ErrorCorrection.java

package org.bouncycastle.pqc.crypto.newhope;

import org.bouncycastle.util.Arrays;

class ErrorCorrection
{
    static int abs(int v)
    {
        int mask = v >> 31;
        return (v ^ mask) - mask;
    }

    static int f(int[] v, int off0, int off1, int x)
    {
        int xit, t, r, b;

        // Next 6 lines compute t = x/Params.Q;
        b = x * 2730;
        t = b >> 25;
        b = x - t * Params.Q;
        b = 12288 - b;
        b >>= 31;
        t -= b;

        r = t & 1;
        xit =  t >> 1;
        v[off0] = xit + r; // v0 = round(x/(2*Params.Q))

        t -= 1;
        r = t & 1;
        v[off1] = (t >> 1) + r;

        return abs(x-((v[off0]) * 2 * Params.Q));
    }

    static int g(int x)
    {
        int t, c, b;

        // Next 6 lines compute t = x/(4 * Params.Q);
        b = x * 2730;
        t = b >> 27;
        b = x - t * 49156;
        b = 49155 - b;
        b >>= 31;
        t -= b;

        c = t & 1;
        t = (t >> 1) + c; // t = round(x/(8 * Params.Q))

        t *= 8 * Params.Q;

        return abs(t - x);
    }

    static void helpRec(short[] c, short[] v, byte[] seed, byte nonce)
    {
        byte[] iv = new byte[8];
//        iv[7] = nonce;
        iv[0] = nonce;

        byte[] rand = new byte[32];
        ChaCha20.process(seed, iv, rand, 0, rand.length);

//      int32_t v0[4], v1[4], v_tmp[4], k;
        int[] vs = new int[8], vTmp = new int[4];
        int k;

        for (int i = 0; i < 256; ++i)
        {
            int rBit = (rand[i >>> 3] >>> (i & 7)) & 1;

            k  = f(vs, 0, 4, 8 * v[  0 + i] + 4 * rBit);
            k += f(vs, 1, 5, 8 * v[256 + i] + 4 * rBit);
            k += f(vs, 2, 6, 8 * v[512 + i] + 4 * rBit);
            k += f(vs, 3, 7, 8 * v[768 + i] + 4 * rBit);

            k = (2 * Params.Q - 1 - k) >> 31;

            vTmp[0] = ((~k) & vs[0]) ^ (k & vs[4]);
            vTmp[1] = ((~k) & vs[1]) ^ (k & vs[5]);
            vTmp[2] = ((~k) & vs[2]) ^ (k & vs[6]);
            vTmp[3] = ((~k) & vs[3]) ^ (k & vs[7]);

            c[  0 + i] = (short)((vTmp[0] -     vTmp[3]) & 3);  
            c[256 + i] = (short)((vTmp[1] -     vTmp[3]) & 3);
            c[512 + i] = (short)((vTmp[2] -     vTmp[3]) & 3);
            c[768 + i] = (short)((   -k   + 2 * vTmp[3]) & 3);
        }
    }

    static short LDDecode(int xi0, int xi1, int xi2, int xi3)
    {
        int t;

        t  = g(xi0);
        t += g(xi1);
        t += g(xi2);
        t += g(xi3);

        t -= 8 * Params.Q;

        return (short)(t >>> 31);
    }

    static void rec(byte[] key, short[] v, short[] c)
    {
        Arrays.fill(key, (byte)0);

        int[] tmp = new int[4];
        for(int i = 0; i < 256; ++i)
        {
            tmp[0] = 16 * Params.Q + 8 * (int)v[  0 + i] - Params.Q * (2 * c[  0 + i] + c[768 + i]);
            tmp[1] = 16 * Params.Q + 8 * (int)v[256 + i] - Params.Q * (2 * c[256 + i] + c[768 + i]);
            tmp[2] = 16 * Params.Q + 8 * (int)v[512 + i] - Params.Q * (2 * c[512 + i] + c[768 + i]);
            tmp[3] = 16 * Params.Q + 8 * (int)v[768 + i] - Params.Q * (                 c[768 + i]);

            key[i >>> 3] |= LDDecode(tmp[0], tmp[1], tmp[2], tmp[3]) << (i & 7);
        }
    }
}