Module util 

Shared, data-oblivious arithmetic for the SP 800-90A DRBGs.

Big-endian byte arithmetic used by Hash_DRBG (§10.1.1) and CTR_DRBG (§10.2.1): the mod-2^(8·len) addition of the Hashgen / Update steps and the counter increment of the block-cipher CTR loop. Both are the canonical carry-propagating schoolbook adders, written branch-free so that they never leak the (secret) internal state.

Side-channel posture

The addends here are the DRBG internal state (V, the CTR counter), which are secret. The routines therefore run in constant time with respect to the contents of the buffers: the loop bounds depend only on the (public) buffer lengths, and the carry is propagated with plain u16 arithmetic — no comparison, table lookup, or early exit on a data-dependent value. This is the discipline required by ~/.claude/CLAUDE.md §2 and CLAUDE.md §3.1.

Functions

ct_add_into

acc = (acc + addend) mod 2^(8·acc.len()), big-endian, in place.

ct_add_u64

acc = (acc + n) mod 2^(8·acc.len()) for a small integer n, big-endian, in place. Used by Hash_DRBG to fold in the reseed_counter (SP 800-90A §10.1.1.4 step 6).

ct_increment

V = (V + 1) mod 2^(8·V.len()), big-endian, in place — the CTR_DRBG counter increment (SP 800-90A §10.2.1.2, the V = (V + 1) mod 2^blocklen of the Update, and the generate loop of §10.2.1.5.2).