1#include <stdint.h>
 2#include <string.h>
 3
 4/* ================================================================================================
 5 * RPO hashing algorithm related structs and methods.
 6 */
 7
 8/*
 9 * RPO128 context.
10 *
11 * This structure is used by the hashing API. It is composed of an internal state that can be
12 * viewed as either:
13 * 1. 12 field elements in the Miden VM.
14 * 2. 96 bytes.
15 *
16 * The first view is used for the internal state in the context of the RPO hashing algorithm. The
17 * second view is used for the buffer used to absorb the data to be hashed.
18 *
19 * The pointer to the buffer is updated as the data is absorbed.
20 *
21 * 'rpo128_context' must be initialized with rpo128_init() before first use.
22 */
23typedef struct
24{
25    union
26    {
27        uint64_t A[12];
28        uint8_t dbuf[96];
29    } st;
30    uint64_t dptr;
31} rpo128_context;
32
33/*
34 * Initializes an RPO state
35 */
36void rpo128_init(rpo128_context *rc);
37
38/*
39 * Absorbs an array of bytes of length 'len' into the state.
40 */
41void rpo128_absorb(rpo128_context *rc, const uint8_t *in, size_t len);
42
43/*
44 * Squeezes an array of bytes of length 'len' from the state.
45 */
46void rpo128_squeeze(rpo128_context *rc, uint8_t *out, size_t len);
47
48/*
49 * Finalizes the state in preparation for squeezing.
50 *
51 * This function should be called after all the data has been absorbed.
52 *
53 * Note that the current implementation does not perform any sort of padding for domain separation
54 * purposes. The reason being that, for our purposes, we always perform the following sequence:
55 * 1. Absorb a Nonce (which is always 40 bytes packed as 8 field elements).
56 * 2. Absorb the message (which is always 4 field elements).
57 * 3. Call finalize.
58 * 4. Squeeze the output.
59 * 5. Call release.
60 */
61void rpo128_finalize(rpo128_context *rc);
62
63/*
64 * Releases the state.
65 *
66 * This function should be called after the squeeze operation is finished.
67 */
68void rpo128_release(rpo128_context *rc);
69
70/* ================================================================================================
71 * Hash-to-Point algorithm for signature generation and signature verification.
72 */
73
74/*
75 * Hash-to-Point algorithm.
76 *
77 * This function generates a point in Z_q[x]/(phi) from a given message.
78 *
79 * It takes a finalized rpo128_context as input and it generates the coefficients of the polynomial
80 * representing the point. The coefficients are stored in the array 'x'. The number of coefficients
81 * is given by 'logn', which must in our case is 512.
82 */
83void PQCLEAN_FALCON512_CLEAN_hash_to_point_rpo(rpo128_context *rc, uint16_t *x, unsigned logn);