scalar
extern void p256_montjscalarmul(uint64_t res[S2N_BIGNUM_STATIC 12],const uint64_t scalar[S2N_BIGNUM_STATIC 4],const uint64_t point[S2N_BIGNUM_STATIC 12]);
extern void p256_montjscalarmul_alt(uint64_t res[S2N_BIGNUM_STATIC 12],const uint64_t scalar[S2N_BIGNUM_STATIC 4],const uint64_t point[S2N_BIGNUM_STATIC 12]);
extern void p256_scalarmul(uint64_t res[S2N_BIGNUM_STATIC 8],const uint64_t scalar[S2N_BIGNUM_STATIC 4],const uint64_t point[S2N_BIGNUM_STATIC 8]);
extern void p256_scalarmul_alt(uint64_t res[S2N_BIGNUM_STATIC 8],const uint64_t scalar[S2N_BIGNUM_STATIC 4],const uint64_t point[S2N_BIGNUM_STATIC 8]);
extern void p256_scalarmulbase(uint64_t res[S2N_BIGNUM_STATIC 8],const uint64_t scalar[S2N_BIGNUM_STATIC 4],uint64_t blocksize,const uint64_t *table);
extern void p256_scalarmulbase_alt(uint64_t res[S2N_BIGNUM_STATIC 8],const uint64_t scalar[S2N_BIGNUM_STATIC 4],uint64_t blocksize,const uint64_t *table);
extern void p384_montjscalarmul(uint64_t res[S2N_BIGNUM_STATIC 18],const uint64_t scalar[S2N_BIGNUM_STATIC 6],const uint64_t point[S2N_BIGNUM_STATIC 18]);
extern void p384_montjscalarmul_alt(uint64_t res[S2N_BIGNUM_STATIC 18],const uint64_t scalar[S2N_BIGNUM_STATIC 6],const uint64_t point[S2N_BIGNUM_STATIC 18]);
extern void p521_jscalarmul(uint64_t res[S2N_BIGNUM_STATIC 27],const uint64_t scalar[S2N_BIGNUM_STATIC 9],const uint64_t point[S2N_BIGNUM_STATIC 27]);
extern void p521_jscalarmul_alt(uint64_t res[S2N_BIGNUM_STATIC 27],const uint64_t scalar[S2N_BIGNUM_STATIC 9],const uint64_t point[S2N_BIGNUM_STATIC 27]);
extern void sm2_montjscalarmul(uint64_t res[S2N_BIGNUM_STATIC 12],const uint64_t scalar[S2N_BIGNUM_STATIC 4],const uint64_t point[S2N_BIGNUM_STATIC 12]);
extern void sm2_montjscalarmul_alt(uint64_t res[S2N_BIGNUM_STATIC 12],const uint64_t scalar[S2N_BIGNUM_STATIC 4],const uint64_t point[S2N_BIGNUM_STATIC 12]);
extern void curve25519_pxscalarmul(uint64_t res[S2N_BIGNUM_STATIC 8],const uint64_t scalar[S2N_BIGNUM_STATIC 4],const uint64_t point[S2N_BIGNUM_STATIC 4]);
extern void curve25519_pxscalarmul_alt(uint64_t res[S2N_BIGNUM_STATIC 8],const uint64_t scalar[S2N_BIGNUM_STATIC 4],const uint64_t point[S2N_BIGNUM_STATIC 4]);
extern void curve25519_x25519(uint64_t res[S2N_BIGNUM_STATIC 4],const uint64_t scalar[S2N_BIGNUM_STATIC 4],const uint64_t point[S2N_BIGNUM_STATIC 4]);
extern void curve25519_x25519_alt(uint64_t res[S2N_BIGNUM_STATIC 4],const uint64_t scalar[S2N_BIGNUM_STATIC 4],const uint64_t point[S2N_BIGNUM_STATIC 4]);
extern void curve25519_x25519_byte(uint8_t res[S2N_BIGNUM_STATIC 32],const uint8_t scalar[S2N_BIGNUM_STATIC 32],const uint8_t point[S2N_BIGNUM_STATIC 32]);
extern void curve25519_x25519_byte_alt(uint8_t res[S2N_BIGNUM_STATIC 32],const uint8_t scalar[S2N_BIGNUM_STATIC 32],const uint8_t point[S2N_BIGNUM_STATIC 32]);
extern void curve25519_x25519base(uint64_t res[S2N_BIGNUM_STATIC 4],const uint64_t scalar[S2N_BIGNUM_STATIC 4]);
extern void curve25519_x25519base_alt(uint64_t res[S2N_BIGNUM_STATIC 4],const uint64_t scalar[S2N_BIGNUM_STATIC 4]);
extern void curve25519_x25519base_byte(uint8_t res[S2N_BIGNUM_STATIC 32],const uint8_t scalar[S2N_BIGNUM_STATIC 32]);
extern void curve25519_x25519base_byte_alt(uint8_t res[S2N_BIGNUM_STATIC 32],const uint8_t scalar[S2N_BIGNUM_STATIC 32]);
extern void edwards25519_scalarmulbase(uint64_t res[S2N_BIGNUM_STATIC 8],const uint64_t scalar[S2N_BIGNUM_STATIC 4]);
extern void edwards25519_scalarmulbase_alt(uint64_t res[S2N_BIGNUM_STATIC 8],const uint64_t scalar[S2N_BIGNUM_STATIC 4]);
extern void edwards25519_scalarmuldouble(uint64_t res[S2N_BIGNUM_STATIC 8],const uint64_t scalar[S2N_BIGNUM_STATIC 4], const uint64_t point[S2N_BIGNUM_STATIC 8],const uint64_t bscalar[S2N_BIGNUM_STATIC 4]);
extern void edwards25519_scalarmuldouble_alt(uint64_t res[S2N_BIGNUM_STATIC 8],const uint64_t scalar[S2N_BIGNUM_STATIC 4], const uint64_t point[S2N_BIGNUM_STATIC 8],const uint64_t bscalar[S2N_BIGNUM_STATIC 4]);
x25519_scalar_mult(uint8_t out[32], const uint8_t scalar[32],
x25519_scalar_mult_generic(out, scalar, point);
void x25519_ge_scalarmult(ge_p2 *r, const uint8_t *scalar, const ge_p3 *A) {
uint8_t index = scalar[31 - i/8];
x25519_scalar_mult_generic(uint8_t out[32], const uint8_t scalar[32],
memcpy(e, scalar, 32);
void x25519_ge_scalarmult(ge_p2 *r, const uint8_t *scalar, const ge_p3 *A);
void x25519_scalar_mult(uint8_t out[32], const uint8_t scalar[32],
void x25519_scalar_mult_generic(uint8_t out[32], const uint8_t scalar[32],
const BIGNUM *scalar, const EC_POINT *point, BN_CTX *);
ec_wnaf_new(const EC_GROUP *group, const BIGNUM *scalar, const EC_POINT *point,
wnaf->num_digits = BN_num_bits(scalar) + 1;
if (!ec_compute_wnaf(scalar, wnaf->digits, wnaf->num_digits))
wnaf->num_multiples = 1ULL << (ec_window_bits(scalar) - 1);
ec_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, const EC_POINT *point,
if (!BN_bn2binpad(scalar, scalar_bytes, scalar_len))
ec_mul_single_ct(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
return ec_mul(group, r, scalar, point, ctx);
ec_mul_ct(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
if (!bn_copy(k, scalar))
ec_mul_single_ct(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
return ec_mul_ct(group, r, scalar, point, ctx);
scalar secret[MLKEM1024_RANK], error[MLKEM1024_RANK], u[MLKEM1024_RANK];
scalar expanded_message, scalar_error;
scalar v;
scalar u[MLKEM1024_RANK];
scalar mask, v;
static inline const scalar *
const_m2s(const scalar *v, size_t row, size_t col, uint16_t rank)
return ((scalar *)v) + row * rank + col;
static inline scalar *
m2s(scalar *v, size_t row, size_t col, uint16_t rank)
return ((scalar *)v) + row * rank + col;
scalar_zero(scalar *out)
vector_zero(scalar *out, size_t rank)
scalar_ntt(scalar *s)
vector_ntt(scalar *v, size_t rank)
scalar_inverse_ntt(scalar *s)
vector_inverse_ntt(scalar *v, size_t rank)
scalar_add(scalar *lhs, const scalar *rhs)
scalar_sub(scalar *lhs, const scalar *rhs)
scalar_mult(scalar *out, const scalar *lhs, const scalar *rhs)
vector_add(scalar *lhs, const scalar *rhs, size_t rank)
matrix_mult(scalar *out, const void *m, const scalar *a, size_t rank)
scalar product;
matrix_mult_transpose(scalar *out, const void *m, const scalar *a, size_t rank)
scalar product;
scalar_inner_product(scalar *out, const scalar *lhs,
const scalar *rhs, size_t rank)
scalar product;
scalar_from_keccak_vartime(scalar *out, sha3_ctx *keccak_ctx)
scalar_centered_binomial_distribution_eta_2_with_prf(scalar *out,
vector_generate_secret_eta_2(scalar *out, uint8_t *counter,
scalar_encode(uint8_t *out, const scalar *s, int bits)
scalar_encode_1(uint8_t out[32], const scalar *s)
vector_encode(uint8_t *out, const scalar *a, int bits, size_t rank)
vector_encode_cbb(CBB *cbb, const scalar *a, int bits, size_t rank)
scalar_decode(scalar *out, const uint8_t *in, int bits)
scalar_decode_1(scalar *out, const uint8_t in[32])
vector_decode(scalar *out, const uint8_t *in, int bits, size_t rank)
scalar_compress(scalar *s, int bits)
scalar_decompress(scalar *s, int bits)
vector_compress(scalar *v, int bits, size_t rank)
vector_decompress(scalar *v, int bits, size_t rank)
scalar *t;
scalar *m;
size_t vector_size = external->rank * sizeof(scalar);
pub->t = (struct scalar *)bytes + offset;
scalar *s;
size_t vector_size = external->rank * sizeof(scalar);
priv->pub.t = (struct scalar *)(bytes + offset);
scalar error[MLKEM1024_RANK];
if (memcmp(kExpected, scalar, sizeof(kExpected)) != 0) {
uint8_t scalar[32] = {9}, point[32] = {9}, out[32];
X25519(out, scalar, point);
memcpy(point, scalar, sizeof(point));
memcpy(scalar, out, sizeof(scalar));
BIGNUM *order = NULL, *scalar = NULL;
if ((scalar = BN_new()) == NULL)
if (!BN_rand_range(scalar, order))
if (!BN_set_bit(scalar, EC_GROUP_order_bits(group) - 1))
if (!EC_POINT_mul(group, a, scalar, NULL, NULL, ctx))
if (!EC_POINT_mul(group, b, scalar, NULL, NULL, ctx))
bm->func(group, result, scalar, a, b, ctx);
BN_free(scalar);
const BIGNUM *scalar, const EC_POINT *a, const EC_POINT *b, BN_CTX *ctx)
const BIGNUM *scalar, const EC_POINT *a, const EC_POINT *b, BN_CTX *ctx)
const BIGNUM *scalar, const EC_POINT *a, const EC_POINT *b, BN_CTX *ctx)
if (!EC_POINT_mul(group, result, scalar, NULL, NULL, ctx))
const uint8_t scalar[CURVE25519_KEY_SIZE],
memcpy(e, scalar, 32);
const uint8_t scalar[CURVE25519_KEY_SIZE],