HRSS: flatten sample distribution.
With HRSS-SXY, the sampling algorithm now longer has to be the same
between the two parties. Therefore we can change it at will (as long as
it remains reasonably uniform) and thus take the opportunity to make the
output distribution flatter.
Change-Id: I74c667fcf919fe11ddcf2f4fb8a540b5112268bf
Reviewed-on: https://boringssl-review.googlesource.com/c/34404
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
diff --git a/include/openssl/hrss.h b/include/openssl/hrss.h
index d4e16dc..5390696 100644
--- a/include/openssl/hrss.h
+++ b/include/openssl/hrss.h
@@ -38,9 +38,8 @@
// HRSS_SAMPLE_BYTES is the number of bytes of entropy needed to generate a
// short vector. There are 701 coefficients, but the final one is always set to
-// zero when sampling. Otherwise, one byte of input is enough to generate two
-// coefficients.
-#define HRSS_SAMPLE_BYTES ((701 - 1) / 2)
+// zero when sampling. Otherwise, we need one byte of input per coefficient.
+#define HRSS_SAMPLE_BYTES (701 - 1)
// HRSS_GENERATE_KEY_BYTES is the number of bytes of entropy needed to generate
// an HRSS key pair.
#define HRSS_GENERATE_KEY_BYTES (HRSS_SAMPLE_BYTES + HRSS_SAMPLE_BYTES + 32)
