+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ ++ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| File | ++ | Statements | ++ | Branches | ++ | Functions | ++ | Lines | ++ |
|---|---|---|---|---|---|---|---|---|---|
| index.ts | +
+
+ |
+ 100% | +4/4 | +100% | +1/1 | +100% | +1/1 | +100% | +4/4 | +
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 | 1x +3x +3x + +1x + + + | export const add = (a: number, b: number) => {
+ return a + b
+}
+
+export const kp = 1
+
+export { MlKem512 } from './mlKem/mlKem512'
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 | + + + + + +1x + +1x + +1x + + +1x +1x +1x +1x +1x +1x +1x +1x +1x +1x +1x +1x + + +1x +1x +1x +1x +1x +1x +1x +1x +1x +1x +1x +1x + | /** + * This implementation is based on https://github.com/antontutoveanu/crystals-kyber-javascript, + * which was deveploped under the MIT licence below: + * https://github.com/antontutoveanu/crystals-kyber-javascript/blob/main/LICENSE + */ + +export const N = 256 + +export const Q = 3329 + +export const Q_INV = 62209 + +// deno-fmt-ignore +export const NTT_ZETAS = [ + 2285, 2571, 2970, 1812, 1493, 1422, 287, 202, 3158, 622, 1577, 182, 962, 2127, + 1855, 1468, 573, 2004, 264, 383, 2500, 1458, 1727, 3199, 2648, 1017, 732, 608, + 1787, 411, 3124, 1758, 1223, 652, 2777, 1015, 2036, 1491, 3047, 1785, 516, + 3321, 3009, 2663, 1711, 2167, 126, 1469, 2476, 3239, 3058, 830, 107, 1908, + 3082, 2378, 2931, 961, 1821, 2604, 448, 2264, 677, 2054, 2226, 430, 555, 843, + 2078, 871, 1550, 105, 422, 587, 177, 3094, 3038, 2869, 1574, 1653, 3083, 778, + 1159, 3182, 2552, 1483, 2727, 1119, 1739, 644, 2457, 349, 418, 329, 3173, + 3254, 817, 1097, 603, 610, 1322, 2044, 1864, 384, 2114, 3193, 1218, 1994, + 2455, 220, 2142, 1670, 2144, 1799, 2051, 794, 1819, 2475, 2459, 478, 3221, + 3021, 996, 991, 958, 1869, 1522, 1628, +] + +// deno-fmt-ignore +export const NTT_ZETAS_INV = [ + 1701, 1807, 1460, 2371, 2338, 2333, 308, 108, 2851, 870, 854, 1510, 2535, + 1278, 1530, 1185, 1659, 1187, 3109, 874, 1335, 2111, 136, 1215, 2945, 1465, + 1285, 2007, 2719, 2726, 2232, 2512, 75, 156, 3000, 2911, 2980, 872, 2685, + 1590, 2210, 602, 1846, 777, 147, 2170, 2551, 246, 1676, 1755, 460, 291, 235, + 3152, 2742, 2907, 3224, 1779, 2458, 1251, 2486, 2774, 2899, 1103, 1275, 2652, + 1065, 2881, 725, 1508, 2368, 398, 951, 247, 1421, 3222, 2499, 271, 90, 853, + 1860, 3203, 1162, 1618, 666, 320, 8, 2813, 1544, 282, 1838, 1293, 2314, 552, + 2677, 2106, 1571, 205, 2918, 1542, 2721, 2597, 2312, 681, 130, 1602, 1871, + 829, 2946, 3065, 1325, 2756, 1861, 1474, 1202, 2367, 3147, 1752, 2707, 171, + 3127, 3042, 1907, 1836, 1517, 359, 758, 1441, +] + |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 | 1x + | export { sha3_256, sha3_512, shake128, shake256 } from '@noble/hashes/sha3'
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 | + + +1x +1x + + + + + + + + + + + + + +1x + | /**
+ * The base error class of kyber-ts.
+ */
+export class MlKemError extends Error {
+ public constructor(e: unknown) {
+ let message: string
+
+ if (e instanceof Error) {
+ message = e.message
+ } else if (typeof e === 'string') {
+ message = e
+ } else {
+ message = ''
+ }
+ super(message)
+
+ this.name = this.constructor.name
+ }
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| File | ++ | Statements | ++ | Branches | ++ | Functions | ++ | Lines | ++ |
|---|---|---|---|---|---|---|---|---|---|
| consts.ts | +
+
+ |
+ 100% | +27/27 | +100% | +0/0 | +100% | +0/0 | +100% | +27/27 | +
| deps.ts | +
+
+ |
+ 100% | +1/1 | +100% | +0/0 | +100% | +0/0 | +100% | +1/1 | +
| errors.ts | +
+
+ |
+ 21.42% | +3/14 | +100% | +0/0 | +0% | +0/1 | +21.42% | +3/14 | +
| mlKem1024.ts | +
+
+ |
+ 0% | +0/107 | +0% | +0/1 | +0% | +0/1 | +0% | +0/107 | +
| mlKem512.ts | +
+
+ |
+ 100% | +44/44 | +100% | +7/7 | +100% | +4/4 | +100% | +44/44 | +
| mlKem768.ts | +
+
+ |
+ 0% | +0/15 | +0% | +0/1 | +0% | +0/1 | +0% | +0/15 | +
| mlKemBase.ts | +
+
+ |
+ 91.1% | +512/562 | +90.29% | +93/103 | +95.34% | +41/43 | +91.1% | +512/562 | +
| utils.ts | +
+
+ |
+ 72.91% | +70/96 | +69.23% | +18/26 | +100% | +12/12 | +72.91% | +70/96 | +
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 +171 +172 +173 +174 +175 +176 +177 +178 +179 +180 +181 +182 +183 +184 +185 +186 +187 +188 +189 +190 +191 +192 +193 +194 +195 | + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + | /** + * This implementation is based on https://github.com/antontutoveanu/crystals-kyber-javascript, + * which was deveploped under the MIT licence below: + * https://github.com/antontutoveanu/crystals-kyber-javascript/blob/main/LICENSE + */ +import { N, Q } from './consts.ts' +import { MlKemBase } from './mlKemBase.ts' +import { byte, int16, uint16, uint32 } from './utils.ts' + +/** + * Represents the MlKem1024 class, which extends the MlKemBase class. + * + * This class extends the MlKemBase class and provides specific implementation for MlKem1024. + * + * @remarks + * + * MlKem1024 is a specific implementation of the ML-KEM key encapsulation mechanism. + * + * @example + * + * ```ts + * // Using jsr: + * import { MlKem1024 } from "@dajiaji/mlkem"; + * // Using npm: + * // import { MlKem1024 } from "mlkem"; // or "crystals-kyber-js" + * + * const recipient = new MlKem1024(); + * const [pkR, skR] = await recipient.generateKeyPair(); + * + * const sender = new MlKem1024(); + * const [ct, ssS] = await sender.encap(pkR); + * + * const ssR = await recipient.decap(ct, skR); + * // ssS === ssR + * ``` + */ +export class MlKem1024 extends MlKemBase { + override _k = 4 + override _du = 11 + override _dv = 5 + override _eta1 = 2 + override _eta2 = 2 + + /** + * Constructs a new instance of the MlKem1024 class. + */ + constructor() { + super() + this._skSize = (12 * this._k * N) / 8 + this._pkSize = this._skSize + 32 + this._compressedUSize = (this._k * this._du * N) / 8 + this._compressedVSize = (this._dv * N) / 8 + } + + // compressU lossily compresses and serializes a vector of polynomials. + + /** + * Lossily compresses and serializes a vector of polynomials. + * + * @param u - The vector of polynomials to compress. + * @returns The compressed and serialized data as a Uint8Array. + */ + protected override _compressU( + r: Uint8Array, + u: Array<Array<number>> + ): Uint8Array { + const t = new Array<number>(8) + for (let rr = 0, i = 0; i < this._k; i++) { + for (let j = 0; j < N / 8; j++) { + for (let k = 0; k < 8; k++) { + t[k] = uint16( + (((uint32(u[i][8 * j + k]) << 11) + uint32(Q / 2)) / uint32(Q)) & + 0x7ff + ) + } + r[rr++] = byte(t[0] >> 0) + r[rr++] = byte((t[0] >> 8) | (t[1] << 3)) + r[rr++] = byte((t[1] >> 5) | (t[2] << 6)) + r[rr++] = byte(t[2] >> 2) + r[rr++] = byte((t[2] >> 10) | (t[3] << 1)) + r[rr++] = byte((t[3] >> 7) | (t[4] << 4)) + r[rr++] = byte((t[4] >> 4) | (t[5] << 7)) + r[rr++] = byte(t[5] >> 1) + r[rr++] = byte((t[5] >> 9) | (t[6] << 2)) + r[rr++] = byte((t[6] >> 6) | (t[7] << 5)) + r[rr++] = byte(t[7] >> 3) + } + } + return r + } + + // compressV lossily compresses and subsequently serializes a polynomial. + + /** + * Lossily compresses and serializes a polynomial. + * + * @param r - The output buffer to store the compressed data. + * @param v - The polynomial to compress. + * @returns The compressed and serialized data as a Uint8Array. + */ + protected override _compressV(r: Uint8Array, v: Array<number>): Uint8Array { + const t = new Uint8Array(8) + for (let rr = 0, i = 0; i < N / 8; i++) { + for (let j = 0; j < 8; j++) { + t[j] = + byte(((uint32(v[8 * i + j]) << 5) + uint32(Q / 2)) / uint32(Q)) & 31 + } + r[rr++] = byte((t[0] >> 0) | (t[1] << 5)) + r[rr++] = byte((t[1] >> 3) | (t[2] << 2) | (t[3] << 7)) + r[rr++] = byte((t[3] >> 1) | (t[4] << 4)) + r[rr++] = byte((t[4] >> 4) | (t[5] << 1) | (t[6] << 6)) + r[rr++] = byte((t[6] >> 2) | (t[7] << 3)) + } + return r + } + + // decompressU de-serializes and decompresses a vector of polynomials and + // represents the approximate inverse of compress1. Since compression is lossy, + // the results of decompression will may not match the original vector of polynomials. + + /** + * Deserializes and decompresses a vector of polynomials. + * This is the approximate inverse of the `_compressU` method. + * Since compression is lossy, the decompressed data may not match the original vector of polynomials. + * + * @param a - The compressed and serialized data as a Uint8Array. + * @returns The decompressed vector of polynomials. + */ + protected override _decompressU(a: Uint8Array): Array<Array<number>> { + const r = new Array<Array<number>>(this._k) + for (let i = 0; i < this._k; i++) { + r[i] = new Array<number>(384) + } + const t = new Array<number>(8) + for (let aa = 0, i = 0; i < this._k; i++) { + for (let j = 0; j < N / 8; j++) { + t[0] = (uint16(a[aa + 0]) >> 0) | (uint16(a[aa + 1]) << 8) + t[1] = (uint16(a[aa + 1]) >> 3) | (uint16(a[aa + 2]) << 5) + t[2] = + (uint16(a[aa + 2]) >> 6) | + (uint16(a[aa + 3]) << 2) | + (uint16(a[aa + 4]) << 10) + t[3] = (uint16(a[aa + 4]) >> 1) | (uint16(a[aa + 5]) << 7) + t[4] = (uint16(a[aa + 5]) >> 4) | (uint16(a[aa + 6]) << 4) + t[5] = + (uint16(a[aa + 6]) >> 7) | + (uint16(a[aa + 7]) << 1) | + (uint16(a[aa + 8]) << 9) + t[6] = (uint16(a[aa + 8]) >> 2) | (uint16(a[aa + 9]) << 6) + t[7] = (uint16(a[aa + 9]) >> 5) | (uint16(a[aa + 10]) << 3) + aa = aa + 11 + for (let k = 0; k < 8; k++) { + r[i][8 * j + k] = (uint32(t[k] & 0x7ff) * Q + 1024) >> 11 + } + } + } + return r + } + + // decompressV de-serializes and subsequently decompresses a polynomial, + // representing the approximate inverse of compress2. + // Note that compression is lossy, and thus decompression will not match the + // original input. + + /** + * Decompresses a given polynomial, representing the approximate inverse of + * compress2, in Uint8Array into an array of numbers. + * + * Note that compression is lossy, and thus decompression will not match the + * original input. + * + * @param a - The Uint8Array to decompress. + * @returns An array of numbers obtained from the decompression process. + */ + protected override _decompressV(a: Uint8Array): Array<number> { + const r = new Array<number>(384) + const t = new Array<number>(8) + for (let aa = 0, i = 0; i < N / 8; i++) { + t[0] = a[aa + 0] >> 0 + t[1] = (a[aa + 0] >> 5) | (a[aa + 1] << 3) + t[2] = a[aa + 1] >> 2 + t[3] = (a[aa + 1] >> 7) | (a[aa + 2] << 1) + t[4] = (a[aa + 2] >> 4) | (a[aa + 3] << 4) + t[5] = a[aa + 3] >> 1 + t[6] = (a[aa + 3] >> 6) | (a[aa + 4] << 2) + t[7] = a[aa + 4] >> 3 + aa = aa + 5 + for (let j = 0; j < 8; j++) { + r[8 * i + j] = int16((uint32(t[j] & 31) * uint32(Q) + 16) >> 5) + } + } + return r + } +} + |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 | 1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x +2x +2x +2x +2x +2x + + + + +2x +2x +2x +2x +2x +2x +2x + + + + + + + + + +2x +4x +4x +4x +4x +4x +4x +8x +8x +8x +4x +4x +2x + + + + + + + + +8x +8x +8x +8x +8x +512x +512x +512x +512x +512x +2048x +2048x +2048x +2048x +512x +8x +8x + | /**
+ * This implementation is based on https://github.com/antontutoveanu/crystals-kyber-javascript,
+ * which was deveploped under the MIT licence below:
+ * https://github.com/antontutoveanu/crystals-kyber-javascript/blob/main/LICENSE
+ */
+import { N } from './consts.ts'
+import { MlKemBase } from './mlKemBase.ts'
+import { byteopsLoad24, int16, prf } from './utils.ts'
+
+/**
+ * Represents the MlKem512 class.
+ *
+ * This class extends the MlKemBase class and provides specific implementation for MlKem512.
+ *
+ * @remarks
+ *
+ * MlKem512 is a specific implementation of the ML-KEM key encapsulation mechanism.
+ *
+ * @example
+ *
+ * ```ts
+ * // Using jsr:
+ * import { MlKem512 } from "@dajiaji/mlkem";
+ * // Using npm:
+ * // import { MlKem512 } from "mlkem"; // or "crystals-kyber-js"
+ *
+ * const recipient = new MlKem512();
+ * const [pkR, skR] = await recipient.generateKeyPair();
+ *
+ * const sender = new MlKem512();
+ * const [ct, ssS] = await sender.encap(pkR);
+ *
+ * const ssR = await recipient.decap(ct, skR);
+ * // ssS === ssR
+ * ```
+ */
+export class MlKem512 extends MlKemBase {
+ override _k = 2
+ override _du = 10
+ override _dv = 4
+ override _eta1 = 3
+ override _eta2 = 2
+
+ /**
+ * Constructs a new instance of the MlKem512 class.
+ */
+ constructor() {
+ super()
+ this._skSize = (12 * this._k * N) / 8
+ this._pkSize = this._skSize + 32
+ this._compressedUSize = (this._k * this._du * N) / 8
+ this._compressedVSize = (this._dv * N) / 8
+ }
+
+ /**
+ * Samples a vector of polynomials from a seed.
+ * @internal
+ * @param sigma - The seed.
+ * @param offset - The offset.
+ * @param size - The size.
+ * @returns The sampled vector of polynomials.
+ */
+ protected override _sampleNoise1(
+ sigma: Uint8Array,
+ offset: number,
+ size: number
+ ): Array<Array<number>> {
+ const r = new Array<Array<number>>(size)
+ for (let i = 0; i < size; i++) {
+ r[i] = byteopsCbd(prf((this._eta1 * N) / 4, sigma, offset), this._eta1)
+ offset++
+ }
+ return r
+ }
+}
+
+/**
+ * Performs the byte operations for the Cbd function.
+ *
+ * @param buf - The input buffer.
+ * @param eta - The value of eta.
+ * @returns An array of numbers representing the result of the byte operations.
+ */
+function byteopsCbd(buf: Uint8Array, eta: number): Array<number> {
+ let t, d
+ let a, b
+ const r = new Array<number>(384).fill(0)
+ for (let i = 0; i < N / 4; i++) {
+ t = byteopsLoad24(buf.subarray(3 * i, buf.length))
+ d = t & 0x00249249
+ d = d + ((t >> 1) & 0x00249249)
+ d = d + ((t >> 2) & 0x00249249)
+ for (let j = 0; j < 4; j++) {
+ a = int16((d >> (6 * j + 0)) & 0x7)
+ b = int16((d >> (6 * j + eta)) & 0x7)
+ r[4 * i + j] = a - b
+ }
+ }
+ return r
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 | + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + | /** + * This implementation is based on https://github.com/antontutoveanu/crystals-kyber-javascript, + * which was deveploped under the MIT licence below: + * https://github.com/antontutoveanu/crystals-kyber-javascript/blob/main/LICENSE + */ +import { N } from './consts.ts' +import { MlKemBase } from './mlKemBase.ts' + +/** + * Represents the MlKem768 class, which extends the MlKemBase class. + * + * This class extends the MlKemBase class and provides specific implementation for MlKem768. + * + * @remarks + * + * MlKem768 is a specific implementation of the ML-KEM key encapsulation mechanism. + * + * @example + * + * ```ts + * // Using jsr: + * import { MlKem768 } from "@dajiaji/mlkem"; + * // Using npm: + * // import { MlKem768 } from "mlkem"; // or "crystals-kyber-js" + * + * const recipient = new MlKem768(); + * const [pkR, skR] = await recipient.generateKeyPair(); + * + * const sender = new MlKem768(); + * const [ct, ssS] = await sender.encap(pkR); + * + * const ssR = await recipient.decap(ct, skR); + * // ssS === ssR + * ``` + */ +export class MlKem768 extends MlKemBase { + override _k = 3 + override _du = 10 + override _dv = 4 + override _eta1 = 2 + override _eta2 = 2 + + constructor() { + super() + this._skSize = (12 * this._k * N) / 8 + this._pkSize = this._skSize + 32 + this._compressedUSize = (this._k * this._du * N) / 8 + this._compressedVSize = (this._dv * N) / 8 + } +} + |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 +171 +172 +173 +174 +175 +176 +177 +178 +179 +180 +181 +182 +183 +184 +185 +186 +187 +188 +189 +190 +191 +192 +193 +194 +195 +196 +197 +198 +199 +200 +201 +202 +203 +204 +205 +206 +207 +208 +209 +210 +211 +212 +213 +214 +215 +216 +217 +218 +219 +220 +221 +222 +223 +224 +225 +226 +227 +228 +229 +230 +231 +232 +233 +234 +235 +236 +237 +238 +239 +240 +241 +242 +243 +244 +245 +246 +247 +248 +249 +250 +251 +252 +253 +254 +255 +256 +257 +258 +259 +260 +261 +262 +263 +264 +265 +266 +267 +268 +269 +270 +271 +272 +273 +274 +275 +276 +277 +278 +279 +280 +281 +282 +283 +284 +285 +286 +287 +288 +289 +290 +291 +292 +293 +294 +295 +296 +297 +298 +299 +300 +301 +302 +303 +304 +305 +306 +307 +308 +309 +310 +311 +312 +313 +314 +315 +316 +317 +318 +319 +320 +321 +322 +323 +324 +325 +326 +327 +328 +329 +330 +331 +332 +333 +334 +335 +336 +337 +338 +339 +340 +341 +342 +343 +344 +345 +346 +347 +348 +349 +350 +351 +352 +353 +354 +355 +356 +357 +358 +359 +360 +361 +362 +363 +364 +365 +366 +367 +368 +369 +370 +371 +372 +373 +374 +375 +376 +377 +378 +379 +380 +381 +382 +383 +384 +385 +386 +387 +388 +389 +390 +391 +392 +393 +394 +395 +396 +397 +398 +399 +400 +401 +402 +403 +404 +405 +406 +407 +408 +409 +410 +411 +412 +413 +414 +415 +416 +417 +418 +419 +420 +421 +422 +423 +424 +425 +426 +427 +428 +429 +430 +431 +432 +433 +434 +435 +436 +437 +438 +439 +440 +441 +442 +443 +444 +445 +446 +447 +448 +449 +450 +451 +452 +453 +454 +455 +456 +457 +458 +459 +460 +461 +462 +463 +464 +465 +466 +467 +468 +469 +470 +471 +472 +473 +474 +475 +476 +477 +478 +479 +480 +481 +482 +483 +484 +485 +486 +487 +488 +489 +490 +491 +492 +493 +494 +495 +496 +497 +498 +499 +500 +501 +502 +503 +504 +505 +506 +507 +508 +509 +510 +511 +512 +513 +514 +515 +516 +517 +518 +519 +520 +521 +522 +523 +524 +525 +526 +527 +528 +529 +530 +531 +532 +533 +534 +535 +536 +537 +538 +539 +540 +541 +542 +543 +544 +545 +546 +547 +548 +549 +550 +551 +552 +553 +554 +555 +556 +557 +558 +559 +560 +561 +562 +563 +564 +565 +566 +567 +568 +569 +570 +571 +572 +573 +574 +575 +576 +577 +578 +579 +580 +581 +582 +583 +584 +585 +586 +587 +588 +589 +590 +591 +592 +593 +594 +595 +596 +597 +598 +599 +600 +601 +602 +603 +604 +605 +606 +607 +608 +609 +610 +611 +612 +613 +614 +615 +616 +617 +618 +619 +620 +621 +622 +623 +624 +625 +626 +627 +628 +629 +630 +631 +632 +633 +634 +635 +636 +637 +638 +639 +640 +641 +642 +643 +644 +645 +646 +647 +648 +649 +650 +651 +652 +653 +654 +655 +656 +657 +658 +659 +660 +661 +662 +663 +664 +665 +666 +667 +668 +669 +670 +671 +672 +673 +674 +675 +676 +677 +678 +679 +680 +681 +682 +683 +684 +685 +686 +687 +688 +689 +690 +691 +692 +693 +694 +695 +696 +697 +698 +699 +700 +701 +702 +703 +704 +705 +706 +707 +708 +709 +710 +711 +712 +713 +714 +715 +716 +717 +718 +719 +720 +721 +722 +723 +724 +725 +726 +727 +728 +729 +730 +731 +732 +733 +734 +735 +736 +737 +738 +739 +740 +741 +742 +743 +744 +745 +746 +747 +748 +749 +750 +751 +752 +753 +754 +755 +756 +757 +758 +759 +760 +761 +762 +763 +764 +765 +766 +767 +768 +769 +770 +771 +772 +773 +774 +775 +776 +777 +778 +779 +780 +781 +782 +783 +784 +785 +786 +787 +788 +789 +790 +791 +792 +793 +794 +795 +796 +797 +798 +799 +800 +801 +802 +803 +804 +805 +806 +807 +808 +809 +810 +811 +812 +813 +814 +815 +816 +817 +818 +819 +820 +821 +822 +823 +824 +825 +826 +827 +828 +829 +830 +831 +832 +833 +834 +835 +836 +837 +838 +839 +840 +841 +842 +843 +844 +845 +846 +847 +848 +849 +850 +851 +852 +853 +854 +855 +856 +857 +858 +859 +860 +861 +862 +863 +864 +865 +866 +867 +868 +869 +870 +871 +872 +873 +874 +875 +876 +877 +878 +879 +880 +881 +882 +883 +884 +885 +886 +887 +888 +889 +890 +891 +892 +893 +894 +895 +896 +897 +898 +899 +900 +901 +902 +903 +904 +905 +906 +907 +908 +909 +910 +911 +912 +913 +914 +915 +916 +917 +918 +919 +920 +921 +922 +923 +924 +925 +926 +927 +928 +929 +930 +931 +932 +933 +934 +935 +936 +937 +938 +939 +940 +941 +942 +943 +944 +945 +946 +947 +948 +949 +950 +951 +952 +953 +954 +955 +956 +957 +958 +959 +960 +961 +962 +963 +964 +965 +966 +967 +968 +969 +970 +971 +972 +973 +974 +975 +976 +977 +978 +979 +980 +981 +982 +983 +984 +985 +986 +987 +988 +989 +990 +991 +992 +993 +994 +995 +996 +997 +998 +999 +1000 +1001 +1002 +1003 +1004 +1005 +1006 +1007 +1008 +1009 +1010 +1011 +1012 +1013 +1014 +1015 +1016 +1017 +1018 +1019 +1020 +1021 +1022 +1023 +1024 +1025 +1026 +1027 +1028 +1029 +1030 +1031 +1032 +1033 +1034 +1035 +1036 +1037 +1038 +1039 +1040 +1041 +1042 +1043 +1044 +1045 +1046 +1047 +1048 +1049 +1050 +1051 +1052 +1053 +1054 +1055 +1056 +1057 +1058 +1059 +1060 +1061 +1062 +1063 +1064 +1065 +1066 +1067 +1068 +1069 +1070 +1071 +1072 +1073 +1074 +1075 +1076 +1077 +1078 +1079 +1080 +1081 +1082 +1083 +1084 +1085 +1086 +1087 +1088 +1089 +1090 +1091 +1092 +1093 +1094 +1095 +1096 +1097 +1098 +1099 +1100 +1101 +1102 +1103 +1104 +1105 +1106 +1107 +1108 +1109 +1110 +1111 +1112 +1113 +1114 +1115 +1116 +1117 +1118 +1119 +1120 +1121 +1122 +1123 +1124 +1125 +1126 +1127 +1128 +1129 +1130 +1131 +1132 +1133 +1134 +1135 +1136 +1137 +1138 +1139 +1140 +1141 +1142 +1143 +1144 +1145 +1146 +1147 +1148 +1149 +1150 +1151 +1152 +1153 +1154 +1155 +1156 +1157 +1158 +1159 +1160 +1161 | 1x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +1x +2x +2x +2x +2x +2x +2x +2x +2x +2x +2x + + + + +2x + + + + + + + + + + + + + + + + + + + + + +2x +1x + +1x +1x +1x +1x +1x + + +1x + + + + + + + + + + + + + + + + + + + + + + + + +2x + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +2x +1x +1x +1x +1x + +1x + +1x + + +1x +1x +1x +1x +1x + + +1x + + + + + + + + + + + + + + + + + + + + + + + + + + +2x +1x + +1x + +1x + + + +1x + + +1x +1x +1x +1x +1x +1x +1x +1x +1x +1x + +1x +1x +1x +1x +1x +1x + + +1x + + + + + + +2x +3x +1x +1x +2x +3x + + + + + + + + + + +2x +1x +1x +1x +1x +1x + + + + +1x + + + + + + + +2x +1x +1x + +1x + +1x +1x +1x +1x +1x +1x +1x +1x + + + + + + + + + + +2x +1x +1x +1x +1x + + +1x +2x +2x +2x +2x + + + +1x +1x +2x +2x +2x +2x + + + +1x +1x +2x +2x + +1x + + + +1x +1x +2x +2x +1x +1x + + + + + + + + + + + + +2x +2x +2x +2x +2x +2x +2x +2x +4x +4x +4x +2x + + +2x +2x +2x +2x +2x + + +2x +4x +4x +4x + + +2x +2x +4x +4x +4x +4x +4x + + +2x +2x +2x +2x +2x +2x + + +2x +2x +2x +2x +2x + + + + + + + + + + + +2x + +1x +1x + +1x + +1x +2x +2x + +1x +1x +1x +1x +1x +1x + + + + + + + + + + + + +2x +3x +3x +3x +3x +3x + +3x +6x + +6x + +12x +8x +8x +12x +4x +4x +4x +12x + + +12x +12x +12x + +12x + + + + + + + + + + + +12x +6x +3x +3x + + + + + + + + + +2x + + + + + + + + + + + + + + + + + + + + +2x +4x +4x +4x +4x +4x +4x +6x +6x +6x +4x +4x + + + + + + + + + +2x +1x +1x +2x +2x +1x +1x + + + + + + + + + + +2x +2x +2x +4x +256x + +1024x +1024x + + +256x +256x +256x +256x +256x +256x +4x +2x +2x + + + + + + + + + + +2x + +2x +2x +64x +512x +512x +64x +64x +64x +64x +64x +2x +2x + + + + + + + + + + + +2x +1x +1x +2x +2x +1x +1x +2x +128x +128x +128x +128x +128x +128x +512x +512x +512x +512x +128x +2x +1x +1x + + + + + + + + + + + + +2x +1x +1x +128x +128x +128x +1x +1x +2x + + + + + + + + +3x +3x +3x +3x +3x +3x +3x +3x + + + + + + + +2x +2x +2x + + + + + + + + + +1x +1x +1x +1x +1x +1x +1x + + + + + + + + +12x +12x +12x + + + + + + + + + + +8x +8x +8x +8x +8x + +8x + +1024x +1024x + + +1024x +1024x +1024x +1024x +8x +8x + + + + + + + + + + + + +6x +6x +6x +768x +768x +768x +768x +768x +768x +768x +6x +6x + + + + + + + + + +1x +1x +1x +1x +1x +32x +32x +256x +256x +256x +32x +1x +1x + + + + + + + + + + +2x +2x +2x +2x +64x +512x +512x +512x +64x +2x +2x + + + + + + + + + + + + +12x +12x +12x +12x +12x +12x +12x +12x + +12x + +1881x +1881x + + +1881x + + +1881x + +1509x + +1509x +1509x +1881x +1563x +1563x +1563x +1881x +12x +12x + + + + + + + + + + + +6x +6x +6x +6x +6x +192x +192x +192x +192x +1536x +1536x +1536x +1536x +192x +6x +6x + + + + + + + + + + +10x + +10x + +70x +1270x +1270x + +1270x + +8960x + +8960x + +8960x +8960x +1270x +70x +10x +10x + + + + + + + + + + +28544x +28544x +28544x + + + + + + + + + +24x +24x +6144x +6144x +24x +24x + + + + + + + + + + + +12416x +12416x +12416x +12416x +12416x +12416x + + + + + + + + + +29056x +29056x +29056x +29056x +29056x +29056x +29056x + + + + + + + + + + +2x + +2x +2x +512x +512x +2x +2x + + + + + + + + + + +9x +9x +9x +9x +9x +9x +9x +9x +9x +9x +9x +9x + + + + + + + + + + +18x +18x +18x +18x +18x +18x +1152x +1152x +1152x +1152x +1152x +1152x +1152x +1152x +1152x +1152x +1152x +1152x +1152x +1152x +1152x +1152x +1152x +1152x +1152x +18x +18x + + + + + + + + + + + + + + + +2304x +2304x +2304x +2304x +2304x +2304x +2304x +2304x +2304x +2304x +2304x +2304x +2304x +2304x +2304x + + + + + + + + + +19x +19x +19x +4864x +4864x +19x +19x + + + + + + + + + + +1x +1x +256x +256x +1x +1x + + + + + + + + + + + +7x +7x +7x +49x +889x +889x +889x +6272x +6272x +6272x +6272x +6272x +889x +49x +7x +1792x +1792x +7x +7x + + + + + + + + + + + + + +9x +9x +2304x + + + +2304x +2304x +9x +9x + | /**
+ * This implementation is based on https://github.com/antontutoveanu/crystals-kyber-javascript,
+ * which was deveploped under the MIT licence below:
+ * https://github.com/antontutoveanu/crystals-kyber-javascript/blob/main/LICENSE
+ */
+import { webcrypto } from 'node:crypto'
+
+
+import { sha3_256, sha3_512, shake128, shake256 } from './deps.ts'
+
+import { N, NTT_ZETAS, NTT_ZETAS_INV, Q, Q_INV } from './consts.ts'
+import { MlKemError } from './errors.ts'
+import {
+ byte,
+ byteopsLoad32,
+ constantTimeCompare,
+ equalUint8Array,
+ int16,
+ int32,
+ loadCrypto,
+ prf,
+ uint16,
+ uint32,
+} from './utils.ts'
+
+/**
+ * Represents the base class for the ML-KEM key encapsulation mechanism.
+ *
+ * This class provides the base implementation for the ML-KEM key encapsulation mechanism.
+ *
+ * @remarks
+ *
+ * This class is not intended to be used directly. Instead, use one of the subclasses:
+ *
+ * @example
+ *
+ * ```ts
+ * // Using jsr:
+ * import { MlKemBase } from "@dajiaji/mlkem";
+ * // Using npm:
+ * // import { MlKemBase } from "mlkem"; // or "crystals-kyber-js"
+ *
+ * class MlKem768 extends MlKemBase {
+ * protected _k = 3;
+ * protected _du = 10;
+ * protected _dv = 4;
+ * protected _eta1 = 2;
+ * protected _eta2 = 2;
+ *
+ * constructor() {
+ * super();
+ * this._skSize = 12 * this._k * N / 8;
+ * this._pkSize = this._skSize + 32;
+ * this._compressedUSize = this._k * this._du * N / 8;
+ * this._compressedVSize = this._dv * N / 8;
+ * }
+ * }
+ *
+ * const kyber = new MlKem768();
+ * ```
+ */
+export class MlKemBase {
+ private _api: webcrypto.Crypto | undefined = undefined
+ protected _k = 0
+ protected _du = 0
+ protected _dv = 0
+ protected _eta1 = 0
+ protected _eta2 = 0
+ protected _skSize = 0
+ protected _pkSize = 0
+ protected _compressedUSize = 0
+ protected _compressedVSize = 0
+
+ /**
+ * Creates a new instance of the MlKemBase class.
+ */
+ constructor() {}
+
+ /**
+ * Generates a keypair [publicKey, privateKey].
+ *
+ * If an error occurred, throws {@link MlKemError}.
+ *
+ * @returns A kaypair [publicKey, privateKey].
+ * @throws {@link MlKemError}
+ *
+ * @example Generates a {@link MlKem768} keypair.
+ *
+ * ```ts
+ * // Using jsr:
+ * import { MlKem768 } from "@dajiaji/mlkem";
+ * // Using npm:
+ * // import { MlKem768 } from "mlkem"; // or "crystals-kyber-js"
+ *
+ * const kyber = new MlKem768();
+ * const [pk, sk] = await kyber.generateKeyPair();
+ * ```
+ */
+ public async generateKeyPair(): Promise<[Uint8Array, Uint8Array]> {
+ await this._setup()
+
+ try {
+ const rnd = new Uint8Array(64)
+ ;(this._api as webcrypto.Crypto).getRandomValues(rnd)
+ return this._deriveKeyPair(rnd)
+ } catch (e: unknown) {
+ throw new MlKemError(e)
+ }
+ }
+
+ /**
+ * Derives a keypair [publicKey, privateKey] deterministically from a 64-octet seed.
+ *
+ * If an error occurred, throws {@link MlKemError}.
+ *
+ * @param seed A 64-octet seed for the deterministic key generation.
+ * @returns A kaypair [publicKey, privateKey].
+ * @throws {@link MlKemError}
+ *
+ * @example Derives a {@link MlKem768} keypair deterministically.
+ *
+ * ```ts
+ * // Using jsr:
+ * import { MlKem768 } from "@dajiaji/mlkem";
+ * // Using npm:
+ * // import { MlKem768 } from "mlkem"; // or "crystals-kyber-js"
+ *
+ * const kyber = new MlKem768();
+ * const seed = new Uint8Array(64);
+ * globalThis.crypto.getRandomValues(seed);
+ * const [pk, sk] = await kyber.deriveKeyPair(seed);
+ * ```
+ */
+ public async deriveKeyPair(
+ seed: Uint8Array
+ ): Promise<[Uint8Array, Uint8Array]> {
+ await this._setup()
+
+ try {
+ if (seed.byteLength !== 64) {
+ throw new Error('seed must be 64 bytes in length')
+ }
+ return this._deriveKeyPair(seed)
+ } catch (e: unknown) {
+ throw new MlKemError(e)
+ }
+ }
+
+ /**
+ * Generates a shared secret from the encapsulated ciphertext and the private key.
+ *
+ * If an error occurred, throws {@link MlKemError}.
+ *
+ * @param pk A public key.
+ * @param seed An optional 32-octet seed for the deterministic shared secret generation.
+ * @returns A ciphertext (encapsulated public key) and a shared secret.
+ * @throws {@link MlKemError}
+ *
+ * @example The {@link MlKem768} encapsulation.
+ *
+ * ```ts
+ * // Using jsr:
+ * import { MlKem768 } from "@dajiaji/mlkem";
+ * // Using npm:
+ * // import { MlKem768 } from "mlkem"; // or "crystals-kyber-js"
+ *
+ * const kyber = new MlKem768();
+ * const [pk, sk] = await kyber.generateKeyPair();
+ * const [ct, ss] = await kyber.encap(pk);
+ * ```
+ */
+ public async encap(
+ pk: Uint8Array,
+ seed?: Uint8Array
+ ): Promise<[Uint8Array, Uint8Array]> {
+ await this._setup()
+
+ try {
+ // validate key type; the modulo is checked in `_encap`.
+ if (pk.length !== 384 * this._k + 32) {
+ throw new Error('invalid encapsulation key')
+ }
+ const m = this._getSeed(seed)
+ const [k, r] = g(m, h(pk))
+ const ct = this._encap(pk, m, r)
+ return [ct, k]
+ } catch (e: unknown) {
+ throw new MlKemError(e)
+ }
+ }
+
+ /**
+ * Generates a ciphertext for the public key and a shared secret.
+ *
+ * If an error occurred, throws {@link MlKemError}.
+ *
+ * @param ct A ciphertext generated by {@link encap}.
+ * @param sk A private key.
+ * @returns A shared secret.
+ * @throws {@link MlKemError}
+ *
+ * @example The {@link MlKem768} decapsulation.
+ *
+ * ```ts
+ * // Using jsr:
+ * import { MlKem768 } from "@dajiaji/mlkem";
+ * // Using npm:
+ * // import { MlKem768 } from "mlkem"; // or "crystals-kyber-js"
+ *
+ * const kyber = new MlKem768();
+ * const [pk, sk] = await kyber.generateKeyPair();
+ * const [ct, ssS] = await kyber.encap(pk);
+ * const ssR = await kyber.decap(ct, sk);
+ * // ssS === ssR
+ * ```
+ */
+ public async decap(ct: Uint8Array, sk: Uint8Array): Promise<Uint8Array> {
+ await this._setup()
+
+ try {
+ // ciphertext type check
+ if (ct.byteLength !== this._compressedUSize + this._compressedVSize) {
+ throw new Error('Invalid ct size')
+ }
+ // decapsulation key type check
+ if (sk.length !== 768 * this._k + 96) {
+ throw new Error('Invalid decapsulation key')
+ }
+ const sk2 = sk.subarray(0, this._skSize)
+ const pk = sk.subarray(this._skSize, this._skSize + this._pkSize)
+ const hpk = sk.subarray(
+ this._skSize + this._pkSize,
+ this._skSize + this._pkSize + 32
+ )
+ const z = sk.subarray(
+ this._skSize + this._pkSize + 32,
+ this._skSize + this._pkSize + 64
+ )
+
+ const m2 = this._decap(ct, sk2)
+ const [k2, r2] = g(m2, hpk)
+ const kBar = kdf(z, ct)
+ const ct2 = this._encap(pk, m2, r2)
+ return constantTimeCompare(ct, ct2) === 1 ? k2 : kBar
+ } catch (e: unknown) {
+ throw new MlKemError(e)
+ }
+ }
+
+ /**
+ * Sets up the MlKemBase instance by loading the necessary crypto library.
+ * If the crypto library is already loaded, this method does nothing.
+ * @returns {Promise<void>} A promise that resolves when the setup is complete.
+ */
+ private async _setup() {
+ if (this._api !== undefined) {
+ return
+ }
+ this._api = await loadCrypto()
+ }
+
+ /**
+ * Returns a Uint8Array seed for cryptographic operations.
+ * If no seed is provided, a random seed of length 32 bytes is generated.
+ * If a seed is provided, it must be exactly 32 bytes in length.
+ *
+ * @param seed - Optional seed for cryptographic operations.
+ * @returns A Uint8Array seed.
+ * @throws Error if the provided seed is not 32 bytes in length.
+ */
+ private _getSeed(seed?: Uint8Array): Uint8Array {
+ if (seed == undefined) {
+ const s = new Uint8Array(32)
+ ;(this._api as webcrypto.Crypto).getRandomValues(s)
+ return s
+ }
+ if (seed.byteLength !== 32) {
+ throw new Error('seed must be 32 bytes in length')
+ }
+ return seed
+ }
+
+ /**
+ * Derives a key pair from a given seed.
+ *
+ * @param seed - The seed used for key derivation.
+ * @returns An array containing the public key and secret key.
+ */
+ private _deriveKeyPair(seed: Uint8Array): [Uint8Array, Uint8Array] {
+ const cpaSeed = seed.subarray(0, 32)
+ const z = seed.subarray(32, 64)
+
+ const [pk, skBody] = this._deriveCpaKeyPair(cpaSeed)
+
+ const pkh = h(pk)
+ const sk = new Uint8Array(this._skSize + this._pkSize + 64)
+ sk.set(skBody, 0)
+ sk.set(pk, this._skSize)
+ sk.set(pkh, this._skSize + this._pkSize)
+ sk.set(z, this._skSize + this._pkSize + 32)
+ return [pk, sk]
+ }
+
+ // indcpaKeyGen generates public and private keys for the CPA-secure
+ // public-key encryption scheme underlying ML-KEM.
+
+ /**
+ * Derives a CPA key pair using the provided CPA seed.
+ *
+ * @param cpaSeed - The CPA seed used for key derivation.
+ * @returns An array containing the public key and private key.
+ */
+ private _deriveCpaKeyPair(cpaSeed: Uint8Array): [Uint8Array, Uint8Array] {
+ const [publicSeed, noiseSeed] = g(cpaSeed, new Uint8Array([this._k]))
+ const a = this._sampleMatrix(publicSeed, false)
+ const s = this._sampleNoise1(noiseSeed, 0, this._k)
+ const e = this._sampleNoise1(noiseSeed, this._k, this._k)
+
+ // perform number theoretic transform on secret s
+ for (let i = 0; i < this._k; i++) {
+ s[i] = ntt(s[i])
+ s[i] = reduce(s[i])
+ e[i] = ntt(e[i])
+ }
+
+ // KEY COMPUTATION
+ // pk = A*s + e
+ const pk = new Array<Array<number>>(this._k)
+ for (let i = 0; i < this._k; i++) {
+ pk[i] = polyToMont(multiply(a[i], s))
+ pk[i] = add(pk[i], e[i])
+ pk[i] = reduce(pk[i])
+ }
+
+ // PUBLIC KEY
+ // turn polynomials into byte arrays
+ const pubKey = new Uint8Array(this._pkSize)
+ for (let i = 0; i < this._k; i++) {
+ pubKey.set(polyToBytes(pk[i]), i * 384)
+ }
+ // append public seed
+ pubKey.set(publicSeed, this._skSize)
+
+ // PRIVATE KEY
+ // turn polynomials into byte arrays
+ const privKey = new Uint8Array(this._skSize)
+ for (let i = 0; i < this._k; i++) {
+ privKey.set(polyToBytes(s[i]), i * 384)
+ }
+ return [pubKey, privKey]
+ }
+
+ // _encap is the encapsulation function of the CPA-secure
+ // public-key encryption scheme underlying ML-KEM.
+
+ /**
+ * Encapsulates a message using the ML-KEM encryption scheme.
+ *
+ * @param pk - The public key.
+ * @param msg - The message to be encapsulated.
+ * @param seed - The seed used for generating random values.
+ * @returns The encapsulated message as a Uint8Array.
+ */
+ private _encap(
+ pk: Uint8Array,
+ msg: Uint8Array,
+ seed: Uint8Array
+ ): Uint8Array {
+ const tHat = new Array<Array<number>>(this._k)
+ const pkCheck = new Uint8Array(384 * this._k) // to validate the pk modulo (see input validation at NIST draft 6.2)
+ for (let i = 0; i < this._k; i++) {
+ tHat[i] = polyFromBytes(pk.subarray(i * 384, (i + 1) * 384))
+ pkCheck.set(polyToBytes(tHat[i]), i * 384)
+ }
+ if (!equalUint8Array(pk.subarray(0, pkCheck.length), pkCheck)) {
+ throw new Error('invalid encapsulation key')
+ }
+ const rho = pk.subarray(this._skSize)
+ const a = this._sampleMatrix(rho, true)
+ const r = this._sampleNoise1(seed, 0, this._k)
+ const e1 = this._sampleNoise2(seed, this._k, this._k)
+ const e2 = this._sampleNoise2(seed, this._k * 2, 1)[0]
+
+ // perform number theoretic transform on random vector r
+ for (let i = 0; i < this._k; i++) {
+ r[i] = ntt(r[i])
+ r[i] = reduce(r[i])
+ }
+
+ // u = A*r + e1
+ const u = new Array<Array<number>>(this._k)
+ for (let i = 0; i < this._k; i++) {
+ u[i] = multiply(a[i], r)
+ u[i] = nttInverse(u[i])
+ u[i] = add(u[i], e1[i])
+ u[i] = reduce(u[i])
+ }
+
+ // v = tHat*r + e2 + m
+ const m = polyFromMsg(msg)
+ let v = multiply(tHat, r)
+ v = nttInverse(v)
+ v = add(v, e2)
+ v = add(v, m)
+ v = reduce(v)
+
+ // compress
+ const ret = new Uint8Array(this._compressedUSize + this._compressedVSize)
+ this._compressU(ret.subarray(0, this._compressedUSize), u)
+ this._compressV(ret.subarray(this._compressedUSize), v)
+ return ret
+ }
+
+ // indcpaDecrypt is the decryption function of the CPA-secure
+ // public-key encryption scheme underlying ML-KEM.
+
+ /**
+ * Decapsulates the ciphertext using the provided secret key.
+ *
+ * @param ct - The ciphertext to be decapsulated.
+ * @param sk - The secret key used for decapsulation.
+ * @returns The decapsulated message as a Uint8Array.
+ */
+ private _decap(ct: Uint8Array, sk: Uint8Array): Uint8Array {
+ // extract ciphertext
+ const u = this._decompressU(ct.subarray(0, this._compressedUSize))
+ const v = this._decompressV(ct.subarray(this._compressedUSize))
+
+ const privateKeyPolyvec = this._polyvecFromBytes(sk)
+
+ for (let i = 0; i < this._k; i++) {
+ u[i] = ntt(u[i])
+ }
+
+ let mp = multiply(privateKeyPolyvec, u)
+ mp = nttInverse(mp)
+ mp = subtract(v, mp)
+ mp = reduce(mp)
+ return polyToMsg(mp)
+ }
+
+ // generateMatrixA deterministically generates a matrix `A` (or the transpose of `A`)
+ // from a seed. Entries of the matrix are polynomials that look uniformly random.
+ // Performs rejection sampling on the output of an extendable-output function (XOF).
+
+ /**
+ * Generates a sample matrix based on the provided seed and transposition flag.
+ *
+ * @param seed - The seed used for generating the matrix.
+ * @param transposed - A flag indicating whether the matrix should be transposed or not.
+ * @returns The generated sample matrix.
+ */
+ private _sampleMatrix(
+ seed: Uint8Array,
+ transposed: boolean
+ ): Array<Array<Array<number>>> {
+ const a = new Array<Array<Array<number>>>(this._k)
+ const transpose = new Uint8Array(2)
+
+ for (let ctr = 0, i = 0; i < this._k; i++) {
+ a[i] = new Array<Array<number>>(this._k)
+
+ for (let j = 0; j < this._k; j++) {
+ // set if transposed matrix or not
+ if (transposed) {
+ transpose[0] = i
+ transpose[1] = j
+ } else {
+ transpose[0] = j
+ transpose[1] = i
+ }
+ const output = xof(seed, transpose)
+
+ // run rejection sampling on the output from above
+ const result = indcpaRejUniform(output.subarray(0, 504), 504, N)
+ a[i][j] = result[0] // the result here is an NTT-representation
+ ctr = result[1] // keeps track of index of output array from sampling function
+
+ while (ctr < N) {
+ // if the polynomial hasnt been filled yet with mod q entries
+ const outputn = output.subarray(504, 672) // take last 168 bytes of byte array from xof
+ const result1 = indcpaRejUniform(outputn, 168, N - ctr) // run sampling function again
+ const missing = result1[0] // here is additional mod q polynomial coefficients
+ const ctrn = result1[1] // how many coefficients were accepted and are in the output
+ // starting at last position of output array from first sampling function until 256 is reached
+ for (let k = ctr; k < N; k++) {
+ a[i][j][k] = missing[k - ctr] // fill rest of array with the additional coefficients until full
+ }
+ ctr = ctr + ctrn // update index
+ }
+ }
+ }
+ return a
+ }
+
+ /**
+ * Generates a 2D array of noise samples.
+ *
+ * @param sigma - The noise parameter.
+ * @param offset - The offset value.
+ * @param size - The size of the array.
+ * @returns The generated 2D array of noise samples.
+ */
+ protected _sampleNoise1(
+ sigma: Uint8Array,
+ offset: number,
+ size: number
+ ): Array<Array<number>> {
+ const r = new Array<Array<number>>(size)
+ for (let i = 0; i < size; i++) {
+ r[i] = byteopsCbd(prf((this._eta1 * N) / 4, sigma, offset), this._eta1)
+ offset++
+ }
+ return r
+ }
+
+ /**
+ * Generates a 2-dimensional array of noise samples.
+ *
+ * @param sigma - The noise parameter.
+ * @param offset - The offset value.
+ * @param size - The size of the array.
+ * @returns The generated 2-dimensional array of noise samples.
+ */
+ protected _sampleNoise2(
+ sigma: Uint8Array,
+ offset: number,
+ size: number
+ ): Array<Array<number>> {
+ const r = new Array<Array<number>>(size)
+ for (let i = 0; i < size; i++) {
+ r[i] = byteopsCbd(prf((this._eta2 * N) / 4, sigma, offset), this._eta2)
+ offset++
+ }
+ return r
+ }
+
+ // polyvecFromBytes deserializes a vector of polynomials.
+
+ /**
+ * Converts a Uint8Array to a 2D array of numbers representing a polynomial vector.
+ * Each element in the resulting array represents a polynomial.
+ * @param a The Uint8Array to convert.
+ * @returns The 2D array of numbers representing the polynomial vector.
+ */
+ private _polyvecFromBytes(a: Uint8Array): Array<Array<number>> {
+ const r = new Array<Array<number>>(this._k)
+ for (let i = 0; i < this._k; i++) {
+ r[i] = polyFromBytes(a.subarray(i * 384, (i + 1) * 384))
+ }
+ return r
+ }
+
+ // compressU lossily compresses and serializes a vector of polynomials.
+
+ /**
+ * Compresses the given array of coefficients into a Uint8Array.
+ *
+ * @param r - The output Uint8Array.
+ * @param u - The array of coefficients.
+ * @returns The compressed Uint8Array.
+ */
+ protected _compressU(r: Uint8Array, u: Array<Array<number>>): Uint8Array {
+ const t = new Array<number>(4)
+ for (let rr = 0, i = 0; i < this._k; i++) {
+ for (let j = 0; j < N / 4; j++) {
+ for (let k = 0; k < 4; k++) {
+ // parse {0,...,3328} to {0,...,1023}
+ t[k] = (((u[i][4 * j + k] << 10) + Q / 2) / Q) & 0b1111111111
+ }
+ // converts 4 12-bit coefficients {0,...,3328} to 5 8-bit bytes {0,...,255}
+ // 48 bits down to 40 bits per block
+ r[rr++] = byte(t[0] >> 0)
+ r[rr++] = byte((t[0] >> 8) | (t[1] << 2))
+ r[rr++] = byte((t[1] >> 6) | (t[2] << 4))
+ r[rr++] = byte((t[2] >> 4) | (t[3] << 6))
+ r[rr++] = byte(t[3] >> 2)
+ }
+ }
+ return r
+ }
+
+ // compressV lossily compresses and subsequently serializes a polynomial.
+
+ /**
+ * Compresses the given array of numbers into a Uint8Array.
+ *
+ * @param r - The Uint8Array to store the compressed values.
+ * @param v - The array of numbers to compress.
+ * @returns The compressed Uint8Array.
+ */
+ protected _compressV(r: Uint8Array, v: Array<number>): Uint8Array {
+ // const r = new Uint8Array(128);
+ const t = new Uint8Array(8)
+ for (let rr = 0, i = 0; i < N / 8; i++) {
+ for (let j = 0; j < 8; j++) {
+ t[j] = byte(((v[8 * i + j] << 4) + Q / 2) / Q) & 0b1111
+ }
+ r[rr++] = t[0] | (t[1] << 4)
+ r[rr++] = t[2] | (t[3] << 4)
+ r[rr++] = t[4] | (t[5] << 4)
+ r[rr++] = t[6] | (t[7] << 4)
+ }
+ return r
+ }
+
+ // decompressU de-serializes and decompresses a vector of polynomials and
+ // represents the approximate inverse of compress1. Since compression is lossy,
+ // the results of decompression will may not match the original vector of polynomials.
+
+ /**
+ * Decompresses a Uint8Array into a two-dimensional array of numbers.
+ *
+ * @param a The Uint8Array to decompress.
+ * @returns The decompressed two-dimensional array.
+ */
+ protected _decompressU(a: Uint8Array): Array<Array<number>> {
+ const r = new Array<Array<number>>(this._k)
+ for (let i = 0; i < this._k; i++) {
+ r[i] = new Array<number>(384)
+ }
+ const t = new Array<number>(4)
+ for (let aa = 0, i = 0; i < this._k; i++) {
+ for (let j = 0; j < N / 4; j++) {
+ t[0] = (uint16(a[aa + 0]) >> 0) | (uint16(a[aa + 1]) << 8)
+ t[1] = (uint16(a[aa + 1]) >> 2) | (uint16(a[aa + 2]) << 6)
+ t[2] = (uint16(a[aa + 2]) >> 4) | (uint16(a[aa + 3]) << 4)
+ t[3] = (uint16(a[aa + 3]) >> 6) | (uint16(a[aa + 4]) << 2)
+ aa = aa + 5
+ for (let k = 0; k < 4; k++) {
+ r[i][4 * j + k] = int16(
+ (uint32(t[k] & 0x3ff) * uint32(Q) + 512) >> 10
+ )
+ }
+ }
+ }
+ return r
+ }
+
+ // decompressV de-serializes and subsequently decompresses a polynomial,
+ // representing the approximate inverse of compress2.
+ // Note that compression is lossy, and thus decompression will not match the
+ // original input.
+
+ /**
+ * Decompresses a Uint8Array into an array of numbers.
+ *
+ * @param a - The Uint8Array to decompress.
+ * @returns An array of numbers.
+ */
+ protected _decompressV(a: Uint8Array): Array<number> {
+ const r = new Array<number>(384)
+ for (let aa = 0, i = 0; i < N / 2; i++, aa++) {
+ r[2 * i + 0] = int16((uint16(a[aa] & 15) * uint16(Q) + 8) >> 4)
+ r[2 * i + 1] = int16((uint16(a[aa] >> 4) * uint16(Q) + 8) >> 4)
+ }
+ return r
+ }
+}
+
+/**
+ * Computes the hash of the input array `a` and an optional input array `b`.
+ * Returns an array containing two Uint8Arrays, representing the first 32 bytes and the next 32 bytes of the hash digest.
+ * @param a - The input array to be hashed.
+ * @param b - An optional input array to be hashed along with `a`.
+ * @returns An array containing two Uint8Arrays representing the hash digest.
+ */
+function g(a: Uint8Array, b?: Uint8Array): [Uint8Array, Uint8Array] {
+ const hash = sha3_512.create().update(a)
+ if (b !== undefined) {
+ hash.update(b)
+ }
+ const res = hash.digest()
+ return [res.subarray(0, 32), res.subarray(32, 64)]
+}
+
+/**
+ * Computes the SHA3-256 hash of the given message.
+ *
+ * @param msg - The input message as a Uint8Array.
+ * @returns The computed hash as a Uint8Array.
+ */
+function h(msg: Uint8Array): Uint8Array {
+ return sha3_256.create().update(msg).digest()
+}
+
+/**
+ * Key Derivation Function (KDF) that takes an input array `a` and an optional input array `b`.
+ * It uses the SHAKE256 hash function to derive a 32-byte output.
+ *
+ * @param a - The input array.
+ * @param b - The optional input array.
+ * @returns The derived key as a Uint8Array.
+ */
+function kdf(a: Uint8Array, b?: Uint8Array): Uint8Array {
+ const hash = shake256.create({ dkLen: 32 }).update(a)
+ if (b !== undefined) {
+ hash.update(b)
+ }
+ return hash.digest()
+}
+
+/**
+ * Computes the extendable-output function (XOF) using the SHAKE128 algorithm.
+ *
+ * @param seed - The seed value for the XOF.
+ * @param transpose - The transpose value for the XOF.
+ * @returns The computed XOF value as a Uint8Array.
+ */
+function xof(seed: Uint8Array, transpose: Uint8Array): Uint8Array {
+ return shake128.create({ dkLen: 672 }).update(seed).update(transpose).digest()
+}
+
+// polyToBytes serializes a polynomial into an array of bytes.
+
+/**
+ * Converts a polynomial represented by an array of numbers to a Uint8Array.
+ * Each coefficient of the polynomial is reduced modulo q.
+ *
+ * @param a - The array representing the polynomial.
+ * @returns The Uint8Array representation of the polynomial.
+ */
+function polyToBytes(a: Array<number>): Uint8Array {
+ let t0 = 0
+ let t1 = 0
+ const r = new Uint8Array(384)
+ const a2 = subtractQ(a) // Returns: a - q if a >= q, else a (each coefficient of the polynomial)
+ // for 0-127
+ for (let i = 0; i < N / 2; i++) {
+ // get two coefficient entries in the polynomial
+ t0 = uint16(a2[2 * i])
+ t1 = uint16(a2[2 * i + 1])
+
+ // convert the 2 coefficient into 3 bytes
+ r[3 * i + 0] = byte(t0 >> 0) // byte() does mod 256 of the input (output value 0-255)
+ r[3 * i + 1] = byte(t0 >> 8) | byte(t1 << 4)
+ r[3 * i + 2] = byte(t1 >> 4)
+ }
+ return r
+}
+
+// polyFromBytes de-serialises an array of bytes into a polynomial,
+// and represents the inverse of polyToBytes.
+
+/**
+ * Converts a Uint8Array to an array of numbers representing a polynomial.
+ * Each element in the array represents a coefficient of the polynomial.
+ * The input array `a` should have a length of 384.
+ * The function performs bitwise operations to extract the coefficients from the input array.
+ * @param a The Uint8Array to convert to a polynomial.
+ * @returns An array of numbers representing the polynomial.
+ */
+function polyFromBytes(a: Uint8Array): Array<number> {
+ const r = new Array<number>(384).fill(0)
+ for (let i = 0; i < N / 2; i++) {
+ r[2 * i] = int16(
+ ((uint16(a[3 * i + 0]) >> 0) | (uint16(a[3 * i + 1]) << 8)) & 0xfff
+ )
+ r[2 * i + 1] = int16(
+ ((uint16(a[3 * i + 1]) >> 4) | (uint16(a[3 * i + 2]) << 4)) & 0xfff
+ )
+ }
+ return r
+}
+
+// polyToMsg converts a polynomial to a 32-byte message
+// and represents the inverse of polyFromMsg.
+
+/**
+ * Converts a polynomial to a message represented as a Uint8Array.
+ * @param a - The polynomial to convert.
+ * @returns The message as a Uint8Array.
+ */
+function polyToMsg(a: Array<number>): Uint8Array {
+ const msg = new Uint8Array(32)
+ let t
+ const a2 = subtractQ(a)
+ for (let i = 0; i < N / 8; i++) {
+ msg[i] = 0
+ for (let j = 0; j < 8; j++) {
+ t = (((uint16(a2[8 * i + j]) << 1) + uint16(Q / 2)) / uint16(Q)) & 1
+ msg[i] |= byte(t << j)
+ }
+ }
+ return msg
+}
+
+// polyFromMsg converts a 32-byte message to a polynomial.
+
+/**
+ * Converts a Uint8Array message to an array of numbers representing a polynomial.
+ * Each element in the array is an int16 (0-65535).
+ *
+ * @param msg - The Uint8Array message to convert.
+ * @returns An array of numbers representing the polynomial.
+ */
+function polyFromMsg(msg: Uint8Array): Array<number> {
+ const r = new Array<number>(384).fill(0) // each element is int16 (0-65535)
+ let mask // int16
+ for (let i = 0; i < N / 8; i++) {
+ for (let j = 0; j < 8; j++) {
+ mask = -1 * int16((msg[i] >> j) & 1)
+ r[8 * i + j] = mask & int16((Q + 1) / 2)
+ }
+ }
+ return r
+}
+
+// indcpaRejUniform runs rejection sampling on uniform random bytes
+// to generate uniform random integers modulo `Q`.
+
+/**
+ * Generates an array of random numbers from a given buffer, rejecting values greater than a specified threshold.
+ *
+ * @param buf - The input buffer containing random bytes.
+ * @param bufl - The length of the input buffer.
+ * @param len - The desired length of the output array.
+ * @returns An array of random numbers and the actual length of the output array.
+ */
+function indcpaRejUniform(
+ buf: Uint8Array,
+ bufl: number,
+ len: number
+): [Array<number>, number] {
+ const r = new Array<number>(384).fill(0)
+ let ctr = 0
+ let val0, val1 // d1, d2 in kyber documentation
+
+ for (let pos = 0; ctr < len && pos + 3 <= bufl; ) {
+ // compute d1 and d2
+ val0 = (uint16(buf[pos] >> 0) | (uint16(buf[pos + 1]) << 8)) & 0xfff
+ val1 = (uint16(buf[pos + 1] >> 4) | (uint16(buf[pos + 2]) << 4)) & 0xfff
+
+ // increment input buffer index by 3
+ pos = pos + 3
+
+ // if d1 is less than 3329
+ if (val0 < Q) {
+ // assign to d1
+ r[ctr] = val0
+ // increment position of output array
+ ctr = ctr + 1
+ }
+ if (ctr < len && val1 < Q) {
+ r[ctr] = val1
+ ctr = ctr + 1
+ }
+ }
+ return [r, ctr]
+}
+
+// byteopsCbd computes a polynomial with coefficients distributed
+// according to a centered binomial distribution with parameter PARAMS_ETA,
+// given an array of uniformly random bytes.
+
+/**
+ * Converts a Uint8Array buffer to an array of numbers using the CBD operation.
+ * @param buf - The input Uint8Array buffer.
+ * @param eta - The value used in the CBD operation.
+ * @returns An array of numbers obtained from the CBD operation.
+ */
+function byteopsCbd(buf: Uint8Array, eta: number): Array<number> {
+ let t, d
+ let a, b
+ const r = new Array<number>(384).fill(0)
+ for (let i = 0; i < N / 8; i++) {
+ t = byteopsLoad32(buf.subarray(4 * i, buf.length))
+ d = t & 0x55555555
+ d = d + ((t >> 1) & 0x55555555)
+ for (let j = 0; j < 8; j++) {
+ a = int16((d >> (4 * j + 0)) & 0x3)
+ b = int16((d >> (4 * j + eta)) & 0x3)
+ r[8 * i + j] = a - b
+ }
+ }
+ return r
+}
+
+// ntt performs an inplace number-theoretic transform (NTT) in `Rq`.
+// The input is in standard order, the output is in bit-reversed order.
+
+/**
+ * Performs the Number Theoretic Transform (NTT) on an array of numbers.
+ *
+ * @param r - The input array of numbers.
+ * @returns The transformed array of numbers.
+ */
+function ntt(r: Array<number>): Array<number> {
+ // 128, 64, 32, 16, 8, 4, 2
+ for (let j = 0, k = 1, l = 128; l >= 2; l >>= 1) {
+ // 0,
+ for (let start = 0; start < 256; start = j + l) {
+ const zeta = NTT_ZETAS[k]
+ k = k + 1
+ // for each element in the subsections (128, 64, 32, 16, 8, 4, 2) starting at an offset
+ for (j = start; j < start + l; j++) {
+ // compute the modular multiplication of the zeta and each element in the subsection
+ const t = nttFqMul(zeta, r[j + l]) // t is mod q
+ // overwrite each element in the subsection as the opposite subsection element minus t
+ r[j + l] = r[j] - t
+ // add t back again to the opposite subsection
+ r[j] = r[j] + t
+ }
+ }
+ }
+ return r
+}
+
+// nttFqMul performs multiplication followed by Montgomery reduction
+// and returns a 16-bit integer congruent to `a*b*R^{-1} mod Q`.
+
+/**
+ * Performs an NTT (Number Theoretic Transform) multiplication on two numbers in Fq.
+ * @param a The first number.
+ * @param b The second number.
+ * @returns The result of the NTT multiplication.
+ */
+function nttFqMul(a: number, b: number): number {
+ return byteopsMontgomeryReduce(a * b)
+}
+
+// reduce applies Barrett reduction to all coefficients of a polynomial.
+
+/**
+ * Reduces each element in the given array using the barrett function.
+ *
+ * @param r - The array to be reduced.
+ * @returns The reduced array.
+ */
+function reduce(r: Array<number>): Array<number> {
+ for (let i = 0; i < N; i++) {
+ r[i] = barrett(r[i])
+ }
+ return r
+}
+
+// barrett computes a Barrett reduction; given
+// a integer `a`, returns a integer congruent to
+// `a mod Q` in {0,...,Q}.
+
+/**
+ * Performs the Barrett reduction algorithm on the given number.
+ *
+ * @param a - The number to be reduced.
+ * @returns The result of the reduction.
+ */
+function barrett(a: number): number {
+ const v = ((1 << 24) + Q / 2) / Q
+ let t = (v * a) >> 24
+ t = t * Q
+ return a - t
+}
+
+// byteopsMontgomeryReduce computes a Montgomery reduction; given
+// a 32-bit integer `a`, returns `a * R^-1 mod Q` where `R=2^16`.
+
+/**
+ * Performs Montgomery reduction on a given number.
+ * @param a - The number to be reduced.
+ * @returns The reduced number.
+ */
+function byteopsMontgomeryReduce(a: number): number {
+ const u = int16(int32(a) * Q_INV)
+ let t = u * Q
+ t = a - t
+ t >>= 16
+ return int16(t)
+}
+
+// polyToMont performs the in-place conversion of all coefficients
+// of a polynomial from the normal domain to the Montgomery domain.
+
+/**
+ * Converts a polynomial to the Montgomery domain.
+ *
+ * @param r - The polynomial to be converted.
+ * @returns The polynomial in the Montgomery domain.
+ */
+function polyToMont(r: Array<number>): Array<number> {
+ // let f = int16(((uint64(1) << 32)) % uint64(Q));
+ const f = 1353 // if Q changes then this needs to be updated
+ for (let i = 0; i < N; i++) {
+ r[i] = byteopsMontgomeryReduce(int32(r[i]) * int32(f))
+ }
+ return r
+}
+
+// pointwise-multiplies elements of polynomial-vectors
+// `a` and `b`, accumulates the results into `r`, and then multiplies by `2^-16`.
+
+/**
+ * Multiplies two matrices element-wise and returns the result.
+ * @param a - The first matrix.
+ * @param b - The second matrix.
+ * @returns The resulting matrix after element-wise multiplication.
+ */
+function multiply(
+ a: Array<Array<number>>,
+ b: Array<Array<number>>
+): Array<number> {
+ let r = polyBaseMulMontgomery(a[0], b[0])
+ let t
+ for (let i = 1; i < a.length; i++) {
+ t = polyBaseMulMontgomery(a[i], b[i])
+ r = add(r, t)
+ }
+ return reduce(r)
+}
+
+// polyBaseMulMontgomery performs the multiplication of two polynomials
+// in the number-theoretic transform (NTT) domain.
+
+/**
+ * Performs polynomial base multiplication in Montgomery domain.
+ * @param a - The first polynomial array.
+ * @param b - The second polynomial array.
+ * @returns The result of the polynomial base multiplication.
+ */
+function polyBaseMulMontgomery(
+ a: Array<number>,
+ b: Array<number>
+): Array<number> {
+ let rx, ry
+ for (let i = 0; i < N / 4; i++) {
+ rx = nttBaseMul(
+ a[4 * i + 0],
+ a[4 * i + 1],
+ b[4 * i + 0],
+ b[4 * i + 1],
+ NTT_ZETAS[64 + i]
+ )
+ ry = nttBaseMul(
+ a[4 * i + 2],
+ a[4 * i + 3],
+ b[4 * i + 2],
+ b[4 * i + 3],
+ -NTT_ZETAS[64 + i]
+ )
+ a[4 * i + 0] = rx[0]
+ a[4 * i + 1] = rx[1]
+ a[4 * i + 2] = ry[0]
+ a[4 * i + 3] = ry[1]
+ }
+ return a
+}
+
+// nttBaseMul performs the multiplication of polynomials
+// in `Zq[X]/(X^2-zeta)`. Used for multiplication of elements
+// in `Rq` in the number-theoretic transformation domain.
+
+/**
+ * Performs NTT base multiplication.
+ *
+ * @param a0 - The first coefficient of the first polynomial.
+ * @param a1 - The second coefficient of the first polynomial.
+ * @param b0 - The first coefficient of the second polynomial.
+ * @param b1 - The second coefficient of the second polynomial.
+ * @param zeta - The zeta value used in the multiplication.
+ * @returns An array containing the result of the multiplication.
+ */
+function nttBaseMul(
+ a0: number,
+ a1: number,
+ b0: number,
+ b1: number,
+ zeta: number
+): Array<number> {
+ const r = new Array<number>(2)
+ r[0] = nttFqMul(a1, b1)
+ r[0] = nttFqMul(r[0], zeta)
+ r[0] += nttFqMul(a0, b0)
+ r[1] = nttFqMul(a0, b1)
+ r[1] += nttFqMul(a1, b0)
+ return r
+}
+
+// adds two polynomials.
+
+/**
+ * Adds two arrays element-wise.
+ * @param a - The first array.
+ * @param b - The second array.
+ * @returns The resulting array after element-wise addition.
+ */
+function add(a: Array<number>, b: Array<number>): Array<number> {
+ const c = new Array<number>(384)
+ for (let i = 0; i < N; i++) {
+ c[i] = a[i] + b[i]
+ }
+ return c
+}
+
+// subtracts two polynomials.
+
+/**
+ * Subtracts the elements of array b from array a.
+ *
+ * @param a - The array from which to subtract.
+ * @param b - The array to subtract.
+ * @returns The resulting array after subtraction.
+ */
+function subtract(a: Array<number>, b: Array<number>): Array<number> {
+ for (let i = 0; i < N; i++) {
+ a[i] -= b[i]
+ }
+ return a
+}
+
+// nttInverse performs an inplace inverse number-theoretic transform (NTT)
+// in `Rq` and multiplication by Montgomery factor 2^16.
+// The input is in bit-reversed order, the output is in standard order.
+
+/**
+ * Performs the inverse Number Theoretic Transform (NTT) on the given array.
+ *
+ * @param r - The input array to perform the inverse NTT on.
+ * @returns The array after performing the inverse NTT.
+ */
+function nttInverse(r: Array<number>): Array<number> {
+ let j = 0
+ for (let k = 0, l = 2; l <= 128; l <<= 1) {
+ for (let start = 0; start < 256; start = j + l) {
+ const zeta = NTT_ZETAS_INV[k]
+ k = k + 1
+ for (j = start; j < start + l; j++) {
+ const t = r[j]
+ r[j] = barrett(t + r[j + l])
+ r[j + l] = t - r[j + l]
+ r[j + l] = nttFqMul(zeta, r[j + l])
+ }
+ }
+ }
+ for (j = 0; j < 256; j++) {
+ r[j] = nttFqMul(r[j], NTT_ZETAS_INV[127])
+ }
+ return r
+}
+
+// subtractQ applies the conditional subtraction of q to each coefficient of a polynomial.
+// if a is 3329 then convert to 0
+// Returns: a - q if a >= q, else a
+
+/**
+ * Subtracts the value of Q from each element in the given array.
+ * The result should be a negative integer for each element.
+ * If the leftmost bit is 0 (positive number), the value of Q is added back.
+ *
+ * @param r - The array to subtract Q from.
+ * @returns The resulting array after the subtraction.
+ */
+function subtractQ(r: Array<number>): Array<number> {
+ for (let i = 0; i < N; i++) {
+ r[i] -= Q // should result in a negative integer
+ // push left most signed bit to right most position
+ // javascript does bitwise operations in signed 32 bit
+ // add q back again if left most bit was 0 (positive number)
+ r[i] += (r[i] >> 31) & Q
+ }
+ return r
+}
+ |
+ Press n or j to go to the next uncovered block, b, p or k for the previous block. +
+ +| 1 +2 +3 +4 +5 +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 | 1x + + + + + + + +1x +6144x +6144x + +1x +68608x +68608x + +68608x +40030x +40030x +68608x +8743x +8743x +8743x +8743x + +19835x +19835x +19835x +19835x + +1x +14948x +14948x + +1x +30080x +30080x + +30080x +30080x +30080x + + + + + + + + + + + + + +1x +3520x +3520x + + + + + +1x + +1x +1x +1x +1x +1x +1x + + + + + + + + + + + + + + + + + + +1x +2x + + +2x +1536x + + +1536x +2x +2x + +2x +2x + +2x +2x + + + + + +2x + + + + + + + + + + + + + + + + + + + + + + +1x +14x +14x +14x +14x +14x +14x + + +1x + +512x +512x +512x +512x + + +512x + + + +1x + +192x +192x +192x +192x +192x + + +192x + | // import type { Crypto } from 'crypto'
+// import { webcrypto } from 'node:crypto'
+// import type { Crypto } from 'node:crypto.webcrypto.Crypto'
+// import crypto from 'node:crypto'
+import { webcrypto } from 'node:crypto'
+
+import { shake256 } from './deps.ts'
+
+export function byte(n: number): number {
+ return n % 256
+}
+
+export function int16(n: number): number {
+ const end = -32768
+ const start = 32767
+
+ if (n >= end && n <= start) {
+ return n
+ }
+ if (n < end) {
+ n = n + 32769
+ n = n % 65536
+ return start + n
+ }
+ // if (n > start) {
+ n = n - 32768
+ n = n % 65536
+ return end + n
+}
+
+export function uint16(n: number): number {
+ return n % 65536
+}
+
+export function int32(n: number): number {
+ const end = -2147483648
+ const start = 2147483647
+
+ if (n >= end && n <= start) {
+ return n
+ }
+ if (n < end) {
+ n = n + 2147483649
+ n = n % 4294967296
+ return start + n
+ }
+ // if (n > start) {
+ n = n - 2147483648
+ n = n % 4294967296
+ return end + n
+}
+
+// any bit operations to be done in uint32 must have >>> 0
+// javascript calculates bitwise in SIGNED 32 bit so you need to convert
+export function uint32(n: number): number {
+ return n % 4294967296
+}
+
+/**
+ * compares two arrays
+ * @returns 1 if they are the same or 0 if not
+ */
+function checkUint8ArrayExists(arr: Uint8Array): boolean {
+ // Check if the variable is defined and is an array
+ return Array.isArray(arr) && arr.length > 0;
+}
+export function constantTimeCompare(x: Uint8Array, y: Uint8Array): number {
+ if (!checkUint8ArrayExists(x) || !checkUint8ArrayExists(y) || (x.length != y.length)) {
+ return 0
+ }
+ const v = new Uint8Array([0]);
+ // constantTimeByteEq
+ const z = new Uint8Array([0])
+ // if (v[0] !== undefined && z[0] !== undefined) {
+ for (let i = 0; i < x.length; i++) {
+ v[0] |= (x?.[i] ?? 0) ^ (y?.[i] ?? 0)
+ }
+
+ z[0] = ~(v[0] ^ z[0])
+ z[0] &= z[0] >> 4
+ z[0] &= z[0] >> 2
+ z[0] &= z[0] >> 1
+ return z[0]
+ // } else {
+ // return 0
+ // }
+}
+
+export function equalUint8Array(x: Uint8Array, y: Uint8Array) {
+ if (x.length != y.length) {
+ return false
+ }
+ for (let i = 0; i < x.length; i++) {
+ if (x[i] !== y[i]) {
+ return false
+ }
+ }
+ return true
+}
+
+export async function loadCrypto(): Promise<webcrypto.Crypto> {
+ if (typeof globalThis !== 'undefined' && globalThis.crypto !== undefined) {
+
+ return globalThis.crypto as webcrypto.Crypto
+ } else {
+ throw new Error('Web Crypto API not available ')
+ }
+ // const x: webcrypto.Crypto = globalThis.crypto
+ // return x
+ // }
+}
+
+// export async function loadCrypto(): Promise<webcrypto.Crypto> {
+// if (typeof globalThis !== 'undefined' && globalThis.crypto !== undefined) {
+// // const x: Crypto = globalThis.crypto
+// const x: webcrypto.Crypto = globalThis.crypto
+// // Browsers, Node.js >= v19, Cloudflare Workers, Bun, etc.
+// return x
+// // return globalThis.crypto
+// }
+// // // Node.js <= v18
+// // try {
+// // // @ts-ignore: to ignore "crypto"
+// // const { webcrypto } = await import('crypto') // node:crypto
+// // return webcrypto as unknown as Crypto
+// // } catch (_e: unknown) {
+// // throw new Error('failed to load Crypto')
+// // }
+// }
+
+// prf provides a pseudo-random function (PRF) which returns
+// a byte array of length `l`, using the provided key and nonce
+// to instantiate the PRF's underlying hash function.
+export function prf(len: number, seed: Uint8Array, nonce: number): Uint8Array {
+ return shake256
+ .create({ dkLen: len })
+ .update(seed)
+ .update(new Uint8Array([nonce]))
+ .digest()
+}
+
+// byteopsLoad24 returns a 32-bit unsigned integer loaded from byte x.
+export function byteopsLoad24(x: Uint8Array): number {
+ // if (x[0] !== undefined && x[1] !== undefined && x[2] !== undefined) {
+ let r = uint32(x[0])
+ r |= uint32(x[1]) << 8
+ r |= uint32(x[2]) << 16
+ return r
+ // }
+ // return 0
+}
+
+
+// byteopsLoad32 returns a 32-bit unsigned integer loaded from byte x.
+export function byteopsLoad32(x: Uint8Array): number {
+ // if (x[0] !== undefined && x[1] !== undefined && x[2] !== undefined && x[3] !== undefined) {
+ let r = uint32(x[0])
+ r |= uint32(x[1]) << 8
+ r |= uint32(x[2]) << 16
+ r |= uint32(x[3]) << 24
+ return uint32(r)
+ // }
+ // return 0
+}
+ |