Added Kyber AES support

12 files changed, 341 insertions, 206 deletions

diff --git a/crypto/src/pqc/crypto/crystals/kyber/CBD.cs b/crypto/src/pqc/crypto/crystals/kyber/CBD.cs
index be0ed7296..e87edc007 100644
--- a/crypto/src/pqc/crypto/crystals/kyber/CBD.cs
+++ b/crypto/src/pqc/crypto/crystals/kyber/CBD.cs
@@ -21,7 +21,7 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
                     {
                         short a = (short)((d >> (4 * j + 0)) & 0x3);
                         short b = (short)((d >> (4 * j + eta)) & 0x3);
-                        r.Coeffs[8 * i + j] = (short) (a - b);
+                        r.m_coeffs[8 * i + j] = (short) (a - b);
                     }
                 }
                 break;
@@ -39,7 +39,7 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
                     {
                         short a = (short)((d >> (6 * j + 0)) & 0x7);
                         short b = (short)((d >> (6 * j + 3)) & 0x7);
-                        r.Coeffs[4 * i + j] = (short)(a - b);
+                        r.m_coeffs[4 * i + j] = (short)(a - b);
                     }
                 }
                 break;
diff --git a/crypto/src/pqc/crypto/crystals/kyber/KyberEngine.cs b/crypto/src/pqc/crypto/crystals/kyber/KyberEngine.cs
index 556803e57..bf9d5ee3c 100644
--- a/crypto/src/pqc/crypto/crystals/kyber/KyberEngine.cs
+++ b/crypto/src/pqc/crypto/crystals/kyber/KyberEngine.cs
@@ -1,6 +1,5 @@
 using System;
 
-using Org.BouncyCastle.Crypto.Digests;
 using Org.BouncyCastle.Security;
 using Org.BouncyCastle.Utilities;
 
@@ -10,7 +9,6 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
     {
         private SecureRandom m_random;
         private KyberIndCpa m_indCpa;
-
         // Constant Parameters
         public const int N = 256;
         public const int Q = 3329;
@@ -24,6 +22,7 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
         public const int Eta2 = 2;
 
         public int IndCpaMsgBytes = SymBytes;
+        public Symmetric Symmetric { get; private set; }
 
 
         // Parameters
@@ -45,7 +44,7 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
         public int CryptoPublicKeyBytes { get; private set; }
         public int CryptoCipherTextBytes { get; private set; }
 
-        internal KyberEngine(int k)
+        public KyberEngine(int k, bool usingAes)
         {
             K = k;
             switch (k)
@@ -65,8 +64,6 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
                 PolyCompressedBytes = 160;
                 PolyVecCompressedBytes = K * 352;
                 break;
-            default:
-                break;
             }
 
             PolyVecBytes = k * PolyBytes;
@@ -83,6 +80,15 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
             CryptoPublicKeyBytes = PublicKeyBytes;
             CryptoCipherTextBytes = CipherTextBytes;
 
+            if (usingAes)
+            {
+                Symmetric = new Symmetric.AesSymmetric();
+            }
+            else
+            {
+                Symmetric = new Symmetric.ShakeSymmetric();
+            }
+
             m_indCpa = new KyberIndCpa(this);
         }
 
@@ -91,83 +97,71 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
             m_random = random;
         }
 
-        internal void UpdateSeed(byte[] seed)
+        internal void GenerateKemKeyPair(out byte[] t, out byte[] rho, out byte[] s, out byte[] hpk, out byte[] nonce)
         {
-            m_random.SetSeed(seed);
-        }
+            byte[] pk, sk;
+            m_indCpa.GenerateKeyPair(out pk, out sk);
+            s = Arrays.CopyOfRange(sk, 0, IndCpaSecretKeyBytes);
+            
+            hpk = new byte[32];
+            Symmetric.Hash_h(hpk, pk, 0);
+
+            nonce = new byte[SymBytes];
+            m_random.NextBytes(nonce);
+            
+            t = Arrays.CopyOfRange(pk, 0, IndCpaPublicKeyBytes - 32);
+            rho = Arrays.CopyOfRange(pk, IndCpaPublicKeyBytes - 32, IndCpaPublicKeyBytes);
 
-        internal void GenerateKemKeyPair(byte[] pk, byte[] sk)
-        {
-            Sha3Digest Sha3Digest256 = new Sha3Digest(256);
-            m_indCpa.GenerateKeyPair(pk, sk);
-            Array.Copy(pk, 0, sk, IndCpaSecretKeyBytes, IndCpaPublicKeyBytes);
-            Sha3Digest256.BlockUpdate(pk, 0, PublicKeyBytes);
-            Sha3Digest256.DoFinal(sk, SecretKeyBytes - 2 * SymBytes);
-            m_random.NextBytes(sk, SecretKeyBytes - SymBytes, SymBytes);            
         }
 
         internal void KemEncrypt(byte[] cipherText, byte[] sharedSecret, byte[] pk)
         {
+            byte[] randBytes = new byte[SymBytes];
             byte[] buf = new byte[2 * SymBytes];
             byte[] kr = new byte[2 * SymBytes];
 
-            Sha3Digest Sha3Digest256 = new Sha3Digest(256);
-
-            m_random.NextBytes(buf, 0, SymBytes);
+            m_random.NextBytes(randBytes, 0, SymBytes);
 
-            Sha3Digest256.BlockUpdate(buf, 0, SymBytes);
-            Sha3Digest256.DoFinal(buf, 0);
+            Symmetric.Hash_h(randBytes, randBytes, 0);
+            Array.Copy(randBytes, 0, buf, 0, SymBytes);
 
-            Sha3Digest256.BlockUpdate(pk, 0, PublicKeyBytes);
-            Sha3Digest256.DoFinal(buf, SymBytes);
-
-            Sha3Digest Sha3Digest512 = new Sha3Digest(512);
-            Sha3Digest512.BlockUpdate(buf, 0, 2 * SymBytes);
-            Sha3Digest512.DoFinal(kr, 0);
+            Symmetric.Hash_h(buf, pk, SymBytes);
 
+            Symmetric.Hash_g(kr, buf);
+            
             m_indCpa.Encrypt(cipherText, Arrays.CopyOfRange(buf, 0, SymBytes), pk, Arrays.CopyOfRange(kr, SymBytes, 2 * SymBytes));
-            Sha3Digest256.BlockUpdate(cipherText, 0, CipherTextBytes);
-            Sha3Digest256.DoFinal(kr, SymBytes);
 
-            ShakeDigest ShakeDigest128 = new ShakeDigest(256);
-            
-            ShakeDigest128.BlockUpdate(kr, 0, 2 * SymBytes);
-            ShakeDigest128.DoFinal(sharedSecret, 0, SymBytes);
+            Symmetric.Hash_h(kr, cipherText, SymBytes);
+
+            Symmetric.Kdf(sharedSecret, kr);
         }
 
         internal void KemDecrypt(byte[] sharedSecret, byte[] cipherText, byte[] secretKey)
         {
+            int i;
             byte[] buf = new byte[2 * SymBytes], kr = new byte[2 * SymBytes], cmp = new byte[CipherTextBytes];
             byte[] pk = Arrays.CopyOfRange(secretKey, IndCpaSecretKeyBytes, secretKey.Length);
             m_indCpa.Decrypt(buf, cipherText, secretKey);
             Array.Copy(secretKey, SecretKeyBytes - 2 * SymBytes, buf, SymBytes, SymBytes);
 
-            Sha3Digest Sha3Digest512 = new Sha3Digest(512);
-            Sha3Digest512.BlockUpdate(buf, 0, 2 * SymBytes);
-            Sha3Digest512.DoFinal(kr, 0);
+            Symmetric.Hash_g(kr, buf);
+
 
             m_indCpa.Encrypt(cmp, Arrays.CopyOf(buf, SymBytes), pk, Arrays.CopyOfRange(kr, SymBytes, kr.Length));
 
             bool fail = !Arrays.ConstantTimeAreEqual(cipherText, cmp);
+            
+            Symmetric.Hash_h(kr, cipherText, SymBytes);
 
-            Sha3Digest Sha3Digest256 = new Sha3Digest(256);
-            Sha3Digest256.BlockUpdate(cipherText, 0, CipherTextBytes);
-            Sha3Digest256.DoFinal(kr, SymBytes);
 
             CMov(kr, Arrays.CopyOfRange(secretKey, SecretKeyBytes - SymBytes, SecretKeyBytes), SymBytes, fail);
 
-            ShakeDigest ShakeDigest256 = new ShakeDigest(256);
-            ShakeDigest256.BlockUpdate(kr, 0, 2 * SymBytes);
-            ShakeDigest256.DoFinal(sharedSecret, 0, SymBytes);
-        }
-
-        internal void RandomBytes(byte[] buf, int len)
-        {
-            m_random.NextBytes(buf, 0, len);
+            Symmetric.Kdf(sharedSecret, kr);
         }
 
         private void CMov(byte[] r, byte[] x, int len, bool b)
         {
+            int i;
             if (b)
             {
                 Array.Copy(x, 0, r, 0, len);
@@ -177,6 +171,11 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
                 Array.Copy(r, 0, r, 0, len);
             }
         }
+        
+        internal void RandomBytes(byte[] buf, int len)
+        {
+            m_random.NextBytes(buf,0,len);
+        }
     }
 }
 
diff --git a/crypto/src/pqc/crypto/crystals/kyber/KyberIndCpa.cs b/crypto/src/pqc/crypto/crystals/kyber/KyberIndCpa.cs
index 1628ed90d..b3be4770d 100644
--- a/crypto/src/pqc/crypto/crystals/kyber/KyberIndCpa.cs
+++ b/crypto/src/pqc/crypto/crystals/kyber/KyberIndCpa.cs
@@ -1,6 +1,5 @@
 using System;
 
-using Org.BouncyCastle.Crypto.Digests;
 using Org.BouncyCastle.Utilities;
 
 namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
@@ -8,37 +7,35 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
     internal class KyberIndCpa
     {
         private readonly KyberEngine m_engine;
-
-        internal KyberIndCpa(KyberEngine engine)
+        private Symmetric m_symmetric;
+        internal KyberIndCpa(KyberEngine mEngine)
         {
-            m_engine = engine;
+            m_engine = mEngine;
+            m_symmetric = mEngine.Symmetric;
         }
-
-        private int XofBlockBytes => Symmetric.Shake128Rate;
-
-        private int GenerateMatrixNBlocks => ((12 * KyberEngine.N / 8 * (1 << 12) / KyberEngine.Q + XofBlockBytes) / XofBlockBytes);
+        
+        private int GenerateMatrixNBlocks => ((12 * KyberEngine.N / 8 * (1 << 12) / KyberEngine.Q + m_symmetric.XofBlockBytes) / m_symmetric.XofBlockBytes);
 
         private void GenerateMatrix(PolyVec[] a, byte[] seed, bool transposed)
         {
             int K = m_engine.K;
-            ShakeDigest shake128 = new ShakeDigest(128);
-            byte[] buf = new byte[GenerateMatrixNBlocks * XofBlockBytes + 2];
 
+            byte[] buf = new byte[GenerateMatrixNBlocks * m_symmetric.XofBlockBytes + 2];
             for (int i = 0; i < K; i++)
             {
                 for (int j = 0; j < K; j++)
                 {
                     if (transposed)
                     {
-                        shake128 = Symmetric.Xof(seed, (byte) i, (byte) j);
+                        m_symmetric.XofAbsorb(seed, (byte) i, (byte) j);
                     }
                     else
                     {
-                        shake128 = Symmetric.Xof(seed, (byte) j, (byte) i);
+                        m_symmetric.XofAbsorb(seed, (byte) j, (byte) i);
                     }
-                    shake128.DoOutput(buf, 0, GenerateMatrixNBlocks * XofBlockBytes);
-                    int buflen = GenerateMatrixNBlocks * XofBlockBytes;
-                    int ctr = RejectionSampling(a[i].m_vec[j].Coeffs, 0, KyberEngine.N, buf, buflen);
+                    m_symmetric.XofSqueezeBlocks(buf, 0, GenerateMatrixNBlocks * m_symmetric.XofBlockBytes);
+                    int buflen = GenerateMatrixNBlocks * m_symmetric.XofBlockBytes;
+                    int ctr = RejectionSampling(a[i].m_vec[j].m_coeffs, 0, KyberEngine.N, buf, buflen);
                     while (ctr < KyberEngine.N)
                     {
                         int off = buflen % 3;
@@ -46,13 +43,14 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
                         {
                             buf[k] = buf[buflen - off + k];
                         }
-                        shake128.DoOutput(buf, off, XofBlockBytes * 2);
-                        buflen = off + XofBlockBytes;
-                        ctr += RejectionSampling(a[i].m_vec[j].Coeffs, ctr, KyberEngine.N - ctr, buf, buflen);
+                        m_symmetric.XofSqueezeBlocks(buf, off, m_symmetric.XofBlockBytes * 2);
+                        buflen = off + m_symmetric.XofBlockBytes;
+                        ctr += RejectionSampling(a[i].m_vec[j].m_coeffs, ctr, KyberEngine.N - ctr, buf, buflen);
                     }
 
                 }
             }
+            return;
         }
 
         private int RejectionSampling(short[] r, int off, int len, byte[] buf, int buflen)
@@ -77,7 +75,7 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
             return ctr;
         }
 
-        internal void GenerateKeyPair(byte[] pk, byte[] sk)
+        internal void GenerateKeyPair(out byte[] pk, out byte[] sk)
         {
             int K = m_engine.K;
 
@@ -85,14 +83,12 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
             byte nonce = 0;
             PolyVec[] Matrix = new PolyVec[K];
             PolyVec e = new PolyVec(m_engine), pkpv = new PolyVec(m_engine), skpv = new PolyVec(m_engine);
-            Sha3Digest Sha3Digest512 = new Sha3Digest(512);
 
-            m_engine.RandomBytes(buf, KyberEngine.SymBytes);
+            byte[] d = new byte[32];
+            m_engine.RandomBytes(d, 32);
             
-            Sha3Digest512.BlockUpdate(buf, 0, KyberEngine.SymBytes);
-            Sha3Digest512.DoFinal(buf, 0);
+            m_symmetric.Hash_g(buf, d);
 
-            //Console.WriteLine(string.Format("buf = {0}", Convert.ToHexString(buf)));
             byte[] PublicSeed = Arrays.CopyOfRange(buf, 0, KyberEngine.SymBytes);
             byte[] NoiseSeed = Arrays.CopyOfRange(buf, KyberEngine.SymBytes, 2 * KyberEngine.SymBytes);
 
@@ -112,61 +108,26 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
             {
                 e.m_vec[i].GetNoiseEta1(NoiseSeed, nonce++);
             }
-
+            
             skpv.Ntt();
             e.Ntt();
-
-            //Console.WriteLine("skpv = ");
-            //for (int i = 0; i < K; i++)
-            //{
-            //    Console.Write(String.Format("{0} [", i));
-            //    foreach (short coeff in skpv.Vec[i].Coeffs)
-            //    {
-            //        Console.Write(String.Format("{0}, ", coeff));
-            //    }
-            //    Console.Write("]\n");
-            //}
-
-            //for (int i = 0; i < K; i++)
-            //{
-            //    Console.Write("[");
-            //    for (int j = 0; j < K; j++)
-            //    {
-            //        Console.Write("[");
-            //        for (int k = 0; k < KyberEngine.N; k++)
-            //        {
-            //            Console.Write(String.Format("{0:G}, ", Matrix[i].Vec[j].Coeffs[k]));
-            //        }
-            //        Console.Write("], \n");
-            //    }
-            //    Console.Write("] \n");
-            //}
-
+            
             for (int i = 0; i < K; i++)
             {
                 PolyVec.PointwiseAccountMontgomery(pkpv.m_vec[i], Matrix[i], skpv, m_engine);
                 pkpv.m_vec[i].ToMont();
             }
-
-            //Console.WriteLine("pkpv = ");
-            //for (int i = 0; i < K; i++)
-            //{
-            //    Console.Write(String.Format("{0} [", i));
-            //    foreach (short coeff in pkpv.Vec[i].Coeffs)
-            //    {
-            //        Console.Write(String.Format("{0}, ", coeff));
-            //    }
-            //    Console.Write("]\n");
-            //}
+            
             pkpv.Add(e);
             pkpv.Reduce();
 
-            PackSecretKey(sk, skpv);
-            PackPublicKey(pk, pkpv, PublicSeed);
+            PackSecretKey(out sk, skpv);
+            PackPublicKey(out pk, pkpv, PublicSeed);
         }
 
-        private void PackSecretKey(byte[] sk, PolyVec skpv)
+        private void PackSecretKey(out byte[] sk, PolyVec skpv)
         {
+            sk = new byte[m_engine.PolyVecBytes];
             skpv.ToBytes(sk);
         }
 
@@ -175,26 +136,28 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
             skpv.FromBytes(sk);
         }
 
-        private void PackPublicKey(byte[] pk, PolyVec pkpv, byte[] seed)
+        private void PackPublicKey(out byte[] pk, PolyVec pkpv, byte[] seed)
         {
+            int i;
+            pk = new byte[m_engine.IndCpaPublicKeyBytes];
             pkpv.ToBytes(pk);
             Array.Copy(seed, 0, pk, m_engine.PolyVecBytes, KyberEngine.SymBytes);
         }
 
         private void UnpackPublicKey(PolyVec pkpv, byte[] seed, byte[] pk)
         {
+            int i;
             pkpv.FromBytes(pk);
             Array.Copy(pk, m_engine.PolyVecBytes, seed, 0, KyberEngine.SymBytes);
         }
 
-        internal void Encrypt(byte[] c, byte[] m, byte[] pk, byte[] coins)
+        public void Encrypt(byte[] c, byte[] m, byte[] pk, byte[] coins)
         {
             int K = m_engine.K;
 
             byte[] seed = new byte[KyberEngine.SymBytes];
             byte nonce = 0;
-            PolyVec sp = new PolyVec(m_engine), pkpv = new PolyVec(m_engine), ep = new PolyVec(m_engine),
-                bp = new PolyVec(m_engine);
+            PolyVec sp = new PolyVec(m_engine), pkpv = new PolyVec(m_engine), ep = new PolyVec(m_engine), bp = new PolyVec(m_engine);
             PolyVec[] MatrixTransposed = new PolyVec[K];
             Poly v = new Poly(m_engine), k = new Poly(m_engine), epp = new Poly(m_engine);
 
diff --git a/crypto/src/pqc/crypto/crystals/kyber/KyberKEMExtractor.cs b/crypto/src/pqc/crypto/crystals/kyber/KyberKEMExtractor.cs
index a9f27c4ed..6dac60625 100644
--- a/crypto/src/pqc/crypto/crystals/kyber/KyberKEMExtractor.cs
+++ b/crypto/src/pqc/crypto/crystals/kyber/KyberKEMExtractor.cs
@@ -9,6 +9,7 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
         private readonly KyberKeyParameters m_key;
         private readonly KyberEngine m_engine;
 
+
         public KyberKemExtractor(KyberKeyParameters privParams)
         {
             m_key = privParams;
@@ -17,13 +18,11 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
 
         public byte[] ExtractSecret(byte[] encapsulation)
         {
-            byte[] sessionKey = new byte[m_engine.CryptoBytes];
-            m_engine.KemDecrypt(sessionKey, encapsulation, ((KyberPrivateKeyParameters)m_key).m_privateKey);
-            byte[] rv = Arrays.CopyOfRange(sessionKey, 0, m_key.Parameters.DefaultKeySize / 8);
-            Arrays.Clear(sessionKey);
-            return rv;
+            byte[] sharedSecret = new byte[m_engine.CryptoBytes];
+            m_engine.KemDecrypt(sharedSecret, encapsulation, ((KyberPrivateKeyParameters)m_key).GetEncoded());
+            return sharedSecret;
         }
 
         public int EncapsulationLength => m_engine.CryptoCipherTextBytes;
     }
-}
+}
\ No newline at end of file
diff --git a/crypto/src/pqc/crypto/crystals/kyber/KyberKEMGenerator.cs b/crypto/src/pqc/crypto/crystals/kyber/KyberKEMGenerator.cs
index a0c070069..394890838 100644
--- a/crypto/src/pqc/crypto/crystals/kyber/KyberKEMGenerator.cs
+++ b/crypto/src/pqc/crypto/crystals/kyber/KyberKEMGenerator.cs
@@ -10,7 +10,7 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
         : IEncapsulatedSecretGenerator
     {
         // the source of randomness
-        private readonly SecureRandom m_random;
+        private SecureRandom m_random;
 
         public KyberKemGenerator(SecureRandom random)
         {
@@ -19,15 +19,13 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
 
         public ISecretWithEncapsulation GenerateEncapsulated(AsymmetricKeyParameter recipientKey)
         {
-            KyberPublicKeyParameters key = (KyberPublicKeyParameters)recipientKey;
+            KyberPublicKeyParameters key = (KyberPublicKeyParameters) recipientKey;
             KyberEngine engine = key.Parameters.Engine;
             engine.Init(m_random);
             byte[] cipherText = new byte[engine.CryptoCipherTextBytes];
             byte[] sessionKey = new byte[engine.CryptoBytes];
-            engine.KemEncrypt(cipherText, sessionKey, key.m_publicKey);
-            byte[] rv = Arrays.CopyOfRange(sessionKey, 0, key.Parameters.DefaultKeySize / 8);
-            Arrays.Clear(sessionKey);
-            return new SecretWithEncapsulationImpl(rv, cipherText);
+            engine.KemEncrypt(cipherText, sessionKey, key.GetEncoded());
+            return new SecretWithEncapsulationImpl(sessionKey, cipherText);
         }
 
         private sealed class SecretWithEncapsulationImpl
@@ -35,8 +33,8 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
         {
             private volatile bool m_hasBeenDestroyed = false;
 
-            private readonly byte[] m_sessionKey;
-            private readonly byte[] m_cipherText;
+            private byte[] m_sessionKey;
+            private byte[] m_cipherText;
 
             internal SecretWithEncapsulationImpl(byte[] sessionKey, byte[] cipher_text)
             {
@@ -68,13 +66,18 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
                 }
             }
 
-            internal bool IsDestroyed => m_hasBeenDestroyed;
+            internal bool IsDestroyed()
+            {
+                return m_hasBeenDestroyed;
+            }
 
             private void CheckDestroyed()
             {
-                if (IsDestroyed)
+                if (IsDestroyed())
+                {
                     throw new ArgumentException("data has been destroyed");
+                }
             }
         }
     }
-}
+}
\ No newline at end of file
diff --git a/crypto/src/pqc/crypto/crystals/kyber/KyberKeyPairGenerator.cs b/crypto/src/pqc/crypto/crystals/kyber/KyberKeyPairGenerator.cs
index fde26f727..442944042 100644
--- a/crypto/src/pqc/crypto/crystals/kyber/KyberKeyPairGenerator.cs
+++ b/crypto/src/pqc/crypto/crystals/kyber/KyberKeyPairGenerator.cs
@@ -6,26 +6,37 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
     public class KyberKeyPairGenerator
         : IAsymmetricCipherKeyPairGenerator
     {
-        private KyberKeyGenerationParameters m_kyberParams;
-        private SecureRandom m_random;
+        private KyberParameters KyberParams;
+        
+        private SecureRandom random;
 
-        public void Init(KeyGenerationParameters param)
+        private void Initialize(
+            KeyGenerationParameters param)
         {
-            m_kyberParams = (KyberKeyGenerationParameters)param;
-            m_random = param.Random;
+            this.KyberParams = ((KyberKeyGenerationParameters)param).Parameters;;
+            this.random = param.Random; 
         }
 
-        public AsymmetricCipherKeyPair GenerateKeyPair()
+        private AsymmetricCipherKeyPair GenKeyPair()
         {
-            KyberEngine engine = m_kyberParams.Parameters.Engine;
-            engine.Init(m_random);
-            byte[] sk = new byte[engine.CryptoSecretKeyBytes];
-            byte[] pk = new byte[engine.CryptoPublicKeyBytes];
-            engine.GenerateKemKeyPair(pk, sk);
+            KyberEngine engine = KyberParams.Engine;
+            engine.Init(random);
+            byte[] s, hpk, nonce, t, rho;
+            engine.GenerateKemKeyPair(out t, out rho, out s, out hpk, out nonce);
 
-            KyberPublicKeyParameters pubKey = new KyberPublicKeyParameters(m_kyberParams.Parameters, pk);
-            KyberPrivateKeyParameters privKey = new KyberPrivateKeyParameters(m_kyberParams.Parameters, sk);
+            KyberPublicKeyParameters pubKey = new KyberPublicKeyParameters(KyberParams, t, rho);
+            KyberPrivateKeyParameters privKey = new KyberPrivateKeyParameters(KyberParams, s, hpk, nonce, t, rho);
             return new AsymmetricCipherKeyPair(pubKey, privKey);
         }
+
+        public void Init(KeyGenerationParameters param)
+        {
+            this.Initialize(param);
+        }
+
+        public AsymmetricCipherKeyPair GenerateKeyPair()
+        {
+            return GenKeyPair();
+        }
     }
 }
\ No newline at end of file
diff --git a/crypto/src/pqc/crypto/crystals/kyber/KyberParameters.cs b/crypto/src/pqc/crypto/crystals/kyber/KyberParameters.cs
index ea9f90c98..f1a4ae921 100644
--- a/crypto/src/pqc/crypto/crystals/kyber/KyberParameters.cs
+++ b/crypto/src/pqc/crypto/crystals/kyber/KyberParameters.cs
@@ -1,31 +1,36 @@
 using System;
-
 using Org.BouncyCastle.Crypto;
 
 namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
 {
-    public sealed class KyberParameters
+    public class KyberParameters
         : ICipherParameters
     {
-        public static KyberParameters kyber512 = new KyberParameters("kyber512", 2);
-        public static KyberParameters kyber768 = new KyberParameters("kyber768", 3);
-        public static KyberParameters kyber1024 = new KyberParameters("kyber1024", 4);
 
-        private string m_name;
+        public static KyberParameters kyber512 = new KyberParameters("kyber512", 2, 128, false);
+        public static KyberParameters kyber768 = new KyberParameters("kyber768", 3, 192, false);
+        public static KyberParameters kyber1024 = new KyberParameters("kyber1024", 4, 256, false);
+        public static KyberParameters kyber512_aes = new KyberParameters("kyber512-aes", 2, 128, true);
+        public static KyberParameters kyber768_aes = new KyberParameters("kyber768-aes", 3, 192, true);
+        public static KyberParameters kyber1024_aes = new KyberParameters("kyber1024-aes", 4, 256, true);
+
+
+        private String m_name;
+        private int m_sessionKeySize;
         private KyberEngine m_engine;
 
-        public KyberParameters(string name, int k)
+        public KyberParameters(String name, int k, int sessionKeySize, bool usingAes)
         {
             m_name = name;
-            m_engine = new KyberEngine(k);
+            this.m_sessionKeySize = sessionKeySize;
+            m_engine = new KyberEngine(k, usingAes);
         }
 
-        public string Name => m_name;
+        public String Name => m_name;
 
         public int K => m_engine.K;
-
-        public int DefaultKeySize => 64 * m_engine.K;
+        public int SessionKeySize => m_sessionKeySize;
 
         internal KyberEngine Engine => m_engine;
     }
-}
+}
\ No newline at end of file
diff --git a/crypto/src/pqc/crypto/crystals/kyber/KyberPrivateKeyParameters.cs b/crypto/src/pqc/crypto/crystals/kyber/KyberPrivateKeyParameters.cs
index d58a59c40..ab355be54 100644
--- a/crypto/src/pqc/crypto/crystals/kyber/KyberPrivateKeyParameters.cs
+++ b/crypto/src/pqc/crypto/crystals/kyber/KyberPrivateKeyParameters.cs
@@ -2,20 +2,28 @@ using Org.BouncyCastle.Utilities;
 
 namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
 {
-    public sealed class KyberPrivateKeyParameters
+    public class KyberPrivateKeyParameters
         : KyberKeyParameters
     {
-        internal readonly byte[] m_privateKey;
+        private readonly byte[] m_s;
+        private readonly byte[] m_hpk;
+        private readonly byte[] m_nonce;
+        private readonly byte[] m_t;
+        private readonly byte[] m_rho;
 
-        public KyberPrivateKeyParameters(KyberParameters parameters, byte[] privateKey)
+        public KyberPrivateKeyParameters(KyberParameters parameters, byte[] s, byte[] hpk, byte[] nonce, byte[] t, byte[] rho)
             : base(true, parameters)
         {
-            m_privateKey = Arrays.Clone(privateKey);
+            m_s = Arrays.Clone(s);
+            m_hpk = Arrays.Clone(hpk);
+            m_nonce = Arrays.Clone(nonce);
+            m_t = Arrays.Clone(t);
+            m_rho = Arrays.Clone(rho);
         }
 
         public byte[] GetEncoded()
         {
-            return Arrays.Clone(m_privateKey);
+            return Arrays.ConcatenateAll(m_s, m_t, m_rho, m_hpk, m_nonce);
         }
     }
-}
+}
\ No newline at end of file
diff --git a/crypto/src/pqc/crypto/crystals/kyber/KyberPublicKeyParameters.cs b/crypto/src/pqc/crypto/crystals/kyber/KyberPublicKeyParameters.cs
index 02e467530..56d80f535 100644
--- a/crypto/src/pqc/crypto/crystals/kyber/KyberPublicKeyParameters.cs
+++ b/crypto/src/pqc/crypto/crystals/kyber/KyberPublicKeyParameters.cs
@@ -5,17 +5,27 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
     public sealed class KyberPublicKeyParameters
         : KyberKeyParameters
     {
-        internal readonly byte[] m_publicKey;
+        private readonly byte[] m_t;
+        private readonly byte[] m_rho;
 
-        public KyberPublicKeyParameters(KyberParameters parameters, byte[] publicKey)
+        public byte[] GetEncoded()
+        {
+            return Arrays.Concatenate(m_t, m_rho);
+        }
+
+        public KyberPublicKeyParameters(KyberParameters parameters, byte[] encoding)
             : base(false, parameters)
         {
-            m_publicKey = Arrays.Clone(publicKey);
+            m_t = Arrays.CopyOfRange(encoding, 0, encoding.Length - KyberEngine.SymBytes);
+            m_rho = Arrays.CopyOfRange(encoding, encoding.Length - KyberEngine.SymBytes, encoding.Length);
         }
 
-        public byte[] GetEncoded()
+        public KyberPublicKeyParameters(KyberParameters parameters, byte[] t, byte[] rho)
+            : base(false, parameters)
         {
-            return Arrays.Clone(m_publicKey);
+            m_t = Arrays.Clone(t);
+            m_rho = Arrays.Clone(rho);
         }
     }
 }
+    
\ No newline at end of file
diff --git a/crypto/src/pqc/crypto/crystals/kyber/Poly.cs b/crypto/src/pqc/crypto/crystals/kyber/Poly.cs
index fc2f7ec70..db996f41a 100644
--- a/crypto/src/pqc/crypto/crystals/kyber/Poly.cs
+++ b/crypto/src/pqc/crypto/crystals/kyber/Poly.cs
@@ -1,31 +1,32 @@
-using System;
+
+using System;
 
 namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
 {
     internal class Poly
     {
-        private short[] m_coeffs = new short[KyberEngine.N];
-
         private KyberEngine m_engine;
-
-        internal Poly(KyberEngine engine)
+        public short[] m_coeffs = new short[KyberEngine.N];
+        private Symmetric m_symmetric;
+        public Poly(KyberEngine mEngine)
         {
-            m_engine = engine;
+            m_engine = mEngine;
+            m_symmetric = mEngine.Symmetric;
         }
-
+        
         internal short[] Coeffs => m_coeffs;
 
         internal void GetNoiseEta1(byte[] seed, byte nonce)
         {
             byte[] buf = new byte[m_engine.Eta1 * KyberEngine.N / 4];
-            Symmetric.Prf(buf, buf.Length, seed, nonce);
+            m_symmetric.Prf(buf, seed, nonce);
             Cbd.Eta(this, buf, m_engine.Eta1);
         }
 
         internal void GetNoiseEta2(byte[] seed, byte nonce)
         {
             byte[] buf = new byte[KyberEngine.Eta2 * KyberEngine.N / 4];
-            Symmetric.Prf(buf, buf.Length, seed, nonce);
+            m_symmetric.Prf(buf, seed, nonce);
             Cbd.Eta(this, buf, KyberEngine.Eta2);
         }
 
@@ -76,7 +77,7 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
         {
             for (int i = 0; i < KyberEngine.N; i++)
             {
-                Coeffs[i] = (short)(a.Coeffs[i] - Coeffs[i]);
+                Coeffs[i] = (short) (a.Coeffs[i] - Coeffs[i]);
             }
         }
 
@@ -90,12 +91,7 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
 
         internal void CompressPoly(byte[] r, int off)
         {
-#if NETCOREAPP2_1_OR_GREATER || NETSTANDARD2_1_OR_GREATER
-            Span<byte> t = stackalloc byte[8];
-#else
             byte[] t = new byte[8];
-#endif
-
             int count = 0;
             CondSubQ();
 
@@ -186,7 +182,7 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
                 throw new ArgumentException("PolyCompressedBytes is neither 128 or 160!");
             }
         }
-
+        
         internal void ToBytes(byte[] r, int off)
         {
             CondSubQ();
@@ -228,8 +224,9 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
         internal void FromMsg(byte[] m)
         {
             if (m.Length != KyberEngine.N / 8)
+            {
                 throw new ArgumentException("KYBER_INDCPA_MSGBYTES must be equal to KYBER_N/8 bytes!");
-
+            }
             for (int i = 0; i < KyberEngine.N / 8; i++)
             {
                 for (int j = 0; j < 8; j++)
diff --git a/crypto/src/pqc/crypto/crystals/kyber/PolyVec.cs b/crypto/src/pqc/crypto/crystals/kyber/PolyVec.cs
index 5c92441b9..325b35e95 100644
--- a/crypto/src/pqc/crypto/crystals/kyber/PolyVec.cs
+++ b/crypto/src/pqc/crypto/crystals/kyber/PolyVec.cs
@@ -82,7 +82,7 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
                             t[k] = (short)
                                 (
                                     (
-                                        (((uint) m_vec[i].Coeffs[4 * j + k] << 10)
+                                        (((uint) m_vec[i].m_coeffs[4 * j + k] << 10)
                                             + (KyberEngine.Q / 2))
                                             / KyberEngine.Q)
                                         & 0x3ff);
@@ -113,7 +113,7 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
                             t[k] = (short)
                                 (
                                     (
-                                        (((uint) m_vec[i].Coeffs[8 * j + k] << 11)
+                                        (((uint) m_vec[i].m_coeffs[8 * j + k] << 11)
                                             + (KyberEngine.Q / 2))
                                             / KyberEngine.Q)
                                         & 0x7ff);
@@ -162,7 +162,7 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
                         count += 5;
                         for (int k = 0; k < 4; k++)
                         {
-                            m_vec[i].Coeffs[4 * j + k] = (short)(((t[k] & 0x3FF) * KyberEngine.Q + 512) >> 10);
+                            m_vec[i].m_coeffs[4 * j + k] = (short)(((t[k] & 0x3FF) * KyberEngine.Q + 512) >> 10);
                         }
                     }
                 }
@@ -190,7 +190,7 @@ namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
                         count += 11;
                         for (int k = 0; k < 8; k++)
                         {
-                            m_vec[i].Coeffs[8 * j + k] = (short)(((t[k] & 0x7FF) * KyberEngine.Q + 1024) >> 11);
+                            m_vec[i].m_coeffs[8 * j + k] = (short)(((t[k] & 0x7FF) * KyberEngine.Q + 1024) >> 11);
                         }
                     }
                 }
diff --git a/crypto/src/pqc/crypto/crystals/kyber/Symmetric.cs b/crypto/src/pqc/crypto/crystals/kyber/Symmetric.cs
index d02990635..1ceb76b98 100644
--- a/crypto/src/pqc/crypto/crystals/kyber/Symmetric.cs
+++ b/crypto/src/pqc/crypto/crystals/kyber/Symmetric.cs
@@ -1,26 +1,166 @@
 using Org.BouncyCastle.Crypto.Digests;
+using System;
+using Org.BouncyCastle.Crypto;
+using Org.BouncyCastle.Crypto.Engines;
+using Org.BouncyCastle.Crypto.Modes;
+using Org.BouncyCastle.Crypto.Parameters;
+using Org.BouncyCastle.Utilities;
 
 namespace Org.BouncyCastle.Pqc.Crypto.Crystals.Kyber
 {
-    internal static class Symmetric
+    public abstract class Symmetric
     {
-        internal const int Shake128Rate = 168;
+        internal readonly int XofBlockBytes;
+        
+        internal abstract void Hash_h(byte[] output, byte[] input, int outOffset);
 
-        internal static void Prf(byte[] outbuf, int outlen, byte[] key, byte nonce)
+        internal abstract void Hash_g(byte[] output, byte[] input);
+
+        internal abstract void XofAbsorb(byte[] seed, byte x, byte y);
+
+        internal abstract void XofSqueezeBlocks(byte[] output, int outOffset, int outLen);
+
+        internal abstract void Prf(byte[] output, byte[] key, byte nonce);
+
+        internal abstract void Kdf(byte[] output, byte[] input);
+
+        Symmetric(int xofBlockBytes)
+        {
+            this.XofBlockBytes = xofBlockBytes;
+        }
+
+        internal class ShakeSymmetric
+            : Symmetric
         {
-            ShakeDigest shake256 = new ShakeDigest(256);
-            shake256.BlockUpdate(key, 0, KyberEngine.SymBytes);
-            shake256.Update(nonce);
-            shake256.DoFinal(outbuf, 0, outlen);
+            private ShakeDigest xof;
+            private Sha3Digest sha3Digest512;
+            private Sha3Digest sha3Digest256;
+            private ShakeDigest shakeDigest;
+
+            
+            internal ShakeSymmetric()
+                : base(164)
+            {
+                xof = new ShakeDigest(128);
+                shakeDigest = new ShakeDigest(256);
+                sha3Digest256 = new Sha3Digest(256);
+                sha3Digest512 = new Sha3Digest(512);
+            }
+
+            internal override void Hash_h(byte[] output, byte[] input, int outOffset)
+            {
+                sha3Digest256.BlockUpdate(input, 0, input.Length);
+                sha3Digest256.DoFinal(output, outOffset);
+            }
+
+            internal override void Hash_g(byte[] output, byte[] input)
+            {
+                sha3Digest512.BlockUpdate(input, 0, input.Length);
+                sha3Digest512.DoFinal(output, 0);
+            }
+
+            internal override void XofAbsorb(byte[] seed, byte x, byte y)
+            {
+                xof.Reset();
+                byte[] buf = new byte[seed.Length + 2];
+                Array.Copy(seed, 0, buf, 0, seed.Length);
+                buf[seed.Length] = x;
+                buf[seed.Length + 1] = y;
+                xof.BlockUpdate(buf, 0, seed.Length + 2);
+            }
+
+            internal override void XofSqueezeBlocks(byte[] output, int outOffset, int outLen)
+            {
+                xof.DoOutput(output, outOffset, outLen);
+            }
+
+            internal override void Prf(byte[] output, byte[] seed, byte nonce)
+            {
+                byte[] extSeed = new byte[seed.Length + 1];
+                Array.Copy(seed, 0, extSeed, 0, seed.Length);
+                extSeed[seed.Length] = nonce;
+                shakeDigest.BlockUpdate(extSeed, 0, extSeed.Length);
+                shakeDigest.DoFinal(output, 0, output.Length);
+            }
+
+            internal override void Kdf(byte[] output, byte[] input)
+            {
+                shakeDigest.BlockUpdate(input, 0, input.Length);
+                shakeDigest.DoFinal(output, 0, output.Length);
+            }
         }
 
-        internal static ShakeDigest Xof(byte[] seed, byte a, byte b)
+        internal class AesSymmetric
+            : Symmetric
         {
-            ShakeDigest shake128 = new ShakeDigest(128);
-            shake128.BlockUpdate(seed, 0, seed.Length);
-            shake128.Update(a);
-            shake128.Update(b);
-            return shake128;
+            private Sha256Digest sha256Digest;
+            private Sha512Digest sha512Digest;
+            private SicBlockCipher cipher;
+
+            internal AesSymmetric()
+                : base(64)
+            {
+                this.sha256Digest = new Sha256Digest();
+                this.sha512Digest = new Sha512Digest();
+                this.cipher = new SicBlockCipher(new AesEngine());
+            }
+            private void DoDigest(IDigest digest, byte[] output, byte[] input, int outOffset)
+            {
+                digest.BlockUpdate(input, 0, input.Length);
+                digest.DoFinal(output, outOffset);
+            }
+            
+            private void Aes128(byte[] output, int offset, int size)
+            {
+                byte[] buf = new byte[size + offset];   // TODO: there might be a more efficient way of doing this...
+                for (int i = 0; i < size; i += 16)
+                {
+                    cipher.ProcessBlock(buf, i + offset, output, i + offset);
+                }
+            }
+            
+            internal override void Hash_h(byte[] output, byte[] input, int outOffset)
+            {
+                DoDigest(sha256Digest, output, input, outOffset);
+            }
+
+            internal override void Hash_g(byte[] output, byte[] input)
+            {
+                DoDigest(sha512Digest, output, input, 0);
+            }
+
+            internal override void XofAbsorb(byte[] key, byte x, byte y)
+            {
+                byte[] expnonce = new byte[12];
+                expnonce[0] = x;
+                expnonce[1] = y;
+
+                ParametersWithIV kp = new ParametersWithIV(new KeyParameter(Arrays.CopyOfRange(key, 0, 32)), expnonce);
+                cipher.Init(true, kp);
+            }
+
+            internal override void XofSqueezeBlocks(byte[] output, int outOffset, int outLen)
+            {
+                Aes128(output, outOffset, outLen);
+            }
+
+            internal override void Prf(byte[] output, byte[] key, byte nonce)
+            {
+                byte[] expnonce = new byte[12];
+                expnonce[0] = nonce;
+
+                ParametersWithIV kp = new ParametersWithIV(new KeyParameter(Arrays.CopyOfRange(key, 0, 32)), expnonce);
+                cipher.Init(true, kp);
+                Aes128(output, 0, output.Length);
+            }
+
+            internal override void Kdf(byte[] output, byte[] input)
+            {
+                byte[] buf = new byte[32];
+                DoDigest(sha256Digest, buf, input, 0);
+                Array.Copy(buf, 0, output, 0, output.Length);            
+            }
         }
+
     }
 }