Refactor FrodoMatrixGenerator (performance)

Author: peterdettman

core/src/main/java/org/bouncycastle/pqc/crypto/frodo/FrodoMatrixGenerator.java

@@ -5,7 +5,6 @@
 import org.bouncycastle.crypto.digests.SHAKEDigest;
 import org.bouncycastle.crypto.engines.AESEngine;
 import org.bouncycastle.crypto.params.KeyParameter;
-import org.bouncycastle.util.Arrays;
 import org.bouncycastle.util.Pack;
 
 abstract class FrodoMatrixGenerator
@@ -33,33 +32,35 @@ short[] genMatrix(byte[] seedA)
         {
             short[] A = new short[n*n];
             short i, j;
-            byte[] b, tmp = new byte[(16 * n) / 8];
+            byte[] tmp = new byte[(16 * n) / 8];
+            byte[] b = new byte[2 + seedA.length];
+            System.arraycopy(seedA, 0, b, 2, seedA.length);
+
+            Xof digest = new SHAKEDigest(128);
+
             for (i = 0; i < n; i++)
             {
                 // 1. b = i || seedA in {0,1}^{16 + len_seedA}, where i is encoded as a 16-bit integer in little-endian byte order
-                b = Arrays.concatenate(Pack.shortToLittleEndian(i), seedA);
+                Pack.shortToLittleEndian(i, b, 0);
 
                 // 2. c_{i,0} || c_{i,1} || ... || c_{i,n-1} = SHAKE128(b, 16n) (length in bits) where each c_{i,j} is parsed as a 16-bit integer in little-endian byte order format
-                Xof digest = new SHAKEDigest(128);
                 digest.update(b, 0, b.length);
                 digest.doFinal(tmp, 0, tmp.length);
                 for (j = 0; j < n; j++)
                 {
-                    A[i*n+j] = (short) (Pack.littleEndianToShort(tmp, 2 * j) % q);
+                    A[i*n+j] = (short) (Pack.littleEndianToShort(tmp, 2 * j) & (q - 1));
                 }
             }
             return A;
         }
-
     }
+
     static class Aes128MatrixGenerator
             extends FrodoMatrixGenerator
     {
-        private final BlockCipher cipher;
         public Aes128MatrixGenerator(int n, int q)
         {
             super(n, q);
-            cipher = new AESEngine();
         }
 
         short[] genMatrix(byte[] seedA)
@@ -70,29 +71,25 @@ short[] genMatrix(byte[] seedA)
             byte[] b = new byte[16];
             byte[] c = new byte[16];
 
-            KeyParameter kp = new KeyParameter(seedA);
-            cipher.init(true, kp);
+            BlockCipher cipher = new AESEngine();
+            cipher.init(true, new KeyParameter(seedA));
 
             // 1. for i = 0; i < n; i += 1
             for (int i = 0; i < n; i++)
             {
                 // 2. for j = 0; j < n; j += 8
                 for (int j = 0; j < n; j+=8)
                 {
-
                     // 3. b = i || j || 0 || ... || 0 in {0,1}^128, where i and j are encoded as 16-bit integers in little-endian byte order
-                    System.arraycopy(Pack.shortToLittleEndian((short) (i&0xffff)), 0, b, 0, 2);
-                    System.arraycopy(Pack.shortToLittleEndian((short) (j&0xffff)), 0, b, 2, 2);
-                    //                b = bytearray(16)
-                    //                struct.pack_into('<H', b, 0, i)
-                    //                struct.pack_into('<H', b, 2, j)
+                    Pack.shortToLittleEndian((short)i, b, 0);
+                    Pack.shortToLittleEndian((short)j, b, 2);
                     // 4. c = AES128(seedA, b)
                     cipher.processBlock(b, 0, c, 0);
                     // 5. for k = 0; k < 8; k += 1
                     for (int k = 0; k < 8; k++)
                     {
                         // 6. A[i][j+k] = c[k] where c is treated as a sequence of 8 16-bit integers each in little-endian byte order
-                        A[i*n+ j + k] = (short) (Pack.littleEndianToShort(c, 2 * k) % q);
+                        A[i*n+ j + k] = (short) (Pack.littleEndianToShort(c, 2 * k) & (q - 1));
                     }
                 }
             }