Workarounds for Charon issues in portable ml-kem

.gitignore

@@ -11,3 +11,4 @@ fuzz/artifacts
 proofs/fstar/extraction/.cache
 __pycache__
 kyber-crate/
+*.llbc

libcrux-ml-kem/.gitignore

@@ -1,3 +1,4 @@
 Cargo.lock
 proofs/fstar/extraction/.cache/
 proofs/fstar/extraction/.depend
+c

libcrux-ml-kem/c.sh

@@ -15,7 +15,7 @@ mkdir -p c
 cd c
 
 echo "Running eurydice ..."
-$EURYDICE_HOME/eurydice --config ../c.yaml ../libcrux_kyber.llbc
+$EURYDICE_HOME/eurydice --config ../c.yaml ../../libcrux_ml_kem.llbc
 cp $EURYDICE_HOME/include/eurydice_glue.h .
 
 if [[ -n "$HACL_PACKAGES_HOME" ]]; then

libcrux-ml-kem/src/sampling.rs

@@ -158,23 +158,25 @@ pub(super) fn sample_from_xof<const K: usize>(seeds: [[u8; 34]; K]) -> [Polynomi
 fn sample_from_binomial_distribution_2(randomness: &[u8]) -> PolynomialRingElement {
     let mut sampled_i32s = [0i32; 256];
 
-    for (chunk_number, byte_chunk) in randomness.chunks_exact(4).enumerate() {
-        let random_bits_as_u32: u32 = (byte_chunk[0] as u32)
-            | (byte_chunk[1] as u32) << 8
-            | (byte_chunk[2] as u32) << 16
-            | (byte_chunk[3] as u32) << 24;
-
-        let even_bits = random_bits_as_u32 & 0x55555555;
-        let odd_bits = (random_bits_as_u32 >> 1) & 0x55555555;
-        let coin_toss_outcomes = even_bits + odd_bits;
-
-        cloop! {
-            for outcome_set in (0..u32::BITS).step_by(4) {
-                let outcome_1 = ((coin_toss_outcomes >> outcome_set) & 0x3) as i32;
-                let outcome_2 = ((coin_toss_outcomes >> (outcome_set + 2)) & 0x3) as i32;
-
-                let offset = (outcome_set >> 2) as usize;
-                sampled_i32s[8 * chunk_number + offset] = outcome_1 - outcome_2;
+    cloop! {
+        for (chunk_number, byte_chunk) in randomness.chunks_exact(4).enumerate() {
+            let random_bits_as_u32: u32 = (byte_chunk[0] as u32)
+                | (byte_chunk[1] as u32) << 8
+                | (byte_chunk[2] as u32) << 16
+                | (byte_chunk[3] as u32) << 24;
+
+            let even_bits = random_bits_as_u32 & 0x55555555;
+            let odd_bits = (random_bits_as_u32 >> 1) & 0x55555555;
+            let coin_toss_outcomes = even_bits + odd_bits;
+
+            cloop! {
+                for outcome_set in (0..u32::BITS).step_by(4) {
+                    let outcome_1 = ((coin_toss_outcomes >> outcome_set) & 0x3) as i32;
+                    let outcome_2 = ((coin_toss_outcomes >> (outcome_set + 2)) & 0x3) as i32;
+
+                    let offset = (outcome_set >> 2) as usize;
+                    sampled_i32s[8 * chunk_number + offset] = outcome_1 - outcome_2;
+                }
             }
         }
     }

libcrux-ml-kem/src/simd/portable.rs

@@ -228,7 +228,7 @@ fn ntt_multiply(
     zeta0: i32,
     zeta1: i32,
 ) -> PortableVector {
-    let mut out = PortableVector::ZERO();
+    let mut out = ZERO();
     let product = ntt_multiply_binomials(
         (lhs.elements[0], lhs.elements[1]),
         (rhs.elements[0], rhs.elements[1]),
@@ -275,7 +275,7 @@ fn serialize_1(v: PortableVector) -> u8 {
 
 #[inline(always)]
 fn deserialize_1(v: u8) -> PortableVector {
-    let mut result = PortableVector::ZERO();
+    let mut result = ZERO();
     for i in 0..FIELD_ELEMENTS_IN_VECTOR {
         result.elements[i] = ((v >> i) & 0x1) as i32;
     }
@@ -297,7 +297,7 @@ fn serialize_4(v: PortableVector) -> [u8; 4] {
 
 #[inline(always)]
 fn deserialize_4(bytes: &[u8]) -> PortableVector {
-    let mut v = PortableVector::ZERO();
+    let mut v = ZERO();
 
     v.elements[0] = (bytes[0] & 0x0F) as i32;
     v.elements[1] = ((bytes[0] >> 4) & 0x0F) as i32;
@@ -329,7 +329,7 @@ fn serialize_5(v: PortableVector) -> [u8; 5] {
 
 #[inline(always)]
 fn deserialize_5(bytes: &[u8]) -> PortableVector {
-    let mut v = PortableVector::ZERO();
+    let mut v = ZERO();
 
     v.elements[0] = (bytes[0] & 0x1F) as i32;
     v.elements[1] = ((bytes[1] & 0x3) << 3 | (bytes[0] >> 5)) as i32;
@@ -364,7 +364,7 @@ fn serialize_10(v: PortableVector) -> [u8; 10] {
 
 #[inline(always)]
 fn deserialize_10(bytes: &[u8]) -> PortableVector {
-    let mut result = PortableVector::ZERO();
+    let mut result = ZERO();
 
     result.elements[0] = ((bytes[1] as i32 & 0x03) << 8 | (bytes[0] as i32 & 0xFF)) as i32;
     result.elements[1] = ((bytes[2] as i32 & 0x0F) << 6 | (bytes[1] as i32 >> 2)) as i32;
@@ -398,7 +398,7 @@ fn serialize_11(v: PortableVector) -> [u8; 11] {
 
 #[inline(always)]
 fn deserialize_11(bytes: &[u8]) -> PortableVector {
-    let mut result = PortableVector::ZERO();
+    let mut result = ZERO();
     result.elements[0] = ((bytes[1] as i32 & 0x7) << 8 | bytes[0] as i32) as i32;
     result.elements[1] = ((bytes[2] as i32 & 0x3F) << 5 | (bytes[1] as i32 >> 3)) as i32;
     result.elements[2] = ((bytes[4] as i32 & 0x1) << 10
@@ -438,7 +438,7 @@ fn serialize_12(v: PortableVector) -> [u8; 12] {
 
 #[inline(always)]
 fn deserialize_12(bytes: &[u8]) -> PortableVector {
-    let mut re = PortableVector::ZERO();
+    let mut re = ZERO();
 
     let byte0 = bytes[0] as i32;
     let byte1 = bytes[1] as i32;