crypto/openssl/crypto/ml_dsa/ml_dsa_key_compress.c

165

if (gamma2 == ((ML_DSA_Q - 1) / 32)) {

crypto/openssl/crypto/ml_dsa/ml_dsa_key_compress.c

92

*r0 -= (((int32_t)ML_DSA_Q_MINUS1_DIV2 - *r0) >> 31) & (int32_t)ML_DSA_Q;

crypto/openssl/crypto/ml_dsa/ml_dsa_local.h

114

return constant_time_select_32(constant_time_lt_32(x, ML_DSA_Q), x, x - ML_DSA_Q);

crypto/openssl/crypto/ml_dsa/ml_dsa_local.h

130

return reduce_once(ML_DSA_Q + a - b);

crypto/openssl/crypto/ml_dsa/ml_dsa_local.h

149

ML_DSA_Q - x, x);

crypto/openssl/crypto/ml_dsa/ml_dsa_local.h

19

#define ML_DSA_Q_MINUS1_DIV2 ((ML_DSA_Q - 1) / 2)

crypto/openssl/crypto/ml_dsa/ml_dsa_local.h

55

#define ML_DSA_GAMMA2_Q_MINUS1_DIV32 ((ML_DSA_Q - 1) / 32)

crypto/openssl/crypto/ml_dsa/ml_dsa_local.h

56

#define ML_DSA_GAMMA2_Q_MINUS1_DIV88 ((ML_DSA_Q - 1) / 88)

crypto/openssl/crypto/ml_dsa/ml_dsa_ntt.c

178

const uint32_t step_root = ML_DSA_Q - zetas_montgomery[step + (step - 1 - i)];

crypto/openssl/crypto/ml_dsa/ml_dsa_ntt.c

186

* (uint64_t)(ML_DSA_Q + even - odd));

crypto/openssl/crypto/ml_dsa/ml_dsa_ntt.c

96

uint64_t b = a + t * ML_DSA_Q; /* a - t * q */

crypto/openssl/crypto/ml_dsa/ml_dsa_sample.c

52

return *out < ML_DSA_Q;