Class GF16

java.lang.Object
org.bouncycastle.math.raw.GF16
public class GF16 extends Object

  • Constructor Summary

    Constructors
    Constructor
    Description
    GF16()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    static void
    decode(byte[] input, byte[] output, int outputLen)
    Decodes an encoded byte array.
    static void
    decode(byte[] input, int inOff, byte[] output, int outOff, int outputLen)
     
    static void
    encode(byte[] input, byte[] output, int inputLen)
    Encodes an array of 4-bit values into a byte array.
    static void
    encode(byte[] input, byte[] output, int outOff, int inputLen)
     
    static byte
    innerProduct(byte[] a, int aOff, byte[] b, int bOff, int rank)
     
    static byte
    inv(byte a)
    Multiplicative inverse in GF(16), table-free: a^14 = a^-1 (since a^15 = 1 for a !
    static int
    inv(int a)
    Multiplicative inverse in GF(16); table-free, branch-free (see inv(byte)).
    static byte
    mul(byte a, byte b)
    GF(16) multiplication mod x^4 + x + 1.
    static int
    mul(int a, int b)
    GF(16) multiplication mod x^4 + x + 1; table-free, branch-free (see mul(byte, byte)).
    static long
    mulAddStep16(long v, long m0, long m1, long m2, long m3)
    One step of the bitsliced, word-parallel GF(16) scalar-times-vector multiply-accumulate.
    static long
    mulFx8(int a, long b)
    Byte-lane parallel GF(16) multiply: multiplies the single GF(16) scalar a into up to eight GF(16) elements packed one-per-byte in b (each in the low nibble of its byte), all at once and table-free.
    static int
    sqr(int a)
    Constant-time GF(16) squaring over x^4 + x + 1.

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • GF16

      public GF16()

  • Method Details

    • mulAddStep16

      public static long mulAddStep16(long v, long m0, long m1, long m2, long m3)
      One step of the bitsliced, word-parallel GF(16) scalar-times-vector multiply-accumulate. Returns the contribution to XOR into the accumulator for a single 16-nibble packed input limb v, given the four broadcast scalar-bit masks m0..m3 (each 0 or -1, one per bit of the GF(16) scalar). The caller hoists the mask computation outside its limb loop.

      This is the constant-time, table-free GF(16) kernel shared by UOV's GF.vecMadd16 and MAYO's GF16Utils.mVecMulAdd: a mask-select on the scalar bits plus a SWAR multiply-by-x that folds x+1 (0x3) per nibble for the field polynomial x^4 + x + 1. No data-dependent branch and no secret-indexed table.

      Parameters:
      v - 16 GF(16) nibbles packed into a long.
      m0 - broadcast mask (0 or -1) for scalar bit 0.
      m1 - broadcast mask (0 or -1) for scalar bit 1.
      m2 - broadcast mask (0 or -1) for scalar bit 2.
      m3 - broadcast mask (0 or -1) for scalar bit 3.
      Returns:
      the multiply-accumulate contribution for this limb.

    • mul

      public static byte mul(byte a, byte b)
      GF(16) multiplication mod x^4 + x + 1.

      Table-free, branch-free carryless multiply followed by reduction modulo x^4 + x + 1, so the multiply carries no secret-indexed memory access (no L3 cache-timing side channel) — the form used by the SNOVA and MAYO reference implementations' production (Opt / AVX2) builds. Please ensure a <= 0x0F and b <= 0x0F.

      Parameters:
      a - an element in GF(16) (only the lower 4 bits are used)
      b - an element in GF(16) (only the lower 4 bits are used)
      Returns:
      the product a * b in GF(16)

    • mul

      public static int mul(int a, int b)
      GF(16) multiplication mod x^4 + x + 1; table-free, branch-free (see mul(byte, byte)). Please ensure a <= 0x0F and b <= 0x0F.
      Parameters:
      a - an element in GF(16) (only the lower 4 bits are used)
      b - an element in GF(16) (only the lower 4 bits are used)
      Returns:
      the product a * b in GF(16)

    • mulFx8

      public static long mulFx8(int a, long b)
      Byte-lane parallel GF(16) multiply: multiplies the single GF(16) scalar a into up to eight GF(16) elements packed one-per-byte in b (each in the low nibble of its byte), all at once and table-free. The batched, constant-time form of mul(int, int) used to multiply a scalar by a whole packed matrix row (the SNOVA / MAYO mul_fx8).
      Parameters:
      a - a GF(16) scalar (only the lower 4 bits are used)
      b - up to eight GF(16) elements, one per byte lane
      Returns:
      the eight products, one per byte lane

    • sqr

      public static int sqr(int a)
      Constant-time GF(16) squaring over x^4 + x + 1. Squaring is GF(2)-linear, so a^2 is just the bit-spread of a (interleave a zero between each bit, via Interleave.expand4to8(int)) reduced mod 0x13. x^4 = x + 1 means the folded-down high nibble multiplies by 0x3, computed branchlessly as d ^ (d<<1) = d * (1 + x); one fold suffices here (unlike GF(256)) because 0x3 is degree 1. Returns the same value as mul(a, a) but with no per-term work — table-free, branchless, and faster (~1.35x on HotSpot C2), so it replaces the squarings in inv(int).

    • inv

      public static byte inv(byte a)
      Multiplicative inverse in GF(16), table-free: a^14 = a^-1 (since a^15 = 1 for a != 0; 0 maps to 0), so the inverse carries no secret-indexed memory access. Matches the SNOVA / MAYO reference gf16_inv / inverse_f.

    • inv

      public static int inv(int a)
      Multiplicative inverse in GF(16); table-free, branch-free (see inv(byte)). The three squarings go through sqr(int); the two genuine products through mul(int, int).
      Parameters:
      a - an element in GF(16) (only the lower 4 bits are used)
      Returns:
      the inverse a^-1 in GF(16), or 0 when a == 0

    • decode

      public static void decode(byte[] input, byte[] output, int outputLen)
      Decodes an encoded byte array. Each byte in the input contains two nibbles (4-bit values); the lower nibble is stored first, followed by the upper nibble.
      Parameters:
      input - the input byte array (each byte holds two 4-bit values)
      output - the output array that will hold the decoded nibbles (one per byte)
      outputLen - the total number of nibbles to decode

    • decode

      public static void decode(byte[] input, int inOff, byte[] output, int outOff, int outputLen)

    • encode

      public static void encode(byte[] input, byte[] output, int inputLen)
      Encodes an array of 4-bit values into a byte array. Two 4-bit values are packed into one byte, with the first nibble stored in the lower 4 bits and the second nibble stored in the upper 4 bits.
      Parameters:
      input - the input array of 4-bit values (stored as bytes, only lower 4 bits used)
      output - the output byte array that will hold the encoded bytes
      inputLen - the number of nibbles in the input array

    • encode

      public static void encode(byte[] input, byte[] output, int outOff, int inputLen)

    • innerProduct

      public static byte innerProduct(byte[] a, int aOff, byte[] b, int bOff, int rank)