diff --git a/.gitignore b/.gitignore
index 0cf152c9..542abd54 100644
--- a/.gitignore
+++ b/.gitignore
@@ -137,6 +137,7 @@ test/default/keygen
test/default/kx
test/default/metamorphic
test/default/kem_mlkem768
+test/default/kem_xwing
test/default/misuse
test/default/onetimeauth
test/default/onetimeauth2
diff --git a/builds/msvc/vs2010/libsodium/libsodium.vcxproj b/builds/msvc/vs2010/libsodium/libsodium.vcxproj
index b0aa5c94..41bab1cc 100644
--- a/builds/msvc/vs2010/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2010/libsodium/libsodium.vcxproj
@@ -193,6 +193,9 @@
+
+
+
@@ -223,6 +226,7 @@
+
@@ -234,6 +238,7 @@
+
@@ -272,6 +277,7 @@
+
@@ -361,6 +367,7 @@
+
diff --git a/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters
index fef1108f..782789d5 100644
--- a/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters
@@ -399,6 +399,15 @@
crypto_aead\chacha20poly1305
+
+ crypto_kem\xwing
+
+
+ crypto_kem\mlkem768
+
+
+ crypto_kem\mlkem768\ref
+
crypto_secretstream\xchacha20poly1305
@@ -485,6 +494,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -518,6 +530,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -632,6 +647,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -899,6 +917,9 @@
crypto_aead\aegis256
+
+ crypto_kem\mlkem768\ref
+
crypto_core\keccak1600\ref
@@ -1057,6 +1078,18 @@
{baf7d894-9298-391d-8dc2-e4c3010f5ddc}
+
+ {b9009d4a-dd97-341d-aafb-eeeb77191a49}
+
+
+ {ab0c8a55-3e1f-307e-82be-8291a3b43735}
+
+
+ {70a10765-f8fb-3898-8514-966e48719bc4}
+
+
+ {2ef7c851-6598-3be5-88be-9ac5ec867cb0}
+
{898b6bd5-1360-3a34-adcd-0fade7561685}
diff --git a/builds/msvc/vs2012/libsodium/libsodium.vcxproj b/builds/msvc/vs2012/libsodium/libsodium.vcxproj
index ca198b0a..c977d707 100644
--- a/builds/msvc/vs2012/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2012/libsodium/libsodium.vcxproj
@@ -193,6 +193,9 @@
+
+
+
@@ -223,6 +226,7 @@
+
@@ -234,6 +238,7 @@
+
@@ -272,6 +277,7 @@
+
@@ -361,6 +367,7 @@
+
diff --git a/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters
index fef1108f..782789d5 100644
--- a/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters
@@ -399,6 +399,15 @@
crypto_aead\chacha20poly1305
+
+ crypto_kem\xwing
+
+
+ crypto_kem\mlkem768
+
+
+ crypto_kem\mlkem768\ref
+
crypto_secretstream\xchacha20poly1305
@@ -485,6 +494,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -518,6 +530,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -632,6 +647,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -899,6 +917,9 @@
crypto_aead\aegis256
+
+ crypto_kem\mlkem768\ref
+
crypto_core\keccak1600\ref
@@ -1057,6 +1078,18 @@
{baf7d894-9298-391d-8dc2-e4c3010f5ddc}
+
+ {b9009d4a-dd97-341d-aafb-eeeb77191a49}
+
+
+ {ab0c8a55-3e1f-307e-82be-8291a3b43735}
+
+
+ {70a10765-f8fb-3898-8514-966e48719bc4}
+
+
+ {2ef7c851-6598-3be5-88be-9ac5ec867cb0}
+
{898b6bd5-1360-3a34-adcd-0fade7561685}
diff --git a/builds/msvc/vs2013/libsodium/libsodium.vcxproj b/builds/msvc/vs2013/libsodium/libsodium.vcxproj
index f0e52997..de545c1e 100644
--- a/builds/msvc/vs2013/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2013/libsodium/libsodium.vcxproj
@@ -193,6 +193,9 @@
+
+
+
@@ -223,6 +226,7 @@
+
@@ -234,6 +238,7 @@
+
@@ -272,6 +277,7 @@
+
@@ -361,6 +367,7 @@
+
diff --git a/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters
index fef1108f..782789d5 100644
--- a/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters
@@ -399,6 +399,15 @@
crypto_aead\chacha20poly1305
+
+ crypto_kem\xwing
+
+
+ crypto_kem\mlkem768
+
+
+ crypto_kem\mlkem768\ref
+
crypto_secretstream\xchacha20poly1305
@@ -485,6 +494,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -518,6 +530,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -632,6 +647,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -899,6 +917,9 @@
crypto_aead\aegis256
+
+ crypto_kem\mlkem768\ref
+
crypto_core\keccak1600\ref
@@ -1057,6 +1078,18 @@
{baf7d894-9298-391d-8dc2-e4c3010f5ddc}
+
+ {b9009d4a-dd97-341d-aafb-eeeb77191a49}
+
+
+ {ab0c8a55-3e1f-307e-82be-8291a3b43735}
+
+
+ {70a10765-f8fb-3898-8514-966e48719bc4}
+
+
+ {2ef7c851-6598-3be5-88be-9ac5ec867cb0}
+
{898b6bd5-1360-3a34-adcd-0fade7561685}
diff --git a/builds/msvc/vs2015/libsodium/libsodium.vcxproj b/builds/msvc/vs2015/libsodium/libsodium.vcxproj
index 0435fabf..674e8da2 100644
--- a/builds/msvc/vs2015/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2015/libsodium/libsodium.vcxproj
@@ -193,6 +193,9 @@
+
+
+
@@ -223,6 +226,7 @@
+
@@ -234,6 +238,7 @@
+
@@ -272,6 +277,7 @@
+
@@ -361,6 +367,7 @@
+
diff --git a/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters
index fef1108f..782789d5 100644
--- a/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters
@@ -399,6 +399,15 @@
crypto_aead\chacha20poly1305
+
+ crypto_kem\xwing
+
+
+ crypto_kem\mlkem768
+
+
+ crypto_kem\mlkem768\ref
+
crypto_secretstream\xchacha20poly1305
@@ -485,6 +494,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -518,6 +530,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -632,6 +647,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -899,6 +917,9 @@
crypto_aead\aegis256
+
+ crypto_kem\mlkem768\ref
+
crypto_core\keccak1600\ref
@@ -1057,6 +1078,18 @@
{baf7d894-9298-391d-8dc2-e4c3010f5ddc}
+
+ {b9009d4a-dd97-341d-aafb-eeeb77191a49}
+
+
+ {ab0c8a55-3e1f-307e-82be-8291a3b43735}
+
+
+ {70a10765-f8fb-3898-8514-966e48719bc4}
+
+
+ {2ef7c851-6598-3be5-88be-9ac5ec867cb0}
+
{898b6bd5-1360-3a34-adcd-0fade7561685}
diff --git a/builds/msvc/vs2017/libsodium/libsodium.vcxproj b/builds/msvc/vs2017/libsodium/libsodium.vcxproj
index d638840c..e33db251 100644
--- a/builds/msvc/vs2017/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2017/libsodium/libsodium.vcxproj
@@ -193,6 +193,9 @@
+
+
+
@@ -223,6 +226,7 @@
+
@@ -234,6 +238,7 @@
+
@@ -272,6 +277,7 @@
+
@@ -361,6 +367,7 @@
+
diff --git a/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters
index fef1108f..782789d5 100644
--- a/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters
@@ -399,6 +399,15 @@
crypto_aead\chacha20poly1305
+
+ crypto_kem\xwing
+
+
+ crypto_kem\mlkem768
+
+
+ crypto_kem\mlkem768\ref
+
crypto_secretstream\xchacha20poly1305
@@ -485,6 +494,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -518,6 +530,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -632,6 +647,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -899,6 +917,9 @@
crypto_aead\aegis256
+
+ crypto_kem\mlkem768\ref
+
crypto_core\keccak1600\ref
@@ -1057,6 +1078,18 @@
{baf7d894-9298-391d-8dc2-e4c3010f5ddc}
+
+ {b9009d4a-dd97-341d-aafb-eeeb77191a49}
+
+
+ {ab0c8a55-3e1f-307e-82be-8291a3b43735}
+
+
+ {70a10765-f8fb-3898-8514-966e48719bc4}
+
+
+ {2ef7c851-6598-3be5-88be-9ac5ec867cb0}
+
{898b6bd5-1360-3a34-adcd-0fade7561685}
diff --git a/builds/msvc/vs2019/libsodium/libsodium.vcxproj b/builds/msvc/vs2019/libsodium/libsodium.vcxproj
index f79e5879..432da651 100644
--- a/builds/msvc/vs2019/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2019/libsodium/libsodium.vcxproj
@@ -217,6 +217,9 @@
+
+
+
@@ -247,6 +250,7 @@
+
@@ -258,6 +262,7 @@
+
@@ -296,6 +301,7 @@
+
@@ -385,6 +391,7 @@
+
diff --git a/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters
index fef1108f..782789d5 100644
--- a/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters
@@ -399,6 +399,15 @@
crypto_aead\chacha20poly1305
+
+ crypto_kem\xwing
+
+
+ crypto_kem\mlkem768
+
+
+ crypto_kem\mlkem768\ref
+
crypto_secretstream\xchacha20poly1305
@@ -485,6 +494,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -518,6 +530,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -632,6 +647,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -899,6 +917,9 @@
crypto_aead\aegis256
+
+ crypto_kem\mlkem768\ref
+
crypto_core\keccak1600\ref
@@ -1057,6 +1078,18 @@
{baf7d894-9298-391d-8dc2-e4c3010f5ddc}
+
+ {b9009d4a-dd97-341d-aafb-eeeb77191a49}
+
+
+ {ab0c8a55-3e1f-307e-82be-8291a3b43735}
+
+
+ {70a10765-f8fb-3898-8514-966e48719bc4}
+
+
+ {2ef7c851-6598-3be5-88be-9ac5ec867cb0}
+
{898b6bd5-1360-3a34-adcd-0fade7561685}
diff --git a/builds/msvc/vs2022/libsodium/libsodium.vcxproj b/builds/msvc/vs2022/libsodium/libsodium.vcxproj
index be8c01f6..c8ca1ac4 100644
--- a/builds/msvc/vs2022/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2022/libsodium/libsodium.vcxproj
@@ -217,6 +217,9 @@
+
+
+
@@ -247,6 +250,7 @@
+
@@ -258,6 +262,7 @@
+
@@ -296,6 +301,7 @@
+
@@ -385,6 +391,7 @@
+
diff --git a/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters
index fef1108f..782789d5 100644
--- a/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters
@@ -399,6 +399,15 @@
crypto_aead\chacha20poly1305
+
+ crypto_kem\xwing
+
+
+ crypto_kem\mlkem768
+
+
+ crypto_kem\mlkem768\ref
+
crypto_secretstream\xchacha20poly1305
@@ -485,6 +494,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -518,6 +530,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -632,6 +647,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -899,6 +917,9 @@
crypto_aead\aegis256
+
+ crypto_kem\mlkem768\ref
+
crypto_core\keccak1600\ref
@@ -1057,6 +1078,18 @@
{baf7d894-9298-391d-8dc2-e4c3010f5ddc}
+
+ {b9009d4a-dd97-341d-aafb-eeeb77191a49}
+
+
+ {ab0c8a55-3e1f-307e-82be-8291a3b43735}
+
+
+ {70a10765-f8fb-3898-8514-966e48719bc4}
+
+
+ {2ef7c851-6598-3be5-88be-9ac5ec867cb0}
+
{898b6bd5-1360-3a34-adcd-0fade7561685}
diff --git a/builds/msvc/vs2026/libsodium/libsodium.vcxproj b/builds/msvc/vs2026/libsodium/libsodium.vcxproj
index 15407d3e..cdeb634d 100644
--- a/builds/msvc/vs2026/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2026/libsodium/libsodium.vcxproj
@@ -217,6 +217,9 @@
+
+
+
@@ -247,6 +250,7 @@
+
@@ -258,6 +262,7 @@
+
@@ -296,6 +301,7 @@
+
@@ -385,6 +391,7 @@
+
diff --git a/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters
index fef1108f..782789d5 100644
--- a/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters
@@ -399,6 +399,15 @@
crypto_aead\chacha20poly1305
+
+ crypto_kem\xwing
+
+
+ crypto_kem\mlkem768
+
+
+ crypto_kem\mlkem768\ref
+
crypto_secretstream\xchacha20poly1305
@@ -485,6 +494,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -518,6 +530,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -632,6 +647,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -899,6 +917,9 @@
crypto_aead\aegis256
+
+ crypto_kem\mlkem768\ref
+
crypto_core\keccak1600\ref
@@ -1057,6 +1078,18 @@
{baf7d894-9298-391d-8dc2-e4c3010f5ddc}
+
+ {b9009d4a-dd97-341d-aafb-eeeb77191a49}
+
+
+ {ab0c8a55-3e1f-307e-82be-8291a3b43735}
+
+
+ {70a10765-f8fb-3898-8514-966e48719bc4}
+
+
+ {2ef7c851-6598-3be5-88be-9ac5ec867cb0}
+
{898b6bd5-1360-3a34-adcd-0fade7561685}
diff --git a/ci/appveyor/libsodium.vcxproj b/ci/appveyor/libsodium.vcxproj
index e699e39b..70b9430d 100644
--- a/ci/appveyor/libsodium.vcxproj
+++ b/ci/appveyor/libsodium.vcxproj
@@ -441,6 +441,9 @@
+
+
+
@@ -471,6 +474,7 @@
+
@@ -482,6 +486,7 @@
+
@@ -520,6 +525,7 @@
+
@@ -609,6 +615,7 @@
+
diff --git a/ci/appveyor/libsodium.vcxproj.filters b/ci/appveyor/libsodium.vcxproj.filters
index 83dff779..b98f5e2b 100644
--- a/ci/appveyor/libsodium.vcxproj.filters
+++ b/ci/appveyor/libsodium.vcxproj.filters
@@ -390,6 +390,15 @@
Source Files
+
+ Source Files
+
+
+ Source Files
+
+
+ Source Files
+
Source Files
@@ -476,6 +485,9 @@
Header Files
+
+ Header Files
+
Header Files
@@ -509,6 +521,9 @@
Header Files
+
+ Header Files
+
Header Files
@@ -623,6 +638,9 @@
Header Files
+
+ Header Files
+
Header Files
@@ -890,6 +908,9 @@
Header Files
+
+ Header Files
+
Header Files
diff --git a/src/libsodium/Makefile.am b/src/libsodium/Makefile.am
index 486fdbd1..8c0fdaa1 100644
--- a/src/libsodium/Makefile.am
+++ b/src/libsodium/Makefile.am
@@ -60,6 +60,7 @@ libsodium_la_SOURCES = \
crypto_kem/mlkem768/kem_mlkem768.c \
crypto_kem/mlkem768/ref/kem_mlkem768_ref.c \
crypto_kem/mlkem768/ref/kem_mlkem768_ref.h \
+ crypto_kem/xwing/kem_xwing.c \
crypto_kx/crypto_kx.c \
crypto_onetimeauth/crypto_onetimeauth.c \
crypto_onetimeauth/poly1305/onetimeauth_poly1305.c \
diff --git a/src/libsodium/Makefile.in b/src/libsodium/Makefile.in
index 5e47feac..dca767ba 100644
--- a/src/libsodium/Makefile.in
+++ b/src/libsodium/Makefile.in
@@ -320,8 +320,11 @@ am__libsodium_la_SOURCES_DIST = \
crypto_ipcrypt/implementations.h \
crypto_kdf/blake2b/kdf_blake2b.c crypto_kdf/crypto_kdf.c \
crypto_kdf/hkdf/kdf_hkdf_sha256.c \
- crypto_kdf/hkdf/kdf_hkdf_sha512.c crypto_kx/crypto_kx.c \
- crypto_onetimeauth/crypto_onetimeauth.c \
+ crypto_kdf/hkdf/kdf_hkdf_sha512.c \
+ crypto_kem/mlkem768/kem_mlkem768.c \
+ crypto_kem/mlkem768/ref/kem_mlkem768_ref.c \
+ crypto_kem/mlkem768/ref/kem_mlkem768_ref.h \
+ crypto_kx/crypto_kx.c crypto_onetimeauth/crypto_onetimeauth.c \
crypto_onetimeauth/poly1305/onetimeauth_poly1305.c \
crypto_onetimeauth/poly1305/onetimeauth_poly1305.h \
crypto_onetimeauth/poly1305/donna/poly1305_donna.h \
@@ -509,6 +512,8 @@ am_libsodium_la_OBJECTS = \
crypto_kdf/libsodium_la-crypto_kdf.lo \
crypto_kdf/hkdf/libsodium_la-kdf_hkdf_sha256.lo \
crypto_kdf/hkdf/libsodium_la-kdf_hkdf_sha512.lo \
+ crypto_kem/mlkem768/libsodium_la-kem_mlkem768.lo \
+ crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo \
crypto_kx/libsodium_la-crypto_kx.lo \
crypto_onetimeauth/libsodium_la-crypto_onetimeauth.lo \
crypto_onetimeauth/poly1305/libsodium_la-onetimeauth_poly1305.lo \
@@ -665,6 +670,8 @@ am__depfiles_remade = crypto_aead/aegis128l/$(DEPDIR)/libaesni_la-aegis128l_aesn
crypto_kdf/blake2b/$(DEPDIR)/libsodium_la-kdf_blake2b.Plo \
crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha256.Plo \
crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha512.Plo \
+ crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Plo \
+ crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Plo \
crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Plo \
crypto_onetimeauth/$(DEPDIR)/libsodium_la-crypto_onetimeauth.Plo \
crypto_onetimeauth/poly1305/$(DEPDIR)/libsodium_la-onetimeauth_poly1305.Plo \
@@ -1079,8 +1086,11 @@ libsodium_la_SOURCES = crypto_aead/aegis128l/aead_aegis128l.c \
crypto_ipcrypt/implementations.h \
crypto_kdf/blake2b/kdf_blake2b.c crypto_kdf/crypto_kdf.c \
crypto_kdf/hkdf/kdf_hkdf_sha256.c \
- crypto_kdf/hkdf/kdf_hkdf_sha512.c crypto_kx/crypto_kx.c \
- crypto_onetimeauth/crypto_onetimeauth.c \
+ crypto_kdf/hkdf/kdf_hkdf_sha512.c \
+ crypto_kem/mlkem768/kem_mlkem768.c \
+ crypto_kem/mlkem768/ref/kem_mlkem768_ref.c \
+ crypto_kem/mlkem768/ref/kem_mlkem768_ref.h \
+ crypto_kx/crypto_kx.c crypto_onetimeauth/crypto_onetimeauth.c \
crypto_onetimeauth/poly1305/onetimeauth_poly1305.c \
crypto_onetimeauth/poly1305/onetimeauth_poly1305.h \
crypto_onetimeauth/poly1305/donna/poly1305_donna.h \
@@ -1758,6 +1768,24 @@ crypto_kdf/hkdf/libsodium_la-kdf_hkdf_sha256.lo: \
crypto_kdf/hkdf/libsodium_la-kdf_hkdf_sha512.lo: \
crypto_kdf/hkdf/$(am__dirstamp) \
crypto_kdf/hkdf/$(DEPDIR)/$(am__dirstamp)
+crypto_kem/mlkem768/$(am__dirstamp):
+ @$(MKDIR_P) crypto_kem/mlkem768
+ @: >>crypto_kem/mlkem768/$(am__dirstamp)
+crypto_kem/mlkem768/$(DEPDIR)/$(am__dirstamp):
+ @$(MKDIR_P) crypto_kem/mlkem768/$(DEPDIR)
+ @: >>crypto_kem/mlkem768/$(DEPDIR)/$(am__dirstamp)
+crypto_kem/mlkem768/libsodium_la-kem_mlkem768.lo: \
+ crypto_kem/mlkem768/$(am__dirstamp) \
+ crypto_kem/mlkem768/$(DEPDIR)/$(am__dirstamp)
+crypto_kem/mlkem768/ref/$(am__dirstamp):
+ @$(MKDIR_P) crypto_kem/mlkem768/ref
+ @: >>crypto_kem/mlkem768/ref/$(am__dirstamp)
+crypto_kem/mlkem768/ref/$(DEPDIR)/$(am__dirstamp):
+ @$(MKDIR_P) crypto_kem/mlkem768/ref/$(DEPDIR)
+ @: >>crypto_kem/mlkem768/ref/$(DEPDIR)/$(am__dirstamp)
+crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo: \
+ crypto_kem/mlkem768/ref/$(am__dirstamp) \
+ crypto_kem/mlkem768/ref/$(DEPDIR)/$(am__dirstamp)
crypto_kx/$(am__dirstamp):
@$(MKDIR_P) crypto_kx
@: >>crypto_kx/$(am__dirstamp)
@@ -2393,6 +2421,10 @@ mostlyclean-compile:
-rm -f crypto_kdf/blake2b/*.lo
-rm -f crypto_kdf/hkdf/*.$(OBJEXT)
-rm -f crypto_kdf/hkdf/*.lo
+ -rm -f crypto_kem/mlkem768/*.$(OBJEXT)
+ -rm -f crypto_kem/mlkem768/*.lo
+ -rm -f crypto_kem/mlkem768/ref/*.$(OBJEXT)
+ -rm -f crypto_kem/mlkem768/ref/*.lo
-rm -f crypto_kx/*.$(OBJEXT)
-rm -f crypto_kx/*.lo
-rm -f crypto_onetimeauth/*.$(OBJEXT)
@@ -2559,6 +2591,8 @@ distclean-compile:
@AMDEP_TRUE@@am__include@ @am__quote@crypto_kdf/blake2b/$(DEPDIR)/libsodium_la-kdf_blake2b.Plo@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha256.Plo@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha512.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Plo@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Plo@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@crypto_onetimeauth/$(DEPDIR)/libsodium_la-crypto_onetimeauth.Plo@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@crypto_onetimeauth/poly1305/$(DEPDIR)/libsodium_la-onetimeauth_poly1305.Plo@am__quote@ # am--include-marker
@@ -3103,6 +3137,20 @@ crypto_kdf/hkdf/libsodium_la-kdf_hkdf_sha512.lo: crypto_kdf/hkdf/kdf_hkdf_sha512
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_kdf/hkdf/libsodium_la-kdf_hkdf_sha512.lo `test -f 'crypto_kdf/hkdf/kdf_hkdf_sha512.c' || echo '$(srcdir)/'`crypto_kdf/hkdf/kdf_hkdf_sha512.c
+crypto_kem/mlkem768/libsodium_la-kem_mlkem768.lo: crypto_kem/mlkem768/kem_mlkem768.c
+@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_kem/mlkem768/libsodium_la-kem_mlkem768.lo -MD -MP -MF crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Tpo -c -o crypto_kem/mlkem768/libsodium_la-kem_mlkem768.lo `test -f 'crypto_kem/mlkem768/kem_mlkem768.c' || echo '$(srcdir)/'`crypto_kem/mlkem768/kem_mlkem768.c
+@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Tpo crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='crypto_kem/mlkem768/kem_mlkem768.c' object='crypto_kem/mlkem768/libsodium_la-kem_mlkem768.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_kem/mlkem768/libsodium_la-kem_mlkem768.lo `test -f 'crypto_kem/mlkem768/kem_mlkem768.c' || echo '$(srcdir)/'`crypto_kem/mlkem768/kem_mlkem768.c
+
+crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo: crypto_kem/mlkem768/ref/kem_mlkem768_ref.c
+@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo -MD -MP -MF crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Tpo -c -o crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo `test -f 'crypto_kem/mlkem768/ref/kem_mlkem768_ref.c' || echo '$(srcdir)/'`crypto_kem/mlkem768/ref/kem_mlkem768_ref.c
+@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Tpo crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='crypto_kem/mlkem768/ref/kem_mlkem768_ref.c' object='crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_kem/mlkem768/ref/libsodium_la-kem_mlkem768_ref.lo `test -f 'crypto_kem/mlkem768/ref/kem_mlkem768_ref.c' || echo '$(srcdir)/'`crypto_kem/mlkem768/ref/kem_mlkem768_ref.c
+
crypto_kx/libsodium_la-crypto_kx.lo: crypto_kx/crypto_kx.c
@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_kx/libsodium_la-crypto_kx.lo -MD -MP -MF crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Tpo -c -o crypto_kx/libsodium_la-crypto_kx.lo `test -f 'crypto_kx/crypto_kx.c' || echo '$(srcdir)/'`crypto_kx/crypto_kx.c
@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Tpo crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Plo
@@ -3712,6 +3760,8 @@ clean-libtool:
-rm -rf crypto_kdf/.libs crypto_kdf/_libs
-rm -rf crypto_kdf/blake2b/.libs crypto_kdf/blake2b/_libs
-rm -rf crypto_kdf/hkdf/.libs crypto_kdf/hkdf/_libs
+ -rm -rf crypto_kem/mlkem768/.libs crypto_kem/mlkem768/_libs
+ -rm -rf crypto_kem/mlkem768/ref/.libs crypto_kem/mlkem768/ref/_libs
-rm -rf crypto_kx/.libs crypto_kx/_libs
-rm -rf crypto_onetimeauth/.libs crypto_onetimeauth/_libs
-rm -rf crypto_onetimeauth/poly1305/.libs crypto_onetimeauth/poly1305/_libs
@@ -4053,6 +4103,10 @@ distclean-generic:
-$(am__rm_f) crypto_kdf/blake2b/$(am__dirstamp)
-$(am__rm_f) crypto_kdf/hkdf/$(DEPDIR)/$(am__dirstamp)
-$(am__rm_f) crypto_kdf/hkdf/$(am__dirstamp)
+ -$(am__rm_f) crypto_kem/mlkem768/$(DEPDIR)/$(am__dirstamp)
+ -$(am__rm_f) crypto_kem/mlkem768/$(am__dirstamp)
+ -$(am__rm_f) crypto_kem/mlkem768/ref/$(DEPDIR)/$(am__dirstamp)
+ -$(am__rm_f) crypto_kem/mlkem768/ref/$(am__dirstamp)
-$(am__rm_f) crypto_kx/$(DEPDIR)/$(am__dirstamp)
-$(am__rm_f) crypto_kx/$(am__dirstamp)
-$(am__rm_f) crypto_onetimeauth/$(DEPDIR)/$(am__dirstamp)
@@ -4225,6 +4279,8 @@ distclean: distclean-recursive
-rm -f crypto_kdf/blake2b/$(DEPDIR)/libsodium_la-kdf_blake2b.Plo
-rm -f crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha256.Plo
-rm -f crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha512.Plo
+ -rm -f crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Plo
+ -rm -f crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Plo
-rm -f crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Plo
-rm -f crypto_onetimeauth/$(DEPDIR)/libsodium_la-crypto_onetimeauth.Plo
-rm -f crypto_onetimeauth/poly1305/$(DEPDIR)/libsodium_la-onetimeauth_poly1305.Plo
@@ -4409,6 +4465,8 @@ maintainer-clean: maintainer-clean-recursive
-rm -f crypto_kdf/blake2b/$(DEPDIR)/libsodium_la-kdf_blake2b.Plo
-rm -f crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha256.Plo
-rm -f crypto_kdf/hkdf/$(DEPDIR)/libsodium_la-kdf_hkdf_sha512.Plo
+ -rm -f crypto_kem/mlkem768/$(DEPDIR)/libsodium_la-kem_mlkem768.Plo
+ -rm -f crypto_kem/mlkem768/ref/$(DEPDIR)/libsodium_la-kem_mlkem768_ref.Plo
-rm -f crypto_kx/$(DEPDIR)/libsodium_la-crypto_kx.Plo
-rm -f crypto_onetimeauth/$(DEPDIR)/libsodium_la-crypto_onetimeauth.Plo
-rm -f crypto_onetimeauth/poly1305/$(DEPDIR)/libsodium_la-onetimeauth_poly1305.Plo
diff --git a/src/libsodium/crypto_kem/xwing/kem_xwing.c b/src/libsodium/crypto_kem/xwing/kem_xwing.c
new file mode 100644
index 00000000..0721ccf4
--- /dev/null
+++ b/src/libsodium/crypto_kem/xwing/kem_xwing.c
@@ -0,0 +1,210 @@
+#include
+#include
+
+#include "crypto_hash_sha3.h"
+#include "crypto_kem_mlkem768.h"
+#include "crypto_kem_xwing.h"
+#include "crypto_scalarmult_curve25519.h"
+#include "crypto_xof_shake256.h"
+#include "private/common.h"
+#include "randombytes.h"
+#include "utils.h"
+
+static const unsigned char xwing_label[6] = { 0x5c, 0x2e, 0x2f, 0x2f, 0x5e, 0x5c };
+
+static void
+expand_decaps_key(unsigned char pk_mlkem[crypto_kem_mlkem768_PUBLICKEYBYTES],
+ unsigned char sk_mlkem[crypto_kem_mlkem768_SECRETKEYBYTES],
+ unsigned char pk_x25519[crypto_scalarmult_curve25519_BYTES],
+ unsigned char sk_x25519[crypto_scalarmult_curve25519_SCALARBYTES],
+ const unsigned char seed[crypto_kem_xwing_SEEDBYTES])
+{
+ unsigned char expanded[96];
+ unsigned char mlkem_seed[crypto_kem_mlkem768_SEEDBYTES];
+
+ crypto_xof_shake256(expanded, 96, seed, crypto_kem_xwing_SEEDBYTES);
+
+ memcpy(mlkem_seed, expanded, 64);
+ memcpy(sk_x25519, expanded + 64, 32);
+
+ crypto_kem_mlkem768_seed_keypair(pk_mlkem, sk_mlkem, mlkem_seed);
+ crypto_scalarmult_curve25519_base(pk_x25519, sk_x25519);
+
+ sodium_memzero(expanded, sizeof expanded);
+ sodium_memzero(mlkem_seed, sizeof mlkem_seed);
+}
+
+static void
+combiner(unsigned char ss[crypto_kem_xwing_SHAREDSECRETBYTES],
+ const unsigned char ss_mlkem[crypto_kem_mlkem768_SHAREDSECRETBYTES],
+ const unsigned char ss_x25519[crypto_scalarmult_curve25519_BYTES],
+ const unsigned char ct_x25519[crypto_scalarmult_curve25519_BYTES],
+ const unsigned char pk_x25519[crypto_scalarmult_curve25519_BYTES])
+{
+ crypto_hash_sha3256_state state;
+
+ crypto_hash_sha3256_init(&state);
+ crypto_hash_sha3256_update(&state, ss_mlkem, crypto_kem_mlkem768_SHAREDSECRETBYTES);
+ crypto_hash_sha3256_update(&state, ss_x25519, crypto_scalarmult_curve25519_BYTES);
+ crypto_hash_sha3256_update(&state, ct_x25519, crypto_scalarmult_curve25519_BYTES);
+ crypto_hash_sha3256_update(&state, pk_x25519, crypto_scalarmult_curve25519_BYTES);
+ crypto_hash_sha3256_update(&state, xwing_label, sizeof xwing_label);
+ crypto_hash_sha3256_final(&state, ss);
+}
+
+size_t
+crypto_kem_xwing_publickeybytes(void)
+{
+ return crypto_kem_xwing_PUBLICKEYBYTES;
+}
+
+size_t
+crypto_kem_xwing_secretkeybytes(void)
+{
+ return crypto_kem_xwing_SECRETKEYBYTES;
+}
+
+size_t
+crypto_kem_xwing_ciphertextbytes(void)
+{
+ return crypto_kem_xwing_CIPHERTEXTBYTES;
+}
+
+size_t
+crypto_kem_xwing_sharedsecretbytes(void)
+{
+ return crypto_kem_xwing_SHAREDSECRETBYTES;
+}
+
+size_t
+crypto_kem_xwing_seedbytes(void)
+{
+ return crypto_kem_xwing_SEEDBYTES;
+}
+
+int
+crypto_kem_xwing_seed_keypair(unsigned char *pk, unsigned char *sk, const unsigned char *seed)
+{
+ unsigned char pk_mlkem[crypto_kem_mlkem768_PUBLICKEYBYTES];
+ unsigned char sk_mlkem[crypto_kem_mlkem768_SECRETKEYBYTES];
+ unsigned char pk_x25519[crypto_scalarmult_curve25519_BYTES];
+ unsigned char sk_x25519[crypto_scalarmult_curve25519_SCALARBYTES];
+
+ expand_decaps_key(pk_mlkem, sk_mlkem, pk_x25519, sk_x25519, seed);
+
+ memcpy(pk, pk_mlkem, crypto_kem_mlkem768_PUBLICKEYBYTES);
+ memcpy(pk + crypto_kem_mlkem768_PUBLICKEYBYTES, pk_x25519, crypto_scalarmult_curve25519_BYTES);
+
+ memcpy(sk, seed, crypto_kem_xwing_SEEDBYTES);
+
+ sodium_memzero(sk_mlkem, sizeof sk_mlkem);
+ sodium_memzero(sk_x25519, sizeof sk_x25519);
+
+ return 0;
+}
+
+int
+crypto_kem_xwing_keypair(unsigned char *pk, unsigned char *sk)
+{
+ unsigned char seed[crypto_kem_xwing_SEEDBYTES];
+
+ randombytes_buf(seed, crypto_kem_xwing_SEEDBYTES);
+ crypto_kem_xwing_seed_keypair(pk, sk, seed);
+
+ sodium_memzero(seed, sizeof seed);
+
+ return 0;
+}
+
+int
+crypto_kem_xwing_enc_deterministic(unsigned char *ct, unsigned char *ss, const unsigned char *pk,
+ const unsigned char *seed)
+{
+ const unsigned char *pk_mlkem = pk;
+ const unsigned char *pk_x25519 = pk + crypto_kem_mlkem768_PUBLICKEYBYTES;
+
+ const unsigned char *seed_mlkem = seed;
+ const unsigned char *sk_e_x25519 = seed + 32;
+
+ unsigned char ct_mlkem[crypto_kem_mlkem768_CIPHERTEXTBYTES];
+ unsigned char ss_mlkem[crypto_kem_mlkem768_SHAREDSECRETBYTES];
+ unsigned char ct_x25519[crypto_scalarmult_curve25519_BYTES];
+ unsigned char ss_x25519[crypto_scalarmult_curve25519_BYTES];
+
+ if (crypto_kem_mlkem768_enc_deterministic(ct_mlkem, ss_mlkem, pk_mlkem, seed_mlkem) != 0) {
+ return -1; /* LCOV_EXCL_LINE */
+ }
+
+ crypto_scalarmult_curve25519_base(ct_x25519, sk_e_x25519);
+
+ if (crypto_scalarmult_curve25519(ss_x25519, sk_e_x25519, pk_x25519) != 0) {
+ sodium_memzero(ss_mlkem, sizeof ss_mlkem); /* LCOV_EXCL_LINE */
+ return -1; /* LCOV_EXCL_LINE */
+ }
+
+ memcpy(ct, ct_mlkem, crypto_kem_mlkem768_CIPHERTEXTBYTES);
+ memcpy(ct + crypto_kem_mlkem768_CIPHERTEXTBYTES, ct_x25519, crypto_scalarmult_curve25519_BYTES);
+
+ combiner(ss, ss_mlkem, ss_x25519, ct_x25519, pk_x25519);
+
+ sodium_memzero(ss_mlkem, sizeof ss_mlkem);
+ sodium_memzero(ss_x25519, sizeof ss_x25519);
+
+ return 0;
+}
+
+int
+crypto_kem_xwing_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk)
+{
+ unsigned char seed[64];
+
+ randombytes_buf(seed, 64);
+ if (crypto_kem_xwing_enc_deterministic(ct, ss, pk, seed) != 0) {
+ sodium_memzero(seed, sizeof seed); /* LCOV_EXCL_LINE */
+ return -1; /* LCOV_EXCL_LINE */
+ }
+ sodium_memzero(seed, sizeof seed);
+
+ return 0;
+}
+
+int
+crypto_kem_xwing_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk)
+{
+ unsigned char pk_mlkem[crypto_kem_mlkem768_PUBLICKEYBYTES];
+ unsigned char sk_mlkem[crypto_kem_mlkem768_SECRETKEYBYTES];
+ unsigned char pk_x25519[crypto_scalarmult_curve25519_BYTES];
+ unsigned char sk_x25519[crypto_scalarmult_curve25519_SCALARBYTES];
+
+ const unsigned char *ct_mlkem = ct;
+ const unsigned char *ct_x25519 = ct + crypto_kem_mlkem768_CIPHERTEXTBYTES;
+
+ unsigned char ss_mlkem[crypto_kem_mlkem768_SHAREDSECRETBYTES];
+ unsigned char ss_x25519[crypto_scalarmult_curve25519_BYTES];
+
+ expand_decaps_key(pk_mlkem, sk_mlkem, pk_x25519, sk_x25519, sk);
+
+ /* LCOV_EXCL_START */
+ if (crypto_kem_mlkem768_dec(ss_mlkem, ct_mlkem, sk_mlkem) != 0) {
+ sodium_memzero(sk_mlkem, sizeof sk_mlkem);
+ sodium_memzero(sk_x25519, sizeof sk_x25519);
+ return -1;
+ }
+
+ if (crypto_scalarmult_curve25519(ss_x25519, sk_x25519, ct_x25519) != 0) {
+ sodium_memzero(ss_mlkem, sizeof ss_mlkem);
+ sodium_memzero(sk_mlkem, sizeof sk_mlkem);
+ sodium_memzero(sk_x25519, sizeof sk_x25519);
+ return -1;
+ }
+ /* LCOV_EXCL_STOP */
+
+ combiner(ss, ss_mlkem, ss_x25519, ct_x25519, pk_x25519);
+
+ sodium_memzero(ss_mlkem, sizeof ss_mlkem);
+ sodium_memzero(ss_x25519, sizeof ss_x25519);
+ sodium_memzero(sk_mlkem, sizeof sk_mlkem);
+ sodium_memzero(sk_x25519, sizeof sk_x25519);
+
+ return 0;
+}
diff --git a/src/libsodium/include/Makefile.am b/src/libsodium/include/Makefile.am
index d411a242..3fdadfbb 100644
--- a/src/libsodium/include/Makefile.am
+++ b/src/libsodium/include/Makefile.am
@@ -34,6 +34,7 @@ SODIUM_EXPORT = \
sodium/crypto_kdf_hkdf_sha512.h \
sodium/crypto_kdf_blake2b.h \
sodium/crypto_kem_mlkem768.h \
+ sodium/crypto_kem_xwing.h \
sodium/crypto_kx.h \
sodium/crypto_onetimeauth.h \
sodium/crypto_onetimeauth_poly1305.h \
diff --git a/src/libsodium/include/Makefile.in b/src/libsodium/include/Makefile.in
index 092fd02d..3c4ae2db 100644
--- a/src/libsodium/include/Makefile.in
+++ b/src/libsodium/include/Makefile.in
@@ -383,6 +383,7 @@ SODIUM_EXPORT = \
sodium/crypto_kdf_hkdf_sha256.h \
sodium/crypto_kdf_hkdf_sha512.h \
sodium/crypto_kdf_blake2b.h \
+ sodium/crypto_kem_mlkem768.h \
sodium/crypto_kx.h \
sodium/crypto_onetimeauth.h \
sodium/crypto_onetimeauth_poly1305.h \
diff --git a/src/libsodium/include/sodium.h b/src/libsodium/include/sodium.h
index 43015093..f1f48f39 100644
--- a/src/libsodium/include/sodium.h
+++ b/src/libsodium/include/sodium.h
@@ -34,6 +34,7 @@
#include "sodium/crypto_kdf_hkdf_sha256.h"
#include "sodium/crypto_kdf_hkdf_sha512.h"
#include "sodium/crypto_kem_mlkem768.h"
+#include "sodium/crypto_kem_xwing.h"
#include "sodium/crypto_kx.h"
#include "sodium/crypto_onetimeauth.h"
#include "sodium/crypto_onetimeauth_poly1305.h"
diff --git a/src/libsodium/include/sodium/crypto_kem_xwing.h b/src/libsodium/include/sodium/crypto_kem_xwing.h
new file mode 100644
index 00000000..d1be2d08
--- /dev/null
+++ b/src/libsodium/include/sodium/crypto_kem_xwing.h
@@ -0,0 +1,69 @@
+#ifndef crypto_kem_xwing_H
+#define crypto_kem_xwing_H
+
+#include
+
+#include "export.h"
+
+#ifdef __cplusplus
+# ifdef __GNUC__
+# pragma GCC diagnostic ignored "-Wlong-long"
+# endif
+extern "C" {
+#endif
+
+#define crypto_kem_xwing_PUBLICKEYBYTES 1216U
+SODIUM_EXPORT
+size_t crypto_kem_xwing_publickeybytes(void);
+
+#define crypto_kem_xwing_SECRETKEYBYTES 32U
+SODIUM_EXPORT
+size_t crypto_kem_xwing_secretkeybytes(void);
+
+#define crypto_kem_xwing_CIPHERTEXTBYTES 1120U
+SODIUM_EXPORT
+size_t crypto_kem_xwing_ciphertextbytes(void);
+
+#define crypto_kem_xwing_SHAREDSECRETBYTES 32U
+SODIUM_EXPORT
+size_t crypto_kem_xwing_sharedsecretbytes(void);
+
+#define crypto_kem_xwing_SEEDBYTES 32U
+SODIUM_EXPORT
+size_t crypto_kem_xwing_seedbytes(void);
+
+SODIUM_EXPORT
+int crypto_kem_xwing_seed_keypair(unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES],
+ unsigned char sk[crypto_kem_xwing_SECRETKEYBYTES],
+ const unsigned char seed[crypto_kem_xwing_SEEDBYTES])
+ __attribute__((nonnull));
+
+SODIUM_EXPORT
+int crypto_kem_xwing_keypair(unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES],
+ unsigned char sk[crypto_kem_xwing_SECRETKEYBYTES])
+ __attribute__((nonnull));
+
+SODIUM_EXPORT
+int crypto_kem_xwing_enc(unsigned char ct[crypto_kem_xwing_CIPHERTEXTBYTES],
+ unsigned char ss[crypto_kem_xwing_SHAREDSECRETBYTES],
+ const unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES])
+ __attribute__((warn_unused_result)) __attribute__((nonnull));
+
+SODIUM_EXPORT
+int crypto_kem_xwing_enc_deterministic(unsigned char ct[crypto_kem_xwing_CIPHERTEXTBYTES],
+ unsigned char ss[crypto_kem_xwing_SHAREDSECRETBYTES],
+ const unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES],
+ const unsigned char seed[64])
+ __attribute__((warn_unused_result)) __attribute__((nonnull));
+
+SODIUM_EXPORT
+int crypto_kem_xwing_dec(unsigned char ss[crypto_kem_xwing_SHAREDSECRETBYTES],
+ const unsigned char ct[crypto_kem_xwing_CIPHERTEXTBYTES],
+ const unsigned char sk[crypto_kem_xwing_SECRETKEYBYTES])
+ __attribute__((warn_unused_result)) __attribute__((nonnull));
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/test/default/Makefile.am b/test/default/Makefile.am
index b1d0ff79..8820548f 100644
--- a/test/default/Makefile.am
+++ b/test/default/Makefile.am
@@ -265,6 +265,7 @@ TESTS_TARGETS = \
ipcrypt \
kdf \
kem_mlkem768 \
+ kem_xwing \
keygen \
kx \
metamorphic \
@@ -472,7 +473,6 @@ kem_mlkem768_LDADD = $(TESTS_LDADD)
kem_xwing_SOURCE = cmptest.h kem_xwing.c
kem_xwing_LDADD = $(TESTS_LDADD)
-
keygen_SOURCE = cmptest.h keygen.c
keygen_LDADD = $(TESTS_LDADD)
diff --git a/test/default/Makefile.in b/test/default/Makefile.in
index c657354e..ec6e0d39 100644
--- a/test/default/Makefile.in
+++ b/test/default/Makefile.in
@@ -159,15 +159,16 @@ am__EXEEXT_3 = aead_aegis128l$(EXEEXT) aead_aegis256$(EXEEXT) \
generichash$(EXEEXT) generichash2$(EXEEXT) \
generichash3$(EXEEXT) hash$(EXEEXT) hash3$(EXEEXT) \
hash_sha3256$(EXEEXT) hash_sha3512$(EXEEXT) ipcrypt$(EXEEXT) \
- kdf$(EXEEXT) keygen$(EXEEXT) kx$(EXEEXT) metamorphic$(EXEEXT) \
- misuse$(EXEEXT) onetimeauth$(EXEEXT) onetimeauth2$(EXEEXT) \
- onetimeauth7$(EXEEXT) pwhash_argon2i$(EXEEXT) \
- pwhash_argon2id$(EXEEXT) pwhash_argon2id2$(EXEEXT) \
- randombytes$(EXEEXT) scalarmult$(EXEEXT) scalarmult2$(EXEEXT) \
- scalarmult5$(EXEEXT) scalarmult6$(EXEEXT) scalarmult7$(EXEEXT) \
- scalarmult8$(EXEEXT) secretbox$(EXEEXT) secretbox2$(EXEEXT) \
- secretbox7$(EXEEXT) secretbox8$(EXEEXT) \
- secretbox_easy$(EXEEXT) secretbox_easy2$(EXEEXT) \
+ kdf$(EXEEXT) kem_mlkem768$(EXEEXT) keygen$(EXEEXT) kx$(EXEEXT) \
+ metamorphic$(EXEEXT) misuse$(EXEEXT) onetimeauth$(EXEEXT) \
+ onetimeauth2$(EXEEXT) onetimeauth7$(EXEEXT) \
+ pwhash_argon2i$(EXEEXT) pwhash_argon2id$(EXEEXT) \
+ pwhash_argon2id2$(EXEEXT) randombytes$(EXEEXT) \
+ scalarmult$(EXEEXT) scalarmult2$(EXEEXT) scalarmult5$(EXEEXT) \
+ scalarmult6$(EXEEXT) scalarmult7$(EXEEXT) scalarmult8$(EXEEXT) \
+ secretbox$(EXEEXT) secretbox2$(EXEEXT) secretbox7$(EXEEXT) \
+ secretbox8$(EXEEXT) secretbox_easy$(EXEEXT) \
+ secretbox_easy2$(EXEEXT) \
secretstream_xchacha20poly1305$(EXEEXT) shorthash$(EXEEXT) \
sign$(EXEEXT) sodium_core$(EXEEXT) sodium_utils$(EXEEXT) \
sodium_version$(EXEEXT) stream$(EXEEXT) stream2$(EXEEXT) \
@@ -323,6 +324,9 @@ kdf_hkdf3_DEPENDENCIES = $(TESTS_LDADD)
kdf_hkdf4_SOURCES = kdf_hkdf4.c
kdf_hkdf4_OBJECTS = kdf_hkdf4.$(OBJEXT)
kdf_hkdf4_DEPENDENCIES = $(TESTS_LDADD)
+kem_mlkem768_SOURCES = kem_mlkem768.c
+kem_mlkem768_OBJECTS = kem_mlkem768.$(OBJEXT)
+kem_mlkem768_DEPENDENCIES = $(TESTS_LDADD)
keygen_SOURCES = keygen.c
keygen_OBJECTS = keygen.$(OBJEXT)
keygen_DEPENDENCIES = $(TESTS_LDADD)
@@ -514,16 +518,17 @@ am__depfiles_remade = ./$(DEPDIR)/aead_aegis128l.Po \
./$(DEPDIR)/ipcrypt.Po ./$(DEPDIR)/kdf.Po \
./$(DEPDIR)/kdf_hkdf.Po ./$(DEPDIR)/kdf_hkdf2.Po \
./$(DEPDIR)/kdf_hkdf3.Po ./$(DEPDIR)/kdf_hkdf4.Po \
- ./$(DEPDIR)/keygen.Po ./$(DEPDIR)/kx.Po \
- ./$(DEPDIR)/metamorphic.Po ./$(DEPDIR)/misuse.Po \
- ./$(DEPDIR)/onetimeauth.Po ./$(DEPDIR)/onetimeauth2.Po \
- ./$(DEPDIR)/onetimeauth7.Po ./$(DEPDIR)/pwhash_argon2i.Po \
- ./$(DEPDIR)/pwhash_argon2id.Po ./$(DEPDIR)/pwhash_argon2id2.Po \
- ./$(DEPDIR)/pwhash_scrypt.Po ./$(DEPDIR)/pwhash_scrypt_ll.Po \
- ./$(DEPDIR)/randombytes.Po ./$(DEPDIR)/scalarmult.Po \
- ./$(DEPDIR)/scalarmult2.Po ./$(DEPDIR)/scalarmult5.Po \
- ./$(DEPDIR)/scalarmult6.Po ./$(DEPDIR)/scalarmult7.Po \
- ./$(DEPDIR)/scalarmult8.Po ./$(DEPDIR)/scalarmult_ed25519.Po \
+ ./$(DEPDIR)/kem_mlkem768.Po ./$(DEPDIR)/keygen.Po \
+ ./$(DEPDIR)/kx.Po ./$(DEPDIR)/metamorphic.Po \
+ ./$(DEPDIR)/misuse.Po ./$(DEPDIR)/onetimeauth.Po \
+ ./$(DEPDIR)/onetimeauth2.Po ./$(DEPDIR)/onetimeauth7.Po \
+ ./$(DEPDIR)/pwhash_argon2i.Po ./$(DEPDIR)/pwhash_argon2id.Po \
+ ./$(DEPDIR)/pwhash_argon2id2.Po ./$(DEPDIR)/pwhash_scrypt.Po \
+ ./$(DEPDIR)/pwhash_scrypt_ll.Po ./$(DEPDIR)/randombytes.Po \
+ ./$(DEPDIR)/scalarmult.Po ./$(DEPDIR)/scalarmult2.Po \
+ ./$(DEPDIR)/scalarmult5.Po ./$(DEPDIR)/scalarmult6.Po \
+ ./$(DEPDIR)/scalarmult7.Po ./$(DEPDIR)/scalarmult8.Po \
+ ./$(DEPDIR)/scalarmult_ed25519.Po \
./$(DEPDIR)/scalarmult_ristretto255.Po \
./$(DEPDIR)/secretbox.Po ./$(DEPDIR)/secretbox2.Po \
./$(DEPDIR)/secretbox7.Po ./$(DEPDIR)/secretbox8.Po \
@@ -570,20 +575,20 @@ SOURCES = aead_aegis128l.c aead_aegis256.c aead_aes256gcm.c \
core_ristretto255.c ed25519_convert.c generichash.c \
generichash2.c generichash3.c hash.c hash3.c hash_sha3256.c \
hash_sha3512.c ipcrypt.c kdf.c kdf_hkdf.c kdf_hkdf2.c \
- kdf_hkdf3.c kdf_hkdf4.c keygen.c kx.c metamorphic.c misuse.c \
- onetimeauth.c onetimeauth2.c onetimeauth7.c pwhash_argon2i.c \
- pwhash_argon2id.c pwhash_argon2id2.c pwhash_scrypt.c \
- pwhash_scrypt_ll.c randombytes.c scalarmult.c scalarmult2.c \
- scalarmult5.c scalarmult6.c scalarmult7.c scalarmult8.c \
- scalarmult_ed25519.c scalarmult_ristretto255.c secretbox.c \
- secretbox2.c secretbox7.c secretbox8.c secretbox_easy.c \
- secretbox_easy2.c secretstream_xchacha20poly1305.c shorthash.c \
- sign.c siphashx24.c sodium_core.c sodium_utils.c \
- sodium_utils2.c sodium_utils3.c sodium_utils4.c \
- sodium_version.c stream.c stream2.c stream3.c stream4.c \
- stream5.c stream6.c verify1.c xchacha20.c xof2.c \
- xof_shake128.c xof_shake256.c xof_turboshake128.c \
- xof_turboshake256.c
+ kdf_hkdf3.c kdf_hkdf4.c kem_mlkem768.c keygen.c kx.c \
+ metamorphic.c misuse.c onetimeauth.c onetimeauth2.c \
+ onetimeauth7.c pwhash_argon2i.c pwhash_argon2id.c \
+ pwhash_argon2id2.c pwhash_scrypt.c pwhash_scrypt_ll.c \
+ randombytes.c scalarmult.c scalarmult2.c scalarmult5.c \
+ scalarmult6.c scalarmult7.c scalarmult8.c scalarmult_ed25519.c \
+ scalarmult_ristretto255.c secretbox.c secretbox2.c \
+ secretbox7.c secretbox8.c secretbox_easy.c secretbox_easy2.c \
+ secretstream_xchacha20poly1305.c shorthash.c sign.c \
+ siphashx24.c sodium_core.c sodium_utils.c sodium_utils2.c \
+ sodium_utils3.c sodium_utils4.c sodium_version.c stream.c \
+ stream2.c stream3.c stream4.c stream5.c stream6.c verify1.c \
+ xchacha20.c xof2.c xof_shake128.c xof_shake256.c \
+ xof_turboshake128.c xof_turboshake256.c
DIST_SOURCES = aead_aegis128l.c aead_aegis256.c aead_aes256gcm.c \
aead_aes256gcm2.c aead_chacha20poly1305.c \
aead_chacha20poly13052.c aead_xchacha20poly1305.c auth.c \
@@ -594,20 +599,20 @@ DIST_SOURCES = aead_aegis128l.c aead_aegis256.c aead_aes256gcm.c \
core_ristretto255.c ed25519_convert.c generichash.c \
generichash2.c generichash3.c hash.c hash3.c hash_sha3256.c \
hash_sha3512.c ipcrypt.c kdf.c kdf_hkdf.c kdf_hkdf2.c \
- kdf_hkdf3.c kdf_hkdf4.c keygen.c kx.c metamorphic.c misuse.c \
- onetimeauth.c onetimeauth2.c onetimeauth7.c pwhash_argon2i.c \
- pwhash_argon2id.c pwhash_argon2id2.c pwhash_scrypt.c \
- pwhash_scrypt_ll.c randombytes.c scalarmult.c scalarmult2.c \
- scalarmult5.c scalarmult6.c scalarmult7.c scalarmult8.c \
- scalarmult_ed25519.c scalarmult_ristretto255.c secretbox.c \
- secretbox2.c secretbox7.c secretbox8.c secretbox_easy.c \
- secretbox_easy2.c secretstream_xchacha20poly1305.c shorthash.c \
- sign.c siphashx24.c sodium_core.c sodium_utils.c \
- sodium_utils2.c sodium_utils3.c sodium_utils4.c \
- sodium_version.c stream.c stream2.c stream3.c stream4.c \
- stream5.c stream6.c verify1.c xchacha20.c xof2.c \
- xof_shake128.c xof_shake256.c xof_turboshake128.c \
- xof_turboshake256.c
+ kdf_hkdf3.c kdf_hkdf4.c kem_mlkem768.c keygen.c kx.c \
+ metamorphic.c misuse.c onetimeauth.c onetimeauth2.c \
+ onetimeauth7.c pwhash_argon2i.c pwhash_argon2id.c \
+ pwhash_argon2id2.c pwhash_scrypt.c pwhash_scrypt_ll.c \
+ randombytes.c scalarmult.c scalarmult2.c scalarmult5.c \
+ scalarmult6.c scalarmult7.c scalarmult8.c scalarmult_ed25519.c \
+ scalarmult_ristretto255.c secretbox.c secretbox2.c \
+ secretbox7.c secretbox8.c secretbox_easy.c secretbox_easy2.c \
+ secretstream_xchacha20poly1305.c shorthash.c sign.c \
+ siphashx24.c sodium_core.c sodium_utils.c sodium_utils2.c \
+ sodium_utils3.c sodium_utils4.c sodium_version.c stream.c \
+ stream2.c stream3.c stream4.c stream5.c stream6.c verify1.c \
+ xchacha20.c xof2.c xof_shake128.c xof_shake256.c \
+ xof_turboshake128.c xof_turboshake256.c
am__can_run_installinfo = \
case $$AM_UPDATE_INFO_DIR in \
n|no|NO) false;; \
@@ -1243,14 +1248,14 @@ TESTS_TARGETS = aead_aegis128l aead_aegis256 aead_aes256gcm \
codecs codecs2 codecs3 core_keccak1600 core1 core2 core3 core4 \
core5 core6 ed25519_convert generichash generichash2 \
generichash3 hash hash3 hash_sha3256 hash_sha3512 ipcrypt kdf \
- keygen kx metamorphic misuse onetimeauth onetimeauth2 \
- onetimeauth7 pwhash_argon2i pwhash_argon2id pwhash_argon2id2 \
- randombytes scalarmult scalarmult2 scalarmult5 scalarmult6 \
- scalarmult7 scalarmult8 secretbox secretbox2 secretbox7 \
- secretbox8 secretbox_easy secretbox_easy2 \
- secretstream_xchacha20poly1305 shorthash sign sodium_core \
- sodium_utils sodium_version stream stream2 stream3 stream4 \
- verify1 xof_shake128 xof_shake256 xof_turboshake128 \
+ kem_mlkem768 keygen kx metamorphic misuse onetimeauth \
+ onetimeauth2 onetimeauth7 pwhash_argon2i pwhash_argon2id \
+ pwhash_argon2id2 randombytes scalarmult scalarmult2 \
+ scalarmult5 scalarmult6 scalarmult7 scalarmult8 secretbox \
+ secretbox2 secretbox7 secretbox8 secretbox_easy \
+ secretbox_easy2 secretstream_xchacha20poly1305 shorthash sign \
+ sodium_core sodium_utils sodium_version stream stream2 stream3 \
+ stream4 verify1 xof_shake128 xof_shake256 xof_turboshake128 \
xof_turboshake256 xof2 $(am__append_1) $(am__append_2)
TESTS_LDADD = \
${top_builddir}/src/libsodium/libsodium.la
@@ -1688,6 +1693,10 @@ kdf_hkdf4$(EXEEXT): $(kdf_hkdf4_OBJECTS) $(kdf_hkdf4_DEPENDENCIES) $(EXTRA_kdf_h
@rm -f kdf_hkdf4$(EXEEXT)
$(AM_V_CCLD)$(LINK) $(kdf_hkdf4_OBJECTS) $(kdf_hkdf4_LDADD) $(LIBS)
+kem_mlkem768$(EXEEXT): $(kem_mlkem768_OBJECTS) $(kem_mlkem768_DEPENDENCIES) $(EXTRA_kem_mlkem768_DEPENDENCIES)
+ @rm -f kem_mlkem768$(EXEEXT)
+ $(AM_V_CCLD)$(LINK) $(kem_mlkem768_OBJECTS) $(kem_mlkem768_LDADD) $(LIBS)
+
keygen$(EXEEXT): $(keygen_OBJECTS) $(keygen_DEPENDENCIES) $(EXTRA_keygen_DEPENDENCIES)
@rm -f keygen$(EXEEXT)
$(AM_V_CCLD)$(LINK) $(keygen_OBJECTS) $(keygen_LDADD) $(LIBS)
@@ -1942,6 +1951,7 @@ distclean-compile:
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kdf_hkdf2.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kdf_hkdf3.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kdf_hkdf4.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kem_mlkem768.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/keygen.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kx.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/metamorphic.Po@am__quote@ # am--include-marker
@@ -2541,6 +2551,13 @@ kdf.log: kdf$(EXEEXT)
--log-file $$b.log --trs-file $$b.trs \
$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
"$$tst" $(AM_TESTS_FD_REDIRECT)
+kem_mlkem768.log: kem_mlkem768$(EXEEXT)
+ @p='kem_mlkem768$(EXEEXT)'; \
+ b='kem_mlkem768'; \
+ $(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \
+ --log-file $$b.log --trs-file $$b.trs \
+ $(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
+ "$$tst" $(AM_TESTS_FD_REDIRECT)
keygen.log: keygen$(EXEEXT)
@p='keygen$(EXEEXT)'; \
b='keygen'; \
@@ -3075,6 +3092,7 @@ distclean: distclean-am
-rm -f ./$(DEPDIR)/kdf_hkdf2.Po
-rm -f ./$(DEPDIR)/kdf_hkdf3.Po
-rm -f ./$(DEPDIR)/kdf_hkdf4.Po
+ -rm -f ./$(DEPDIR)/kem_mlkem768.Po
-rm -f ./$(DEPDIR)/keygen.Po
-rm -f ./$(DEPDIR)/kx.Po
-rm -f ./$(DEPDIR)/metamorphic.Po
@@ -3218,6 +3236,7 @@ maintainer-clean: maintainer-clean-am
-rm -f ./$(DEPDIR)/kdf_hkdf2.Po
-rm -f ./$(DEPDIR)/kdf_hkdf3.Po
-rm -f ./$(DEPDIR)/kdf_hkdf4.Po
+ -rm -f ./$(DEPDIR)/kem_mlkem768.Po
-rm -f ./$(DEPDIR)/keygen.Po
-rm -f ./$(DEPDIR)/kx.Po
-rm -f ./$(DEPDIR)/metamorphic.Po
diff --git a/test/default/kem_xwing.c b/test/default/kem_xwing.c
new file mode 100644
index 00000000..c008c97e
--- /dev/null
+++ b/test/default/kem_xwing.c
@@ -0,0 +1,217 @@
+#define TEST_NAME "kem_xwing"
+#include "cmptest.h"
+
+static const char tv0_seed[] =
+ "0000000000000000000000000000000000000000000000000000000000000000";
+static const char tv0_randomness[] =
+ "6464646464646464646464646464646464646464646464646464646464646464"
+ "6464646464646464646464646464646464646464646464646464646464646464";
+static const char tv0_ek_prefix[] =
+ "3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978";
+static const char tv0_ct_prefix[] =
+ "d81018a94f8078e02105beaa814e003390befa4589bb614f7739";
+static const char tv0_ss[] =
+ "e5ba94031ea6efd69c09c254f6d9783136ba6037e2d4c43bcccf19d6f3f4343a";
+
+static const char tv1_seed[] =
+ "0101010101010101010101010101010101010101010101010101010101010101";
+static const char tv1_randomness[] =
+ "6565656565656565656565656565656565656565656565656565656565656565"
+ "6565656565656565656565656565656565656565656565656565656565656565";
+static const char tv1_ek_prefix[] =
+ "ec7b50cddc8360f98b189bac73d395ef947b37d8453886a253269f7b18b9eb78";
+static const char tv1_ct_prefix[] =
+ "600ecf4026683898d0e339eeea9ebd437a4a802952bf32bfa326";
+static const char tv1_ss[] =
+ "750300db25bff9620e893c2c6fcab9bf04d7f2e543b5b39420485626fa274908";
+
+static const char tv2_seed[] =
+ "0202020202020202020202020202020202020202020202020202020202020202";
+static const char tv2_randomness[] =
+ "6666666666666666666666666666666666666666666666666666666666666666"
+ "6666666666666666666666666666666666666666666666666666666666666666";
+static const char tv2_ek_prefix[] =
+ "08118d8819772292c976ec971ee3039195800c823544484595cc63450b9db941";
+static const char tv2_ct_prefix[] =
+ "413c55d5710bae6376761dada807daffd4dc45f9f70d825e0d46";
+static const char tv2_ss[] =
+ "87292f18b2e7af74bb8839ddee15e832d2f4bfac14dc84f824906d951436aafa";
+
+static int
+test_kat_vector(const char *seed_hex, const char *randomness_hex,
+ const char *ek_prefix_hex, const char *ct_prefix_hex,
+ const char *ss_hex)
+{
+ unsigned char seed[crypto_kem_xwing_SEEDBYTES];
+ unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES];
+ unsigned char sk[crypto_kem_xwing_SECRETKEYBYTES];
+ unsigned char randomness[64];
+ unsigned char ct[crypto_kem_xwing_CIPHERTEXTBYTES];
+ unsigned char ss_enc[crypto_kem_xwing_SHAREDSECRETBYTES];
+ unsigned char ss_dec[crypto_kem_xwing_SHAREDSECRETBYTES];
+ unsigned char expected_ek_prefix[32];
+ unsigned char expected_ct_prefix[26];
+ unsigned char expected_ss[32];
+ char hex[65];
+
+ sodium_hex2bin(seed, sizeof seed, seed_hex, strlen(seed_hex), NULL, NULL, NULL);
+ sodium_hex2bin(randomness, sizeof randomness, randomness_hex, strlen(randomness_hex),
+ NULL, NULL, NULL);
+ sodium_hex2bin(expected_ek_prefix, sizeof expected_ek_prefix, ek_prefix_hex,
+ strlen(ek_prefix_hex), NULL, NULL, NULL);
+ sodium_hex2bin(expected_ct_prefix, sizeof expected_ct_prefix, ct_prefix_hex,
+ strlen(ct_prefix_hex), NULL, NULL, NULL);
+ sodium_hex2bin(expected_ss, sizeof expected_ss, ss_hex, strlen(ss_hex), NULL, NULL, NULL);
+
+ crypto_kem_xwing_seed_keypair(pk, sk, seed);
+
+ if (memcmp(pk, expected_ek_prefix, 32) != 0) {
+ sodium_bin2hex(hex, sizeof hex, pk, 32);
+ printf("pk mismatch: got %s\n", hex);
+ return -1;
+ }
+
+ assert(crypto_kem_xwing_enc_deterministic(ct, ss_enc, pk, randomness) == 0);
+
+ if (memcmp(ct, expected_ct_prefix, 26) != 0) {
+ sodium_bin2hex(hex, sizeof hex, ct, 26);
+ printf("ct mismatch: got %s\n", hex);
+ return -1;
+ }
+
+ if (memcmp(ss_enc, expected_ss, 32) != 0) {
+ sodium_bin2hex(hex, sizeof hex, ss_enc, 32);
+ printf("ss_enc mismatch: got %s\n", hex);
+ return -1;
+ }
+
+ assert(crypto_kem_xwing_dec(ss_dec, ct, sk) == 0);
+
+ if (memcmp(ss_dec, expected_ss, 32) != 0) {
+ sodium_bin2hex(hex, sizeof hex, ss_dec, 32);
+ printf("ss_dec mismatch: got %s\n", hex);
+ return -1;
+ }
+
+ return 0;
+}
+
+static void
+tv_kem_xwing(void)
+{
+ unsigned char *pk;
+ unsigned char *sk;
+ unsigned char *seed;
+ unsigned char *ct;
+ unsigned char *ss_enc;
+ unsigned char *ss_dec;
+ unsigned char *randomness;
+ char hex[65];
+ int i;
+
+ pk = (unsigned char *) sodium_malloc(crypto_kem_xwing_PUBLICKEYBYTES);
+ sk = (unsigned char *) sodium_malloc(crypto_kem_xwing_SECRETKEYBYTES);
+ seed = (unsigned char *) sodium_malloc(crypto_kem_xwing_SEEDBYTES);
+ ct = (unsigned char *) sodium_malloc(crypto_kem_xwing_CIPHERTEXTBYTES);
+ ss_enc = (unsigned char *) sodium_malloc(crypto_kem_xwing_SHAREDSECRETBYTES);
+ ss_dec = (unsigned char *) sodium_malloc(crypto_kem_xwing_SHAREDSECRETBYTES);
+ randomness = (unsigned char *) sodium_malloc(64);
+
+ for (i = 0; i < (int) crypto_kem_xwing_SEEDBYTES; i++) {
+ seed[i] = (unsigned char) i;
+ }
+ crypto_kem_xwing_seed_keypair(pk, sk, seed);
+
+ sodium_bin2hex(hex, sizeof hex, pk, 32);
+ printf("pk (first 32 bytes): [%s]\n", hex);
+ sodium_bin2hex(hex, sizeof hex, sk, 32);
+ printf("sk: [%s]\n", hex);
+
+ for (i = 0; i < 64; i++) {
+ randomness[i] = (unsigned char)(i + 64);
+ }
+ assert(crypto_kem_xwing_enc_deterministic(ct, ss_enc, pk, randomness) == 0);
+
+ sodium_bin2hex(hex, sizeof hex, ct, 32);
+ printf("ct (first 32 bytes): [%s]\n", hex);
+ sodium_bin2hex(hex, sizeof hex, ss_enc, crypto_kem_xwing_SHAREDSECRETBYTES);
+ printf("ss_enc: [%s]\n", hex);
+
+ assert(crypto_kem_xwing_dec(ss_dec, ct, sk) == 0);
+
+ sodium_bin2hex(hex, sizeof hex, ss_dec, crypto_kem_xwing_SHAREDSECRETBYTES);
+ printf("ss_dec: [%s]\n", hex);
+
+ if (memcmp(ss_enc, ss_dec, crypto_kem_xwing_SHAREDSECRETBYTES) != 0) {
+ printf("ERROR: shared secrets don't match!\n");
+ } else {
+ printf("shared secrets match: ok\n");
+ }
+
+ crypto_kem_xwing_keypair(pk, sk);
+ assert(crypto_kem_xwing_enc(ct, ss_enc, pk) == 0);
+ assert(crypto_kem_xwing_dec(ss_dec, ct, sk) == 0);
+ if (memcmp(ss_enc, ss_dec, crypto_kem_xwing_SHAREDSECRETBYTES) != 0) {
+ printf("ERROR: shared secrets don't match (random keys)!\n");
+ } else {
+ printf("random keypair test: ok\n");
+ }
+
+ assert(crypto_kem_xwing_publickeybytes() == crypto_kem_xwing_PUBLICKEYBYTES);
+ assert(crypto_kem_xwing_secretkeybytes() == crypto_kem_xwing_SECRETKEYBYTES);
+ assert(crypto_kem_xwing_ciphertextbytes() == crypto_kem_xwing_CIPHERTEXTBYTES);
+ assert(crypto_kem_xwing_sharedsecretbytes() == crypto_kem_xwing_SHAREDSECRETBYTES);
+ assert(crypto_kem_xwing_seedbytes() == crypto_kem_xwing_SEEDBYTES);
+
+ assert(crypto_kem_xwing_PUBLICKEYBYTES == 1216U);
+ assert(crypto_kem_xwing_SECRETKEYBYTES == 32U);
+ assert(crypto_kem_xwing_CIPHERTEXTBYTES == 1120U);
+ assert(crypto_kem_xwing_SHAREDSECRETBYTES == 32U);
+ assert(crypto_kem_xwing_SEEDBYTES == 32U);
+
+ printf("constants: ok\n");
+
+ sodium_free(randomness);
+ sodium_free(ss_dec);
+ sodium_free(ss_enc);
+ sodium_free(ct);
+ sodium_free(seed);
+ sodium_free(sk);
+ sodium_free(pk);
+
+ printf("tv_kem_xwing: ok\n");
+}
+
+static void
+tv_kem_xwing_kat(void)
+{
+ printf("IETF KAT vector 0: ");
+ if (test_kat_vector(tv0_seed, tv0_randomness, tv0_ek_prefix, tv0_ct_prefix, tv0_ss) == 0) {
+ printf("ok\n");
+ } else {
+ printf("FAILED\n");
+ }
+
+ printf("IETF KAT vector 1: ");
+ if (test_kat_vector(tv1_seed, tv1_randomness, tv1_ek_prefix, tv1_ct_prefix, tv1_ss) == 0) {
+ printf("ok\n");
+ } else {
+ printf("FAILED\n");
+ }
+
+ printf("IETF KAT vector 2: ");
+ if (test_kat_vector(tv2_seed, tv2_randomness, tv2_ek_prefix, tv2_ct_prefix, tv2_ss) == 0) {
+ printf("ok\n");
+ } else {
+ printf("FAILED\n");
+ }
+}
+
+int
+main(void)
+{
+ tv_kem_xwing();
+ tv_kem_xwing_kat();
+
+ return 0;
+}
diff --git a/test/default/kem_xwing.exp b/test/default/kem_xwing.exp
new file mode 100644
index 00000000..0f74c945
--- /dev/null
+++ b/test/default/kem_xwing.exp
@@ -0,0 +1,12 @@
+pk (first 32 bytes): [6f54098a0a0e641146614b6960ba60d8603d62f447f9ab499b47bd6906cc40b0]
+sk: [000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f]
+ct (first 32 bytes): [332c248ecac774a5b9e28b7018565b7e07b57733b8e68a432084b39b9221e497]
+ss_enc: [f285b028f4de617b6adf9eccbd811327848dd44ac7078c15390b16682576ad8c]
+ss_dec: [f285b028f4de617b6adf9eccbd811327848dd44ac7078c15390b16682576ad8c]
+shared secrets match: ok
+random keypair test: ok
+constants: ok
+tv_kem_xwing: ok
+IETF KAT vector 0: ok
+IETF KAT vector 1: ok
+IETF KAT vector 2: ok