| ... | ... | @@ -274,18 +274,18 @@ fn Kyber(comptime p: Params) type { |
| 274 | 274 | g.update(&pk.hpk); |
| 275 | 275 | g.final(&kr); |
| 276 | 276 | |
| 277 | | // c = innerEncrypy(pk, m, r) |
| 277 | // c = innerEncrypt(pk, m, r) |
| 278 | 278 | const ct = pk.pk.encrypt(&m, kr[32..64]); |
| 279 | 279 | |
| 280 | | // Compute H(c) and put in second slot of kr, which will be (K', H(c)). |
| 281 | | sha3.Sha3_256.hash(&ct, kr[32..], .{}); |
| 282 | | |
| 283 | 280 | if (p.ml_kem) { |
| 284 | 281 | return EncapsulatedSecret{ |
| 285 | 282 | .shared_secret = kr[0..shared_length].*, // ML-KEM: K = K' |
| 286 | 283 | .ciphertext = ct, |
| 287 | 284 | }; |
| 288 | 285 | } else { |
| 286 | // Compute H(c) and put in second slot of kr, which will be (K', H(c)). |
| 287 | sha3.Sha3_256.hash(&ct, kr[32..], .{}); |
| 288 | |
| 289 | 289 | var ss: [shared_length]u8 = undefined; |
| 290 | 290 | sha3.Shake256.hash(&kr, &ss, .{}); |
| 291 | 291 | return EncapsulatedSecret{ |