Module ntt 

ML-KEM (Kyber) negacyclic NTT runtime kernel — the verified scalar reference + AVX2 i16×16 path that compiled LOGOS reaches through the mlkemNtt stdlib function. Ported from the validated scripts/ntt_simd_proto.rs (round-trip + AVX2==scalar bit-identical). q = 3329, R = 2¹⁶, the incomplete 7-level transform over ℤ_q[X]/(X²⁵⁶+1). The Montgomery reduction it uses is kernel-certified (logicaffeine_kernel::field_algebra::montgomery_reduction_*).

Input/output are LOGOS Int (i64); coefficients are reduced into [0, q) at the boundary, the transform runs in i16, and the result is returned reduced into [0, q). On x86-64 with AVX2 the 16-wide kernel runs (≈49 ns/NTT on a modern core); otherwise the scalar path (≈147 ns).

Functions

mlkem_add_mod_q_w16

(a + b) mod q, element-wise on Word16 [0, q) — the native modular-add the Logos matrix-vector loop calls (so the orchestration never does Word16 arithmetic, only structure).

mlkem_base_mul

The compiled form of LOGOS mlkemBaseMul(a, b) — pointwise multiply of two NTT-domain polynomials. mlkemInvNtt(mlkemBaseMul(mlkemNtt(a), mlkemNtt(b))) is the ML-KEM polynomial product a·b in ℤ_q[X]/(X²⁵⁶+1).

mlkem_base_mul_w16

mlkem_base_mul_w16_seq

mlkem_byte_decode

The compiled form of LOGOS byteDecode(bytes, d) — unpack bytes to coefficients.

mlkem_byte_decode_w16

mlkem_byte_decode_w16_from_int

mlkem_byte_decode_w16_seq

mlkem_byte_encode

The compiled form of LOGOS byteEncode(coeffs, d) — pack coefficients to bytes.

mlkem_byte_encode_w16

mlkem_byte_encode_w16_seq

mlkem_byte_encode_w16_to_int

mlkem_cbd2

The compiled form of LOGOS cbd2(buf) — sample a noise polynomial (η=2) from 128 bytes of (SHAKE) randomness; 256 coefficients in [−2, 2].

mlkem_cbd3

The compiled form of LOGOS cbd3(buf) — η=3 noise from 192 bytes; coefficients in [−3, 3].

mlkem_cbd2_w16

CBD noise sampled to [0, q) Word16 (the reduced form the Word16 NTT consumes directly).

mlkem_cbd2_w16_from_int

mlkem_cbd2_w16_seq

mlkem_cbd3_w16

mlkem_cbd3_w16_seq

mlkem_compress

The compiled form of LOGOS compress(coeffs, d) — element-wise Compress_d.

mlkem_compress_w16

mlkem_compress_w16_seq

mlkem_decompress

The compiled form of LOGOS decompress(coeffs, d) — element-wise Decompress_d.

mlkem_decompress_w16

mlkem_decompress_w16_seq

mlkem_inv_ntt

The compiled form of LOGOS mlkemInvNtt(a) — the inverse ML-KEM NTT (tomont), so mlkemInvNtt(mlkemNtt(p)) = p·2285 mod q. Together with mlkemNtt and a base-multiply this is the polynomial-multiplication primitive ML-KEM is built on.

mlkem_inv_ntt_w16

Word16-native inverse NTT, base multiply, and tomont — same zero-conversion carrier.

mlkem_inv_ntt_w16_seq

mlkem_ntt

The compiled form of LOGOS mlkemNtt(a) — the runtime entry the generated Rust calls (and the interpreter dispatches to). Takes/returns the LOGOS Seq of Int carrier.

mlkem_ntt_w16

Word16-native forward NTT — coefficients are carried as Word16 (u16) in [0, q), so the boundary is a plain reinterpret (w.0 as i16, exact since q < 2¹⁵), no rem_euclid and no i64 round-trip. The experimental fast carrier for the Word16-representation crypto.

mlkem_ntt_w16_seq

Native entry for the LOGOS Seq of Word16 carrier — wraps the raw Word16 NTT in a LogosSeq.

mlkem_sample_a

The compiled form of LOGOS sampleA(seed, i, j) — expand matrix entry Â[i][j] from the 32-byte seed ρ via SHAKE128, with the XOF and rejection handled in one verified step.

mlkem_sample_a_w16

Matrix entry Â[i][j] sampled to [0, q) Word16 — streaming SHAKE128 rejection (scalar reference).

mlkem_sample_a_w16_from_int

mlkem_sample_a_w16_seq

mlkem_sample_matrix_w16

Sample the full ML-KEM-768 3×3 matrix  at once (9 × 256 Word16, entry Â[r][c] at slot (r·3+c)·256), batching four rejection-sampling streams per 4-way AVX2 SHAKE128 permutation. Bit-identical to nine mlkem_sample_a_w16 calls; falls back to scalar without AVX2. This is the matrix-expansion keystone — sampleA is ~60% of keygen and is ×9 again in encaps.

mlkem_sample_matrix_w16_from_int

Native entry for the full 3×3 matrix  (9 × 256 Word16, entry Â[r][c] at slot (r·3+c)·256), 4-way AVX2 SHAKE128 batched — the shipped-Logos mlkemSampleMatrixW16(rho).

mlkem_sample_ntt

The compiled form of LOGOS sampleNtt(stream) — rejection-sample a uniform NTT-domain polynomial directly from a caller-provided byte stream.

mlkem_sub_mod_q_w16

(a − b) mod q, element-wise on Word16 [0, q).

mlkem_to_mont

The compiled form of LOGOS toMont(coeffs) — multiply a polynomial into the Montgomery domain.

mlkem_to_mont_w16

mlkem_to_mont_w16_seq

mlkem_zeros_w16

A run of n zero coefficients (Word16).

sha3_256_w8_seq

sha3_512_w8_seq

shake128_w8_seq

shake256_w8_seq