Splits 0 ≤ a < q into a₀ and a₁ with a = a₁*α + a₀ with -α/2 < a₀ ≤ α/2, except for when we would have a₁ = (q-1)/α in which case a₁=0 is taken and -α

Splits 0 ≤ a < q into a₀ and a₁ with a = a₁*α + a₀ with -α/2 < a₀ ≤ α/2, except for when we would have a₁ = (q-1)/α in which case a₁=0 is taken and -α

Splits 0 ≤ a < q into a₀ and a₁ with a = a₁*α + a₀ with -α/2 < a₀ ≤ α/2, except for when we would have a₁ = (q-1)/α in which case a₁=0 is taken and -α

Splits 0 ≤ a < q into a₀ and a₁ with a = a₁*α + a₀ with -α/2 < a₀ ≤ α/2, except for when we would have a₁ = (q-1)/α in which case a₁=0 is taken and -α

derivePublicKey tweaks the public key based on the input metadata. See the specification for more details: https://datatracker.ietf.org/doc/html/draf

Checks whether the "supnorm" (see sec 2.1 of the spec) of p is equal or greater than the given bound. Requires the coefficients of p to be normalized

The function fiatFpMul multiplies two field elements in the Montgomery domain. Preconditions: 0 ≤ eval arg1 < m 0 ≤ eval arg2 < m Postconditions: eva

The function fiatFpMul multiplies two field elements in the Montgomery domain. Preconditions: 0 ≤ eval arg1 < m 0 ≤ eval arg2 < m Postconditions: eva

See FIPS 205 -- Section 8.4 -- Algorithm 17.

go:noescape

See FIPS 205 -- Section 7.1 -- Algorithm 12.

See FIPS 205 -- Section 7.2 -- Algorithm 13.

d*xmssSigSize() bytes

Converts src to an array of uint64 values encoded in little-endian byte order.

Execute an in-place inverse NTT and multiply by Montgomery factor R Assumes the coefficients are in Montgomery representation and bounded by 2*Q. Th

Returns result of x<y operation.

isRTorsion returns true if point is in the r-torsion subgroup.

mixadd calculates P=Q+R such that P and Q different than the identity point, and Q not in {P,-P, O}.

modExpRdc does modular exponentiation of 512-bit number. Constant-time.

Sets p to 2ᵈ q without reducing. So it requires the coefficients of p to be less than 2³²⁻ᴰ.

Normalize the coefficients in this polynomial assuming they are already bounded by 2q.

Normalizes coefficients. Ensures each coefficient is in {0, …, q-1}.

Writes p whose coefficients are in [0, 16) to buf, which must be of length N/2.

Splits p into p1 and p0 such that [i]p1 * 2ᴰ + [i]p0 = [i]p with -2ᴰ⁻¹ < [i]p0 ≤ 2ᴰ⁻¹. Returns p0 + Q and p1. Requires the coefficients of p to be n

push sends a point on the Goldilocks curve to a point on the twist curve.

reduceModOrder calculates k = k mod order of the curve.

scalarMult sets m to c*a where c is a Scalar,

See FIPS 205 -- Section 9 SLH-DSA Internal Functions See FIPS 205 -- Section 9.1 -- Algorithm 18.

See FIPS 205 -- Section 9.2 -- Algorithm 19.

sub sets m to a-b.

r = x - y.

Sets p to a - b. Does not normalize coefficients.

Sets p to a - b. Warning: assumes coefficients of b are less than 2q.

See FIPS 205 -- Section 5.1 -- Algorithm 6.

xAdd implements differential arithmetic in P^1 for Montgomery curves E(x): x^3 + A*x^2 + x by using x-coordinate only arithmetic. x(PaQ) = x(P) + x(

xIso computes the isogeny with kernel point kern of a given order kernOrder. Returns the new curve coefficient co and the image img. During computati

xMul implements point multiplication with left-to-right Montgomery adder. co is A coefficient of x^3 + A*x^2 + x curve. k must be > 0 Non-constant ti

See FIPS 205 -- Section 6.3 -- Algorithm 11.

Add calculates z = x+y mod p.

Add returns P+Q.

AddSub calculates (x,y) = (x+y mod p, x-y mod p).

Aggregate produces a unified signature given a list of signatures. To specify the group of keys pass either G1{} or G2{} as the first parameter.

Allocate allocates KEM object for multiple SIKE operations. The rng must be cryptographically secure PRNG.

BuildMessage returns a [Message] for signing, and resets the writer.

CMov sets z=x if b == 0 and z=y if b == 1. Its behavior is undefined if b takes any other value.

CombineSignShares combines SignShares to produce a valid signature. Players and threshold must be trusted protocol parameters; the function checks the

CommitSecret creates a commitment to the secret for further verifying shares.

Dbl sets the receiver to 2 * x, and returns the receiver.

Expands the given seed to a complete matrix. This function is called ExpandA in the specification.

Expands the given seed to a complete matrix. This function is called ExpandA in the specification.

Expands the given seed to a complete matrix. This function is called ExpandA in the specification.

Expands the given seed to a complete matrix. This function is called ExpandA in the specification.

Expands the given seed to a complete matrix. This function is called ExpandA in the specification.

Expands the given seed to a complete matrix. This function is called ExpandA in the specification.

DeriveKeyPair derives a public/private keypair deterministically from the given seed. Panics if seed is not of length SeedSize.

Samples p from a centered binomial distribution with given η. Essentially CBD_η(PRF(seed, nonce)) from the specification.

Sample p from a centered binomial distribution with n=4 and p=½ - that is: coefficients are in {-2, -1, 0, 1, 2} with probabilities {1/16, 1/4, 3/8, 1

Sample p from a centered binomial distribution with n=6 and p=½ - that is: coefficients are in {-3, -2, -1, 0, 1, 2, 3} with probabilities {1/64, 3/32

Double returns 2*(x,y).