Working towards a F7 template for benchmarking masked implementations

src-ascon/ascon/.clang-format

+---
+Language:        Cpp
+# BasedOnStyle:  Google
+AccessModifierOffset: -1
+AlignAfterOpenBracket: Align
+AlignConsecutiveMacros: false
+AlignConsecutiveAssignments: false
+AlignConsecutiveDeclarations: false
+AlignEscapedNewlines: Left
+AlignOperands:   true
+AlignTrailingComments: true
+AllowAllArgumentsOnNextLine: true
+AllowAllConstructorInitializersOnNextLine: true
+AllowAllParametersOfDeclarationOnNextLine: true
+AllowShortBlocksOnASingleLine: Never
+AllowShortCaseLabelsOnASingleLine: false
+AllowShortFunctionsOnASingleLine: All
+AllowShortLambdasOnASingleLine: All
+AllowShortIfStatementsOnASingleLine: WithoutElse
+AllowShortLoopsOnASingleLine: true
+AlwaysBreakAfterDefinitionReturnType: None
+AlwaysBreakAfterReturnType: None
+AlwaysBreakBeforeMultilineStrings: true
+AlwaysBreakTemplateDeclarations: Yes
+BinPackArguments: true
+BinPackParameters: true
+BraceWrapping:
+  AfterCaseLabel:  false
+  AfterClass:      false
+  AfterControlStatement: false
+  AfterEnum:       false
+  AfterFunction:   false
+  AfterNamespace:  false
+  AfterObjCDeclaration: false
+  AfterStruct:     false
+  AfterUnion:      false
+  AfterExternBlock: false
+  BeforeCatch:     false
+  BeforeElse:      false
+  IndentBraces:    false
+  SplitEmptyFunction: true
+  SplitEmptyRecord: true
+  SplitEmptyNamespace: true
+BreakBeforeBinaryOperators: None
+BreakBeforeBraces: Attach
+BreakBeforeInheritanceComma: false
+BreakInheritanceList: BeforeColon
+BreakBeforeTernaryOperators: true
+BreakConstructorInitializersBeforeComma: false
+BreakConstructorInitializers: BeforeColon
+BreakAfterJavaFieldAnnotations: false
+BreakStringLiterals: true
+ColumnLimit:     80
+CommentPragmas:  '^ IWYU pragma:'
+CompactNamespaces: false
+ConstructorInitializerAllOnOneLineOrOnePerLine: true
+ConstructorInitializerIndentWidth: 4
+ContinuationIndentWidth: 4
+Cpp11BracedListStyle: true
+DeriveLineEnding: true
+DerivePointerAlignment: true
+DisableFormat:   false
+ExperimentalAutoDetectBinPacking: false
+FixNamespaceComments: true
+ForEachMacros:
+  - foreach
+  - Q_FOREACH
+  - BOOST_FOREACH
+IncludeBlocks:   Regroup
+IncludeCategories:
+  - Regex:           '^<ext/.*\.h>'
+    Priority:        2
+    SortPriority:    0
+  - Regex:           '^<.*\.h>'
+    Priority:        1
+    SortPriority:    0
+  - Regex:           '^<.*'
+    Priority:        2
+    SortPriority:    0
+  - Regex:           '.*'
+    Priority:        3
+    SortPriority:    0
+IncludeIsMainRegex: '([-_](test|unittest))?$'
+IncludeIsMainSourceRegex: ''
+IndentCaseLabels: true
+IndentGotoLabels: true
+IndentPPDirectives: None
+IndentWidth:     2
+IndentWrappedFunctionNames: false
+JavaScriptQuotes: Leave
+JavaScriptWrapImports: true
+KeepEmptyLinesAtTheStartOfBlocks: false
+MacroBlockBegin: ''
+MacroBlockEnd:   ''
+MaxEmptyLinesToKeep: 1
+NamespaceIndentation: None
+ObjCBinPackProtocolList: Never
+ObjCBlockIndentWidth: 2
+ObjCSpaceAfterProperty: false
+ObjCSpaceBeforeProtocolList: true
+PenaltyBreakAssignment: 2
+PenaltyBreakBeforeFirstCallParameter: 1
+PenaltyBreakComment: 300
+PenaltyBreakFirstLessLess: 120
+PenaltyBreakString: 1000
+PenaltyBreakTemplateDeclaration: 10
+PenaltyExcessCharacter: 1000000
+PenaltyReturnTypeOnItsOwnLine: 200
+PointerAlignment: Left
+RawStringFormats:
+  - Language:        Cpp
+    Delimiters:
+      - cc
+      - CC
+      - cpp
+      - Cpp
+      - CPP
+      - 'c++'
+      - 'C++'
+    CanonicalDelimiter: ''
+    BasedOnStyle:    google
+  - Language:        TextProto
+    Delimiters:
+      - pb
+      - PB
+      - proto
+      - PROTO
+    EnclosingFunctions:
+      - EqualsProto
+      - EquivToProto
+      - PARSE_PARTIAL_TEXT_PROTO
+      - PARSE_TEST_PROTO
+      - PARSE_TEXT_PROTO
+      - ParseTextOrDie
+      - ParseTextProtoOrDie
+    CanonicalDelimiter: ''
+    BasedOnStyle:    google
+ReflowComments:  true
+SortIncludes:    true
+SortUsingDeclarations: true
+SpaceAfterCStyleCast: false
+SpaceAfterLogicalNot: false
+SpaceAfterTemplateKeyword: true
+SpaceBeforeAssignmentOperators: true
+SpaceBeforeCpp11BracedList: false
+SpaceBeforeCtorInitializerColon: true
+SpaceBeforeInheritanceColon: true
+SpaceBeforeParens: ControlStatements
+SpaceBeforeRangeBasedForLoopColon: true
+SpaceInEmptyBlock: false
+SpaceInEmptyParentheses: false
+SpacesBeforeTrailingComments: 2
+SpacesInAngles:  false
+SpacesInConditionalStatement: false
+SpacesInContainerLiterals: true
+SpacesInCStyleCastParentheses: false
+SpacesInParentheses: false
+SpacesInSquareBrackets: false
+SpaceBeforeSquareBrackets: false
+Standard:        Auto
+StatementMacros:
+  - Q_UNUSED
+  - QT_REQUIRE_VERSION
+TabWidth:        8
+UseCRLF:         false
+UseTab:          Never
+...
+

src-ascon/ascon/Implementations/crypto_aead/ascon128v12/protected_bi32_armv6/aead.c

+#include "api.h"
+#include "ascon.h"
+#include "permutations.h"
+#include "printstate.h"
+
+void ascon_initaead(state_t* s, const mask_npub_uint32_t* n,
+                    const mask_key_uint32_t* k) {
+  word_t N0, N1;
+  word_t K1, K2;
+  /* randomize the initial state */
+  s->x[5] = MZERO(NUM_SHARES_KEY);
+  s->x[0] = MZERO(NUM_SHARES_KEY);
+  /* set the initial value */
+  s->x[0].s[0].w[0] ^= 0x08220000;
+  s->x[0].s[0].w[1] ^= 0x80210000;
+  /* set the nonce */
+  s->x[3] = N0 = MLOAD((uint32_t*)n, NUM_SHARES_NPUB);
+  s->x[4] = N1 = MLOAD((uint32_t*)(n + 2), NUM_SHARES_NPUB);
+  /* first key xor */
+  s->x[1] = K1 = MLOAD((uint32_t*)k, NUM_SHARES_KEY);
+  s->x[2] = K2 = MLOAD((uint32_t*)(k + 2), NUM_SHARES_KEY);
+  printstate("init 1st key xor", s, NUM_SHARES_KEY);
+  /* compute the permutation */
+  P(s, ASCON_PA_ROUNDS, NUM_SHARES_KEY);
+  /* second key xor */
+  s->x[3] = MXOR(s->x[3], K1, NUM_SHARES_KEY);
+  s->x[4] = MXOR(s->x[4], K2, NUM_SHARES_KEY);
+  printstate("init 2nd key xor", s, NUM_SHARES_KEY);
+}
+
+void ascon_adata(state_t* s, const mask_ad_uint32_t* ad, uint64_t adlen) {
+  const int nr = ASCON_PB_ROUNDS;
+  if (adlen) {
+    /* full associated data blocks */
+    while (adlen >= ASCON_AEAD_RATE) {
+      word_t as = MLOAD((uint32_t*)ad, NUM_SHARES_AD);
+      s->x[0] = MXOR(s->x[0], as, NUM_SHARES_AD);
+      printstate("absorb adata", s, NUM_SHARES_AD);
+      P(s, nr, NUM_SHARES_AD);
+      adlen -= ASCON_AEAD_RATE;
+      ad += 2;
+    }
+    /* final associated data block */
+    s->x[0].s[0].w[1] ^= 0x80000000 >> (adlen * 4);
+    if (adlen) {
+      word_t as = MLOAD((uint32_t*)ad, NUM_SHARES_AD);
+      s->x[0] = MXOR(s->x[0], as, NUM_SHARES_AD);
+    }
+    printstate("pad adata", s, NUM_SHARES_AD);
+    P(s, nr, NUM_SHARES_AD);
+  }
+  /* domain separation */
+  s->x[4].s[0].w[0] ^= 1;
+  printstate("domain separation", s, NUM_SHARES_AD);
+}
+
+void ascon_encrypt(state_t* s, mask_c_uint32_t* c, const mask_m_uint32_t* m,
+                   uint64_t mlen) {
+  const int nr = ASCON_PB_ROUNDS;
+  /* full plaintext blocks */
+  while (mlen >= ASCON_AEAD_RATE) {
+    word_t ms = MLOAD((uint32_t*)m, NUM_SHARES_M);
+    s->x[0] = MXOR(s->x[0], ms, NUM_SHARES_M);
+    MSTORE((uint32_t*)c, s->x[0], NUM_SHARES_C);
+    printstate("absorb plaintext", s, NUM_SHARES_M);
+    P(s, nr, NUM_SHARES_M);
+    mlen -= ASCON_AEAD_RATE;
+    m += 2;
+    c += 2;
+  }
+  /* final plaintext block */
+  s->x[0].s[0].w[1] ^= 0x80000000 >> (mlen * 4);
+  if (mlen) {
+    word_t ms = MLOAD((uint32_t*)m, NUM_SHARES_M);
+    s->x[0] = MXOR(s->x[0], ms, NUM_SHARES_M);
+    MSTORE((uint32_t*)c, s->x[0], NUM_SHARES_C);
+  }
+  printstate("pad plaintext", s, NUM_SHARES_M);
+}
+
+void ascon_decrypt(state_t* s, mask_m_uint32_t* m, const mask_c_uint32_t* c,
+                   uint64_t clen) {
+  const int nr = ASCON_PB_ROUNDS;
+  /* full ciphertext blocks */
+  while (clen >= ASCON_AEAD_RATE) {
+    word_t cx = MLOAD((uint32_t*)c, NUM_SHARES_C);
+    s->x[0] = MXOR(s->x[0], cx, NUM_SHARES_C);
+    MSTORE((uint32_t*)m, s->x[0], NUM_SHARES_M);
+    s->x[0] = cx;
+    printstate("insert ciphertext", s, NUM_SHARES_M);
+    P(s, nr, NUM_SHARES_M);
+    clen -= ASCON_AEAD_RATE;
+    c += 2;
+    m += 2;
+  }
+  /* final ciphertext block */
+  s->x[0].s[0].w[1] ^= 0x80000000 >> (clen * 4);
+  if (clen) {
+    word_t cx = MLOAD((uint32_t*)c, NUM_SHARES_C);
+    s->x[0] = MXOR(s->x[0], cx, NUM_SHARES_C);
+    MSTORE((uint32_t*)m, s->x[0], NUM_SHARES_M);
+    word_t mask = MMASK(clen, NUM_SHARES_C);
+    s->x[0] = MXORAND(cx, s->x[0], mask, NUM_SHARES_C);
+  }
+  printstate("pad ciphertext", s, NUM_SHARES_M);
+}
+
+void ascon_final(state_t* s, const mask_key_uint32_t* k) {
+  word_t K1, K2;
+  K1 = MLOAD((uint32_t*)k, NUM_SHARES_KEY);
+  K2 = MLOAD((uint32_t*)(k + 2), NUM_SHARES_KEY);
+  /* first key xor (first 64-bit word) */
+  s->x[1] = MXOR(s->x[1], K1, NUM_SHARES_KEY);
+  /* first key xor (second 64-bit word) */
+  s->x[2] = MXOR(s->x[2], K2, NUM_SHARES_KEY);
+  printstate("final 1st key xor", s, NUM_SHARES_KEY);
+  /* compute the permutation */
+  P(s, ASCON_PA_ROUNDS, NUM_SHARES_KEY);
+  /* second key xor (first 64-bit word) */
+  s->x[3] = MXOR(s->x[3], K1, NUM_SHARES_KEY);
+  /* second key xor (second 64-bit word) */
+  s->x[4] = MXOR(s->x[4], K2, NUM_SHARES_KEY);
+  printstate("final 2nd key xor", s, NUM_SHARES_KEY);
+}
+
+void ascon_settag(state_t* s, mask_c_uint32_t* t) {
+  MSTORE((uint32_t*)t, s->x[3], NUM_SHARES_C);
+  MSTORE((uint32_t*)(t + 2), s->x[4], NUM_SHARES_C);
+}
+
+/* expected value of x3,x4 for P(0) */
+#if ASCON_PB_ROUNDS == 1
+static const uint32_t c[4] = {0x4b000009, 0x1c800003, 0x00000000, 0x00000000};
+#elif ASCON_PB_ROUNDS == 2
+static const uint32_t c[4] = {0x5d2d1034, 0x76fa81d1, 0x0cc1c9ef, 0xdb30a503};
+#elif ASCON_PB_ROUNDS == 3
+static const uint32_t c[4] = {0xbcaa1d46, 0xf1d0bde9, 0x32c4e651, 0x7b797cd9};
+#elif ASCON_PB_ROUNDS == 4
+static const uint32_t c[4] = {0xf7820616, 0xeffead2d, 0x94846901, 0xd4895cf5};
+#elif ASCON_PB_ROUNDS == 5
+static const uint32_t c[4] = {0x9e5ce5e3, 0xd40e9b87, 0x0bfc74af, 0xf8e408a9};
+#else /* ASCON_PB_ROUNDS == 6 */
+static const uint32_t c[4] = {0x11874f08, 0x7520afef, 0xa4dd41b4, 0x4bd6f9a4};
+#endif
+
+void ascon_xortag(state_t* s, const mask_c_uint32_t* t) {
+  /* set x0, x1, x2 to zero */
+  s->x[0] = MREUSE(s->x[0], 0, NUM_SHARES_KEY);
+  s->x[1] = MREUSE(s->x[1], 0, NUM_SHARES_KEY);
+  s->x[2] = MREUSE(s->x[2], 0, NUM_SHARES_KEY);
+  /* xor tag to x3, x4 */
+  word_t t0 = MLOAD((uint32_t*)t, NUM_SHARES_C);
+  s->x[3] = MXOR(s->x[3], t0, NUM_SHARES_C);
+  word_t t1 = MLOAD((uint32_t*)(t + 2), NUM_SHARES_C);
+  s->x[4] = MXOR(s->x[4], t1, NUM_SHARES_C);
+  /* compute P(0) if tags are equal */
+  P(s, ASCON_PB_ROUNDS, NUM_SHARES_KEY);
+  /* xor expected result to x3, x4 */
+  s->x[3].s[0].w[0] ^= c[0];
+  s->x[3].s[0].w[1] ^= c[1];
+  s->x[4].s[0].w[0] ^= c[2];
+  s->x[4].s[0].w[1] ^= c[3];
+}
+
+int ascon_iszero(state_t* s) {
+#if NUM_SHARES_KEY >= 2
+  s->x[3].s[0].w[0] ^= ROR32(s->x[3].s[1].w[0], ROT(1));
+  s->x[3].s[0].w[1] ^= ROR32(s->x[3].s[1].w[1], ROT(1));
+  s->x[4].s[0].w[0] ^= ROR32(s->x[4].s[1].w[0], ROT(1));
+  s->x[4].s[0].w[1] ^= ROR32(s->x[4].s[1].w[1], ROT(1));
+#endif
+#if NUM_SHARES_KEY >= 3
+  s->x[3].s[0].w[0] ^= ROR32(s->x[3].s[2].w[0], ROT(2));
+  s->x[3].s[0].w[1] ^= ROR32(s->x[3].s[2].w[1], ROT(2));
+  s->x[4].s[0].w[0] ^= ROR32(s->x[4].s[2].w[0], ROT(2));
+  s->x[4].s[0].w[1] ^= ROR32(s->x[4].s[2].w[1], ROT(2));
+#endif
+#if NUM_SHARES_KEY >= 4
+  s->x[3].s[0].w[0] ^= ROR32(s->x[3].s[3].w[0], ROT(3));
+  s->x[3].s[0].w[1] ^= ROR32(s->x[3].s[3].w[1], ROT(3));
+  s->x[4].s[0].w[0] ^= ROR32(s->x[4].s[3].w[0], ROT(3));
+  s->x[4].s[0].w[1] ^= ROR32(s->x[4].s[3].w[1], ROT(3));
+#endif
+  uint32_t result;
+  result = s->x[3].s[0].w[0] ^ s->x[3].s[0].w[1];
+  result ^= s->x[4].s[0].w[0] ^ s->x[4].s[0].w[1];
+  result |= result >> 16;
+  result |= result >> 8;
+  return ((((int)(result & 0xff) - 1) >> 8) & 1) - 1;
+}
+
+int ascon_verify(state_t* s, const mask_c_uint32_t* t) {
+  ascon_xortag(s, t);
+  return ascon_iszero(s);
+}

src-ascon/ascon/Implementations/crypto_aead/ascon128v12/protected_bi32_armv6/api.h

+#define CRYPTO_VERSION "1.2.6"
+#define CRYPTO_KEYBYTES 16
+#define CRYPTO_NSECBYTES 0
+#define CRYPTO_NPUBBYTES 16
+#define CRYPTO_ABYTES 16
+#define CRYPTO_NOOVERLAP 1
+#define ASCON_AEAD_RATE 8
+
+#ifndef ASCON_ROR_SHARES
+#define ASCON_ROR_SHARES 5
+#endif
+
+#ifndef NUM_SHARES_M
+#define NUM_SHARES_M 1
+#endif
+
+#ifndef NUM_SHARES_C
+#define NUM_SHARES_C 1
+#endif
+
+#ifndef NUM_SHARES_AD
+#define NUM_SHARES_AD 1
+#endif
+
+#ifndef NUM_SHARES_NPUB
+#define NUM_SHARES_NPUB 1
+#endif
+
+#ifndef NUM_SHARES_KEY
+#define NUM_SHARES_KEY 1
+#endif

src-ascon/ascon/Implementations/crypto_aead/ascon128v12/protected_bi32_armv6/architectures

+arm

src-ascon/ascon/Implementations/crypto_aead/ascon128v12/protected_bi32_armv6/ascon.h

+#ifndef ASCON_H_
+#define ASCON_H_
+
+#include <stdint.h>
+
+#include "shares.h"
+#include "word.h"
+
+typedef struct {
+  word_t x[6];
+} state_t;
+
+void ascon_initaead(state_t* s, const mask_npub_uint32_t* n,
+                    const mask_key_uint32_t* k);
+void ascon_adata(state_t* s, const mask_ad_uint32_t* ad, uint64_t adlen);
+void ascon_encrypt(state_t* s, mask_c_uint32_t* c, const mask_m_uint32_t* m,
+                   uint64_t mlen);
+void ascon_decrypt(state_t* s, mask_m_uint32_t* m, const mask_c_uint32_t* c,
+                   uint64_t clen);
+void ascon_final(state_t* s, const mask_key_uint32_t* k);
+void ascon_settag(state_t* s, mask_c_uint32_t* t);
+int ascon_verify(state_t* s, const mask_c_uint32_t* t);
+
+void ascon_level_adata(state_t* s);
+void ascon_level_encdec(state_t* s);
+void ascon_level_final(state_t* s);
+
+#endif /* ASCON_H_ */

src-ascon/ascon/Implementations/crypto_aead/ascon128v12/protected_bi32_armv6/asm.h

+#ifndef ASM_H_
+#define ASM_H_
+
+#ifndef __GNUC__
+#define __asm__ asm
+#endif
+
+#define LDR(rd, ptr, offset) \
+  __asm__ volatile("ldr %0, [%1, %2]\n\t" : "=r"(rd) : "r"(ptr), "ri"(offset))
+
+#define STR(rd, ptr, offset)                                                \
+  __asm__ volatile("str %0, [%1, %2]\n\t" ::"r"(rd), "r"(ptr), "ri"(offset) \
+                   : "memory")
+
+#define CLEAR()                                            \
+  do {                                                     \
+    uint32_t r, i = 0;                                     \
+    __asm__ volatile("mov %0, %1\n\t" : "=r"(r) : "i"(i)); \
+  } while (0)
+
+#define MOVI(rd, imm) __asm__ volatile("mov %0, %1\n\t" : "=r"(rd) : "i"(imm))
+
+#define RORI(rd, rn, imm) \
+  __asm__ volatile("ror %0, %1, #%c2\n\t" : "=r"(rd) : "r"(rn), "i"(imm))
+
+#define EOR_ROR(rd, rn, rm, imm)                  \
+  __asm__ volatile("eor %0, %1, %2, ror #%c3\n\t" \
+                   : "=r"(rd)                     \
+                   : "r"(rn), "r"(rm), "i"(imm))
+
+#define EOR_AND_ROR(ce, ae, be, imm, tmp)                       \
+  __asm__ volatile(                                             \
+      "and %[tmp_], %[ae_], %[be_], ror %[i1_]\n\t"             \
+      "eor %[ce_], %[tmp_], %[ce_]\n\t"                         \
+      : [ ce_ ] "+r"(ce), [ tmp_ ] "=r"(tmp)                    \
+      : [ ae_ ] "r"(ae), [ be_ ] "r"(be), [ i1_ ] "i"(ROT(imm)) \
+      :)
+
+#define EOR_BIC_ROR(ce, ae, be, imm, tmp)                       \
+  __asm__ volatile(                                             \
+      "bic %[tmp_], %[ae_], %[be_], ror %[i1_]\n\t"             \
+      "eor %[ce_], %[tmp_], %[ce_]\n\t"                         \
+      : [ ce_ ] "+r"(ce), [ tmp_ ] "=r"(tmp)                    \
+      : [ ae_ ] "r"(ae), [ be_ ] "r"(be), [ i1_ ] "i"(ROT(imm)) \
+      :)
+
+#define EOR_ORR_ROR(ce, ae, be, imm, tmp)                       \
+  __asm__ volatile(                                             \
+      "orr %[tmp_], %[ae_], %[be_], ror %[i1_]\n\t"             \
+      "eor %[ce_], %[tmp_], %[ce_]\n\t"                         \
+      : [ ce_ ] "+r"(ce), [ tmp_ ] "=r"(tmp)                    \
+      : [ ae_ ] "r"(ae), [ be_ ] "r"(be), [ i1_ ] "i"(ROT(imm)) \
+      :)
+
+#endif  // ASM_H_

src-ascon/ascon/Implementations/crypto_aead/ascon128v12/protected_bi32_armv6/config.h

+#ifndef CONFIG_H_
+#define CONFIG_H_
+
+#include "api.h"
+
+/* extern bit interleaving */
+#ifndef ASCON_EXTERN_BI
+#define ASCON_EXTERN_BI 0
+#endif
+
+/* number of PA rounds */
+#ifndef ASCON_PA_ROUNDS
+#define ASCON_PA_ROUNDS 12
+#endif
+
+/* number of PB rounds */
+#ifndef ASCON_PB_ROUNDS
+#define ASCON_PB_ROUNDS 6
+#endif
+
+#if NUM_SHARES_M != NUM_SHARES_KEY
+#error "NUM_SHARES_M != NUM_SHARES_KEY currently not supported"
+#endif
+
+#if NUM_SHARES_C != NUM_SHARES_M
+#error "NUM_SHARES_C != NUM_SHARES_M currently not supported"
+#endif
+
+#if NUM_SHARES_AD != NUM_SHARES_M
+#error "NUM_SHARES_AD != NUM_SHARES_M currently not supported"
+#endif
+
+#if NUM_SHARES_NPUB != NUM_SHARES_KEY
+#error "NUM_SHARES_NPUB != NUM_SHARES_KEY currently not supported"
+#endif
+
+#endif /* CONFIG_H_ */

src-ascon/ascon/Implementations/crypto_aead/ascon128v12/protected_bi32_armv6/constants.c

+#include "constants.h"
+
+const uint8_t constants[] = {0xc, 0xc, 0x9, 0xc, 0xc, 0x9, 0x9, 0x9,
+                             0x6, 0xc, 0x3, 0xc, 0x6, 0x9, 0x3, 0x9,
+                             0xc, 0x6, 0x9, 0x6, 0xc, 0x3, 0x9, 0x3};

src-ascon/ascon/Implementations/crypto_aead/ascon128v12/protected_bi32_armv6/constants.h

+#ifndef CONSTANTS_H_
+#define CONSTANTS_H_
+
+#include <stdint.h>
+
+#define ASCON_128_KEYBYTES 16
+#define ASCON_128A_KEYBYTES 16
+#define ASCON_80PQ_KEYBYTES 20
+
+#define ASCON_128_RATE 8
+#define ASCON_128A_RATE 16
+#define ASCON_HASH_RATE 8
+#define ASCON_PRF_IN_RATE 32
+#define ASCON_PRF_OUT_RATE 16
+
+#define ASCON_128_PA_ROUNDS 12
+#define ASCON_128_PB_ROUNDS 6
+
+#define ASCON_128A_PA_ROUNDS 12
+#define ASCON_128A_PB_ROUNDS 8
+
+#define ASCON_HASH_PA_ROUNDS 12
+#define ASCON_HASH_PB_ROUNDS 12
+
+#define ASCON_HASHA_PA_ROUNDS 12
+#define ASCON_HASHA_PB_ROUNDS 8
+
+#define ASCON_PRF_PA_ROUNDS 12
+#define ASCON_PRF_PB_ROUNDS 12
+
+#define ASCON_128_IV 0x8021000008220000ull
+#define ASCON_128A_IV 0x8822000000200000ull
+#define ASCON_80PQ_IV 0xc021000008220000ull
+
+#define ASCON_HASH_IV 0x0020000008200010ull
+#define ASCON_HASHA_IV 0x0020000008220010ull
+#define ASCON_XOF_IV 0x0020000008200000ull
+#define ASCON_XOFA_IV 0x0020000008220000ull
+
+#define ASCON_PRF_IV 0x88a0000000200000ull
+#define ASCON_MAC_IV 0x88a0000800200000ull
+#define ASCON_PRFS_IV 0x8028000000a00000ull
+
+#define ASCON_HASH_IV0 0xf9afb5c6a540dbc7ull
+#define ASCON_HASH_IV1 0xbd2493011445a340ull
+#define ASCON_HASH_IV2 0xcb9ba8b5604d4fc8ull
+#define ASCON_HASH_IV3 0x12a4eede94514c98ull
+#define ASCON_HASH_IV4 0x4bca84c06339f398ull
+
+#define ASCON_HASHA_IV0 0x0108e46d1b16eb02ull
+#define ASCON_HASHA_IV1 0x5b9b8efdd29083f3ull
+#define ASCON_HASHA_IV2 0x7ad665622891ae4aull
+#define ASCON_HASHA_IV3 0x9dc27156ee3bfc7full
+#define ASCON_HASHA_IV4 0xc61d5fa916801633ull
+
+#define ASCON_XOF_IV0 0xc75782817e351ae6ull
+#define ASCON_XOF_IV1 0x70045f441d238220ull
+#define ASCON_XOF_IV2 0x5dd5ab52a13e3f04ull
+#define ASCON_XOF_IV3 0x3e378142c30c1db2ull
+#define ASCON_XOF_IV4 0x3735189db624d656ull
+
+#define ASCON_XOFA_IV0 0x0846d7a5a4b87d44ull
+#define ASCON_XOFA_IV1 0xaa6f1005b3a2dbf4ull
+#define ASCON_XOFA_IV2 0xdc451146f713e811ull
+#define ASCON_XOFA_IV3 0x468cb2532839e30dull
+#define ASCON_XOFA_IV4 0xeb2d429709e96977ull
+
+#define RC0 0x0000000c0000000cull
+#define RC1 0x0000000c00000009ull
+#define RC2 0x000000090000000cull
+#define RC3 0x0000000900000009ull
+#define RC4 0x0000000c00000006ull
+#define RC5 0x0000000c00000003ull
+#define RC6 0x0000000900000006ull
+#define RC7 0x0000000900000003ull
+#define RC8 0x000000060000000cull
+#define RC9 0x0000000600000009ull
+#define RCa 0x000000030000000cull
+#define RCb 0x0000000300000009ull
+
+#define RC(i) constants[2 * i + 1], constants[2 * i + 0]
+
+#define START(n) (12 - (n))
+#define INC 1
+#define END 12
+
+extern const uint8_t constants[];
+
+#endif /* CONSTANTS_H_ */

src-ascon/ascon/Implementations/crypto_aead/ascon128v12/protected_bi32_armv6/crypto_aead.c

+#include "crypto_aead.h"
+
+#include <stdlib.h>
+
+#include "api.h"
+#include "crypto_aead_shared.h"
+
+#ifdef SS_VER
+#include "hal.h"
+#else
+#define trigger_high()
+#define trigger_low()
+#endif
+
+int crypto_aead_encrypt(unsigned char* c, unsigned long long* clen,
+                        const unsigned char* m, unsigned long long mlen,
+                        const unsigned char* a, unsigned long long alen,
+                        const unsigned char* nsec, const unsigned char* npub,
+                        const unsigned char* k) {
+  (void)nsec;
+  /* dynamic allocation of input/output shares */
+  mask_key_uint32_t* ks = malloc(sizeof(*ks) * NUM_WORDS(CRYPTO_KEYBYTES));
+  mask_npub_uint32_t* ns = malloc(sizeof(*ns) * NUM_WORDS(CRYPTO_NPUBBYTES));
+  mask_ad_uint32_t* as = malloc(sizeof(*as) * NUM_WORDS(alen));
+  mask_m_uint32_t* ms = malloc(sizeof(*ms) * NUM_WORDS(mlen));
+  mask_c_uint32_t* cs = malloc(sizeof(*cs) * NUM_WORDS(mlen + CRYPTO_ABYTES));
+  /* mask plain input data */
+  generate_shares_encrypt(m, ms, mlen, a, as, alen, npub, ns, k, ks);
+  /* call shared interface of ascon encrypt */
+  //trigger_high();
+  crypto_aead_encrypt_shared(cs, clen, ms, mlen, as, alen, ns, ks);
+  //trigger_low();
+  /* unmask shared output data */
+  combine_shares_encrypt(cs, c, *clen);
+  /* free shares */
+  free(ks);
+  free(ns);
+  free(as);
+  free(ms);
+  free(cs);
+  return 0;
+}
+
+int crypto_aead_decrypt(unsigned char* m, unsigned long long* mlen,
+                        unsigned char* nsec, const unsigned char* c,
+                        unsigned long long clen, const unsigned char* a,
+                        unsigned long long alen, const unsigned char* npub,
+                        const unsigned char* k) {
+  int result = 0;
+  (void)nsec;
+  if (clen < CRYPTO_ABYTES) return -1;
+  /* dynamic allocation of input/output shares */
+  mask_key_uint32_t* ks = malloc(sizeof(*ks) * NUM_WORDS(CRYPTO_KEYBYTES));
+  mask_npub_uint32_t* ns = malloc(sizeof(*ns) * NUM_WORDS(CRYPTO_NPUBBYTES));
+  mask_ad_uint32_t* as = malloc(sizeof(*as) * NUM_WORDS(alen));
+  mask_m_uint32_t* ms = malloc(sizeof(*ms) * NUM_WORDS(clen - CRYPTO_ABYTES));
+  mask_c_uint32_t* cs = malloc(sizeof(*cs) * NUM_WORDS(clen));
+  /* mask plain input data */
+  generate_shares_decrypt(c, cs, clen, a, as, alen, npub, ns, k, ks);
+  /* call shared interface of ascon decrypt */
+  //trigger_high();
+  result = crypto_aead_decrypt_shared(ms, mlen, cs, clen, as, alen, ns, ks);
+  //trigger_low();
+  /* unmask shared output data */
+  combine_shares_decrypt(ms, m, *mlen);
+  /* free shares */
+  free(ks);
+  free(ns);
+  free(as);
+  free(ms);
+  free(