Reduce code duplication

A large number of functions was repeated in xmss_fast; these are now
shared between the two implementations via the xmss_commons file.
Notably, we ensure compatability by sharing the verification functions.

xmss.c

@@ -22,78 +22,6 @@ Public domain.
 // For testing
 #include "stdio.h"
 
-/**
- * Used for pseudorandom keygeneration,
- * generates the seed for the WOTS keypair at address addr
- *
- * takes XMSS_N byte sk_seed and returns XMSS_N byte seed using 32 byte address addr.
- */
-static void get_seed(unsigned char *seed, const unsigned char *sk_seed, uint32_t addr[8])
-{
-  unsigned char bytes[32];
-  // Make sure that chain addr, hash addr, and key bit are 0!
-  setChainADRS(addr, 0);
-  setHashADRS(addr, 0);
-  setKeyAndMask(addr, 0);
-  // Generate pseudorandom value
-  addr_to_byte(bytes, addr);
-  prf(seed, bytes, sk_seed, XMSS_N);
-}
-
-/**
- * Computes a leaf from a WOTS public key using an L-tree.
- */
-static void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8])
-{
-  unsigned int l = XMSS_WOTS_LEN;
-  uint32_t i = 0;
-  uint32_t height = 0;
-  uint32_t bound;
-
-  //ADRS.setTreeHeight(0);
-  setTreeHeight(addr, height);
-
-  while (l > 1) {
-     bound = l >> 1; //floor(l / 2);
-     for (i = 0; i < bound; i++) {
-       //ADRS.setTreeIndex(i);
-       setTreeIndex(addr, i);
-       //wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS);
-       hash_h(wots_pk+i*XMSS_N, wots_pk+i*2*XMSS_N, pub_seed, addr, XMSS_N);
-     }
-     //if ( l % 2 == 1 ) {
-     if (l & 1) {
-       //pk[floor(l / 2) + 1] = pk[l];
-       memcpy(wots_pk+(l>>1)*XMSS_N, wots_pk+(l-1)*XMSS_N, XMSS_N);
-       //l = ceil(l / 2);
-       l=(l>>1)+1;
-     }
-     else {
-       //l = ceil(l / 2);
-       l=(l>>1);
-     }
-     //ADRS.setTreeHeight(ADRS.getTreeHeight() + 1);
-     height++;
-     setTreeHeight(addr, height);
-   }
-   //return pk[0];
-   memcpy(leaf, wots_pk, XMSS_N);
-}
-
-/**
- * Computes the leaf at a given address. First generates the WOTS key pair, then computes leaf using l_tree. As this happens position independent, we only require that addr encodes the right ltree-address.
- */
-static void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8])
-{
-  unsigned char seed[XMSS_N];
-  unsigned char pk[XMSS_WOTS_KEYSIZE];
-
-  get_seed(seed, sk_seed, ots_addr);
-  wots_pkgen(pk, seed, pub_seed, ots_addr);
-
-  l_tree(leaf, pk, pub_seed, ltree_addr);
-}
-
 /**
  * Merkle's TreeHash algorithm. The address only needs to initialize the first 78 bits of addr. Everything else will be set by treehash.
  * Currently only used for key generation.
@@ -141,52 +69,6 @@ static void treehash(unsigned char *node, uint16_t height, uint32_t index, const
     node[i] = stack[i];
 }
 
-/**
- * Computes a root node given a leaf and an authapth
- */
-static void validate_authpath(unsigned char *root, const unsigned char *leaf, unsigned long leafidx, const unsigned char *authpath, const unsigned char *pub_seed, uint32_t addr[8])
-{
-  uint32_t i, j;
-  unsigned char buffer[2*XMSS_N];
-
-  // If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left.
-  // Otherwise, it is the other way around
-  if (leafidx & 1) {
-    for (j = 0; j < XMSS_N; j++)
-      buffer[XMSS_N+j] = leaf[j];
-    for (j = 0; j < XMSS_N; j++)
-      buffer[j] = authpath[j];
-  }
-  else {
-    for (j = 0; j < XMSS_N; j++)
-      buffer[j] = leaf[j];
-    for (j = 0; j < XMSS_N; j++)
-      buffer[XMSS_N+j] = authpath[j];
-  }
-  authpath += XMSS_N;
-
-  for (i=0; i < XMSS_TREEHEIGHT-1; i++) {
-    setTreeHeight(addr, i);
-    leafidx >>= 1;
-    setTreeIndex(addr, leafidx);
-    if (leafidx&1) {
-      hash_h(buffer+XMSS_N, buffer, pub_seed, addr, XMSS_N);
-      for (j = 0; j < XMSS_N; j++)
-        buffer[j] = authpath[j];
-    }
-    else {
-      hash_h(buffer, buffer, pub_seed, addr, XMSS_N);
-      for (j = 0; j < XMSS_N; j++)
-        buffer[j+XMSS_N] = authpath[j];
-    }
-    authpath += XMSS_N;
-  }
-  setTreeHeight(addr, (XMSS_TREEHEIGHT-1));
-  leafidx >>= 1;
-  setTreeIndex(addr, leafidx);
-  hash_h(root, buffer, pub_seed, addr, XMSS_N);
-}
-
 /**
  * Computes the authpath and the root. This method is using a lot of space as we build the whole tree and then select the authpath nodes.
  * For more efficient algorithms see e.g. the chapter on hash-based signatures in Bernstein, Buchmann, Dahmen. "Post-quantum Cryptography", Springer 2009.
@@ -369,91 +251,6 @@ int xmss_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *sig
   return 0;
 }
 
-/**
- * Verifies a given message signature pair under a given public key.
- */
-int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
-{
-  
-  unsigned long long i, m_len;
-  unsigned long idx=0;
-  unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
-  unsigned char pkhash[XMSS_N];
-  unsigned char root[XMSS_N];
-  unsigned char msg_h[XMSS_N];
-  unsigned char hash_key[3*XMSS_N];
-
-  unsigned char pub_seed[XMSS_N];
-  memcpy(pub_seed, pk+XMSS_N, XMSS_N);
-
-  // Init addresses
-  uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
-  uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
-  uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
-
-  setType(ots_addr, 0);
-  setType(ltree_addr, 1);
-  setType(node_addr, 2);
-  
-  // Extract index
-  idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3];
-  printf("verify:: idx = %lu\n", idx);
-  
-  // Generate hash key (R || root || idx)
-  memcpy(hash_key, sig_msg+4,XMSS_N);
-  memcpy(hash_key+XMSS_N, pk, XMSS_N);
-  to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
-  
-  sig_msg += (XMSS_N+4);
-  sig_msg_len -= (XMSS_N+4);
-  
-
-  // hash message 
-  unsigned long long tmp_sig_len = XMSS_WOTS_KEYSIZE+XMSS_TREEHEIGHT*XMSS_N;
-  m_len = sig_msg_len - tmp_sig_len;
-  h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);
-  
-  //-----------------------
-  // Verify signature
-  //-----------------------
-
-  // Prepare Address
-  setOTSADRS(ots_addr, idx);
-  // Check WOTS signature
-  wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);
-
-  sig_msg += XMSS_WOTS_KEYSIZE;
-  sig_msg_len -= XMSS_WOTS_KEYSIZE;
-
-  // Compute Ltree
-  setLtreeADRS(ltree_addr, idx);
-  l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
-
-  // Compute root
-  validate_authpath(root, pkhash, idx, sig_msg, pub_seed, node_addr);
-
-  sig_msg += XMSS_TREEHEIGHT*XMSS_N;
-  sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
-
-  for (i=0; i < XMSS_N; i++)
-    if (root[i] != pk[i])
-      goto fail;
-
-  *msglen = sig_msg_len;
-  for (i=0; i < *msglen; i++)
-    msg[i] = sig_msg[i];
-
-  return 0;
-
-
-fail:
-  *msglen = sig_msg_len;
-  for (i=0; i < *msglen; i++)
-    msg[i] = 0;
-  *msglen = -1;
-  return -1;
-}
-
 /*
  * Generates a XMSSMT key pair for a given parameter set.
  * Format sk: [(ceil(h/8) bit) idx || SK_SEED || SK_PRF || PUB_SEED]
@@ -617,138 +414,3 @@ int xmssmt_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *s
 
   return 0;
 }
-
-/**
- * Verifies a given message signature pair under a given public key.
- */
-int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
-{
-  uint64_t idx_tree;
-  uint32_t idx_leaf;
-
-  unsigned long long i, m_len;
-  unsigned long long idx=0;
-  unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
-  unsigned char pkhash[XMSS_N];
-  unsigned char root[XMSS_N];
-  unsigned char msg_h[XMSS_N];
-  unsigned char hash_key[3*XMSS_N];
-
-  unsigned char pub_seed[XMSS_N];
-  memcpy(pub_seed, pk+XMSS_N, XMSS_N);
-
-  // Init addresses
-  uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
-  uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
-  uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
-
-  // Extract index
-  for (i = 0; i < XMSS_INDEX_LEN; i++) {
-    idx |= ((unsigned long long)sig_msg[i]) << (8*(XMSS_INDEX_LEN - 1 - i));
-  }
-  printf("verify:: idx = %llu\n", idx);
-  sig_msg += XMSS_INDEX_LEN;
-  sig_msg_len -= XMSS_INDEX_LEN;
-
-  // Generate hash key (R || root || idx)
-  memcpy(hash_key, sig_msg,XMSS_N);
-  memcpy(hash_key+XMSS_N, pk, XMSS_N);
-  to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
-
-  sig_msg += XMSS_N;
-  sig_msg_len -= XMSS_N;
-  
-  // hash message 
-  unsigned long long tmp_sig_len = (XMSS_D * XMSS_WOTS_KEYSIZE) + (XMSS_FULLHEIGHT * XMSS_N);
-  m_len = sig_msg_len - tmp_sig_len;
-  h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);
-
-
-  //-----------------------
-  // Verify signature
-  //-----------------------
-
-  // Prepare Address
-  idx_tree = idx >> XMSS_TREEHEIGHT;
-  idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1));
-  setLayerADRS(ots_addr, 0);
-  setTreeADRS(ots_addr, idx_tree);
-  setType(ots_addr, 0);
-
-  memcpy(ltree_addr, ots_addr, 12);
-  setType(ltree_addr, 1);
-
-  memcpy(node_addr, ltree_addr, 12);
-  setType(node_addr, 2);
-  
-  setOTSADRS(ots_addr, idx_leaf);
-
-  // Check WOTS signature
-  wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);
-
-  sig_msg += XMSS_WOTS_KEYSIZE;
-  sig_msg_len -= XMSS_WOTS_KEYSIZE;
-
-  // Compute Ltree
-  setLtreeADRS(ltree_addr, idx_leaf);
-  l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
-
-  // Compute root
-  validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);
-
-  sig_msg += XMSS_TREEHEIGHT*XMSS_N;
-  sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
-
-  for (i = 1; i < XMSS_D; i++) {
-    // Prepare Address
-    idx_leaf = (idx_tree & ((1 << XMSS_TREEHEIGHT)-1));
-    idx_tree = idx_tree >> XMSS_TREEHEIGHT;
-
-    setLayerADRS(ots_addr, i);
-    setTreeADRS(ots_addr, idx_tree);
-    setType(ots_addr, 0);
-
-    memcpy(ltree_addr, ots_addr, 12);
-    setType(ltree_addr, 1);
-
-    memcpy(node_addr, ltree_addr, 12);
-    setType(node_addr, 2);
-
-    setOTSADRS(ots_addr, idx_leaf);
-
-    // Check WOTS signature
-    wots_pkFromSig(wots_pk, sig_msg, root, pub_seed, ots_addr);
-
-    sig_msg += XMSS_WOTS_KEYSIZE;
-    sig_msg_len -= XMSS_WOTS_KEYSIZE;
-
-    // Compute Ltree
-    setLtreeADRS(ltree_addr, idx_leaf);
-    l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
-
-    // Compute root
-    validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);
-
-    sig_msg += XMSS_TREEHEIGHT*XMSS_N;
-    sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
-
-  }
-
-  for (i=0; i < XMSS_N; i++)
-    if (root[i] != pk[i])
-      goto fail;
-
-  *msglen = sig_msg_len;
-  for (i=0; i < *msglen; i++)
-    msg[i] = sig_msg[i];
-
-  return 0;
-
-
-fail:
-  *msglen = sig_msg_len;
-  for (i=0; i < *msglen; i++)
-    msg[i] = 0;
-  *msglen = -1;
-  return -1;
-}

xmss_commons.c

@@ -6,10 +6,17 @@ Public domain.
 */
 
 #include "xmss_commons.h"
+
 #include <stdlib.h>
+#include <string.h>
 #include <stdio.h>
 #include <stdint.h>
 
+#include "wots.h"
+#include "hash.h"
+#include "hash_address.h"
+#include "params.h"
+
 void to_byte(unsigned char *out, unsigned long long in, uint32_t bytes)
 {
   int32_t i;
@@ -19,9 +26,340 @@ void to_byte(unsigned char *out, unsigned long long in, uint32_t bytes)
   }
 }
 
-void hexdump(const unsigned char *a, size_t len)
+/**
+ * Computes the leaf at a given address. First generates the WOTS key pair, then computes leaf using l_tree. As this happens position independent, we only require that addr encodes the right ltree-address.
+ */
+void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8])
+{
+  unsigned char seed[XMSS_N];
+  unsigned char pk[XMSS_WOTS_KEYSIZE];
+
+  get_seed(seed, sk_seed, ots_addr);
+  wots_pkgen(pk, seed, pub_seed, ots_addr);
+
+  l_tree(leaf, pk, pub_seed, ltree_addr);
+}
+
+/**
+ * Used for pseudorandom keygeneration,
+ * generates the seed for the WOTS keypair at address addr
+ *
+ * takes XMSS_N byte sk_seed and returns XMSS_N byte seed using 32 byte address addr.
+ */
+void get_seed(unsigned char *seed, const unsigned char *sk_seed, uint32_t addr[8])
+{
+  unsigned char bytes[32];
+  // Make sure that chain addr, hash addr, and key bit are 0!
+  setChainADRS(addr, 0);
+  setHashADRS(addr, 0);
+  setKeyAndMask(addr, 0);
+  // Generate pseudorandom value
+  addr_to_byte(bytes, addr);
+  prf(seed, bytes, sk_seed, XMSS_N);
+}
+
+/**
+ * Computes a leaf from a WOTS public key using an L-tree.
+ */
+void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8])
+{
+  unsigned int l = XMSS_WOTS_LEN;
+  uint32_t i = 0;
+  uint32_t height = 0;
+  uint32_t bound;
+
+  //ADRS.setTreeHeight(0);
+  setTreeHeight(addr, height);
+
+  while (l > 1) {
+     bound = l >> 1; //floor(l / 2);
+     for (i = 0; i < bound; i++) {
+       //ADRS.setTreeIndex(i);
+       setTreeIndex(addr, i);
+       //wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS);
+       hash_h(wots_pk+i*XMSS_N, wots_pk+i*2*XMSS_N, pub_seed, addr, XMSS_N);
+     }
+     //if ( l % 2 == 1 ) {
+     if (l & 1) {
+       //pk[floor(l / 2) + 1] = pk[l];
+       memcpy(wots_pk+(l>>1)*XMSS_N, wots_pk+(l-1)*XMSS_N, XMSS_N);
+       //l = ceil(l / 2);
+       l=(l>>1)+1;
+     }
+     else {
+       //l = ceil(l / 2);
+       l=(l>>1);
+     }
+     //ADRS.setTreeHeight(ADRS.getTreeHeight() + 1);
+     height++;
+     setTreeHeight(addr, height);
+   }
+   //return pk[0];
+   memcpy(leaf, wots_pk, XMSS_N);
+}
+
+/**
+ * Computes a root node given a leaf and an authapth
+ */
+static void validate_authpath(unsigned char *root, const unsigned char *leaf, unsigned long leafidx, const unsigned char *authpath, const unsigned char *pub_seed, uint32_t addr[8])
+{
+  uint32_t i, j;
+  unsigned char buffer[2*XMSS_N];
+
+  // If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left.
+  // Otherwise, it is the other way around
+  if (leafidx & 1) {
+    for (j = 0; j < XMSS_N; j++)
+      buffer[XMSS_N+j] = leaf[j];
+    for (j = 0; j < XMSS_N; j++)
+      buffer[j] = authpath[j];
+  }
+  else {
+    for (j = 0; j < XMSS_N; j++)
+      buffer[j] = leaf[j];
+    for (j = 0; j < XMSS_N; j++)
+      buffer[XMSS_N+j] = authpath[j];
+  }
+  authpath += XMSS_N;
+
+  for (i=0; i < XMSS_TREEHEIGHT-1; i++) {
+    setTreeHeight(addr, i);
+    leafidx >>= 1;
+    setTreeIndex(addr, leafidx);
+    if (leafidx&1) {
+      hash_h(buffer+XMSS_N, buffer, pub_seed, addr, XMSS_N);
+      for (j = 0; j < XMSS_N; j++)
+        buffer[j] = authpath[j];
+    }
+    else {
+      hash_h(buffer, buffer, pub_seed, addr, XMSS_N);
+      for (j = 0; j < XMSS_N; j++)
+        buffer[j+XMSS_N] = authpath[j];
+    }
+    authpath += XMSS_N;
+  }
+  setTreeHeight(addr, (XMSS_TREEHEIGHT-1));
+  leafidx >>= 1;
+  setTreeIndex(addr, leafidx);
+  hash_h(root, buffer, pub_seed, addr, XMSS_N);
+}
+
+/**
+ * Verifies a given message signature pair under a given public key.
+ */
+int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
 {
-  size_t i;
-  for (i = 0; i < len; i++)
-    printf("%02x", a[i]);
-}
+  
+  unsigned long long i, m_len;
+  unsigned long idx=0;
+  unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
+  unsigned char pkhash[XMSS_N];
+  unsigned char root[XMSS_N];
+  unsigned char msg_h[XMSS_N];
+  unsigned char hash_key[3*XMSS_N];
+
+  unsigned char pub_seed[XMSS_N];
+  memcpy(pub_seed, pk+XMSS_N, XMSS_N);
+
+  // Init addresses
+  uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
+  uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
+  uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
+
+  setType(ots_addr, 0);
+  setType(ltree_addr, 1);
+  setType(node_addr, 2);
+  
+  // Extract index
+  idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3];
+  printf("verify:: idx = %lu\n", idx);
+  
+  // Generate hash key (R || root || idx)
+  memcpy(hash_key, sig_msg+4,XMSS_N);
+  memcpy(hash_key+XMSS_N, pk, XMSS_N);
+  to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
+  
+  sig_msg += (XMSS_N+4);
+  sig_msg_len -= (XMSS_N+4);
+  
+
+  // hash message 
+  unsigned long long tmp_sig_len = XMSS_WOTS_KEYSIZE+XMSS_TREEHEIGHT*XMSS_N;
+  m_len = sig_msg_len - tmp_sig_len;
+  h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);
+  
+  //-----------------------
+  // Verify signature
+  //-----------------------
+
+  // Prepare Address
+  setOTSADRS(ots_addr, idx);
+  // Check WOTS signature
+  wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);
+
+  sig_msg += XMSS_WOTS_KEYSIZE;
+  sig_msg_len -= XMSS_WOTS_KEYSIZE;
+
+  // Compute Ltree
+  setLtreeADRS(ltree_addr, idx);
+  l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
+
+  // Compute root
+  validate_authpath(root, pkhash, idx, sig_msg, pub_seed, node_addr);
+
+  sig_msg += XMSS_TREEHEIGHT*XMSS_N;
+  sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
+
+  for (i=0; i < XMSS_N; i++)
+    if (root[i] != pk[i])
+      goto fail;
+
+  *msglen = sig_msg_len;
+  for (i=0; i < *msglen; i++)
+    msg[i] = sig_msg[i];
+
+  return 0;
+
+
+fail:
+  *msglen = sig_msg_len;
+  for (i=0; i < *msglen; i++)
+    msg[i] = 0;
+  *msglen = -1;
+  return -1;
+}
+
+/**
+ * Verifies a given message signature pair under a given public key.
+ */
+int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
+{
+  uint64_t idx_tree;
+  uint32_t idx_leaf;
+
+  unsigned long long i, m_len;
+  unsigned long long idx=0;
+  unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
+  unsigned char pkhash[XMSS_N];
+  unsigned char root[XMSS_N];
+  unsigned char msg_h[XMSS_N];
+  unsigned char hash_key[3*XMSS_N];
+
+  unsigned char pub_seed[XMSS_N];
+  memcpy(pub_seed, pk+XMSS_N, XMSS_N);
+
+  // Init addresses
+  uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
+  uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
+  uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
+
+  // Extract index
+  for (i = 0; i < XMSS_INDEX_LEN; i++) {
+    idx |= ((unsigned long long)sig_msg[i]) << (8*(XMSS_INDEX_LEN - 1 - i));
+  }
+  printf("verify:: idx = %llu\n", idx);
+  sig_msg += XMSS_INDEX_LEN;
+  sig_msg_len -= XMSS_INDEX_LEN;
+
+  // Generate hash key (R || root || idx)
+  memcpy(hash_key, sig_msg,XMSS_N);
+  memcpy(hash_key+XMSS_N, pk, XMSS_N);
+  to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
+
+  sig_msg += XMSS_N;
+  sig_msg_len -= XMSS_N;
+  
+  // hash message 
+  unsigned long long tmp_sig_len = (XMSS_D * XMSS_WOTS_KEYSIZE) + (XMSS_FULLHEIGHT * XMSS_N);
+  m_len = sig_msg_len - tmp_sig_len;
+  h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);
+
+
+  //-----------------------
+  // Verify signature
+  //-----------------------
+
+  // Prepare Address
+  idx_tree = idx >> XMSS_TREEHEIGHT;
+  idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1));
+  setLayerADRS(ots_addr, 0);
+  setTreeADRS(ots_addr, idx_tree);
+  setType(ots_addr, 0);
+
+  memcpy(ltree_addr, ots_addr, 12);
+  setType(ltree_addr, 1);
+
+  memcpy(node_addr, ltree_addr, 12);
+  setType(node_addr, 2);
+  
+  setOTSADRS(ots_addr, idx_leaf);
+
+  // Check WOTS signature
+  wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);
+
+  sig_msg += XMSS_WOTS_KEYSIZE;
+  sig_msg_len -= XMSS_WOTS_KEYSIZE;
+
+  // Compute Ltree
+  setLtreeADRS(ltree_addr, idx_leaf);
+  l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
+
+  // Compute root
+  validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);
+
+  sig_msg += XMSS_TREEHEIGHT*XMSS_N;
+  sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
+
+  for (i = 1; i < XMSS_D; i++) {
+    // Prepare Address
+    idx_leaf = (idx_tree & ((1 << XMSS_TREEHEIGHT)-1));
+    idx_tree = idx_tree >> XMSS_TREEHEIGHT;
+
+    setLayerADRS(ots_addr, i);
+    setTreeADRS(ots_addr, idx_tree);
+    setType(ots_addr, 0);
+
+    memcpy(ltree_addr, ots_addr, 12);
+    setType(ltree_addr, 1);
+
+    memcpy(node_addr, ltree_addr, 12);
+    setType(node_addr, 2);
+
+    setOTSADRS(ots_addr, idx_leaf);
+
+    // Check WOTS signature
+    wots_pkFromSig(wots_pk, sig_msg, root, pub_seed, ots_addr);
+
+    sig_msg += XMSS_WOTS_KEYSIZE;
+    sig_msg_len -= XMSS_WOTS_KEYSIZE;
+
+    // Compute Ltree
+    setLtreeADRS(ltree_addr, idx_leaf);
+    l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
+
+    // Compute root
+    validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);
+
+    sig_msg += XMSS_TREEHEIGHT*XMSS_N;
+    sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
+
+  }
+
+  for (i=0; i < XMSS_N; i++)
+    if (root[i] != pk[i])
+      goto fail;
+
+  *msglen = sig_msg_len;
+  for (i=0; i < *msglen; i++)
+    msg[i] = sig_msg[i];
+
+  return 0;
+
+
+fail:
+  *msglen = sig_msg_len;
+  for (i=0; i < *msglen; i++)
+    msg[i] = 0;
+  *msglen = -1;
+  return -1;
+}

xmss_commons.h

@@ -12,4 +12,9 @@ Public domain.
 
 void to_byte(unsigned char *output, unsigned long long in, uint32_t bytes);
 void hexdump(const unsigned char *a, size_t len);
-#endif
+void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8]);
+void get_seed(unsigned char *seed, const unsigned char *sk_seed, uint32_t addr[8]);
+void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8]);
+int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk);
+int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk);
+#endif

xmss_fast.c

@@ -19,24 +19,6 @@ Public domain.
 #include "hash_address.h"
 #include "params.h"
 
-/**
- * Used for pseudorandom keygeneration,
- * generates the seed for the WOTS keypair at address addr
- *
- * takes n byte sk_seed and returns n byte seed using 32 byte address addr.
- */
-static void get_seed(unsigned char *seed, const unsigned char *sk_seed, int n, uint32_t addr[8])
-{
-  unsigned char bytes[32];
-  // Make sure that chain addr, hash addr, and key bit are 0!
-  setChainADRS(addr,0);
-  setHashADRS(addr,0);
-  setKeyAndMask(addr,0);
-  // Generate pseudorandom value
-  addr_to_byte(bytes, addr);
-  prf(seed, bytes, sk_seed, n);
-}
-
 /**
  * Initialize BDS state struct
  * parameter names are the same as used in the description of the BDS traversal
@@ -53,61 +35,6 @@ void xmss_set_bds_state(bds_state *state, unsigned char *stack, int stackoffset,
   state->next_leaf = next_leaf;
 }
 
-/**
- * Computes a leaf from a WOTS public key using an L-tree.
- */
-static void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8])
-{
-  unsigned int l = XMSS_WOTS_LEN;
-  unsigned int n = XMSS_N;
-  uint32_t i = 0;
-  uint32_t height = 0;
-  uint32_t bound;
-
-  //ADRS.setTreeHeight(0);
-  setTreeHeight(addr, height);
-  
-  while (l > 1) {
-     bound = l >> 1; //floor(l / 2);
-     for (i = 0; i < bound; i++) {
-       //ADRS.setTreeIndex(i);
-       setTreeIndex(addr, i);
-       //wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS);
-       hash_h(wots_pk+i*n, wots_pk+i*2*n, pub_seed, addr, n);
-     }
-     //if ( l % 2 == 1 ) {
-     if (l & 1) {
-       //pk[floor(l / 2) + 1] = pk[l];
-       memcpy(wots_pk+(l>>1)*n, wots_pk+(l-1)*n, n);
-       //l = ceil(l / 2);
-       l=(l>>1)+1;
-     }
-     else {
-       //l = ceil(l / 2);
-       l=(l>>1);
-     }
-     //ADRS.setTreeHeight(ADRS.getTreeHeight() + 1);
-     height++;
-     setTreeHeight(addr, height);
-   }
-   //return pk[0];
-   memcpy(leaf, wots_pk, n);
-}
-
-/**
- * Computes the leaf at a given address. First generates the WOTS key pair, then computes leaf using l_tree. As this happens position independent, we only require that addr encodes the right ltree-address.
- */
-static void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8])
-{
-  unsigned char seed[XMSS_N];
-  unsigned char pk[XMSS_WOTS_KEYSIZE];
-
-  get_seed(seed, sk_seed, XMSS_N, ots_addr);
-  wots_pkgen(pk, seed, pub_seed, ots_addr);
-
-  l_tree(leaf, pk, pub_seed, ltree_addr);
-}
-
 static int treehash_minheight_on_stack(bds_state* state, const treehash_inst *treehash) {
   unsigned int r = XMSS_TREEHEIGHT, i;
   for (i = 0; i < treehash->stackusage; i++) {
@@ -233,52 +160,6 @@ static void treehash_update(treehash_inst *treehash, bds_state *state, const uns
   }
 }
 
-/**
- * Computes a root node given a leaf and an authapth
- */
-static void validate_authpath(unsigned char *root, const unsigned char *leaf, unsigned long leafidx, const unsigned char *authpath, const unsigned char *pub_seed, uint32_t addr[8])
-{
-  uint32_t i, j;
-  unsigned char buffer[2*XMSS_N];
-
-  // If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left.
-  // Otherwise, it is the other way around
-  if (leafidx & 1) {
-    for (j = 0; j < XMSS_N; j++)
-      buffer[XMSS_N+j] = leaf[j];
-    for (j = 0; j < XMSS_N; j++)
-      buffer[j] = authpath[j];
-  }
-  else {
-    for (j = 0; j < XMSS_N; j++)
-      buffer[j] = leaf[j];
-    for (j = 0; j < XMSS_N; j++)
-      buffer[XMSS_N+j] = authpath[j];
-  }
-  authpath += XMSS_N;
-
-  for (i=0; i < XMSS_TREEHEIGHT-1; i++) {
-    setTreeHeight(addr, i);
-    leafidx >>= 1;
-    setTreeIndex(addr, leafidx);
-    if (leafidx&1) {
-      hash_h(buffer+XMSS_N, buffer, pub_seed, addr, XMSS_N);
-      for (j = 0; j < XMSS_N; j++)
-        buffer[j] = authpath[j];
-    }
-    else {
-      hash_h(buffer, buffer, pub_seed, addr, XMSS_N);
-      for (j = 0; j < XMSS_N; j++)
-        buffer[j+XMSS_N] = authpath[j];
-    }
-    authpath += XMSS_N;
-  }
-  setTreeHeight(addr, (XMSS_TREEHEIGHT-1));
-  leafidx >>= 1;
-  setTreeIndex(addr, leafidx);
-  hash_h(root, buffer, pub_seed, addr, XMSS_N);
-}
-
 /**
  * Performs one treehash update on the instance that needs it the most.
  * Returns 1 if such an instance was not found
@@ -553,7 +434,7 @@ int xmss_sign(unsigned char *sk, bds_state *state, unsigned char *sig_msg, unsig
   setOTSADRS(ots_addr, idx);
 
   // Compute seed for OTS key pair
-  get_seed(ots_seed, sk_seed, XMSS_N, ots_addr);
+  get_seed(ots_seed, sk_seed, ots_addr);
 
   // Compute WOTS signature
   wots_sign(sig_msg, msg_h, ots_seed, pub_seed, ots_addr);
@@ -578,88 +459,6 @@ int xmss_sign(unsigned char *sk, bds_state *state, unsigned char *sig_msg, unsig
   return 0;
 }
 
-/**
- * Verifies a given message signature pair under a given public key.
- */
-int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
-{
-  unsigned long long i, m_len;
-  unsigned long idx=0;
-  unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
-  unsigned char pkhash[XMSS_N];
-  unsigned char root[XMSS_N];
-  unsigned char msg_h[XMSS_N];
-  unsigned char hash_key[3*XMSS_N];
-
-  unsigned char pub_seed[XMSS_N];
-  memcpy(pub_seed, pk+XMSS_N, XMSS_N);
-
-  // Init addresses
-  uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
-  uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
-  uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
-
-  setType(ots_addr, 0);
-  setType(ltree_addr, 1);
-  setType(node_addr, 2);
-
-  // Extract index
-  idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3];
-  
-  // Generate hash key (R || root || idx)
-  memcpy(hash_key, sig_msg+4,XMSS_N);
-  memcpy(hash_key+XMSS_N, pk, XMSS_N);
-  to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
-  
-  sig_msg += (XMSS_N+4);
-  sig_msg_len -= (XMSS_N+4);
-
-  // hash message 
-  unsigned long long tmp_sig_len = XMSS_WOTS_KEYSIZE+XMSS_TREEHEIGHT*XMSS_N;
-  m_len = sig_msg_len - tmp_sig_len;
-  h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);
-
-  //-----------------------
-  // Verify signature
-  //-----------------------
-
-  // Prepare Address
-  setOTSADRS(ots_addr, idx);
-  // Check WOTS signature
-  wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);
-
-  sig_msg += XMSS_WOTS_KEYSIZE;
-  sig_msg_len -= XMSS_WOTS_KEYSIZE;
-
-  // Compute Ltree
-  setLtreeADRS(ltree_addr, idx);
-  l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
-
-  // Compute root
-  validate_authpath(root, pkhash, idx, sig_msg, pub_seed, node_addr);
-
-  sig_msg += XMSS_TREEHEIGHT*XMSS_N;
-  sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
-
-  for (i = 0; i < XMSS_N; i++)
-    if (root[i] != pk[i])
-      goto fail;
-
-  *msglen = sig_msg_len;
-  for (i = 0; i < *msglen; i++)
-    msg[i] = sig_msg[i];
-
-  return 0;
-
-
-fail:
-  *msglen = sig_msg_len;
-  for (i = 0; i < *msglen; i++)
-    msg[i] = 0;
-  *msglen = -1;
-  return -1;
-}
-
 /*
  * Generates a XMSSMT key pair for a given parameter set.
  * Format sk: [(ceil(h/8) bit) idx || SK_SEED || SK_PRF || PUB_SEED || root]
@@ -686,7 +485,7 @@ int xmssmt_keypair(unsigned char *pk, unsigned char *sk, bds_state *states, unsi
     // Compute seed for OTS key pair
     treehash_setup(pk, XMSS_TREEHEIGHT, 0, states + i, sk+XMSS_INDEX_LEN, pk+XMSS_N, addr);
     setLayerADRS(addr, (i+1));
-    get_seed(ots_seed, sk+XMSS_INDEX_LEN, XMSS_N, addr);
+    get_seed(ots_seed, sk+XMSS_INDEX_LEN, addr);
     wots_sign(wots_sigs + i*XMSS_WOTS_KEYSIZE, pk, ots_seed, pk+XMSS_N, addr);
   }
   // Address now points to the single tree on layer d-1
@@ -790,7 +589,7 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs,
   setOTSADRS(ots_addr, idx_leaf);
 
   // Compute seed for OTS key pair
-  get_seed(ots_seed, sk_seed, XMSS_N, ots_addr);
+  get_seed(ots_seed, sk_seed, ots_addr);
 
   // Compute WOTS signature
   wots_sign(sig_msg, msg_h, ots_seed, pub_seed, ots_addr);
@@ -853,7 +652,7 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs,
       setTreeADRS(ots_addr, ((idx + 1) >> ((i+2) * XMSS_TREEHEIGHT)));
       setOTSADRS(ots_addr, (((idx >> ((i+1) * XMSS_TREEHEIGHT)) + 1) & ((1 << XMSS_TREEHEIGHT)-1)));
 
-      get_seed(ots_seed, sk+XMSS_INDEX_LEN, XMSS_N, ots_addr);
+      get_seed(ots_seed, sk+XMSS_INDEX_LEN, ots_addr);
       wots_sign(wots_sigs + i*XMSS_WOTS_KEYSIZE, states[i].stack, ots_seed, pub_seed, ots_addr);
 
       states[XMSS_D + i].stackoffset = 0;
@@ -872,138 +671,3 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs,
 
   return 0;
 }
-
-/**
- * Verifies a given message signature pair under a given public key.
- */
-int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
-{
-  uint64_t idx_tree;
-  uint32_t idx_leaf;
-
-  unsigned long long i, m_len;
-  unsigned long long idx=0;
-  unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
-  unsigned char pkhash[XMSS_N];
-  unsigned char root[XMSS_N];
-  unsigned char msg_h[XMSS_N];
-  unsigned char hash_key[3*XMSS_N];
-
-  unsigned char pub_seed[XMSS_N];
-  memcpy(pub_seed, pk+XMSS_N, XMSS_N);
-
-  // Init addresses
-  uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
-  uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
-  uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
-
-  // Extract index
-  for (i = 0; i < XMSS_INDEX_LEN; i++) {
-    idx |= ((unsigned long long)sig_msg[i]) << (8*(XMSS_INDEX_LEN - 1 - i));
-  }
-  sig_msg += XMSS_INDEX_LEN;
-  sig_msg_len -= XMSS_INDEX_LEN;
-  
-  // Generate hash key (R || root || idx)
-  memcpy(hash_key, sig_msg,XMSS_N);
-  memcpy(hash_key+XMSS_N, pk, XMSS_N);
-  to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
-
-  sig_msg += XMSS_N;
-  sig_msg_len -= XMSS_N;
-  
-
-  // hash message (recall, R is now on pole position at sig_msg
-  unsigned long long tmp_sig_len = (XMSS_D * XMSS_WOTS_KEYSIZE) + (XMSS_FULLHEIGHT * XMSS_N);
-  m_len = sig_msg_len - tmp_sig_len;
-  h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);
-
-  
-  //-----------------------
-  // Verify signature
-  //-----------------------
-
-  // Prepare Address
-  idx_tree = idx >> XMSS_TREEHEIGHT;
-  idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1));
-  setLayerADRS(ots_addr, 0);
-  setTreeADRS(ots_addr, idx_tree);
-  setType(ots_addr, 0);
-
-  memcpy(ltree_addr, ots_addr, 12);
-  setType(ltree_addr, 1);
-
-  memcpy(node_addr, ltree_addr, 12);
-  setType(node_addr, 2);
-  
-  setOTSADRS(ots_addr, idx_leaf);
-
-  // Check WOTS signature
-  wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);
-
-  sig_msg += XMSS_WOTS_KEYSIZE;
-  sig_msg_len -= XMSS_WOTS_KEYSIZE;
-
-  // Compute Ltree
-  setLtreeADRS(ltree_addr, idx_leaf);
-  l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
-
-  // Compute root
-  validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);
-
-  sig_msg += XMSS_TREEHEIGHT*XMSS_N;
-  sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
-
-  for (i = 1; i < XMSS_D; i++) {
-    // Prepare Address
-    idx_leaf = (idx_tree & ((1 << XMSS_TREEHEIGHT)-1));
-    idx_tree = idx_tree >> XMSS_TREEHEIGHT;
-
-    setLayerADRS(ots_addr, i);
-    setTreeADRS(ots_addr, idx_tree);
-    setType(ots_addr, 0);
-
-    memcpy(ltree_addr, ots_addr, 12);
-    setType(ltree_addr, 1);
-
-    memcpy(node_addr, ltree_addr, 12);
-    setType(node_addr, 2);
-
-    setOTSADRS(ots_addr, idx_leaf);
-
-    // Check WOTS signature
-    wots_pkFromSig(wots_pk, sig_msg, root, pub_seed, ots_addr);
-
-    sig_msg += XMSS_WOTS_KEYSIZE;
-    sig_msg_len -= XMSS_WOTS_KEYSIZE;
-
-    // Compute Ltree
-    setLtreeADRS(ltree_addr, idx_leaf);
-    l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
-
-    // Compute root
-    validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);
-
-    sig_msg += XMSS_TREEHEIGHT*XMSS_N;
-    sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
-
-  }
-
-  for (i = 0; i < XMSS_N; i++)
-    if (root[i] != pk[i])
-      goto fail;
-
-  *msglen = sig_msg_len;
-  for (i = 0; i < *msglen; i++)
-    msg[i] = sig_msg[i];
-
-  return 0;
-
-
-fail:
-  *msglen = sig_msg_len;
-  for (i = 0; i < *msglen; i++)
-    msg[i] = 0;
-  *msglen = -1;
-  return -1;
-}