barett_reducing in inverse ntt to avoid overflows.

cryspen · Aug 24, 2023 · 23c2c7c · 23c2c7c
1 parent 76eb6cf
commit 23c2c7c
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/src/kem/kyber768/ind_cpa.rs b/src/kem/kyber768/ind_cpa.rs
@@ -254,7 +254,6 @@ pub(crate) fn encrypt(
     let mut u = multiply_matrix_by_column(&A_transpose, &r_as_ntt);
     for i in 0..RANK {
         u[i] = invert_ntt(u[i]) + error_1[i];
-        u[i].coefficients = u[i].coefficients.map(barrett_reduce);
     }
 
     // v := NTT^{−1}(tˆT ◦ rˆ) + e_2 + Decompress_q(Decode_1(m),1)

diff --git a/src/kem/kyber768/ntt.rs b/src/kem/kyber768/ntt.rs
@@ -70,7 +70,8 @@ pub(crate) mod kyber_polynomial_ring_element_mod {
         // so we can just left-shift by 9 bits.
         re.coefficients = re
             .coefficients
-            .map(|coefficient| montgomery_reduce((coefficient as i32) << 9));
+            .map(|coefficient| montgomery_reduce((coefficient as i32) << 9))
+            .map(barrett_reduce);
 
         re
     }