Initial commit
Esse commit está contido em:
Andreas
pai
7f9cc3e418
commit
1826fb26ff
5
.kdev4/xmss_ref.kdev4
Arquivo normal
5
.kdev4/xmss_ref.kdev4
Arquivo normal
@ -0,0 +1,5 @@
|
||||
[Buildset]
|
||||
BuildItems=@Variant(\x00\x00\x00\t\x00\x00\x00\x00\x01\x00\x00\x00\x0b\x00\x00\x00\x00\x01\x00\x00\x00\x10\x00x\x00m\x00s\x00s\x00_\x00r\x00e\x00f)
|
||||
|
||||
[Project]
|
||||
VersionControlSupport=kdevgit
|
||||
17
Makefile
17
Makefile
@ -1,5 +1,18 @@
|
||||
CC=gcc
|
||||
CFLAGS="-Wall"
|
||||
CC = /usr/bin/gcc
|
||||
CFLAGS = -Wall -g -O3
|
||||
|
||||
all: test/test_chacha \
|
||||
test/test_wots \
|
||||
test/test_xmss
|
||||
|
||||
test/test_chacha: chacha.c prg.c randombytes.c test/test_chacha.c chacha.h prg.h randombytes.h
|
||||
$(CC) $(CFLAGS) chacha.c prg.c randombytes.c test/test_chacha.c -o $@ #-lcrypto -lm
|
||||
|
||||
test/test_wots: chacha.c hash.c prg.c randombytes.c wots.c xmss_commons.c test/test_wots.c chacha.h hash.h prg.h randombytes.h wots.h xmss_commons.h
|
||||
$(CC) $(CFLAGS) chacha.c hash.c prg.c randombytes.c wots.c xmss_commons.c test/test_wots.c -o $@ -lcrypto -lm
|
||||
|
||||
test/test_xmss: chacha.c hash.c prg.c randombytes.c wots.c xmss.c xmss_commons.c test/test_xmss.c chacha.h hash.h prg.h randombytes.h wots.h xmss.h xmss_commons.h
|
||||
$(CC) $(CFLAGS) chacha.c hash.c prg.c randombytes.c wots.c xmss.c xmss_commons.c test/test_xmss.c -o $@ -lcrypto -lm
|
||||
|
||||
debug:clean
|
||||
$(CC) $(CFLAGS) -g -o xmss_ref main.c
|
||||
|
||||
208
chacha.c
Arquivo normal
208
chacha.c
Arquivo normal
@ -0,0 +1,208 @@
|
||||
/*
|
||||
* This code is based on an OpenSSL implementation of chacha20.
|
||||
* Hence, the copyright below applies.
|
||||
*
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright (c) 2011-2013 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* licensing@OpenSSL.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*/
|
||||
|
||||
/* Adapted from the public domain code by D. Bernstein from SUPERCOP. */
|
||||
|
||||
#include <stdint.h>
|
||||
#include <string.h>
|
||||
#include "chacha.h"
|
||||
|
||||
/* sigma contains the ChaCha constants, which happen to be an ASCII string. */
|
||||
static const char sigma[16] = "expand 32-byte k";
|
||||
|
||||
#define ROTATE(v, n) (((v) << (n)) | ((v) >> (32 - (n))))
|
||||
#define XOR(v, w) ((v) ^ (w))
|
||||
#define PLUS(x, y) ((x) + (y))
|
||||
#define PLUSONE(v) (PLUS((v), 1))
|
||||
|
||||
#define U32TO8_LITTLE(p, v) \
|
||||
{ (p)[0] = (v >> 0) & 0xff; (p)[1] = (v >> 8) & 0xff; \
|
||||
(p)[2] = (v >> 16) & 0xff; (p)[3] = (v >> 24) & 0xff; }
|
||||
#define U8TO32_LITTLE(p) \
|
||||
(((uint32_t)((p)[0]) ) | ((uint32_t)((p)[1]) << 8) | \
|
||||
((uint32_t)((p)[2]) << 16) | ((uint32_t)((p)[3]) << 24) )
|
||||
|
||||
/* QUARTERROUND updates a, b, c, d with a ChaCha "quarter" round. */
|
||||
#define QUARTERROUND(a,b,c,d) \
|
||||
x[a] = PLUS(x[a],x[b]); x[d] = ROTATE(XOR(x[d],x[a]),16); \
|
||||
x[c] = PLUS(x[c],x[d]); x[b] = ROTATE(XOR(x[b],x[c]),12); \
|
||||
x[a] = PLUS(x[a],x[b]); x[d] = ROTATE(XOR(x[d],x[a]), 8); \
|
||||
x[c] = PLUS(x[c],x[d]); x[b] = ROTATE(XOR(x[b],x[c]), 7);
|
||||
|
||||
/* chacha_core performs |num_rounds| rounds of ChaCha20 on the input words in
|
||||
* |input| and writes the 64 output bytes to |output|. */
|
||||
static void chacha_core(unsigned char output[64], const uint32_t input[16],
|
||||
int num_rounds)
|
||||
{
|
||||
uint32_t x[16];
|
||||
int i;
|
||||
|
||||
memcpy(x, input, sizeof(uint32_t) * 16);
|
||||
for (i = 20; i > 0; i -= 2)
|
||||
{
|
||||
QUARTERROUND( 0, 4, 8,12)
|
||||
QUARTERROUND( 1, 5, 9,13)
|
||||
QUARTERROUND( 2, 6,10,14)
|
||||
QUARTERROUND( 3, 7,11,15)
|
||||
QUARTERROUND( 0, 5,10,15)
|
||||
QUARTERROUND( 1, 6,11,12)
|
||||
QUARTERROUND( 2, 7, 8,13)
|
||||
QUARTERROUND( 3, 4, 9,14)
|
||||
}
|
||||
|
||||
for (i = 0; i < 16; ++i)
|
||||
x[i] = PLUS(x[i], input[i]);
|
||||
for (i = 0; i < 16; ++i)
|
||||
U32TO8_LITTLE(output + 4 * i, x[i]);
|
||||
}
|
||||
|
||||
void CRYPTO_chacha_20(unsigned char *out,
|
||||
const unsigned char *in, size_t in_len,
|
||||
const unsigned char key[32],
|
||||
const unsigned char nonce[12],
|
||||
uint32_t counter)
|
||||
{
|
||||
uint32_t input[16];
|
||||
unsigned char buf[64];
|
||||
size_t todo, i;
|
||||
|
||||
input[0] = U8TO32_LITTLE(sigma + 0);
|
||||
input[1] = U8TO32_LITTLE(sigma + 4);
|
||||
input[2] = U8TO32_LITTLE(sigma + 8);
|
||||
input[3] = U8TO32_LITTLE(sigma + 12);
|
||||
|
||||
input[4] = U8TO32_LITTLE(key + 0);
|
||||
input[5] = U8TO32_LITTLE(key + 4);
|
||||
input[6] = U8TO32_LITTLE(key + 8);
|
||||
input[7] = U8TO32_LITTLE(key + 12);
|
||||
|
||||
input[8] = U8TO32_LITTLE(key + 16);
|
||||
input[9] = U8TO32_LITTLE(key + 20);
|
||||
input[10] = U8TO32_LITTLE(key + 24);
|
||||
input[11] = U8TO32_LITTLE(key + 28);
|
||||
|
||||
input[12] = counter;
|
||||
input[13] = U8TO32_LITTLE(nonce + 0);
|
||||
input[14] = U8TO32_LITTLE(nonce + 4);
|
||||
input[15] = U8TO32_LITTLE(nonce + 8);
|
||||
|
||||
while (in_len > 0)
|
||||
{
|
||||
todo = sizeof(buf);
|
||||
if (in_len < todo)
|
||||
todo = in_len;
|
||||
|
||||
chacha_core(buf, input, 20);
|
||||
for (i = 0; i < todo; i++)
|
||||
out[i] = in[i] ^ buf[i];
|
||||
|
||||
out += todo;
|
||||
in += todo;
|
||||
in_len -= todo;
|
||||
|
||||
input[12]++;
|
||||
if (input[12] == 0)
|
||||
input[13]++;
|
||||
}
|
||||
}
|
||||
|
||||
void CRYPTO_chacha_20_keystream(unsigned char *out,
|
||||
size_t out_len,
|
||||
const unsigned char key[32],
|
||||
const unsigned char nonce[12],
|
||||
uint32_t counter)
|
||||
{
|
||||
uint32_t input[16];
|
||||
unsigned char buf[64];
|
||||
size_t todo, i;
|
||||
|
||||
input[0] = U8TO32_LITTLE(sigma + 0);
|
||||
input[1] = U8TO32_LITTLE(sigma + 4);
|
||||
input[2] = U8TO32_LITTLE(sigma + 8);
|
||||
input[3] = U8TO32_LITTLE(sigma + 12);
|
||||
|
||||
input[4] = U8TO32_LITTLE(key + 0);
|
||||
input[5] = U8TO32_LITTLE(key + 4);
|
||||
input[6] = U8TO32_LITTLE(key + 8);
|
||||
input[7] = U8TO32_LITTLE(key + 12);
|
||||
|
||||
input[8] = U8TO32_LITTLE(key + 16);
|
||||
input[9] = U8TO32_LITTLE(key + 20);
|
||||
input[10] = U8TO32_LITTLE(key + 24);
|
||||
input[11] = U8TO32_LITTLE(key + 28);
|
||||
|
||||
input[12] = counter;
|
||||
input[13] = U8TO32_LITTLE(nonce + 0);
|
||||
input[14] = U8TO32_LITTLE(nonce + 4);
|
||||
input[15] = U8TO32_LITTLE(nonce + 8);
|
||||
|
||||
while (out_len > 0)
|
||||
{
|
||||
todo = sizeof(buf);
|
||||
if (out_len < todo)
|
||||
todo = out_len;
|
||||
|
||||
chacha_core(buf, input, 20);
|
||||
for (i = 0; i < todo; i++)
|
||||
out[i] = buf[i];
|
||||
|
||||
out += todo;
|
||||
out_len -= todo;
|
||||
|
||||
input[12]++;
|
||||
if (input[12] == 0)
|
||||
input[13]++;
|
||||
}
|
||||
}
|
||||
|
||||
78
chacha.h
Arquivo normal
78
chacha.h
Arquivo normal
@ -0,0 +1,78 @@
|
||||
/*
|
||||
* This code is based on an OpenSSL implementation of chacha20.
|
||||
* Hence, the copyright below applies.
|
||||
*
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright (c) 2011-2013 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* licensing@OpenSSL.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*/
|
||||
#ifndef CHACHA_H
|
||||
#define CHACHA_H
|
||||
|
||||
#include <stddef.h>
|
||||
|
||||
typedef unsigned int uint32_t;
|
||||
/* CRYPTO_chacha_20 encrypts |in_len| bytes from |in| with the given key and
|
||||
* nonce and writes the result to |out|, which may be equal to |in|. The
|
||||
* initial block counter is specified by |counter|. */
|
||||
void CRYPTO_chacha_20(unsigned char *out,
|
||||
const unsigned char *in, size_t in_len,
|
||||
const unsigned char key[32],
|
||||
const unsigned char nonce[12],
|
||||
uint32_t counter);
|
||||
|
||||
/* CRYPTO_chacha_20_keystream generates |out_len| bytes from the generated keystream with the given key and
|
||||
* nonce and writes the result to |out|. The
|
||||
* initial block counter is specified by |counter|. */
|
||||
void CRYPTO_chacha_20_keystream(unsigned char *out,
|
||||
size_t out_len,
|
||||
const unsigned char key[32],
|
||||
const unsigned char nonce[12],
|
||||
uint32_t counter);
|
||||
|
||||
#endif
|
||||
143
hash.c
Arquivo normal
143
hash.c
Arquivo normal
@ -0,0 +1,143 @@
|
||||
#include "params.h"
|
||||
#include "prg.h"
|
||||
|
||||
#include <stddef.h>
|
||||
#include "stdio.h"
|
||||
#include <openssl/sha.h>
|
||||
#include <openssl/hmac.h>
|
||||
#include <openssl/evp.h>
|
||||
|
||||
|
||||
#define SET_KEY_BIT(a,b) (a[15] = (a[15] & 253) | (b << 1))
|
||||
#define SET_BLOCK_BIT(a,b) (a[15] = (a[15] & 254) | b)
|
||||
|
||||
#define WOTS_SELECT_KEY(a) (a[15] = (a[15] & 253) | 1)
|
||||
#define WOTS_SELECT_BLOCK(a) (a[15] = (a[15] & 254) | 0)
|
||||
|
||||
/**
|
||||
* Implements PRF_m
|
||||
*/
|
||||
int prf_m(unsigned char *out, const unsigned char *in, size_t inlen, const unsigned char *key, int keylen)
|
||||
{
|
||||
unsigned int length;
|
||||
if (keylen == 32){
|
||||
HMAC(EVP_sha256(), key, keylen, in, inlen, out, &length);
|
||||
if(length != 32)
|
||||
{
|
||||
fprintf(stderr, "HMAC outputs %d bytes... That should not happen...",length);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
else
|
||||
{
|
||||
if(keylen == 64)
|
||||
{
|
||||
HMAC(EVP_sha512(), key, keylen, in, inlen, out, &length);
|
||||
if(length != 64)
|
||||
{
|
||||
fprintf(stderr, "HMAC outputs %d bytes... That should not happen...",length);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Implemts H_m
|
||||
*/
|
||||
int hash_m(unsigned char *out,const unsigned char *in,unsigned long long inlen,const unsigned char *key, const int keylen, const int m)
|
||||
{
|
||||
if(keylen != m){
|
||||
fprintf(stderr, "H_m takes m-bit keys, we got m=%d but a keylength of %d.\n",m,keylen);
|
||||
return 1;
|
||||
}
|
||||
unsigned long long i;
|
||||
unsigned char buf[inlen +keylen+m];
|
||||
for(i=0;i<m;i++)
|
||||
{
|
||||
buf[i] = 0x00;
|
||||
}
|
||||
for(i=0;i <keylen;i++)
|
||||
{
|
||||
buf[m+i] = key[i];
|
||||
}
|
||||
for(i=0;i <inlen;i++)
|
||||
{
|
||||
buf[m+keylen+i] = in[i];
|
||||
}
|
||||
|
||||
if(m == 32)
|
||||
{
|
||||
SHA256(buf,inlen +keylen+m,out);
|
||||
return 0;
|
||||
}
|
||||
else
|
||||
{
|
||||
if(m == 64)
|
||||
{
|
||||
SHA512(buf,inlen +keylen+m,out);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* We assume the left half is in in[0]...in[n-1]
|
||||
*/
|
||||
int hash_2n_n(unsigned char *out,const unsigned char *in, const unsigned char *pub_seed, unsigned char addr[16], const int n)
|
||||
{
|
||||
if(n != 32){
|
||||
fprintf(stderr, "Hash.c:hash_2n_n: Current implementation does not support n != 32, yet.\n");
|
||||
return -1;
|
||||
}
|
||||
unsigned char buf[4*n];
|
||||
unsigned char key[n];
|
||||
unsigned char bitmask[2*n];
|
||||
int i;
|
||||
|
||||
SET_KEY_BIT(addr,1);
|
||||
SET_BLOCK_BIT(addr,0);
|
||||
prg_with_counter(key, n, pub_seed, 32, addr);
|
||||
SET_KEY_BIT(addr,0);
|
||||
// Use MSB order
|
||||
prg_with_counter(bitmask, n, pub_seed, 32, addr);
|
||||
SET_BLOCK_BIT(addr,1);
|
||||
prg_with_counter(bitmask+n, n, pub_seed, 32, addr);
|
||||
for(i=0;i<n;i++)
|
||||
{
|
||||
buf[i] = 0x00;
|
||||
buf[n+i] = key[i];
|
||||
buf[2*n+i] = in[i] ^ bitmask[i];
|
||||
buf[3*n+i] = in[n+i] ^ bitmask[n+i];
|
||||
}
|
||||
SHA256(buf,4*n,out);
|
||||
return 0;
|
||||
}
|
||||
|
||||
int hash_n_n(unsigned char *out,const unsigned char *in, const unsigned char *pub_seed, unsigned char addr[16], const int n)
|
||||
{
|
||||
if(n != 32){
|
||||
fprintf(stderr, "Hash.c:hash_n_n: Current implementation does not support n != 32, yet.\n");
|
||||
return -1;
|
||||
}
|
||||
|
||||
unsigned char buf[3*n];
|
||||
unsigned char key[n];
|
||||
unsigned char bitmask[n];
|
||||
int i;
|
||||
|
||||
WOTS_SELECT_KEY(addr);
|
||||
prg_with_counter(key, n, pub_seed, 32, addr);
|
||||
WOTS_SELECT_BLOCK(addr);
|
||||
prg_with_counter(bitmask, n, pub_seed, 32, addr);
|
||||
for(i=0;i<n;i++)
|
||||
{
|
||||
buf[i] = 0x00;
|
||||
buf[n+i] = key[i];
|
||||
buf[2*n+i] = in[i] ^ bitmask[i];
|
||||
}
|
||||
SHA256(buf,3*n,out);
|
||||
return 0;
|
||||
}
|
||||
11
hash.h
Arquivo normal
11
hash.h
Arquivo normal
@ -0,0 +1,11 @@
|
||||
#ifndef HASH_H
|
||||
#define HASH_H
|
||||
|
||||
#include "params.h"
|
||||
|
||||
int prf_m(unsigned char *out, const unsigned char *in, size_t inlen, const unsigned char *key, int keylen);
|
||||
int hash_m(unsigned char *out,const unsigned char *in,unsigned long long inlen, const unsigned char *key, const int keylen, const int m);
|
||||
int hash_2n_n(unsigned char *out,const unsigned char *in, const unsigned char *pub_seed, unsigned char addr[16], const int n);
|
||||
int hash_n_n(unsigned char *out,const unsigned char *in, const unsigned char *pub_seed, unsigned char addr[16], const int n);
|
||||
|
||||
#endif
|
||||
7
main.c
7
main.c
@ -1,7 +0,0 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
printf("Hello World!");
|
||||
return 0;
|
||||
}
|
||||
13
params.h
Arquivo normal
13
params.h
Arquivo normal
@ -0,0 +1,13 @@
|
||||
#define TREE_HEIGHT 10
|
||||
#define WOTS_LOGW 4 // -> w = 16
|
||||
|
||||
#define SK_RAND_SEED_BYTES 32
|
||||
#define MESSAGE_HASH_SEED_BYTES 32
|
||||
|
||||
#define WOTS_W (1 << WOTS_LOGW)
|
||||
#define WOTS_L1 ((256+WOTS_LOGW-1)/WOTS_LOGW)
|
||||
#define WOTS_L 67 // for WOTS_W == 16
|
||||
#define WOTS_LOG_L 7 // for WOTS_W == 16
|
||||
#define WOTS_SIGBYTES (WOTS_L*HASH_BYTES)
|
||||
|
||||
#define HASH_BYTES 32
|
||||
31
prg.c
Arquivo normal
31
prg.c
Arquivo normal
@ -0,0 +1,31 @@
|
||||
#include "chacha.h"
|
||||
//#include "params.h"
|
||||
#include "prg.h"
|
||||
|
||||
const unsigned char zero_nonce[12] = {0};
|
||||
|
||||
/**
|
||||
* Generates rlen output bytes using ChaCha20 with a zero nonce and counter = 0
|
||||
*/
|
||||
void prg(unsigned char *r, unsigned long long rlen, const unsigned char *key, uint key_len)
|
||||
{
|
||||
CRYPTO_chacha_20_keystream(r, rlen, key, zero_nonce, 0);
|
||||
}
|
||||
|
||||
/**
|
||||
* Generates rlen output bytes using ChaCha20.
|
||||
* Nonce and counter are set depending on the address addr.
|
||||
*/
|
||||
void prg_with_counter(unsigned char *r, unsigned long long rlen, const unsigned char *key, uint key_len, const unsigned char addr[16])
|
||||
{
|
||||
int i;
|
||||
unsigned char nonce[12];
|
||||
for(i = 0; i < 12; i++)
|
||||
{
|
||||
nonce[i] = addr[i];
|
||||
}
|
||||
uint32_t counter;
|
||||
counter = (addr[12] << 24)|(addr[13] << 16)|(addr[14] << 8)|addr[15];
|
||||
// TODO: Check address handling. Endianess?
|
||||
CRYPTO_chacha_20_keystream(r, rlen, key, nonce, counter);
|
||||
}
|
||||
16
prg.h
Arquivo normal
16
prg.h
Arquivo normal
@ -0,0 +1,16 @@
|
||||
#ifndef PRG_H
|
||||
#define PRG_H
|
||||
#include <stdlib.h>
|
||||
|
||||
/**
|
||||
* Generates rlen output bytes using key_len-byte key and places them in r.
|
||||
*
|
||||
*/
|
||||
void prg(unsigned char *r, unsigned long long rlen, const unsigned char *key, uint key_len);
|
||||
|
||||
/**
|
||||
* Generates rlen output bytes using key_len-byte key and hash address addr and places them in r.
|
||||
*
|
||||
*/
|
||||
void prg_with_counter(unsigned char *r, unsigned long long rlen, const unsigned char *key, uint key_len, const unsigned char addr[16]);
|
||||
#endif
|
||||
34
randombytes.c
Arquivo normal
34
randombytes.c
Arquivo normal
@ -0,0 +1,34 @@
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <fcntl.h>
|
||||
#include <unistd.h>
|
||||
|
||||
/* it's really stupid that there isn't a syscall for this */
|
||||
|
||||
static int fd = -1;
|
||||
|
||||
void randombytes(unsigned char *x,unsigned long long xlen)
|
||||
{
|
||||
int i;
|
||||
|
||||
if (fd == -1) {
|
||||
for (;;) {
|
||||
fd = open("/dev/urandom",O_RDONLY);
|
||||
if (fd != -1) break;
|
||||
sleep(1);
|
||||
}
|
||||
}
|
||||
|
||||
while (xlen > 0) {
|
||||
if (xlen < 1048576) i = xlen; else i = 1048576;
|
||||
|
||||
i = read(fd,x,i);
|
||||
if (i < 1) {
|
||||
sleep(1);
|
||||
continue;
|
||||
}
|
||||
|
||||
x += i;
|
||||
xlen -= i;
|
||||
}
|
||||
}
|
||||
6
randombytes.h
Arquivo normal
6
randombytes.h
Arquivo normal
@ -0,0 +1,6 @@
|
||||
#ifndef RANDOMBYTES_H
|
||||
#define RANDOMBYTES_H
|
||||
|
||||
extern void randombytes(unsigned char * x,unsigned long long xlen);
|
||||
|
||||
#endif
|
||||
92
test/gen_testvectors.c
Arquivo normal
92
test/gen_testvectors.c
Arquivo normal
@ -0,0 +1,92 @@
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
#include "../crypto_sign.h"
|
||||
|
||||
#define MAXMBYTES 2048
|
||||
|
||||
typedef uint32_t uint32;
|
||||
|
||||
static uint32 seed[32] = { 3,1,4,1,5,9,2,6,5,3,5,8,9,7,9,3,2,3,8,4,6,2,6,4,3,3,8,3,2,7,9,5 } ;
|
||||
static uint32 in[12];
|
||||
static uint32 out[8];
|
||||
static int outleft = 0;
|
||||
|
||||
#define ROTATE(x,b) (((x) << (b)) | ((x) >> (32 - (b))))
|
||||
#define MUSH(i,b) x = t[i] += (((x ^ seed[i]) + sum) ^ ROTATE(x,b));
|
||||
|
||||
static void surf(void)
|
||||
{
|
||||
uint32 t[12]; uint32 x; uint32 sum = 0;
|
||||
int r; int i; int loop;
|
||||
|
||||
for (i = 0;i < 12;++i) t[i] = in[i] ^ seed[12 + i];
|
||||
for (i = 0;i < 8;++i) out[i] = seed[24 + i];
|
||||
x = t[11];
|
||||
for (loop = 0;loop < 2;++loop) {
|
||||
for (r = 0;r < 16;++r) {
|
||||
sum += 0x9e3779b9;
|
||||
MUSH(0,5) MUSH(1,7) MUSH(2,9) MUSH(3,13)
|
||||
MUSH(4,5) MUSH(5,7) MUSH(6,9) MUSH(7,13)
|
||||
MUSH(8,5) MUSH(9,7) MUSH(10,9) MUSH(11,13)
|
||||
}
|
||||
for (i = 0;i < 8;++i) out[i] ^= t[i + 4];
|
||||
}
|
||||
}
|
||||
|
||||
void randombytes(unsigned char *x,unsigned long long xlen)
|
||||
{
|
||||
while (xlen > 0) {
|
||||
if (!outleft) {
|
||||
if (!++in[0]) if (!++in[1]) if (!++in[2]) ++in[3];
|
||||
surf();
|
||||
outleft = 8;
|
||||
}
|
||||
*x = out[--outleft];
|
||||
++x;
|
||||
--xlen;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
unsigned char pk[CRYPTO_PUBLICKEYBYTES];
|
||||
unsigned char sk[CRYPTO_SECRETKEYBYTES];
|
||||
unsigned char m[MAXMBYTES];
|
||||
unsigned char sm[MAXMBYTES+CRYPTO_BYTES];
|
||||
//unsigned char mo[MAXMBYTES+CRYPTO_BYTES];
|
||||
unsigned long long smlen;
|
||||
unsigned long long mlen;
|
||||
|
||||
int main(void)
|
||||
{
|
||||
int n,i,r;
|
||||
for(n=0;n<MAXMBYTES;n++)
|
||||
{
|
||||
crypto_sign_keypair(pk,sk);
|
||||
randombytes(m,n);
|
||||
|
||||
crypto_sign(sm, &smlen, m, n, sk);
|
||||
for(i=0;i<smlen;i++)
|
||||
printf("%02x",sm[i]);
|
||||
printf("\n");
|
||||
r = crypto_sign_open(sm, &mlen, sm, smlen, pk);
|
||||
if(r)
|
||||
{
|
||||
printf("signature verification fails\n");
|
||||
return -1;
|
||||
}
|
||||
if(mlen != n)
|
||||
{
|
||||
printf("signature verification produces wrong message length\n");
|
||||
return -1;
|
||||
}
|
||||
for(i=0;i<n;i++)
|
||||
{
|
||||
if(sm[i] != m[i])
|
||||
{
|
||||
printf("signature verification does not recover message\n");
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
124
test/speed.c
Arquivo normal
124
test/speed.c
Arquivo normal
@ -0,0 +1,124 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include "../crypto_sign.h"
|
||||
#include "../cpucycles.h"
|
||||
#include "../randombytes.h"
|
||||
#include "../horst.h"
|
||||
#include "../wots.h"
|
||||
#include "../hash.h"
|
||||
|
||||
|
||||
#define MLEN 59
|
||||
#define REP 1
|
||||
#define NRUNS 100
|
||||
|
||||
static int ull_cmp(const void *a, const void *b)
|
||||
{
|
||||
const unsigned long long *ia = (const unsigned long long *)a;
|
||||
const unsigned long long *ib = (const unsigned long long *)b;
|
||||
if (*ia > *ib) return 1;
|
||||
if (*ia < *ib) return -1;
|
||||
return 0;
|
||||
}
|
||||
|
||||
static const unsigned char seed[32] = {
|
||||
0x22, 0x26, 0xb5, 0x64, 0xbb, 0x78, 0xcc, 0xab, 0x4a, 0x4c, 0x0a, 0x64, 0xc2, 0x0b, 0x5d, 0x68,
|
||||
0x38, 0x74, 0x1a, 0xc0, 0x03, 0x17, 0xff, 0xd8, 0xe3, 0x53, 0xc8, 0x59, 0xc6, 0x23, 0x5b, 0xaa};
|
||||
|
||||
|
||||
int main()
|
||||
{
|
||||
unsigned long long t[NRUNS];
|
||||
int i,j;
|
||||
|
||||
printf("\n=== Benchmarks of signatures ===\n\n");
|
||||
unsigned char sk[CRYPTO_SECRETKEYBYTES];
|
||||
unsigned char pk[CRYPTO_PUBLICKEYBYTES];
|
||||
|
||||
unsigned char m[MLEN+CRYPTO_BYTES];
|
||||
unsigned char sm[MLEN+CRYPTO_BYTES];
|
||||
unsigned long long mlen;
|
||||
unsigned long long smlen;
|
||||
|
||||
unsigned char masks[2*HORST_LOGT*HASH_BYTES];
|
||||
randombytes(masks,N_MASKS*HASH_BYTES);
|
||||
|
||||
unsigned char msg_seed[MSGHASH_BYTES];
|
||||
randombytes(msg_seed, MSGHASH_BYTES);
|
||||
|
||||
//Benchmarking signature key generation
|
||||
for(i=0;i<NRUNS;i++)
|
||||
{
|
||||
t[i] = cpucycles();
|
||||
for(j=0;j<REP;j++)
|
||||
crypto_sign_keypair(pk, sk);
|
||||
}
|
||||
for(i=0;i<NRUNS-1;i++)
|
||||
t[i] = (t[i+1] - t[i]);
|
||||
qsort(t, NRUNS-1, sizeof(unsigned long long), ull_cmp);
|
||||
printf("keypair: %13.3lf\n", (double)t[NRUNS/2-1]/REP);
|
||||
|
||||
//Benchmarking signature generation
|
||||
for(i=0;i<NRUNS;i++)
|
||||
{
|
||||
t[i] = cpucycles();
|
||||
for(j=0;j<REP;j++)
|
||||
crypto_sign(sm, &smlen, m, MLEN, sk);
|
||||
}
|
||||
for(i=0;i<NRUNS-1;i++)
|
||||
t[i] = (t[i+1] - t[i]);
|
||||
qsort(t, NRUNS-1, sizeof(unsigned long long), ull_cmp);
|
||||
printf("sign: %13.3lf\n", (double)t[NRUNS/2-1]/REP);
|
||||
|
||||
//Benchmarking signature verification
|
||||
for(i=0;i<NRUNS;i++)
|
||||
{
|
||||
t[i] = cpucycles();
|
||||
for(j=0;j<REP;j++)
|
||||
crypto_sign_open(m, &mlen, sm, smlen, pk);
|
||||
}
|
||||
for(i=0;i<NRUNS-1;i++)
|
||||
t[i] = (t[i+1] - t[i]);
|
||||
qsort(t, NRUNS-1, sizeof(unsigned long long), ull_cmp);
|
||||
printf("sign_open: %13.3lf\n", (double)t[NRUNS/2-1]/REP);
|
||||
|
||||
//Benchmarking WOTS pkgen
|
||||
for(i=0;i<NRUNS;i++)
|
||||
{
|
||||
t[i] = cpucycles();
|
||||
for(j=0;j<REP;j++)
|
||||
wots_pkgen(sm, seed, masks);
|
||||
}
|
||||
for(i=0;i<NRUNS-1;i++)
|
||||
t[i] = (t[i+1] - t[i]);
|
||||
qsort(t, NRUNS-1, sizeof(unsigned long long), ull_cmp);
|
||||
printf("wots_pkgen: %13.3lf\n", (double)t[NRUNS/2-1]/REP);
|
||||
printf("416*wots_pkgen: %13.3lf\n", 416*(double)t[NRUNS/2-1]/REP);
|
||||
|
||||
//Benchmarking HORSt signing
|
||||
for(i=0;i<NRUNS;i++)
|
||||
{
|
||||
t[i] = cpucycles();
|
||||
for(j=0;j<REP;j++)
|
||||
horst_sign(sm, pk, &smlen, m, MLEN, seed, masks, msg_seed);
|
||||
}
|
||||
for(i=0;i<NRUNS-1;i++)
|
||||
t[i] = (t[i+1] - t[i]);
|
||||
qsort(t, NRUNS-1, sizeof(unsigned long long), ull_cmp);
|
||||
printf("horst_sign: %13.3lf\n", (double)t[NRUNS/2-1]/REP);
|
||||
|
||||
//Benchmarking hash_2n_n
|
||||
for(i=0;i<NRUNS;i++)
|
||||
{
|
||||
t[i] = cpucycles();
|
||||
for(j=0;j<REP;j++)
|
||||
hash_2n_n(sm, sm);
|
||||
}
|
||||
for(i=0;i<NRUNS-1;i++)
|
||||
t[i] = (t[i+1] - t[i]);
|
||||
qsort(t, NRUNS-1, sizeof(unsigned long long), ull_cmp);
|
||||
printf("hash_2n_n: %13.3lf\n", (double)t[NRUNS/2-1]/REP);
|
||||
|
||||
|
||||
return 0;
|
||||
}
|
||||
6
test/test.sh
Arquivo executável
6
test/test.sh
Arquivo executável
@ -0,0 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
DIR=$(dirname $0)
|
||||
#for i in `ls $DIR/test* | grep -v \.c$ | grep -v \.sh$`;do ($i || echo 666) | bc | grep -v ^0$;done
|
||||
for i in `ls $DIR/test* | grep -v \.c$ | grep -v \.sh$`;do ($i || echo 666) ;done
|
||||
exit 0
|
||||
BIN
test/test_chacha
Arquivo executável
BIN
test/test_chacha
Arquivo executável
Arquivo binário não exibido.
33
test/test_chacha.c
Arquivo normal
33
test/test_chacha.c
Arquivo normal
@ -0,0 +1,33 @@
|
||||
#include <stdio.h>
|
||||
#include "../prg.h"
|
||||
|
||||
static void hexdump(unsigned char *a, size_t len)
|
||||
{
|
||||
size_t i;
|
||||
for (i = 0; i < len; i++)
|
||||
printf("%02x", a[i]);
|
||||
}
|
||||
|
||||
|
||||
int main()
|
||||
{
|
||||
unsigned char seed[32] = {0};
|
||||
unsigned char out[64];
|
||||
unsigned char addr[16] = {2};
|
||||
|
||||
printf("Case 1: All 0\n");
|
||||
prg(out, 64, seed, 32);
|
||||
|
||||
printf("\n");
|
||||
hexdump(out, 64);
|
||||
printf("\n");
|
||||
|
||||
printf("Case 2: key = 1\n");
|
||||
seed[31] = 1;
|
||||
prg_with_counter(out, 64, seed, 32, addr);
|
||||
|
||||
printf("\n");
|
||||
hexdump(out, 64);
|
||||
printf("\n");
|
||||
return 0;
|
||||
}
|
||||
BIN
test/test_wots
Arquivo executável
BIN
test/test_wots
Arquivo executável
Arquivo binário não exibido.
54
test/test_wots.c
Arquivo normal
54
test/test_wots.c
Arquivo normal
@ -0,0 +1,54 @@
|
||||
#include <stdio.h>
|
||||
#include "../wots.h"
|
||||
#include "../randombytes.h"
|
||||
#include "../params.h"
|
||||
|
||||
static void hexdump(unsigned char *a, size_t len)
|
||||
{
|
||||
size_t i;
|
||||
for (i = 0; i < len; i++)
|
||||
printf("%02x", a[i]);
|
||||
}
|
||||
|
||||
int main()
|
||||
{
|
||||
unsigned char seed[32];
|
||||
unsigned char pub_seed[32];
|
||||
wots_params params;
|
||||
wots_set_params(¶ms, 32, 32, 16);
|
||||
|
||||
int sig_len = params.len*params.n;
|
||||
|
||||
unsigned char pk1[sig_len];
|
||||
unsigned char pk2[sig_len];
|
||||
unsigned char sig[sig_len];
|
||||
unsigned char addr[16] = {1,2,3,4};
|
||||
|
||||
unsigned char msg[32];
|
||||
int i;
|
||||
|
||||
randombytes(seed, 32);
|
||||
randombytes(pub_seed, 32);
|
||||
randombytes(msg, 32);
|
||||
//randombytes(addr, 16);
|
||||
|
||||
wots_pkgen(pk1, seed, ¶ms, pub_seed, addr);
|
||||
wots_sign(sig, msg, seed, ¶ms, pub_seed, addr);
|
||||
wots_pkFromSig(pk2, sig, msg, ¶ms, pub_seed, addr);
|
||||
|
||||
for(i=0;i<sig_len;i++)
|
||||
if(pk1[i] != pk2[i])
|
||||
{
|
||||
printf("fuck %d\n",i);
|
||||
return -1;
|
||||
}
|
||||
printf("worked great!\npk1: ");
|
||||
hexdump(pk1, sig_len);
|
||||
printf("\npk2: ");
|
||||
hexdump(pk2, sig_len);
|
||||
printf("\nsig: ");
|
||||
hexdump(sig, sig_len);
|
||||
printf("\n");
|
||||
|
||||
return 0;
|
||||
}
|
||||
BIN
test/test_xmss
Arquivo executável
BIN
test/test_xmss
Arquivo executável
Arquivo binário não exibido.
83
test/test_xmss.c
Arquivo normal
83
test/test_xmss.c
Arquivo normal
@ -0,0 +1,83 @@
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "../xmss.h"
|
||||
|
||||
#define MLEN 3491
|
||||
|
||||
|
||||
|
||||
unsigned char sk[100];
|
||||
unsigned char pk[64];
|
||||
unsigned char mi[MLEN];
|
||||
unsigned long long smlen;
|
||||
unsigned long long mlen;
|
||||
|
||||
int main()
|
||||
{
|
||||
int r;
|
||||
unsigned long long i;
|
||||
int m = 32;
|
||||
int n = 32;
|
||||
int h = 8;
|
||||
int w = 16;
|
||||
|
||||
xmss_params p;
|
||||
xmss_params *params = &p;
|
||||
xmss_set_params(params, m, n, h, w);
|
||||
unsigned long long signature_length = 4+m+params->wots_par->keysize+h*n;
|
||||
unsigned char mo[MLEN+signature_length];
|
||||
unsigned char sm[MLEN+signature_length];
|
||||
|
||||
FILE *urandom = fopen("/dev/urandom", "r");
|
||||
for(i=0;i<MLEN;i++) mi[i] = fgetc(urandom);
|
||||
|
||||
printf("keypair\n");
|
||||
xmss_keypair(pk, sk, params);
|
||||
// check pub_seed in SK
|
||||
for(i=0;i<n;i++)
|
||||
{
|
||||
if(pk[n+i] != sk[4+m+n+i]) printf("fuck %llu",i);
|
||||
}
|
||||
|
||||
// check index
|
||||
unsigned long idx = (sk[0] << 24) | (sk[1] << 16) | (sk[2] << 8) || sk[3];
|
||||
if(idx) printf("\nfuck %lu\n",idx);
|
||||
|
||||
printf("sign\n");
|
||||
xmss_sign(sk, sm, &smlen, mi, MLEN, params, pk);
|
||||
|
||||
r = memcmp(mi, sm+signature_length,MLEN);
|
||||
printf("%d\n", r);
|
||||
|
||||
/* Test valid signature */
|
||||
printf("verify\n");
|
||||
r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params);
|
||||
printf("%d\n", r);
|
||||
r = memcmp(mi,mo,MLEN);
|
||||
printf("%d\n", r);
|
||||
printf("%llu\n", MLEN-mlen);
|
||||
|
||||
/* Test with modified message */
|
||||
sm[52] ^= 1;
|
||||
r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params);
|
||||
printf("%d\n", r+1);
|
||||
r = memcmp(mi,mo,MLEN);
|
||||
printf("%d\n", (r!=0) - 1);
|
||||
printf("%llu\n", mlen+1);
|
||||
|
||||
/* Test with modified signature */
|
||||
sm[260] ^= 1;
|
||||
sm[52] ^= 1;
|
||||
sm[2] ^= 1;
|
||||
r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params);
|
||||
printf("%d\n", r+1);
|
||||
r = memcmp(mi,mo,MLEN);
|
||||
printf("%d\n", (r!=0) - 1);
|
||||
printf("%llu\n", mlen+1);
|
||||
|
||||
fclose(urandom);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
200
wots.c
Arquivo normal
200
wots.c
Arquivo normal
@ -0,0 +1,200 @@
|
||||
/*
|
||||
wots.c version 2015xxxx
|
||||
Andreas Hülsing
|
||||
Public domain.
|
||||
*/
|
||||
|
||||
#include "math.h"
|
||||
#include "stdio.h"
|
||||
#include "xmss_commons.h"
|
||||
//#include "params.h"
|
||||
#include "prg.h"
|
||||
#include "hash.h"
|
||||
#include "wots.h"
|
||||
|
||||
/**
|
||||
* Macros used to manipulate the respective fields
|
||||
* in the 16byte hash address
|
||||
*/
|
||||
#define SET_HASH_ADDRESS(a, v) {\
|
||||
a[15] = (a[15] & 1) | ((v << 1) & 255);\
|
||||
a[14] = (a[14] & 254) | ((v >> 7) & 1);}
|
||||
|
||||
#define SET_CHAIN_ADDRESS(a, v) {\
|
||||
a[14] = (a[14] & 1) | ((v << 1) & 255);\
|
||||
a[13] = (v >> 7) & 255;\
|
||||
a[12] = (a[12] & 254) | ((v >> 15) & 1);}
|
||||
|
||||
|
||||
void wots_set_params(wots_params *params, int m, int n, int w)
|
||||
{
|
||||
params->m = m;
|
||||
params->n = n;
|
||||
params->w = w;
|
||||
params->log_w = (int) log2(w);
|
||||
params->len_1 = (int) ceil(((8*m) / params->log_w));
|
||||
params->len_2 = (int) floor(log2(params->len_1*(w-1)) / params->log_w) + 1;
|
||||
params->len = params->len_1 + params->len_2;
|
||||
params->keysize = params->len*params->n;
|
||||
}
|
||||
|
||||
/**
|
||||
* Helper method for pseudorandom key generation
|
||||
* Expands a 32 byte array into a len*n byte array
|
||||
* this is done using chacha20 with nonce 0 and counter 0
|
||||
*/
|
||||
static void expand_seed(unsigned char *outseeds, const unsigned char *inseed, wots_params *params)
|
||||
{
|
||||
prg(outseeds, params->keysize, inseed, 32);
|
||||
}
|
||||
|
||||
/**
|
||||
* Computes the chaining function.
|
||||
* out and in have to be n-byte arrays
|
||||
*
|
||||
* interpretes in as start-th value of the chain
|
||||
* addr has to contain the address of the chain
|
||||
*/
|
||||
static void gen_chain(unsigned char *out, const unsigned char *in, int start, int steps, const wots_params *params, const unsigned char *pub_seed, unsigned char addr[16])
|
||||
{
|
||||
uint i,j;
|
||||
for(j=0;j<params->n;j++)
|
||||
out[j] = in[j];
|
||||
|
||||
for(i=start;i<(start+steps) && i<params->w;i++){
|
||||
SET_HASH_ADDRESS(addr,i);
|
||||
// printf("Hash %d:",i);
|
||||
// hexdump(addr,16);
|
||||
// printf("\n");
|
||||
hash_n_n(out,out, pub_seed, addr,params->n);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* base_w algorithm as described in draft.
|
||||
*
|
||||
*
|
||||
*/
|
||||
static void base_w(int *output, const unsigned char *input, int in_len, wots_params *params)
|
||||
{
|
||||
int in = 0;
|
||||
int out = 0;
|
||||
int total = 0;
|
||||
int bits = 0;
|
||||
int consumed = 0;
|
||||
|
||||
for(consumed = 0; consumed < 8 * in_len; consumed += params->log_w)
|
||||
{
|
||||
if(bits == 0){
|
||||
total = input[in_len - 1 - in];
|
||||
in++;
|
||||
bits += 8;
|
||||
}
|
||||
bits -= params->log_w;
|
||||
output[out] = (total >> bits) & (params->w - 1);
|
||||
out++;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Alternative base w algorithm for w = 16 to check...
|
||||
*/
|
||||
static void base_w_alternative(int *output, unsigned char *input, int in_len, wots_params *params)
|
||||
{
|
||||
uint i = 0;
|
||||
for(i = 0; i < in_len; i += 2)
|
||||
{
|
||||
output[i] = input[in_len - 1 - (i / 2)] >> 4;
|
||||
output[i+1] = input[in_len - 1 - (i / 2)] & 0xf;
|
||||
}
|
||||
}
|
||||
|
||||
void wots_pkgen(unsigned char *pk, const unsigned char *sk, wots_params *params, const unsigned char *pub_seed, unsigned char addr[16])
|
||||
{
|
||||
uint i;
|
||||
expand_seed(pk, sk, params);
|
||||
for(i=0;i<params->len;i++){
|
||||
SET_CHAIN_ADDRESS(addr,i);
|
||||
// printf("Chain: %d\n",i);
|
||||
// hexdump(addr,16);
|
||||
// printf("\n");
|
||||
gen_chain(pk+i*params->n, pk+i*params->n, 0, params->w-1, params, pub_seed, addr);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
void wots_sign(unsigned char *sig, const unsigned char *msg, const unsigned char *sk, wots_params *params, const unsigned char *pub_seed, unsigned char addr[16])
|
||||
{
|
||||
int basew[params->len];
|
||||
int csum = 0;
|
||||
uint i=0;
|
||||
|
||||
base_w(basew, msg, params->m, params);
|
||||
|
||||
for(i=0;i<params->len_1;i++)
|
||||
{
|
||||
csum += params->w - 1 - basew[i];
|
||||
}
|
||||
|
||||
csum = csum << ( 8 - ( ( params->len_2 * params->log_w ) % 8 ));
|
||||
|
||||
int len_2_bytes = ((params->len_2 * params->log_w) + 7) / 8;
|
||||
|
||||
unsigned char csum_bytes[len_2_bytes];
|
||||
to_byte(csum_bytes, csum, len_2_bytes);
|
||||
|
||||
int csum_basew[len_2_bytes / params->log_w];
|
||||
base_w(csum_basew, csum_bytes, len_2_bytes, params);
|
||||
|
||||
for(i = 0; i < params->len_2; i++)
|
||||
{
|
||||
basew[params->len_1 + i] = csum_basew[i];
|
||||
}
|
||||
|
||||
expand_seed(sig, sk, params);
|
||||
|
||||
for(i=0;i<params->len;i++){
|
||||
SET_CHAIN_ADDRESS(addr,i);
|
||||
// printf("Chain: %d\n",i);
|
||||
// hexdump(addr,16);
|
||||
// printf("\n");
|
||||
gen_chain(sig+i*params->n, sig+i*params->n, 0, basew[i], params, pub_seed, addr);
|
||||
}
|
||||
}
|
||||
|
||||
void wots_pkFromSig(unsigned char *pk, const unsigned char *sig, const unsigned char *msg, wots_params *params, const unsigned char *pub_seed, unsigned char addr[16])
|
||||
{
|
||||
int basew[params->len];
|
||||
int csum = 0;
|
||||
uint i=0;
|
||||
|
||||
base_w(basew, msg, params->m, params);
|
||||
|
||||
for(i=0;i<params->len_1;i++)
|
||||
{
|
||||
csum += params->w - 1 - basew[i];
|
||||
}
|
||||
|
||||
csum = csum << ( 8 - ( ( params->len_2 * params->log_w ) % 8 ));
|
||||
|
||||
int len_2_bytes = ((params->len_2 * params->log_w) + 7) / 8;
|
||||
|
||||
unsigned char csum_bytes[len_2_bytes];
|
||||
to_byte(csum_bytes, csum, len_2_bytes);
|
||||
|
||||
int csum_basew[len_2_bytes / params->log_w];
|
||||
base_w(csum_basew, csum_bytes, len_2_bytes, params);
|
||||
|
||||
for(i = 0; i < params->len_2; i++)
|
||||
{
|
||||
basew[params->len_1 + i] = csum_basew[i];
|
||||
}
|
||||
|
||||
for(i=0;i<params->len;i++){
|
||||
SET_CHAIN_ADDRESS(addr,i);
|
||||
// printf("Chain: %d\n",i);
|
||||
// hexdump(addr,16);
|
||||
// printf("\n");
|
||||
gen_chain(pk+i*params->n, sig+i*params->n, basew[i], params->w-1-basew[i], params, pub_seed, addr);
|
||||
}
|
||||
}
|
||||
52
wots.h
Arquivo normal
52
wots.h
Arquivo normal
@ -0,0 +1,52 @@
|
||||
#ifndef WOTS_H
|
||||
#define WOTS_H
|
||||
|
||||
#include "params.h"
|
||||
/**
|
||||
* WOTS parameter set
|
||||
*
|
||||
* Meaning as defined in draft-irtf-cfrg-xmss-hash-based-signatures-02
|
||||
*/
|
||||
typedef struct{
|
||||
int len_1;
|
||||
int len_2;
|
||||
int len;
|
||||
int m;
|
||||
int n;
|
||||
int w;
|
||||
int log_w;
|
||||
int keysize;
|
||||
} wots_params;
|
||||
|
||||
/**
|
||||
* Set the WOTS parameters,
|
||||
* only m, n, w are required as inputs,
|
||||
* len, len_1, and len_2 are computed from those.
|
||||
*
|
||||
* Assumes w is a power of 2
|
||||
*/
|
||||
void wots_set_params(wots_params *params, int m, int n, int w);
|
||||
|
||||
/**
|
||||
* WOTS key generation. Takes a 32byte seed for the secret key, expands it to a full WOTS secret key and computes the corresponding public key.
|
||||
* For this it takes the seed pub_seed which is used to generate bitmasks and hash keys and the address of this WOTS key pair addr
|
||||
*
|
||||
* params, must have been initialized before using wots_set params for params ! This is not done in this function
|
||||
*
|
||||
* Places the computed public key at address pk.
|
||||
*/
|
||||
void wots_pkgen(unsigned char *pk, const unsigned char *sk, wots_params *params, const unsigned char *pub_seed, unsigned char addr[16]);
|
||||
|
||||
/**
|
||||
* Takes a m-byte message and the 32-byte seed for the secret key to compute a signature that is placed at "sig".
|
||||
*
|
||||
*/
|
||||
void wots_sign(unsigned char *sig, const unsigned char *msg, const unsigned char *sk, wots_params *params, const unsigned char *pub_seed, unsigned char addr[16]);
|
||||
|
||||
/**
|
||||
* Takes a WOTS signature, a m-byte message and computes a WOTS public key that it places at pk.
|
||||
*
|
||||
*/
|
||||
void wots_pkFromSig(unsigned char *pk, const unsigned char *sig, const unsigned char *msg, wots_params *params, const unsigned char *pub_seed, unsigned char addr[16]);
|
||||
|
||||
#endif
|
||||
524
xmss.c
Arquivo normal
524
xmss.c
Arquivo normal
@ -0,0 +1,524 @@
|
||||
#include "xmss.h"
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <stdint.h>
|
||||
#include <math.h>
|
||||
|
||||
#include "randombytes.h"
|
||||
#include "wots.h"
|
||||
#include "hash.h"
|
||||
#include "prg.h"
|
||||
#include "xmss_commons.h"
|
||||
|
||||
// For testing
|
||||
#include "stdio.h"
|
||||
|
||||
/**
|
||||
* Macros used to manipulate the respective fields
|
||||
* in the 16byte hash address
|
||||
*/
|
||||
#define SET_OTS_BIT(a, b) {\
|
||||
a[9] = (a[9] & 253) | (b << 1);}
|
||||
|
||||
#define SET_OTS_ADDRESS(a, v) {\
|
||||
a[12] = (a[12] & 1) | ((v << 1) & 255);\
|
||||
a[11] = (v >> 7) & 255;\
|
||||
a[10] = (v >> 15) & 255;\
|
||||
a[9] = (a[9] & 254) | ((v >> 23) & 1);}
|
||||
|
||||
#define ZEROISE_OTS_ADDR(a) {\
|
||||
a[12] = (a[12] & 254);\
|
||||
a[13] = 0;\
|
||||
a[14] = 0;\
|
||||
a[15] = 0;}
|
||||
|
||||
#define SET_LTREE_BIT(a, b) {\
|
||||
a[9] = (a[9] & 254) | b;}
|
||||
|
||||
#define SET_LTREE_ADDRESS(a, v) {\
|
||||
a[12] = v & 255;\
|
||||
a[11] = (v >> 8) & 255;\
|
||||
a[10] = (v >> 16) & 255;}
|
||||
|
||||
#define SET_LTREE_TREE_HEIGHT(a, v) {\
|
||||
a[13] = (a[13] & 3) | ((v << 2) & 255);}
|
||||
|
||||
#define SET_LTREE_TREE_INDEX(a, v) {\
|
||||
a[15] = (a[15] & 3) | ((v << 2) & 255);\
|
||||
a[14] = (v >> 6) & 255;\
|
||||
a[13] = (a[13] & 252) | ((v >> 14) & 3);}
|
||||
|
||||
#define SET_NODE_PADDING(a) {\
|
||||
a[10] = 0;\
|
||||
a[11] = a[11] & 3;}
|
||||
|
||||
#define SET_NODE_TREE_HEIGHT(a, v) {\
|
||||
a[12] = (a[12] & 3) | ((v << 2) & 255);\
|
||||
a[11] = (a[11] & 252) | ((v >> 6) & 3);}
|
||||
|
||||
#define SET_NODE_TREE_INDEX(a, v) {\
|
||||
a[15] = (a[15] & 3) | ((v << 2) & 255);\
|
||||
a[14] = (v >> 6) & 255;\
|
||||
a[13] = (v >> 14) & 255;\
|
||||
a[12] = (a[12] & 252) | ((v >> 22) & 3);}
|
||||
|
||||
|
||||
/**
|
||||
* Used for pseudorandom keygeneration,
|
||||
* generates the seed for the WOTS keypair at address addr
|
||||
*/
|
||||
static void get_seed(unsigned char seed[32], const unsigned char *sk_seed, unsigned char addr[16])
|
||||
{
|
||||
// Make sure that chain addr, hash addr, and key bit are 0!
|
||||
ZEROISE_OTS_ADDR(addr);
|
||||
// Generate pseudorandom value
|
||||
prg_with_counter(seed, 32, sk_seed, 32, addr);
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize xmss params struct
|
||||
* parameter names are the same as in the draft
|
||||
*/
|
||||
void xmss_set_params(xmss_params *params, int m, int n, int h, int w)
|
||||
{
|
||||
params->h = h;
|
||||
params->m = m;
|
||||
params->n = n;
|
||||
wots_params wots_par;
|
||||
wots_set_params(&wots_par, m, n, w);
|
||||
params->wots_par = &wots_par;
|
||||
}
|
||||
|
||||
/**
|
||||
* Computes a leaf from a WOTS public key using an L-tree.
|
||||
*/
|
||||
static void l_tree(unsigned char *leaf, unsigned char *wots_pk, const xmss_params *params, const unsigned char *pub_seed, unsigned char addr[16])
|
||||
{
|
||||
uint l = params->wots_par->len;
|
||||
uint n = params->n;
|
||||
unsigned long i = 0;
|
||||
uint height = 0;
|
||||
|
||||
//ADRS.setTreeHeight(0);
|
||||
SET_LTREE_TREE_HEIGHT(addr,height);
|
||||
unsigned long bound;
|
||||
while ( l > 1 )
|
||||
{
|
||||
bound = l >> 1; //floor(l / 2);
|
||||
for ( i = 0; i < bound; i = i + 1 ) {
|
||||
//ADRS.setTreeIndex(i);
|
||||
SET_LTREE_TREE_INDEX(addr,i);
|
||||
//wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS);
|
||||
hash_2n_n(wots_pk+i*n,wots_pk+i*2*n, pub_seed, addr, n);
|
||||
}
|
||||
//if ( l % 2 == 1 ) {
|
||||
if(l&1)
|
||||
{
|
||||
//pk[floor(l / 2) + 1] = pk[l];
|
||||
memcpy(wots_pk+(l>>1)*n,wots_pk+(l-1)*n, n);
|
||||
//l = ceil(l / 2);
|
||||
l=(l>>1)+1;
|
||||
}
|
||||
else
|
||||
{
|
||||
//l = ceil(l / 2);
|
||||
l=(l>>1);
|
||||
}
|
||||
//ADRS.setTreeHeight(ADRS.getTreeHeight() + 1);
|
||||
height++;
|
||||
SET_LTREE_TREE_HEIGHT(addr,height);
|
||||
}
|
||||
//return pk[0];
|
||||
memcpy(leaf,wots_pk,n);
|
||||
}
|
||||
|
||||
/**
|
||||
* Computes the leaf at a given address. First generates the WOTS key pair, then computes leaf using l_tree. As this happens position independent, we only require that addr encodes the right ltree-address.
|
||||
*/
|
||||
static void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const xmss_params *params, const unsigned char *pub_seed, unsigned char ltree_addr[16], unsigned char ots_addr[16])
|
||||
{
|
||||
unsigned char seed[32];
|
||||
unsigned char pk[params->wots_par->keysize];
|
||||
|
||||
get_seed(seed, sk_seed, ots_addr);
|
||||
wots_pkgen(pk, seed, params->wots_par, pub_seed, ots_addr);
|
||||
|
||||
l_tree(leaf, pk, params, pub_seed, ltree_addr);
|
||||
}
|
||||
|
||||
/**
|
||||
* Merkle's TreeHash algorithm. The address only needs to initialize the first 78 bits of addr. Everything else will be set by treehash.
|
||||
* Currently only used for key generation.
|
||||
*
|
||||
*/
|
||||
static void treehash(unsigned char *node, int height, int index, const unsigned char *sk_seed, const xmss_params *params, const unsigned char *pub_seed, const unsigned char addr[16])
|
||||
{
|
||||
|
||||
uint idx = index;
|
||||
uint n = params->n;
|
||||
// use three different addresses because at this point we use all three formats in parallel
|
||||
unsigned char ots_addr[16];
|
||||
unsigned char ltree_addr[16];
|
||||
unsigned char node_addr[16];
|
||||
memcpy(ots_addr, addr, 10);
|
||||
SET_OTS_BIT(ots_addr, 1);
|
||||
memcpy(ltree_addr, addr, 10);
|
||||
SET_OTS_BIT(ltree_addr, 0);
|
||||
SET_LTREE_BIT(ltree_addr, 1);
|
||||
memcpy(node_addr, ltree_addr, 10);
|
||||
SET_LTREE_BIT(node_addr, 0);
|
||||
SET_NODE_PADDING(node_addr);
|
||||
|
||||
int lastnode,i;
|
||||
unsigned char stack[(height+1)*n];
|
||||
unsigned int stacklevels[height+1];
|
||||
unsigned int stackoffset=0;
|
||||
|
||||
lastnode = idx+(1<<height);
|
||||
|
||||
for(;idx<lastnode;idx++)
|
||||
{
|
||||
SET_LTREE_ADDRESS(ltree_addr,idx);
|
||||
SET_OTS_ADDRESS(ots_addr,idx);
|
||||
gen_leaf_wots(stack+stackoffset*n,sk_seed,params, pub_seed, ltree_addr, ots_addr);
|
||||
stacklevels[stackoffset] = 0;
|
||||
stackoffset++;
|
||||
while(stackoffset>1 && stacklevels[stackoffset-1] == stacklevels[stackoffset-2])
|
||||
{
|
||||
SET_NODE_TREE_HEIGHT(node_addr,stacklevels[stackoffset-1]);
|
||||
SET_NODE_TREE_INDEX(node_addr, (idx >> (stacklevels[stackoffset-1]+1)));
|
||||
hash_2n_n(stack+(stackoffset-2)*n,stack+(stackoffset-2)*n, pub_seed,
|
||||
node_addr, n);
|
||||
stacklevels[stackoffset-2]++;
|
||||
stackoffset--;
|
||||
}
|
||||
}
|
||||
for(i=0;i<n;i++)
|
||||
node[i] = stack[i];
|
||||
}
|
||||
|
||||
/**
|
||||
* Computes a root node given a leaf and an authapth
|
||||
*/
|
||||
static void validate_authpath(unsigned char *root, const unsigned char *leaf, unsigned long leafidx, const unsigned char *authpath, const xmss_params *params, const unsigned char *pub_seed, unsigned char addr[16])
|
||||
{
|
||||
uint n = params->n;
|
||||
|
||||
int i,j;
|
||||
unsigned char buffer[2*n];
|
||||
|
||||
// If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left.
|
||||
// Otherwise, it is the other way around
|
||||
if(leafidx&1)
|
||||
{
|
||||
for(j=0;j<n;j++)
|
||||
buffer[n+j] = leaf[j];
|
||||
for(j=0;j<n;j++)
|
||||
buffer[j] = authpath[j];
|
||||
}
|
||||
else
|
||||
{
|
||||
for(j=0;j<n;j++)
|
||||
buffer[j] = leaf[j];
|
||||
for(j=0;j<n;j++)
|
||||
buffer[n+j] = authpath[j];
|
||||
}
|
||||
authpath += n;
|
||||
|
||||
for(i=0;i<params->h-1;i++)
|
||||
{
|
||||
SET_NODE_TREE_HEIGHT(addr,i);
|
||||
leafidx >>= 1;
|
||||
SET_NODE_TREE_INDEX(addr, leafidx);
|
||||
if(leafidx&1)
|
||||
{
|
||||
hash_2n_n(buffer+n,buffer,pub_seed, addr, n);
|
||||
for(j=0;j<n;j++)
|
||||
buffer[j] = authpath[j];
|
||||
}
|
||||
else
|
||||
{
|
||||
hash_2n_n(buffer,buffer,pub_seed, addr, n);
|
||||
for(j=0;j<n;j++)
|
||||
buffer[j+n] = authpath[j];
|
||||
}
|
||||
authpath += n;
|
||||
}
|
||||
SET_NODE_TREE_HEIGHT(addr, (params->h-1));
|
||||
leafidx >>= 1;
|
||||
SET_NODE_TREE_INDEX(addr, leafidx);
|
||||
hash_2n_n(root,buffer,pub_seed,addr,n);
|
||||
}
|
||||
|
||||
/**
|
||||
* Computes the authpath and the root. This method is using a lot of space as we build the whole tree and then select the authpath nodes.
|
||||
* For more efficient algorithms see e.g. the chapter on hash-based signatures in Bernstein, Buchmann, Dahmen. "Post-quantum Cryptography", Springer 2009.
|
||||
* It returns the authpath in "authpath" with the node on level 0 at index 0.
|
||||
*/
|
||||
static void compute_authpath_wots(unsigned char *root, unsigned char *authpath, unsigned long leaf_idx, const unsigned char *sk_seed, const xmss_params *params, unsigned char *pub_seed, unsigned char addr[16])
|
||||
{
|
||||
uint i, j, level;
|
||||
int n = params->n;
|
||||
int h = params->h;
|
||||
|
||||
unsigned char tree[2*(1<<h)*n];
|
||||
|
||||
unsigned char ots_addr[16];
|
||||
unsigned char ltree_addr[16];
|
||||
unsigned char node_addr[16];
|
||||
|
||||
memcpy(ots_addr, addr, 10);
|
||||
SET_OTS_BIT(ots_addr, 1);
|
||||
memcpy(ltree_addr, addr, 10);
|
||||
SET_OTS_BIT(ltree_addr, 0);
|
||||
SET_LTREE_BIT(ltree_addr, 1);
|
||||
memcpy(node_addr, ltree_addr, 10);
|
||||
SET_LTREE_BIT(node_addr, 0);
|
||||
SET_NODE_PADDING(node_addr);
|
||||
|
||||
|
||||
// Compute all leaves
|
||||
for(i = 0; i < (1<<h); i++)
|
||||
{
|
||||
SET_LTREE_ADDRESS(ltree_addr,i);
|
||||
SET_OTS_ADDRESS(ots_addr,i);
|
||||
gen_leaf_wots(tree+((1<<h)*n + i*n), sk_seed, params, pub_seed, ltree_addr, ots_addr);
|
||||
}
|
||||
|
||||
|
||||
level = 0;
|
||||
// Compute tree:
|
||||
// Outer loop: For each inner layer
|
||||
for (i = (1<<h); i > 0; i>>=1)
|
||||
{
|
||||
SET_NODE_TREE_HEIGHT(node_addr, level);
|
||||
// Inner loop: for each pair of sibling nodes
|
||||
for (j = 0; j < i; j+=2)
|
||||
{
|
||||
SET_NODE_TREE_INDEX(node_addr, j>>1);
|
||||
hash_2n_n(tree + (i>>1)*n + (j>>1) * n, tree + i*n + j*n, pub_seed, node_addr, n);
|
||||
}
|
||||
level++;
|
||||
}
|
||||
|
||||
// copy authpath
|
||||
for(i=0;i<h;i++)
|
||||
memcpy(authpath + i*n, tree + ((1<<h)>>i)*n + ((leaf_idx >> i) ^ 1) * n, n);
|
||||
|
||||
// copy root
|
||||
memcpy(root, tree+n, n);
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
* Generates a XMSS key pair for a given parameter set.
|
||||
* Format sk: [(32bit) idx || SK_SEED || SK_PRF || PUB_SEED]
|
||||
* Format pk: [root || PUB_SEED] omitting algo oid.
|
||||
*/
|
||||
int xmss_keypair(unsigned char *pk, unsigned char *sk, xmss_params *params)
|
||||
{
|
||||
uint n = params->n;
|
||||
uint m = params->m;
|
||||
// Set idx = 0
|
||||
sk[0] = 0;
|
||||
sk[1] = 0;
|
||||
sk[2] = 0;
|
||||
sk[3] = 0;
|
||||
// Init SK_SEED (n byte), SK_PRF (m byte), and PUB_SEED (n byte)
|
||||
randombytes(sk+4,2*n+m);
|
||||
// Copy PUB_SEED to public key
|
||||
memcpy(pk+n, sk+4+n+m,n);
|
||||
|
||||
unsigned char addr[16] = {0,0,0,0};
|
||||
// Compute root
|
||||
treehash(pk, params->h, 0, sk+4, params, sk+4+n+m, addr);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Signs a message.
|
||||
* Returns
|
||||
* 1. an array containing the signature followed by the message AND
|
||||
* 2. an updated secret key!
|
||||
*
|
||||
*/
|
||||
int xmss_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *sig_msg_len, const unsigned char *msg, unsigned long long msglen, const xmss_params *params, unsigned char* pk)
|
||||
{
|
||||
uint n = params->n;
|
||||
uint m = params->m;
|
||||
|
||||
// Extract SK
|
||||
unsigned long idx = (sk[0] << 24) | (sk[1] << 16) | (sk[2] << 8) || sk[3];
|
||||
unsigned char sk_seed[n];
|
||||
memcpy(sk_seed,sk+4,n);
|
||||
unsigned char sk_prf[m];
|
||||
memcpy(sk_prf,sk+4+n,m);
|
||||
unsigned char pub_seed[n];
|
||||
memcpy(pub_seed,sk+4+n+m,n);
|
||||
|
||||
// Update SK
|
||||
sk[0] = ((idx + 1) >> 24) & 255;
|
||||
sk[1] = ((idx + 1) >> 16) & 255;
|
||||
sk[2] = ((idx + 1) >> 8) & 255;
|
||||
sk[3] = (idx + 1) & 255;
|
||||
// -- Secret key for this non-forward-secure version is now updated.
|
||||
// -- A productive implementation should use a file handle instead and write the updated secret key at this point!
|
||||
|
||||
// Init working params
|
||||
unsigned long long i;
|
||||
unsigned char R[m];
|
||||
unsigned char msg_h[m];
|
||||
unsigned char root[n];
|
||||
unsigned char ots_seed[n];
|
||||
unsigned char ots_addr[16] = {0,0,0,0};
|
||||
|
||||
// ---------------------------------
|
||||
// Message Hashing
|
||||
// ---------------------------------
|
||||
|
||||
// Message Hash:
|
||||
// First compute pseudorandom key
|
||||
prf_m(R, msg, msglen, sk_prf, m);
|
||||
// Then use it for message digest
|
||||
hash_m(msg_h, msg, msglen, R, m, m);
|
||||
|
||||
// Start collecting signature
|
||||
*sig_msg_len = 0;
|
||||
|
||||
// Copy index to signature
|
||||
sig_msg[0] = (idx >> 24) & 255;
|
||||
sig_msg[1] = (idx >> 16) & 255;
|
||||
sig_msg[2] = (idx >> 8) & 255;
|
||||
sig_msg[3] = idx & 255;
|
||||
|
||||
sig_msg += 4;
|
||||
*sig_msg_len += 4;
|
||||
|
||||
// Copy R to signature
|
||||
for(i=0; i<m; i++)
|
||||
sig_msg[i] = R[i];
|
||||
|
||||
sig_msg += m;
|
||||
*sig_msg_len += m;
|
||||
|
||||
// ----------------------------------
|
||||
// Now we start to "really sign"
|
||||
// ----------------------------------
|
||||
|
||||
// Prepare Address
|
||||
SET_OTS_BIT(ots_addr,1);
|
||||
SET_OTS_ADDRESS(ots_addr,idx);
|
||||
|
||||
// Compute seed for OTS key pair
|
||||
get_seed(ots_seed, sk_seed, ots_addr);
|
||||
|
||||
// Compute WOTS signature
|
||||
wots_sign(sig_msg, msg_h, ots_seed, params->wots_par, pub_seed, ots_addr);
|
||||
|
||||
sig_msg += params->wots_par->keysize;
|
||||
*sig_msg_len += params->wots_par->keysize;
|
||||
|
||||
compute_authpath_wots(root, sig_msg, idx, sk_seed, params, pub_seed, ots_addr);
|
||||
sig_msg += params->h*n;
|
||||
*sig_msg_len += params->h*n;
|
||||
|
||||
//DEBUG
|
||||
for(i=0;i<n;i++)
|
||||
if(root[i] != pk[i])
|
||||
printf("Different PK's %llu",i);
|
||||
|
||||
//Whipe secret elements?
|
||||
//zerobytes(tsk, CRYPTO_SECRETKEYBYTES);
|
||||
|
||||
memcpy(sig_msg,msg,msglen);
|
||||
*sig_msg_len += msglen;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Verifies a given message signature pair under a given public key.
|
||||
*/
|
||||
int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk, const xmss_params *params)
|
||||
{
|
||||
uint n = params->n;
|
||||
uint m = params->m;
|
||||
|
||||
unsigned long long i, m_len;
|
||||
unsigned long idx=0;
|
||||
unsigned char wots_pk[params->wots_par->keysize];
|
||||
unsigned char pkhash[n];
|
||||
unsigned char root[n];
|
||||
unsigned char msg_h[m];
|
||||
|
||||
unsigned char pub_seed[n];
|
||||
memcpy(pub_seed,pk+n,n);
|
||||
|
||||
// Init addresses
|
||||
unsigned char ots_addr[16] = {0,0,0,0};
|
||||
unsigned char ltree_addr[16];
|
||||
unsigned char node_addr[16];
|
||||
|
||||
SET_OTS_BIT(ots_addr, 1);
|
||||
|
||||
memcpy(ltree_addr, ots_addr, 10);
|
||||
SET_OTS_BIT(ltree_addr, 0);
|
||||
SET_LTREE_BIT(ltree_addr, 1);
|
||||
|
||||
memcpy(node_addr, ltree_addr, 10);
|
||||
SET_LTREE_BIT(node_addr, 0);
|
||||
SET_NODE_PADDING(node_addr);
|
||||
|
||||
// Extract index
|
||||
idx = (sig_msg[0] << 24) | (sig_msg[1] << 16) | (sig_msg[2] << 8) || sig_msg[3];
|
||||
sig_msg += 4;
|
||||
sig_msg_len -= 4;
|
||||
|
||||
// hash message (recall, R is now on pole position at sig_msg
|
||||
unsigned long long tmp_sig_len = m+params->wots_par->keysize+params->h*n;
|
||||
m_len = sig_msg_len - tmp_sig_len;
|
||||
hash_m(msg_h, sig_msg + tmp_sig_len, m_len, sig_msg, m, m);
|
||||
|
||||
sig_msg += m;
|
||||
sig_msg_len -= m;
|
||||
|
||||
//-----------------------
|
||||
// Verify signature
|
||||
//-----------------------
|
||||
|
||||
// Prepare Address
|
||||
SET_OTS_ADDRESS(ots_addr,idx);
|
||||
// Check WOTS signature
|
||||
wots_pkFromSig(wots_pk, sig_msg, msg_h, params->wots_par, pub_seed, ots_addr);
|
||||
|
||||
sig_msg += params->wots_par->keysize;
|
||||
sig_msg_len -= params->wots_par->keysize;
|
||||
|
||||
// Compute Ltree
|
||||
SET_LTREE_ADDRESS(ltree_addr, idx);
|
||||
l_tree(pkhash, wots_pk, params, pub_seed, ltree_addr);
|
||||
|
||||
// Compute root
|
||||
validate_authpath(root, pkhash, idx, sig_msg, params, pub_seed, node_addr);
|
||||
|
||||
sig_msg += params->h*n;
|
||||
sig_msg_len -= params->h*n;
|
||||
|
||||
for(i=0;i<n;i++)
|
||||
if(root[i] != pk[i])
|
||||
goto fail;
|
||||
|
||||
*msglen = sig_msg_len;
|
||||
for(i=0;i<*msglen;i++)
|
||||
msg[i] = sig_msg[i];
|
||||
|
||||
return 0;
|
||||
|
||||
|
||||
fail:
|
||||
*msglen = sig_msg_len;
|
||||
for(i=0;i<*msglen;i++)
|
||||
msg[i] = 0;
|
||||
*msglen = -1;
|
||||
return -1;
|
||||
}
|
||||
45
xmss.h
Arquivo normal
45
xmss.h
Arquivo normal
@ -0,0 +1,45 @@
|
||||
#include "wots.h"
|
||||
|
||||
#ifndef XMSS_H
|
||||
#define XMSS_H
|
||||
typedef struct{
|
||||
int level;
|
||||
unsigned long long subtree;
|
||||
int subleaf;
|
||||
} leafaddr;
|
||||
|
||||
typedef struct{
|
||||
wots_params *wots_par;
|
||||
int n;
|
||||
int m;
|
||||
int h;
|
||||
} xmss_params;
|
||||
|
||||
/**
|
||||
* Initializes parameter set.
|
||||
* Needed, for any of the other methods.
|
||||
*/
|
||||
void xmss_set_params(xmss_params *params, int m, int n, int h, int w);
|
||||
/**
|
||||
* Generates a XMSS key pair for a given parameter set.
|
||||
* Format sk: [(32bit) idx || SK_SEED || SK_PRF || PUB_SEED]
|
||||
* Format pk: [root || PUB_SEED] omitting algo oid.
|
||||
*/
|
||||
int xmss_keypair(unsigned char *pk, unsigned char *sk, xmss_params *params);
|
||||
/**
|
||||
* Signs a message.
|
||||
* Returns
|
||||
* 1. an array containing the signature followed by the message AND
|
||||
* 2. an updated secret key!
|
||||
*
|
||||
*/
|
||||
int xmss_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *sig_msg_len, const unsigned char *msg,unsigned long long msglen, const xmss_params *params, unsigned char* pk);
|
||||
/**
|
||||
* Verifies a given message signature pair under a given public key.
|
||||
*
|
||||
* Note: msg and msglen are pure outputs which carry the message in case verification succeeds. The (input) message is assumed to be within sig_msg which has the form (sig||msg).
|
||||
*/
|
||||
int xmss_sign_open(unsigned char *msg,unsigned long long *msglen, const unsigned char *sig_msg,unsigned long long sig_msg_len, const unsigned char *pk, const xmss_params *params);
|
||||
|
||||
#endif
|
||||
|
||||
19
xmss_commons.c
Arquivo normal
19
xmss_commons.c
Arquivo normal
@ -0,0 +1,19 @@
|
||||
#include "xmss_commons.h"
|
||||
#include <stdlib.h>
|
||||
#include <stdio.h>
|
||||
|
||||
void to_byte(unsigned char *out, uint in, int bytes)
|
||||
{
|
||||
int i;
|
||||
for(i = 0; i < bytes; i++){
|
||||
out[i] = in & 0xff;
|
||||
in = in >> 8;
|
||||
}
|
||||
}
|
||||
|
||||
void hexdump(const unsigned char *a, size_t len)
|
||||
{
|
||||
size_t i;
|
||||
for (i = 0; i < len; i++)
|
||||
printf("%02x", a[i]);
|
||||
}
|
||||
8
xmss_commons.h
Arquivo normal
8
xmss_commons.h
Arquivo normal
@ -0,0 +1,8 @@
|
||||
#ifndef XMSS_COMMONS_H
|
||||
#define XMSS_COMMONS_H
|
||||
|
||||
#include <stdlib.h>
|
||||
|
||||
void to_byte(unsigned char *output, uint in, int bytes);
|
||||
void hexdump(const unsigned char *a, size_t len);
|
||||
#endif
|
||||
9
zerobytes.c
Arquivo normal
9
zerobytes.c
Arquivo normal
@ -0,0 +1,9 @@
|
||||
#include "zerobytes.h"
|
||||
|
||||
unsigned char *zerobytes(unsigned char *r,unsigned long long n)
|
||||
{
|
||||
volatile unsigned char *p=r;
|
||||
while (n--)
|
||||
*(p++) = 0;
|
||||
return r;
|
||||
}
|
||||
6
zerobytes.h
Arquivo normal
6
zerobytes.h
Arquivo normal
@ -0,0 +1,6 @@
|
||||
#ifndef ZEROBYTES_H
|
||||
#define ZEROBYTES_H
|
||||
|
||||
unsigned char *zerobytes(unsigned char *r,unsigned long long n);
|
||||
|
||||
#endif
|
||||
Carregando…
Referência em uma nova issue
Block a user