bugfix:KyberSlash2 case d=3

kudelskisecurity · Jan 16, 2024 · 8380db8 · 8380db8
1 parent a7cf5ef
commit 8380db8
Showing 1 changed file with 9 additions and 3 deletions.
diff --git a/crystals-kyber/poly.go b/crystals-kyber/poly.go
@@ -193,11 +193,17 @@ func (p *Poly) compress(d int) []byte {
 
 	case 3:
 		var t [8]uint16
+		var d0 uint32 /* accumulation value for fixing KyberSlash2 */
 		id := 0
 		for i := 0; i < n/8; i++ {
-			for j := 0; j < 8; j++ { //TODO: fix KyberSlash2 here
-				t[j] = uint16(((uint32(p[8*i+j])<<3)+uint32(q)/2)/
-					uint32(q)) & ((1 << 3) - 1)
+			for j := 0; j < 8; j++ {
+				/* t[j] = uint16(((uint32(p[8*i+j])<<3)+uint32(q)/2)/
+					uint32(q)) & ((1 << 3) - 1) */
+				d0 = uint32(p[8*i+j]) << 3
+				d0 += 1664
+				d0 *= 161271
+				d0 >>= 29
+				t[j] = uint16(d0 & 0x7)
 			}
 			c[id] = byte(t[0]) | byte(t[1]<<3) | byte(t[2]<<6)
 			c[id+1] = byte(t[2]>>2) | byte(t[3]<<1) | byte(t[4]<<4) | byte(t[5]<<7)