vector_portable_vector_type_PortableVector 9072 coefficient_normal_form = 9073 libcrux_ml_kem_vector_portable_montgomery_multiply_by_constant_b8( 9074 myself->coefficients[j], (int16_t)1441); 9075 libcrux_ml_kem_vector_portable_vector_type_PortableVector sum = 9076 libcrux_ml_kem_vector_portable_add_b8(coefficient_normal_form, 9077 &error->coefficients[j]); 9078 libcrux_ml_kem_vector_portable_vector_type_PortableVector red = 9079 libcrux_ml_kem_vector_portable_barrett_reduce_b8(sum); 9080 myself->coefficients[j] = red; 9081 } 9082 } 9083 9084 /** 9085 This function found in impl 9086 {libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 9087 TraitClause@1]} 9088 */ 9089 /** 9090 A monomorphic instance of libcrux_ml_kem.polynomial.add_error_reduce_d6 9091 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 9092 with const generics 9093 9094 */ 9095 static KRML_MUSTINLINE void libcrux_ml_kem_polynomial_add_error_reduce_d6_ea( 9096 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *self, 9097 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *error) { 9098 libcrux_ml_kem_polynomial_add_error_reduce_ea(self, error); 9099 } 9100 9101 /** 9102 Compute u := InvertNTT(A r) + e 9103 */ 9104 /** 9105 A monomorphic instance of libcrux_ml_kem.matrix.compute_vector_u 9106 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 9107 with const generics 9108 - K= 3 9109 */ 9110 static KRML_MUSTINLINE void libcrux_ml_kem_matrix_compute_vector_u_1b( 9111 libcrux_ml_kem_polynomial_PolynomialRingElement_1d (*a_as_ntt)[3U], 9112 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *r_as_ntt, 9113 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *error_1, 9114 libcrux_ml_kem_polynomial_PolynomialRingElement_1d ret[3U]) { 9115 libcrux_ml_kem_polynomial_PolynomialRingElement_1d result[3U]; 9116 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 9117 /* original Rust expression is not an lvalue in C */ 9118 void *lvalue = (void *)0U; 9119 result[i] = 9120 libcrux_ml_kem_matrix_compute_vector_u_call_mut_a8_1b(&lvalue, i); 9121 } 9122 for (size_t i0 = (size_t)0U; 9123 i0 < Eurydice_slice_len( 9124 Eurydice_array_to_slice( 9125 (size_t)3U, a_as_ntt, 9126 libcrux_ml_kem_polynomial_PolynomialRingElement_1d[3U]), 9127 libcrux_ml_kem_polynomial_PolynomialRingElement_1d[3U]); 9128 i0++) { 9129 size_t i1 = i0; 9130 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *row = a_as_ntt[i1]; 9131 for (size_t i = (size_t)0U; 9132 i < Eurydice_slice_len( 9133 Eurydice_array_to_slice( 9134 (size_t)3U, row, 9135 libcrux_ml_kem_polynomial_PolynomialRingElement_1d), 9136 libcrux_ml_kem_polynomial_PolynomialRingElement_1d); 9137 i++) { 9138 size_t j = i; 9139 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *a_element = &row[j]; 9140 libcrux_ml_kem_polynomial_PolynomialRingElement_1d product = 9141 libcrux_ml_kem_polynomial_ntt_multiply_d6_ea(a_element, &r_as_ntt[j]); 9142 libcrux_ml_kem_polynomial_add_to_ring_element_d6_1b(&result[i1], 9143 &product); 9144 } 9145 libcrux_ml_kem_invert_ntt_invert_ntt_montgomery_1b(&result[i1]); 9146 libcrux_ml_kem_polynomial_add_error_reduce_d6_ea(&result[i1], &error_1[i1]); 9147 } 9148 memcpy( 9149 ret, result, 9150 (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d)); 9151 } 9152 9153 /** 9154 A monomorphic instance of libcrux_ml_kem.vector.portable.compress.compress 9155 with const generics 9156 - COEFFICIENT_BITS= 10 9157 */ 9158 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 9159 libcrux_ml_kem_vector_portable_compress_compress_ef( 9160 libcrux_ml_kem_vector_portable_vector_type_PortableVector a) { 9161 for (size_t i = (size_t)0U; 9162 i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { 9163 size_t i0 = i; 9164 int16_t uu____0 = libcrux_secrets_int_as_i16_f5( 9165 libcrux_ml_kem_vector_portable_compress_compress_ciphertext_coefficient( 9166 (uint8_t)(int32_t)10, 9167 libcrux_secrets_int_as_u16_f5(a.elements[i0]))); 9168 a.elements[i0] = uu____0; 9169 } 9170 return a; 9171 } 9172 9173 /** 9174 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 9175 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 9176 */ 9177 /** 9178 A monomorphic instance of libcrux_ml_kem.vector.portable.compress_b8 9179 with const generics 9180 - COEFFICIENT_BITS= 10 9181 */ 9182 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 9183 libcrux_ml_kem_vector_portable_compress_b8_ef( 9184 libcrux_ml_kem_vector_portable_vector_type_PortableVector a) { 9185 return libcrux_ml_kem_vector_portable_compress_compress_ef(a); 9186 } 9187 9188 /** 9189 A monomorphic instance of libcrux_ml_kem.serialize.compress_then_serialize_10 9190 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 9191 with const generics 9192 - OUT_LEN= 320 9193 */ 9194 static KRML_MUSTINLINE void 9195 libcrux_ml_kem_serialize_compress_then_serialize_10_ff( 9196 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *re, uint8_t ret[320U]) { 9197 uint8_t serialized[320U] = {0U}; 9198 for (size_t i = (size_t)0U; 9199 i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { 9200 size_t i0 = i; 9201 libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficient = 9202 libcrux_ml_kem_vector_portable_compress_b8_ef( 9203 libcrux_ml_kem_serialize_to_unsigned_field_modulus_ea( 9204 re->coefficients[i0])); 9205 uint8_t bytes[20U]; 9206 libcrux_ml_kem_vector_portable_serialize_10_b8(coefficient, bytes); 9207 Eurydice_slice_copy( 9208 Eurydice_array_to_subslice3(serialized, (size_t)20U * i0, 9209 (size_t)20U * i0 + (size_t)20U, uint8_t *), 9210 Eurydice_array_to_slice((size_t)20U, bytes, uint8_t), uint8_t); 9211 } 9212 memcpy(ret, serialized, (size_t)320U * sizeof(uint8_t)); 9213 } 9214 9215 /** 9216 A monomorphic instance of 9217 libcrux_ml_kem.serialize.compress_then_serialize_ring_element_u with types 9218 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 9219 - COMPRESSION_FACTOR= 10 9220 - OUT_LEN= 320 9221 */ 9222 static KRML_MUSTINLINE void 9223 libcrux_ml_kem_serialize_compress_then_serialize_ring_element_u_fe( 9224 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *re, uint8_t ret[320U]) { 9225 uint8_t uu____0[320U]; 9226 libcrux_ml_kem_serialize_compress_then_serialize_10_ff(re, uu____0); 9227 memcpy(ret, uu____0, (size_t)320U * sizeof(uint8_t)); 9228 } 9229 9230 /** 9231 Call [`compress_then_serialize_ring_element_u`] on each ring element. 9232 */ 9233 /** 9234 A monomorphic instance of libcrux_ml_kem.ind_cpa.compress_then_serialize_u 9235 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 9236 with const generics 9237 - K= 3 9238 - OUT_LEN= 960 9239 - COMPRESSION_FACTOR= 10 9240 - BLOCK_LEN= 320 9241 */ 9242 static KRML_MUSTINLINE void libcrux_ml_kem_ind_cpa_compress_then_serialize_u_43( 9243 libcrux_ml_kem_polynomial_PolynomialRingElement_1d input[3U], 9244 Eurydice_slice out) { 9245 for (size_t i = (size_t)0U; 9246 i < Eurydice_slice_len( 9247 Eurydice_array_to_slice( 9248 (size_t)3U, input, 9249 libcrux_ml_kem_polynomial_PolynomialRingElement_1d), 9250 libcrux_ml_kem_polynomial_PolynomialRingElement_1d); 9251 i++) { 9252 size_t i0 = i; 9253 libcrux_ml_kem_polynomial_PolynomialRingElement_1d re = input[i0]; 9254 Eurydice_slice uu____0 = Eurydice_slice_subslice3( 9255 out, i0 * ((size_t)960U / (size_t)3U), 9256 (i0 + (size_t)1U) * ((size_t)960U / (size_t)3U), uint8_t *); 9257 uint8_t ret[320U]; 9258 libcrux_ml_kem_serialize_compress_then_serialize_ring_element_u_fe(&re, 9259 ret); 9260 Eurydice_slice_copy( 9261 uu____0, Eurydice_array_to_slice((size_t)320U, ret, uint8_t), uint8_t); 9262 } 9263 } 9264 9265 /** 9266 A monomorphic instance of libcrux_ml_kem.ind_cpa.encrypt_c1 9267 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 9268 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const 9269 generics 9270 - K= 3 9271 - C1_LEN= 960 9272 - U_COMPRESSION_FACTOR= 10 9273 - BLOCK_LEN= 320 9274 - ETA1= 2 9275 - ETA1_RANDOMNESS_SIZE= 128 9276 - ETA2= 2 9277 - ETA2_RANDOMNESS_SIZE= 128 9278 */ 9279 static KRML_MUSTINLINE tuple_ed libcrux_ml_kem_ind_cpa_encrypt_c1_85( 9280 Eurydice_slice randomness, 9281 libcrux_ml_kem_polynomial_PolynomialRingElement_1d (*matrix)[3U], 9282 Eurydice_slice ciphertext) { 9283 uint8_t prf_input[33U]; 9284 libcrux_ml_kem_utils_into_padded_array_c8(randomness, prf_input); 9285 libcrux_ml_kem_polynomial_PolynomialRingElement_1d r_as_ntt[3U]; 9286 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 9287 /* original Rust expression is not an lvalue in C */ 9288 void *lvalue = (void *)0U; 9289 r_as_ntt[i] = libcrux_ml_kem_ind_cpa_encrypt_c1_call_mut_f1_85(&lvalue, i); 9290 } 9291 uint8_t domain_separator0 = 9292 libcrux_ml_kem_ind_cpa_sample_vector_cbd_then_ntt_3b(r_as_ntt, prf_input, 9293 0U); 9294 libcrux_ml_kem_polynomial_PolynomialRingElement_1d error_1[3U]; 9295 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 9296 /* original Rust expression is not an lvalue in C */ 9297 void *lvalue = (void *)0U; 9298 error_1[i] = libcrux_ml_kem_ind_cpa_encrypt_c1_call_mut_dd_85(&lvalue, i); 9299 } 9300 uint8_t domain_separator = libcrux_ml_kem_ind_cpa_sample_ring_element_cbd_3b( 9301 prf_input, domain_separator0, error_1); 9302 prf_input[32U] = domain_separator; 9303 uint8_t prf_output[128U]; 9304 libcrux_ml_kem_hash_functions_portable_PRF_4a_410( 9305 Eurydice_array_to_slice((size_t)33U, prf_input, uint8_t), prf_output); 9306 libcrux_ml_kem_polynomial_PolynomialRingElement_1d error_2 = 9307 libcrux_ml_kem_sampling_sample_from_binomial_distribution_a0( 9308 Eurydice_array_to_slice((size_t)128U, prf_output, uint8_t)); 9309 libcrux_ml_kem_polynomial_PolynomialRingElement_1d u[3U]; 9310 libcrux_ml_kem_matrix_compute_vector_u_1b(matrix, r_as_ntt, error_1, u); 9311 libcrux_ml_kem_polynomial_PolynomialRingElement_1d uu____0[3U]; 9312 memcpy( 9313 uu____0, u, 9314 (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d)); 9315 libcrux_ml_kem_ind_cpa_compress_then_serialize_u_43(uu____0, ciphertext); 9316 /* Passing arrays by value in Rust generates a copy in C */ 9317 libcrux_ml_kem_polynomial_PolynomialRingElement_1d copy_of_r_as_ntt[3U]; 9318 memcpy( 9319 copy_of_r_as_ntt, r_as_ntt, 9320 (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d)); 9321 tuple_ed lit; 9322 memcpy( 9323 lit.fst, copy_of_r_as_ntt, 9324 (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d)); 9325 lit.snd = error_2; 9326 return lit; 9327 } 9328 9329 /** 9330 A monomorphic instance of 9331 libcrux_ml_kem.serialize.deserialize_then_decompress_message with types 9332 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 9333 9334 */ 9335 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 9336 libcrux_ml_kem_serialize_deserialize_then_decompress_message_ea( 9337 uint8_t *serialized) { 9338 libcrux_ml_kem_polynomial_PolynomialRingElement_1d re = 9339 libcrux_ml_kem_polynomial_ZERO_d6_ea(); 9340 for (size_t i = (size_t)0U; i < (size_t)16U; i++) { 9341 size_t i0 = i; 9342 libcrux_ml_kem_vector_portable_vector_type_PortableVector 9343 coefficient_compressed = 9344 libcrux_ml_kem_vector_portable_deserialize_1_b8( 9345 Eurydice_array_to_subslice3(serialized, (size_t)2U * i0, 9346 (size_t)2U * i0 + (size_t)2U, 9347 uint8_t *)); 9348 libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = 9349 libcrux_ml_kem_vector_portable_decompress_1_b8(coefficient_compressed); 9350 re.coefficients[i0] = uu____0; 9351 } 9352 return re; 9353 } 9354 9355 /** 9356 A monomorphic instance of libcrux_ml_kem.polynomial.add_message_error_reduce 9357 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 9358 with const generics 9359 9360 */ 9361 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 9362 libcrux_ml_kem_polynomial_add_message_error_reduce_ea( 9363 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *myself, 9364 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *message, 9365 libcrux_ml_kem_polynomial_PolynomialRingElement_1d result) { 9366 for (size_t i = (size_t)0U; 9367 i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { 9368 size_t i0 = i; 9369 libcrux_ml_kem_vector_portable_vector_type_PortableVector 9370 coefficient_normal_form = 9371 libcrux_ml_kem_vector_portable_montgomery_multiply_by_constant_b8( 9372 result.coefficients[i0], (int16_t)1441); 9373 libcrux_ml_kem_vector_portable_vector_type_PortableVector sum1 = 9374 libcrux_ml_kem_vector_portable_add_b8(myself->coefficients[i0], 9375 &message->coefficients[i0]); 9376 libcrux_ml_kem_vector_portable_vector_type_PortableVector sum2 = 9377 libcrux_ml_kem_vector_portable_add_b8(coefficient_normal_form, &sum1); 9378 libcrux_ml_kem_vector_portable_vector_type_PortableVector red = 9379 libcrux_ml_kem_vector_portable_barrett_reduce_b8(sum2); 9380 result.coefficients[i0] = red; 9381 } 9382 return result; 9383 } 9384 9385 /** 9386 This function found in impl 9387 {libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 9388 TraitClause@1]} 9389 */ 9390 /** 9391 A monomorphic instance of libcrux_ml_kem.polynomial.add_message_error_reduce_d6 9392 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 9393 with const generics 9394 9395 */ 9396 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 9397 libcrux_ml_kem_polynomial_add_message_error_reduce_d6_ea( 9398 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *self, 9399 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *message, 9400 libcrux_ml_kem_polynomial_PolynomialRingElement_1d result) { 9401 return libcrux_ml_kem_polynomial_add_message_error_reduce_ea(self, message, 9402 result); 9403 } 9404 9405 /** 9406 Compute InverseNTT(t r) + e + message 9407 */ 9408 /** 9409 A monomorphic instance of libcrux_ml_kem.matrix.compute_ring_element_v 9410 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 9411 with const generics 9412 - K= 3 9413 */ 9414 static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_1d 9415 libcrux_ml_kem_matrix_compute_ring_element_v_1b( 9416 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *t_as_ntt, 9417 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *r_as_ntt, 9418 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *error_2, 9419 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *message) { 9420 libcrux_ml_kem_polynomial_PolynomialRingElement_1d result = 9421 libcrux_ml_kem_polynomial_ZERO_d6_ea(); 9422 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 9423 size_t i0 = i; 9424 libcrux_ml_kem_polynomial_PolynomialRingElement_1d product = 9425 libcrux_ml_kem_polynomial_ntt_multiply_d6_ea(&t_as_ntt[i0], 9426 &r_as_ntt[i0]); 9427 libcrux_ml_kem_polynomial_add_to_ring_element_d6_1b(&result, &product); 9428 } 9429 libcrux_ml_kem_invert_ntt_invert_ntt_montgomery_1b(&result); 9430 return libcrux_ml_kem_polynomial_add_message_error_reduce_d6_ea( 9431 error_2, message, result); 9432 } 9433 9434 /** 9435 A monomorphic instance of libcrux_ml_kem.vector.portable.compress.compress 9436 with const generics 9437 - COEFFICIENT_BITS= 4 9438 */ 9439 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 9440 libcrux_ml_kem_vector_portable_compress_compress_d1( 9441 libcrux_ml_kem_vector_portable_vector_type_PortableVector a) { 9442 for (size_t i = (size_t)0U; 9443 i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { 9444 size_t i0 = i; 9445 int16_t uu____0 = libcrux_secrets_int_as_i16_f5( 9446 libcrux_ml_kem_vector_portable_compress_compress_ciphertext_coefficient( 9447 (uint8_t)(int32_t)4, 9448 libcrux_secrets_int_as_u16_f5(a.elements[i0]))); 9449 a.elements[i0] = uu____0; 9450 } 9451 return a; 9452 } 9453 9454 /** 9455 This function found in impl {libcrux_ml_kem::vector::traits::Operations for 9456 libcrux_ml_kem::vector::portable::vector_type::PortableVector} 9457 */ 9458 /** 9459 A monomorphic instance of libcrux_ml_kem.vector.portable.compress_b8 9460 with const generics 9461 - COEFFICIENT_BITS= 4 9462 */ 9463 static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector 9464 libcrux_ml_kem_vector_portable_compress_b8_d1( 9465 libcrux_ml_kem_vector_portable_vector_type_PortableVector a) { 9466 return libcrux_ml_kem_vector_portable_compress_compress_d1(a); 9467 } 9468 9469 /** 9470 A monomorphic instance of libcrux_ml_kem.serialize.compress_then_serialize_4 9471 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 9472 with const generics 9473 9474 */ 9475 static KRML_MUSTINLINE void 9476 libcrux_ml_kem_serialize_compress_then_serialize_4_ea( 9477 libcrux_ml_kem_polynomial_PolynomialRingElement_1d re, 9478 Eurydice_slice serialized) { 9479 for (size_t i = (size_t)0U; 9480 i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { 9481 size_t i0 = i; 9482 libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficient = 9483 libcrux_ml_kem_vector_portable_compress_b8_d1( 9484 libcrux_ml_kem_serialize_to_unsigned_field_modulus_ea( 9485 re.coefficients[i0])); 9486 uint8_t bytes[8U]; 9487 libcrux_ml_kem_vector_portable_serialize_4_b8(coefficient, bytes); 9488 Eurydice_slice_copy( 9489 Eurydice_slice_subslice3(serialized, (size_t)8U * i0, 9490 (size_t)8U * i0 + (size_t)8U, uint8_t *), 9491 Eurydice_array_to_slice((size_t)8U, bytes, uint8_t), uint8_t); 9492 } 9493 } 9494 9495 /** 9496 A monomorphic instance of 9497 libcrux_ml_kem.serialize.compress_then_serialize_ring_element_v with types 9498 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 9499 - K= 3 9500 - COMPRESSION_FACTOR= 4 9501 - OUT_LEN= 128 9502 */ 9503 static KRML_MUSTINLINE void 9504 libcrux_ml_kem_serialize_compress_then_serialize_ring_element_v_6c( 9505 libcrux_ml_kem_polynomial_PolynomialRingElement_1d re, Eurydice_slice out) { 9506 libcrux_ml_kem_serialize_compress_then_serialize_4_ea(re, out); 9507 } 9508 9509 /** 9510 A monomorphic instance of libcrux_ml_kem.ind_cpa.encrypt_c2 9511 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 9512 with const generics 9513 - K= 3 9514 - V_COMPRESSION_FACTOR= 4 9515 - C2_LEN= 128 9516 */ 9517 static KRML_MUSTINLINE void libcrux_ml_kem_ind_cpa_encrypt_c2_6c( 9518 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *t_as_ntt, 9519 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *r_as_ntt, 9520 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *error_2, 9521 uint8_t *message, Eurydice_slice ciphertext) { 9522 libcrux_ml_kem_polynomial_PolynomialRingElement_1d message_as_ring_element = 9523 libcrux_ml_kem_serialize_deserialize_then_decompress_message_ea(message); 9524 libcrux_ml_kem_polynomial_PolynomialRingElement_1d v = 9525 libcrux_ml_kem_matrix_compute_ring_element_v_1b( 9526 t_as_ntt, r_as_ntt, error_2, &message_as_ring_element); 9527 libcrux_ml_kem_serialize_compress_then_serialize_ring_element_v_6c( 9528 v, ciphertext); 9529 } 9530 9531 /** 9532 This function implements <strong>Algorithm 13</strong> of the 9533 NIST FIPS 203 specification; this is the Kyber CPA-PKE encryption algorithm. 9534 9535 Algorithm 13 is reproduced below: 9536 9537 ```plaintext 9538 Input: encryption key ek ^{384k+32}. 9539 Input: message m ^{32}. 9540 Input: encryption randomness r ^{32}. 9541 Output: ciphertext c ^{32(dk + d)}. 9542 9543 N 0 9544 t ByteDecode(ek[0:384k]) 9545 ek[384k: 384k + 32] 9546 for (i 0; i < k; i++) 9547 for(j 0; j < k; j++) 9548 [i,j] SampleNTT(XOF(, i, j)) 9549 end for 9550 end for 9551 for(i 0; i < k; i++) 9552 r[i] SamplePolyCBD_{}(PRF_{}(r,N)) 9553 N N + 1 9554 end for 9555 for(i 0; i < k; i++) 9556 e[i] SamplePolyCBD_{}(PRF_{}(r,N)) 9557 N N + 1 9558 end for 9559 e SamplePolyCBD_{}(PRF_{}(r,N)) 9560 r NTT(r) 9561 u NTT-( r) + e 9562 Decompress(ByteDecode(m))) 9563 v NTT-(t r) + e + 9564 c ByteEncode_{d}(Compress_{d}(u)) 9565 c ByteEncode_{d}(Compress_{d}(v)) 9566 return c (c c) 9567 ``` 9568 9569 The NIST FIPS 203 standard can be found at 9570 <https://csrc.nist.gov/pubs/fips/203/ipd>. 9571 */ 9572 /** 9573 A monomorphic instance of libcrux_ml_kem.ind_cpa.encrypt_unpacked 9574 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 9575 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const 9576 generics 9577 - K= 3 9578 - CIPHERTEXT_SIZE= 1088 9579 - T_AS_NTT_ENCODED_SIZE= 1152 9580 - C1_LEN= 960 9581 - C2_LEN= 128 9582 - U_COMPRESSION_FACTOR= 10 9583 - V_COMPRESSION_FACTOR= 4 9584 - BLOCK_LEN= 320 9585 - ETA1= 2 9586 - ETA1_RANDOMNESS_SIZE= 128 9587 - ETA2= 2 9588 - ETA2_RANDOMNESS_SIZE= 128 9589 */ 9590 static KRML_MUSTINLINE void libcrux_ml_kem_ind_cpa_encrypt_unpacked_2a( 9591 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPublicKeyUnpacked_a0 *public_key, 9592 uint8_t *message, Eurydice_slice randomness, uint8_t ret[1088U]) { 9593 uint8_t ciphertext[1088U] = {0U}; 9594 tuple_ed uu____0 = libcrux_ml_kem_ind_cpa_encrypt_c1_85( 9595 randomness, public_key->A, 9596 Eurydice_array_to_subslice3(ciphertext, (size_t)0U, (size_t)960U, 9597 uint8_t *)); 9598 libcrux_ml_kem_polynomial_PolynomialRingElement_1d r_as_ntt[3U]; 9599 memcpy( 9600 r_as_ntt, uu____0.fst, 9601 (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d)); 9602 libcrux_ml_kem_polynomial_PolynomialRingElement_1d error_2 = uu____0.snd; 9603 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *uu____1 = 9604 public_key->t_as_ntt; 9605 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *uu____2 = r_as_ntt; 9606 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *uu____3 = &error_2; 9607 uint8_t *uu____4 = message; 9608 libcrux_ml_kem_ind_cpa_encrypt_c2_6c( 9609 uu____1, uu____2, uu____3, uu____4, 9610 Eurydice_array_to_subslice_from((size_t)1088U, ciphertext, (size_t)960U, 9611 uint8_t, size_t, uint8_t[])); 9612 memcpy(ret, ciphertext, (size_t)1088U * sizeof(uint8_t)); 9613 } 9614 9615 /** 9616 A monomorphic instance of libcrux_ml_kem.ind_cpa.encrypt 9617 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 9618 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const 9619 generics 9620 - K= 3 9621 - CIPHERTEXT_SIZE= 1088 9622 - T_AS_NTT_ENCODED_SIZE= 1152 9623 - C1_LEN= 960 9624 - C2_LEN= 128 9625 - U_COMPRESSION_FACTOR= 10 9626 - V_COMPRESSION_FACTOR= 4 9627 - BLOCK_LEN= 320 9628 - ETA1= 2 9629 - ETA1_RANDOMNESS_SIZE= 128 9630 - ETA2= 2 9631 - ETA2_RANDOMNESS_SIZE= 128 9632 */ 9633 static KRML_MUSTINLINE void libcrux_ml_kem_ind_cpa_encrypt_2a( 9634 Eurydice_slice public_key, uint8_t *message, Eurydice_slice randomness, 9635 uint8_t ret[1088U]) { 9636 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPublicKeyUnpacked_a0 9637 unpacked_public_key = 9638 libcrux_ml_kem_ind_cpa_build_unpacked_public_key_3f(public_key); 9639 uint8_t ret0[1088U]; 9640 libcrux_ml_kem_ind_cpa_encrypt_unpacked_2a(&unpacked_public_key, message, 9641 randomness, ret0); 9642 memcpy(ret, ret0, (size_t)1088U * sizeof(uint8_t)); 9643 } 9644 9645 /** 9646 This function found in impl {libcrux_ml_kem::variant::Variant for 9647 libcrux_ml_kem::variant::MlKem} 9648 */ 9649 /** 9650 A monomorphic instance of libcrux_ml_kem.variant.kdf_39 9651 with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] 9652 with const generics 9653 - K= 3 9654 - CIPHERTEXT_SIZE= 1088 9655 */ 9656 static KRML_MUSTINLINE void libcrux_ml_kem_variant_kdf_39_d6( 9657 Eurydice_slice shared_secret, uint8_t *_, uint8_t ret[32U]) { 9658 uint8_t out[32U] = {0U}; 9659 Eurydice_slice_copy(Eurydice_array_to_slice((size_t)32U, out, uint8_t), 9660 shared_secret, uint8_t); 9661 memcpy(ret, out, (size_t)32U * sizeof(uint8_t)); 9662 } 9663 9664 /** 9665 This code verifies on some machines, runs out of memory on others 9666 */ 9667 /** 9668 A monomorphic instance of libcrux_ml_kem.ind_cca.decapsulate 9669 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 9670 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]], 9671 libcrux_ml_kem_variant_MlKem with const generics 9672 - K= 3 9673 - SECRET_KEY_SIZE= 2400 9674 - CPA_SECRET_KEY_SIZE= 1152 9675 - PUBLIC_KEY_SIZE= 1184 9676 - CIPHERTEXT_SIZE= 1088 9677 - T_AS_NTT_ENCODED_SIZE= 1152 9678 - C1_SIZE= 960 9679 - C2_SIZE= 128 9680 - VECTOR_U_COMPRESSION_FACTOR= 10 9681 - VECTOR_V_COMPRESSION_FACTOR= 4 9682 - C1_BLOCK_SIZE= 320 9683 - ETA1= 2 9684 - ETA1_RANDOMNESS_SIZE= 128 9685 - ETA2= 2 9686 - ETA2_RANDOMNESS_SIZE= 128 9687 - IMPLICIT_REJECTION_HASH_INPUT_SIZE= 1120 9688 */ 9689 static KRML_MUSTINLINE void libcrux_ml_kem_ind_cca_decapsulate_62( 9690 libcrux_ml_kem_types_MlKemPrivateKey_d9 *private_key, 9691 libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext, uint8_t ret[32U]) { 9692 Eurydice_slice_uint8_t_x4 uu____0 = 9693 libcrux_ml_kem_types_unpack_private_key_b4( 9694 Eurydice_array_to_slice((size_t)2400U, private_key->value, uint8_t)); 9695 Eurydice_slice ind_cpa_secret_key = uu____0.fst; 9696 Eurydice_slice ind_cpa_public_key = uu____0.snd; 9697 Eurydice_slice ind_cpa_public_key_hash = uu____0.thd; 9698 Eurydice_slice implicit_rejection_value = uu____0.f3; 9699 uint8_t decrypted[32U]; 9700 libcrux_ml_kem_ind_cpa_decrypt_42(ind_cpa_secret_key, ciphertext->value, 9701 decrypted); 9702 uint8_t to_hash0[64U]; 9703 libcrux_ml_kem_utils_into_padded_array_24( 9704 Eurydice_array_to_slice((size_t)32U, decrypted, uint8_t), to_hash0); 9705 Eurydice_slice_copy( 9706 Eurydice_array_to_subslice_from( 9707 (size_t)64U, to_hash0, LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE, 9708 uint8_t, size_t, uint8_t[]), 9709 ind_cpa_public_key_hash, uint8_t); 9710 uint8_t hashed[64U]; 9711 libcrux_ml_kem_hash_functions_portable_G_4a_e0( 9712 Eurydice_array_to_slice((size_t)64U, to_hash0, uint8_t), hashed); 9713 Eurydice_slice_uint8_t_x2 uu____1 = Eurydice_slice_split_at( 9714 Eurydice_array_to_slice((size_t)64U, hashed, uint8_t), 9715 LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE, uint8_t, 9716 Eurydice_slice_uint8_t_x2); 9717 Eurydice_slice shared_secret0 = uu____1.fst; 9718 Eurydice_slice pseudorandomness = uu____1.snd; 9719 uint8_t to_hash[1120U]; 9720 libcrux_ml_kem_utils_into_padded_array_15(implicit_rejection_value, to_hash); 9721 Eurydice_slice uu____2 = Eurydice_array_to_subslice_from( 9722 (size_t)1120U, to_hash, LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE, 9723 uint8_t, size_t, uint8_t[]); 9724 Eurydice_slice_copy(uu____2, libcrux_ml_kem_types_as_ref_d3_80(ciphertext), 9725 uint8_t); 9726 uint8_t implicit_rejection_shared_secret0[32U]; 9727 libcrux_ml_kem_hash_functions_portable_PRF_4a_41( 9728 Eurydice_array_to_slice((size_t)1120U, to_hash, uint8_t), 9729 implicit_rejection_shared_secret0); 9730 uint8_t expected_ciphertext[1088U]; 9731 libcrux_ml_kem_ind_cpa_encrypt_2a(ind_cpa_public_key, decrypted, 9732 pseudorandomness, expected_ciphertext); 9733 uint8_t implicit_rejection_shared_secret[32U]; 9734 libcrux_ml_kem_variant_kdf_39_d6( 9735 Eurydice_array_to_slice((size_t)32U, implicit_rejection_shared_secret0, 9736 uint8_t), 9737 libcrux_ml_kem_types_as_slice_a9_80(ciphertext), 9738 implicit_rejection_shared_secret); 9739 uint8_t shared_secret[32U]; 9740 libcrux_ml_kem_variant_kdf_39_d6( 9741 shared_secret0, libcrux_ml_kem_types_as_slice_a9_80(ciphertext), 9742 shared_secret); 9743 uint8_t ret0[32U]; 9744 libcrux_ml_kem_constant_time_ops_compare_ciphertexts_select_shared_secret_in_constant_time( 9745 libcrux_ml_kem_types_as_ref_d3_80(ciphertext), 9746 Eurydice_array_to_slice((size_t)1088U, expected_ciphertext, uint8_t), 9747 Eurydice_array_to_slice((size_t)32U, shared_secret, uint8_t), 9748 Eurydice_array_to_slice((size_t)32U, implicit_rejection_shared_secret, 9749 uint8_t), 9750 ret0); 9751 memcpy(ret, ret0, (size_t)32U * sizeof(uint8_t)); 9752 } 9753 9754 /** 9755 Portable decapsulate 9756 */ 9757 /** 9758 A monomorphic instance of 9759 libcrux_ml_kem.ind_cca.instantiations.portable.decapsulate with const generics 9760 - K= 3 9761 - SECRET_KEY_SIZE= 2400 9762 - CPA_SECRET_KEY_SIZE= 1152 9763 - PUBLIC_KEY_SIZE= 1184 9764 - CIPHERTEXT_SIZE= 1088 9765 - T_AS_NTT_ENCODED_SIZE= 1152 9766 - C1_SIZE= 960 9767 - C2_SIZE= 128 9768 - VECTOR_U_COMPRESSION_FACTOR= 10 9769 - VECTOR_V_COMPRESSION_FACTOR= 4 9770 - C1_BLOCK_SIZE= 320 9771 - ETA1= 2 9772 - ETA1_RANDOMNESS_SIZE= 128 9773 - ETA2= 2 9774 - ETA2_RANDOMNESS_SIZE= 128 9775 - IMPLICIT_REJECTION_HASH_INPUT_SIZE= 1120 9776 */ 9777 static inline void 9778 libcrux_ml_kem_ind_cca_instantiations_portable_decapsulate_35( 9779 libcrux_ml_kem_types_MlKemPrivateKey_d9 *private_key, 9780 libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext, uint8_t ret[32U]) { 9781 libcrux_ml_kem_ind_cca_decapsulate_62(private_key, ciphertext, ret); 9782 } 9783 9784 /** 9785 Decapsulate ML-KEM 768 9786 9787 Generates an [`MlKemSharedSecret`]. 9788 The input is a reference to an [`MlKem768PrivateKey`] and an 9789 [`MlKem768Ciphertext`]. 9790 */ 9791 static inline void libcrux_ml_kem_mlkem768_portable_decapsulate( 9792 libcrux_ml_kem_types_MlKemPrivateKey_d9 *private_key, 9793 libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext, uint8_t ret[32U]) { 9794 libcrux_ml_kem_ind_cca_instantiations_portable_decapsulate_35( 9795 private_key, ciphertext, ret); 9796 } 9797 9798 /** 9799 This function found in impl {libcrux_ml_kem::variant::Variant for 9800 libcrux_ml_kem::variant::MlKem} 9801 */ 9802 /** 9803 A monomorphic instance of libcrux_ml_kem.variant.entropy_preprocess_39 9804 with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] 9805 with const generics 9806 - K= 3 9807 */ 9808 static KRML_MUSTINLINE void libcrux_ml_kem_variant_entropy_preprocess_39_9c( 9809 Eurydice_slice randomness, uint8_t ret[32U]) { 9810 uint8_t out[32U] = {0U}; 9811 Eurydice_slice_copy(Eurydice_array_to_slice((size_t)32U, out, uint8_t), 9812 randomness, uint8_t); 9813 memcpy(ret, out, (size_t)32U * sizeof(uint8_t)); 9814 } 9815 9816 /** 9817 This function found in impl {libcrux_ml_kem::hash_functions::Hash<K> for 9818 libcrux_ml_kem::hash_functions::portable::PortableHash<K>} 9819 */ 9820 /** 9821 A monomorphic instance of libcrux_ml_kem.hash_functions.portable.H_4a 9822 with const generics 9823 - K= 3 9824 */ 9825 static inline void libcrux_ml_kem_hash_functions_portable_H_4a_e0( 9826 Eurydice_slice input, uint8_t ret[32U]) { 9827 libcrux_ml_kem_hash_functions_portable_H(input, ret); 9828 } 9829 9830 /** 9831 A monomorphic instance of libcrux_ml_kem.ind_cca.encapsulate 9832 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 9833 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]], 9834 libcrux_ml_kem_variant_MlKem with const generics 9835 - K= 3 9836 - CIPHERTEXT_SIZE= 1088 9837 - PUBLIC_KEY_SIZE= 1184 9838 - T_AS_NTT_ENCODED_SIZE= 1152 9839 - C1_SIZE= 960 9840 - C2_SIZE= 128 9841 - VECTOR_U_COMPRESSION_FACTOR= 10 9842 - VECTOR_V_COMPRESSION_FACTOR= 4 9843 - C1_BLOCK_SIZE= 320 9844 - ETA1= 2 9845 - ETA1_RANDOMNESS_SIZE= 128 9846 - ETA2= 2 9847 - ETA2_RANDOMNESS_SIZE= 128 9848 */ 9849 static KRML_MUSTINLINE tuple_c2 libcrux_ml_kem_ind_cca_encapsulate_ca( 9850 libcrux_ml_kem_types_MlKemPublicKey_30 *public_key, uint8_t *randomness) { 9851 uint8_t randomness0[32U]; 9852 libcrux_ml_kem_variant_entropy_preprocess_39_9c( 9853 Eurydice_array_to_slice((size_t)32U, randomness, uint8_t), randomness0); 9854 uint8_t to_hash[64U]; 9855 libcrux_ml_kem_utils_into_padded_array_24( 9856 Eurydice_array_to_slice((size_t)32U, randomness0, uint8_t), to_hash); 9857 Eurydice_slice uu____0 = Eurydice_array_to_subslice_from( 9858 (size_t)64U, to_hash, LIBCRUX_ML_KEM_CONSTANTS_H_DIGEST_SIZE, uint8_t, 9859 size_t, uint8_t[]); 9860 uint8_t ret0[32U]; 9861 libcrux_ml_kem_hash_functions_portable_H_4a_e0( 9862 Eurydice_array_to_slice((size_t)1184U, 9863 libcrux_ml_kem_types_as_slice_e6_d0(public_key), 9864 uint8_t), 9865 ret0); 9866 Eurydice_slice_copy( 9867 uu____0, Eurydice_array_to_slice((size_t)32U, ret0, uint8_t), uint8_t); 9868 uint8_t hashed[64U]; 9869 libcrux_ml_kem_hash_functions_portable_G_4a_e0( 9870 Eurydice_array_to_slice((size_t)64U, to_hash, uint8_t), hashed); 9871 Eurydice_slice_uint8_t_x2 uu____1 = Eurydice_slice_split_at( 9872 Eurydice_array_to_slice((size_t)64U, hashed, uint8_t), 9873 LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE, uint8_t, 9874 Eurydice_slice_uint8_t_x2); 9875 Eurydice_slice shared_secret = uu____1.fst; 9876 Eurydice_slice pseudorandomness = uu____1.snd; 9877 uint8_t ciphertext[1088U]; 9878 libcrux_ml_kem_ind_cpa_encrypt_2a( 9879 Eurydice_array_to_slice((size_t)1184U, 9880 libcrux_ml_kem_types_as_slice_e6_d0(public_key), 9881 uint8_t), 9882 randomness0, pseudorandomness, ciphertext); 9883 /* Passing arrays by value in Rust generates a copy in C */ 9884 uint8_t copy_of_ciphertext[1088U]; 9885 memcpy(copy_of_ciphertext, ciphertext, (size_t)1088U * sizeof(uint8_t)); 9886 tuple_c2 lit; 9887 lit.fst = libcrux_ml_kem_types_from_e0_80(copy_of_ciphertext); 9888 uint8_t ret[32U]; 9889 libcrux_ml_kem_variant_kdf_39_d6(shared_secret, ciphertext, ret); 9890 memcpy(lit.snd, ret, (size_t)32U * sizeof(uint8_t)); 9891 return lit; 9892 } 9893 9894 /** 9895 A monomorphic instance of 9896 libcrux_ml_kem.ind_cca.instantiations.portable.encapsulate with const generics 9897 - K= 3 9898 - CIPHERTEXT_SIZE= 1088 9899 - PUBLIC_KEY_SIZE= 1184 9900 - T_AS_NTT_ENCODED_SIZE= 1152 9901 - C1_SIZE= 960 9902 - C2_SIZE= 128 9903 - VECTOR_U_COMPRESSION_FACTOR= 10 9904 - VECTOR_V_COMPRESSION_FACTOR= 4 9905 - C1_BLOCK_SIZE= 320 9906 - ETA1= 2 9907 - ETA1_RANDOMNESS_SIZE= 128 9908 - ETA2= 2 9909 - ETA2_RANDOMNESS_SIZE= 128 9910 */ 9911 static inline tuple_c2 9912 libcrux_ml_kem_ind_cca_instantiations_portable_encapsulate_cd( 9913 libcrux_ml_kem_types_MlKemPublicKey_30 *public_key, uint8_t *randomness) { 9914 return libcrux_ml_kem_ind_cca_encapsulate_ca(public_key, randomness); 9915 } 9916 9917 /** 9918 Encapsulate ML-KEM 768 9919 9920 Generates an ([`MlKem768Ciphertext`], [`MlKemSharedSecret`]) tuple. 9921 The input is a reference to an [`MlKem768PublicKey`] and [`SHARED_SECRET_SIZE`] 9922 bytes of `randomness`. 9923 */ 9924 static inline tuple_c2 libcrux_ml_kem_mlkem768_portable_encapsulate( 9925 libcrux_ml_kem_types_MlKemPublicKey_30 *public_key, 9926 uint8_t randomness[32U]) { 9927 return libcrux_ml_kem_ind_cca_instantiations_portable_encapsulate_cd( 9928 public_key, randomness); 9929 } 9930 9931 /** 9932 This function found in impl {core::default::Default for 9933 libcrux_ml_kem::ind_cpa::unpacked::IndCpaPrivateKeyUnpacked<Vector, 9934 K>[TraitClause@0, TraitClause@1]} 9935 */ 9936 /** 9937 A monomorphic instance of libcrux_ml_kem.ind_cpa.unpacked.default_70 9938 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 9939 with const generics 9940 - K= 3 9941 */ 9942 static inline libcrux_ml_kem_ind_cpa_unpacked_IndCpaPrivateKeyUnpacked_a0 9943 libcrux_ml_kem_ind_cpa_unpacked_default_70_1b(void) { 9944 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPrivateKeyUnpacked_a0 lit; 9945 libcrux_ml_kem_polynomial_PolynomialRingElement_1d repeat_expression[3U]; 9946 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 9947 repeat_expression[i] = libcrux_ml_kem_polynomial_ZERO_d6_ea(); 9948 } 9949 memcpy( 9950 lit.secret_as_ntt, repeat_expression, 9951 (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d)); 9952 return lit; 9953 } 9954 9955 /** 9956 This function found in impl {libcrux_ml_kem::variant::Variant for 9957 libcrux_ml_kem::variant::MlKem} 9958 */ 9959 /** 9960 A monomorphic instance of libcrux_ml_kem.variant.cpa_keygen_seed_39 9961 with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] 9962 with const generics 9963 - K= 3 9964 */ 9965 static KRML_MUSTINLINE void libcrux_ml_kem_variant_cpa_keygen_seed_39_9c( 9966 Eurydice_slice key_generation_seed, uint8_t ret[64U]) { 9967 uint8_t seed[33U] = {0U}; 9968 Eurydice_slice_copy( 9969 Eurydice_array_to_subslice3( 9970 seed, (size_t)0U, 9971 LIBCRUX_ML_KEM_CONSTANTS_CPA_PKE_KEY_GENERATION_SEED_SIZE, uint8_t *), 9972 key_generation_seed, uint8_t); 9973 seed[LIBCRUX_ML_KEM_CONSTANTS_CPA_PKE_KEY_GENERATION_SEED_SIZE] = 9974 (uint8_t)(size_t)3U; 9975 uint8_t ret0[64U]; 9976 libcrux_ml_kem_hash_functions_portable_G_4a_e0( 9977 Eurydice_array_to_slice((size_t)33U, seed, uint8_t), ret0); 9978 memcpy(ret, ret0, (size_t)64U * sizeof(uint8_t)); 9979 } 9980 9981 /** 9982 This function found in impl {core::ops::function::FnMut<(usize), 9983 libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 9984 TraitClause@3]> for 9985 libcrux_ml_kem::ind_cpa::generate_keypair_unpacked::closure<Vector, Hasher, 9986 Scheme, K, ETA1, ETA1_RANDOMNESS_SIZE>[TraitClause@0, TraitClause@1, 9987 TraitClause@2, TraitClause@3, TraitClause@4, TraitClause@5]} 9988 */ 9989 /** 9990 A monomorphic instance of 9991 libcrux_ml_kem.ind_cpa.generate_keypair_unpacked.call_mut_73 with types 9992 libcrux_ml_kem_vector_portable_vector_type_PortableVector, 9993 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]], 9994 libcrux_ml_kem_variant_MlKem with const generics 9995 - K= 3 9996 - ETA1= 2 9997 - ETA1_RANDOMNESS_SIZE= 128 9998 */ 9999 static inline libcrux_ml_kem_polynomial_PolynomialRingElement_1d 10000 libcrux_ml_kem_ind_cpa_generate_keypair_unpacked_call_mut_73_1c( 10001 void **_, size_t tupled_args) { 10002 return libcrux_ml_kem_polynomial_ZERO_d6_ea(); 10003 } 10004 10005 /** 10006 A monomorphic instance of libcrux_ml_kem.polynomial.to_standard_domain 10007 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 10008 with const generics 10009 10010 */ 10011 static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector 10012 libcrux_ml_kem_polynomial_to_standard_domain_ea( 10013 libcrux_ml_kem_vector_portable_vector_type_PortableVector vector) { 10014 return libcrux_ml_kem_vector_portable_montgomery_multiply_by_constant_b8( 10015 vector, 10016 LIBCRUX_ML_KEM_VECTOR_TRAITS_MONTGOMERY_R_SQUARED_MOD_FIELD_MODULUS); 10017 } 10018 10019 /** 10020 A monomorphic instance of libcrux_ml_kem.polynomial.add_standard_error_reduce 10021 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 10022 with const generics 10023 10024 */ 10025 static KRML_MUSTINLINE void 10026 libcrux_ml_kem_polynomial_add_standard_error_reduce_ea( 10027 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *myself, 10028 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *error) { 10029 for (size_t i = (size_t)0U; 10030 i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { 10031 size_t j = i; 10032 libcrux_ml_kem_vector_portable_vector_type_PortableVector 10033 coefficient_normal_form = 10034 libcrux_ml_kem_polynomial_to_standard_domain_ea( 10035 myself->coefficients[j]); 10036 libcrux_ml_kem_vector_portable_vector_type_PortableVector sum = 10037 libcrux_ml_kem_vector_portable_add_b8(coefficient_normal_form, 10038 &error->coefficients[j]); 10039 libcrux_ml_kem_vector_portable_vector_type_PortableVector red = 10040 libcrux_ml_kem_vector_portable_barrett_reduce_b8(sum); 10041 myself->coefficients[j] = red; 10042 } 10043 } 10044 10045 /** 10046 This function found in impl 10047 {libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 10048 TraitClause@1]} 10049 */ 10050 /** 10051 A monomorphic instance of libcrux_ml_kem.polynomial.add_standard_error_reduce_d6 10052 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 10053 with const generics 10054 10055 */ 10056 static KRML_MUSTINLINE void 10057 libcrux_ml_kem_polynomial_add_standard_error_reduce_d6_ea( 10058 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *self, 10059 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *error) { 10060 libcrux_ml_kem_polynomial_add_standard_error_reduce_ea(self, error); 10061 } 10062 10063 /** 10064 Compute + 10065 */ 10066 /** 10067 A monomorphic instance of libcrux_ml_kem.matrix.compute_As_plus_e 10068 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 10069 with const generics 10070 - K= 3 10071 */ 10072 static KRML_MUSTINLINE void libcrux_ml_kem_matrix_compute_As_plus_e_1b( 10073 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *t_as_ntt, 10074 libcrux_ml_kem_polynomial_PolynomialRingElement_1d (*matrix_A)[3U], 10075 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *s_as_ntt, 10076 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *error_as_ntt) { 10077 for (size_t i = (size_t)0U; 10078 i < Eurydice_slice_len( 10079 Eurydice_array_to_slice( 10080 (size_t)3U, matrix_A, 10081 libcrux_ml_kem_polynomial_PolynomialRingElement_1d[3U]), 10082 libcrux_ml_kem_polynomial_PolynomialRingElement_1d[3U]); 10083 i++) { 10084 size_t i0 = i; 10085 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *row = matrix_A[i0]; 10086 libcrux_ml_kem_polynomial_PolynomialRingElement_1d uu____0 = 10087 libcrux_ml_kem_polynomial_ZERO_d6_ea(); 10088 t_as_ntt[i0] = uu____0; 10089 for (size_t i1 = (size_t)0U; 10090 i1 < Eurydice_slice_len( 10091 Eurydice_array_to_slice( 10092 (size_t)3U, row, 10093 libcrux_ml_kem_polynomial_PolynomialRingElement_1d), 10094 libcrux_ml_kem_polynomial_PolynomialRingElement_1d); 10095 i1++) { 10096 size_t j = i1; 10097 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *matrix_element = 10098 &row[j]; 10099 libcrux_ml_kem_polynomial_PolynomialRingElement_1d product = 10100 libcrux_ml_kem_polynomial_ntt_multiply_d6_ea(matrix_element, 10101 &s_as_ntt[j]); 10102 libcrux_ml_kem_polynomial_add_to_ring_element_d6_1b(&t_as_ntt[i0], 10103 &product); 10104 } 10105 libcrux_ml_kem_polynomial_add_standard_error_reduce_d6_ea( 10106 &t_as_ntt[i0], &error_as_ntt[i0]); 10107 } 10108 } 10109 10110 /** 10111 This function implements most of <strong>Algorithm 12</strong> of the 10112 NIST FIPS 203 specification; this is the Kyber CPA-PKE key generation 10113 algorithm. 10114 10115 We say "most of" since Algorithm 12 samples the required randomness within 10116 the function itself, whereas this implementation expects it to be provided 10117 through the `key_generation_seed` parameter. 10118 10119 Algorithm 12 is reproduced below: 10120 10121 ```plaintext 10122 Output: encryption key ek ^{384k+32}. 10123 Output: decryption key dk ^{384k}. 10124 10125 d $ B 10126 (,) G(d) 10127 N 0 10128 for (i 0; i < k; i++) 10129 for(j 0; j < k; j++) 10130 [i,j] SampleNTT(XOF(, i, j)) 10131 end for 10132 end for 10133 for(i 0; i < k; i++) 10134 s[i] SamplePolyCBD_{}(PRF_{}(,N)) 10135 N N + 1 10136 end for 10137 for(i 0; i < k; i++) 10138 e[i] SamplePolyCBD_{}(PRF_{}(,N)) 10139 N N + 1 10140 end for 10141 NTT(s) 10142 NTT(e) 10143 t + 10144 ek ByteEncode(t) 10145 dk ByteEncode() 10146 ``` 10147 10148 The NIST FIPS 203 standard can be found at 10149 <https://csrc.nist.gov/pubs/fips/203/ipd>. 10150 */ 10151 /** 10152 A monomorphic instance of libcrux_ml_kem.ind_cpa.generate_keypair_unpacked 10153 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 10154 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]], 10155 libcrux_ml_kem_variant_MlKem with const generics 10156 - K= 3 10157 - ETA1= 2 10158 - ETA1_RANDOMNESS_SIZE= 128 10159 */ 10160 static KRML_MUSTINLINE void libcrux_ml_kem_ind_cpa_generate_keypair_unpacked_1c( 10161 Eurydice_slice key_generation_seed, 10162 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPrivateKeyUnpacked_a0 *private_key, 10163 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPublicKeyUnpacked_a0 *public_key) { 10164 uint8_t hashed[64U]; 10165 libcrux_ml_kem_variant_cpa_keygen_seed_39_9c(key_generation_seed, hashed); 10166 Eurydice_slice_uint8_t_x2 uu____0 = Eurydice_slice_split_at( 10167 Eurydice_array_to_slice((size_t)64U, hashed, uint8_t), (size_t)32U, 10168 uint8_t, Eurydice_slice_uint8_t_x2); 10169 Eurydice_slice seed_for_A = uu____0.fst; 10170 Eurydice_slice seed_for_secret_and_error = uu____0.snd; 10171 libcrux_ml_kem_polynomial_PolynomialRingElement_1d(*uu____1)[3U] = 10172 public_key->A; 10173 uint8_t ret[34U]; 10174 libcrux_ml_kem_utils_into_padded_array_b6(seed_for_A, ret); 10175 libcrux_ml_kem_matrix_sample_matrix_A_2b(uu____1, ret, true); 10176 uint8_t prf_input[33U]; 10177 libcrux_ml_kem_utils_into_padded_array_c8(seed_for_secret_and_error, 10178 prf_input); 10179 uint8_t domain_separator = 10180 libcrux_ml_kem_ind_cpa_sample_vector_cbd_then_ntt_3b( 10181 private_key->secret_as_ntt, prf_input, 0U); 10182 libcrux_ml_kem_polynomial_PolynomialRingElement_1d error_as_ntt[3U]; 10183 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 10184 /* original Rust expression is not an lvalue in C */ 10185 void *lvalue = (void *)0U; 10186 error_as_ntt[i] = 10187 libcrux_ml_kem_ind_cpa_generate_keypair_unpacked_call_mut_73_1c(&lvalue, 10188 i); 10189 } 10190 libcrux_ml_kem_ind_cpa_sample_vector_cbd_then_ntt_3b(error_as_ntt, prf_input, 10191 domain_separator); 10192 libcrux_ml_kem_matrix_compute_As_plus_e_1b( 10193 public_key->t_as_ntt, public_key->A, private_key->secret_as_ntt, 10194 error_as_ntt); 10195 uint8_t uu____2[32U]; 10196 Result_fb dst; 10197 Eurydice_slice_to_array2(&dst, seed_for_A, Eurydice_slice, uint8_t[32U], 10198 TryFromSliceError); 10199 unwrap_26_b3(dst, uu____2); 10200 memcpy(public_key->seed_for_A, uu____2, (size_t)32U * sizeof(uint8_t)); 10201 } 10202 10203 /** 10204 A monomorphic instance of 10205 libcrux_ml_kem.serialize.serialize_uncompressed_ring_element with types 10206 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 10207 10208 */ 10209 static KRML_MUSTINLINE void 10210 libcrux_ml_kem_serialize_serialize_uncompressed_ring_element_ea( 10211 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *re, uint8_t ret[384U]) { 10212 uint8_t serialized[384U] = {0U}; 10213 for (size_t i = (size_t)0U; 10214 i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { 10215 size_t i0 = i; 10216 libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficient = 10217 libcrux_ml_kem_serialize_to_unsigned_field_modulus_ea( 10218 re->coefficients[i0]); 10219 uint8_t bytes[24U]; 10220 libcrux_ml_kem_vector_portable_serialize_12_b8(coefficient, bytes); 10221 Eurydice_slice_copy( 10222 Eurydice_array_to_subslice3(serialized, (size_t)24U * i0, 10223 (size_t)24U * i0 + (size_t)24U, uint8_t *), 10224 Eurydice_array_to_slice((size_t)24U, bytes, uint8_t), uint8_t); 10225 } 10226 memcpy(ret, serialized, (size_t)384U * sizeof(uint8_t)); 10227 } 10228 10229 /** 10230 Call [`serialize_uncompressed_ring_element`] for each ring element. 10231 */ 10232 /** 10233 A monomorphic instance of libcrux_ml_kem.ind_cpa.serialize_vector 10234 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 10235 with const generics 10236 - K= 3 10237 */ 10238 static KRML_MUSTINLINE void libcrux_ml_kem_ind_cpa_serialize_vector_1b( 10239 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *key, 10240 Eurydice_slice out) { 10241 for (size_t i = (size_t)0U; 10242 i < Eurydice_slice_len( 10243 Eurydice_array_to_slice( 10244 (size_t)3U, key, 10245 libcrux_ml_kem_polynomial_PolynomialRingElement_1d), 10246 libcrux_ml_kem_polynomial_PolynomialRingElement_1d); 10247 i++) { 10248 size_t i0 = i; 10249 libcrux_ml_kem_polynomial_PolynomialRingElement_1d re = key[i0]; 10250 Eurydice_slice uu____0 = Eurydice_slice_subslice3( 10251 out, i0 * LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT, 10252 (i0 + (size_t)1U) * LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT, 10253 uint8_t *); 10254 uint8_t ret[384U]; 10255 libcrux_ml_kem_serialize_serialize_uncompressed_ring_element_ea(&re, ret); 10256 Eurydice_slice_copy( 10257 uu____0, Eurydice_array_to_slice((size_t)384U, ret, uint8_t), uint8_t); 10258 } 10259 } 10260 10261 /** 10262 Concatenate `t` and `` into the public key. 10263 */ 10264 /** 10265 A monomorphic instance of libcrux_ml_kem.ind_cpa.serialize_public_key_mut 10266 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 10267 with const generics 10268 - K= 3 10269 - PUBLIC_KEY_SIZE= 1184 10270 */ 10271 static KRML_MUSTINLINE void libcrux_ml_kem_ind_cpa_serialize_public_key_mut_89( 10272 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *t_as_ntt, 10273 Eurydice_slice seed_for_a, uint8_t *serialized) { 10274 libcrux_ml_kem_ind_cpa_serialize_vector_1b( 10275 t_as_ntt, 10276 Eurydice_array_to_subslice3( 10277 serialized, (size_t)0U, 10278 libcrux_ml_kem_constants_ranked_bytes_per_ring_element((size_t)3U), 10279 uint8_t *)); 10280 Eurydice_slice_copy( 10281 Eurydice_array_to_subslice_from( 10282 (size_t)1184U, serialized, 10283 libcrux_ml_kem_constants_ranked_bytes_per_ring_element((size_t)3U), 10284 uint8_t, size_t, uint8_t[]), 10285 seed_for_a, uint8_t); 10286 } 10287 10288 /** 10289 Concatenate `t` and `` into the public key. 10290 */ 10291 /** 10292 A monomorphic instance of libcrux_ml_kem.ind_cpa.serialize_public_key 10293 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 10294 with const generics 10295 - K= 3 10296 - PUBLIC_KEY_SIZE= 1184 10297 */ 10298 static KRML_MUSTINLINE void libcrux_ml_kem_ind_cpa_serialize_public_key_89( 10299 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *t_as_ntt, 10300 Eurydice_slice seed_for_a, uint8_t ret[1184U]) { 10301 uint8_t public_key_serialized[1184U] = {0U}; 10302 libcrux_ml_kem_ind_cpa_serialize_public_key_mut_89(t_as_ntt, seed_for_a, 10303 public_key_serialized); 10304 memcpy(ret, public_key_serialized, (size_t)1184U * sizeof(uint8_t)); 10305 } 10306 10307 /** 10308 Serialize the secret key from the unpacked key pair generation. 10309 */ 10310 /** 10311 A monomorphic instance of libcrux_ml_kem.ind_cpa.serialize_unpacked_secret_key 10312 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 10313 with const generics 10314 - K= 3 10315 - PRIVATE_KEY_SIZE= 1152 10316 - PUBLIC_KEY_SIZE= 1184 10317 */ 10318 static inline libcrux_ml_kem_utils_extraction_helper_Keypair768 10319 libcrux_ml_kem_ind_cpa_serialize_unpacked_secret_key_6c( 10320 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPublicKeyUnpacked_a0 *public_key, 10321 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPrivateKeyUnpacked_a0 *private_key) { 10322 uint8_t public_key_serialized[1184U]; 10323 libcrux_ml_kem_ind_cpa_serialize_public_key_89( 10324 public_key->t_as_ntt, 10325 Eurydice_array_to_slice((size_t)32U, public_key->seed_for_A, uint8_t), 10326 public_key_serialized); 10327 uint8_t secret_key_serialized[1152U] = {0U}; 10328 libcrux_ml_kem_ind_cpa_serialize_vector_1b( 10329 private_key->secret_as_ntt, 10330 Eurydice_array_to_slice((size_t)1152U, secret_key_serialized, uint8_t)); 10331 /* Passing arrays by value in Rust generates a copy in C */ 10332 uint8_t copy_of_secret_key_serialized[1152U]; 10333 memcpy(copy_of_secret_key_serialized, secret_key_serialized, 10334 (size_t)1152U * sizeof(uint8_t)); 10335 /* Passing arrays by value in Rust generates a copy in C */ 10336 uint8_t copy_of_public_key_serialized[1184U]; 10337 memcpy(copy_of_public_key_serialized, public_key_serialized, 10338 (size_t)1184U * sizeof(uint8_t)); 10339 libcrux_ml_kem_utils_extraction_helper_Keypair768 lit; 10340 memcpy(lit.fst, copy_of_secret_key_serialized, 10341 (size_t)1152U * sizeof(uint8_t)); 10342 memcpy(lit.snd, copy_of_public_key_serialized, 10343 (size_t)1184U * sizeof(uint8_t)); 10344 return lit; 10345 } 10346 10347 /** 10348 A monomorphic instance of libcrux_ml_kem.ind_cpa.generate_keypair 10349 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 10350 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]], 10351 libcrux_ml_kem_variant_MlKem with const generics 10352 - K= 3 10353 - PRIVATE_KEY_SIZE= 1152 10354 - PUBLIC_KEY_SIZE= 1184 10355 - ETA1= 2 10356 - ETA1_RANDOMNESS_SIZE= 128 10357 */ 10358 static KRML_MUSTINLINE libcrux_ml_kem_utils_extraction_helper_Keypair768 10359 libcrux_ml_kem_ind_cpa_generate_keypair_ea(Eurydice_slice key_generation_seed) { 10360 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPrivateKeyUnpacked_a0 private_key = 10361 libcrux_ml_kem_ind_cpa_unpacked_default_70_1b(); 10362 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPublicKeyUnpacked_a0 public_key = 10363 libcrux_ml_kem_ind_cpa_unpacked_default_8b_1b(); 10364 libcrux_ml_kem_ind_cpa_generate_keypair_unpacked_1c( 10365 key_generation_seed, &private_key, &public_key); 10366 return libcrux_ml_kem_ind_cpa_serialize_unpacked_secret_key_6c(&public_key, 10367 &private_key); 10368 } 10369 10370 /** 10371 Serialize the secret key. 10372 */ 10373 /** 10374 A monomorphic instance of libcrux_ml_kem.ind_cca.serialize_kem_secret_key_mut 10375 with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] 10376 with const generics 10377 - K= 3 10378 - SERIALIZED_KEY_LEN= 2400 10379 */ 10380 static KRML_MUSTINLINE void 10381 libcrux_ml_kem_ind_cca_serialize_kem_secret_key_mut_d6( 10382 Eurydice_slice private_key, Eurydice_slice public_key, 10383 Eurydice_slice implicit_rejection_value, uint8_t *serialized) { 10384 size_t pointer = (size_t)0U; 10385 uint8_t *uu____0 = serialized; 10386 size_t uu____1 = pointer; 10387 size_t uu____2 = pointer; 10388 Eurydice_slice_copy( 10389 Eurydice_array_to_subslice3( 10390 uu____0, uu____1, uu____2 + Eurydice_slice_len(private_key, uint8_t), 10391 uint8_t *), 10392 private_key, uint8_t); 10393 pointer = pointer + Eurydice_slice_len(private_key, uint8_t); 10394 uint8_t *uu____3 = serialized; 10395 size_t uu____4 = pointer; 10396 size_t uu____5 = pointer; 10397 Eurydice_slice_copy( 10398 Eurydice_array_to_subslice3( 10399 uu____3, uu____4, uu____5 + Eurydice_slice_len(public_key, uint8_t), 10400 uint8_t *), 10401 public_key, uint8_t); 10402 pointer = pointer + Eurydice_slice_len(public_key, uint8_t); 10403 Eurydice_slice uu____6 = Eurydice_array_to_subslice3( 10404 serialized, pointer, pointer + LIBCRUX_ML_KEM_CONSTANTS_H_DIGEST_SIZE, 10405 uint8_t *); 10406 uint8_t ret[32U]; 10407 libcrux_ml_kem_hash_functions_portable_H_4a_e0(public_key, ret); 10408 Eurydice_slice_copy( 10409 uu____6, Eurydice_array_to_slice((size_t)32U, ret, uint8_t), uint8_t); 10410 pointer = pointer + LIBCRUX_ML_KEM_CONSTANTS_H_DIGEST_SIZE; 10411 uint8_t *uu____7 = serialized; 10412 size_t uu____8 = pointer; 10413 size_t uu____9 = pointer; 10414 Eurydice_slice_copy( 10415 Eurydice_array_to_subslice3( 10416 uu____7, uu____8, 10417 uu____9 + Eurydice_slice_len(implicit_rejection_value, uint8_t), 10418 uint8_t *), 10419 implicit_rejection_value, uint8_t); 10420 } 10421 10422 /** 10423 A monomorphic instance of libcrux_ml_kem.ind_cca.serialize_kem_secret_key 10424 with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] 10425 with const generics 10426 - K= 3 10427 - SERIALIZED_KEY_LEN= 2400 10428 */ 10429 static KRML_MUSTINLINE void libcrux_ml_kem_ind_cca_serialize_kem_secret_key_d6( 10430 Eurydice_slice private_key, Eurydice_slice public_key, 10431 Eurydice_slice implicit_rejection_value, uint8_t ret[2400U]) { 10432 uint8_t out[2400U] = {0U}; 10433 libcrux_ml_kem_ind_cca_serialize_kem_secret_key_mut_d6( 10434 private_key, public_key, implicit_rejection_value, out); 10435 memcpy(ret, out, (size_t)2400U * sizeof(uint8_t)); 10436 } 10437 10438 /** 10439 Packed API 10440 10441 Generate a key pair. 10442 10443 Depending on the `Vector` and `Hasher` used, this requires different hardware 10444 features 10445 */ 10446 /** 10447 A monomorphic instance of libcrux_ml_kem.ind_cca.generate_keypair 10448 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 10449 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]], 10450 libcrux_ml_kem_variant_MlKem with const generics 10451 - K= 3 10452 - CPA_PRIVATE_KEY_SIZE= 1152 10453 - PRIVATE_KEY_SIZE= 2400 10454 - PUBLIC_KEY_SIZE= 1184 10455 - ETA1= 2 10456 - ETA1_RANDOMNESS_SIZE= 128 10457 */ 10458 static KRML_MUSTINLINE libcrux_ml_kem_mlkem768_MlKem768KeyPair 10459 libcrux_ml_kem_ind_cca_generate_keypair_15(uint8_t *randomness) { 10460 Eurydice_slice ind_cpa_keypair_randomness = Eurydice_array_to_subslice3( 10461 randomness, (size_t)0U, 10462 LIBCRUX_ML_KEM_CONSTANTS_CPA_PKE_KEY_GENERATION_SEED_SIZE, uint8_t *); 10463 Eurydice_slice implicit_rejection_value = Eurydice_array_to_subslice_from( 10464 (size_t)64U, randomness, 10465 LIBCRUX_ML_KEM_CONSTANTS_CPA_PKE_KEY_GENERATION_SEED_SIZE, uint8_t, 10466 size_t, uint8_t[]); 10467 libcrux_ml_kem_utils_extraction_helper_Keypair768 uu____0 = 10468 libcrux_ml_kem_ind_cpa_generate_keypair_ea(ind_cpa_keypair_randomness); 10469 uint8_t ind_cpa_private_key[1152U]; 10470 memcpy(ind_cpa_private_key, uu____0.fst, (size_t)1152U * sizeof(uint8_t)); 10471 uint8_t public_key[1184U]; 10472 memcpy(public_key, uu____0.snd, (size_t)1184U * sizeof(uint8_t)); 10473 uint8_t secret_key_serialized[2400U]; 10474 libcrux_ml_kem_ind_cca_serialize_kem_secret_key_d6( 10475 Eurydice_array_to_slice((size_t)1152U, ind_cpa_private_key, uint8_t), 10476 Eurydice_array_to_slice((size_t)1184U, public_key, uint8_t), 10477 implicit_rejection_value, secret_key_serialized); 10478 /* Passing arrays by value in Rust generates a copy in C */ 10479 uint8_t copy_of_secret_key_serialized[2400U]; 10480 memcpy(copy_of_secret_key_serialized, secret_key_serialized, 10481 (size_t)2400U * sizeof(uint8_t)); 10482 libcrux_ml_kem_types_MlKemPrivateKey_d9 private_key = 10483 libcrux_ml_kem_types_from_77_28(copy_of_secret_key_serialized); 10484 libcrux_ml_kem_types_MlKemPrivateKey_d9 uu____2 = private_key; 10485 /* Passing arrays by value in Rust generates a copy in C */ 10486 uint8_t copy_of_public_key[1184U]; 10487 memcpy(copy_of_public_key, public_key, (size_t)1184U * sizeof(uint8_t)); 10488 return libcrux_ml_kem_types_from_17_74( 10489 uu____2, libcrux_ml_kem_types_from_fd_d0(copy_of_public_key)); 10490 } 10491 10492 /** 10493 Portable generate key pair. 10494 */ 10495 /** 10496 A monomorphic instance of 10497 libcrux_ml_kem.ind_cca.instantiations.portable.generate_keypair with const 10498 generics 10499 - K= 3 10500 - CPA_PRIVATE_KEY_SIZE= 1152 10501 - PRIVATE_KEY_SIZE= 2400 10502 - PUBLIC_KEY_SIZE= 1184 10503 - ETA1= 2 10504 - ETA1_RANDOMNESS_SIZE= 128 10505 */ 10506 static inline libcrux_ml_kem_mlkem768_MlKem768KeyPair 10507 libcrux_ml_kem_ind_cca_instantiations_portable_generate_keypair_ce( 10508 uint8_t *randomness) { 10509 return libcrux_ml_kem_ind_cca_generate_keypair_15(randomness); 10510 } 10511 10512 /** 10513 Generate ML-KEM 768 Key Pair 10514 */ 10515 static inline libcrux_ml_kem_mlkem768_MlKem768KeyPair 10516 libcrux_ml_kem_mlkem768_portable_generate_key_pair(uint8_t randomness[64U]) { 10517 return libcrux_ml_kem_ind_cca_instantiations_portable_generate_keypair_ce( 10518 randomness); 10519 } 10520 10521 /** 10522 Validate an ML-KEM private key. 10523 10524 This implements the Hash check in 7.3 3. 10525 */ 10526 /** 10527 A monomorphic instance of libcrux_ml_kem.ind_cca.validate_private_key_only 10528 with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] 10529 with const generics 10530 - K= 3 10531 - SECRET_KEY_SIZE= 2400 10532 */ 10533 static KRML_MUSTINLINE bool libcrux_ml_kem_ind_cca_validate_private_key_only_d6( 10534 libcrux_ml_kem_types_MlKemPrivateKey_d9 *private_key) { 10535 uint8_t t[32U]; 10536 libcrux_ml_kem_hash_functions_portable_H_4a_e0( 10537 Eurydice_array_to_subslice3(private_key->value, (size_t)384U * (size_t)3U, 10538 (size_t)768U * (size_t)3U + (size_t)32U, 10539 uint8_t *), 10540 t); 10541 Eurydice_slice expected = Eurydice_array_to_subslice3( 10542 private_key->value, (size_t)768U * (size_t)3U + (size_t)32U, 10543 (size_t)768U * (size_t)3U + (size_t)64U, uint8_t *); 10544 return Eurydice_array_eq_slice((size_t)32U, t, &expected, uint8_t, bool); 10545 } 10546 10547 /** 10548 Validate an ML-KEM private key. 10549 10550 This implements the Hash check in 7.3 3. 10551 Note that the size checks in 7.2 1 and 2 are covered by the `SECRET_KEY_SIZE` 10552 and `CIPHERTEXT_SIZE` in the `private_key` and `ciphertext` types. 10553 */ 10554 /** 10555 A monomorphic instance of libcrux_ml_kem.ind_cca.validate_private_key 10556 with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] 10557 with const generics 10558 - K= 3 10559 - SECRET_KEY_SIZE= 2400 10560 - CIPHERTEXT_SIZE= 1088 10561 */ 10562 static KRML_MUSTINLINE bool libcrux_ml_kem_ind_cca_validate_private_key_37( 10563 libcrux_ml_kem_types_MlKemPrivateKey_d9 *private_key, 10564 libcrux_ml_kem_mlkem768_MlKem768Ciphertext *_ciphertext) { 10565 return libcrux_ml_kem_ind_cca_validate_private_key_only_d6(private_key); 10566 } 10567 10568 /** 10569 Private key validation 10570 */ 10571 /** 10572 A monomorphic instance of 10573 libcrux_ml_kem.ind_cca.instantiations.portable.validate_private_key with const 10574 generics 10575 - K= 3 10576 - SECRET_KEY_SIZE= 2400 10577 - CIPHERTEXT_SIZE= 1088 10578 */ 10579 static KRML_MUSTINLINE bool 10580 libcrux_ml_kem_ind_cca_instantiations_portable_validate_private_key_31( 10581 libcrux_ml_kem_types_MlKemPrivateKey_d9 *private_key, 10582 libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext) { 10583 return libcrux_ml_kem_ind_cca_validate_private_key_37(private_key, 10584 ciphertext); 10585 } 10586 10587 /** 10588 Validate a private key. 10589 10590 Returns `true` if valid, and `false` otherwise. 10591 */ 10592 static inline bool libcrux_ml_kem_mlkem768_portable_validate_private_key( 10593 libcrux_ml_kem_types_MlKemPrivateKey_d9 *private_key, 10594 libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext) { 10595 return libcrux_ml_kem_ind_cca_instantiations_portable_validate_private_key_31( 10596 private_key, ciphertext); 10597 } 10598 10599 /** 10600 Private key validation 10601 */ 10602 /** 10603 A monomorphic instance of 10604 libcrux_ml_kem.ind_cca.instantiations.portable.validate_private_key_only with 10605 const generics 10606 - K= 3 10607 - SECRET_KEY_SIZE= 2400 10608 */ 10609 static KRML_MUSTINLINE bool 10610 libcrux_ml_kem_ind_cca_instantiations_portable_validate_private_key_only_41( 10611 libcrux_ml_kem_types_MlKemPrivateKey_d9 *private_key) { 10612 return libcrux_ml_kem_ind_cca_validate_private_key_only_d6(private_key); 10613 } 10614 10615 /** 10616 Validate the private key only. 10617 10618 Returns `true` if valid, and `false` otherwise. 10619 */ 10620 static inline bool libcrux_ml_kem_mlkem768_portable_validate_private_key_only( 10621 libcrux_ml_kem_types_MlKemPrivateKey_d9 *private_key) { 10622 return libcrux_ml_kem_ind_cca_instantiations_portable_validate_private_key_only_41( 10623 private_key); 10624 } 10625 10626 /** 10627 This function found in impl {core::ops::function::FnMut<(usize), 10628 libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 10629 TraitClause@1]> for 10630 libcrux_ml_kem::serialize::deserialize_ring_elements_reduced_out::closure<Vector, 10631 K>[TraitClause@0, TraitClause@1]} 10632 */ 10633 /** 10634 A monomorphic instance of 10635 libcrux_ml_kem.serialize.deserialize_ring_elements_reduced_out.call_mut_0b with 10636 types libcrux_ml_kem_vector_portable_vector_type_PortableVector with const 10637 generics 10638 - K= 3 10639 */ 10640 static inline libcrux_ml_kem_polynomial_PolynomialRingElement_1d 10641 libcrux_ml_kem_serialize_deserialize_ring_elements_reduced_out_call_mut_0b_1b( 10642 void **_, size_t tupled_args) { 10643 return libcrux_ml_kem_polynomial_ZERO_d6_ea(); 10644 } 10645 10646 /** 10647 This function deserializes ring elements and reduces the result by the field 10648 modulus. 10649 10650 This function MUST NOT be used on secret inputs. 10651 */ 10652 /** 10653 A monomorphic instance of 10654 libcrux_ml_kem.serialize.deserialize_ring_elements_reduced_out with types 10655 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 10656 - K= 3 10657 */ 10658 static KRML_MUSTINLINE void 10659 libcrux_ml_kem_serialize_deserialize_ring_elements_reduced_out_1b( 10660 Eurydice_slice public_key, 10661 libcrux_ml_kem_polynomial_PolynomialRingElement_1d ret[3U]) { 10662 libcrux_ml_kem_polynomial_PolynomialRingElement_1d deserialized_pk[3U]; 10663 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 10664 /* original Rust expression is not an lvalue in C */ 10665 void *lvalue = (void *)0U; 10666 deserialized_pk[i] = 10667 libcrux_ml_kem_serialize_deserialize_ring_elements_reduced_out_call_mut_0b_1b( 10668 &lvalue, i); 10669 } 10670 libcrux_ml_kem_serialize_deserialize_ring_elements_reduced_1b( 10671 public_key, deserialized_pk); 10672 memcpy( 10673 ret, deserialized_pk, 10674 (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d)); 10675 } 10676 10677 /** 10678 Validate an ML-KEM public key. 10679 10680 This implements the Modulus check in 7.2 2. 10681 Note that the size check in 7.2 1 is covered by the `PUBLIC_KEY_SIZE` in the 10682 `public_key` type. 10683 */ 10684 /** 10685 A monomorphic instance of libcrux_ml_kem.ind_cca.validate_public_key 10686 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 10687 with const generics 10688 - K= 3 10689 - PUBLIC_KEY_SIZE= 1184 10690 */ 10691 static KRML_MUSTINLINE bool libcrux_ml_kem_ind_cca_validate_public_key_89( 10692 uint8_t *public_key) { 10693 libcrux_ml_kem_polynomial_PolynomialRingElement_1d deserialized_pk[3U]; 10694 libcrux_ml_kem_serialize_deserialize_ring_elements_reduced_out_1b( 10695 Eurydice_array_to_subslice_to( 10696 (size_t)1184U, public_key, 10697 libcrux_ml_kem_constants_ranked_bytes_per_ring_element((size_t)3U), 10698 uint8_t, size_t, uint8_t[]), 10699 deserialized_pk); 10700 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *uu____0 = deserialized_pk; 10701 uint8_t public_key_serialized[1184U]; 10702 libcrux_ml_kem_ind_cpa_serialize_public_key_89( 10703 uu____0, 10704 Eurydice_array_to_subslice_from( 10705 (size_t)1184U, public_key, 10706 libcrux_ml_kem_constants_ranked_bytes_per_ring_element((size_t)3U), 10707 uint8_t, size_t, uint8_t[]), 10708 public_key_serialized); 10709 return Eurydice_array_eq((size_t)1184U, public_key, public_key_serialized, 10710 uint8_t); 10711 } 10712 10713 /** 10714 Public key validation 10715 */ 10716 /** 10717 A monomorphic instance of 10718 libcrux_ml_kem.ind_cca.instantiations.portable.validate_public_key with const 10719 generics 10720 - K= 3 10721 - PUBLIC_KEY_SIZE= 1184 10722 */ 10723 static KRML_MUSTINLINE bool 10724 libcrux_ml_kem_ind_cca_instantiations_portable_validate_public_key_41( 10725 uint8_t *public_key) { 10726 return libcrux_ml_kem_ind_cca_validate_public_key_89(public_key); 10727 } 10728 10729 /** 10730 Validate a public key. 10731 10732 Returns `true` if valid, and `false` otherwise. 10733 */ 10734 static inline bool libcrux_ml_kem_mlkem768_portable_validate_public_key( 10735 libcrux_ml_kem_types_MlKemPublicKey_30 *public_key) { 10736 return libcrux_ml_kem_ind_cca_instantiations_portable_validate_public_key_41( 10737 public_key->value); 10738 } 10739 10740 /** 10741 A monomorphic instance of libcrux_ml_kem.ind_cca.unpacked.MlKemPublicKeyUnpacked 10742 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 10743 with const generics 10744 - $3size_t 10745 */ 10746 typedef struct libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0_s { 10747 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPublicKeyUnpacked_a0 ind_cpa_public_key; 10748 uint8_t public_key_hash[32U]; 10749 } libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0; 10750 10751 typedef libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 10752 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768PublicKeyUnpacked; 10753 10754 /** 10755 A monomorphic instance of 10756 libcrux_ml_kem.ind_cca.unpacked.MlKemPrivateKeyUnpacked with types 10757 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 10758 - $3size_t 10759 */ 10760 typedef struct libcrux_ml_kem_ind_cca_unpacked_MlKemPrivateKeyUnpacked_a0_s { 10761 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPrivateKeyUnpacked_a0 10762 ind_cpa_private_key; 10763 uint8_t implicit_rejection_value[32U]; 10764 } libcrux_ml_kem_ind_cca_unpacked_MlKemPrivateKeyUnpacked_a0; 10765 10766 typedef struct 10767 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked_s { 10768 libcrux_ml_kem_ind_cca_unpacked_MlKemPrivateKeyUnpacked_a0 private_key; 10769 libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 public_key; 10770 } libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked; 10771 10772 /** 10773 A monomorphic instance of libcrux_ml_kem.ind_cca.unpacked.decapsulate 10774 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 10775 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const 10776 generics 10777 - K= 3 10778 - SECRET_KEY_SIZE= 2400 10779 - CPA_SECRET_KEY_SIZE= 1152 10780 - PUBLIC_KEY_SIZE= 1184 10781 - CIPHERTEXT_SIZE= 1088 10782 - T_AS_NTT_ENCODED_SIZE= 1152 10783 - C1_SIZE= 960 10784 - C2_SIZE= 128 10785 - VECTOR_U_COMPRESSION_FACTOR= 10 10786 - VECTOR_V_COMPRESSION_FACTOR= 4 10787 - C1_BLOCK_SIZE= 320 10788 - ETA1= 2 10789 - ETA1_RANDOMNESS_SIZE= 128 10790 - ETA2= 2 10791 - ETA2_RANDOMNESS_SIZE= 128 10792 - IMPLICIT_REJECTION_HASH_INPUT_SIZE= 1120 10793 */ 10794 static KRML_MUSTINLINE void libcrux_ml_kem_ind_cca_unpacked_decapsulate_51( 10795 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked *key_pair, 10796 libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext, uint8_t ret[32U]) { 10797 uint8_t decrypted[32U]; 10798 libcrux_ml_kem_ind_cpa_decrypt_unpacked_42( 10799 &key_pair->private_key.ind_cpa_private_key, ciphertext->value, decrypted); 10800 uint8_t to_hash0[64U]; 10801 libcrux_ml_kem_utils_into_padded_array_24( 10802 Eurydice_array_to_slice((size_t)32U, decrypted, uint8_t), to_hash0); 10803 Eurydice_slice uu____0 = Eurydice_array_to_subslice_from( 10804 (size_t)64U, to_hash0, LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE, 10805 uint8_t, size_t, uint8_t[]); 10806 Eurydice_slice_copy( 10807 uu____0, 10808 Eurydice_array_to_slice((size_t)32U, key_pair->public_key.public_key_hash, 10809 uint8_t), 10810 uint8_t); 10811 uint8_t hashed[64U]; 10812 libcrux_ml_kem_hash_functions_portable_G_4a_e0( 10813 Eurydice_array_to_slice((size_t)64U, to_hash0, uint8_t), hashed); 10814 Eurydice_slice_uint8_t_x2 uu____1 = Eurydice_slice_split_at( 10815 Eurydice_array_to_slice((size_t)64U, hashed, uint8_t), 10816 LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE, uint8_t, 10817 Eurydice_slice_uint8_t_x2); 10818 Eurydice_slice shared_secret = uu____1.fst; 10819 Eurydice_slice pseudorandomness = uu____1.snd; 10820 uint8_t to_hash[1120U]; 10821 libcrux_ml_kem_utils_into_padded_array_15( 10822 Eurydice_array_to_slice( 10823 (size_t)32U, key_pair->private_key.implicit_rejection_value, uint8_t), 10824 to_hash); 10825 Eurydice_slice uu____2 = Eurydice_array_to_subslice_from( 10826 (size_t)1120U, to_hash, LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE, 10827 uint8_t, size_t, uint8_t[]); 10828 Eurydice_slice_copy(uu____2, libcrux_ml_kem_types_as_ref_d3_80(ciphertext), 10829 uint8_t); 10830 uint8_t implicit_rejection_shared_secret[32U]; 10831 libcrux_ml_kem_hash_functions_portable_PRF_4a_41( 10832 Eurydice_array_to_slice((size_t)1120U, to_hash, uint8_t), 10833 implicit_rejection_shared_secret); 10834 uint8_t expected_ciphertext[1088U]; 10835 libcrux_ml_kem_ind_cpa_encrypt_unpacked_2a( 10836 &key_pair->public_key.ind_cpa_public_key, decrypted, pseudorandomness, 10837 expected_ciphertext); 10838 uint8_t selector = 10839 libcrux_ml_kem_constant_time_ops_compare_ciphertexts_in_constant_time( 10840 libcrux_ml_kem_types_as_ref_d3_80(ciphertext), 10841 Eurydice_array_to_slice((size_t)1088U, expected_ciphertext, uint8_t)); 10842 uint8_t ret0[32U]; 10843 libcrux_ml_kem_constant_time_ops_select_shared_secret_in_constant_time( 10844 shared_secret, 10845 Eurydice_array_to_slice((size_t)32U, implicit_rejection_shared_secret, 10846 uint8_t), 10847 selector, ret0); 10848 memcpy(ret, ret0, (size_t)32U * sizeof(uint8_t)); 10849 } 10850 10851 /** 10852 Unpacked decapsulate 10853 */ 10854 /** 10855 A monomorphic instance of 10856 libcrux_ml_kem.ind_cca.instantiations.portable.unpacked.decapsulate with const 10857 generics 10858 - K= 3 10859 - SECRET_KEY_SIZE= 2400 10860 - CPA_SECRET_KEY_SIZE= 1152 10861 - PUBLIC_KEY_SIZE= 1184 10862 - CIPHERTEXT_SIZE= 1088 10863 - T_AS_NTT_ENCODED_SIZE= 1152 10864 - C1_SIZE= 960 10865 - C2_SIZE= 128 10866 - VECTOR_U_COMPRESSION_FACTOR= 10 10867 - VECTOR_V_COMPRESSION_FACTOR= 4 10868 - C1_BLOCK_SIZE= 320 10869 - ETA1= 2 10870 - ETA1_RANDOMNESS_SIZE= 128 10871 - ETA2= 2 10872 - ETA2_RANDOMNESS_SIZE= 128 10873 - IMPLICIT_REJECTION_HASH_INPUT_SIZE= 1120 10874 */ 10875 static KRML_MUSTINLINE void 10876 libcrux_ml_kem_ind_cca_instantiations_portable_unpacked_decapsulate_35( 10877 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked *key_pair, 10878 libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext, uint8_t ret[32U]) { 10879 libcrux_ml_kem_ind_cca_unpacked_decapsulate_51(key_pair, ciphertext, ret); 10880 } 10881 10882 /** 10883 Decapsulate ML-KEM 768 (unpacked) 10884 10885 Generates an [`MlKemSharedSecret`]. 10886 The input is a reference to an unpacked key pair of type 10887 [`MlKem768KeyPairUnpacked`] and an [`MlKem768Ciphertext`]. 10888 */ 10889 static inline void libcrux_ml_kem_mlkem768_portable_unpacked_decapsulate( 10890 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked 10891 *private_key, 10892 libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext, uint8_t ret[32U]) { 10893 libcrux_ml_kem_ind_cca_instantiations_portable_unpacked_decapsulate_35( 10894 private_key, ciphertext, ret); 10895 } 10896 10897 /** 10898 A monomorphic instance of libcrux_ml_kem.ind_cca.unpacked.encaps_prepare 10899 with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] 10900 with const generics 10901 - K= 3 10902 */ 10903 static inline void libcrux_ml_kem_ind_cca_unpacked_encaps_prepare_9c( 10904 Eurydice_slice randomness, Eurydice_slice pk_hash, uint8_t ret[64U]) { 10905 uint8_t to_hash[64U]; 10906 libcrux_ml_kem_utils_into_padded_array_24(randomness, to_hash); 10907 Eurydice_slice_copy( 10908 Eurydice_array_to_subslice_from((size_t)64U, to_hash, 10909 LIBCRUX_ML_KEM_CONSTANTS_H_DIGEST_SIZE, 10910 uint8_t, size_t, uint8_t[]), 10911 pk_hash, uint8_t); 10912 uint8_t ret0[64U]; 10913 libcrux_ml_kem_hash_functions_portable_G_4a_e0( 10914 Eurydice_array_to_slice((size_t)64U, to_hash, uint8_t), ret0); 10915 memcpy(ret, ret0, (size_t)64U * sizeof(uint8_t)); 10916 } 10917 10918 /** 10919 A monomorphic instance of libcrux_ml_kem.ind_cca.unpacked.encapsulate 10920 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 10921 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const 10922 generics 10923 - K= 3 10924 - CIPHERTEXT_SIZE= 1088 10925 - PUBLIC_KEY_SIZE= 1184 10926 - T_AS_NTT_ENCODED_SIZE= 1152 10927 - C1_SIZE= 960 10928 - C2_SIZE= 128 10929 - VECTOR_U_COMPRESSION_FACTOR= 10 10930 - VECTOR_V_COMPRESSION_FACTOR= 4 10931 - VECTOR_U_BLOCK_LEN= 320 10932 - ETA1= 2 10933 - ETA1_RANDOMNESS_SIZE= 128 10934 - ETA2= 2 10935 - ETA2_RANDOMNESS_SIZE= 128 10936 */ 10937 static KRML_MUSTINLINE tuple_c2 libcrux_ml_kem_ind_cca_unpacked_encapsulate_0c( 10938 libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 *public_key, 10939 uint8_t *randomness) { 10940 uint8_t hashed[64U]; 10941 libcrux_ml_kem_ind_cca_unpacked_encaps_prepare_9c( 10942 Eurydice_array_to_slice((size_t)32U, randomness, uint8_t), 10943 Eurydice_array_to_slice((size_t)32U, public_key->public_key_hash, 10944 uint8_t), 10945 hashed); 10946 Eurydice_slice_uint8_t_x2 uu____0 = Eurydice_slice_split_at( 10947 Eurydice_array_to_slice((size_t)64U, hashed, uint8_t), 10948 LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE, uint8_t, 10949 Eurydice_slice_uint8_t_x2); 10950 Eurydice_slice shared_secret = uu____0.fst; 10951 Eurydice_slice pseudorandomness = uu____0.snd; 10952 uint8_t ciphertext[1088U]; 10953 libcrux_ml_kem_ind_cpa_encrypt_unpacked_2a(&public_key->ind_cpa_public_key, 10954 randomness, pseudorandomness, 10955 ciphertext); 10956 uint8_t shared_secret_array[32U] = {0U}; 10957 Eurydice_slice_copy( 10958 Eurydice_array_to_slice((size_t)32U, shared_secret_array, uint8_t), 10959 shared_secret, uint8_t); 10960 /* Passing arrays by value in Rust generates a copy in C */ 10961 uint8_t copy_of_ciphertext[1088U]; 10962 memcpy(copy_of_ciphertext, ciphertext, (size_t)1088U * sizeof(uint8_t)); 10963 libcrux_ml_kem_mlkem768_MlKem768Ciphertext uu____2 = 10964 libcrux_ml_kem_types_from_e0_80(copy_of_ciphertext); 10965 /* Passing arrays by value in Rust generates a copy in C */ 10966 uint8_t copy_of_shared_secret_array[32U]; 10967 memcpy(copy_of_shared_secret_array, shared_secret_array, 10968 (size_t)32U * sizeof(uint8_t)); 10969 tuple_c2 lit; 10970 lit.fst = uu____2; 10971 memcpy(lit.snd, copy_of_shared_secret_array, (size_t)32U * sizeof(uint8_t)); 10972 return lit; 10973 } 10974 10975 /** 10976 Unpacked encapsulate 10977 */ 10978 /** 10979 A monomorphic instance of 10980 libcrux_ml_kem.ind_cca.instantiations.portable.unpacked.encapsulate with const 10981 generics 10982 - K= 3 10983 - CIPHERTEXT_SIZE= 1088 10984 - PUBLIC_KEY_SIZE= 1184 10985 - T_AS_NTT_ENCODED_SIZE= 1152 10986 - C1_SIZE= 960 10987 - C2_SIZE= 128 10988 - VECTOR_U_COMPRESSION_FACTOR= 10 10989 - VECTOR_V_COMPRESSION_FACTOR= 4 10990 - VECTOR_U_BLOCK_LEN= 320 10991 - ETA1= 2 10992 - ETA1_RANDOMNESS_SIZE= 128 10993 - ETA2= 2 10994 - ETA2_RANDOMNESS_SIZE= 128 10995 */ 10996 static KRML_MUSTINLINE tuple_c2 10997 libcrux_ml_kem_ind_cca_instantiations_portable_unpacked_encapsulate_cd( 10998 libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 *public_key, 10999 uint8_t *randomness) { 11000 return libcrux_ml_kem_ind_cca_unpacked_encapsulate_0c(public_key, randomness); 11001 } 11002 11003 /** 11004 Encapsulate ML-KEM 768 (unpacked) 11005 11006 Generates an ([`MlKem768Ciphertext`], [`MlKemSharedSecret`]) tuple. 11007 The input is a reference to an unpacked public key of type 11008 [`MlKem768PublicKeyUnpacked`], the SHA3-256 hash of this public key, and 11009 [`SHARED_SECRET_SIZE`] bytes of `randomness`. 11010 */ 11011 static inline tuple_c2 libcrux_ml_kem_mlkem768_portable_unpacked_encapsulate( 11012 libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 *public_key, 11013 uint8_t randomness[32U]) { 11014 return libcrux_ml_kem_ind_cca_instantiations_portable_unpacked_encapsulate_cd( 11015 public_key, randomness); 11016 } 11017 11018 /** 11019 This function found in impl {core::ops::function::FnMut<(usize), 11020 libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 11021 TraitClause@1]> for 11022 libcrux_ml_kem::ind_cca::unpacked::transpose_a::closure::closure<Vector, 11023 K>[TraitClause@0, TraitClause@1]} 11024 */ 11025 /** 11026 A monomorphic instance of 11027 libcrux_ml_kem.ind_cca.unpacked.transpose_a.closure.call_mut_b4 with types 11028 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 11029 - K= 3 11030 */ 11031 static inline libcrux_ml_kem_polynomial_PolynomialRingElement_1d 11032 libcrux_ml_kem_ind_cca_unpacked_transpose_a_closure_call_mut_b4_1b( 11033 void **_, size_t tupled_args) { 11034 return libcrux_ml_kem_polynomial_ZERO_d6_ea(); 11035 } 11036 11037 /** 11038 This function found in impl {core::ops::function::FnMut<(usize), 11039 @Array<libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 11040 TraitClause@1], K>> for 11041 libcrux_ml_kem::ind_cca::unpacked::transpose_a::closure<Vector, 11042 K>[TraitClause@0, TraitClause@1]} 11043 */ 11044 /** 11045 A monomorphic instance of 11046 libcrux_ml_kem.ind_cca.unpacked.transpose_a.call_mut_7b with types 11047 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 11048 - K= 3 11049 */ 11050 static inline void libcrux_ml_kem_ind_cca_unpacked_transpose_a_call_mut_7b_1b( 11051 void **_, size_t tupled_args, 11052 libcrux_ml_kem_polynomial_PolynomialRingElement_1d ret[3U]) { 11053 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 11054 /* original Rust expression is not an lvalue in C */ 11055 void *lvalue = (void *)0U; 11056 ret[i] = libcrux_ml_kem_ind_cca_unpacked_transpose_a_closure_call_mut_b4_1b( 11057 &lvalue, i); 11058 } 11059 } 11060 11061 /** 11062 This function found in impl {core::clone::Clone for 11063 libcrux_ml_kem::polynomial::PolynomialRingElement<Vector>[TraitClause@0, 11064 TraitClause@2]} 11065 */ 11066 /** 11067 A monomorphic instance of libcrux_ml_kem.polynomial.clone_c1 11068 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 11069 with const generics 11070 11071 */ 11072 static inline libcrux_ml_kem_polynomial_PolynomialRingElement_1d 11073 libcrux_ml_kem_polynomial_clone_c1_ea( 11074 libcrux_ml_kem_polynomial_PolynomialRingElement_1d *self) { 11075 libcrux_ml_kem_polynomial_PolynomialRingElement_1d lit; 11076 libcrux_ml_kem_vector_portable_vector_type_PortableVector ret[16U]; 11077 core_array__core__clone__Clone_for__Array_T__N___clone( 11078 (size_t)16U, self->coefficients, ret, 11079 libcrux_ml_kem_vector_portable_vector_type_PortableVector, void *); 11080 memcpy(lit.coefficients, ret, 11081 (size_t)16U * 11082 sizeof(libcrux_ml_kem_vector_portable_vector_type_PortableVector)); 11083 return lit; 11084 } 11085 11086 /** 11087 A monomorphic instance of libcrux_ml_kem.ind_cca.unpacked.transpose_a 11088 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 11089 with const generics 11090 - K= 3 11091 */ 11092 static inline void libcrux_ml_kem_ind_cca_unpacked_transpose_a_1b( 11093 libcrux_ml_kem_polynomial_PolynomialRingElement_1d ind_cpa_a[3U][3U], 11094 libcrux_ml_kem_polynomial_PolynomialRingElement_1d ret[3U][3U]) { 11095 libcrux_ml_kem_polynomial_PolynomialRingElement_1d A[3U][3U]; 11096 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 11097 /* original Rust expression is not an lvalue in C */ 11098 void *lvalue = (void *)0U; 11099 libcrux_ml_kem_ind_cca_unpacked_transpose_a_call_mut_7b_1b(&lvalue, i, 11100 A[i]); 11101 } 11102 for (size_t i = (size_t)0U; i < (size_t)3U; i++) { 11103 size_t i0 = i; 11104 libcrux_ml_kem_polynomial_PolynomialRingElement_1d _a_i[3U][3U]; 11105 memcpy(_a_i, A, 11106 (size_t)3U * 11107 sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d[3U])); 11108 for (size_t i1 = (size_t)0U; i1 < (size_t)3U; i1++) { 11109 size_t j = i1; 11110 libcrux_ml_kem_polynomial_PolynomialRingElement_1d uu____0 = 11111 libcrux_ml_kem_polynomial_clone_c1_ea(&ind_cpa_a[j][i0]); 11112 A[i0][j] = uu____0; 11113 } 11114 } 11115 memcpy(ret, A, 11116 (size_t)3U * 11117 sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d[3U])); 11118 } 11119 11120 /** 11121 Generate Unpacked Keys 11122 */ 11123 /** 11124 A monomorphic instance of libcrux_ml_kem.ind_cca.unpacked.generate_keypair 11125 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, 11126 libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]], 11127 libcrux_ml_kem_variant_MlKem with const generics 11128 - K= 3 11129 - CPA_PRIVATE_KEY_SIZE= 1152 11130 - PRIVATE_KEY_SIZE= 2400 11131 - PUBLIC_KEY_SIZE= 1184 11132 - ETA1= 2 11133 - ETA1_RANDOMNESS_SIZE= 128 11134 */ 11135 static KRML_MUSTINLINE void libcrux_ml_kem_ind_cca_unpacked_generate_keypair_15( 11136 uint8_t randomness[64U], 11137 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked *out) { 11138 Eurydice_slice ind_cpa_keypair_randomness = Eurydice_array_to_subslice3( 11139 randomness, (size_t)0U, 11140 LIBCRUX_ML_KEM_CONSTANTS_CPA_PKE_KEY_GENERATION_SEED_SIZE, uint8_t *); 11141 Eurydice_slice implicit_rejection_value = Eurydice_array_to_subslice_from( 11142 (size_t)64U, randomness, 11143 LIBCRUX_ML_KEM_CONSTANTS_CPA_PKE_KEY_GENERATION_SEED_SIZE, uint8_t, 11144 size_t, uint8_t[]); 11145 libcrux_ml_kem_ind_cpa_generate_keypair_unpacked_1c( 11146 ind_cpa_keypair_randomness, &out->private_key.ind_cpa_private_key, 11147 &out->public_key.ind_cpa_public_key); 11148 libcrux_ml_kem_polynomial_PolynomialRingElement_1d uu____0[3U][3U]; 11149 memcpy(uu____0, out->public_key.ind_cpa_public_key.A, 11150 (size_t)3U * 11151 sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d[3U])); 11152 libcrux_ml_kem_polynomial_PolynomialRingElement_1d A[3U][3U]; 11153 libcrux_ml_kem_ind_cca_unpacked_transpose_a_1b(uu____0, A); 11154 libcrux_ml_kem_polynomial_PolynomialRingElement_1d uu____1[3U][3U]; 11155 memcpy(uu____1, A, 11156 (size_t)3U * 11157 sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d[3U])); 11158 memcpy(out->public_key.ind_cpa_public_key.A, uu____1, 11159 (size_t)3U * 11160 sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d[3U])); 11161 uint8_t pk_serialized[1184U]; 11162 libcrux_ml_kem_ind_cpa_serialize_public_key_89( 11163 out->public_key.ind_cpa_public_key.t_as_ntt, 11164 Eurydice_array_to_slice( 11165 (size_t)32U, out->public_key.ind_cpa_public_key.seed_for_A, uint8_t), 11166 pk_serialized); 11167 uint8_t uu____2[32U]; 11168 libcrux_ml_kem_hash_functions_portable_H_4a_e0( 11169 Eurydice_array_to_slice((size_t)1184U, pk_serialized, uint8_t), uu____2); 11170 memcpy(out->public_key.public_key_hash, uu____2, 11171 (size_t)32U * sizeof(uint8_t)); 11172 uint8_t uu____3[32U]; 11173 Result_fb dst; 11174 Eurydice_slice_to_array2(&dst, implicit_rejection_value, Eurydice_slice, 11175 uint8_t[32U], TryFromSliceError); 11176 unwrap_26_b3(dst, uu____3); 11177 memcpy(out->private_key.implicit_rejection_value, uu____3, 11178 (size_t)32U * sizeof(uint8_t)); 11179 } 11180 11181 /** 11182 Generate a key pair 11183 */ 11184 /** 11185 A monomorphic instance of 11186 libcrux_ml_kem.ind_cca.instantiations.portable.unpacked.generate_keypair with 11187 const generics 11188 - K= 3 11189 - CPA_PRIVATE_KEY_SIZE= 1152 11190 - PRIVATE_KEY_SIZE= 2400 11191 - PUBLIC_KEY_SIZE= 1184 11192 - ETA1= 2 11193 - ETA1_RANDOMNESS_SIZE= 128 11194 */ 11195 static KRML_MUSTINLINE void 11196 libcrux_ml_kem_ind_cca_instantiations_portable_unpacked_generate_keypair_ce( 11197 uint8_t randomness[64U], 11198 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked *out) { 11199 /* Passing arrays by value in Rust generates a copy in C */ 11200 uint8_t copy_of_randomness[64U]; 11201 memcpy(copy_of_randomness, randomness, (size_t)64U * sizeof(uint8_t)); 11202 libcrux_ml_kem_ind_cca_unpacked_generate_keypair_15(copy_of_randomness, out); 11203 } 11204 11205 /** 11206 Generate ML-KEM 768 Key Pair in "unpacked" form. 11207 */ 11208 static inline void 11209 libcrux_ml_kem_mlkem768_portable_unpacked_generate_key_pair_mut( 11210 uint8_t randomness[64U], 11211 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked 11212 *key_pair) { 11213 /* Passing arrays by value in Rust generates a copy in C */ 11214 uint8_t copy_of_randomness[64U]; 11215 memcpy(copy_of_randomness, randomness, (size_t)64U * sizeof(uint8_t)); 11216 libcrux_ml_kem_ind_cca_instantiations_portable_unpacked_generate_keypair_ce( 11217 copy_of_randomness, key_pair); 11218 } 11219 11220 /** 11221 This function found in impl {core::default::Default for 11222 libcrux_ml_kem::ind_cca::unpacked::MlKemPublicKeyUnpacked<Vector, 11223 K>[TraitClause@0, TraitClause@1]} 11224 */ 11225 /** 11226 A monomorphic instance of libcrux_ml_kem.ind_cca.unpacked.default_30 11227 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 11228 with const generics 11229 - K= 3 11230 */ 11231 static KRML_MUSTINLINE libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 11232 libcrux_ml_kem_ind_cca_unpacked_default_30_1b(void) { 11233 return ( 11234 KRML_CLITERAL(libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0){ 11235 .ind_cpa_public_key = libcrux_ml_kem_ind_cpa_unpacked_default_8b_1b(), 11236 .public_key_hash = {0U}}); 11237 } 11238 11239 /** 11240 This function found in impl {core::default::Default for 11241 libcrux_ml_kem::ind_cca::unpacked::MlKemKeyPairUnpacked<Vector, 11242 K>[TraitClause@0, TraitClause@1]} 11243 */ 11244 /** 11245 A monomorphic instance of libcrux_ml_kem.ind_cca.unpacked.default_7b 11246 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 11247 with const generics 11248 - K= 3 11249 */ 11250 static KRML_MUSTINLINE 11251 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked 11252 libcrux_ml_kem_ind_cca_unpacked_default_7b_1b(void) { 11253 libcrux_ml_kem_ind_cca_unpacked_MlKemPrivateKeyUnpacked_a0 uu____0 = { 11254 .ind_cpa_private_key = libcrux_ml_kem_ind_cpa_unpacked_default_70_1b(), 11255 .implicit_rejection_value = {0U}}; 11256 return (KRML_CLITERAL( 11257 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked){ 11258 .private_key = uu____0, 11259 .public_key = libcrux_ml_kem_ind_cca_unpacked_default_30_1b()}); 11260 } 11261 11262 /** 11263 Generate ML-KEM 768 Key Pair in "unpacked" form. 11264 */ 11265 static inline libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked 11266 libcrux_ml_kem_mlkem768_portable_unpacked_generate_key_pair( 11267 uint8_t randomness[64U]) { 11268 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked key_pair = 11269 libcrux_ml_kem_ind_cca_unpacked_default_7b_1b(); 11270 uint8_t uu____0[64U]; 11271 memcpy(uu____0, randomness, (size_t)64U * sizeof(uint8_t)); 11272 libcrux_ml_kem_mlkem768_portable_unpacked_generate_key_pair_mut(uu____0, 11273 &key_pair); 11274 return key_pair; 11275 } 11276 11277 /** 11278 Create a new, empty unpacked key. 11279 */ 11280 static inline libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked 11281 libcrux_ml_kem_mlkem768_portable_unpacked_init_key_pair(void) { 11282 return libcrux_ml_kem_ind_cca_unpacked_default_7b_1b(); 11283 } 11284 11285 /** 11286 Create a new, empty unpacked public key. 11287 */ 11288 static inline libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 11289 libcrux_ml_kem_mlkem768_portable_unpacked_init_public_key(void) { 11290 return libcrux_ml_kem_ind_cca_unpacked_default_30_1b(); 11291 } 11292 11293 /** 11294 Take a serialized private key and generate an unpacked key pair from it. 11295 */ 11296 /** 11297 A monomorphic instance of libcrux_ml_kem.ind_cca.unpacked.keys_from_private_key 11298 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 11299 with const generics 11300 - K= 3 11301 - SECRET_KEY_SIZE= 2400 11302 - CPA_SECRET_KEY_SIZE= 1152 11303 - PUBLIC_KEY_SIZE= 1184 11304 - T_AS_NTT_ENCODED_SIZE= 1152 11305 */ 11306 static KRML_MUSTINLINE void 11307 libcrux_ml_kem_ind_cca_unpacked_keys_from_private_key_42( 11308 libcrux_ml_kem_types_MlKemPrivateKey_d9 *private_key, 11309 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked 11310 *key_pair) { 11311 Eurydice_slice_uint8_t_x4 uu____0 = 11312 libcrux_ml_kem_types_unpack_private_key_b4( 11313 Eurydice_array_to_slice((size_t)2400U, private_key->value, uint8_t)); 11314 Eurydice_slice ind_cpa_secret_key = uu____0.fst; 11315 Eurydice_slice ind_cpa_public_key = uu____0.snd; 11316 Eurydice_slice ind_cpa_public_key_hash = uu____0.thd; 11317 Eurydice_slice implicit_rejection_value = uu____0.f3; 11318 libcrux_ml_kem_ind_cpa_deserialize_vector_1b( 11319 ind_cpa_secret_key, 11320 key_pair->private_key.ind_cpa_private_key.secret_as_ntt); 11321 libcrux_ml_kem_ind_cpa_build_unpacked_public_key_mut_3f( 11322 ind_cpa_public_key, &key_pair->public_key.ind_cpa_public_key); 11323 Eurydice_slice_copy( 11324 Eurydice_array_to_slice((size_t)32U, key_pair->public_key.public_key_hash, 11325 uint8_t), 11326 ind_cpa_public_key_hash, uint8_t); 11327 Eurydice_slice_copy( 11328 Eurydice_array_to_slice( 11329 (size_t)32U, key_pair->private_key.implicit_rejection_value, uint8_t), 11330 implicit_rejection_value, uint8_t); 11331 Eurydice_slice_copy( 11332 Eurydice_array_to_slice( 11333 (size_t)32U, key_pair->public_key.ind_cpa_public_key.seed_for_A, 11334 uint8_t), 11335 Eurydice_slice_subslice_from(ind_cpa_public_key, (size_t)1152U, uint8_t, 11336 size_t, uint8_t[]), 11337 uint8_t); 11338 } 11339 11340 /** 11341 Take a serialized private key and generate an unpacked key pair from it. 11342 */ 11343 /** 11344 A monomorphic instance of 11345 libcrux_ml_kem.ind_cca.instantiations.portable.unpacked.keypair_from_private_key 11346 with const generics 11347 - K= 3 11348 - SECRET_KEY_SIZE= 2400 11349 - CPA_SECRET_KEY_SIZE= 1152 11350 - PUBLIC_KEY_SIZE= 1184 11351 - T_AS_NTT_ENCODED_SIZE= 1152 11352 */ 11353 static KRML_MUSTINLINE void 11354 libcrux_ml_kem_ind_cca_instantiations_portable_unpacked_keypair_from_private_key_fd( 11355 libcrux_ml_kem_types_MlKemPrivateKey_d9 *private_key, 11356 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked 11357 *key_pair) { 11358 libcrux_ml_kem_ind_cca_unpacked_keys_from_private_key_42(private_key, 11359 key_pair); 11360 } 11361 11362 /** 11363 Get an unpacked key from a private key. 11364 */ 11365 static inline void 11366 libcrux_ml_kem_mlkem768_portable_unpacked_key_pair_from_private_mut( 11367 libcrux_ml_kem_types_MlKemPrivateKey_d9 *private_key, 11368 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked 11369 *key_pair) { 11370 libcrux_ml_kem_ind_cca_instantiations_portable_unpacked_keypair_from_private_key_fd( 11371 private_key, key_pair); 11372 } 11373 11374 /** 11375 This function found in impl 11376 {libcrux_ml_kem::ind_cca::unpacked::MlKemKeyPairUnpacked<Vector, 11377 K>[TraitClause@0, TraitClause@1]} 11378 */ 11379 /** 11380 A monomorphic instance of 11381 libcrux_ml_kem.ind_cca.unpacked.serialized_private_key_mut_11 with types 11382 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 11383 - K= 3 11384 - CPA_PRIVATE_KEY_SIZE= 1152 11385 - PRIVATE_KEY_SIZE= 2400 11386 - PUBLIC_KEY_SIZE= 1184 11387 */ 11388 static KRML_MUSTINLINE void 11389 libcrux_ml_kem_ind_cca_unpacked_serialized_private_key_mut_11_43( 11390 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked *self, 11391 libcrux_ml_kem_types_MlKemPrivateKey_d9 *serialized) { 11392 libcrux_ml_kem_utils_extraction_helper_Keypair768 uu____0 = 11393 libcrux_ml_kem_ind_cpa_serialize_unpacked_secret_key_6c( 11394 &self->public_key.ind_cpa_public_key, 11395 &self->private_key.ind_cpa_private_key); 11396 uint8_t ind_cpa_private_key[1152U]; 11397 memcpy(ind_cpa_private_key, uu____0.fst, (size_t)1152U * sizeof(uint8_t)); 11398 uint8_t ind_cpa_public_key[1184U]; 11399 memcpy(ind_cpa_public_key, uu____0.snd, (size_t)1184U * sizeof(uint8_t)); 11400 libcrux_ml_kem_ind_cca_serialize_kem_secret_key_mut_d6( 11401 Eurydice_array_to_slice((size_t)1152U, ind_cpa_private_key, uint8_t), 11402 Eurydice_array_to_slice((size_t)1184U, ind_cpa_public_key, uint8_t), 11403 Eurydice_array_to_slice( 11404 (size_t)32U, self->private_key.implicit_rejection_value, uint8_t), 11405 serialized->value); 11406 } 11407 11408 /** 11409 This function found in impl 11410 {libcrux_ml_kem::ind_cca::unpacked::MlKemKeyPairUnpacked<Vector, 11411 K>[TraitClause@0, TraitClause@1]} 11412 */ 11413 /** 11414 A monomorphic instance of 11415 libcrux_ml_kem.ind_cca.unpacked.serialized_private_key_11 with types 11416 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 11417 - K= 3 11418 - CPA_PRIVATE_KEY_SIZE= 1152 11419 - PRIVATE_KEY_SIZE= 2400 11420 - PUBLIC_KEY_SIZE= 1184 11421 */ 11422 static KRML_MUSTINLINE libcrux_ml_kem_types_MlKemPrivateKey_d9 11423 libcrux_ml_kem_ind_cca_unpacked_serialized_private_key_11_43( 11424 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked *self) { 11425 libcrux_ml_kem_types_MlKemPrivateKey_d9 sk = 11426 libcrux_ml_kem_types_default_d3_28(); 11427 libcrux_ml_kem_ind_cca_unpacked_serialized_private_key_mut_11_43(self, &sk); 11428 return sk; 11429 } 11430 11431 /** 11432 Get the serialized private key. 11433 */ 11434 static inline libcrux_ml_kem_types_MlKemPrivateKey_d9 11435 libcrux_ml_kem_mlkem768_portable_unpacked_key_pair_serialized_private_key( 11436 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked 11437 *key_pair) { 11438 return libcrux_ml_kem_ind_cca_unpacked_serialized_private_key_11_43(key_pair); 11439 } 11440 11441 /** 11442 Get the serialized private key. 11443 */ 11444 static inline void 11445 libcrux_ml_kem_mlkem768_portable_unpacked_key_pair_serialized_private_key_mut( 11446 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked *key_pair, 11447 libcrux_ml_kem_types_MlKemPrivateKey_d9 *serialized) { 11448 libcrux_ml_kem_ind_cca_unpacked_serialized_private_key_mut_11_43(key_pair, 11449 serialized); 11450 } 11451 11452 /** 11453 This function found in impl 11454 {libcrux_ml_kem::ind_cca::unpacked::MlKemPublicKeyUnpacked<Vector, 11455 K>[TraitClause@0, TraitClause@1]} 11456 */ 11457 /** 11458 A monomorphic instance of libcrux_ml_kem.ind_cca.unpacked.serialized_dd 11459 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 11460 with const generics 11461 - K= 3 11462 - PUBLIC_KEY_SIZE= 1184 11463 */ 11464 static KRML_MUSTINLINE libcrux_ml_kem_types_MlKemPublicKey_30 11465 libcrux_ml_kem_ind_cca_unpacked_serialized_dd_89( 11466 libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 *self) { 11467 uint8_t ret[1184U]; 11468 libcrux_ml_kem_ind_cpa_serialize_public_key_89( 11469 self->ind_cpa_public_key.t_as_ntt, 11470 Eurydice_array_to_slice((size_t)32U, self->ind_cpa_public_key.seed_for_A, 11471 uint8_t), 11472 ret); 11473 return libcrux_ml_kem_types_from_fd_d0(ret); 11474 } 11475 11476 /** 11477 This function found in impl 11478 {libcrux_ml_kem::ind_cca::unpacked::MlKemKeyPairUnpacked<Vector, 11479 K>[TraitClause@0, TraitClause@1]} 11480 */ 11481 /** 11482 A monomorphic instance of 11483 libcrux_ml_kem.ind_cca.unpacked.serialized_public_key_11 with types 11484 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 11485 - K= 3 11486 - PUBLIC_KEY_SIZE= 1184 11487 */ 11488 static KRML_MUSTINLINE libcrux_ml_kem_types_MlKemPublicKey_30 11489 libcrux_ml_kem_ind_cca_unpacked_serialized_public_key_11_89( 11490 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked *self) { 11491 return libcrux_ml_kem_ind_cca_unpacked_serialized_dd_89(&self->public_key); 11492 } 11493 11494 /** 11495 Get the serialized public key. 11496 */ 11497 static inline libcrux_ml_kem_types_MlKemPublicKey_30 11498 libcrux_ml_kem_mlkem768_portable_unpacked_key_pair_serialized_public_key( 11499 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked 11500 *key_pair) { 11501 return libcrux_ml_kem_ind_cca_unpacked_serialized_public_key_11_89(key_pair); 11502 } 11503 11504 /** 11505 This function found in impl 11506 {libcrux_ml_kem::ind_cca::unpacked::MlKemPublicKeyUnpacked<Vector, 11507 K>[TraitClause@0, TraitClause@1]} 11508 */ 11509 /** 11510 A monomorphic instance of libcrux_ml_kem.ind_cca.unpacked.serialized_mut_dd 11511 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 11512 with const generics 11513 - K= 3 11514 - PUBLIC_KEY_SIZE= 1184 11515 */ 11516 static KRML_MUSTINLINE void 11517 libcrux_ml_kem_ind_cca_unpacked_serialized_mut_dd_89( 11518 libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 *self, 11519 libcrux_ml_kem_types_MlKemPublicKey_30 *serialized) { 11520 libcrux_ml_kem_ind_cpa_serialize_public_key_mut_89( 11521 self->ind_cpa_public_key.t_as_ntt, 11522 Eurydice_array_to_slice((size_t)32U, self->ind_cpa_public_key.seed_for_A, 11523 uint8_t), 11524 serialized->value); 11525 } 11526 11527 /** 11528 This function found in impl 11529 {libcrux_ml_kem::ind_cca::unpacked::MlKemKeyPairUnpacked<Vector, 11530 K>[TraitClause@0, TraitClause@1]} 11531 */ 11532 /** 11533 A monomorphic instance of 11534 libcrux_ml_kem.ind_cca.unpacked.serialized_public_key_mut_11 with types 11535 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 11536 - K= 3 11537 - PUBLIC_KEY_SIZE= 1184 11538 */ 11539 static KRML_MUSTINLINE void 11540 libcrux_ml_kem_ind_cca_unpacked_serialized_public_key_mut_11_89( 11541 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked *self, 11542 libcrux_ml_kem_types_MlKemPublicKey_30 *serialized) { 11543 libcrux_ml_kem_ind_cca_unpacked_serialized_mut_dd_89(&self->public_key, 11544 serialized); 11545 } 11546 11547 /** 11548 Get the serialized public key. 11549 */ 11550 static inline void 11551 libcrux_ml_kem_mlkem768_portable_unpacked_key_pair_serialized_public_key_mut( 11552 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked *key_pair, 11553 libcrux_ml_kem_types_MlKemPublicKey_30 *serialized) { 11554 libcrux_ml_kem_ind_cca_unpacked_serialized_public_key_mut_11_89(key_pair, 11555 serialized); 11556 } 11557 11558 /** 11559 This function found in impl {core::clone::Clone for 11560 libcrux_ml_kem::ind_cpa::unpacked::IndCpaPublicKeyUnpacked<Vector, 11561 K>[TraitClause@0, TraitClause@2]} 11562 */ 11563 /** 11564 A monomorphic instance of libcrux_ml_kem.ind_cpa.unpacked.clone_91 11565 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 11566 with const generics 11567 - K= 3 11568 */ 11569 static inline libcrux_ml_kem_ind_cpa_unpacked_IndCpaPublicKeyUnpacked_a0 11570 libcrux_ml_kem_ind_cpa_unpacked_clone_91_1b( 11571 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPublicKeyUnpacked_a0 *self) { 11572 libcrux_ml_kem_polynomial_PolynomialRingElement_1d uu____0[3U]; 11573 core_array__core__clone__Clone_for__Array_T__N___clone( 11574 (size_t)3U, self->t_as_ntt, uu____0, 11575 libcrux_ml_kem_polynomial_PolynomialRingElement_1d, void *); 11576 uint8_t uu____1[32U]; 11577 core_array__core__clone__Clone_for__Array_T__N___clone( 11578 (size_t)32U, self->seed_for_A, uu____1, uint8_t, void *); 11579 libcrux_ml_kem_ind_cpa_unpacked_IndCpaPublicKeyUnpacked_a0 lit; 11580 memcpy( 11581 lit.t_as_ntt, uu____0, 11582 (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d)); 11583 memcpy(lit.seed_for_A, uu____1, (size_t)32U * sizeof(uint8_t)); 11584 libcrux_ml_kem_polynomial_PolynomialRingElement_1d ret[3U][3U]; 11585 core_array__core__clone__Clone_for__Array_T__N___clone( 11586 (size_t)3U, self->A, ret, 11587 libcrux_ml_kem_polynomial_PolynomialRingElement_1d[3U], void *); 11588 memcpy(lit.A, ret, 11589 (size_t)3U * 11590 sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_1d[3U])); 11591 return lit; 11592 } 11593 11594 /** 11595 This function found in impl {core::clone::Clone for 11596 libcrux_ml_kem::ind_cca::unpacked::MlKemPublicKeyUnpacked<Vector, 11597 K>[TraitClause@0, TraitClause@2]} 11598 */ 11599 /** 11600 A monomorphic instance of libcrux_ml_kem.ind_cca.unpacked.clone_d7 11601 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 11602 with const generics 11603 - K= 3 11604 */ 11605 static inline libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 11606 libcrux_ml_kem_ind_cca_unpacked_clone_d7_1b( 11607 libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 *self) { 11608 libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 lit; 11609 lit.ind_cpa_public_key = 11610 libcrux_ml_kem_ind_cpa_unpacked_clone_91_1b(&self->ind_cpa_public_key); 11611 uint8_t ret[32U]; 11612 core_array__core__clone__Clone_for__Array_T__N___clone( 11613 (size_t)32U, self->public_key_hash, ret, uint8_t, void *); 11614 memcpy(lit.public_key_hash, ret, (size_t)32U * sizeof(uint8_t)); 11615 return lit; 11616 } 11617 11618 /** 11619 This function found in impl 11620 {libcrux_ml_kem::ind_cca::unpacked::MlKemKeyPairUnpacked<Vector, 11621 K>[TraitClause@0, TraitClause@1]} 11622 */ 11623 /** 11624 A monomorphic instance of libcrux_ml_kem.ind_cca.unpacked.public_key_11 11625 with types libcrux_ml_kem_vector_portable_vector_type_PortableVector 11626 with const generics 11627 - K= 3 11628 */ 11629 static KRML_MUSTINLINE libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 * 11630 libcrux_ml_kem_ind_cca_unpacked_public_key_11_1b( 11631 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked *self) { 11632 return &self->public_key; 11633 } 11634 11635 /** 11636 Get the unpacked public key. 11637 */ 11638 static inline void libcrux_ml_kem_mlkem768_portable_unpacked_public_key( 11639 libcrux_ml_kem_mlkem768_portable_unpacked_MlKem768KeyPairUnpacked *key_pair, 11640 libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 *pk) { 11641 libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 uu____0 = 11642 libcrux_ml_kem_ind_cca_unpacked_clone_d7_1b( 11643 libcrux_ml_kem_ind_cca_unpacked_public_key_11_1b(key_pair)); 11644 pk[0U] = uu____0; 11645 } 11646 11647 /** 11648 Get the serialized public key. 11649 */ 11650 static inline void 11651 libcrux_ml_kem_mlkem768_portable_unpacked_serialized_public_key( 11652 libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 *public_key, 11653 libcrux_ml_kem_types_MlKemPublicKey_30 *serialized) { 11654 libcrux_ml_kem_ind_cca_unpacked_serialized_mut_dd_89(public_key, serialized); 11655 } 11656 11657 /** 11658 Generate an unpacked key from a serialized key. 11659 */ 11660 /** 11661 A monomorphic instance of libcrux_ml_kem.ind_cca.unpacked.unpack_public_key 11662 with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]], 11663 libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics 11664 - K= 3 11665 - T_AS_NTT_ENCODED_SIZE= 1152 11666 - PUBLIC_KEY_SIZE= 1184 11667 */ 11668 static KRML_MUSTINLINE void 11669 libcrux_ml_kem_ind_cca_unpacked_unpack_public_key_0a( 11670 libcrux_ml_kem_types_MlKemPublicKey_30 *public_key, 11671 libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 11672 *unpacked_public_key) { 11673 Eurydice_slice uu____0 = 11674 Eurydice_array_to_subslice_to((size_t)1184U, public_key->value, 11675 (size_t)1152U, uint8_t, size_t, uint8_t[]); 11676 libcrux_ml_kem_serialize_deserialize_ring_elements_reduced_1b( 11677 uu____0, unpacked_public_key->ind_cpa_public_key.t_as_ntt); 11678 uint8_t uu____1[32U]; 11679 libcrux_ml_kem_utils_into_padded_array_9e( 11680 Eurydice_array_to_subslice_from((size_t)1184U, public_key->value, 11681 (size_t)1152U, uint8_t, size_t, 11682 uint8_t[]), 11683 uu____1); 11684 memcpy(unpacked_public_key->ind_cpa_public_key.seed_for_A, uu____1, 11685 (size_t)32U * sizeof(uint8_t)); 11686 libcrux_ml_kem_polynomial_PolynomialRingElement_1d(*uu____2)[3U] = 11687 unpacked_public_key->ind_cpa_public_key.A; 11688 uint8_t ret[34U]; 11689 libcrux_ml_kem_utils_into_padded_array_b6( 11690 Eurydice_array_to_subslice_from((size_t)1184U, public_key->value, 11691 (size_t)1152U, uint8_t, size_t, 11692 uint8_t[]), 11693 ret); 11694 libcrux_ml_kem_matrix_sample_matrix_A_2b(uu____2, ret, false); 11695 uint8_t uu____3[32U]; 11696 libcrux_ml_kem_hash_functions_portable_H_4a_e0( 11697 Eurydice_array_to_slice((size_t)1184U, 11698 libcrux_ml_kem_types_as_slice_e6_d0(public_key), 11699 uint8_t), 11700 uu____3); 11701 memcpy(unpacked_public_key->public_key_hash, uu____3, 11702 (size_t)32U * sizeof(uint8_t)); 11703 } 11704 11705 /** 11706 Get the unpacked public key. 11707 */ 11708 /** 11709 A monomorphic instance of 11710 libcrux_ml_kem.ind_cca.instantiations.portable.unpacked.unpack_public_key with 11711 const generics 11712 - K= 3 11713 - T_AS_NTT_ENCODED_SIZE= 1152 11714 - PUBLIC_KEY_SIZE= 1184 11715 */ 11716 static KRML_MUSTINLINE void 11717 libcrux_ml_kem_ind_cca_instantiations_portable_unpacked_unpack_public_key_31( 11718 libcrux_ml_kem_types_MlKemPublicKey_30 *public_key, 11719 libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 11720 *unpacked_public_key) { 11721 libcrux_ml_kem_ind_cca_unpacked_unpack_public_key_0a(public_key, 11722 unpacked_public_key); 11723 } 11724 11725 /** 11726 Get the unpacked public key. 11727 */ 11728 static inline void 11729 libcrux_ml_kem_mlkem768_portable_unpacked_unpacked_public_key( 11730 libcrux_ml_kem_types_MlKemPublicKey_30 *public_key, 11731 libcrux_ml_kem_ind_cca_unpacked_MlKemPublicKeyUnpacked_a0 11732 *unpacked_public_key) { 11733 libcrux_ml_kem_ind_cca_instantiations_portable_unpacked_unpack_public_key_31( 11734 public_key, unpacked_public_key); 11735 } 11736 11737 #if defined(__cplusplus) 11738 } 11739 #endif 11740 11741 #define libcrux_mlkem768_portable_H_DEFINED 11742 #endif /* libcrux_mlkem768_portable_H */ 11743 11744 11745 /* rename some types to be a bit more ergonomic */ 11746 #define libcrux_mlkem768_keypair libcrux_ml_kem_mlkem768_MlKem768KeyPair_s 11747 #define libcrux_mlkem768_pk libcrux_ml_kem_types_MlKemPublicKey_30_s 11748 #define libcrux_mlkem768_sk libcrux_ml_kem_types_MlKemPrivateKey_d9_s 11749 #define libcrux_mlkem768_ciphertext libcrux_ml_kem_mlkem768_MlKem768Ciphertext_s 11750 #define libcrux_mlkem768_enc_result tuple_c2_s 11751 /* defines for PRNG inputs */ 11752 #define LIBCRUX_ML_KEM_KEY_PAIR_PRNG_LEN 64U 11753 #define LIBCRUX_ML_KEM_ENC_PRNG_LEN 32 11754
Indexes created Tue Sep 22 00:26:15 UTC 2026