kris
/
xmss-KAT-generator
1
0
Fork 0
Code Issues 0 Pull Requests 0 Releases 0 Wiki Activity
Browse Source

Reduce code duplication 

A large number of functions was repeated in xmss_fast; these are now
shared between the two implementations via the xmss_commons file.
Notably, we ensure compatability by sharing the verification functions.
master
Joost Rijneveld 7 years ago
parent
1e00c92c18
commit
5122ac6f73
No known key found for this signature in database GPG Key ID: 307BC77F47D58EE2
4 changed files with 353 additions and 684 deletions
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. +0
    -338
      xmss.c
  2. +343
    -5
      xmss_commons.c
  3. +6
    -1
      xmss_commons.h
  4. +4
    -340
      xmss_fast.c

+ 0
- 338
xmss.c View File

@@ -22,78 +22,6 @@ Public domain.
// For testing // For testing
#include "stdio.h" #include "stdio.h"


/**
* Used for pseudorandom keygeneration,
* generates the seed for the WOTS keypair at address addr
*
* takes XMSS_N byte sk_seed and returns XMSS_N byte seed using 32 byte address addr.
*/
static void get_seed(unsigned char *seed, const unsigned char *sk_seed, uint32_t addr[8])
{
unsigned char bytes[32];
// Make sure that chain addr, hash addr, and key bit are 0!
setChainADRS(addr, 0);
setHashADRS(addr, 0);
setKeyAndMask(addr, 0);
// Generate pseudorandom value
addr_to_byte(bytes, addr);
prf(seed, bytes, sk_seed, XMSS_N);
}

/**
* Computes a leaf from a WOTS public key using an L-tree.
*/
static void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8])
{
unsigned int l = XMSS_WOTS_LEN;
uint32_t i = 0;
uint32_t height = 0;
uint32_t bound;

//ADRS.setTreeHeight(0);
setTreeHeight(addr, height);

while (l > 1) {
bound = l >> 1; //floor(l / 2);
for (i = 0; i < bound; i++) {
//ADRS.setTreeIndex(i);
setTreeIndex(addr, i);
//wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS);
hash_h(wots_pk+i*XMSS_N, wots_pk+i*2*XMSS_N, pub_seed, addr, XMSS_N);
}
//if ( l % 2 == 1 ) {
if (l & 1) {
//pk[floor(l / 2) + 1] = pk[l];
memcpy(wots_pk+(l>>1)*XMSS_N, wots_pk+(l-1)*XMSS_N, XMSS_N);
//l = ceil(l / 2);
l=(l>>1)+1;
}
else {
//l = ceil(l / 2);
l=(l>>1);
}
//ADRS.setTreeHeight(ADRS.getTreeHeight() + 1);
height++;
setTreeHeight(addr, height);
}
//return pk[0];
memcpy(leaf, wots_pk, XMSS_N);
}

/**
* Computes the leaf at a given address. First generates the WOTS key pair, then computes leaf using l_tree. As this happens position independent, we only require that addr encodes the right ltree-address.
*/
static void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8])
{
unsigned char seed[XMSS_N];
unsigned char pk[XMSS_WOTS_KEYSIZE];

get_seed(seed, sk_seed, ots_addr);
wots_pkgen(pk, seed, pub_seed, ots_addr);

l_tree(leaf, pk, pub_seed, ltree_addr);
}

/** /**
* Merkle's TreeHash algorithm. The address only needs to initialize the first 78 bits of addr. Everything else will be set by treehash. * Merkle's TreeHash algorithm. The address only needs to initialize the first 78 bits of addr. Everything else will be set by treehash.
* Currently only used for key generation. * Currently only used for key generation.
@@ -141,52 +69,6 @@ static void treehash(unsigned char *node, uint16_t height, uint32_t index, const
node[i] = stack[i]; node[i] = stack[i];
} }


/**
* Computes a root node given a leaf and an authapth
*/
static void validate_authpath(unsigned char *root, const unsigned char *leaf, unsigned long leafidx, const unsigned char *authpath, const unsigned char *pub_seed, uint32_t addr[8])
{
uint32_t i, j;
unsigned char buffer[2*XMSS_N];

// If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left.
// Otherwise, it is the other way around
if (leafidx & 1) {
for (j = 0; j < XMSS_N; j++)
buffer[XMSS_N+j] = leaf[j];
for (j = 0; j < XMSS_N; j++)
buffer[j] = authpath[j];
}
else {
for (j = 0; j < XMSS_N; j++)
buffer[j] = leaf[j];
for (j = 0; j < XMSS_N; j++)
buffer[XMSS_N+j] = authpath[j];
}
authpath += XMSS_N;

for (i=0; i < XMSS_TREEHEIGHT-1; i++) {
setTreeHeight(addr, i);
leafidx >>= 1;
setTreeIndex(addr, leafidx);
if (leafidx&1) {
hash_h(buffer+XMSS_N, buffer, pub_seed, addr, XMSS_N);
for (j = 0; j < XMSS_N; j++)
buffer[j] = authpath[j];
}
else {
hash_h(buffer, buffer, pub_seed, addr, XMSS_N);
for (j = 0; j < XMSS_N; j++)
buffer[j+XMSS_N] = authpath[j];
}
authpath += XMSS_N;
}
setTreeHeight(addr, (XMSS_TREEHEIGHT-1));
leafidx >>= 1;
setTreeIndex(addr, leafidx);
hash_h(root, buffer, pub_seed, addr, XMSS_N);
}

/** /**
* Computes the authpath and the root. This method is using a lot of space as we build the whole tree and then select the authpath nodes. * Computes the authpath and the root. This method is using a lot of space as we build the whole tree and then select the authpath nodes.
* For more efficient algorithms see e.g. the chapter on hash-based signatures in Bernstein, Buchmann, Dahmen. "Post-quantum Cryptography", Springer 2009. * For more efficient algorithms see e.g. the chapter on hash-based signatures in Bernstein, Buchmann, Dahmen. "Post-quantum Cryptography", Springer 2009.
@@ -369,91 +251,6 @@ int xmss_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *sig
return 0; return 0;
} }


/**
* Verifies a given message signature pair under a given public key.
*/
int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
{
unsigned long long i, m_len;
unsigned long idx=0;
unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
unsigned char pkhash[XMSS_N];
unsigned char root[XMSS_N];
unsigned char msg_h[XMSS_N];
unsigned char hash_key[3*XMSS_N];

unsigned char pub_seed[XMSS_N];
memcpy(pub_seed, pk+XMSS_N, XMSS_N);

// Init addresses
uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

setType(ots_addr, 0);
setType(ltree_addr, 1);
setType(node_addr, 2);
// Extract index
idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3];
printf("verify:: idx = %lu\n", idx);
// Generate hash key (R || root || idx)
memcpy(hash_key, sig_msg+4,XMSS_N);
memcpy(hash_key+XMSS_N, pk, XMSS_N);
to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
sig_msg += (XMSS_N+4);
sig_msg_len -= (XMSS_N+4);

// hash message
unsigned long long tmp_sig_len = XMSS_WOTS_KEYSIZE+XMSS_TREEHEIGHT*XMSS_N;
m_len = sig_msg_len - tmp_sig_len;
h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);
//-----------------------
// Verify signature
//-----------------------

// Prepare Address
setOTSADRS(ots_addr, idx);
// Check WOTS signature
wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);

sig_msg += XMSS_WOTS_KEYSIZE;
sig_msg_len -= XMSS_WOTS_KEYSIZE;

// Compute Ltree
setLtreeADRS(ltree_addr, idx);
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);

// Compute root
validate_authpath(root, pkhash, idx, sig_msg, pub_seed, node_addr);

sig_msg += XMSS_TREEHEIGHT*XMSS_N;
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;

for (i=0; i < XMSS_N; i++)
if (root[i] != pk[i])
goto fail;

*msglen = sig_msg_len;
for (i=0; i < *msglen; i++)
msg[i] = sig_msg[i];

return 0;


fail:
*msglen = sig_msg_len;
for (i=0; i < *msglen; i++)
msg[i] = 0;
*msglen = -1;
return -1;
}

/* /*
* Generates a XMSSMT key pair for a given parameter set. * Generates a XMSSMT key pair for a given parameter set.
* Format sk: [(ceil(h/8) bit) idx || SK_SEED || SK_PRF || PUB_SEED] * Format sk: [(ceil(h/8) bit) idx || SK_SEED || SK_PRF || PUB_SEED]
@@ -617,138 +414,3 @@ int xmssmt_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *s


return 0; return 0;
} }

/**
* Verifies a given message signature pair under a given public key.
*/
int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
{
uint64_t idx_tree;
uint32_t idx_leaf;

unsigned long long i, m_len;
unsigned long long idx=0;
unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
unsigned char pkhash[XMSS_N];
unsigned char root[XMSS_N];
unsigned char msg_h[XMSS_N];
unsigned char hash_key[3*XMSS_N];

unsigned char pub_seed[XMSS_N];
memcpy(pub_seed, pk+XMSS_N, XMSS_N);

// Init addresses
uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

// Extract index
for (i = 0; i < XMSS_INDEX_LEN; i++) {
idx |= ((unsigned long long)sig_msg[i]) << (8*(XMSS_INDEX_LEN - 1 - i));
}
printf("verify:: idx = %llu\n", idx);
sig_msg += XMSS_INDEX_LEN;
sig_msg_len -= XMSS_INDEX_LEN;

// Generate hash key (R || root || idx)
memcpy(hash_key, sig_msg,XMSS_N);
memcpy(hash_key+XMSS_N, pk, XMSS_N);
to_byte(hash_key+2*XMSS_N, idx, XMSS_N);

sig_msg += XMSS_N;
sig_msg_len -= XMSS_N;
// hash message
unsigned long long tmp_sig_len = (XMSS_D * XMSS_WOTS_KEYSIZE) + (XMSS_FULLHEIGHT * XMSS_N);
m_len = sig_msg_len - tmp_sig_len;
h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);


//-----------------------
// Verify signature
//-----------------------

// Prepare Address
idx_tree = idx >> XMSS_TREEHEIGHT;
idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1));
setLayerADRS(ots_addr, 0);
setTreeADRS(ots_addr, idx_tree);
setType(ots_addr, 0);

memcpy(ltree_addr, ots_addr, 12);
setType(ltree_addr, 1);

memcpy(node_addr, ltree_addr, 12);
setType(node_addr, 2);
setOTSADRS(ots_addr, idx_leaf);

// Check WOTS signature
wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);

sig_msg += XMSS_WOTS_KEYSIZE;
sig_msg_len -= XMSS_WOTS_KEYSIZE;

// Compute Ltree
setLtreeADRS(ltree_addr, idx_leaf);
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);

// Compute root
validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);

sig_msg += XMSS_TREEHEIGHT*XMSS_N;
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;

for (i = 1; i < XMSS_D; i++) {
// Prepare Address
idx_leaf = (idx_tree & ((1 << XMSS_TREEHEIGHT)-1));
idx_tree = idx_tree >> XMSS_TREEHEIGHT;

setLayerADRS(ots_addr, i);
setTreeADRS(ots_addr, idx_tree);
setType(ots_addr, 0);

memcpy(ltree_addr, ots_addr, 12);
setType(ltree_addr, 1);

memcpy(node_addr, ltree_addr, 12);
setType(node_addr, 2);

setOTSADRS(ots_addr, idx_leaf);

// Check WOTS signature
wots_pkFromSig(wots_pk, sig_msg, root, pub_seed, ots_addr);

sig_msg += XMSS_WOTS_KEYSIZE;
sig_msg_len -= XMSS_WOTS_KEYSIZE;

// Compute Ltree
setLtreeADRS(ltree_addr, idx_leaf);
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);

// Compute root
validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);

sig_msg += XMSS_TREEHEIGHT*XMSS_N;
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;

}

for (i=0; i < XMSS_N; i++)
if (root[i] != pk[i])
goto fail;

*msglen = sig_msg_len;
for (i=0; i < *msglen; i++)
msg[i] = sig_msg[i];

return 0;


fail:
*msglen = sig_msg_len;
for (i=0; i < *msglen; i++)
msg[i] = 0;
*msglen = -1;
return -1;
}

+ 343
- 5
xmss_commons.c View File

@@ -6,10 +6,17 @@ Public domain.
*/ */


#include "xmss_commons.h" #include "xmss_commons.h"

#include <stdlib.h> #include <stdlib.h>
#include <string.h>
#include <stdio.h> #include <stdio.h>
#include <stdint.h> #include <stdint.h>


#include "wots.h"
#include "hash.h"
#include "hash_address.h"
#include "params.h"

void to_byte(unsigned char *out, unsigned long long in, uint32_t bytes) void to_byte(unsigned char *out, unsigned long long in, uint32_t bytes)
{ {
int32_t i; int32_t i;
@@ -19,9 +26,340 @@ void to_byte(unsigned char *out, unsigned long long in, uint32_t bytes)
} }
} }


void hexdump(const unsigned char *a, size_t len)
/**
* Computes the leaf at a given address. First generates the WOTS key pair, then computes leaf using l_tree. As this happens position independent, we only require that addr encodes the right ltree-address.
*/
void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8])
{
unsigned char seed[XMSS_N];
unsigned char pk[XMSS_WOTS_KEYSIZE];

get_seed(seed, sk_seed, ots_addr);
wots_pkgen(pk, seed, pub_seed, ots_addr);

l_tree(leaf, pk, pub_seed, ltree_addr);
}

/**
* Used for pseudorandom keygeneration,
* generates the seed for the WOTS keypair at address addr
*
* takes XMSS_N byte sk_seed and returns XMSS_N byte seed using 32 byte address addr.
*/
void get_seed(unsigned char *seed, const unsigned char *sk_seed, uint32_t addr[8])
{
unsigned char bytes[32];
// Make sure that chain addr, hash addr, and key bit are 0!
setChainADRS(addr, 0);
setHashADRS(addr, 0);
setKeyAndMask(addr, 0);
// Generate pseudorandom value
addr_to_byte(bytes, addr);
prf(seed, bytes, sk_seed, XMSS_N);
}

/**
* Computes a leaf from a WOTS public key using an L-tree.
*/
void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8])
{
unsigned int l = XMSS_WOTS_LEN;
uint32_t i = 0;
uint32_t height = 0;
uint32_t bound;

//ADRS.setTreeHeight(0);
setTreeHeight(addr, height);

while (l > 1) {
bound = l >> 1; //floor(l / 2);
for (i = 0; i < bound; i++) {
//ADRS.setTreeIndex(i);
setTreeIndex(addr, i);
//wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS);
hash_h(wots_pk+i*XMSS_N, wots_pk+i*2*XMSS_N, pub_seed, addr, XMSS_N);
}
//if ( l % 2 == 1 ) {
if (l & 1) {
//pk[floor(l / 2) + 1] = pk[l];
memcpy(wots_pk+(l>>1)*XMSS_N, wots_pk+(l-1)*XMSS_N, XMSS_N);
//l = ceil(l / 2);
l=(l>>1)+1;
}
else {
//l = ceil(l / 2);
l=(l>>1);
}
//ADRS.setTreeHeight(ADRS.getTreeHeight() + 1);
height++;
setTreeHeight(addr, height);
}
//return pk[0];
memcpy(leaf, wots_pk, XMSS_N);
}

/**
* Computes a root node given a leaf and an authapth
*/
static void validate_authpath(unsigned char *root, const unsigned char *leaf, unsigned long leafidx, const unsigned char *authpath, const unsigned char *pub_seed, uint32_t addr[8])
{
uint32_t i, j;
unsigned char buffer[2*XMSS_N];

// If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left.
// Otherwise, it is the other way around
if (leafidx & 1) {
for (j = 0; j < XMSS_N; j++)
buffer[XMSS_N+j] = leaf[j];
for (j = 0; j < XMSS_N; j++)
buffer[j] = authpath[j];
}
else {
for (j = 0; j < XMSS_N; j++)
buffer[j] = leaf[j];
for (j = 0; j < XMSS_N; j++)
buffer[XMSS_N+j] = authpath[j];
}
authpath += XMSS_N;

for (i=0; i < XMSS_TREEHEIGHT-1; i++) {
setTreeHeight(addr, i);
leafidx >>= 1;
setTreeIndex(addr, leafidx);
if (leafidx&1) {
hash_h(buffer+XMSS_N, buffer, pub_seed, addr, XMSS_N);
for (j = 0; j < XMSS_N; j++)
buffer[j] = authpath[j];
}
else {
hash_h(buffer, buffer, pub_seed, addr, XMSS_N);
for (j = 0; j < XMSS_N; j++)
buffer[j+XMSS_N] = authpath[j];
}
authpath += XMSS_N;
}
setTreeHeight(addr, (XMSS_TREEHEIGHT-1));
leafidx >>= 1;
setTreeIndex(addr, leafidx);
hash_h(root, buffer, pub_seed, addr, XMSS_N);
}

/**
* Verifies a given message signature pair under a given public key.
*/
int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
{ {
size_t i;
for (i = 0; i < len; i++)
printf("%02x", a[i]);
}
unsigned long long i, m_len;
unsigned long idx=0;
unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
unsigned char pkhash[XMSS_N];
unsigned char root[XMSS_N];
unsigned char msg_h[XMSS_N];
unsigned char hash_key[3*XMSS_N];

unsigned char pub_seed[XMSS_N];
memcpy(pub_seed, pk+XMSS_N, XMSS_N);

// Init addresses
uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

setType(ots_addr, 0);
setType(ltree_addr, 1);
setType(node_addr, 2);
// Extract index
idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3];
printf("verify:: idx = %lu\n", idx);
// Generate hash key (R || root || idx)
memcpy(hash_key, sig_msg+4,XMSS_N);
memcpy(hash_key+XMSS_N, pk, XMSS_N);
to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
sig_msg += (XMSS_N+4);
sig_msg_len -= (XMSS_N+4);

// hash message
unsigned long long tmp_sig_len = XMSS_WOTS_KEYSIZE+XMSS_TREEHEIGHT*XMSS_N;
m_len = sig_msg_len - tmp_sig_len;
h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);
//-----------------------
// Verify signature
//-----------------------

// Prepare Address
setOTSADRS(ots_addr, idx);
// Check WOTS signature
wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);

sig_msg += XMSS_WOTS_KEYSIZE;
sig_msg_len -= XMSS_WOTS_KEYSIZE;

// Compute Ltree
setLtreeADRS(ltree_addr, idx);
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);

// Compute root
validate_authpath(root, pkhash, idx, sig_msg, pub_seed, node_addr);

sig_msg += XMSS_TREEHEIGHT*XMSS_N;
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;

for (i=0; i < XMSS_N; i++)
if (root[i] != pk[i])
goto fail;

*msglen = sig_msg_len;
for (i=0; i < *msglen; i++)
msg[i] = sig_msg[i];

return 0;


fail:
*msglen = sig_msg_len;
for (i=0; i < *msglen; i++)
msg[i] = 0;
*msglen = -1;
return -1;
}

/**
* Verifies a given message signature pair under a given public key.
*/
int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
{
uint64_t idx_tree;
uint32_t idx_leaf;

unsigned long long i, m_len;
unsigned long long idx=0;
unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
unsigned char pkhash[XMSS_N];
unsigned char root[XMSS_N];
unsigned char msg_h[XMSS_N];
unsigned char hash_key[3*XMSS_N];

unsigned char pub_seed[XMSS_N];
memcpy(pub_seed, pk+XMSS_N, XMSS_N);

// Init addresses
uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

// Extract index
for (i = 0; i < XMSS_INDEX_LEN; i++) {
idx |= ((unsigned long long)sig_msg[i]) << (8*(XMSS_INDEX_LEN - 1 - i));
}
printf("verify:: idx = %llu\n", idx);
sig_msg += XMSS_INDEX_LEN;
sig_msg_len -= XMSS_INDEX_LEN;

// Generate hash key (R || root || idx)
memcpy(hash_key, sig_msg,XMSS_N);
memcpy(hash_key+XMSS_N, pk, XMSS_N);
to_byte(hash_key+2*XMSS_N, idx, XMSS_N);

sig_msg += XMSS_N;
sig_msg_len -= XMSS_N;
// hash message
unsigned long long tmp_sig_len = (XMSS_D * XMSS_WOTS_KEYSIZE) + (XMSS_FULLHEIGHT * XMSS_N);
m_len = sig_msg_len - tmp_sig_len;
h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);


//-----------------------
// Verify signature
//-----------------------

// Prepare Address
idx_tree = idx >> XMSS_TREEHEIGHT;
idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1));
setLayerADRS(ots_addr, 0);
setTreeADRS(ots_addr, idx_tree);
setType(ots_addr, 0);

memcpy(ltree_addr, ots_addr, 12);
setType(ltree_addr, 1);

memcpy(node_addr, ltree_addr, 12);
setType(node_addr, 2);
setOTSADRS(ots_addr, idx_leaf);

// Check WOTS signature
wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);

sig_msg += XMSS_WOTS_KEYSIZE;
sig_msg_len -= XMSS_WOTS_KEYSIZE;

// Compute Ltree
setLtreeADRS(ltree_addr, idx_leaf);
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);

// Compute root
validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);

sig_msg += XMSS_TREEHEIGHT*XMSS_N;
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;

for (i = 1; i < XMSS_D; i++) {
// Prepare Address
idx_leaf = (idx_tree & ((1 << XMSS_TREEHEIGHT)-1));
idx_tree = idx_tree >> XMSS_TREEHEIGHT;

setLayerADRS(ots_addr, i);
setTreeADRS(ots_addr, idx_tree);
setType(ots_addr, 0);

memcpy(ltree_addr, ots_addr, 12);
setType(ltree_addr, 1);

memcpy(node_addr, ltree_addr, 12);
setType(node_addr, 2);

setOTSADRS(ots_addr, idx_leaf);

// Check WOTS signature
wots_pkFromSig(wots_pk, sig_msg, root, pub_seed, ots_addr);

sig_msg += XMSS_WOTS_KEYSIZE;
sig_msg_len -= XMSS_WOTS_KEYSIZE;

// Compute Ltree
setLtreeADRS(ltree_addr, idx_leaf);
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);

// Compute root
validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);

sig_msg += XMSS_TREEHEIGHT*XMSS_N;
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;

}

for (i=0; i < XMSS_N; i++)
if (root[i] != pk[i])
goto fail;

*msglen = sig_msg_len;
for (i=0; i < *msglen; i++)
msg[i] = sig_msg[i];

return 0;


fail:
*msglen = sig_msg_len;
for (i=0; i < *msglen; i++)
msg[i] = 0;
*msglen = -1;
return -1;
}

+ 6
- 1
xmss_commons.h View File

@@ -12,4 +12,9 @@ Public domain.


void to_byte(unsigned char *output, unsigned long long in, uint32_t bytes); void to_byte(unsigned char *output, unsigned long long in, uint32_t bytes);
void hexdump(const unsigned char *a, size_t len); void hexdump(const unsigned char *a, size_t len);
#endif
void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8]);
void get_seed(unsigned char *seed, const unsigned char *sk_seed, uint32_t addr[8]);
void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8]);
int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk);
int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk);
#endif

+ 4
- 340
xmss_fast.c View File

@@ -19,24 +19,6 @@ Public domain.
#include "hash_address.h" #include "hash_address.h"
#include "params.h" #include "params.h"


/**
* Used for pseudorandom keygeneration,
* generates the seed for the WOTS keypair at address addr
*
* takes n byte sk_seed and returns n byte seed using 32 byte address addr.
*/
static void get_seed(unsigned char *seed, const unsigned char *sk_seed, int n, uint32_t addr[8])
{
unsigned char bytes[32];
// Make sure that chain addr, hash addr, and key bit are 0!
setChainADRS(addr,0);
setHashADRS(addr,0);
setKeyAndMask(addr,0);
// Generate pseudorandom value
addr_to_byte(bytes, addr);
prf(seed, bytes, sk_seed, n);
}

/** /**
* Initialize BDS state struct * Initialize BDS state struct
* parameter names are the same as used in the description of the BDS traversal * parameter names are the same as used in the description of the BDS traversal
@@ -53,61 +35,6 @@ void xmss_set_bds_state(bds_state *state, unsigned char *stack, int stackoffset,
state->next_leaf = next_leaf; state->next_leaf = next_leaf;
} }


/**
* Computes a leaf from a WOTS public key using an L-tree.
*/
static void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8])
{
unsigned int l = XMSS_WOTS_LEN;
unsigned int n = XMSS_N;
uint32_t i = 0;
uint32_t height = 0;
uint32_t bound;

//ADRS.setTreeHeight(0);
setTreeHeight(addr, height);
while (l > 1) {
bound = l >> 1; //floor(l / 2);
for (i = 0; i < bound; i++) {
//ADRS.setTreeIndex(i);
setTreeIndex(addr, i);
//wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS);
hash_h(wots_pk+i*n, wots_pk+i*2*n, pub_seed, addr, n);
}
//if ( l % 2 == 1 ) {
if (l & 1) {
//pk[floor(l / 2) + 1] = pk[l];
memcpy(wots_pk+(l>>1)*n, wots_pk+(l-1)*n, n);
//l = ceil(l / 2);
l=(l>>1)+1;
}
else {
//l = ceil(l / 2);
l=(l>>1);
}
//ADRS.setTreeHeight(ADRS.getTreeHeight() + 1);
height++;
setTreeHeight(addr, height);
}
//return pk[0];
memcpy(leaf, wots_pk, n);
}

/**
* Computes the leaf at a given address. First generates the WOTS key pair, then computes leaf using l_tree. As this happens position independent, we only require that addr encodes the right ltree-address.
*/
static void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8])
{
unsigned char seed[XMSS_N];
unsigned char pk[XMSS_WOTS_KEYSIZE];

get_seed(seed, sk_seed, XMSS_N, ots_addr);
wots_pkgen(pk, seed, pub_seed, ots_addr);

l_tree(leaf, pk, pub_seed, ltree_addr);
}

static int treehash_minheight_on_stack(bds_state* state, const treehash_inst *treehash) { static int treehash_minheight_on_stack(bds_state* state, const treehash_inst *treehash) {
unsigned int r = XMSS_TREEHEIGHT, i; unsigned int r = XMSS_TREEHEIGHT, i;
for (i = 0; i < treehash->stackusage; i++) { for (i = 0; i < treehash->stackusage; i++) {
@@ -233,52 +160,6 @@ static void treehash_update(treehash_inst *treehash, bds_state *state, const uns
} }
} }


/**
* Computes a root node given a leaf and an authapth
*/
static void validate_authpath(unsigned char *root, const unsigned char *leaf, unsigned long leafidx, const unsigned char *authpath, const unsigned char *pub_seed, uint32_t addr[8])
{
uint32_t i, j;
unsigned char buffer[2*XMSS_N];

// If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left.
// Otherwise, it is the other way around
if (leafidx & 1) {
for (j = 0; j < XMSS_N; j++)
buffer[XMSS_N+j] = leaf[j];
for (j = 0; j < XMSS_N; j++)
buffer[j] = authpath[j];
}
else {
for (j = 0; j < XMSS_N; j++)
buffer[j] = leaf[j];
for (j = 0; j < XMSS_N; j++)
buffer[XMSS_N+j] = authpath[j];
}
authpath += XMSS_N;

for (i=0; i < XMSS_TREEHEIGHT-1; i++) {
setTreeHeight(addr, i);
leafidx >>= 1;
setTreeIndex(addr, leafidx);
if (leafidx&1) {
hash_h(buffer+XMSS_N, buffer, pub_seed, addr, XMSS_N);
for (j = 0; j < XMSS_N; j++)
buffer[j] = authpath[j];
}
else {
hash_h(buffer, buffer, pub_seed, addr, XMSS_N);
for (j = 0; j < XMSS_N; j++)
buffer[j+XMSS_N] = authpath[j];
}
authpath += XMSS_N;
}
setTreeHeight(addr, (XMSS_TREEHEIGHT-1));
leafidx >>= 1;
setTreeIndex(addr, leafidx);
hash_h(root, buffer, pub_seed, addr, XMSS_N);
}

/** /**
* Performs one treehash update on the instance that needs it the most. * Performs one treehash update on the instance that needs it the most.
* Returns 1 if such an instance was not found * Returns 1 if such an instance was not found
@@ -553,7 +434,7 @@ int xmss_sign(unsigned char *sk, bds_state *state, unsigned char *sig_msg, unsig
setOTSADRS(ots_addr, idx); setOTSADRS(ots_addr, idx);


// Compute seed for OTS key pair // Compute seed for OTS key pair
get_seed(ots_seed, sk_seed, XMSS_N, ots_addr);
get_seed(ots_seed, sk_seed, ots_addr);


// Compute WOTS signature // Compute WOTS signature
wots_sign(sig_msg, msg_h, ots_seed, pub_seed, ots_addr); wots_sign(sig_msg, msg_h, ots_seed, pub_seed, ots_addr);
@@ -578,88 +459,6 @@ int xmss_sign(unsigned char *sk, bds_state *state, unsigned char *sig_msg, unsig
return 0; return 0;
} }


/**
* Verifies a given message signature pair under a given public key.
*/
int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
{
unsigned long long i, m_len;
unsigned long idx=0;
unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
unsigned char pkhash[XMSS_N];
unsigned char root[XMSS_N];
unsigned char msg_h[XMSS_N];
unsigned char hash_key[3*XMSS_N];

unsigned char pub_seed[XMSS_N];
memcpy(pub_seed, pk+XMSS_N, XMSS_N);

// Init addresses
uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

setType(ots_addr, 0);
setType(ltree_addr, 1);
setType(node_addr, 2);

// Extract index
idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3];
// Generate hash key (R || root || idx)
memcpy(hash_key, sig_msg+4,XMSS_N);
memcpy(hash_key+XMSS_N, pk, XMSS_N);
to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
sig_msg += (XMSS_N+4);
sig_msg_len -= (XMSS_N+4);

// hash message
unsigned long long tmp_sig_len = XMSS_WOTS_KEYSIZE+XMSS_TREEHEIGHT*XMSS_N;
m_len = sig_msg_len - tmp_sig_len;
h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);

//-----------------------
// Verify signature
//-----------------------

// Prepare Address
setOTSADRS(ots_addr, idx);
// Check WOTS signature
wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);

sig_msg += XMSS_WOTS_KEYSIZE;
sig_msg_len -= XMSS_WOTS_KEYSIZE;

// Compute Ltree
setLtreeADRS(ltree_addr, idx);
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);

// Compute root
validate_authpath(root, pkhash, idx, sig_msg, pub_seed, node_addr);

sig_msg += XMSS_TREEHEIGHT*XMSS_N;
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;

for (i = 0; i < XMSS_N; i++)
if (root[i] != pk[i])
goto fail;

*msglen = sig_msg_len;
for (i = 0; i < *msglen; i++)
msg[i] = sig_msg[i];

return 0;


fail:
*msglen = sig_msg_len;
for (i = 0; i < *msglen; i++)
msg[i] = 0;
*msglen = -1;
return -1;
}

/* /*
* Generates a XMSSMT key pair for a given parameter set. * Generates a XMSSMT key pair for a given parameter set.
* Format sk: [(ceil(h/8) bit) idx || SK_SEED || SK_PRF || PUB_SEED || root] * Format sk: [(ceil(h/8) bit) idx || SK_SEED || SK_PRF || PUB_SEED || root]
@@ -686,7 +485,7 @@ int xmssmt_keypair(unsigned char *pk, unsigned char *sk, bds_state *states, unsi
// Compute seed for OTS key pair // Compute seed for OTS key pair
treehash_setup(pk, XMSS_TREEHEIGHT, 0, states + i, sk+XMSS_INDEX_LEN, pk+XMSS_N, addr); treehash_setup(pk, XMSS_TREEHEIGHT, 0, states + i, sk+XMSS_INDEX_LEN, pk+XMSS_N, addr);
setLayerADRS(addr, (i+1)); setLayerADRS(addr, (i+1));
get_seed(ots_seed, sk+XMSS_INDEX_LEN, XMSS_N, addr);
get_seed(ots_seed, sk+XMSS_INDEX_LEN, addr);
wots_sign(wots_sigs + i*XMSS_WOTS_KEYSIZE, pk, ots_seed, pk+XMSS_N, addr); wots_sign(wots_sigs + i*XMSS_WOTS_KEYSIZE, pk, ots_seed, pk+XMSS_N, addr);
} }
// Address now points to the single tree on layer d-1 // Address now points to the single tree on layer d-1
@@ -790,7 +589,7 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs,
setOTSADRS(ots_addr, idx_leaf); setOTSADRS(ots_addr, idx_leaf);


// Compute seed for OTS key pair // Compute seed for OTS key pair
get_seed(ots_seed, sk_seed, XMSS_N, ots_addr);
get_seed(ots_seed, sk_seed, ots_addr);


// Compute WOTS signature // Compute WOTS signature
wots_sign(sig_msg, msg_h, ots_seed, pub_seed, ots_addr); wots_sign(sig_msg, msg_h, ots_seed, pub_seed, ots_addr);
@@ -853,7 +652,7 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs,
setTreeADRS(ots_addr, ((idx + 1) >> ((i+2) * XMSS_TREEHEIGHT))); setTreeADRS(ots_addr, ((idx + 1) >> ((i+2) * XMSS_TREEHEIGHT)));
setOTSADRS(ots_addr, (((idx >> ((i+1) * XMSS_TREEHEIGHT)) + 1) & ((1 << XMSS_TREEHEIGHT)-1))); setOTSADRS(ots_addr, (((idx >> ((i+1) * XMSS_TREEHEIGHT)) + 1) & ((1 << XMSS_TREEHEIGHT)-1)));


get_seed(ots_seed, sk+XMSS_INDEX_LEN, XMSS_N, ots_addr);
get_seed(ots_seed, sk+XMSS_INDEX_LEN, ots_addr);
wots_sign(wots_sigs + i*XMSS_WOTS_KEYSIZE, states[i].stack, ots_seed, pub_seed, ots_addr); wots_sign(wots_sigs + i*XMSS_WOTS_KEYSIZE, states[i].stack, ots_seed, pub_seed, ots_addr);


states[XMSS_D + i].stackoffset = 0; states[XMSS_D + i].stackoffset = 0;
@@ -872,138 +671,3 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs,


return 0; return 0;
} }

/**
* Verifies a given message signature pair under a given public key.
*/
int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
{
uint64_t idx_tree;
uint32_t idx_leaf;

unsigned long long i, m_len;
unsigned long long idx=0;
unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
unsigned char pkhash[XMSS_N];
unsigned char root[XMSS_N];
unsigned char msg_h[XMSS_N];
unsigned char hash_key[3*XMSS_N];

unsigned char pub_seed[XMSS_N];
memcpy(pub_seed, pk+XMSS_N, XMSS_N);

// Init addresses
uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

// Extract index
for (i = 0; i < XMSS_INDEX_LEN; i++) {
idx |= ((unsigned long long)sig_msg[i]) << (8*(XMSS_INDEX_LEN - 1 - i));
}
sig_msg += XMSS_INDEX_LEN;
sig_msg_len -= XMSS_INDEX_LEN;
// Generate hash key (R || root || idx)
memcpy(hash_key, sig_msg,XMSS_N);
memcpy(hash_key+XMSS_N, pk, XMSS_N);
to_byte(hash_key+2*XMSS_N, idx, XMSS_N);

sig_msg += XMSS_N;
sig_msg_len -= XMSS_N;

// hash message (recall, R is now on pole position at sig_msg
unsigned long long tmp_sig_len = (XMSS_D * XMSS_WOTS_KEYSIZE) + (XMSS_FULLHEIGHT * XMSS_N);
m_len = sig_msg_len - tmp_sig_len;
h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);

//-----------------------
// Verify signature
//-----------------------

// Prepare Address
idx_tree = idx >> XMSS_TREEHEIGHT;
idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1));
setLayerADRS(ots_addr, 0);
setTreeADRS(ots_addr, idx_tree);
setType(ots_addr, 0);

memcpy(ltree_addr, ots_addr, 12);
setType(ltree_addr, 1);

memcpy(node_addr, ltree_addr, 12);
setType(node_addr, 2);
setOTSADRS(ots_addr, idx_leaf);

// Check WOTS signature
wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);

sig_msg += XMSS_WOTS_KEYSIZE;
sig_msg_len -= XMSS_WOTS_KEYSIZE;

// Compute Ltree
setLtreeADRS(ltree_addr, idx_leaf);
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);

// Compute root
validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);

sig_msg += XMSS_TREEHEIGHT*XMSS_N;
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;

for (i = 1; i < XMSS_D; i++) {
// Prepare Address
idx_leaf = (idx_tree & ((1 << XMSS_TREEHEIGHT)-1));
idx_tree = idx_tree >> XMSS_TREEHEIGHT;

setLayerADRS(ots_addr, i);
setTreeADRS(ots_addr, idx_tree);
setType(ots_addr, 0);

memcpy(ltree_addr, ots_addr, 12);
setType(ltree_addr, 1);

memcpy(node_addr, ltree_addr, 12);
setType(node_addr, 2);

setOTSADRS(ots_addr, idx_leaf);

// Check WOTS signature
wots_pkFromSig(wots_pk, sig_msg, root, pub_seed, ots_addr);

sig_msg += XMSS_WOTS_KEYSIZE;
sig_msg_len -= XMSS_WOTS_KEYSIZE;

// Compute Ltree
setLtreeADRS(ltree_addr, idx_leaf);
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);

// Compute root
validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);

sig_msg += XMSS_TREEHEIGHT*XMSS_N;
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;

}

for (i = 0; i < XMSS_N; i++)
if (root[i] != pk[i])
goto fail;

*msglen = sig_msg_len;
for (i = 0; i < *msglen; i++)
msg[i] = sig_msg[i];

return 0;


fail:
*msglen = sig_msg_len;
for (i = 0; i < *msglen; i++)
msg[i] = 0;
*msglen = -1;
return -1;
}

Write Preview
Loading…
Cancel
Save