Porting of the library

[smuellerDD]

I have integrated BIKE into the leancrypto library [1]. The implementation works and complies with the BIKE-1 through 3 round 4 vectors. The implementations are provided for both user space as well as Linux kernel space integrated with the Linux crypto KPP API.

That said, during the porting, I identified some question. I would be grateful
if I can discuss them with you.

• Can you please help me why you ALIGN(sizeof(idx_t)) of aligned_sk_t
  considering that sk_t is already aligned to idx_t due to compressed_idx_d_t
  including an array of uint32_t integers?

• it seems that compute_syndrome could be made static

• it seems that sample_indicates_fisher_yates could be made static

• it seems that sample_uniform_r_bits_with_fixed_prf_context is not used

• it seems that generated_indices_mod_z could be made static

• Functions K and L: the specification says that the least significant bits of
  the digest should be used. But seemingly the code uses the most significant
  bits. I see no cryptographic difference, but I am wondering regarding the
  consistency with the specification.

• Functions K and L: This code here uses SHA3-384 (i.e. FIPS 202). But the
  specification seems to refer to SHA-384 (FIPS 180). Could you please help me
  what I am misunderstanding here? Do not get me wrong, I am happy to use SHA-3
  considering that already SHAKE is in use and thus we only have one primitive
  we base on instead of two.

• bit_scan_reverse_vartime does not exist -> DUNIFORM_SAMPLING=1 does not seem to compile

After now implementing C and acceleration support, I got these performance numbers on my laptop with AVX2 support. Note, the test performs 200 BIKE keygen/enc/dec rounds. The figures for Kyber performs 50.000 keygen/enc/dec rounds. You can obtain these values on your system by compiling leancrypto and invoke meson test -C build

BIKE 5 KEM 200 AVX2 1.37s
BIKE 5 KEM 200 C 39.79s
BIKE 3 KEM 200 AVX2 0.51s
BIKE 3 KEM 200 C 15.57s
BIKE 1 KEM 200 AVX2 0.16s
BIKE 1 KEM 200 C 5.03s

Kyber 1024 KEM AVX2 50000 2.46s
Kyber 1024 KEM C 50000 8.31s
Kyber 768 KEM AVX2 50000 1.85s
Kyber 768 KEM C 50000 5.25s
Kyber 512 KEM C 50000 3.33s

Thanks a lot

[1] https://github.com/smuellerDD/leancrypto