diff --git a/xmss.c b/xmss.c index e2dadf7..2e34e3b 100644 --- a/xmss.c +++ b/xmss.c @@ -22,78 +22,6 @@ Public domain. // For testing #include "stdio.h" -/** - * Used for pseudorandom keygeneration, - * generates the seed for the WOTS keypair at address addr - * - * takes XMSS_N byte sk_seed and returns XMSS_N byte seed using 32 byte address addr. - */ -static void get_seed(unsigned char *seed, const unsigned char *sk_seed, uint32_t addr[8]) -{ - unsigned char bytes[32]; - // Make sure that chain addr, hash addr, and key bit are 0! - setChainADRS(addr, 0); - setHashADRS(addr, 0); - setKeyAndMask(addr, 0); - // Generate pseudorandom value - addr_to_byte(bytes, addr); - prf(seed, bytes, sk_seed, XMSS_N); -} - -/** - * Computes a leaf from a WOTS public key using an L-tree. - */ -static void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8]) -{ - unsigned int l = XMSS_WOTS_LEN; - uint32_t i = 0; - uint32_t height = 0; - uint32_t bound; - - //ADRS.setTreeHeight(0); - setTreeHeight(addr, height); - - while (l > 1) { - bound = l >> 1; //floor(l / 2); - for (i = 0; i < bound; i++) { - //ADRS.setTreeIndex(i); - setTreeIndex(addr, i); - //wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS); - hash_h(wots_pk+i*XMSS_N, wots_pk+i*2*XMSS_N, pub_seed, addr, XMSS_N); - } - //if ( l % 2 == 1 ) { - if (l & 1) { - //pk[floor(l / 2) + 1] = pk[l]; - memcpy(wots_pk+(l>>1)*XMSS_N, wots_pk+(l-1)*XMSS_N, XMSS_N); - //l = ceil(l / 2); - l=(l>>1)+1; - } - else { - //l = ceil(l / 2); - l=(l>>1); - } - //ADRS.setTreeHeight(ADRS.getTreeHeight() + 1); - height++; - setTreeHeight(addr, height); - } - //return pk[0]; - memcpy(leaf, wots_pk, XMSS_N); -} - -/** - * Computes the leaf at a given address. First generates the WOTS key pair, then computes leaf using l_tree. As this happens position independent, we only require that addr encodes the right ltree-address. - */ -static void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8]) -{ - unsigned char seed[XMSS_N]; - unsigned char pk[XMSS_WOTS_KEYSIZE]; - - get_seed(seed, sk_seed, ots_addr); - wots_pkgen(pk, seed, pub_seed, ots_addr); - - l_tree(leaf, pk, pub_seed, ltree_addr); -} - /** * Merkle's TreeHash algorithm. The address only needs to initialize the first 78 bits of addr. Everything else will be set by treehash. * Currently only used for key generation. @@ -141,52 +69,6 @@ static void treehash(unsigned char *node, uint16_t height, uint32_t index, const node[i] = stack[i]; } -/** - * Computes a root node given a leaf and an authapth - */ -static void validate_authpath(unsigned char *root, const unsigned char *leaf, unsigned long leafidx, const unsigned char *authpath, const unsigned char *pub_seed, uint32_t addr[8]) -{ - uint32_t i, j; - unsigned char buffer[2*XMSS_N]; - - // If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left. - // Otherwise, it is the other way around - if (leafidx & 1) { - for (j = 0; j < XMSS_N; j++) - buffer[XMSS_N+j] = leaf[j]; - for (j = 0; j < XMSS_N; j++) - buffer[j] = authpath[j]; - } - else { - for (j = 0; j < XMSS_N; j++) - buffer[j] = leaf[j]; - for (j = 0; j < XMSS_N; j++) - buffer[XMSS_N+j] = authpath[j]; - } - authpath += XMSS_N; - - for (i=0; i < XMSS_TREEHEIGHT-1; i++) { - setTreeHeight(addr, i); - leafidx >>= 1; - setTreeIndex(addr, leafidx); - if (leafidx&1) { - hash_h(buffer+XMSS_N, buffer, pub_seed, addr, XMSS_N); - for (j = 0; j < XMSS_N; j++) - buffer[j] = authpath[j]; - } - else { - hash_h(buffer, buffer, pub_seed, addr, XMSS_N); - for (j = 0; j < XMSS_N; j++) - buffer[j+XMSS_N] = authpath[j]; - } - authpath += XMSS_N; - } - setTreeHeight(addr, (XMSS_TREEHEIGHT-1)); - leafidx >>= 1; - setTreeIndex(addr, leafidx); - hash_h(root, buffer, pub_seed, addr, XMSS_N); -} - /** * Computes the authpath and the root. This method is using a lot of space as we build the whole tree and then select the authpath nodes. * For more efficient algorithms see e.g. the chapter on hash-based signatures in Bernstein, Buchmann, Dahmen. "Post-quantum Cryptography", Springer 2009. @@ -369,91 +251,6 @@ int xmss_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *sig return 0; } -/** - * Verifies a given message signature pair under a given public key. - */ -int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk) -{ - - unsigned long long i, m_len; - unsigned long idx=0; - unsigned char wots_pk[XMSS_WOTS_KEYSIZE]; - unsigned char pkhash[XMSS_N]; - unsigned char root[XMSS_N]; - unsigned char msg_h[XMSS_N]; - unsigned char hash_key[3*XMSS_N]; - - unsigned char pub_seed[XMSS_N]; - memcpy(pub_seed, pk+XMSS_N, XMSS_N); - - // Init addresses - uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; - uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; - uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; - - setType(ots_addr, 0); - setType(ltree_addr, 1); - setType(node_addr, 2); - - // Extract index - idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3]; - printf("verify:: idx = %lu\n", idx); - - // Generate hash key (R || root || idx) - memcpy(hash_key, sig_msg+4,XMSS_N); - memcpy(hash_key+XMSS_N, pk, XMSS_N); - to_byte(hash_key+2*XMSS_N, idx, XMSS_N); - - sig_msg += (XMSS_N+4); - sig_msg_len -= (XMSS_N+4); - - - // hash message - unsigned long long tmp_sig_len = XMSS_WOTS_KEYSIZE+XMSS_TREEHEIGHT*XMSS_N; - m_len = sig_msg_len - tmp_sig_len; - h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N); - - //----------------------- - // Verify signature - //----------------------- - - // Prepare Address - setOTSADRS(ots_addr, idx); - // Check WOTS signature - wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr); - - sig_msg += XMSS_WOTS_KEYSIZE; - sig_msg_len -= XMSS_WOTS_KEYSIZE; - - // Compute Ltree - setLtreeADRS(ltree_addr, idx); - l_tree(pkhash, wots_pk, pub_seed, ltree_addr); - - // Compute root - validate_authpath(root, pkhash, idx, sig_msg, pub_seed, node_addr); - - sig_msg += XMSS_TREEHEIGHT*XMSS_N; - sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N; - - for (i=0; i < XMSS_N; i++) - if (root[i] != pk[i]) - goto fail; - - *msglen = sig_msg_len; - for (i=0; i < *msglen; i++) - msg[i] = sig_msg[i]; - - return 0; - - -fail: - *msglen = sig_msg_len; - for (i=0; i < *msglen; i++) - msg[i] = 0; - *msglen = -1; - return -1; -} - /* * Generates a XMSSMT key pair for a given parameter set. * Format sk: [(ceil(h/8) bit) idx || SK_SEED || SK_PRF || PUB_SEED] @@ -617,138 +414,3 @@ int xmssmt_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *s return 0; } - -/** - * Verifies a given message signature pair under a given public key. - */ -int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk) -{ - uint64_t idx_tree; - uint32_t idx_leaf; - - unsigned long long i, m_len; - unsigned long long idx=0; - unsigned char wots_pk[XMSS_WOTS_KEYSIZE]; - unsigned char pkhash[XMSS_N]; - unsigned char root[XMSS_N]; - unsigned char msg_h[XMSS_N]; - unsigned char hash_key[3*XMSS_N]; - - unsigned char pub_seed[XMSS_N]; - memcpy(pub_seed, pk+XMSS_N, XMSS_N); - - // Init addresses - uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; - uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; - uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; - - // Extract index - for (i = 0; i < XMSS_INDEX_LEN; i++) { - idx |= ((unsigned long long)sig_msg[i]) << (8*(XMSS_INDEX_LEN - 1 - i)); - } - printf("verify:: idx = %llu\n", idx); - sig_msg += XMSS_INDEX_LEN; - sig_msg_len -= XMSS_INDEX_LEN; - - // Generate hash key (R || root || idx) - memcpy(hash_key, sig_msg,XMSS_N); - memcpy(hash_key+XMSS_N, pk, XMSS_N); - to_byte(hash_key+2*XMSS_N, idx, XMSS_N); - - sig_msg += XMSS_N; - sig_msg_len -= XMSS_N; - - // hash message - unsigned long long tmp_sig_len = (XMSS_D * XMSS_WOTS_KEYSIZE) + (XMSS_FULLHEIGHT * XMSS_N); - m_len = sig_msg_len - tmp_sig_len; - h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N); - - - //----------------------- - // Verify signature - //----------------------- - - // Prepare Address - idx_tree = idx >> XMSS_TREEHEIGHT; - idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1)); - setLayerADRS(ots_addr, 0); - setTreeADRS(ots_addr, idx_tree); - setType(ots_addr, 0); - - memcpy(ltree_addr, ots_addr, 12); - setType(ltree_addr, 1); - - memcpy(node_addr, ltree_addr, 12); - setType(node_addr, 2); - - setOTSADRS(ots_addr, idx_leaf); - - // Check WOTS signature - wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr); - - sig_msg += XMSS_WOTS_KEYSIZE; - sig_msg_len -= XMSS_WOTS_KEYSIZE; - - // Compute Ltree - setLtreeADRS(ltree_addr, idx_leaf); - l_tree(pkhash, wots_pk, pub_seed, ltree_addr); - - // Compute root - validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr); - - sig_msg += XMSS_TREEHEIGHT*XMSS_N; - sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N; - - for (i = 1; i < XMSS_D; i++) { - // Prepare Address - idx_leaf = (idx_tree & ((1 << XMSS_TREEHEIGHT)-1)); - idx_tree = idx_tree >> XMSS_TREEHEIGHT; - - setLayerADRS(ots_addr, i); - setTreeADRS(ots_addr, idx_tree); - setType(ots_addr, 0); - - memcpy(ltree_addr, ots_addr, 12); - setType(ltree_addr, 1); - - memcpy(node_addr, ltree_addr, 12); - setType(node_addr, 2); - - setOTSADRS(ots_addr, idx_leaf); - - // Check WOTS signature - wots_pkFromSig(wots_pk, sig_msg, root, pub_seed, ots_addr); - - sig_msg += XMSS_WOTS_KEYSIZE; - sig_msg_len -= XMSS_WOTS_KEYSIZE; - - // Compute Ltree - setLtreeADRS(ltree_addr, idx_leaf); - l_tree(pkhash, wots_pk, pub_seed, ltree_addr); - - // Compute root - validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr); - - sig_msg += XMSS_TREEHEIGHT*XMSS_N; - sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N; - - } - - for (i=0; i < XMSS_N; i++) - if (root[i] != pk[i]) - goto fail; - - *msglen = sig_msg_len; - for (i=0; i < *msglen; i++) - msg[i] = sig_msg[i]; - - return 0; - - -fail: - *msglen = sig_msg_len; - for (i=0; i < *msglen; i++) - msg[i] = 0; - *msglen = -1; - return -1; -} \ No newline at end of file diff --git a/xmss_commons.c b/xmss_commons.c index 51171af..23a0dc0 100644 --- a/xmss_commons.c +++ b/xmss_commons.c @@ -6,10 +6,17 @@ Public domain. */ #include "xmss_commons.h" + #include +#include #include #include +#include "wots.h" +#include "hash.h" +#include "hash_address.h" +#include "params.h" + void to_byte(unsigned char *out, unsigned long long in, uint32_t bytes) { int32_t i; @@ -19,9 +26,340 @@ void to_byte(unsigned char *out, unsigned long long in, uint32_t bytes) } } -void hexdump(const unsigned char *a, size_t len) +/** + * Computes the leaf at a given address. First generates the WOTS key pair, then computes leaf using l_tree. As this happens position independent, we only require that addr encodes the right ltree-address. + */ +void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8]) +{ + unsigned char seed[XMSS_N]; + unsigned char pk[XMSS_WOTS_KEYSIZE]; + + get_seed(seed, sk_seed, ots_addr); + wots_pkgen(pk, seed, pub_seed, ots_addr); + + l_tree(leaf, pk, pub_seed, ltree_addr); +} + +/** + * Used for pseudorandom keygeneration, + * generates the seed for the WOTS keypair at address addr + * + * takes XMSS_N byte sk_seed and returns XMSS_N byte seed using 32 byte address addr. + */ +void get_seed(unsigned char *seed, const unsigned char *sk_seed, uint32_t addr[8]) +{ + unsigned char bytes[32]; + // Make sure that chain addr, hash addr, and key bit are 0! + setChainADRS(addr, 0); + setHashADRS(addr, 0); + setKeyAndMask(addr, 0); + // Generate pseudorandom value + addr_to_byte(bytes, addr); + prf(seed, bytes, sk_seed, XMSS_N); +} + +/** + * Computes a leaf from a WOTS public key using an L-tree. + */ +void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8]) +{ + unsigned int l = XMSS_WOTS_LEN; + uint32_t i = 0; + uint32_t height = 0; + uint32_t bound; + + //ADRS.setTreeHeight(0); + setTreeHeight(addr, height); + + while (l > 1) { + bound = l >> 1; //floor(l / 2); + for (i = 0; i < bound; i++) { + //ADRS.setTreeIndex(i); + setTreeIndex(addr, i); + //wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS); + hash_h(wots_pk+i*XMSS_N, wots_pk+i*2*XMSS_N, pub_seed, addr, XMSS_N); + } + //if ( l % 2 == 1 ) { + if (l & 1) { + //pk[floor(l / 2) + 1] = pk[l]; + memcpy(wots_pk+(l>>1)*XMSS_N, wots_pk+(l-1)*XMSS_N, XMSS_N); + //l = ceil(l / 2); + l=(l>>1)+1; + } + else { + //l = ceil(l / 2); + l=(l>>1); + } + //ADRS.setTreeHeight(ADRS.getTreeHeight() + 1); + height++; + setTreeHeight(addr, height); + } + //return pk[0]; + memcpy(leaf, wots_pk, XMSS_N); +} + +/** + * Computes a root node given a leaf and an authapth + */ +static void validate_authpath(unsigned char *root, const unsigned char *leaf, unsigned long leafidx, const unsigned char *authpath, const unsigned char *pub_seed, uint32_t addr[8]) +{ + uint32_t i, j; + unsigned char buffer[2*XMSS_N]; + + // If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left. + // Otherwise, it is the other way around + if (leafidx & 1) { + for (j = 0; j < XMSS_N; j++) + buffer[XMSS_N+j] = leaf[j]; + for (j = 0; j < XMSS_N; j++) + buffer[j] = authpath[j]; + } + else { + for (j = 0; j < XMSS_N; j++) + buffer[j] = leaf[j]; + for (j = 0; j < XMSS_N; j++) + buffer[XMSS_N+j] = authpath[j]; + } + authpath += XMSS_N; + + for (i=0; i < XMSS_TREEHEIGHT-1; i++) { + setTreeHeight(addr, i); + leafidx >>= 1; + setTreeIndex(addr, leafidx); + if (leafidx&1) { + hash_h(buffer+XMSS_N, buffer, pub_seed, addr, XMSS_N); + for (j = 0; j < XMSS_N; j++) + buffer[j] = authpath[j]; + } + else { + hash_h(buffer, buffer, pub_seed, addr, XMSS_N); + for (j = 0; j < XMSS_N; j++) + buffer[j+XMSS_N] = authpath[j]; + } + authpath += XMSS_N; + } + setTreeHeight(addr, (XMSS_TREEHEIGHT-1)); + leafidx >>= 1; + setTreeIndex(addr, leafidx); + hash_h(root, buffer, pub_seed, addr, XMSS_N); +} + +/** + * Verifies a given message signature pair under a given public key. + */ +int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk) { - size_t i; - for (i = 0; i < len; i++) - printf("%02x", a[i]); -} \ No newline at end of file + + unsigned long long i, m_len; + unsigned long idx=0; + unsigned char wots_pk[XMSS_WOTS_KEYSIZE]; + unsigned char pkhash[XMSS_N]; + unsigned char root[XMSS_N]; + unsigned char msg_h[XMSS_N]; + unsigned char hash_key[3*XMSS_N]; + + unsigned char pub_seed[XMSS_N]; + memcpy(pub_seed, pk+XMSS_N, XMSS_N); + + // Init addresses + uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; + uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; + uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; + + setType(ots_addr, 0); + setType(ltree_addr, 1); + setType(node_addr, 2); + + // Extract index + idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3]; + printf("verify:: idx = %lu\n", idx); + + // Generate hash key (R || root || idx) + memcpy(hash_key, sig_msg+4,XMSS_N); + memcpy(hash_key+XMSS_N, pk, XMSS_N); + to_byte(hash_key+2*XMSS_N, idx, XMSS_N); + + sig_msg += (XMSS_N+4); + sig_msg_len -= (XMSS_N+4); + + + // hash message + unsigned long long tmp_sig_len = XMSS_WOTS_KEYSIZE+XMSS_TREEHEIGHT*XMSS_N; + m_len = sig_msg_len - tmp_sig_len; + h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N); + + //----------------------- + // Verify signature + //----------------------- + + // Prepare Address + setOTSADRS(ots_addr, idx); + // Check WOTS signature + wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr); + + sig_msg += XMSS_WOTS_KEYSIZE; + sig_msg_len -= XMSS_WOTS_KEYSIZE; + + // Compute Ltree + setLtreeADRS(ltree_addr, idx); + l_tree(pkhash, wots_pk, pub_seed, ltree_addr); + + // Compute root + validate_authpath(root, pkhash, idx, sig_msg, pub_seed, node_addr); + + sig_msg += XMSS_TREEHEIGHT*XMSS_N; + sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N; + + for (i=0; i < XMSS_N; i++) + if (root[i] != pk[i]) + goto fail; + + *msglen = sig_msg_len; + for (i=0; i < *msglen; i++) + msg[i] = sig_msg[i]; + + return 0; + + +fail: + *msglen = sig_msg_len; + for (i=0; i < *msglen; i++) + msg[i] = 0; + *msglen = -1; + return -1; +} + +/** + * Verifies a given message signature pair under a given public key. + */ +int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk) +{ + uint64_t idx_tree; + uint32_t idx_leaf; + + unsigned long long i, m_len; + unsigned long long idx=0; + unsigned char wots_pk[XMSS_WOTS_KEYSIZE]; + unsigned char pkhash[XMSS_N]; + unsigned char root[XMSS_N]; + unsigned char msg_h[XMSS_N]; + unsigned char hash_key[3*XMSS_N]; + + unsigned char pub_seed[XMSS_N]; + memcpy(pub_seed, pk+XMSS_N, XMSS_N); + + // Init addresses + uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; + uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; + uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; + + // Extract index + for (i = 0; i < XMSS_INDEX_LEN; i++) { + idx |= ((unsigned long long)sig_msg[i]) << (8*(XMSS_INDEX_LEN - 1 - i)); + } + printf("verify:: idx = %llu\n", idx); + sig_msg += XMSS_INDEX_LEN; + sig_msg_len -= XMSS_INDEX_LEN; + + // Generate hash key (R || root || idx) + memcpy(hash_key, sig_msg,XMSS_N); + memcpy(hash_key+XMSS_N, pk, XMSS_N); + to_byte(hash_key+2*XMSS_N, idx, XMSS_N); + + sig_msg += XMSS_N; + sig_msg_len -= XMSS_N; + + // hash message + unsigned long long tmp_sig_len = (XMSS_D * XMSS_WOTS_KEYSIZE) + (XMSS_FULLHEIGHT * XMSS_N); + m_len = sig_msg_len - tmp_sig_len; + h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N); + + + //----------------------- + // Verify signature + //----------------------- + + // Prepare Address + idx_tree = idx >> XMSS_TREEHEIGHT; + idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1)); + setLayerADRS(ots_addr, 0); + setTreeADRS(ots_addr, idx_tree); + setType(ots_addr, 0); + + memcpy(ltree_addr, ots_addr, 12); + setType(ltree_addr, 1); + + memcpy(node_addr, ltree_addr, 12); + setType(node_addr, 2); + + setOTSADRS(ots_addr, idx_leaf); + + // Check WOTS signature + wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr); + + sig_msg += XMSS_WOTS_KEYSIZE; + sig_msg_len -= XMSS_WOTS_KEYSIZE; + + // Compute Ltree + setLtreeADRS(ltree_addr, idx_leaf); + l_tree(pkhash, wots_pk, pub_seed, ltree_addr); + + // Compute root + validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr); + + sig_msg += XMSS_TREEHEIGHT*XMSS_N; + sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N; + + for (i = 1; i < XMSS_D; i++) { + // Prepare Address + idx_leaf = (idx_tree & ((1 << XMSS_TREEHEIGHT)-1)); + idx_tree = idx_tree >> XMSS_TREEHEIGHT; + + setLayerADRS(ots_addr, i); + setTreeADRS(ots_addr, idx_tree); + setType(ots_addr, 0); + + memcpy(ltree_addr, ots_addr, 12); + setType(ltree_addr, 1); + + memcpy(node_addr, ltree_addr, 12); + setType(node_addr, 2); + + setOTSADRS(ots_addr, idx_leaf); + + // Check WOTS signature + wots_pkFromSig(wots_pk, sig_msg, root, pub_seed, ots_addr); + + sig_msg += XMSS_WOTS_KEYSIZE; + sig_msg_len -= XMSS_WOTS_KEYSIZE; + + // Compute Ltree + setLtreeADRS(ltree_addr, idx_leaf); + l_tree(pkhash, wots_pk, pub_seed, ltree_addr); + + // Compute root + validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr); + + sig_msg += XMSS_TREEHEIGHT*XMSS_N; + sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N; + + } + + for (i=0; i < XMSS_N; i++) + if (root[i] != pk[i]) + goto fail; + + *msglen = sig_msg_len; + for (i=0; i < *msglen; i++) + msg[i] = sig_msg[i]; + + return 0; + + +fail: + *msglen = sig_msg_len; + for (i=0; i < *msglen; i++) + msg[i] = 0; + *msglen = -1; + return -1; +} diff --git a/xmss_commons.h b/xmss_commons.h index 32fd4e2..313962c 100644 --- a/xmss_commons.h +++ b/xmss_commons.h @@ -12,4 +12,9 @@ Public domain. void to_byte(unsigned char *output, unsigned long long in, uint32_t bytes); void hexdump(const unsigned char *a, size_t len); -#endif \ No newline at end of file +void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8]); +void get_seed(unsigned char *seed, const unsigned char *sk_seed, uint32_t addr[8]); +void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8]); +int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk); +int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk); +#endif diff --git a/xmss_fast.c b/xmss_fast.c index 2dd8732..6fcb669 100644 --- a/xmss_fast.c +++ b/xmss_fast.c @@ -19,24 +19,6 @@ Public domain. #include "hash_address.h" #include "params.h" -/** - * Used for pseudorandom keygeneration, - * generates the seed for the WOTS keypair at address addr - * - * takes n byte sk_seed and returns n byte seed using 32 byte address addr. - */ -static void get_seed(unsigned char *seed, const unsigned char *sk_seed, int n, uint32_t addr[8]) -{ - unsigned char bytes[32]; - // Make sure that chain addr, hash addr, and key bit are 0! - setChainADRS(addr,0); - setHashADRS(addr,0); - setKeyAndMask(addr,0); - // Generate pseudorandom value - addr_to_byte(bytes, addr); - prf(seed, bytes, sk_seed, n); -} - /** * Initialize BDS state struct * parameter names are the same as used in the description of the BDS traversal @@ -53,61 +35,6 @@ void xmss_set_bds_state(bds_state *state, unsigned char *stack, int stackoffset, state->next_leaf = next_leaf; } -/** - * Computes a leaf from a WOTS public key using an L-tree. - */ -static void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8]) -{ - unsigned int l = XMSS_WOTS_LEN; - unsigned int n = XMSS_N; - uint32_t i = 0; - uint32_t height = 0; - uint32_t bound; - - //ADRS.setTreeHeight(0); - setTreeHeight(addr, height); - - while (l > 1) { - bound = l >> 1; //floor(l / 2); - for (i = 0; i < bound; i++) { - //ADRS.setTreeIndex(i); - setTreeIndex(addr, i); - //wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS); - hash_h(wots_pk+i*n, wots_pk+i*2*n, pub_seed, addr, n); - } - //if ( l % 2 == 1 ) { - if (l & 1) { - //pk[floor(l / 2) + 1] = pk[l]; - memcpy(wots_pk+(l>>1)*n, wots_pk+(l-1)*n, n); - //l = ceil(l / 2); - l=(l>>1)+1; - } - else { - //l = ceil(l / 2); - l=(l>>1); - } - //ADRS.setTreeHeight(ADRS.getTreeHeight() + 1); - height++; - setTreeHeight(addr, height); - } - //return pk[0]; - memcpy(leaf, wots_pk, n); -} - -/** - * Computes the leaf at a given address. First generates the WOTS key pair, then computes leaf using l_tree. As this happens position independent, we only require that addr encodes the right ltree-address. - */ -static void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8]) -{ - unsigned char seed[XMSS_N]; - unsigned char pk[XMSS_WOTS_KEYSIZE]; - - get_seed(seed, sk_seed, XMSS_N, ots_addr); - wots_pkgen(pk, seed, pub_seed, ots_addr); - - l_tree(leaf, pk, pub_seed, ltree_addr); -} - static int treehash_minheight_on_stack(bds_state* state, const treehash_inst *treehash) { unsigned int r = XMSS_TREEHEIGHT, i; for (i = 0; i < treehash->stackusage; i++) { @@ -233,52 +160,6 @@ static void treehash_update(treehash_inst *treehash, bds_state *state, const uns } } -/** - * Computes a root node given a leaf and an authapth - */ -static void validate_authpath(unsigned char *root, const unsigned char *leaf, unsigned long leafidx, const unsigned char *authpath, const unsigned char *pub_seed, uint32_t addr[8]) -{ - uint32_t i, j; - unsigned char buffer[2*XMSS_N]; - - // If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left. - // Otherwise, it is the other way around - if (leafidx & 1) { - for (j = 0; j < XMSS_N; j++) - buffer[XMSS_N+j] = leaf[j]; - for (j = 0; j < XMSS_N; j++) - buffer[j] = authpath[j]; - } - else { - for (j = 0; j < XMSS_N; j++) - buffer[j] = leaf[j]; - for (j = 0; j < XMSS_N; j++) - buffer[XMSS_N+j] = authpath[j]; - } - authpath += XMSS_N; - - for (i=0; i < XMSS_TREEHEIGHT-1; i++) { - setTreeHeight(addr, i); - leafidx >>= 1; - setTreeIndex(addr, leafidx); - if (leafidx&1) { - hash_h(buffer+XMSS_N, buffer, pub_seed, addr, XMSS_N); - for (j = 0; j < XMSS_N; j++) - buffer[j] = authpath[j]; - } - else { - hash_h(buffer, buffer, pub_seed, addr, XMSS_N); - for (j = 0; j < XMSS_N; j++) - buffer[j+XMSS_N] = authpath[j]; - } - authpath += XMSS_N; - } - setTreeHeight(addr, (XMSS_TREEHEIGHT-1)); - leafidx >>= 1; - setTreeIndex(addr, leafidx); - hash_h(root, buffer, pub_seed, addr, XMSS_N); -} - /** * Performs one treehash update on the instance that needs it the most. * Returns 1 if such an instance was not found @@ -553,7 +434,7 @@ int xmss_sign(unsigned char *sk, bds_state *state, unsigned char *sig_msg, unsig setOTSADRS(ots_addr, idx); // Compute seed for OTS key pair - get_seed(ots_seed, sk_seed, XMSS_N, ots_addr); + get_seed(ots_seed, sk_seed, ots_addr); // Compute WOTS signature wots_sign(sig_msg, msg_h, ots_seed, pub_seed, ots_addr); @@ -578,88 +459,6 @@ int xmss_sign(unsigned char *sk, bds_state *state, unsigned char *sig_msg, unsig return 0; } -/** - * Verifies a given message signature pair under a given public key. - */ -int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk) -{ - unsigned long long i, m_len; - unsigned long idx=0; - unsigned char wots_pk[XMSS_WOTS_KEYSIZE]; - unsigned char pkhash[XMSS_N]; - unsigned char root[XMSS_N]; - unsigned char msg_h[XMSS_N]; - unsigned char hash_key[3*XMSS_N]; - - unsigned char pub_seed[XMSS_N]; - memcpy(pub_seed, pk+XMSS_N, XMSS_N); - - // Init addresses - uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; - uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; - uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; - - setType(ots_addr, 0); - setType(ltree_addr, 1); - setType(node_addr, 2); - - // Extract index - idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3]; - - // Generate hash key (R || root || idx) - memcpy(hash_key, sig_msg+4,XMSS_N); - memcpy(hash_key+XMSS_N, pk, XMSS_N); - to_byte(hash_key+2*XMSS_N, idx, XMSS_N); - - sig_msg += (XMSS_N+4); - sig_msg_len -= (XMSS_N+4); - - // hash message - unsigned long long tmp_sig_len = XMSS_WOTS_KEYSIZE+XMSS_TREEHEIGHT*XMSS_N; - m_len = sig_msg_len - tmp_sig_len; - h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N); - - //----------------------- - // Verify signature - //----------------------- - - // Prepare Address - setOTSADRS(ots_addr, idx); - // Check WOTS signature - wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr); - - sig_msg += XMSS_WOTS_KEYSIZE; - sig_msg_len -= XMSS_WOTS_KEYSIZE; - - // Compute Ltree - setLtreeADRS(ltree_addr, idx); - l_tree(pkhash, wots_pk, pub_seed, ltree_addr); - - // Compute root - validate_authpath(root, pkhash, idx, sig_msg, pub_seed, node_addr); - - sig_msg += XMSS_TREEHEIGHT*XMSS_N; - sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N; - - for (i = 0; i < XMSS_N; i++) - if (root[i] != pk[i]) - goto fail; - - *msglen = sig_msg_len; - for (i = 0; i < *msglen; i++) - msg[i] = sig_msg[i]; - - return 0; - - -fail: - *msglen = sig_msg_len; - for (i = 0; i < *msglen; i++) - msg[i] = 0; - *msglen = -1; - return -1; -} - /* * Generates a XMSSMT key pair for a given parameter set. * Format sk: [(ceil(h/8) bit) idx || SK_SEED || SK_PRF || PUB_SEED || root] @@ -686,7 +485,7 @@ int xmssmt_keypair(unsigned char *pk, unsigned char *sk, bds_state *states, unsi // Compute seed for OTS key pair treehash_setup(pk, XMSS_TREEHEIGHT, 0, states + i, sk+XMSS_INDEX_LEN, pk+XMSS_N, addr); setLayerADRS(addr, (i+1)); - get_seed(ots_seed, sk+XMSS_INDEX_LEN, XMSS_N, addr); + get_seed(ots_seed, sk+XMSS_INDEX_LEN, addr); wots_sign(wots_sigs + i*XMSS_WOTS_KEYSIZE, pk, ots_seed, pk+XMSS_N, addr); } // Address now points to the single tree on layer d-1 @@ -790,7 +589,7 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs, setOTSADRS(ots_addr, idx_leaf); // Compute seed for OTS key pair - get_seed(ots_seed, sk_seed, XMSS_N, ots_addr); + get_seed(ots_seed, sk_seed, ots_addr); // Compute WOTS signature wots_sign(sig_msg, msg_h, ots_seed, pub_seed, ots_addr); @@ -853,7 +652,7 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs, setTreeADRS(ots_addr, ((idx + 1) >> ((i+2) * XMSS_TREEHEIGHT))); setOTSADRS(ots_addr, (((idx >> ((i+1) * XMSS_TREEHEIGHT)) + 1) & ((1 << XMSS_TREEHEIGHT)-1))); - get_seed(ots_seed, sk+XMSS_INDEX_LEN, XMSS_N, ots_addr); + get_seed(ots_seed, sk+XMSS_INDEX_LEN, ots_addr); wots_sign(wots_sigs + i*XMSS_WOTS_KEYSIZE, states[i].stack, ots_seed, pub_seed, ots_addr); states[XMSS_D + i].stackoffset = 0; @@ -872,138 +671,3 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs, return 0; } - -/** - * Verifies a given message signature pair under a given public key. - */ -int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk) -{ - uint64_t idx_tree; - uint32_t idx_leaf; - - unsigned long long i, m_len; - unsigned long long idx=0; - unsigned char wots_pk[XMSS_WOTS_KEYSIZE]; - unsigned char pkhash[XMSS_N]; - unsigned char root[XMSS_N]; - unsigned char msg_h[XMSS_N]; - unsigned char hash_key[3*XMSS_N]; - - unsigned char pub_seed[XMSS_N]; - memcpy(pub_seed, pk+XMSS_N, XMSS_N); - - // Init addresses - uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; - uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; - uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0}; - - // Extract index - for (i = 0; i < XMSS_INDEX_LEN; i++) { - idx |= ((unsigned long long)sig_msg[i]) << (8*(XMSS_INDEX_LEN - 1 - i)); - } - sig_msg += XMSS_INDEX_LEN; - sig_msg_len -= XMSS_INDEX_LEN; - - // Generate hash key (R || root || idx) - memcpy(hash_key, sig_msg,XMSS_N); - memcpy(hash_key+XMSS_N, pk, XMSS_N); - to_byte(hash_key+2*XMSS_N, idx, XMSS_N); - - sig_msg += XMSS_N; - sig_msg_len -= XMSS_N; - - - // hash message (recall, R is now on pole position at sig_msg - unsigned long long tmp_sig_len = (XMSS_D * XMSS_WOTS_KEYSIZE) + (XMSS_FULLHEIGHT * XMSS_N); - m_len = sig_msg_len - tmp_sig_len; - h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N); - - - //----------------------- - // Verify signature - //----------------------- - - // Prepare Address - idx_tree = idx >> XMSS_TREEHEIGHT; - idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1)); - setLayerADRS(ots_addr, 0); - setTreeADRS(ots_addr, idx_tree); - setType(ots_addr, 0); - - memcpy(ltree_addr, ots_addr, 12); - setType(ltree_addr, 1); - - memcpy(node_addr, ltree_addr, 12); - setType(node_addr, 2); - - setOTSADRS(ots_addr, idx_leaf); - - // Check WOTS signature - wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr); - - sig_msg += XMSS_WOTS_KEYSIZE; - sig_msg_len -= XMSS_WOTS_KEYSIZE; - - // Compute Ltree - setLtreeADRS(ltree_addr, idx_leaf); - l_tree(pkhash, wots_pk, pub_seed, ltree_addr); - - // Compute root - validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr); - - sig_msg += XMSS_TREEHEIGHT*XMSS_N; - sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N; - - for (i = 1; i < XMSS_D; i++) { - // Prepare Address - idx_leaf = (idx_tree & ((1 << XMSS_TREEHEIGHT)-1)); - idx_tree = idx_tree >> XMSS_TREEHEIGHT; - - setLayerADRS(ots_addr, i); - setTreeADRS(ots_addr, idx_tree); - setType(ots_addr, 0); - - memcpy(ltree_addr, ots_addr, 12); - setType(ltree_addr, 1); - - memcpy(node_addr, ltree_addr, 12); - setType(node_addr, 2); - - setOTSADRS(ots_addr, idx_leaf); - - // Check WOTS signature - wots_pkFromSig(wots_pk, sig_msg, root, pub_seed, ots_addr); - - sig_msg += XMSS_WOTS_KEYSIZE; - sig_msg_len -= XMSS_WOTS_KEYSIZE; - - // Compute Ltree - setLtreeADRS(ltree_addr, idx_leaf); - l_tree(pkhash, wots_pk, pub_seed, ltree_addr); - - // Compute root - validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr); - - sig_msg += XMSS_TREEHEIGHT*XMSS_N; - sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N; - - } - - for (i = 0; i < XMSS_N; i++) - if (root[i] != pk[i]) - goto fail; - - *msglen = sig_msg_len; - for (i = 0; i < *msglen; i++) - msg[i] = sig_msg[i]; - - return 0; - - -fail: - *msglen = sig_msg_len; - for (i = 0; i < *msglen; i++) - msg[i] = 0; - *msglen = -1; - return -1; -} \ No newline at end of file