psanal2018 / kyber-arm64 Goto Github PK

My crypto library [1] implements the C version of Kyber derived from [2] as well as your code.

I discovered that the poly_reduce function in your code calculates a different result compared to the C version from [2]. This implies that sometimes the secret key has different bytes compared to the C implementation. Details are given with the patch [3]. Yet, the interesting aspect is that the calculated public key, ciphertext and shared secret are all identical to the ones calculated by C.

When applying the C version instead of the ARMv8 assembler version with the patch [3], the entire code works correctly.

Compare the test results using the following test applications assuming the build directory is build:

• build/kem/tests/kyber_kem_tester_c

• build/kem/tests/kyber_kem_tester_armv8

[1] https://github.com/smuellerDD/leancrypto

[2] https://github.com/pq-crystals/kyber

[3] smuellerDD/leancrypto@d6e1e3a