Sets p to the polynomial of norm less than or equal η encoded in the given buffer of size PolyLeqEtaSize. Output coefficients of p are not normalized

Sets p to the polynomial of norm less than or equal η encoded in the given buffer of size PolyLeqEtaSize. Output coefficients of p are not normalized

Sets p to the polynomial of norm less than or equal η encoded in the given buffer of size PolyLeqEtaSize. Output coefficients of p are not normalized

Sets p to the polynomial of norm less than or equal η encoded in the given buffer of size PolyLeqEtaSize. Output coefficients of p are not normalized

ProdPairFrac computes the product e(P, Q)^sign where sign is 1 or -1

Prove returns a proof attesting that kG = [k]G. It panics if the base G or public key kG is the identity element.

Prove returns a proof attesting to the validity of the given measurement.

Returns a y with y < 2q and y = x mod q. Note that in general *not*: ReduceLe2Q(ReduceLe2Q(x)) == x.

Registers SIDH parameters for particular field.

Round 3 ---- sender should send e0, e1 to receiver ---- Input: e0, e1: encryption of m0 and m1 from the sender Input: choice, choice bit of receiver C

ScalarMult calculates P = k*Q, where Q is an N-torsion point.

Scheme returns a KEM interface.

SetBigInt stores b into e, reducing it modulo p as necessary. Any b is accepted, including negative and out-of-range values.

SetBigInt sets the receiver to x, and returns the receiver. Warning: operations on big.Int are not constant time. Do not use them for cryptography unl

SetupPSK generates a new HPKE context used for PSK Mode encryption. Returns the Sealer and corresponding encapsulated key.

Size of established shared keys.

SignTo signs the given message and writes the signature into signature. It will panic if signature is not of length at least SignatureSize.

SignTo signs the given message and writes the signature into signature. It will panic if signature is not of length at least SignatureSize.

SignedDigit obtains the signed-digit recoding of n and returns a list L of digits such that n = sum( L[i]*2^(i*(w-1)) ), and each L[i] is an odd numbe

Size returns size of the public key in bytes.

Size returns size of the private key in bytes.

Sqr calculates z = x^2 mod p.

Sqrt returns 1 and sets z=sqrt(x) only if x is a quadratic-residue; otherwise, returns 0 and z is unmodified.

Strip removes the higher-degree zero terms.

Sub calculates z = x-y mod p.

Suite returns the cipher suite corresponding to this context.

ToBytes stores P into a slice of bytes.

Multiplies p in-place by the Montgomery factor 2¹⁶. Coefficients of p can be arbitrary. Resulting coefficients are bounded in absolute value by q.

Uint64Le2BigInt converts a little-endian slice x into a big number.

UnmarshalBinary recovers a KeyShare from a slice of bytes, or returns an error if the encoding is invalid.

Unpacks pk from the given buffer. Returns an error if the buffer is not of the right size, or the public key is not normalized.

Verify returns true if the share s was produced by sharing a secret with threshold t and commitment of the secret c.

Verify checks whether the given signature by pk on msg is valid. For Dilithium this is the top-level verification function. In ML-DSA, this is ML-DSA

Verify checks whether the given signature by pk on msg is valid. For Dilithium this is the top-level verification function. In ML-DSA, this is ML-DSA

Verify checks whether the given signature by pk on msg is valid. For Dilithium this is the top-level verification function. In ML-DSA, this is ML-DSA

Verify checks whether the proof attests that kG = [k]G. The base G, public key kG, and proof commitment must not be the identity element.

Verify verifies the input (message, signature) pair and produces an error upon failure.

VerifyBlindSignature verifies the signature of the hashed and encoded message against the input public key.

Returns the hybrid KEM of ML-KEM-768 and X25519. https://www.ietf.org/archive/id/draft-kwiatkowski-tls-ecdhe-mlkem-01.html

absolute returns always a positive value.

add calculates z = x + y. Assumes len(z) > max(len(x),len(y)).

Compute z = x + y (mod p). go:noescape

Compute z = x + y (mod p). go:noescape

Compute z = x + y (mod p). go:noescape

Compute z = x + y, without reducing mod p. go:noescape

Compute z = x + y, without reducing mod p. go:noescape

Compute z = x + y, without reducing mod p. go:noescape

* ------------------------------------------------------------------------- Benchmarking -------------------------------------------------------

See FIPS 205 -- Section 5 -- Algorithm 5.

clear sets m to the zero matrix

clear sets a matrix to the all zero matrix

clear sets m to be the "zero" matrix

clearCofactor maps g to a point in the r-torsion subgroup. This method multiplies g times (1-z) rather than (z-1)^2/3, where z is the BLS12 parameter

cneg conditionally negates the point if b=1.

computes Lagrange Interpolation for the shares i must be in {0..l} but not in S j must be in S

f(X) = Σ^{k-1}_{i=0} | a_i * X^i (mod m), where k = len(a).

condAddOrderN updates x = x+order if x is even, otherwise x remains unchanged.

conformal returns true iff m and a have the same dimensions.

conformal returns true iff m and a have the same dimensions.

If choice = 0, leave x,y unchanged. If choice = 1, set x,y = y,x. If choice is neither 0 nor 1 then behaviour is undefined. This function executes in

If choice = 0, leave x,y unchanged. If choice = 1, set x,y = y,x. If choice is neither 0 nor 1 then behaviour is undefined. This function executes in

If choice = 0, leave x,y unchanged. If choice = 1, set x,y = y,x. If choice is neither 0 nor 1 then behaviour is undefined. This function executes in

ctIsNonZero64 returns 0 in case i == 0, otherwise it returns 1. Constant-time.

decrypt uses SIKE private key to decrypt ciphertext. Returns plaintext in case decryption succeeds or error in case unexpected input was provided. Con

divBy4 calculates z = x/4 mod order.

doubleMult returns P=mG+nQ.

encrypt uses SIKE public key to encrypt plaintext. Requires cryptographically secure PRNG. Returns ciphertext in case encryption succeeds. Returns err

evalIsogG1 calculates g = g1Isog11(p), where g1Isog11 is an isogeny of degree 11 to the curve used in G1.