kris/xmss-KAT-generator
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Make codestyle more consistent, fix -Wextra warns

Browse Source
This commit is contained in:
Joost Rijneveld 2016-02-02 14:06:43 +01:00
parent 719cb467df
commit 1e503b665e
19 changed files with 722 additions and 810 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@ -1,5 +1,5 @@
CC = /usr/bin/gcc CC = /usr/bin/gcc
CFLAGS = -Wall -g -O3 CFLAGS = -Wall -g -O3 -Wextra
all: test/test_chacha \ all: test/test_chacha \
test/test_wots \ test/test_wots \

24
chacha.c
View File

@ -84,13 +84,12 @@ static const char sigma[16] = "expand 32-byte k";
* |input| and writes the 64 output bytes to |output|. */ * |input| and writes the 64 output bytes to |output|. */
static void chacha_core(unsigned char output[64], const uint32_t input[16], static void chacha_core(unsigned char output[64], const uint32_t input[16],
int num_rounds) int num_rounds)
{ {
uint32_t x[16]; uint32_t x[16];
int i; int i;
memcpy(x, input, sizeof(uint32_t) * 16); memcpy(x, input, sizeof(uint32_t) * 16);
for (i = 20; i > 0; i -= 2) for (i = num_rounds; i > 0; i -= 2) {
{
QUARTERROUND( 0, 4, 8,12) QUARTERROUND( 0, 4, 8,12)
QUARTERROUND( 1, 5, 9,13) QUARTERROUND( 1, 5, 9,13)
QUARTERROUND( 2, 6,10,14) QUARTERROUND( 2, 6,10,14)
@ -99,20 +98,20 @@ static void chacha_core(unsigned char output[64], const uint32_t input[16],
QUARTERROUND( 1, 6,11,12) QUARTERROUND( 1, 6,11,12)
QUARTERROUND( 2, 7, 8,13) QUARTERROUND( 2, 7, 8,13)
QUARTERROUND( 3, 4, 9,14) QUARTERROUND( 3, 4, 9,14)
} }
for (i = 0; i < 16; ++i) for (i = 0; i < 16; ++i)
x[i] = PLUS(x[i], input[i]); x[i] = PLUS(x[i], input[i]);
for (i = 0; i < 16; ++i) for (i = 0; i < 16; ++i)
U32TO8_LITTLE(output + 4 * i, x[i]); U32TO8_LITTLE(output + 4 * i, x[i]);
} }
void CRYPTO_chacha_20(unsigned char *out, void CRYPTO_chacha_20(unsigned char *out,
const unsigned char *in, size_t in_len, const unsigned char *in, size_t in_len,
const unsigned char key[32], const unsigned char key[32],
const unsigned char nonce[12], const unsigned char nonce[12],
uint32_t counter) uint32_t counter)
{ {
uint32_t input[16]; uint32_t input[16];
unsigned char buf[64]; unsigned char buf[64];
size_t todo, i; size_t todo, i;
@ -137,8 +136,7 @@ void CRYPTO_chacha_20(unsigned char *out,
input[14] = U8TO32_LITTLE(nonce + 4); input[14] = U8TO32_LITTLE(nonce + 4);
input[15] = U8TO32_LITTLE(nonce + 8); input[15] = U8TO32_LITTLE(nonce + 8);
while (in_len > 0) while (in_len > 0) {
{
todo = sizeof(buf); todo = sizeof(buf);
if (in_len < todo) if (in_len < todo)
todo = in_len; todo = in_len;
@ -154,15 +152,15 @@ void CRYPTO_chacha_20(unsigned char *out,
input[12]++; input[12]++;
if (input[12] == 0) if (input[12] == 0)
input[13]++; input[13]++;
}
} }
}
void CRYPTO_chacha_20_keystream(unsigned char *out, void CRYPTO_chacha_20_keystream(unsigned char *out,
size_t out_len, size_t out_len,
const unsigned char key[32], const unsigned char key[32],
const unsigned char nonce[12], const unsigned char nonce[12],
uint32_t counter) uint32_t counter)
{ {
uint32_t input[16]; uint32_t input[16];
unsigned char buf[64]; unsigned char buf[64];
size_t todo, i; size_t todo, i;
@ -187,8 +185,7 @@ void CRYPTO_chacha_20_keystream(unsigned char *out,
input[14] = U8TO32_LITTLE(nonce + 4); input[14] = U8TO32_LITTLE(nonce + 4);
input[15] = U8TO32_LITTLE(nonce + 8); input[15] = U8TO32_LITTLE(nonce + 8);
while (out_len > 0) while (out_len > 0) {
{
todo = sizeof(buf); todo = sizeof(buf);
if (out_len < todo) if (out_len < todo)
todo = out_len; todo = out_len;
@ -203,6 +200,5 @@ void CRYPTO_chacha_20_keystream(unsigned char *out,
input[12]++; input[12]++;
if (input[12] == 0) if (input[12] == 0)
input[13]++; input[13]++;
}
} }
}

114
hash.c
View File

@ -7,14 +7,15 @@ Public domain.
#include "prg.h" #include "prg.h"
#include <stddef.h> #include <stddef.h>
#include "stdio.h" #include <stdio.h>
#include <string.h>
#include <openssl/sha.h> #include <openssl/sha.h>
#include <openssl/hmac.h> #include <openssl/hmac.h>
#include <openssl/evp.h> #include <openssl/evp.h>
#define SET_KEY_BIT(a,b) (a[15] = (a[15] & 253) | ((b << 1) & 2)) #define SET_KEY_BIT(a, b) (a[15] = (a[15] & 253) | ((b << 1) & 2))
#define SET_BLOCK_BIT(a,b) (a[15] = (a[15] & 254) | (b & 1)) #define SET_BLOCK_BIT(a, b) (a[15] = (a[15] & 254) | (b & 1))
#define WOTS_SELECT_KEY(a) (a[15] = (a[15] & 254) | 1) #define WOTS_SELECT_KEY(a) (a[15] = (a[15] & 254) | 1)
#define WOTS_SELECT_BLOCK(a) (a[15] = (a[15] & 254) | 0) #define WOTS_SELECT_BLOCK(a) (a[15] = (a[15] & 254) | 0)
@ -22,25 +23,21 @@ Public domain.
/** /**
* Implements PRF_m * Implements PRF_m
*/ */
int prf_m(unsigned char *out, const unsigned char *in, size_t inlen, const unsigned char *key, int keylen) int prf_m(unsigned char *out, const unsigned char *in, size_t inlen, const unsigned char *key, unsigned int keylen)
{ {
unsigned int length; unsigned int length;
if (keylen == 32){ if (keylen == 32) {
HMAC(EVP_sha256(), key, keylen, in, inlen, out, &length); HMAC(EVP_sha256(), key, keylen, in, inlen, out, &length);
if(length != 32) if (length != 32) {
{ fprintf(stderr, "HMAC outputs %d bytes... That should not happen...", length);
fprintf(stderr, "HMAC outputs %d bytes... That should not happen...",length);
} }
return 0; return 0;
} }
else else {
{ if (keylen == 64) {
if(keylen == 64)
{
HMAC(EVP_sha512(), key, keylen, in, inlen, out, &length); HMAC(EVP_sha512(), key, keylen, in, inlen, out, &length);
if(length != 64) if (length != 64) {
{ fprintf(stderr, "HMAC outputs %d bytes... That should not happen...", length);
fprintf(stderr, "HMAC outputs %d bytes... That should not happen...",length);
} }
return 0; return 0;
} }
@ -51,37 +48,32 @@ int prf_m(unsigned char *out, const unsigned char *in, size_t inlen, const unsig
/* /*
* Implemts H_m * Implemts H_m
*/ */
int hash_m(unsigned char *out,const unsigned char *in,unsigned long long inlen,const unsigned char *key, const int keylen, const int m) int hash_m(unsigned char *out, const unsigned char *in, unsigned long long inlen, const unsigned char *key, const unsigned int keylen, const unsigned int m)
{ {
if(keylen != m){ unsigned int i;
fprintf(stderr, "H_m takes m-bit keys, we got m=%d but a keylength of %d.\n",m,keylen); unsigned char buf[inlen + keylen + m];
if (keylen != m){
fprintf(stderr, "H_m takes m-bit keys, we got m=%d but a keylength of %d.\n", m, keylen);
return 1; return 1;
} }
unsigned long long i; for (i=0; i < m; i++) {
unsigned char buf[inlen +keylen+m];
for(i=0;i<m;i++)
{
buf[i] = 0x00; buf[i] = 0x00;
} }
for(i=0;i <keylen;i++) for (i=0; i < keylen; i++) {
{ buf[m + i] = key[i];
buf[m+i] = key[i];
} }
for(i=0;i <inlen;i++) for (i=0; i < inlen; i++) {
{ buf[m + keylen + i] = in[i];
buf[m+keylen+i] = in[i];
} }
if(m == 32) if (m == 32) {
{ SHA256(buf, inlen + keylen + m, out);
SHA256(buf,inlen +keylen+m,out);
return 0; return 0;
} }
else else {
{ if (m == 64) {
if(m == 64) SHA512(buf, inlen + keylen + m, out);
{
SHA512(buf,inlen +keylen+m,out);
return 0; return 0;
} }
} }
@ -91,68 +83,70 @@ int hash_m(unsigned char *out,const unsigned char *in,unsigned long long inlen,c
/** /**
* We assume the left half is in in[0]...in[n-1] * We assume the left half is in in[0]...in[n-1]
*/ */
int hash_2n_n(unsigned char *out,const unsigned char *in, const unsigned char *pub_seed, unsigned char addr[16], const int n) int hash_2n_n(unsigned char *out, const unsigned char *in, const unsigned char *pub_seed, unsigned char addr[16], const unsigned int n)
{ {
unsigned char buf[4*n]; unsigned char buf[4*n];
unsigned char key[n]; unsigned char key[n];
unsigned char bitmask[2*n]; unsigned char bitmask[2*n];
int i; unsigned int i;
SET_KEY_BIT(addr,1); SET_KEY_BIT(addr, 1);
SET_BLOCK_BIT(addr,0); SET_BLOCK_BIT(addr, 0);
prg_with_counter(key, pub_seed, n, addr); prg_with_counter(key, pub_seed, n, addr);
SET_KEY_BIT(addr,0); SET_KEY_BIT(addr, 0);
// Use MSB order // Use MSB order
prg_with_counter(bitmask, pub_seed, n, addr); prg_with_counter(bitmask, pub_seed, n, addr);
SET_BLOCK_BIT(addr,1); SET_BLOCK_BIT(addr, 1);
prg_with_counter(bitmask+n, pub_seed, n, addr); prg_with_counter(bitmask+n, pub_seed, n, addr);
for(i=0;i<n;i++) for (i = 0; i < n; i++) {
{
buf[i] = 0x00; buf[i] = 0x00;
buf[n+i] = key[i]; buf[n+i] = key[i];
buf[2*n+i] = in[i] ^ bitmask[i]; buf[2*n+i] = in[i] ^ bitmask[i];
buf[3*n+i] = in[n+i] ^ bitmask[n+i]; buf[3*n+i] = in[n+i] ^ bitmask[n+i];
} }
if(n==32){ if (n == 32) {
SHA256(buf,4*n,out); SHA256(buf, 4*n, out);
return 0; return 0;
} else { }
if(n==64){ else {
SHA512(buf,4*n,out); if (n == 64) {
SHA512(buf, 4*n, out);
return 0; return 0;
} else { }
else {
fprintf(stderr, "Hash.c:hash_2n_n: Code only supports n=32 or n=64"); fprintf(stderr, "Hash.c:hash_2n_n: Code only supports n=32 or n=64");
return -1; return -1;
} }
} }
} }
int hash_n_n(unsigned char *out,const unsigned char *in, const unsigned char *pub_seed, unsigned char addr[16], const int n) int hash_n_n(unsigned char *out, const unsigned char *in, const unsigned char *pub_seed, unsigned char addr[16], const unsigned int n)
{ {
unsigned char buf[3*n]; unsigned char buf[3*n];
unsigned char key[n]; unsigned char key[n];
unsigned char bitmask[n]; unsigned char bitmask[n];
int i; unsigned int i;
WOTS_SELECT_KEY(addr); WOTS_SELECT_KEY(addr);
prg_with_counter(key, pub_seed, n, addr); prg_with_counter(key, pub_seed, n, addr);
WOTS_SELECT_BLOCK(addr); WOTS_SELECT_BLOCK(addr);
prg_with_counter(bitmask, pub_seed, n, addr); prg_with_counter(bitmask, pub_seed, n, addr);
for(i=0;i<n;i++) for (i = 0; i < n; i++) {
{
buf[i] = 0x00; buf[i] = 0x00;
buf[n+i] = key[i]; buf[n+i] = key[i];
buf[2*n+i] = in[i] ^ bitmask[i]; buf[2*n+i] = in[i] ^ bitmask[i];
} }
if(n==32){ if (n == 32) {
SHA256(buf,3*n,out); SHA256(buf, 3*n, out);
return 0; return 0;
} else { }
if(n==64){ else {
SHA512(buf,3*n,out); if (n == 64) {
SHA512(buf, 3*n, out);
return 0; return 0;
} else { }
else {
fprintf(stderr, "Hash.c:hash_n_n: Code only supports n=32 or n=64"); fprintf(stderr, "Hash.c:hash_n_n: Code only supports n=32 or n=64");
return -1; return -1;
} }

52
prg.c
View File

@ -17,32 +17,27 @@ const unsigned char zero_nonce[12] = {0};
*/ */
void prg(unsigned char *r, unsigned long long rlen, const unsigned char *key, unsigned int key_len) void prg(unsigned char *r, unsigned long long rlen, const unsigned char *key, unsigned int key_len)
{ {
if(key_len == 32){ if (key_len == 32) {
CRYPTO_chacha_20_keystream(r, rlen, key, zero_nonce, 0); CRYPTO_chacha_20_keystream(r, rlen, key, zero_nonce, 0);
} }
else else {
{ if (key_len == 64) {
if(key_len == 64)
{
unsigned long long left = rlen; unsigned long long left = rlen;
u_int32_t counter = 0; u_int32_t counter = 0;
unsigned char *c = (unsigned char*)&counter; unsigned char *c = (unsigned char*)&counter;
unsigned int length; unsigned int length;
unsigned int i = 0; unsigned int i = 0;
unsigned char tmp[64]; unsigned char tmp[64];
while(left > 0) while (left > 0) {
{ HMAC(EVP_sha512(), key, key_len, c , 4, tmp, &length);
HMAC(EVP_sha512(), key, key_len, c , 4, tmp, &length); if (length != 64) {
if(length != 64) fprintf(stderr, "HMAC outputs %d bytes... That should not happen...", length);
{ }
fprintf(stderr, "HMAC outputs %d bytes... That should not happen...",length); for (i = 0; ((i < length) && (i < left)); i++) {
} r[rlen-left+i] = tmp[i];
for(i = 0; ((i < length) && (i < left));i++) }
{ left -= length;
r[rlen-left+i] = tmp[i]; counter++;
}
left -=length;
counter++;
} }
} }
else { else {
@ -60,27 +55,24 @@ void prg_with_counter(unsigned char *r, const unsigned char *key, unsigned int n
{ {
int i; int i;
unsigned char nonce[12]; unsigned char nonce[12];
if(n == 32){ if (n == 32) {
for(i = 0; i < 12; i++) for (i = 0; i < 12; i++) {
{
nonce[i] = addr[i]; nonce[i] = addr[i];
} }
uint32_t counter; uint32_t counter;
counter = (((uint32_t)addr[12]) << 24)|(((uint32_t)addr[13]) << 16)|(((uint32_t)addr[14]) << 8)|addr[15]; counter = (((uint32_t)addr[12]) << 24) | (((uint32_t)addr[13]) << 16) | (((uint32_t)addr[14]) << 8) | addr[15];
// TODO: Check address handling. Endianess? // TODO: Check address handling. Endianess?
CRYPTO_chacha_20_keystream(r, n, key, nonce, counter); CRYPTO_chacha_20_keystream(r, n, key, nonce, counter);
} }
else else {
{ if (n == 64) {
if(n == 64)
{
unsigned int length; unsigned int length;
HMAC(EVP_sha512(), key, n, addr, 16, r, &length); HMAC(EVP_sha512(), key, n, addr, 16, r, &length);
if(length != 64) if (length != 64) {
{ fprintf(stderr, "HMAC outputs %d bytes... That should not happen...", length);
fprintf(stderr, "HMAC outputs %d bytes... That should not happen...",length);
} }
} else { }
else {
fprintf(stderr,"prg.c:: Code only supports 32 byte and 64 byte seeds"); fprintf(stderr,"prg.c:: Code only supports 32 byte and 64 byte seeds");
} }
} }

6
randombytes.c
View File

@ -11,13 +11,13 @@ This code was taken from the SPHINCS reference implementation and is public doma
static int fd = -1; static int fd = -1;
void randombytes(unsigned char *x,unsigned long long xlen) void randombytes(unsigned char *x, unsigned long long xlen)
{ {
int i; int i;
if (fd == -1) { if (fd == -1) {
for (;;) { for (;;) {
fd = open("/dev/urandom",O_RDONLY); fd = open("/dev/urandom", O_RDONLY);
if (fd != -1) break; if (fd != -1) break;
sleep(1); sleep(1);
} }
@ -26,7 +26,7 @@ void randombytes(unsigned char *x,unsigned long long xlen)
while (xlen > 0) { while (xlen > 0) {
if (xlen < 1048576) i = xlen; else i = 1048576; if (xlen < 1048576) i = xlen; else i = 1048576;
i = read(fd,x,i); i = read(fd, x, i);
if (i < 1) { if (i < 1) {
sleep(1); sleep(1);
continue; continue;

5
test/test_wots.c
View File

@ -36,9 +36,8 @@ int main()
wots_sign(sig, msg, seed, &params, pub_seed, addr); wots_sign(sig, msg, seed, &params, pub_seed, addr);
wots_pkFromSig(pk2, sig, msg, &params, pub_seed, addr); wots_pkFromSig(pk2, sig, msg, &params, pub_seed, addr);
for(i=0;i<sig_len;i++) for (i = 0; i < sig_len; i++)
if(pk1[i] != pk2[i]) if (pk1[i] != pk2[i]) {
{
printf("pk1 != pk2 %d\n",i); printf("pk1 != pk2 %d\n",i);
return -1; return -1;
} }

35
test/test_xmss.c
View File

@ -6,8 +6,6 @@
#define MLEN 3491 #define MLEN 3491
#define SIGNATURES 50 #define SIGNATURES 50
unsigned char mi[MLEN]; unsigned char mi[MLEN];
unsigned long long smlen; unsigned long long smlen;
unsigned long long mlen; unsigned long long mlen;
@ -16,10 +14,10 @@ int main()
{ {
int r; int r;
unsigned long long i; unsigned long long i;
int m = 64; unsigned int m = 64;
int n = 64; unsigned int n = 64;
int h = 8; unsigned int h = 8;
int w = 16; unsigned int w = 16;
unsigned long errors = 0; unsigned long errors = 0;
@ -34,21 +32,20 @@ int main()
unsigned char sm[MLEN+signature_length]; unsigned char sm[MLEN+signature_length];
FILE *urandom = fopen("/dev/urandom", "r"); FILE *urandom = fopen("/dev/urandom", "r");
for(i=0;i<MLEN;i++) mi[i] = fgetc(urandom); for (i = 0; i < MLEN; i++) mi[i] = fgetc(urandom);
printf("keypair\n"); printf("keypair\n");
xmss_keypair(pk, sk, params); xmss_keypair(pk, sk, params);
// check pub_seed in SK // check pub_seed in SK
for(i=0;i<n;i++) for (i = 0; i < n; i++) {
{ if (pk[n+i] != sk[4+m+n+i]) printf("pk.pub_seed != sk.pub_seed %llu",i);
if(pk[n+i] != sk[4+m+n+i]) printf("pk.pub_seed != sk.pub_seed %llu",i);
} }
// check index // check index
unsigned long idx = ((unsigned long)sk[0] << 24) | ((unsigned long)sk[1] << 16) | ((unsigned long)sk[2] << 8) | sk[3]; unsigned long idx = ((unsigned long)sk[0] << 24) | ((unsigned long)sk[1] << 16) | ((unsigned long)sk[2] << 8) | sk[3];
if(idx) printf("\nidx != 0 %lu\n",idx); if (idx) printf("\nidx != 0 %lu\n",idx);
for(i=0;i<(1<<h);i++){ for (i = 0; i < SIGNATURES; i++) {
printf("sign\n"); printf("sign\n");
xmss_sign(sk, sm, &smlen, mi, MLEN, params); xmss_sign(sk, sm, &smlen, mi, MLEN, params);
idx = ((unsigned long)sm[0] << 24) | ((unsigned long)sm[1] << 16) | ((unsigned long)sm[2] << 8) | sm[3]; idx = ((unsigned long)sm[0] << 24) | ((unsigned long)sm[1] << 16) | ((unsigned long)sm[2] << 8) | sm[3];
@ -57,11 +54,11 @@ int main()
r = memcmp(mi, sm+signature_length,MLEN); r = memcmp(mi, sm+signature_length,MLEN);
printf("%d\n", r); printf("%d\n", r);
/* Test valid signature */ /* Test valid signature */
printf("verify\n"); printf("verify\n");
r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params); r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params);
printf("%d\n", r); printf("%d\n", r);
if(r != 0) errors++; if (r != 0) errors++;
r = memcmp(mi,mo,MLEN); r = memcmp(mi,mo,MLEN);
printf("%d\n", r); printf("%d\n", r);
printf("%llu\n", MLEN-mlen); printf("%llu\n", MLEN-mlen);
@ -70,7 +67,7 @@ int main()
sm[signature_length+10] ^= 1; sm[signature_length+10] ^= 1;
r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params); r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params);
printf("%d\n", r+1); printf("%d\n", r+1);
if(r == 0) errors++; if (r == 0) errors++;
r = memcmp(mi,mo,MLEN); r = memcmp(mi,mo,MLEN);
printf("%d\n", (r!=0) - 1); printf("%d\n", (r!=0) - 1);
printf("%llu\n", mlen+1); printf("%llu\n", mlen+1);
@ -81,7 +78,7 @@ int main()
sm[2] ^= 1; sm[2] ^= 1;
r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params); r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params);
printf("%d\n", r+1); printf("%d\n", r+1);
if(r == 0) errors++; if (r == 0) errors++;
r = memcmp(mi,mo,MLEN); r = memcmp(mi,mo,MLEN);
printf("%d\n", (r!=0) - 1); printf("%d\n", (r!=0) - 1);
printf("%llu\n", mlen+1); printf("%llu\n", mlen+1);
@ -91,7 +88,7 @@ int main()
sm[5] ^= 1; sm[5] ^= 1;
r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params); r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params);
printf("%d\n", r+1); printf("%d\n", r+1);
if(r == 0) errors++; if (r == 0) errors++;
r = memcmp(mi,mo,MLEN); r = memcmp(mi,mo,MLEN);
printf("%d\n", (r!=0) - 1); printf("%d\n", (r!=0) - 1);
printf("%llu\n", mlen+1); printf("%llu\n", mlen+1);
@ -101,7 +98,7 @@ int main()
sm[240] ^= 1; sm[240] ^= 1;
r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params); r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params);
printf("%d\n", r+1); printf("%d\n", r+1);
if(r == 0) errors++; if (r == 0) errors++;
r = memcmp(mi,mo,MLEN); r = memcmp(mi,mo,MLEN);
printf("%d\n", (r!=0) - 1); printf("%d\n", (r!=0) - 1);
printf("%llu\n", mlen+1); printf("%llu\n", mlen+1);
@ -111,7 +108,7 @@ int main()
sm[signature_length - 10] ^= 1; sm[signature_length - 10] ^= 1;
r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params); r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params);
printf("%d\n", r+1); printf("%d\n", r+1);
if(r == 0) errors++; if (r == 0) errors++;
r = memcmp(mi,mo,MLEN); r = memcmp(mi,mo,MLEN);
printf("%d\n", (r!=0) - 1); printf("%d\n", (r!=0) - 1);
printf("%llu\n", mlen+1); printf("%llu\n", mlen+1);

39
test/test_xmss_fast.c
View File

@ -7,8 +7,6 @@
#define MLEN 3491 #define MLEN 3491
#define SIGNATURES 256 #define SIGNATURES 256
unsigned char mi[MLEN]; unsigned char mi[MLEN];
unsigned long long smlen; unsigned long long smlen;
unsigned long long mlen; unsigned long long mlen;
@ -17,11 +15,11 @@ int main()
{ {
int r; int r;
unsigned long long i; unsigned long long i;
int m = 32; unsigned int m = 32;
int n = 32; unsigned int n = 32;
int h = 8; unsigned int h = 8;
int w = 16; unsigned int w = 16;
int k = 2; unsigned int k = 2;
unsigned long errors = 0; unsigned long errors = 0;
@ -43,7 +41,7 @@ int main()
unsigned char retain[((1 << k) - k - 1)*n]; unsigned char retain[((1 << k) - k - 1)*n];
bds_state s; bds_state s;
bds_state *state = &s; bds_state *state = &s;
for(i=0;i<h-k;i++) for (i = 0; i < h-k; i++)
treehash[i].node = &th_nodes[n*i]; treehash[i].node = &th_nodes[n*i];
xmss_set_bds_state(state, stack, stackoffset, stacklevels, auth, keep, treehash, retain, 0); xmss_set_bds_state(state, stack, stackoffset, stacklevels, auth, keep, treehash, retain, 0);
@ -52,21 +50,20 @@ int main()
unsigned char sm[MLEN+signature_length]; unsigned char sm[MLEN+signature_length];
FILE *urandom = fopen("/dev/urandom", "r"); FILE *urandom = fopen("/dev/urandom", "r");
for(i=0;i<MLEN;i++) mi[i] = fgetc(urandom); for (i = 0; i < MLEN; i++) mi[i] = fgetc(urandom);
printf("keypair\n"); printf("keypair\n");
xmss_keypair(pk, sk, state, params); xmss_keypair(pk, sk, state, params);
// check pub_seed in SK // check pub_seed in SK
for(i=0;i<n;i++) for (i = 0; i < n; i++) {
{ if (pk[n+i] != sk[4+m+n+i]) printf("pk.pub_seed != sk.pub_seed %llu",i);
if(pk[n+i] != sk[4+m+n+i]) printf("pk.pub_seed != sk.pub_seed %llu",i);
} }
// check index // check index
unsigned long idx = ((unsigned long)sk[0] << 24) | ((unsigned long)sk[1] << 16) | ((unsigned long)sk[2] << 8) | sk[3]; unsigned long idx = ((unsigned long)sk[0] << 24) | ((unsigned long)sk[1] << 16) | ((unsigned long)sk[2] << 8) | sk[3];
if(idx) printf("\nidx != 0 %lu\n",idx); if (idx) printf("\nidx != 0 %lu\n",idx);
for(i=0;i<((1<<h));i++){ for (i = 0; i < SIGNATURES; i++) {
printf("sign\n"); printf("sign\n");
xmss_sign(sk, state, sm, &smlen, mi, MLEN, params); xmss_sign(sk, state, sm, &smlen, mi, MLEN, params);
idx = ((unsigned long)sm[0] << 24) | ((unsigned long)sm[1] << 16) | ((unsigned long)sm[2] << 8) | sm[3]; idx = ((unsigned long)sm[0] << 24) | ((unsigned long)sm[1] << 16) | ((unsigned long)sm[2] << 8) | sm[3];
@ -79,7 +76,7 @@ int main()
printf("verify\n"); printf("verify\n");
r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params); r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params);
printf("%d\n", r); printf("%d\n", r);
if(r != 0) errors++; if (r != 0) errors++;
r = memcmp(mi,mo,MLEN); r = memcmp(mi,mo,MLEN);
printf("%d\n", r); printf("%d\n", r);
printf("%llu\n", MLEN-mlen); printf("%llu\n", MLEN-mlen);
@ -88,7 +85,7 @@ int main()
sm[signature_length+10] ^= 1; sm[signature_length+10] ^= 1;
r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params); r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params);
printf("%d\n", r+1); printf("%d\n", r+1);
if(r == 0) errors++; if (r == 0) errors++;
r = memcmp(mi,mo,MLEN); r = memcmp(mi,mo,MLEN);
printf("%d\n", (r!=0) - 1); printf("%d\n", (r!=0) - 1);
printf("%llu\n", mlen+1); printf("%llu\n", mlen+1);
@ -99,7 +96,7 @@ int main()
sm[2] ^= 1; sm[2] ^= 1;
r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params); r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params);
printf("%d\n", r+1); printf("%d\n", r+1);
if(r == 0) errors++; if (r == 0) errors++;
r = memcmp(mi,mo,MLEN); r = memcmp(mi,mo,MLEN);
printf("%d\n", (r!=0) - 1); printf("%d\n", (r!=0) - 1);
printf("%llu\n", mlen+1); printf("%llu\n", mlen+1);
@ -109,7 +106,7 @@ int main()
sm[5] ^= 1; sm[5] ^= 1;
r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params); r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params);
printf("%d\n", r+1); printf("%d\n", r+1);
if(r == 0) errors++; if (r == 0) errors++;
r = memcmp(mi,mo,MLEN); r = memcmp(mi,mo,MLEN);
printf("%d\n", (r!=0) - 1); printf("%d\n", (r!=0) - 1);
printf("%llu\n", mlen+1); printf("%llu\n", mlen+1);
@ -119,7 +116,7 @@ int main()
sm[240] ^= 1; sm[240] ^= 1;
r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params); r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params);
printf("%d\n", r+1); printf("%d\n", r+1);
if(r == 0) errors++; if (r == 0) errors++;
r = memcmp(mi,mo,MLEN); r = memcmp(mi,mo,MLEN);
printf("%d\n", (r!=0) - 1); printf("%d\n", (r!=0) - 1);
printf("%llu\n", mlen+1); printf("%llu\n", mlen+1);
@ -129,7 +126,7 @@ int main()
sm[signature_length - 10] ^= 1; sm[signature_length - 10] ^= 1;
r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params); r = xmss_sign_open(mo, &mlen, sm, smlen, pk, params);
printf("%d\n", r+1); printf("%d\n", r+1);
if(r == 0) errors++; if (r == 0) errors++;
r = memcmp(mi,mo,MLEN); r = memcmp(mi,mo,MLEN);
printf("%d\n", (r!=0) - 1); printf("%d\n", (r!=0) - 1);
printf("%llu\n", mlen+1); printf("%llu\n", mlen+1);
@ -141,5 +138,3 @@ int main()
printf("closed urandom\n"); printf("closed urandom\n");
return 0; return 0;
} }

27
test/test_xmssmt.c
View File

@ -6,7 +6,6 @@
#define MLEN 3491 #define MLEN 3491
#define SIGNATURES 1024 #define SIGNATURES 1024
unsigned char mi[MLEN]; unsigned char mi[MLEN];
unsigned long long smlen; unsigned long long smlen;
unsigned long long mlen; unsigned long long mlen;
@ -15,11 +14,11 @@ int main()
{ {
int r; int r;
unsigned long long i,j; unsigned long long i,j;
int m = 32; unsigned int m = 32;
int n = 32; unsigned int n = 32;
int h = 20; unsigned int h = 20;
int d = 5; unsigned int d = 5;
int w = 16; unsigned int w = 16;
xmssmt_params p; xmssmt_params p;
xmssmt_params *params = &p; xmssmt_params *params = &p;
@ -33,31 +32,30 @@ int main()
unsigned char sm[MLEN+signature_length]; unsigned char sm[MLEN+signature_length];
FILE *urandom = fopen("/dev/urandom", "r"); FILE *urandom = fopen("/dev/urandom", "r");
for(i=0;i<MLEN;i++) mi[i] = fgetc(urandom); for (i = 0; i < MLEN; i++) mi[i] = fgetc(urandom);
printf("keypair\n"); printf("keypair\n");
xmssmt_keypair(pk, sk, params); xmssmt_keypair(pk, sk, params);
// check pub_seed in SK // check pub_seed in SK
for(i=0;i<n;i++) for (i = 0; i < n; i++) {
{ if (pk[n+i] != sk[params->index_len+m+n+i]) printf("pk.pub_seed != sk.pub_seed %llu",i);
if(pk[n+i] != sk[params->index_len+m+n+i]) printf("pk.pub_seed != sk.pub_seed %llu",i);
} }
printf("pk checked\n"); printf("pk checked\n");
unsigned int idx_len = params->index_len; unsigned int idx_len = params->index_len;
// check index // check index
unsigned long long idx = 0; unsigned long long idx = 0;
for(i = 0; i < idx_len; i++){ for (i = 0; i < idx_len; i++) {
idx |= ((unsigned long long)sk[i]) << 8*(idx_len - 1 - i); idx |= ((unsigned long long)sk[i]) << 8*(idx_len - 1 - i);
} }
if(idx) printf("\nidx != 0: %llu\n",idx); if (idx) printf("\nidx != 0: %llu\n",idx);
for(i=0;i<(1<<h);i++){ for (i = 0; i < SIGNATURES; i++) {
printf("sign\n"); printf("sign\n");
xmssmt_sign(sk, sm, &smlen, mi, MLEN, params); xmssmt_sign(sk, sm, &smlen, mi, MLEN, params);
idx = 0; idx = 0;
for(j = 0; j < idx_len; j++){ for (j = 0; j < idx_len; j++) {
idx += ((unsigned long long)sm[j]) << 8*(idx_len - 1 - j); idx += ((unsigned long long)sm[j]) << 8*(idx_len - 1 - j);
} }
printf("\nidx = %llu\n",idx); printf("\nidx = %llu\n",idx);
@ -89,7 +87,6 @@ int main()
r = memcmp(mi,mo,MLEN); r = memcmp(mi,mo,MLEN);
printf("%d\n", (r!=0) - 1); printf("%d\n", (r!=0) - 1);
printf("%llu\n", mlen+1); printf("%llu\n", mlen+1);
} }
fclose(urandom); fclose(urandom);
return 0; return 0;

30
test/test_xmssmt_fast.c
View File

@ -6,7 +6,6 @@
#define MLEN 3491 #define MLEN 3491
#define SIGNATURES 4096 #define SIGNATURES 4096
unsigned char mi[MLEN]; unsigned char mi[MLEN];
unsigned long long smlen; unsigned long long smlen;
unsigned long long mlen; unsigned long long mlen;
@ -15,12 +14,12 @@ int main()
{ {
int r; int r;
unsigned long long i,j; unsigned long long i,j;
int m = 32; unsigned int m = 32;
int n = 32; unsigned int n = 32;
int h = 12; unsigned int h = 12;
int d = 2; unsigned int d = 3;
int w = 16; unsigned int w = 16;
int k = 2; unsigned int k = 2;
xmssmt_params p; xmssmt_params p;
xmssmt_params *params = &p; xmssmt_params *params = &p;
@ -43,7 +42,7 @@ int main()
bds_state states[2*d-1]; bds_state states[2*d-1];
for (i = 0; i < 2*d-1; i++) { for (i = 0; i < 2*d-1; i++) {
for(j=0;j<tree_h-k;j++) for (j = 0; j < tree_h-k; j++)
treehash[i*(tree_h-k) + j].node = th_nodes + (i*(tree_h-k) + j) * n; treehash[i*(tree_h-k) + j].node = th_nodes + (i*(tree_h-k) + j) * n;
xmss_set_bds_state(states + i, xmss_set_bds_state(states + i,
stack + i*(tree_h + 1)*n, 0, stacklevels + i*(tree_h + 1), stack + i*(tree_h + 1)*n, 0, stacklevels + i*(tree_h + 1),
@ -63,32 +62,31 @@ int main()
unsigned char sm[MLEN+signature_length]; unsigned char sm[MLEN+signature_length];
FILE *urandom = fopen("/dev/urandom", "r"); FILE *urandom = fopen("/dev/urandom", "r");
for(i=0;i<MLEN;i++) mi[i] = fgetc(urandom); for (i = 0; i < MLEN; i++) mi[i] = fgetc(urandom);
printf("keypair\n"); printf("keypair\n");
xmssmt_keypair(pk, sk, states, wots_sigs, params); xmssmt_keypair(pk, sk, states, wots_sigs, params);
// check pub_seed in SK // check pub_seed in SK
for(i=0;i<n;i++) for (i = 0; i < n; i++) {
{ if (pk[n+i] != sk[params->index_len+m+n+i]) printf("pk.pub_seed != sk.pub_seed %llu",i);
if(pk[n+i] != sk[params->index_len+m+n+i]) printf("pk.pub_seed != sk.pub_seed %llu",i);
} }
printf("pk checked\n"); printf("pk checked\n");
unsigned int idx_len = params->index_len; unsigned int idx_len = params->index_len;
// check index // check index
unsigned long long idx = 0; unsigned long long idx = 0;
for(i = 0; i < idx_len; i++){ for (i = 0; i < idx_len; i++) {
idx |= ((unsigned long long)sk[i]) << 8*(idx_len - 1 - i); idx |= ((unsigned long long)sk[i]) << 8*(idx_len - 1 - i);
} }
if(idx) printf("\nidx != 0: %llu\n",idx); if (idx) printf("\nidx != 0: %llu\n",idx);
for(i=0;i<SIGNATURES;i++){ for (i = 0; i < SIGNATURES; i++) {
printf("sign\n"); printf("sign\n");
xmssmt_sign(sk, states, wots_sigs, sm, &smlen, mi, MLEN, params); xmssmt_sign(sk, states, wots_sigs, sm, &smlen, mi, MLEN, params);
idx = 0; idx = 0;
for(j = 0; j < idx_len; j++){ for (j = 0; j < idx_len; j++) {
idx += ((unsigned long long)sm[j]) << 8*(idx_len - 1 - j); idx += ((unsigned long long)sm[j]) << 8*(idx_len - 1 - j);
} }
printf("\nidx = %llu\n",idx); printf("\nidx = %llu\n",idx);

83
wots.c
View File

@ -40,7 +40,7 @@ void wots_set_params(wots_params *params, int m, int n, int w)
/** /**
* Helper method for pseudorandom key generation * Helper method for pseudorandom key generation
* Expands a 32 byte array into a len*n byte array * Expands an n-byte array into a len*n byte array
* this is done using chacha20 with nonce 0 and counter 0 * this is done using chacha20 with nonce 0 and counter 0
*/ */
static void expand_seed(unsigned char *outseeds, const unsigned char *inseed, const wots_params *params) static void expand_seed(unsigned char *outseeds, const unsigned char *inseed, const wots_params *params)
@ -55,18 +55,15 @@ static void expand_seed(unsigned char *outseeds, const unsigned char *inseed, co
* interpretes in as start-th value of the chain * interpretes in as start-th value of the chain
* addr has to contain the address of the chain * addr has to contain the address of the chain
*/ */
static void gen_chain(unsigned char *out, const unsigned char *in, int start, int steps, const wots_params *params, const unsigned char *pub_seed, unsigned char addr[16]) static void gen_chain(unsigned char *out, const unsigned char *in, unsigned int start, unsigned int steps, const wots_params *params, const unsigned char *pub_seed, unsigned char addr[16])
{ {
unsigned int i,j; unsigned int i, j;
for(j=0;j<params->n;j++) for (j = 0; j < params->n; j++)
out[j] = in[j]; out[j] = in[j];
for(i=start;i<(start+steps) && i<params->w;i++){ for (i = start; i < (start+steps) && i < params->w; i++) {
SET_HASH_ADDRESS(addr,i); SET_HASH_ADDRESS(addr, i);
// printf("Hash %d:",i); hash_n_n(out, out, pub_seed, addr, params->n);
// hexdump(addr,16);
// printf("\n");
hash_n_n(out,out, pub_seed, addr,params->n);
} }
} }
@ -83,9 +80,8 @@ static void base_w(int *output, const unsigned char *input, int in_len, const wo
int bits = 0; int bits = 0;
int consumed = 0; int consumed = 0;
for(consumed = 0; consumed < 8 * in_len; consumed += params->log_w) for (consumed = 0; consumed < 8 * in_len; consumed += params->log_w) {
{ if (bits == 0) {
if(bits == 0){
total = input[in_len - 1 - in]; total = input[in_len - 1 - in];
in++; in++;
bits += 8; bits += 8;
@ -96,29 +92,13 @@ static void base_w(int *output, const unsigned char *input, int in_len, const wo
} }
} }
/**
* Alternative base w algorithm for w = 16 to check...
*/
static void base_w_alternative(int *output, unsigned char *input, int in_len, const wots_params *params)
{
unsigned int i = 0;
for(i = 0; i < in_len; i += 2)
{
output[i] = input[in_len - 1 - (i / 2)] >> 4;
output[i+1] = input[in_len - 1 - (i / 2)] & 0xf;
}
}
void wots_pkgen(unsigned char *pk, const unsigned char *sk, const wots_params *params, const unsigned char *pub_seed, unsigned char addr[16]) void wots_pkgen(unsigned char *pk, const unsigned char *sk, const wots_params *params, const unsigned char *pub_seed, unsigned char addr[16])
{ {
unsigned int i; unsigned int i;
expand_seed(pk, sk, params); expand_seed(pk, sk, params);
for(i=0;i<params->len;i++){ for (i=0; i < params->len; i++) {
SET_CHAIN_ADDRESS(addr,i); SET_CHAIN_ADDRESS(addr, i);
// printf("Chain: %d\n",i); gen_chain(pk+i*params->n, pk+i*params->n, 0, params->w-1, params, pub_seed, addr);
// hexdump(addr,16);
// printf("\n");
gen_chain(pk+i*params->n, pk+i*params->n, 0, params->w-1, params, pub_seed, addr);
} }
} }
@ -127,16 +107,15 @@ void wots_sign(unsigned char *sig, const unsigned char *msg, const unsigned char
{ {
int basew[params->len]; int basew[params->len];
int csum = 0; int csum = 0;
unsigned int i=0; unsigned int i = 0;
base_w(basew, msg, params->m, params); base_w(basew, msg, params->m, params);
for(i=0;i<params->len_1;i++) for (i=0; i < params->len_1; i++) {
{
csum += params->w - 1 - basew[i]; csum += params->w - 1 - basew[i];
} }
csum = csum << ( 8 - ( ( params->len_2 * params->log_w ) % 8 )); csum = csum << (8 - ((params->len_2 * params->log_w) % 8));
int len_2_bytes = ((params->len_2 * params->log_w) + 7) / 8; int len_2_bytes = ((params->len_2 * params->log_w) + 7) / 8;
@ -146,19 +125,15 @@ void wots_sign(unsigned char *sig, const unsigned char *msg, const unsigned char
int csum_basew[len_2_bytes / params->log_w]; int csum_basew[len_2_bytes / params->log_w];
base_w(csum_basew, csum_bytes, len_2_bytes, params); base_w(csum_basew, csum_bytes, len_2_bytes, params);
for(i = 0; i < params->len_2; i++) for (i = 0; i < params->len_2; i++) {
{
basew[params->len_1 + i] = csum_basew[i]; basew[params->len_1 + i] = csum_basew[i];
} }
expand_seed(sig, sk, params); expand_seed(sig, sk, params);
for(i=0;i<params->len;i++){ for (i = 0; i < params->len; i++) {
SET_CHAIN_ADDRESS(addr,i); SET_CHAIN_ADDRESS(addr, i);
// printf("Chain: %d\n",i); gen_chain(sig+i*params->n, sig+i*params->n, 0, basew[i], params, pub_seed, addr);
// hexdump(addr,16);
// printf("\n");
gen_chain(sig+i*params->n, sig+i*params->n, 0, basew[i], params, pub_seed, addr);
} }
} }
@ -166,16 +141,15 @@ void wots_pkFromSig(unsigned char *pk, const unsigned char *sig, const unsigned
{ {
int basew[params->len]; int basew[params->len];
int csum = 0; int csum = 0;
unsigned int i=0; unsigned int i = 0;
base_w(basew, msg, params->m, params); base_w(basew, msg, params->m, params);
for(i=0;i<params->len_1;i++) for (i=0; i < params->len_1; i++) {
{
csum += params->w - 1 - basew[i]; csum += params->w - 1 - basew[i];
} }
csum = csum << ( 8 - ( ( params->len_2 * params->log_w ) % 8 )); csum = csum << (8 - ((params->len_2 * params->log_w) % 8));
int len_2_bytes = ((params->len_2 * params->log_w) + 7) / 8; int len_2_bytes = ((params->len_2 * params->log_w) + 7) / 8;
@ -185,16 +159,11 @@ void wots_pkFromSig(unsigned char *pk, const unsigned char *sig, const unsigned
int csum_basew[len_2_bytes / params->log_w]; int csum_basew[len_2_bytes / params->log_w];
base_w(csum_basew, csum_bytes, len_2_bytes, params); base_w(csum_basew, csum_bytes, len_2_bytes, params);
for(i = 0; i < params->len_2; i++) for (i = 0; i < params->len_2; i++) {
{
basew[params->len_1 + i] = csum_basew[i]; basew[params->len_1 + i] = csum_basew[i];
} }
for (i=0; i < params->len; i++) {
for(i=0;i<params->len;i++){ SET_CHAIN_ADDRESS(addr, i);
SET_CHAIN_ADDRESS(addr,i); gen_chain(pk+i*params->n, sig+i*params->n, basew[i], params->w-1-basew[i], params, pub_seed, addr);
// printf("Chain: %d\n",i);
// hexdump(addr,16);
// printf("\n");
gen_chain(pk+i*params->n, sig+i*params->n, basew[i], params->w-1-basew[i], params, pub_seed, addr);
} }
} }

18
wots.h
View File

@ -12,15 +12,15 @@ Public domain.
* *
* Meaning as defined in draft-irtf-cfrg-xmss-hash-based-signatures-02 * Meaning as defined in draft-irtf-cfrg-xmss-hash-based-signatures-02
*/ */
typedef struct{ typedef struct {
int len_1; unsigned int len_1;
int len_2; unsigned int len_2;
int len; unsigned int len;
int m; unsigned int m;
int n; unsigned int n;
int w; unsigned int w;
int log_w; unsigned int log_w;
int keysize; unsigned int keysize;
} wots_params; } wots_params;
/** /**

205
xmss.c
View File

@ -115,7 +115,7 @@ void xmss_set_params(xmss_params *params, int m, int n, int h, int w)
*/ */
void xmssmt_set_params(xmssmt_params *params, int m, int n, int h, int d, int w) void xmssmt_set_params(xmssmt_params *params, int m, int n, int h, int d, int w)
{ {
if(h % d){ if (h % d) {
fprintf(stderr, "d must devide h without remainder!\n"); fprintf(stderr, "d must devide h without remainder!\n");
return; return;
} }
@ -140,36 +140,33 @@ static void l_tree(unsigned char *leaf, unsigned char *wots_pk, const xmss_param
unsigned int height = 0; unsigned int height = 0;
//ADRS.setTreeHeight(0); //ADRS.setTreeHeight(0);
SET_LTREE_TREE_HEIGHT(addr,height); SET_LTREE_TREE_HEIGHT(addr, height);
unsigned long bound; unsigned long bound;
while ( l > 1 ) while (l > 1) {
{
bound = l >> 1; //floor(l / 2); bound = l >> 1; //floor(l / 2);
for ( i = 0; i < bound; i = i + 1 ) { for (i = 0; i < bound; i++) {
//ADRS.setTreeIndex(i); //ADRS.setTreeIndex(i);
SET_LTREE_TREE_INDEX(addr,i); SET_LTREE_TREE_INDEX(addr, i);
//wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS); //wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS);
hash_2n_n(wots_pk+i*n,wots_pk+i*2*n, pub_seed, addr, n); hash_2n_n(wots_pk+i*n, wots_pk+i*2*n, pub_seed, addr, n);
} }
//if ( l % 2 == 1 ) { //if ( l % 2 == 1 ) {
if(l&1) if (l & 1) {
{
//pk[floor(l / 2) + 1] = pk[l]; //pk[floor(l / 2) + 1] = pk[l];
memcpy(wots_pk+(l>>1)*n,wots_pk+(l-1)*n, n); memcpy(wots_pk+(l>>1)*n, wots_pk+(l-1)*n, n);
//l = ceil(l / 2); //l = ceil(l / 2);
l=(l>>1)+1; l=(l>>1)+1;
} }
else else {
{
//l = ceil(l / 2); //l = ceil(l / 2);
l=(l>>1); l=(l>>1);
} }
//ADRS.setTreeHeight(ADRS.getTreeHeight() + 1); //ADRS.setTreeHeight(ADRS.getTreeHeight() + 1);
height++; height++;
SET_LTREE_TREE_HEIGHT(addr,height); SET_LTREE_TREE_HEIGHT(addr, height);
} }
//return pk[0]; //return pk[0];
memcpy(leaf,wots_pk,n); memcpy(leaf, wots_pk, n);
} }
/** /**
@ -209,31 +206,29 @@ static void treehash(unsigned char *node, int height, int index, const unsigned
SET_LTREE_BIT(node_addr, 0); SET_LTREE_BIT(node_addr, 0);
SET_NODE_PADDING(node_addr); SET_NODE_PADDING(node_addr);
int lastnode,i; unsigned int lastnode, i;
unsigned char stack[(height+1)*n]; unsigned char stack[(height+1)*n];
unsigned int stacklevels[height+1]; unsigned int stacklevels[height+1];
unsigned int stackoffset=0; unsigned int stackoffset=0;
lastnode = idx+(1<<height); lastnode = idx+(1 << height);
for(;idx<lastnode;idx++) for (; idx < lastnode; idx++) {
{ SET_LTREE_ADDRESS(ltree_addr, idx);
SET_LTREE_ADDRESS(ltree_addr,idx); SET_OTS_ADDRESS(ots_addr, idx);
SET_OTS_ADDRESS(ots_addr,idx); gen_leaf_wots(stack+stackoffset*n, sk_seed, params, pub_seed, ltree_addr, ots_addr);
gen_leaf_wots(stack+stackoffset*n,sk_seed,params, pub_seed, ltree_addr, ots_addr);
stacklevels[stackoffset] = 0; stacklevels[stackoffset] = 0;
stackoffset++; stackoffset++;
while(stackoffset>1 && stacklevels[stackoffset-1] == stacklevels[stackoffset-2]) while (stackoffset>1 && stacklevels[stackoffset-1] == stacklevels[stackoffset-2]) {
{ SET_NODE_TREE_HEIGHT(node_addr, stacklevels[stackoffset-1]);
SET_NODE_TREE_HEIGHT(node_addr,stacklevels[stackoffset-1]);
SET_NODE_TREE_INDEX(node_addr, (idx >> (stacklevels[stackoffset-1]+1))); SET_NODE_TREE_INDEX(node_addr, (idx >> (stacklevels[stackoffset-1]+1)));
hash_2n_n(stack+(stackoffset-2)*n,stack+(stackoffset-2)*n, pub_seed, hash_2n_n(stack+(stackoffset-2)*n, stack+(stackoffset-2)*n, pub_seed,
node_addr, n); node_addr, n);
stacklevels[stackoffset-2]++; stacklevels[stackoffset-2]++;
stackoffset--; stackoffset--;
} }
} }
for(i=0;i<n;i++) for (i=0; i < n; i++)
node[i] = stack[i]; node[i] = stack[i];
} }
@ -244,42 +239,37 @@ static void validate_authpath(unsigned char *root, const unsigned char *leaf, un
{ {
unsigned int n = params->n; unsigned int n = params->n;
int i,j; unsigned int i, j;
unsigned char buffer[2*n]; unsigned char buffer[2*n];
// If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left. // If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left.
// Otherwise, it is the other way around // Otherwise, it is the other way around
if(leafidx&1) if (leafidx & 1) {
{ for (j = 0; j < n; j++)
for(j=0;j<n;j++)
buffer[n+j] = leaf[j]; buffer[n+j] = leaf[j];
for(j=0;j<n;j++) for (j = 0; j < n; j++)
buffer[j] = authpath[j]; buffer[j] = authpath[j];
} }
else else {
{ for (j = 0; j < n; j++)
for(j=0;j<n;j++)
buffer[j] = leaf[j]; buffer[j] = leaf[j];
for(j=0;j<n;j++) for (j = 0; j < n; j++)
buffer[n+j] = authpath[j]; buffer[n+j] = authpath[j];
} }
authpath += n; authpath += n;
for(i=0;i<params->h-1;i++) for (i=0; i < params->h-1; i++) {
{ SET_NODE_TREE_HEIGHT(addr, i);
SET_NODE_TREE_HEIGHT(addr,i);
leafidx >>= 1; leafidx >>= 1;
SET_NODE_TREE_INDEX(addr, leafidx); SET_NODE_TREE_INDEX(addr, leafidx);
if(leafidx&1) if (leafidx&1) {
{ hash_2n_n(buffer+n, buffer, pub_seed, addr, n);
hash_2n_n(buffer+n,buffer,pub_seed, addr, n); for (j = 0; j < n; j++)
for(j=0;j<n;j++)
buffer[j] = authpath[j]; buffer[j] = authpath[j];
} }
else else {
{ hash_2n_n(buffer, buffer, pub_seed, addr, n);
hash_2n_n(buffer,buffer,pub_seed, addr, n); for (j = 0; j < n; j++)
for(j=0;j<n;j++)
buffer[j+n] = authpath[j]; buffer[j+n] = authpath[j];
} }
authpath += n; authpath += n;
@ -287,7 +277,7 @@ static void validate_authpath(unsigned char *root, const unsigned char *leaf, un
SET_NODE_TREE_HEIGHT(addr, (params->h-1)); SET_NODE_TREE_HEIGHT(addr, (params->h-1));
leafidx >>= 1; leafidx >>= 1;
SET_NODE_TREE_INDEX(addr, leafidx); SET_NODE_TREE_INDEX(addr, leafidx);
hash_2n_n(root,buffer,pub_seed,addr,n); hash_2n_n(root, buffer, pub_seed, addr, n);
} }
/** /**
@ -298,8 +288,8 @@ static void validate_authpath(unsigned char *root, const unsigned char *leaf, un
static void compute_authpath_wots(unsigned char *root, unsigned char *authpath, unsigned long leaf_idx, const unsigned char *sk_seed, const xmss_params *params, unsigned char *pub_seed, unsigned char addr[16]) static void compute_authpath_wots(unsigned char *root, unsigned char *authpath, unsigned long leaf_idx, const unsigned char *sk_seed, const xmss_params *params, unsigned char *pub_seed, unsigned char addr[16])
{ {
unsigned int i, j, level; unsigned int i, j, level;
int n = params->n; unsigned int n = params->n;
int h = params->h; unsigned int h = params->h;
unsigned char tree[2*(1<<h)*n]; unsigned char tree[2*(1<<h)*n];
@ -318,10 +308,9 @@ static void compute_authpath_wots(unsigned char *root, unsigned char *authpath,
// Compute all leaves // Compute all leaves
for(i = 0; i < (1<<h); i++) for (i = 0; i < (1U << h); i++) {
{ SET_LTREE_ADDRESS(ltree_addr, i);
SET_LTREE_ADDRESS(ltree_addr,i); SET_OTS_ADDRESS(ots_addr, i);
SET_OTS_ADDRESS(ots_addr,i);
gen_leaf_wots(tree+((1<<h)*n + i*n), sk_seed, params, pub_seed, ltree_addr, ots_addr); gen_leaf_wots(tree+((1<<h)*n + i*n), sk_seed, params, pub_seed, ltree_addr, ots_addr);
} }
@ -329,12 +318,10 @@ static void compute_authpath_wots(unsigned char *root, unsigned char *authpath,
level = 0; level = 0;
// Compute tree: // Compute tree:
// Outer loop: For each inner layer // Outer loop: For each inner layer
for (i = (1<<h); i > 1; i>>=1) for (i = (1<<h); i > 1; i>>=1) {
{
SET_NODE_TREE_HEIGHT(node_addr, level); SET_NODE_TREE_HEIGHT(node_addr, level);
// Inner loop: for each pair of sibling nodes // Inner loop: for each pair of sibling nodes
for (j = 0; j < i; j+=2) for (j = 0; j < i; j+=2) {
{
SET_NODE_TREE_INDEX(node_addr, j>>1); SET_NODE_TREE_INDEX(node_addr, j>>1);
hash_2n_n(tree + (i>>1)*n + (j>>1) * n, tree + i*n + j*n, pub_seed, node_addr, n); hash_2n_n(tree + (i>>1)*n + (j>>1) * n, tree + i*n + j*n, pub_seed, node_addr, n);
} }
@ -342,7 +329,7 @@ static void compute_authpath_wots(unsigned char *root, unsigned char *authpath,
} }
// copy authpath // copy authpath
for(i=0;i<h;i++) for (i=0; i < h; i++)
memcpy(authpath + i*n, tree + ((1<<h)>>i)*n + ((leaf_idx >> i) ^ 1) * n, n); memcpy(authpath + i*n, tree + ((1<<h)>>i)*n + ((leaf_idx >> i) ^ 1) * n, n);
// copy root // copy root
@ -365,11 +352,11 @@ int xmss_keypair(unsigned char *pk, unsigned char *sk, xmss_params *params)
sk[2] = 0; sk[2] = 0;
sk[3] = 0; sk[3] = 0;
// Init SK_SEED (n byte), SK_PRF (m byte), and PUB_SEED (n byte) // Init SK_SEED (n byte), SK_PRF (m byte), and PUB_SEED (n byte)
randombytes(sk+4,2*n+m); randombytes(sk+4, 2*n+m);
// Copy PUB_SEED to public key // Copy PUB_SEED to public key
memcpy(pk+n, sk+4+n+m,n); memcpy(pk+n, sk+4+n+m, n);
unsigned char addr[16] = {0,0,0,0}; unsigned char addr[16] = {0, 0, 0, 0};
// Compute root // Compute root
treehash(pk, params->h, 0, sk+4, params, sk+4+n+m, addr); treehash(pk, params->h, 0, sk+4, params, sk+4+n+m, addr);
return 0; return 0;
@ -390,11 +377,11 @@ int xmss_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *sig
// Extract SK // Extract SK
unsigned long idx = ((unsigned long)sk[0] << 24) | ((unsigned long)sk[1] << 16) | ((unsigned long)sk[2] << 8) | sk[3]; unsigned long idx = ((unsigned long)sk[0] << 24) | ((unsigned long)sk[1] << 16) | ((unsigned long)sk[2] << 8) | sk[3];
unsigned char sk_seed[n]; unsigned char sk_seed[n];
memcpy(sk_seed,sk+4,n); memcpy(sk_seed, sk+4, n);
unsigned char sk_prf[m]; unsigned char sk_prf[m];
memcpy(sk_prf,sk+4+n,m); memcpy(sk_prf, sk+4+n, m);
unsigned char pub_seed[n]; unsigned char pub_seed[n];
memcpy(pub_seed,sk+4+n+m,n); memcpy(pub_seed, sk+4+n+m, n);
// Update SK // Update SK
sk[0] = ((idx + 1) >> 24) & 255; sk[0] = ((idx + 1) >> 24) & 255;
@ -410,7 +397,7 @@ int xmss_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *sig
unsigned char msg_h[m]; unsigned char msg_h[m];
unsigned char root[n]; unsigned char root[n];
unsigned char ots_seed[n]; unsigned char ots_seed[n];
unsigned char ots_addr[16] = {0,0,0,0}; unsigned char ots_addr[16] = {0, 0, 0, 0};
// --------------------------------- // ---------------------------------
// Message Hashing // Message Hashing
@ -435,7 +422,7 @@ int xmss_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *sig
*sig_msg_len += 4; *sig_msg_len += 4;
// Copy R to signature // Copy R to signature
for(i=0; i<m; i++) for (i = 0; i < m; i++)
sig_msg[i] = R[i]; sig_msg[i] = R[i];
sig_msg += m; sig_msg += m;
@ -446,8 +433,8 @@ int xmss_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *sig
// ---------------------------------- // ----------------------------------
// Prepare Address // Prepare Address
SET_OTS_BIT(ots_addr,1); SET_OTS_BIT(ots_addr, 1);
SET_OTS_ADDRESS(ots_addr,idx); SET_OTS_ADDRESS(ots_addr, idx);
// Compute seed for OTS key pair // Compute seed for OTS key pair
get_seed(ots_seed, sk_seed, n, ots_addr); get_seed(ots_seed, sk_seed, n, ots_addr);
@ -465,7 +452,7 @@ int xmss_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *sig
//Whipe secret elements? //Whipe secret elements?
//zerobytes(tsk, CRYPTO_SECRETKEYBYTES); //zerobytes(tsk, CRYPTO_SECRETKEYBYTES);
memcpy(sig_msg,msg,msglen); memcpy(sig_msg, msg, msglen);
*sig_msg_len += msglen; *sig_msg_len += msglen;
return 0; return 0;
@ -487,10 +474,10 @@ int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigne
unsigned char msg_h[m]; unsigned char msg_h[m];
unsigned char pub_seed[n]; unsigned char pub_seed[n];
memcpy(pub_seed,pk+n,n); memcpy(pub_seed, pk+n, n);
// Init addresses // Init addresses
unsigned char ots_addr[16] = {0,0,0,0}; unsigned char ots_addr[16] = {0, 0, 0, 0};
unsigned char ltree_addr[16]; unsigned char ltree_addr[16];
unsigned char node_addr[16]; unsigned char node_addr[16];
@ -506,7 +493,7 @@ int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigne
// Extract index // Extract index
idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3]; idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3];
printf("verify:: idx = %lu\n",idx); printf("verify:: idx = %lu\n", idx);
sig_msg += 4; sig_msg += 4;
sig_msg_len -= 4; sig_msg_len -= 4;
@ -523,7 +510,7 @@ int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigne
//----------------------- //-----------------------
// Prepare Address // Prepare Address
SET_OTS_ADDRESS(ots_addr,idx); SET_OTS_ADDRESS(ots_addr, idx);
// Check WOTS signature // Check WOTS signature
wots_pkFromSig(wots_pk, sig_msg, msg_h, &(params->wots_par), pub_seed, ots_addr); wots_pkFromSig(wots_pk, sig_msg, msg_h, &(params->wots_par), pub_seed, ots_addr);
@ -540,12 +527,12 @@ int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigne
sig_msg += params->h*n; sig_msg += params->h*n;
sig_msg_len -= params->h*n; sig_msg_len -= params->h*n;
for(i=0;i<n;i++) for (i=0; i < n; i++)
if(root[i] != pk[i]) if (root[i] != pk[i])
goto fail; goto fail;
*msglen = sig_msg_len; *msglen = sig_msg_len;
for(i=0;i<*msglen;i++) for (i=0; i < *msglen; i++)
msg[i] = sig_msg[i]; msg[i] = sig_msg[i];
return 0; return 0;
@ -553,7 +540,7 @@ int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigne
fail: fail:
*msglen = sig_msg_len; *msglen = sig_msg_len;
for(i=0;i<*msglen;i++) for (i=0; i < *msglen; i++)
msg[i] = 0; msg[i] = 0;
*msglen = -1; *msglen = -1;
return -1; return -1;
@ -570,16 +557,16 @@ int xmssmt_keypair(unsigned char *pk, unsigned char *sk, xmssmt_params *params)
unsigned int m = params->m; unsigned int m = params->m;
unsigned int i; unsigned int i;
// Set idx = 0 // Set idx = 0
for (i = 0; i < params->index_len; i++){ for (i = 0; i < params->index_len; i++) {
sk[i] = 0; sk[i] = 0;
} }
// Init SK_SEED (n byte), SK_PRF (m byte), and PUB_SEED (n byte) // Init SK_SEED (n byte), SK_PRF (m byte), and PUB_SEED (n byte)
randombytes(sk+params->index_len,2*n+m); randombytes(sk+params->index_len, 2*n+m);
// Copy PUB_SEED to public key // Copy PUB_SEED to public key
memcpy(pk+n, sk+params->index_len+n+m,n); memcpy(pk+n, sk+params->index_len+n+m, n);
// Set address to point on the single tree on layer d-1 // Set address to point on the single tree on layer d-1
unsigned char addr[16] = {0,0,0,0}; unsigned char addr[16] = {0, 0, 0, 0};
SET_LAYER_ADDRESS(addr, (params->d-1)); SET_LAYER_ADDRESS(addr, (params->d-1));
// Compute root // Compute root
@ -612,20 +599,20 @@ int xmssmt_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *s
unsigned char msg_h[m]; unsigned char msg_h[m];
unsigned char root[n]; unsigned char root[n];
unsigned char ots_seed[n]; unsigned char ots_seed[n];
unsigned char ots_addr[16] = {0,0,0,0}; unsigned char ots_addr[16] = {0, 0, 0, 0};
// Extract SK // Extract SK
unsigned long long idx = 0; unsigned long long idx = 0;
for(i = 0; i < idx_len; i++){ for (i = 0; i < idx_len; i++) {
idx |= ((unsigned long long)sk[i]) << 8*(idx_len - 1 - i); idx |= ((unsigned long long)sk[i]) << 8*(idx_len - 1 - i);
} }
memcpy(sk_seed,sk+idx_len,n); memcpy(sk_seed, sk+idx_len, n);
memcpy(sk_prf,sk+idx_len+n,m); memcpy(sk_prf, sk+idx_len+n, m);
memcpy(pub_seed,sk+idx_len+n+m,n); memcpy(pub_seed, sk+idx_len+n+m, n);
// Update SK // Update SK
for(i = 0; i < idx_len; i++){ for (i = 0; i < idx_len; i++) {
sk[i] = ((idx + 1) >> 8*(idx_len - 1 - i)) & 255; sk[i] = ((idx + 1) >> 8*(idx_len - 1 - i)) & 255;
} }
// -- Secret key for this non-forward-secure version is now updated. // -- Secret key for this non-forward-secure version is now updated.
@ -646,7 +633,7 @@ int xmssmt_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *s
*sig_msg_len = 0; *sig_msg_len = 0;
// Copy index to signature // Copy index to signature
for(i = 0; i < idx_len; i++){ for (i = 0; i < idx_len; i++) {
sig_msg[i] = (idx >> 8*(idx_len - 1 - i)) & 255; sig_msg[i] = (idx >> 8*(idx_len - 1 - i)) & 255;
} }
@ -654,7 +641,7 @@ int xmssmt_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *s
*sig_msg_len += idx_len; *sig_msg_len += idx_len;
// Copy R to signature // Copy R to signature
for(i=0; i<m; i++) for (i=0; i < m; i++)
sig_msg[i] = R[i]; sig_msg[i] = R[i];
sig_msg += m; sig_msg += m;
@ -667,10 +654,10 @@ int xmssmt_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *s
// Handle lowest layer separately as it is slightly different... // Handle lowest layer separately as it is slightly different...
// Prepare Address // Prepare Address
SET_OTS_BIT(ots_addr,1); SET_OTS_BIT(ots_addr, 1);
idx_tree = idx >> tree_h; idx_tree = idx >> tree_h;
idx_leaf = (idx & ((1 << tree_h)-1)); idx_leaf = (idx & ((1 << tree_h)-1));
SET_LAYER_ADDRESS(ots_addr,0); SET_LAYER_ADDRESS(ots_addr, 0);
SET_TREE_ADDRESS(ots_addr, idx_tree); SET_TREE_ADDRESS(ots_addr, idx_tree);
SET_OTS_ADDRESS(ots_addr, idx_leaf); SET_OTS_ADDRESS(ots_addr, idx_leaf);
@ -689,11 +676,11 @@ int xmssmt_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *s
// Now loop over remaining layers... // Now loop over remaining layers...
unsigned int j; unsigned int j;
for(j = 1; j < params->d; j++){ for (j = 1; j < params->d; j++) {
// Prepare Address // Prepare Address
idx_leaf = (idx_tree & ((1 << tree_h)-1)); idx_leaf = (idx_tree & ((1 << tree_h)-1));
idx_tree = idx_tree >> tree_h; idx_tree = idx_tree >> tree_h;
SET_LAYER_ADDRESS(ots_addr,j); SET_LAYER_ADDRESS(ots_addr, j);
SET_TREE_ADDRESS(ots_addr, idx_tree); SET_TREE_ADDRESS(ots_addr, idx_tree);
SET_OTS_ADDRESS(ots_addr, idx_leaf); SET_OTS_ADDRESS(ots_addr, idx_leaf);
@ -714,7 +701,7 @@ int xmssmt_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *s
//Whipe secret elements? //Whipe secret elements?
//zerobytes(tsk, CRYPTO_SECRETKEYBYTES); //zerobytes(tsk, CRYPTO_SECRETKEYBYTES);
memcpy(sig_msg,msg,msglen); memcpy(sig_msg, msg, msglen);
*sig_msg_len += msglen; *sig_msg_len += msglen;
return 0; return 0;
@ -741,18 +728,18 @@ int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsig
unsigned char msg_h[m]; unsigned char msg_h[m];
unsigned char pub_seed[n]; unsigned char pub_seed[n];
memcpy(pub_seed,pk+n,n); memcpy(pub_seed, pk+n, n);
// Init addresses // Init addresses
unsigned char ots_addr[16] = {0,0,0,0}; unsigned char ots_addr[16] = {0, 0, 0, 0};
unsigned char ltree_addr[16]; unsigned char ltree_addr[16];
unsigned char node_addr[16]; unsigned char node_addr[16];
// Extract index // Extract index
for(i = 0; i < idx_len; i++){ for (i = 0; i < idx_len; i++) {
idx |= ((unsigned long long)sig_msg[i]) << (8*(idx_len - 1 - i)); idx |= ((unsigned long long)sig_msg[i]) << (8*(idx_len - 1 - i));
} }
printf("verify:: idx = %llu\n",idx); printf("verify:: idx = %llu\n", idx);
sig_msg += idx_len; sig_msg += idx_len;
sig_msg_len -= idx_len; sig_msg_len -= idx_len;
@ -771,7 +758,7 @@ int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsig
// Prepare Address // Prepare Address
idx_tree = idx >> tree_h; idx_tree = idx >> tree_h;
idx_leaf = (idx & ((1 << tree_h)-1)); idx_leaf = (idx & ((1 << tree_h)-1));
SET_LAYER_ADDRESS(ots_addr,0); SET_LAYER_ADDRESS(ots_addr, 0);
SET_TREE_ADDRESS(ots_addr, idx_tree); SET_TREE_ADDRESS(ots_addr, idx_tree);
SET_OTS_BIT(ots_addr, 1); SET_OTS_BIT(ots_addr, 1);
@ -783,7 +770,7 @@ int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsig
SET_LTREE_BIT(node_addr, 0); SET_LTREE_BIT(node_addr, 0);
SET_NODE_PADDING(node_addr); SET_NODE_PADDING(node_addr);
SET_OTS_ADDRESS(ots_addr,idx_leaf); SET_OTS_ADDRESS(ots_addr, idx_leaf);
// Check WOTS signature // Check WOTS signature
wots_pkFromSig(wots_pk, sig_msg, msg_h, &(params->xmss_par.wots_par), pub_seed, ots_addr); wots_pkFromSig(wots_pk, sig_msg, msg_h, &(params->xmss_par.wots_par), pub_seed, ots_addr);
@ -801,12 +788,12 @@ int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsig
sig_msg += tree_h*n; sig_msg += tree_h*n;
sig_msg_len -= tree_h*n; sig_msg_len -= tree_h*n;
for(i = 1; i < params->d; i++){ for (i = 1; i < params->d; i++) {
// Prepare Address // Prepare Address
idx_leaf = (idx_tree & ((1 << tree_h)-1)); idx_leaf = (idx_tree & ((1 << tree_h)-1));
idx_tree = idx_tree >> tree_h; idx_tree = idx_tree >> tree_h;
SET_LAYER_ADDRESS(ots_addr,i); SET_LAYER_ADDRESS(ots_addr, i);
SET_TREE_ADDRESS(ots_addr, idx_tree); SET_TREE_ADDRESS(ots_addr, idx_tree);
SET_OTS_BIT(ots_addr, 1); SET_OTS_BIT(ots_addr, 1);
@ -818,7 +805,7 @@ int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsig
SET_LTREE_BIT(node_addr, 0); SET_LTREE_BIT(node_addr, 0);
SET_NODE_PADDING(node_addr); SET_NODE_PADDING(node_addr);
SET_OTS_ADDRESS(ots_addr,idx_leaf); SET_OTS_ADDRESS(ots_addr, idx_leaf);
// Check WOTS signature // Check WOTS signature
wots_pkFromSig(wots_pk, sig_msg, root, &(params->xmss_par.wots_par), pub_seed, ots_addr); wots_pkFromSig(wots_pk, sig_msg, root, &(params->xmss_par.wots_par), pub_seed, ots_addr);
@ -838,12 +825,12 @@ int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsig
} }
for(i=0;i<n;i++) for (i=0; i < n; i++)
if(root[i] != pk[i]) if (root[i] != pk[i])
goto fail; goto fail;
*msglen = sig_msg_len; *msglen = sig_msg_len;
for(i=0;i<*msglen;i++) for (i=0; i < *msglen; i++)
msg[i] = sig_msg[i]; msg[i] = sig_msg[i];
return 0; return 0;
@ -851,7 +838,7 @@ int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsig
fail: fail:
*msglen = sig_msg_len; *msglen = sig_msg_len;
for(i=0;i<*msglen;i++) for (i=0; i < *msglen; i++)
msg[i] = 0; msg[i] = 0;
*msglen = -1; *msglen = -1;
return -1; return -1;

20
xmss.h
View File

@ -9,25 +9,25 @@ Public domain.
#ifndef XMSS_H #ifndef XMSS_H
#define XMSS_H #define XMSS_H
typedef struct{ typedef struct{
int level; unsigned int level;
unsigned long long subtree; unsigned long long subtree;
int subleaf; unsigned int subleaf;
} leafaddr; } leafaddr;
typedef struct{ typedef struct{
wots_params wots_par; wots_params wots_par;
int n; unsigned int n;
int m; unsigned int m;
int h; unsigned int h;
} xmss_params; } xmss_params;
typedef struct{ typedef struct{
xmss_params xmss_par; xmss_params xmss_par;
int n; unsigned int n;
int m; unsigned int m;
int h; unsigned int h;
int d; unsigned int d;
int index_len; unsigned int index_len;
} xmssmt_params; } xmssmt_params;
/** /**
* Initializes parameter set. * Initializes parameter set.

2
xmss_commons.c
View File

@ -11,7 +11,7 @@ Public domain.
void to_byte(unsigned char *out, unsigned int in, int bytes) void to_byte(unsigned char *out, unsigned int in, int bytes)
{ {
int i; int i;
for(i = 0; i < bytes; i++){ for (i = 0; i < bytes; i++) {
out[i] = in & 0xff; out[i] = in & 0xff;
in = in >> 8; in = in >> 8;
} }

230
xmss_fast.c
View File

@ -99,7 +99,7 @@ static void get_seed(unsigned char *seed, const unsigned char *sk_seed, int n, u
*/ */
int xmss_set_params(xmss_params *params, int m, int n, int h, int w, int k) int xmss_set_params(xmss_params *params, int m, int n, int h, int w, int k)
{ {
if(k >= h || k < 2 || (h - k) % 2){ if (k >= h || k < 2 || (h - k) % 2) {
fprintf(stderr, "For BDS traversal, H - K must be even, with H > K >= 2!\n"); fprintf(stderr, "For BDS traversal, H - K must be even, with H > K >= 2!\n");
return 1; return 1;
} }
@ -137,7 +137,7 @@ void xmss_set_bds_state(bds_state *state, unsigned char *stack, int stackoffset,
*/ */
int xmssmt_set_params(xmssmt_params *params, int m, int n, int h, int d, int w, int k) int xmssmt_set_params(xmssmt_params *params, int m, int n, int h, int d, int w, int k)
{ {
if(h % d){ if (h % d) {
fprintf(stderr, "d must divide h without remainder!\n"); fprintf(stderr, "d must divide h without remainder!\n");
return 1; return 1;
} }
@ -165,22 +165,20 @@ static void l_tree(unsigned char *leaf, unsigned char *wots_pk, const xmss_param
unsigned int height = 0; unsigned int height = 0;
//ADRS.setTreeHeight(0); //ADRS.setTreeHeight(0);
SET_LTREE_TREE_HEIGHT(addr,height); SET_LTREE_TREE_HEIGHT(addr, height);
unsigned long bound; unsigned long bound;
while ( l > 1 ) while (l > 1) {
{
bound = l >> 1; //floor(l / 2); bound = l >> 1; //floor(l / 2);
for ( i = 0; i < bound; i = i + 1 ) { for (i = 0; i < bound; i = i + 1) {
//ADRS.setTreeIndex(i); //ADRS.setTreeIndex(i);
SET_LTREE_TREE_INDEX(addr,i); SET_LTREE_TREE_INDEX(addr, i);
//wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS); //wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS);
hash_2n_n(wots_pk+i*n,wots_pk+i*2*n, pub_seed, addr, n); hash_2n_n(wots_pk+i*n, wots_pk+i*2*n, pub_seed, addr, n);
} }
//if ( l % 2 == 1 ) { //if ( l % 2 == 1 ) {
if(l&1) if (l & 1) {
{
//pk[floor(l / 2) + 1] = pk[l]; //pk[floor(l / 2) + 1] = pk[l];
memcpy(wots_pk+(l>>1)*n,wots_pk+(l-1)*n, n); memcpy(wots_pk+(l>>1)*n, wots_pk+(l-1)*n, n);
//l = ceil(l / 2); //l = ceil(l / 2);
l=(l>>1)+1; l=(l>>1)+1;
} }
@ -191,10 +189,10 @@ static void l_tree(unsigned char *leaf, unsigned char *wots_pk, const xmss_param
} }
//ADRS.setTreeHeight(ADRS.getTreeHeight() + 1); //ADRS.setTreeHeight(ADRS.getTreeHeight() + 1);
height++; height++;
SET_LTREE_TREE_HEIGHT(addr,height); SET_LTREE_TREE_HEIGHT(addr, height);
} }
//return pk[0]; //return pk[0];
memcpy(leaf,wots_pk,n); memcpy(leaf, wots_pk, n);
} }
/** /**
@ -212,7 +210,7 @@ static void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, con
} }
static int treehash_minheight_on_stack(bds_state* state, const xmss_params *params, const treehash_inst *treehash) { static int treehash_minheight_on_stack(bds_state* state, const xmss_params *params, const treehash_inst *treehash) {
int r = params->h, i; unsigned int r = params->h, i;
for (i = 0; i < treehash->stackusage; i++) { for (i = 0; i < treehash->stackusage; i++) {
if (state->stacklevels[state->stackoffset - i - 1] < r) { if (state->stacklevels[state->stackoffset - i - 1] < r) {
r = state->stacklevels[state->stackoffset - i - 1]; r = state->stacklevels[state->stackoffset - i - 1];
@ -245,33 +243,31 @@ static void treehash_setup(unsigned char *node, int height, int index, bds_state
SET_LTREE_BIT(node_addr, 0); SET_LTREE_BIT(node_addr, 0);
SET_NODE_PADDING(node_addr); SET_NODE_PADDING(node_addr);
int lastnode,i; unsigned int lastnode, i;
unsigned char stack[(height+1)*n]; unsigned char stack[(height+1)*n];
unsigned int stacklevels[height+1]; unsigned int stacklevels[height+1];
unsigned int stackoffset=0; unsigned int stackoffset=0;
unsigned int nodeh;
int nodeh;
lastnode = idx+(1<<height); lastnode = idx+(1<<height);
for(i = 0; i < h-k; i++) { for (i = 0; i < h-k; i++) {
state->treehash[i].h = i; state->treehash[i].h = i;
state->treehash[i].completed = 1; state->treehash[i].completed = 1;
state->treehash[i].stackusage = 0; state->treehash[i].stackusage = 0;
} }
i = 0; i = 0;
for(;idx<lastnode;idx++) for (; idx < lastnode; idx++) {
{ SET_LTREE_ADDRESS(ltree_addr, idx);
SET_LTREE_ADDRESS(ltree_addr,idx); SET_OTS_ADDRESS(ots_addr, idx);
SET_OTS_ADDRESS(ots_addr,idx); gen_leaf_wots(stack+stackoffset*n, sk_seed, params, pub_seed, ltree_addr, ots_addr);
gen_leaf_wots(stack+stackoffset*n,sk_seed,params, pub_seed, ltree_addr, ots_addr);
stacklevels[stackoffset] = 0; stacklevels[stackoffset] = 0;
stackoffset++; stackoffset++;
if (h - k > 0 && i == 3) { if (h - k > 0 && i == 3) {
memcpy(state->treehash[0].node, stack+stackoffset*n, n); memcpy(state->treehash[0].node, stack+stackoffset*n, n);
} }
while(stackoffset>1 && stacklevels[stackoffset-1] == stacklevels[stackoffset-2]) while (stackoffset>1 && stacklevels[stackoffset-1] == stacklevels[stackoffset-2])
{ {
nodeh = stacklevels[stackoffset-1]; nodeh = stacklevels[stackoffset-1];
if (i >> nodeh == 1) { if (i >> nodeh == 1) {
@ -285,9 +281,9 @@ static void treehash_setup(unsigned char *node, int height, int index, bds_state
memcpy(state->retain + ((1 << (h - 1 - nodeh)) + nodeh - h + (((i >> nodeh) - 3) >> 1)) * n, stack+(stackoffset-1)*n, n); memcpy(state->retain + ((1 << (h - 1 - nodeh)) + nodeh - h + (((i >> nodeh) - 3) >> 1)) * n, stack+(stackoffset-1)*n, n);
} }
} }
SET_NODE_TREE_HEIGHT(node_addr,stacklevels[stackoffset-1]); SET_NODE_TREE_HEIGHT(node_addr, stacklevels[stackoffset-1]);
SET_NODE_TREE_INDEX(node_addr, (idx >> (stacklevels[stackoffset-1]+1))); SET_NODE_TREE_INDEX(node_addr, (idx >> (stacklevels[stackoffset-1]+1)));
hash_2n_n(stack+(stackoffset-2)*n,stack+(stackoffset-2)*n, pub_seed, hash_2n_n(stack+(stackoffset-2)*n, stack+(stackoffset-2)*n, pub_seed,
node_addr, n); node_addr, n);
stacklevels[stackoffset-2]++; stacklevels[stackoffset-2]++;
stackoffset--; stackoffset--;
@ -295,7 +291,7 @@ static void treehash_setup(unsigned char *node, int height, int index, bds_state
i++; i++;
} }
for(i=0;i<n;i++) for (i = 0; i < n; i++)
node[i] = stack[i]; node[i] = stack[i];
} }
@ -351,42 +347,37 @@ static void validate_authpath(unsigned char *root, const unsigned char *leaf, un
{ {
unsigned int n = params->n; unsigned int n = params->n;
int i,j; unsigned int i, j;
unsigned char buffer[2*n]; unsigned char buffer[2*n];
// If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left. // If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left.
// Otherwise, it is the other way around // Otherwise, it is the other way around
if(leafidx&1) if (leafidx & 1) {
{ for (j = 0; j < n; j++)
for(j=0;j<n;j++)
buffer[n+j] = leaf[j]; buffer[n+j] = leaf[j];
for(j=0;j<n;j++) for (j = 0; j < n; j++)
buffer[j] = authpath[j]; buffer[j] = authpath[j];
} }
else else {
{ for (j = 0; j < n; j++)
for(j=0;j<n;j++)
buffer[j] = leaf[j]; buffer[j] = leaf[j];
for(j=0;j<n;j++) for (j = 0; j < n; j++)
buffer[n+j] = authpath[j]; buffer[n+j] = authpath[j];
} }
authpath += n; authpath += n;
for(i=0;i<params->h-1;i++) for (i = 0; i < params->h-1; i++) {
{ SET_NODE_TREE_HEIGHT(addr, i);
SET_NODE_TREE_HEIGHT(addr,i);
leafidx >>= 1; leafidx >>= 1;
SET_NODE_TREE_INDEX(addr, leafidx); SET_NODE_TREE_INDEX(addr, leafidx);
if(leafidx&1) if (leafidx & 1) {
{ hash_2n_n(buffer+n, buffer, pub_seed, addr, n);
hash_2n_n(buffer+n,buffer,pub_seed, addr, n); for (j = 0; j < n; j++)
for(j=0;j<n;j++)
buffer[j] = authpath[j]; buffer[j] = authpath[j];
} }
else else {
{ hash_2n_n(buffer, buffer, pub_seed, addr, n);
hash_2n_n(buffer,buffer,pub_seed, addr, n); for (j = 0; j < n; j++)
for(j=0;j<n;j++)
buffer[j+n] = authpath[j]; buffer[j+n] = authpath[j];
} }
authpath += n; authpath += n;
@ -394,7 +385,7 @@ static void validate_authpath(unsigned char *root, const unsigned char *leaf, un
SET_NODE_TREE_HEIGHT(addr, (params->h-1)); SET_NODE_TREE_HEIGHT(addr, (params->h-1));
leafidx >>= 1; leafidx >>= 1;
SET_NODE_TREE_INDEX(addr, leafidx); SET_NODE_TREE_INDEX(addr, leafidx);
hash_2n_n(root,buffer,pub_seed,addr,n); hash_2n_n(root, buffer, pub_seed, addr, n);
} }
/** /**
@ -403,10 +394,10 @@ static void validate_authpath(unsigned char *root, const unsigned char *leaf, un
**/ **/
static char bds_treehash_update(bds_state *state, unsigned int updates, const unsigned char *sk_seed, const xmss_params *params, unsigned char *pub_seed, const unsigned char addr[16]) { static char bds_treehash_update(bds_state *state, unsigned int updates, const unsigned char *sk_seed, const xmss_params *params, unsigned char *pub_seed, const unsigned char addr[16]) {
unsigned int i, j; unsigned int i, j;
int level, l_min, low; unsigned int level, l_min, low;
int h = params->h; unsigned int h = params->h;
int k = params->k; unsigned int k = params->k;
int used = 0; unsigned int used = 0;
for (j = 0; j < updates; j++) { for (j = 0; j < updates; j++) {
l_min = h; l_min = h;
@ -429,7 +420,6 @@ static char bds_treehash_update(bds_state *state, unsigned int updates, const un
if (level == h - k) { if (level == h - k) {
break; break;
} }
// printf("Updated treehash instance on level %d\n", level);
treehash_update(&(state->treehash[level]), state, sk_seed, params, pub_seed, addr); treehash_update(&(state->treehash[level]), state, sk_seed, params, pub_seed, addr);
used++; used++;
} }
@ -469,15 +459,14 @@ static char bds_state_update(bds_state *state, const unsigned char *sk_seed, con
SET_OTS_BIT(node_addr, 0); SET_OTS_BIT(node_addr, 0);
SET_NODE_PADDING(node_addr); SET_NODE_PADDING(node_addr);
gen_leaf_wots(state->stack+state->stackoffset*n,sk_seed,params, pub_seed, ltree_addr, ots_addr); gen_leaf_wots(state->stack+state->stackoffset*n, sk_seed, params, pub_seed, ltree_addr, ots_addr);
state->stacklevels[state->stackoffset] = 0; state->stacklevels[state->stackoffset] = 0;
state->stackoffset++; state->stackoffset++;
if (h - k > 0 && idx == 3) { if (h - k > 0 && idx == 3) {
memcpy(state->treehash[0].node, state->stack+state->stackoffset*n, n); memcpy(state->treehash[0].node, state->stack+state->stackoffset*n, n);
} }
while(state->stackoffset>1 && state->stacklevels[state->stackoffset-1] == state->stacklevels[state->stackoffset-2]) while (state->stackoffset>1 && state->stacklevels[state->stackoffset-1] == state->stacklevels[state->stackoffset-2]) {
{
nodeh = state->stacklevels[state->stackoffset-1]; nodeh = state->stacklevels[state->stackoffset-1];
if (idx >> nodeh == 1) { if (idx >> nodeh == 1) {
memcpy(state->auth + nodeh*n, state->stack+(state->stackoffset-1)*n, n); memcpy(state->auth + nodeh*n, state->stack+(state->stackoffset-1)*n, n);
@ -492,7 +481,7 @@ static char bds_state_update(bds_state *state, const unsigned char *sk_seed, con
} }
SET_NODE_TREE_HEIGHT(node_addr, state->stacklevels[state->stackoffset-1]); SET_NODE_TREE_HEIGHT(node_addr, state->stacklevels[state->stackoffset-1]);
SET_NODE_TREE_INDEX(node_addr, (idx >> (state->stacklevels[state->stackoffset-1]+1))); SET_NODE_TREE_INDEX(node_addr, (idx >> (state->stacklevels[state->stackoffset-1]+1)));
hash_2n_n(state->stack+(state->stackoffset-2)*n,state->stack+(state->stackoffset-2)*n, pub_seed, node_addr, n); hash_2n_n(state->stack+(state->stackoffset-2)*n, state->stack+(state->stackoffset-2)*n, pub_seed, node_addr, n);
state->stacklevels[state->stackoffset-2]++; state->stacklevels[state->stackoffset-2]++;
state->stackoffset--; state->stackoffset--;
@ -508,15 +497,14 @@ static char bds_state_update(bds_state *state, const unsigned char *sk_seed, con
*/ */
static void bds_round(bds_state *state, const unsigned long leaf_idx, const unsigned char *sk_seed, const xmss_params *params, unsigned char *pub_seed, unsigned char addr[16]) static void bds_round(bds_state *state, const unsigned long leaf_idx, const unsigned char *sk_seed, const xmss_params *params, unsigned char *pub_seed, unsigned char addr[16])
{ {
// printf("COMPUTING %llu\n", leaf_idx);
unsigned int i; unsigned int i;
int n = params->n; unsigned int n = params->n;
int h = params->h; unsigned int h = params->h;
int k = params->k; unsigned int k = params->k;
int tau = h; unsigned int tau = h;
int startidx; unsigned int startidx;
int offset, rowidx; unsigned int offset, rowidx;
unsigned char buf[2 * n]; unsigned char buf[2 * n];
unsigned char ots_addr[16]; unsigned char ots_addr[16];
@ -548,8 +536,8 @@ static void bds_round(bds_state *state, const unsigned long leaf_idx, const unsi
memcpy(state->keep + (tau >> 1)*n, state->auth + tau*n, n); memcpy(state->keep + (tau >> 1)*n, state->auth + tau*n, n);
} }
if (tau == 0) { if (tau == 0) {
SET_LTREE_ADDRESS(ltree_addr,leaf_idx); SET_LTREE_ADDRESS(ltree_addr, leaf_idx);
SET_OTS_ADDRESS(ots_addr,leaf_idx); SET_OTS_ADDRESS(ots_addr, leaf_idx);
gen_leaf_wots(state->auth, sk_seed, params, pub_seed, ltree_addr, ots_addr); gen_leaf_wots(state->auth, sk_seed, params, pub_seed, ltree_addr, ots_addr);
} }
else { else {
@ -569,7 +557,7 @@ static void bds_round(bds_state *state, const unsigned long leaf_idx, const unsi
for (i = 0; i < ((tau < h - k) ? tau : (h - k)); i++) { for (i = 0; i < ((tau < h - k) ? tau : (h - k)); i++) {
startidx = leaf_idx + 1 + 3 * (1 << i); startidx = leaf_idx + 1 + 3 * (1 << i);
if (startidx < 1 << h) { if (startidx < 1U << h) {
state->treehash[i].h = i; state->treehash[i].h = i;
state->treehash[i].next_idx = startidx; state->treehash[i].next_idx = startidx;
state->treehash[i].completed = 0; state->treehash[i].completed = 0;
@ -594,11 +582,11 @@ int xmss_keypair(unsigned char *pk, unsigned char *sk, bds_state *state, xmss_pa
sk[2] = 0; sk[2] = 0;
sk[3] = 0; sk[3] = 0;
// Init SK_SEED (n byte), SK_PRF (m byte), and PUB_SEED (n byte) // Init SK_SEED (n byte), SK_PRF (m byte), and PUB_SEED (n byte)
randombytes(sk+4,2*n+m); randombytes(sk+4, 2*n+m);
// Copy PUB_SEED to public key // Copy PUB_SEED to public key
memcpy(pk+n, sk+4+n+m,n); memcpy(pk+n, sk+4+n+m, n);
unsigned char addr[16] = {0,0,0,0}; unsigned char addr[16] = {0, 0, 0, 0};
// Compute root // Compute root
treehash_setup(pk, params->h, 0, state, sk+4, params, sk+4+n+m, addr); treehash_setup(pk, params->h, 0, state, sk+4, params, sk+4+n+m, addr);
return 0; return 0;
@ -621,11 +609,11 @@ int xmss_sign(unsigned char *sk, bds_state *state, unsigned char *sig_msg, unsig
// Extract SK // Extract SK
unsigned long idx = ((unsigned long)sk[0] << 24) | ((unsigned long)sk[1] << 16) | ((unsigned long)sk[2] << 8) | sk[3]; unsigned long idx = ((unsigned long)sk[0] << 24) | ((unsigned long)sk[1] << 16) | ((unsigned long)sk[2] << 8) | sk[3];
unsigned char sk_seed[n]; unsigned char sk_seed[n];
memcpy(sk_seed,sk+4,n); memcpy(sk_seed, sk+4, n);
unsigned char sk_prf[m]; unsigned char sk_prf[m];
memcpy(sk_prf,sk+4+n,m); memcpy(sk_prf, sk+4+n, m);
unsigned char pub_seed[n]; unsigned char pub_seed[n];
memcpy(pub_seed,sk+4+n+m,n); memcpy(pub_seed, sk+4+n+m, n);
// Update SK // Update SK
sk[0] = ((idx + 1) >> 24) & 255; sk[0] = ((idx + 1) >> 24) & 255;
@ -640,7 +628,7 @@ int xmss_sign(unsigned char *sk, bds_state *state, unsigned char *sig_msg, unsig
unsigned char R[m]; unsigned char R[m];
unsigned char msg_h[m]; unsigned char msg_h[m];
unsigned char ots_seed[n]; unsigned char ots_seed[n];
unsigned char ots_addr[16] = {0,0,0,0}; unsigned char ots_addr[16] = {0, 0, 0, 0};
// --------------------------------- // ---------------------------------
// Message Hashing // Message Hashing
@ -665,7 +653,7 @@ int xmss_sign(unsigned char *sk, bds_state *state, unsigned char *sig_msg, unsig
*sig_msg_len += 4; *sig_msg_len += 4;
// Copy R to signature // Copy R to signature
for(i=0; i<m; i++) for (i = 0; i < m; i++)
sig_msg[i] = R[i]; sig_msg[i] = R[i];
sig_msg += m; sig_msg += m;
@ -676,8 +664,8 @@ int xmss_sign(unsigned char *sk, bds_state *state, unsigned char *sig_msg, unsig
// ---------------------------------- // ----------------------------------
// Prepare Address // Prepare Address
SET_OTS_BIT(ots_addr,1); SET_OTS_BIT(ots_addr, 1);
SET_OTS_ADDRESS(ots_addr,idx); SET_OTS_ADDRESS(ots_addr, idx);
// Compute seed for OTS key pair // Compute seed for OTS key pair
get_seed(ots_seed, sk_seed, n, ots_addr); get_seed(ots_seed, sk_seed, n, ots_addr);
@ -691,7 +679,7 @@ int xmss_sign(unsigned char *sk, bds_state *state, unsigned char *sig_msg, unsig
// the auth path was already computed during the previous round // the auth path was already computed during the previous round
memcpy(sig_msg, state->auth, h*n); memcpy(sig_msg, state->auth, h*n);
if (idx < (1 << h) - 1) { if (idx < (1U << h) - 1) {
bds_round(state, idx, sk_seed, params, pub_seed, ots_addr); bds_round(state, idx, sk_seed, params, pub_seed, ots_addr);
bds_treehash_update(state, (h - k) >> 1, sk_seed, params, pub_seed, ots_addr); bds_treehash_update(state, (h - k) >> 1, sk_seed, params, pub_seed, ots_addr);
} }
@ -702,7 +690,7 @@ int xmss_sign(unsigned char *sk, bds_state *state, unsigned char *sig_msg, unsig
//Whipe secret elements? //Whipe secret elements?
//zerobytes(tsk, CRYPTO_SECRETKEYBYTES); //zerobytes(tsk, CRYPTO_SECRETKEYBYTES);
memcpy(sig_msg,msg,msglen); memcpy(sig_msg, msg, msglen);
*sig_msg_len += msglen; *sig_msg_len += msglen;
return 0; return 0;
@ -724,10 +712,10 @@ int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigne
unsigned char msg_h[m]; unsigned char msg_h[m];
unsigned char pub_seed[n]; unsigned char pub_seed[n];
memcpy(pub_seed,pk+n,n); memcpy(pub_seed, pk+n, n);
// Init addresses // Init addresses
unsigned char ots_addr[16] = {0,0,0,0}; unsigned char ots_addr[16] = {0, 0, 0, 0};
unsigned char ltree_addr[16]; unsigned char ltree_addr[16];
unsigned char node_addr[16]; unsigned char node_addr[16];
@ -743,7 +731,7 @@ int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigne
// Extract index // Extract index
idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3]; idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3];
printf("verify:: idx = %lu\n",idx); printf("verify:: idx = %lu\n", idx);
sig_msg += 4; sig_msg += 4;
sig_msg_len -= 4; sig_msg_len -= 4;
@ -760,7 +748,7 @@ int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigne
//----------------------- //-----------------------
// Prepare Address // Prepare Address
SET_OTS_ADDRESS(ots_addr,idx); SET_OTS_ADDRESS(ots_addr, idx);
// Check WOTS signature // Check WOTS signature
wots_pkFromSig(wots_pk, sig_msg, msg_h, &(params->wots_par), pub_seed, ots_addr); wots_pkFromSig(wots_pk, sig_msg, msg_h, &(params->wots_par), pub_seed, ots_addr);
@ -777,12 +765,12 @@ int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigne
sig_msg += params->h*n; sig_msg += params->h*n;
sig_msg_len -= params->h*n; sig_msg_len -= params->h*n;
for(i=0;i<n;i++) for (i = 0; i < n; i++)
if(root[i] != pk[i]) if (root[i] != pk[i])
goto fail; goto fail;
*msglen = sig_msg_len; *msglen = sig_msg_len;
for(i=0;i<*msglen;i++) for (i = 0; i < *msglen; i++)
msg[i] = sig_msg[i]; msg[i] = sig_msg[i];
return 0; return 0;
@ -790,7 +778,7 @@ int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigne
fail: fail:
*msglen = sig_msg_len; *msglen = sig_msg_len;
for(i=0;i<*msglen;i++) for (i = 0; i < *msglen; i++)
msg[i] = 0; msg[i] = 0;
*msglen = -1; *msglen = -1;
return -1; return -1;
@ -808,17 +796,17 @@ int xmssmt_keypair(unsigned char *pk, unsigned char *sk, bds_state *states, unsi
unsigned int i; unsigned int i;
unsigned char ots_seed[params->n]; unsigned char ots_seed[params->n];
// Set idx = 0 // Set idx = 0
for (i = 0; i < params->index_len; i++){ for (i = 0; i < params->index_len; i++) {
sk[i] = 0; sk[i] = 0;
} }
// Init SK_SEED (n byte), SK_PRF (m byte), and PUB_SEED (n byte) // Init SK_SEED (n byte), SK_PRF (m byte), and PUB_SEED (n byte)
randombytes(sk+params->index_len,2*n+m); randombytes(sk+params->index_len, 2*n+m);
// Copy PUB_SEED to public key // Copy PUB_SEED to public key
memcpy(pk+n, sk+params->index_len+n+m,n); memcpy(pk+n, sk+params->index_len+n+m, n);
// Set address to point on the single tree on layer d-1 // Set address to point on the single tree on layer d-1
unsigned char addr[16] = {0,0,0,0}; unsigned char addr[16] = {0, 0, 0, 0};
SET_OTS_BIT(addr,1); SET_OTS_BIT(addr, 1);
SET_TREE_ADDRESS(addr, 0); SET_TREE_ADDRESS(addr, 0);
SET_OTS_ADDRESS(addr, 0); SET_OTS_ADDRESS(addr, 0);
SET_LAYER_ADDRESS(addr, 0); SET_LAYER_ADDRESS(addr, 0);
@ -865,22 +853,22 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs,
unsigned char R[m]; unsigned char R[m];
unsigned char msg_h[m]; unsigned char msg_h[m];
unsigned char ots_seed[n]; unsigned char ots_seed[n];
unsigned char addr[16] = {0,0,0,0}; unsigned char addr[16] = {0, 0, 0, 0};
unsigned char ots_addr[16] = {0,0,0,0}; unsigned char ots_addr[16] = {0, 0, 0, 0};
bds_state tmp; bds_state tmp;
// Extract SK // Extract SK
unsigned long long idx = 0; unsigned long long idx = 0;
for(i = 0; i < idx_len; i++){ for (i = 0; i < idx_len; i++) {
idx |= ((unsigned long long)sk[i]) << 8*(idx_len - 1 - i); idx |= ((unsigned long long)sk[i]) << 8*(idx_len - 1 - i);
} }
memcpy(sk_seed,sk+idx_len,n); memcpy(sk_seed, sk+idx_len, n);
memcpy(sk_prf,sk+idx_len+n,m); memcpy(sk_prf, sk+idx_len+n, m);
memcpy(pub_seed,sk+idx_len+n+m,n); memcpy(pub_seed, sk+idx_len+n+m, n);
// Update SK // Update SK
for(i = 0; i < idx_len; i++){ for (i = 0; i < idx_len; i++) {
sk[i] = ((idx + 1) >> 8*(idx_len - 1 - i)) & 255; sk[i] = ((idx + 1) >> 8*(idx_len - 1 - i)) & 255;
} }
// -- Secret key for this non-forward-secure version is now updated. // -- Secret key for this non-forward-secure version is now updated.
@ -901,7 +889,7 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs,
*sig_msg_len = 0; *sig_msg_len = 0;
// Copy index to signature // Copy index to signature
for(i = 0; i < idx_len; i++){ for (i = 0; i < idx_len; i++) {
sig_msg[i] = (idx >> 8*(idx_len - 1 - i)) & 255; sig_msg[i] = (idx >> 8*(idx_len - 1 - i)) & 255;
} }
@ -909,7 +897,7 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs,
*sig_msg_len += idx_len; *sig_msg_len += idx_len;
// Copy R to signature // Copy R to signature
for(i=0; i<m; i++) for (i = 0; i < m; i++)
sig_msg[i] = R[i]; sig_msg[i] = R[i];
sig_msg += m; sig_msg += m;
@ -922,10 +910,10 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs,
// Handle lowest layer separately as it is slightly different... // Handle lowest layer separately as it is slightly different...
// Prepare Address // Prepare Address
SET_OTS_BIT(ots_addr,1); SET_OTS_BIT(ots_addr, 1);
idx_tree = idx >> tree_h; idx_tree = idx >> tree_h;
idx_leaf = (idx & ((1 << tree_h)-1)); idx_leaf = (idx & ((1 << tree_h)-1));
SET_LAYER_ADDRESS(ots_addr,0); SET_LAYER_ADDRESS(ots_addr, 0);
SET_TREE_ADDRESS(ots_addr, idx_tree); SET_TREE_ADDRESS(ots_addr, idx_tree);
SET_OTS_ADDRESS(ots_addr, idx_leaf); SET_OTS_ADDRESS(ots_addr, idx_leaf);
@ -943,7 +931,7 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs,
*sig_msg_len += tree_h*n; *sig_msg_len += tree_h*n;
// prepare signature of remaining layers // prepare signature of remaining layers
for(i = 1; i < params->d; i++){ for (i = 1; i < params->d; i++) {
// put WOTS signature in place // put WOTS signature in place
memcpy(sig_msg, wots_sigs + (i-1)*params->xmss_par.wots_par.keysize, params->xmss_par.wots_par.keysize); memcpy(sig_msg, wots_sigs + (i-1)*params->xmss_par.wots_par.keysize, params->xmss_par.wots_par.keysize);
@ -970,7 +958,7 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs,
idx_tree = (idx >> (tree_h * (i+1))); idx_tree = (idx >> (tree_h * (i+1)));
SET_LAYER_ADDRESS(addr, i); SET_LAYER_ADDRESS(addr, i);
SET_TREE_ADDRESS(addr, idx_tree); SET_TREE_ADDRESS(addr, idx_tree);
if (i == needswap_upto+1) { if (i == (unsigned int) (needswap_upto + 1)) {
bds_round(&states[i], idx_leaf, sk_seed, &(params->xmss_par), pub_seed, addr); bds_round(&states[i], idx_leaf, sk_seed, &(params->xmss_par), pub_seed, addr);
} }
updates = bds_treehash_update(&states[i], updates, sk_seed, &(params->xmss_par), pub_seed, addr); updates = bds_treehash_update(&states[i], updates, sk_seed, &(params->xmss_par), pub_seed, addr);
@ -1009,7 +997,7 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs,
//Whipe secret elements? //Whipe secret elements?
//zerobytes(tsk, CRYPTO_SECRETKEYBYTES); //zerobytes(tsk, CRYPTO_SECRETKEYBYTES);
memcpy(sig_msg,msg,msglen); memcpy(sig_msg, msg, msglen);
*sig_msg_len += msglen; *sig_msg_len += msglen;
return 0; return 0;
@ -1036,18 +1024,18 @@ int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsig
unsigned char msg_h[m]; unsigned char msg_h[m];
unsigned char pub_seed[n]; unsigned char pub_seed[n];
memcpy(pub_seed,pk+n,n); memcpy(pub_seed, pk+n, n);
// Init addresses // Init addresses
unsigned char ots_addr[16] = {0,0,0,0}; unsigned char ots_addr[16] = {0, 0, 0, 0};
unsigned char ltree_addr[16]; unsigned char ltree_addr[16];
unsigned char node_addr[16]; unsigned char node_addr[16];
// Extract index // Extract index
for(i = 0; i < idx_len; i++){ for (i = 0; i < idx_len; i++) {
idx |= ((unsigned long long)sig_msg[i]) << (8*(idx_len - 1 - i)); idx |= ((unsigned long long)sig_msg[i]) << (8*(idx_len - 1 - i));
} }
printf("verify:: idx = %llu\n",idx); printf("verify:: idx = %llu\n", idx);
sig_msg += idx_len; sig_msg += idx_len;
sig_msg_len -= idx_len; sig_msg_len -= idx_len;
@ -1066,7 +1054,7 @@ int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsig
// Prepare Address // Prepare Address
idx_tree = idx >> tree_h; idx_tree = idx >> tree_h;
idx_leaf = (idx & ((1 << tree_h)-1)); idx_leaf = (idx & ((1 << tree_h)-1));
SET_LAYER_ADDRESS(ots_addr,0); SET_LAYER_ADDRESS(ots_addr, 0);
SET_TREE_ADDRESS(ots_addr, idx_tree); SET_TREE_ADDRESS(ots_addr, idx_tree);
SET_OTS_BIT(ots_addr, 1); SET_OTS_BIT(ots_addr, 1);
@ -1078,7 +1066,7 @@ int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsig
SET_LTREE_BIT(node_addr, 0); SET_LTREE_BIT(node_addr, 0);
SET_NODE_PADDING(node_addr); SET_NODE_PADDING(node_addr);
SET_OTS_ADDRESS(ots_addr,idx_leaf); SET_OTS_ADDRESS(ots_addr, idx_leaf);
// Check WOTS signature // Check WOTS signature
wots_pkFromSig(wots_pk, sig_msg, msg_h, &(params->xmss_par.wots_par), pub_seed, ots_addr); wots_pkFromSig(wots_pk, sig_msg, msg_h, &(params->xmss_par.wots_par), pub_seed, ots_addr);
@ -1096,12 +1084,12 @@ int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsig
sig_msg += tree_h*n; sig_msg += tree_h*n;
sig_msg_len -= tree_h*n; sig_msg_len -= tree_h*n;
for(i = 1; i < params->d; i++){ for (i = 1; i < params->d; i++) {
// Prepare Address // Prepare Address
idx_leaf = (idx_tree & ((1 << tree_h)-1)); idx_leaf = (idx_tree & ((1 << tree_h)-1));
idx_tree = idx_tree >> tree_h; idx_tree = idx_tree >> tree_h;
SET_LAYER_ADDRESS(ots_addr,i); SET_LAYER_ADDRESS(ots_addr, i);
SET_TREE_ADDRESS(ots_addr, idx_tree); SET_TREE_ADDRESS(ots_addr, idx_tree);
SET_OTS_BIT(ots_addr, 1); SET_OTS_BIT(ots_addr, 1);
@ -1113,7 +1101,7 @@ int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsig
SET_LTREE_BIT(node_addr, 0); SET_LTREE_BIT(node_addr, 0);
SET_NODE_PADDING(node_addr); SET_NODE_PADDING(node_addr);
SET_OTS_ADDRESS(ots_addr,idx_leaf); SET_OTS_ADDRESS(ots_addr, idx_leaf);
// Check WOTS signature // Check WOTS signature
wots_pkFromSig(wots_pk, sig_msg, root, &(params->xmss_par.wots_par), pub_seed, ots_addr); wots_pkFromSig(wots_pk, sig_msg, root, &(params->xmss_par.wots_par), pub_seed, ots_addr);
@ -1133,12 +1121,12 @@ int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsig
} }
for(i=0;i<n;i++) for (i = 0; i < n; i++)
if(root[i] != pk[i]) if (root[i] != pk[i])
goto fail; goto fail;
*msglen = sig_msg_len; *msglen = sig_msg_len;
for(i=0;i<*msglen;i++) for (i = 0; i < *msglen; i++)
msg[i] = sig_msg[i]; msg[i] = sig_msg[i];
return 0; return 0;
@ -1146,7 +1134,7 @@ int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsig
fail: fail:
*msglen = sig_msg_len; *msglen = sig_msg_len;
for(i=0;i<*msglen;i++) for (i = 0; i < *msglen; i++)
msg[i] = 0; msg[i] = 0;
*msglen = -1; *msglen = -1;
return -1; return -1;

32
xmss_fast.h
View File

@ -9,45 +9,45 @@ Public domain.
#ifndef XMSS_H #ifndef XMSS_H
#define XMSS_H #define XMSS_H
typedef struct{ typedef struct{
int level; unsigned int level;
unsigned long long subtree; unsigned long long subtree;
int subleaf; unsigned int subleaf;
} leafaddr; } leafaddr;
typedef struct{ typedef struct{
wots_params wots_par; wots_params wots_par;
int n; unsigned int n;
int m; unsigned int m;
int h; unsigned int h;
int k; unsigned int k;
} xmss_params; } xmss_params;
typedef struct{ typedef struct{
xmss_params xmss_par; xmss_params xmss_par;
int n; unsigned int n;
int m; unsigned int m;
int h; unsigned int h;
int d; unsigned int d;
int index_len; unsigned int index_len;
} xmssmt_params; } xmssmt_params;
typedef struct{ typedef struct{
int h; unsigned int h;
int next_idx; unsigned int next_idx;
int stackusage; unsigned int stackusage;
unsigned char completed; unsigned char completed;
unsigned char *node; unsigned char *node;
} treehash_inst; } treehash_inst;
typedef struct { typedef struct {
unsigned char *stack; unsigned char *stack;
int stackoffset; unsigned int stackoffset;
unsigned char *stacklevels; unsigned char *stacklevels;
unsigned char *auth; unsigned char *auth;
unsigned char *keep; unsigned char *keep;
treehash_inst *treehash; treehash_inst *treehash;
unsigned char *retain; unsigned char *retain;
int next_leaf; unsigned int next_leaf;
} bds_state; } bds_state;
/** /**