Refactoring in ML-KEM:

- remove Symmetric, make MLKemEngine immutable
- avoid overproducing implicit-rejection data
- reduce memory usage
- "Kyber" cleanup

Author: peterdettman

core/src/main/java/org/bouncycastle/pqc/crypto/mlkem/CBD.java

@@ -1,84 +1,39 @@
 package org.bouncycastle.pqc.crypto.mlkem;
 
-final class CBD
-{
+import org.bouncycastle.util.Pack;
 
-    public static void mlkemCBD(Poly r, byte[] bytes, int eta)
+class CBD
+{
+    static void eta2(Poly r, byte[] bytes)
     {
-        long t, d;
-        int a, b;
-
-        switch (eta)
+        for (int i = 0; i < MLKEMEngine.N / 8; i++)
         {
-        case 3:
-            for (int i = 0; i < MLKEMEngine.KyberN / 4; i++)
-            {
-                t = convertByteTo24BitUnsignedInt(bytes, 3 * i);
-                d = t & 0x00249249;
-                d = d + ((t >> 1) & 0x00249249);
-                d = d + ((t >> 2) & 0x00249249);
-                for (int j = 0; j < 4; j++)
-                {
-                    a = (short)((d >> (6 * j + 0)) & 0x7);
-                    b = (short)((d >> (6 * j + 3)) & 0x7);
-                    // System.out.printf("a = %d, b = %d\n", a, b);
-                    r.setCoeffIndex(4 * i + j, (short)(a - b));
-                }
-            }
-            break;
-        default:
-            // Only for Kyber512 where eta = 2
-            for (int i = 0; i < MLKEMEngine.KyberN / 8; i++)
+            int t = Pack.littleEndianToInt(bytes, 4 * i);
+            int d = t & 0x55555555;
+            d += (t >>> 1) & 0x55555555;
+            for (int j = 0; j < 8; j++)
             {
-                t = convertByteTo32BitUnsignedInt(bytes, 4 * i); // ? Problem
-                d = t & 0x55555555;
-                d = d + ((t >> 1) & 0x55555555);
-                for (int j = 0; j < 8; j++)
-                {
-                    a = (short)((d >> (4 * j + 0)) & 0x3);
-                    b = (short)((d >> (4 * j + eta)) & 0x3);
-                    r.setCoeffIndex(8 * i + j, (short)(a - b));
-                }
+                int a = (short)((d >>> (4 * j + 0)) & 0x3);
+                int b = (short)((d >>> (4 * j + 2)) & 0x3);
+                r.setCoeffIndex(8 * i + j, (short)(a - b));
             }
         }
     }
 
-    /**
-     * Converts an Array of Bytes to a 32-bit Unsigned Integer
-     * Returns a 32-bit unsigned integer as a long
-     *
-     * @param x
-     * @return
-     */
-    private static long convertByteTo32BitUnsignedInt(byte[] x, int offset)
+    static void eta3(Poly r, byte[] bytes)
     {
-        // Convert first byte to an unsigned integer 
-        // byte x & 0xFF allows us to grab the last 8 bits
-        long r = (long)(x[offset] & 0xFF);
-
-        // Perform the same operation then left bit shift to store the next 8 bits without
-        // altering the previous bits
-        r = r | (long)((long)(x[offset + 1] & 0xFF) << 8);
-        r = r | (long)((long)(x[offset + 2] & 0xFF) << 16);
-        r = r | (long)((long)(x[offset + 3] & 0xFF) << 24);
-        return r;
-    }
-
-    /**
-     * Converts an Array of Bytes to a 24-bit Unsigned Integer
-     * Returns a 24-bit unsigned integer as a long from byte x
-     *
-     * @param x
-     * @return
-     */
-    private static long convertByteTo24BitUnsignedInt(byte[] x, int offset)
-    {
-        // Refer to convertByteTo32-BitUnsignedInt for explanation
-        long r = (long)(x[offset] & 0xFF);
-        r = r | (long)((long)(x[offset + 1] & 0xFF) << 8);
-        r = r | (long)((long)(x[offset + 2] & 0xFF) << 16);
-        return r;
+        for (int i = 0; i < MLKEMEngine.N / 4; i++)
+        {
+            int t = Pack.littleEndianToInt24(bytes, 3 * i);
+            int d = t & 0x00249249;
+            d += (t >>> 1) & 0x00249249;
+            d += (t >>> 2) & 0x00249249;
+            for (int j = 0; j < 4; j++)
+            {
+                int a = (short)((d >>> (6 * j + 0)) & 0x7);
+                int b = (short)((d >>> (6 * j + 3)) & 0x7);
+                r.setCoeffIndex(4 * i + j, (short)(a - b));
+            }
+        }
     }
-
-
 }