🥮 mooncakes.io
    Sign in

    moondsa

    moondsa is a MoonBit implementation of Dilithium, a post-quantum signature scheme.

    Dilithium
    Signature
    Cryptography
    Post-Quantum
    Download zip
    Author
    Version
    0.1.2
    License
    Apache-2.0
    Repository
    Last updated
    last year
    Downloads
    37

    #ruifeng/dilithium

    本项目使用 MoonBit 实现了 Dilithium 算法，一种抗量子的签名算法。 提供秘钥生成，签名，验证等三个函数。

    #RoadMap

    #Warning

    本项目没有经过安全性分析。请谨慎使用。

    #Examples

    // 首先需要设置优先级别
@dilithium.dilithium_context.set_level(SecurityLevel::Dilithium5)
let (pk, sk) = keypair_gen(Ok(seed)) // 这里需要传入seed或者Rand作为随机
let sign = sign(msg, sk) 
let result : Result[Unit, SignError] = verify(sig, msg, pk)

    BigRandom

    source
    type BigRandom

    BigRandom::get_random

    source
    fn BigRandom::get_random(seed : Array[Byte], level : Int) -> 
    Rand
    Crate a new BigRandom the length of the seed must be a multiple of 32(256 bits)

    DilithiumContext

    source
    type DilithiumContext

    DilithiumContext::get_params_set

    source
    fn DilithiumContext::get_params_set(self : DilithiumContext) -> ParameterSet

    DilithiumContext::get_random

    source

    DilithiumContext::set_level

    source
    fn DilithiumContext::set_level(self : DilithiumContext, level : SecurityLevel) -> Unit

    DilithiumContext::set_random

    source

    KeccakState

    source
    pub struct KeccakState {
      s : FixedArray[UInt64]
      pos : UInt
    }
    Keccak state structure | Keccak 状态结构 Contains the 5x5 state array and current position 包含 5x5 状态数组和当前位置
    impl Show for KeccakState

    KeccakState::init

    source
    fn KeccakState::init(self : KeccakState) -> Unit
    Initialize Keccak state to all zeros | 将 Keccak 状态初始化为全零

    ParameterSet

    source
    pub struct ParameterSet {
      k : Int
      l : Int
      eta : Int
      tau : Int
      beta : Int
      gamma1 : Int
      gamma2 : Int
      omega : Int
      publickey_bytes : Int
      polyeta_packedbytes : Int
      polyw1_packedbytes : Int
      polyz_packed_bytes : Int
      poly_uniform_gamma1_nblocks : UInt
      polyvech_packed_bytes : Int
      sign_bytes : Int
      level : SecurityLevel
      features : Map[String, String]
    }

    Poly

    source
    pub struct Poly {
      coeffs : Array[Int]
    }
    Polynomial structure containing an array of coefficients. 包含系数数组的多项式结构。
    impl Show for Poly

    Poly::add

    source
    fn Poly::add(self : Poly, other : Poly) -> Unit
    Add polynomials. No modular reduction is performed. 多项式加法。不执行模约简。

    Arguments / 参数:
    • self: target polynomial (modified in place) / 目标多项式（原地修改）
    • other: polynomial to add / 要相加的多项式

    Poly::caddq

    source
    fn Poly::caddq(self : Poly) -> Unit
    For all coefficients of in/out polynomial add Q if coefficient is negative. 对于多项式的所有系数，如果系数为负则加上 Q。

    Poly::challenge

    source
    fn Poly::challenge(self : Poly, seed : Array[Byte]) -> Unit
    Implementation of H. Samples polynomial with TAU nonzero coefficients in {-1,1} using the output stream of SHAKE256(seed).

    Poly::chknorm

    source
    fn Poly::chknorm(self : Poly, b : Int) -> Byte
    Check infinity norm of polynomial against given bound. Assumes input coefficients to be standard representatives. Returns 0 if norm is strictly smaller than B and 1 otherwise. 检查多项式的无穷范数是否超过给定界限。 假设输入系数为标准代表元。 如果范数严格小于 B 则返回 0，否则返回 1。

    Arguments / 参数:
    • self: polynomial to check / 要检查的多项式
    • b: bound to check against / 要检查的界限

    Returns / 返回: 0 if all coefficients have absolute value < b, 1 otherwise 0 如果所有系数的绝对值 < b，否则返回 1

    Poly::copy

    source
    fn Poly::copy(self : Poly) -> Poly

    Poly::decompose

    source
    fn Poly::decompose(self : Poly, low : Poly) -> Unit
    For all coefficients c of the input polynomial, compute high and low bits c0, c1 such c mod Q = c1ALPHA + c0 with -ALPHA/2 < c0 <= ALPHA/2 except c1 = (Q-1)/ALPHA where we set c1 = 0 and -ALPHA/2 <= c0 = c mod Q - Q < 0. Assumes coefficients to be standard representatives. 对于输入多项式的所有系数 c，计算高位和低位 c0, c1， 使得 c mod Q = c1ALPHA + c0，其中 -ALPHA/2 < c0 <= ALPHA/2， 除了当 c1 = (Q-1)/ALPHA 时，我们设置 c1 = 0 且 -ALPHA/2 <= c0 = c mod Q - Q < 0。 假设系数为标准代表元。

    Arguments / 参数:
    • self: input polynomial, gets high bits (modified in place) / 输入多项式，获得高位（原地修改）
    • other: output polynomial for low bits / 低位的输出多项式

    Poly::inv_ntt_to_mont

    source
    fn Poly::inv_ntt_to_mont(self : Poly) -> Unit
    Inplace inverse NTT and multiplication by 2^{32}. Input coefficients need to be less than 2Q. Output coefficients are less than 2Q. 原地逆向 NTT 并乘以 2^{32}。 输入系数需要小于 2Q。 输出系数小于 2Q。

    Poly::make_hint

    source
    fn Poly::make_hint(h : Poly, a0 : Poly, a1 : Poly) -> Int
    Compute hint polynomial. The coefficients of which indicate whether the low bits of the corresponding coefficient of the input polynomial overflow into the high bits. 计算提示多项式。其系数指示输入多项式对应系数的低位 是否溢出到高位。

    Arguments / 参数:
    • h: output hint polynomial / 输出提示多项式
    • a0: low bits polynomial / 低位多项式
    • a1: high bits polynomial / 高位多项式

    Returns / 返回: Number of 1's in hint polynomial / 提示多项式中 1 的数量

    Poly::new

    source
    fn Poly::new() -> Poly
    Create a new polynomial with all zero coefficients. 创建一个所有系数为零的新多项式。

    Poly::ntt

    source
    fn Poly::ntt(self : Poly) -> Unit
    Inplace forward NTT. Output coefficients can be up to 16Q larger than input coefficients. 原地正向 NTT。输出系数可能比输入系数大至多 16Q。

    Poly::pack_eta

    source
    fn Poly::pack_eta(self : Poly) -> Array[Byte]
    Bit-pack polynomial with coefficients in [-ETA,ETA]. Input coefficients are assumed to lie in [Q-ETA,Q+ETA].

    Poly::pack_t0

    source
    fn Poly::pack_t0(self : Poly) -> Array[Byte]
    Bit-pack polynomial t0 with coefficients in [-2^{D-1}, 2^{D-1}].

    Poly::pack_t1

    source
    fn Poly::pack_t1(self : Poly) -> Array[Byte]
    Bit-pack polynomial t1 with coefficients fitting in 10 bits. Input coefficients are assumed to be standard representatives.

    Poly::pack_w1

    source
    fn Poly::pack_w1(self : Poly) -> Array[Byte]
    Bit-pack polynomial w1 with coefficients in [0, 15]. Input coefficients are assumed to be standard representatives.

    Poly::pack_z

    source
    fn Poly::pack_z(self : Poly) -> Array[Byte]
    Bit-pack polynomial z with coefficients in [-(GAMMA1 - 1), GAMMA1 - 1]. Input coefficients are assumed to be standard representatives.*

    Poly::pointwise_montgomery

    source
    fn Poly::pointwise_montgomery(c : Poly, a : Poly, b : Poly) -> Unit
    Pointwise multiplication of polynomials in NTT domain representation and multiplication of resulting polynomial by 2^{-32}. Output coefficients are less than 2Q if input coefficient are less than 22Q. NTT 域内多项式的逐点乘法，并将结果多项式乘以 2^{-32}。 如果输入系数小于 22Q，则输出系数小于 2Q。

    Arguments / 参数:
    • self: result polynomial (modified in place) / 结果多项式（原地修改）
    • other: polynomial to multiply with / 要相乘的多项式

    Poly::poly_uniform_eta

    source
    fn Poly::poly_uniform_eta(self : Poly, seed : Array[Byte], nonce : UInt16) -> Unit

    Poly::power2round

    source
    fn Poly::power2round(self : Poly, a0 : Poly) -> Unit
    For all coefficients c of the input polynomial, compute c0, c1 such that c mod Q = c1*2^D + c0 with -2^{D-1} < c0 <= 2^{D-1}. Assumes coefficients to be standard representatives.

    Poly::reduce

    source
    fn Poly::reduce(self : Poly) -> Unit
    Inplace reduction of all coefficients of polynomial to representative in [0,2Q]. 将多项式的所有系数原地约简到 [0,2Q] 范围内的代表元。

    Poly::shiftl

    source
    fn Poly::shiftl(self : Poly) -> Unit
    Multiply polynomial by 2^D without modular reduction. Assumes input coefficients to be less than 2^{32-D}. 将多项式乘以 2^D，不执行模约简。假设输入系数小于 2^{32-D}。

    Poly::sub

    source
    fn Poly::sub(self : Poly, other : Poly) -> Unit
    Subtract polynomials. Assumes coefficients of second input polynomial to be less than 2Q. No modular reduction is performed. 多项式减法。假设第二个输入多项式的系数小于 2Q。 不执行模约简。

    Arguments / 参数:
    • self: target polynomial (modified in place) / 目标多项式（原地修改）
    • other: polynomial to subtract / 要减去的多项式

    Poly::uniform

    source
    fn Poly::uniform(self : Poly, seed : Array[Byte], nonce : UInt16) -> Unit

    Poly::uniform_gamma1

    source
    fn Poly::uniform_gamma1(self : Poly, seed : Array[Byte], nonce : UInt16) -> Unit
    Sample polynomial with uniformly random coefficients in [-(GAMMA1 - 1), GAMMA1 - 1] by performing rejection sampling on output stream of SHAKE256(seed|nonce) or AES256CTR(seed,nonce).

    Poly::unpack_eta

    source
    fn Poly::unpack_eta(self : Poly, a : Array[Byte]) -> Unit
    Unpack polynomial with coefficients in [-ETA,ETA].

    Poly::unpack_t0

    source
    fn Poly::unpack_t0(self : Poly, a : Array[Byte]) -> Unit
    Unpack polynomial t0 with coefficients in ]-2^{D-1}, 2^{D-1}]. Output coefficients lie in ]Q-2^{D-1},Q+2^{D-1}].

    Poly::unpack_t1

    source
    fn Poly::unpack_t1(self : Poly, a : Array[Byte]) -> Unit
    Unpack polynomial t1 with 9-bit coefficients. Output coefficients are standard representatives.

    Poly::unpack_z

    source
    fn Poly::unpack_z(self : Poly, a : Array[Byte]) -> Unit
    Unpack polynomial z with coefficients in [-(GAMMA1 - 1), GAMMA1 - 1]. Output coefficients are standard representatives.

    Poly::use_hint

    source
    fn Poly::use_hint(self : Poly, h : Poly) -> Unit
    Use hint polynomial to correct the high bits of a polynomial. 使用提示多项式来修正多项式的高位。

    Arguments / 参数:
    • self: input/output polynomial with corrected high bits / 具有修正高位的输入/输出多项式
    • h: hint polynomial / 提示多项式

    Polyveck

    source
    pub struct Polyveck {
      vec : Array[Poly]
    }
    Polyveck is a vector of polynomials and length is k.
    impl Show for Polyveck

    Polyveck::add

    source
    fn Polyveck::add(w : Polyveck, v : Polyveck) -> Unit
    Add vectors of polynomials of length K. No modular reduction is performed.

    Polyveck::caddq

    source
    fn Polyveck::caddq(v : Polyveck) -> Unit
    For all coefficients of polynomials in vector of length K add Q if coefficient is negative.

    Polyveck::chknorm

    source
    fn Polyveck::chknorm(v : Polyveck, bound : Int) -> Byte
    Check infinity norm of polynomials in vector of length K. Assumes input coefficients to be standard representatives. Returns 0 if norm of all polynomials are strictly smaller than B and 1 otherwise.

    Polyveck::copy

    source
    fn Polyveck::copy(self : Polyveck) -> Polyveck
    deep clone

    Polyveck::decompose

    source
    fn Polyveck::decompose(v1 : Polyveck, v0 : Polyveck) -> Unit
    For all coefficients a of polynomials in vector of length K, compute high and low bits a0, a1 such a mod Q = a1*ALPHA + a0 with -ALPHA/2 < a0 <= ALPHA/2 except a1 = (Q-1)/ALPHA where we set a1 = 0 and -ALPHA/2 <= a0 = a mod Q - Q < 0. Assumes coefficients to be standard representatives.

    Polyveck::invntt_tomont

    source
    fn Polyveck::invntt_tomont(v : Polyveck) -> Unit
    Inverse NTT and multiplication by 2^{32} of polynomials in vector of length K. Input coefficients need to be less than 2*Q.

    Polyveck::make_hint

    source
    fn Polyveck::make_hint(h : Polyveck, v0 : Polyveck, v1 : Polyveck) -> Int
    Compute hint vector.

    Returns number of 1 bits.

    Polyveck::ntt

    source
    fn Polyveck::ntt(v : Polyveck) -> Unit
    Forward NTT of all polynomials in vector of length K. Output coefficients can be up to 16*Q larger than input coefficients.

    Polyveck::pack_w1

    source
    fn Polyveck::pack_w1(self : Polyveck, r : Array[Byte]) -> Unit

    Polyveck::pointwise_poly_montgomery

    source
    fn Polyveck::pointwise_poly_montgomery(r : Polyveck, a : Poly, v : Polyveck) -> Unit

    Polyveck::power2round

    source
    fn Polyveck::power2round(v1 : Polyveck, v0 : Polyveck) -> Unit
    For all coefficients a of polynomials in vector of length K, compute a0, a1 such that a mod Q = a1*2^D + a0 with -2^{D-1} < a0 <= 2^{D-1}. Assumes coefficients to be standard representatives.

    Polyveck::reduce

    source
    fn Polyveck::reduce(v : Polyveck) -> Unit
    Reduce coefficients of polynomials in vector of length K to representatives in [0,2*Q].

    Polyveck::shiftl

    source
    fn Polyveck::shiftl(v : Polyveck) -> Unit
    Multiply vector of polynomials of Length K by 2^D without modular reduction. Assumes input coefficients to be less than 2^{32-D}.

    Polyveck::sub

    source
    fn Polyveck::sub(w : Polyveck, v : Polyveck) -> Unit
    Subtract vectors of polynomials of length K. Assumes coefficients of polynomials in second input vector to be less than 2*Q. No modular reduction is performed.

    Polyveck::uniform_eta

    source
    fn Polyveck::uniform_eta(v : Polyveck, seed : Array[Byte], nonce : UInt16) -> Unit

    Polyveck::use_hint

    source
    fn Polyveck::use_hint(w : Polyveck, h : Polyveck) -> Unit
    Use hint vector to correct the high bits of input vector.

    Polyvecl

    source
    pub struct Polyvecl {
      vec : Array[Poly]
    }

    impl Show for Polyvecl

    Polyvecl::add

    source
    fn Polyvecl::add(w : Polyvecl, v : Polyvecl) -> Unit
    Add vectors of polynomials of length L. No modular reduction is performed.

    Polyvecl::chknorm

    source
    fn Polyvecl::chknorm(v : Polyvecl, bound : Int) -> Byte
    Check infinity norm of polynomials in vector of length L. Assumes input coefficients to be standard representatives. Returns 0 if norm of all polynomials is strictly smaller than B and 1 otherwise.

    Polyvecl::copy

    source
    fn Polyvecl::copy(self : Polyvecl) -> Polyvecl
    deep clone

    Polyvecl::invntt_tomont

    source
    fn Polyvecl::invntt_tomont(v : Polyvecl) -> Unit

    Polyvecl::matrix_expand

    source
    fn Polyvecl::matrix_expand(mat : Array[Polyvecl], rho : Array[Byte]) -> Unit
    Implementation of ExpandA. Generates matrix A with uniformly random coefficients a_{i,j} by performing rejection sampling on the output stream of SHAKE128(rho|j|i)

    Polyvecl::ntt

    source
    fn Polyvecl::ntt(v : Polyvecl) -> Unit
    Forward NTT of all polynomials in vector of length L. Output coefficients can be up to 16Q larger than input coefficients.

    Polyvecl::pointwise_acc_montgomery

    source
    fn Polyvecl::pointwise_acc_montgomery(w : Poly, u : Polyvecl, v : Polyvecl) -> Unit
    Pointwise multiply vectors of polynomials of length L, multiply resulting vector by 2^{-32} and add (accumulate) polynomials in it. Input/output vectors are in NTT domain representation. Input coefficients are assumed to be less than 22Q. Output coefficient are less than 2L*Q.

    Polyvecl::pointwise_poly_montgomery

    source
    fn Polyvecl::pointwise_poly_montgomery(r : Polyvecl, a : Poly, v : Polyvecl) -> Unit

    Polyvecl::reduce

    source
    fn Polyvecl::reduce(v : Polyvecl) -> Unit

    Polyvecl::uniform_eta

    source
    fn Polyvecl::uniform_eta(v : Polyvecl, seed : Array[Byte], nonce : UInt16) -> Unit

    Polyvecl::uniform_gamma1

    source
    fn Polyvecl::uniform_gamma1(v : Polyvecl, seed : Array[Byte], nonce : UInt16) -> Unit

    SecurityLevel

    source
    pub(all) enum SecurityLevel {
      Dilithium2
      Dilithium3
      Dilithium5
    }

    SignError

    source
    type SignError

    CRHBYTES

    source
    let CRHBYTES : Int

    let D : Int

    let N : Int

    POLYT0_PACKEDBYTES

    source
    let POLYT0_PACKEDBYTES : Int

    POLYT1_PACKEDBYTES

    source
    let POLYT1_PACKEDBYTES : Int

    POLY_UNIFORM_NBLOCKS

    source
    let POLY_UNIFORM_NBLOCKS : UInt

    let Q : Int

    SEEDBYTES

    source
    let SEEDBYTES : Int

    SHAKE128_RATE

    source
    let SHAKE128_RATE : UInt
    SHAKE128 rate (block size) in bytes | SHAKE128 的比特率（块大小），以字节为单位

    SHAKE256_RATE

    source
    let SHAKE256_RATE : UInt
    SHAKE256 rate (block size) in bytes | SHAKE256 的比特率（块大小），以字节为单位

    STREAM128_BLOCKBYTES

    source
    let STREAM128_BLOCKBYTES : UInt

    STREAM256_BLOCKBYTES

    source
    let STREAM256_BLOCKBYTES : UInt

    caddq

    source
    fn caddq(a : Int) -> Int
    如果输入为负数，则加上Q

    decompose

    source
    fn decompose(a : Int) -> (Int, Int)
    a = a0 + a1 * 2 * gamma2 gamma2 = (Q - 1) / 32 or (Q - 1) / 88

    dilithium_context

    source
    let dilithium_context : DilithiumContext
    default random is very dangerous, please use your own random source

    dilithium_shake128_stream_init

    source
    fn dilithium_shake128_stream_init(state : KeccakState, seed : Array[Byte], nonce : UInt16) -> Unit

    dilithium_shake256_stream_init

    source
    fn dilithium_shake256_stream_init(state : KeccakState, seed : Array[Byte], nonce : UInt16) -> Unit

    inv_ntt_to_mont

    source
    fn inv_ntt_to_mont(a : Array[Int]) -> Unit
    Inverse Number Theoretic Transform (INTT) 逆向数论变换 (INTT)

    Performs in-place inverse NTT with Montgomery factor multiplication. 执行原地逆向 NTT 并乘以蒙哥马利因子。

    Algorithm details / 算法细节:
    • Decimation-in-time (DIT) butterfly operations / 时域抽取蝶形运算
    • Uses negative twiddle factors / 使用负旋转因子
    • Final multiplication by F = (R^2/N) mod Q / 最终乘以 F = (R^2/N) mod Q
    • No modular reduction during butterfly operations / 蝶形运算期间不进行模约简

    The factor F serves three purposes / 因子 F 有三个作用:
    1. Divide by N to normalize the transform / 除以 N 来归一化变换
    2. Multiply by R to keep result in Montgomery domain / 乘以 R 保持结果在蒙哥马利域
    3. Multiply by R again to compensate for Montgomery reduction / 再乘以 R 补偿蒙哥马利约简

    Complexity / 复杂度: O(N log N) where N = 256

    Arguments / 参数:
    • a: input/output coefficient array (length 256) / 输入/输出系数数组（长度256）

    Preconditions / 前置条件:
    • Input is in bit-reversed order (output of NTT) / 输入为比特翻转顺序（NTT的输出）
    • Input coefficients < Q in absolute value / 输入系数绝对值 < Q

    Postconditions / 后置条件:
    • Output is in standard order / 输出为标准顺序
    • Output coefficients < Q in absolute value / 输出系数绝对值 < Q
    • Result remains in Montgomery domain / 结果保持在蒙哥马利域中

    ite

    source
    fn ite(cond : Bool, a : Int, b : Int) -> Int

    keccakf1600_statepermute

    source
    fn keccakf1600_statepermute(state : FixedArray[UInt64]) -> Unit
    Keccak-f[1600] permutation function | Keccak-f[1600] 置换函数 Applies the complete Keccak permutation to the state 对状态应用完整的 Keccak 置换

    keypair_gen

    source
    fn keypair_gen(seed : Result[Array[Byte], 
    Rand    ]) -> (Array[Byte], Array[Byte])
    return (public key, secret key)

    load64

    source
    fn load64(x : Array[Byte]) -> UInt64
    Load 64-bit integer from 8-byte array (little-endian) | 从 8 字节数组加载 64 位整数（小端序）

    make_hint

    source
    fn make_hint(a0 : Int, a1 : Int) -> Byte

    montgomery_reduce

    source
    fn montgomery_reduce(a : Int64) -> Int
    将 a 从蒙哥马利域转换到普通域 return a * R^-1 % Q

    ntt

    source
    fn ntt(a : Array[Int]) -> Unit
    Forward Number Theoretic Transform (NTT) 正向数论变换 (NTT)

    Performs in-place Cooley-Tukey NTT using Montgomery arithmetic. 使用蒙哥马利算术执行原地 Cooley-Tukey NTT。

    Algorithm details / 算法细节:
    • Decimation-in-frequency (DIF) butterfly operations / 频域抽取蝶形运算
    • No modular reduction after additions/subtractions / 加减法后不进行模约简
    • Output is in bit-reversed order / 输出为比特翻转顺序
    • All coefficients remain in Montgomery domain / 所有系数保持在蒙哥马利域中

    Arguments / 参数:
    • a: input/output coefficient array (length 256) / 输入/输出系数数组（长度256）

    pack_pk

    source
    fn pack_pk(rho : Array[Byte], t1 : Polyveck) -> Array[Byte]
    Bit-pack public key pk = (rho, t1).

    pack_sig

    source
    fn pack_sig(sig : Array[Byte], c : Array[Byte]?, z : Polyvecl, h : Polyveck) -> Array[Byte]
    Bit-pack signature sig = (c, z, h).

    pack_sk

    source
    fn pack_sk(rho : Array[Byte], tr : Array[Byte], key : Array[Byte], t0 : Polyveck, s1 : Polyvecl, s2 : Polyveck) -> Array[Byte]
    Bit-pack secret key sk = (rho, key, tr, s1, s2, t0).

    polyvec_matrix_pointwise_montgomery

    source
    fn polyvec_matrix_pointwise_montgomery(t : Polyveck, mat : Array[Polyvecl], v : Polyvecl) -> Unit

    power2round

    source
    fn power2round(a : Int) -> (Int, Int)
    a = a0 + a1 * 2 ^ D

    randombytes

    source
    fn randombytes(rand : 
    Rand    , n : Int) -> Array[Byte]

    reduce32

    source
    fn reduce32(a : Int) -> Int
    对于一个有限域元素a, a <= 2 ^ {31} - 2 ^ {22} - 1, 计算 r \equiv a (mod Q), 满足 -6283009 <= r <= 6283008

    rej_eta

    source
    fn rej_eta(a : ArrayView[Int], len : Int, buf : Array[Byte], buflen : Int) -> UInt

    rej_uniform

    source
    fn rej_uniform(a : ArrayView[Int], len : Int, buf : Array[Byte], buflen : Int) -> Int
    Sample uniformly random coefficients in [0, Q-1] by performing rejection sampling on array of random bytes. Returns number of sampled coefficients. Can be smaller than len if not enough random bytes were given. 通过对随机字节数组执行拒绝采样来采样 [0, Q-1] 范围内的均匀随机系数。 返回采样系数的数量。如果给定的随机字节不够，可能小于 len。

    Arguments / 参数:
    • a: output array for coefficients / 系数的输出数组
    • len: number of coefficients to sample / 要采样的系数数量
    • buf: input buffer of random bytes / 随机字节的输入缓冲区
    • buflen: length of input buffer / 输入缓冲区的长度

    Returns / 返回: number of coefficients successfully sampled / 成功采样的系数数量

    shake128_absorb

    source
    fn shake128_absorb(state : KeccakState, input : Array[Byte], inlen : UInt) -> Unit
    SHAKE128 incremental absorb | SHAKE128 增量吸收 Absorbs input data into SHAKE128 state 将输入数据吸收到 SHAKE128 状态中

    shake128_finalize

    source
    fn shake128_finalize(state : KeccakState) -> Unit
    SHAKE128 finalize | SHAKE128 完成 Finalizes SHAKE128 absorb phase with proper padding 使用适当的填充完成 SHAKE128 吸收阶段

    shake128_squeezeblocks

    source
    fn shake128_squeezeblocks(output : ArrayView[Byte], nblocks : UInt, s : KeccakState) -> Unit
    SHAKE128 squeeze blocks | SHAKE128 挤压块 Squeezes full blocks from SHAKE128 state 从 SHAKE128 状态挤压完整块

    shake256

    source
    fn shake256(output~ : Array[Byte], outlen : UInt, input~ : Array[Byte], inlen : UInt) -> Unit
    SHAKE256 complete operation | SHAKE256 完整操作 Performs complete SHAKE256 hash: absorb input and squeeze output 执行完整的 SHAKE256 哈希：吸收输入并挤压输出

    shake256_absorb

    source
    fn shake256_absorb(state : KeccakState, input : Array[Byte], inlen : UInt) -> Unit
    SHAKE256 incremental absorb | SHAKE256 增量吸收 Absorbs input data into SHAKE256 state 将输入数据吸收到 SHAKE256 状态中

    shake256_absorb_once

    source
    fn shake256_absorb_once(state : KeccakState, input : Array[Byte], inlen : UInt) -> Unit
    SHAKE256 one-shot absorb | SHAKE256 一次性吸收 Non-incremental SHAKE256 absorb for convenience 为方便使用的非增量 SHAKE256 吸收

    shake256_finalize

    source
    fn shake256_finalize(state : KeccakState) -> Unit
    SHAKE256 finalize | SHAKE256 完成 Finalizes SHAKE256 absorb phase with proper padding 使用适当的填充完成 SHAKE256 吸收阶段

    shake256_squeeze

    source
    fn shake256_squeeze(out : ArrayView[Byte], outlen : UInt, state : KeccakState) -> Unit
    SHAKE256 squeeze arbitrary bytes | SHAKE256 挤压任意字节 Squeezes any number of bytes from SHAKE256 state 从 SHAKE256 状态挤压任意数量的字节

    shake256_squeezeblocks

    source
    fn shake256_squeezeblocks(out : Array[Byte], nblocks : UInt, state : KeccakState) -> Unit
    SHAKE256 squeeze blocks | SHAKE256 挤压块 Squeezes full blocks from SHAKE256 state 从 SHAKE256 状态挤压完整块

    sign

    source
    fn sign(m : Array[Byte], sk : Array[Byte]) -> Array[Byte]
    (m, sk) -> sig

    store64

    source
    fn store64(x : Array[Byte], u : UInt64) -> Unit
    Store 64-bit integer to 8-byte array (little-endian) | 将 64 位整数存储到 8 字节数组（小端序）

    stream128_init

    source
    fn stream128_init(state : KeccakState, seed : Array[Byte], nonce : UInt16) -> Unit

    stream128_squeezeblocks

    source
    fn stream128_squeezeblocks(out : ArrayView[Byte], outblocks : UInt64, state : KeccakState) -> Unit

    stream256_init

    source
    fn stream256_init(state : KeccakState, seed : Array[Byte], nonce : UInt16) -> Unit

    stream256_squeezeblocks

    source
    fn stream256_squeezeblocks(out : Array[Byte], outblocks : UInt64, state : KeccakState) -> Unit

    unpack_pk

    source
    fn unpack_pk(pk : Array[Byte]) -> (Array[Byte], Polyveck)
    Unpack public key pk = (rho, t1).

    unpack_sig

    source
    fn unpack_sig(sig : Array[Byte]) -> Result[(Polyvecl, Polyveck, Array[Byte]), SignError]
    Unpack signature sig = (z, h, c).

    unpack_sk

    source
    fn unpack_sk(sk : Array[Byte]) -> (Array[Byte], Array[Byte], Array[Byte], Polyveck, Polyvecl, Polyveck)
    Unpack secret key sk = (rho, key, tr, t0, s1, s2).

    use_hint

    source
    fn use_hint(a : Int, hint : Byte) -> Int

    verify

    source
    fn verify(sig : Array[Byte], m : Array[Byte], pk : Array[Byte]) -> Result[Unit, SignError]

    Source Files

    Powered by MoonBit

    Site sourceReport issuePackagesBuild queueSkillsStatistics

    © 2026 mooncakes.io