Struct MaskedPoly 

pub struct MaskedPoly {
    pub share0: [i16; 256],
    pub share1: [i16; 256],
}

A polynomial split into two additive shares modulo q.

Maintains the invariant real_value[i] = (share0[i] + share1[i]) mod q for all i in 0..256. Neither share alone reveals any information about the underlying polynomial.

Both shares have coefficients in [0, q-1].

Fields

share0: [i16; 256]

First additive share of the polynomial.

share1: [i16; 256]

Second additive share of the polynomial.

Implementations

impl MaskedPoly

pub fn mask( poly: &[i16; 256], rng: &mut impl CryptoRng, ) -> Result<Self, MlKemError>

Split a plaintext polynomial into two random additive shares.

Generates a uniformly random share1 from the RNG, then computes share0 = poly - share1 mod q. The random bytes are zeroized after use.

Arguments

• poly - The secret polynomial to mask (coefficients in [0, q-1]).
• rng - A cryptographic RNG for generating the random share.

Errors

Returns MlKemError::RngFailure if the RNG fails.

pub fn unmask(&self) -> [i16; 256]

Reconstruct the plaintext polynomial from the two shares.

Computes (share0[i] + share1[i]) mod q for each coefficient. The resulting polynomial has coefficients in [0, q-1].

Security note

The returned polynomial is unmasked and should be handled as secret data (zeroized after use).

pub fn zeroize(&mut self)

Securely erase both shares via volatile writes.

Delegates to super::ntt::zeroize_poly for each share to ensure the optimizer cannot elide the writes.

pub fn refresh(&mut self, rng: &mut impl CryptoRng) -> Result<(), MlKemError>

Re-randomize the shares without changing the unmasked value.

Draws a fresh random polynomial r and updates the shares: share0' = share0 - r mod q, share1' = share1 + r mod q. The sum is preserved: share0' + share1' = share0 + share1.

Refreshing prevents higher-order correlation buildup when the same masked polynomial is used in multiple operations.

Errors

Returns MlKemError::RngFailure if the RNG fails.