32 lines
714 B
Text
32 lines
714 B
Text
/* Zupt — ML-KEM Constant-Time Select (Jasmin)
|
||
* Copyright (c) 2026 Cristian Cezar Moisés
|
||
* SPDX-License-Identifier: AGPL-3.0-or-later
|
||
*
|
||
* CT-REQUIRED: FO implicit rejection must not leak via timing.
|
||
* Operates in u64 chunks: 4 × 8 = 32 bytes, no byte access.
|
||
*/
|
||
|
||
export fn zupt_ct_select_32(
|
||
reg u64 out_ptr,
|
||
reg u64 a_ptr,
|
||
reg u64 b_ptr,
|
||
reg u64 cond)
|
||
{
|
||
reg u64 mask va vb tmp sel;
|
||
inline int i;
|
||
|
||
mask = 0;
|
||
mask -= cond;
|
||
|
||
/* 4 × u64 = 32 bytes */
|
||
for i = 0 to 4 {
|
||
va = [a_ptr + 8 * i];
|
||
vb = [b_ptr + 8 * i];
|
||
tmp = va;
|
||
tmp ^= vb;
|
||
tmp &= mask;
|
||
sel = va;
|
||
sel ^= tmp;
|
||
[out_ptr + 8 * i] = sel;
|
||
}
|
||
}
|