fp384Neg requires a reduced a, as it computes p-a. go:noescape

go:noescape

go:noescape

Executes an in-place inverse "NTT" on p and multiply by the Montgomery factor R. Requires coefficients to be in "tangled" order, see Tangle(). Assume

modOrder reduces z mod order.

Sets p to the "pointwise" multiplication of a and b. That is: InvNTT(p) = InvNTT(a) * InvNTT(b). Assumes a and b are in Montgomery form. Products b

Sets p to the polynomial whose coefficients are the pointwise multiplication of those of a and b. The coefficients of p are bounded by 2q. Assumes a

Reduce each of the coefficients to <q.

Executes an in-place forward "NTT" on p. Assumes the coefficients are in absolute value ≤q. The resulting coefficients are in absolute value ≤7q. I

Execute an in-place forward NTT on as. Assumes the coefficients are in Montgomery representation and bounded by 2*Q. The resulting coefficients are

Reduces each of the coefficients to <2q.

sampleDlin samples from the distribution Dk. See section 3.2 of the paper for details.

See FIPS 205 -- Section 9.3 -- Algorithm 20.

Compute z = x - y (mod p). go:noescape

Compute z = x - y (mod p). go:noescape

Compute z = x - y (mod p). go:noescape

* ------------------------------------------------------------------------- Wrappers for 'testing' SIDH ----------------------------------------

BlindSign blindly computes the RSA operation using the Signer's private key on the blinded message input, if it's of valid length, and returns an erro

ByName returns the scheme with the given name and nil if it is not supported. Names are case insensitive.

Packs the public key.

Read 2*bytelen(p) bytes into the given ExtensionFieldElement. It is an error to call this function if the input byte slice is less than 2*bytelen(p)

Computes equivalence (A:C) ~ (A+2C : 4C)

Computes equivalence (A:C) ~ (A+2C : 4C)

Computes equivalence (A:C) ~ (A+2C : 4C)

CombinedMult calculates P=mG+nQ, where G is the generator and Q=(Qx,Qy). The scalars m and n are positive integers in big-endian form. Runs in non-con

Set p to Decompress_q(m, 1). p will be normalized. m has to be of PlaintextSize.

DeriveKeyPair deterministically derives a pair of keys from a seed. Panics if the length of seed is not equal to the value returned by SeedSize.

DeriveSecret computes a cSIDH shared secret. If successful, returns true and fills 'out' with shared secret. Function returns false in case 'pub' is i

Puts p back into standard form.

Double updates g = 2g.

Exp is calculates x^k, where x is a predetermined element of a group G.

Exports currently stored key. In case structure hasn't been filled with key data returned byte string is filled with zeros.

FromBytes stores z = x mod order, where x is a number stored in little-endian order.

Given a three-torsion point p = x(PB) on the curve E_(A:C), construct the three-isogeny phi : E_(A:C) -> E_(A:C)/<P_3> = E_(A':C'). Input: (XP_3: ZP_

Given a four-torsion point p = x(PB) on the curve E_(A:C), construct the four-isogeny phi : E_(A:C) -> E_(A:C)/<P_4> = E_(A':C'). Input: (XP_4: ZP_4)

Given a three-torsion point p = x(PB) on the curve E_(A:C), construct the three-isogeny phi : E_(A:C) -> E_(A:C)/<P_3> = E_(A':C'). Input: (XP_3: ZP_

Given a four-torsion point p = x(PB) on the curve E_(A:C), construct the four-isogeny phi : E_(A:C) -> E_(A:C)/<P_4> = E_(A':C'). Input: (XP_4: ZP_4)

Given a three-torsion point p = x(PB) on the curve E_(A:C), construct the three-isogeny phi : E_(A:C) -> E_(A:C)/<P_3> = E_(A':C'). Input: (XP_3: ZP_

Given a four-torsion point p = x(PB) on the curve E_(A:C), construct the four-isogeny phi : E_(A:C) -> E_(A:C)/<P_4> = E_(A':C'). Input: (XP_4: ZP_4)

Assumes key is in Montgomery domain.

Initialization Input: myGroup, the group we operate in Input: m0, m1 the 2 message of the sender Input: index, the index of this SimOT Output: A = [a]

Initialize the state and returns the buffer on which the two permutations will act: a uint64 slice of length 50. The first permutation will act on {a

Inv calculates z = 1 / x.

IsEqual returns 1 if z == x and 0 otherwise.

IsExtended returns true if the element x^(2^(wd)) must be calculated.

IsNegative returns 0 if the least absolute residue for z is in [0,(p-1)/2], and 1 otherwise. Equivalently, this function returns 1 if z is lexicograph

IsOnCurve returns true if the point lies on the curve.

IsOnCurve reports whether the given P=(x,y) lies on the curve.

IsOnG2 returns true if the point is in the group G2.

IsZero returns 1 if z == 0 and 0 otherwise.

Returns true if the element is the neutral additive element.

KeyGen calculates a public key k from a secret key.

Marshal encodes a point P into out buffer.

Executes an in-place forward "NTT" on p. Assumes the coefficients are in absolute value ≤q. The resulting coefficients are in absolute value ≤7q. I

New creates a new polynomial given its coefficients in ascending order. Thus, p(x) = \sum_i^k c[i] x^i, where k = len(c)-1 is the degree of the pol

This file provides functions for creating instances of the SHA-3 and SHAKE hash functions, as well as utility functions for hashing bytes. New224 crea

Derives a new Kyber.CPAPKE keypair from the given seed.

Derives a new Kyber.CPAPKE keypair from the given seed.

Derives a new Kyber.CPAPKE keypair from the given seed.

NewSike434 instantiates SIKE/p434 KEM. Deprecated: not cryptographically secure.

NewSike751 instantiates SIKE/p751 KEM. Deprecated: not cryptographically secure.

Normalizes coefficients in-place. Ensures each coefficient is in {0, …, q-1}.

Normalizes coefficients in-place. Ensures each coefficient is in {0, …, q-1}.

Normalizes coefficients in-place. Ensures each coefficient is in {0, …, q-1}.

Pack packs the public key into buf.

Pack packs the public key into buf.