Reduce code duplication
A large number of functions was repeated in xmss_fast; these are now shared between the two implementations via the xmss_commons file. Notably, we ensure compatability by sharing the verification functions.
This commit is contained in:
Joost Rijneveld
parent
1e00c92c18
commit
5122ac6f73
338
xmss.c
338
xmss.c
@ -22,78 +22,6 @@ Public domain.
|
||||
// For testing
|
||||
#include "stdio.h"
|
||||
|
||||
/**
|
||||
* Used for pseudorandom keygeneration,
|
||||
* generates the seed for the WOTS keypair at address addr
|
||||
*
|
||||
* takes XMSS_N byte sk_seed and returns XMSS_N byte seed using 32 byte address addr.
|
||||
*/
|
||||
static void get_seed(unsigned char *seed, const unsigned char *sk_seed, uint32_t addr[8])
|
||||
{
|
||||
unsigned char bytes[32];
|
||||
// Make sure that chain addr, hash addr, and key bit are 0!
|
||||
setChainADRS(addr, 0);
|
||||
setHashADRS(addr, 0);
|
||||
setKeyAndMask(addr, 0);
|
||||
// Generate pseudorandom value
|
||||
addr_to_byte(bytes, addr);
|
||||
prf(seed, bytes, sk_seed, XMSS_N);
|
||||
}
|
||||
|
||||
/**
|
||||
* Computes a leaf from a WOTS public key using an L-tree.
|
||||
*/
|
||||
static void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8])
|
||||
{
|
||||
unsigned int l = XMSS_WOTS_LEN;
|
||||
uint32_t i = 0;
|
||||
uint32_t height = 0;
|
||||
uint32_t bound;
|
||||
|
||||
//ADRS.setTreeHeight(0);
|
||||
setTreeHeight(addr, height);
|
||||
|
||||
while (l > 1) {
|
||||
bound = l >> 1; //floor(l / 2);
|
||||
for (i = 0; i < bound; i++) {
|
||||
//ADRS.setTreeIndex(i);
|
||||
setTreeIndex(addr, i);
|
||||
//wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS);
|
||||
hash_h(wots_pk+i*XMSS_N, wots_pk+i*2*XMSS_N, pub_seed, addr, XMSS_N);
|
||||
}
|
||||
//if ( l % 2 == 1 ) {
|
||||
if (l & 1) {
|
||||
//pk[floor(l / 2) + 1] = pk[l];
|
||||
memcpy(wots_pk+(l>>1)*XMSS_N, wots_pk+(l-1)*XMSS_N, XMSS_N);
|
||||
//l = ceil(l / 2);
|
||||
l=(l>>1)+1;
|
||||
}
|
||||
else {
|
||||
//l = ceil(l / 2);
|
||||
l=(l>>1);
|
||||
}
|
||||
//ADRS.setTreeHeight(ADRS.getTreeHeight() + 1);
|
||||
height++;
|
||||
setTreeHeight(addr, height);
|
||||
}
|
||||
//return pk[0];
|
||||
memcpy(leaf, wots_pk, XMSS_N);
|
||||
}
|
||||
|
||||
/**
|
||||
* Computes the leaf at a given address. First generates the WOTS key pair, then computes leaf using l_tree. As this happens position independent, we only require that addr encodes the right ltree-address.
|
||||
*/
|
||||
static void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8])
|
||||
{
|
||||
unsigned char seed[XMSS_N];
|
||||
unsigned char pk[XMSS_WOTS_KEYSIZE];
|
||||
|
||||
get_seed(seed, sk_seed, ots_addr);
|
||||
wots_pkgen(pk, seed, pub_seed, ots_addr);
|
||||
|
||||
l_tree(leaf, pk, pub_seed, ltree_addr);
|
||||
}
|
||||
|
||||
/**
|
||||
* Merkle's TreeHash algorithm. The address only needs to initialize the first 78 bits of addr. Everything else will be set by treehash.
|
||||
* Currently only used for key generation.
|
||||
@ -141,52 +69,6 @@ static void treehash(unsigned char *node, uint16_t height, uint32_t index, const
|
||||
node[i] = stack[i];
|
||||
}
|
||||
|
||||
/**
|
||||
* Computes a root node given a leaf and an authapth
|
||||
*/
|
||||
static void validate_authpath(unsigned char *root, const unsigned char *leaf, unsigned long leafidx, const unsigned char *authpath, const unsigned char *pub_seed, uint32_t addr[8])
|
||||
{
|
||||
uint32_t i, j;
|
||||
unsigned char buffer[2*XMSS_N];
|
||||
|
||||
// If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left.
|
||||
// Otherwise, it is the other way around
|
||||
if (leafidx & 1) {
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[XMSS_N+j] = leaf[j];
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[j] = authpath[j];
|
||||
}
|
||||
else {
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[j] = leaf[j];
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[XMSS_N+j] = authpath[j];
|
||||
}
|
||||
authpath += XMSS_N;
|
||||
|
||||
for (i=0; i < XMSS_TREEHEIGHT-1; i++) {
|
||||
setTreeHeight(addr, i);
|
||||
leafidx >>= 1;
|
||||
setTreeIndex(addr, leafidx);
|
||||
if (leafidx&1) {
|
||||
hash_h(buffer+XMSS_N, buffer, pub_seed, addr, XMSS_N);
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[j] = authpath[j];
|
||||
}
|
||||
else {
|
||||
hash_h(buffer, buffer, pub_seed, addr, XMSS_N);
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[j+XMSS_N] = authpath[j];
|
||||
}
|
||||
authpath += XMSS_N;
|
||||
}
|
||||
setTreeHeight(addr, (XMSS_TREEHEIGHT-1));
|
||||
leafidx >>= 1;
|
||||
setTreeIndex(addr, leafidx);
|
||||
hash_h(root, buffer, pub_seed, addr, XMSS_N);
|
||||
}
|
||||
|
||||
/**
|
||||
* Computes the authpath and the root. This method is using a lot of space as we build the whole tree and then select the authpath nodes.
|
||||
* For more efficient algorithms see e.g. the chapter on hash-based signatures in Bernstein, Buchmann, Dahmen. "Post-quantum Cryptography", Springer 2009.
|
||||
@ -369,91 +251,6 @@ int xmss_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *sig
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Verifies a given message signature pair under a given public key.
|
||||
*/
|
||||
int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
|
||||
{
|
||||
|
||||
unsigned long long i, m_len;
|
||||
unsigned long idx=0;
|
||||
unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
|
||||
unsigned char pkhash[XMSS_N];
|
||||
unsigned char root[XMSS_N];
|
||||
unsigned char msg_h[XMSS_N];
|
||||
unsigned char hash_key[3*XMSS_N];
|
||||
|
||||
unsigned char pub_seed[XMSS_N];
|
||||
memcpy(pub_seed, pk+XMSS_N, XMSS_N);
|
||||
|
||||
// Init addresses
|
||||
uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
|
||||
setType(ots_addr, 0);
|
||||
setType(ltree_addr, 1);
|
||||
setType(node_addr, 2);
|
||||
|
||||
// Extract index
|
||||
idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3];
|
||||
printf("verify:: idx = %lu\n", idx);
|
||||
|
||||
// Generate hash key (R || root || idx)
|
||||
memcpy(hash_key, sig_msg+4,XMSS_N);
|
||||
memcpy(hash_key+XMSS_N, pk, XMSS_N);
|
||||
to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
|
||||
|
||||
sig_msg += (XMSS_N+4);
|
||||
sig_msg_len -= (XMSS_N+4);
|
||||
|
||||
|
||||
// hash message
|
||||
unsigned long long tmp_sig_len = XMSS_WOTS_KEYSIZE+XMSS_TREEHEIGHT*XMSS_N;
|
||||
m_len = sig_msg_len - tmp_sig_len;
|
||||
h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);
|
||||
|
||||
//-----------------------
|
||||
// Verify signature
|
||||
//-----------------------
|
||||
|
||||
// Prepare Address
|
||||
setOTSADRS(ots_addr, idx);
|
||||
// Check WOTS signature
|
||||
wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);
|
||||
|
||||
sig_msg += XMSS_WOTS_KEYSIZE;
|
||||
sig_msg_len -= XMSS_WOTS_KEYSIZE;
|
||||
|
||||
// Compute Ltree
|
||||
setLtreeADRS(ltree_addr, idx);
|
||||
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
|
||||
|
||||
// Compute root
|
||||
validate_authpath(root, pkhash, idx, sig_msg, pub_seed, node_addr);
|
||||
|
||||
sig_msg += XMSS_TREEHEIGHT*XMSS_N;
|
||||
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
|
||||
|
||||
for (i=0; i < XMSS_N; i++)
|
||||
if (root[i] != pk[i])
|
||||
goto fail;
|
||||
|
||||
*msglen = sig_msg_len;
|
||||
for (i=0; i < *msglen; i++)
|
||||
msg[i] = sig_msg[i];
|
||||
|
||||
return 0;
|
||||
|
||||
|
||||
fail:
|
||||
*msglen = sig_msg_len;
|
||||
for (i=0; i < *msglen; i++)
|
||||
msg[i] = 0;
|
||||
*msglen = -1;
|
||||
return -1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Generates a XMSSMT key pair for a given parameter set.
|
||||
* Format sk: [(ceil(h/8) bit) idx || SK_SEED || SK_PRF || PUB_SEED]
|
||||
@ -617,138 +414,3 @@ int xmssmt_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *s
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Verifies a given message signature pair under a given public key.
|
||||
*/
|
||||
int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
|
||||
{
|
||||
uint64_t idx_tree;
|
||||
uint32_t idx_leaf;
|
||||
|
||||
unsigned long long i, m_len;
|
||||
unsigned long long idx=0;
|
||||
unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
|
||||
unsigned char pkhash[XMSS_N];
|
||||
unsigned char root[XMSS_N];
|
||||
unsigned char msg_h[XMSS_N];
|
||||
unsigned char hash_key[3*XMSS_N];
|
||||
|
||||
unsigned char pub_seed[XMSS_N];
|
||||
memcpy(pub_seed, pk+XMSS_N, XMSS_N);
|
||||
|
||||
// Init addresses
|
||||
uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
|
||||
// Extract index
|
||||
for (i = 0; i < XMSS_INDEX_LEN; i++) {
|
||||
idx |= ((unsigned long long)sig_msg[i]) << (8*(XMSS_INDEX_LEN - 1 - i));
|
||||
}
|
||||
printf("verify:: idx = %llu\n", idx);
|
||||
sig_msg += XMSS_INDEX_LEN;
|
||||
sig_msg_len -= XMSS_INDEX_LEN;
|
||||
|
||||
// Generate hash key (R || root || idx)
|
||||
memcpy(hash_key, sig_msg,XMSS_N);
|
||||
memcpy(hash_key+XMSS_N, pk, XMSS_N);
|
||||
to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
|
||||
|
||||
sig_msg += XMSS_N;
|
||||
sig_msg_len -= XMSS_N;
|
||||
|
||||
// hash message
|
||||
unsigned long long tmp_sig_len = (XMSS_D * XMSS_WOTS_KEYSIZE) + (XMSS_FULLHEIGHT * XMSS_N);
|
||||
m_len = sig_msg_len - tmp_sig_len;
|
||||
h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);
|
||||
|
||||
|
||||
//-----------------------
|
||||
// Verify signature
|
||||
//-----------------------
|
||||
|
||||
// Prepare Address
|
||||
idx_tree = idx >> XMSS_TREEHEIGHT;
|
||||
idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1));
|
||||
setLayerADRS(ots_addr, 0);
|
||||
setTreeADRS(ots_addr, idx_tree);
|
||||
setType(ots_addr, 0);
|
||||
|
||||
memcpy(ltree_addr, ots_addr, 12);
|
||||
setType(ltree_addr, 1);
|
||||
|
||||
memcpy(node_addr, ltree_addr, 12);
|
||||
setType(node_addr, 2);
|
||||
|
||||
setOTSADRS(ots_addr, idx_leaf);
|
||||
|
||||
// Check WOTS signature
|
||||
wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);
|
||||
|
||||
sig_msg += XMSS_WOTS_KEYSIZE;
|
||||
sig_msg_len -= XMSS_WOTS_KEYSIZE;
|
||||
|
||||
// Compute Ltree
|
||||
setLtreeADRS(ltree_addr, idx_leaf);
|
||||
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
|
||||
|
||||
// Compute root
|
||||
validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);
|
||||
|
||||
sig_msg += XMSS_TREEHEIGHT*XMSS_N;
|
||||
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
|
||||
|
||||
for (i = 1; i < XMSS_D; i++) {
|
||||
// Prepare Address
|
||||
idx_leaf = (idx_tree & ((1 << XMSS_TREEHEIGHT)-1));
|
||||
idx_tree = idx_tree >> XMSS_TREEHEIGHT;
|
||||
|
||||
setLayerADRS(ots_addr, i);
|
||||
setTreeADRS(ots_addr, idx_tree);
|
||||
setType(ots_addr, 0);
|
||||
|
||||
memcpy(ltree_addr, ots_addr, 12);
|
||||
setType(ltree_addr, 1);
|
||||
|
||||
memcpy(node_addr, ltree_addr, 12);
|
||||
setType(node_addr, 2);
|
||||
|
||||
setOTSADRS(ots_addr, idx_leaf);
|
||||
|
||||
// Check WOTS signature
|
||||
wots_pkFromSig(wots_pk, sig_msg, root, pub_seed, ots_addr);
|
||||
|
||||
sig_msg += XMSS_WOTS_KEYSIZE;
|
||||
sig_msg_len -= XMSS_WOTS_KEYSIZE;
|
||||
|
||||
// Compute Ltree
|
||||
setLtreeADRS(ltree_addr, idx_leaf);
|
||||
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
|
||||
|
||||
// Compute root
|
||||
validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);
|
||||
|
||||
sig_msg += XMSS_TREEHEIGHT*XMSS_N;
|
||||
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
|
||||
|
||||
}
|
||||
|
||||
for (i=0; i < XMSS_N; i++)
|
||||
if (root[i] != pk[i])
|
||||
goto fail;
|
||||
|
||||
*msglen = sig_msg_len;
|
||||
for (i=0; i < *msglen; i++)
|
||||
msg[i] = sig_msg[i];
|
||||
|
||||
return 0;
|
||||
|
||||
|
||||
fail:
|
||||
*msglen = sig_msg_len;
|
||||
for (i=0; i < *msglen; i++)
|
||||
msg[i] = 0;
|
||||
*msglen = -1;
|
||||
return -1;
|
||||
}
|
||||
346
xmss_commons.c
346
xmss_commons.c
@ -6,10 +6,17 @@ Public domain.
|
||||
*/
|
||||
|
||||
#include "xmss_commons.h"
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <stdio.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#include "wots.h"
|
||||
#include "hash.h"
|
||||
#include "hash_address.h"
|
||||
#include "params.h"
|
||||
|
||||
void to_byte(unsigned char *out, unsigned long long in, uint32_t bytes)
|
||||
{
|
||||
int32_t i;
|
||||
@ -19,9 +26,340 @@ void to_byte(unsigned char *out, unsigned long long in, uint32_t bytes)
|
||||
}
|
||||
}
|
||||
|
||||
void hexdump(const unsigned char *a, size_t len)
|
||||
/**
|
||||
* Computes the leaf at a given address. First generates the WOTS key pair, then computes leaf using l_tree. As this happens position independent, we only require that addr encodes the right ltree-address.
|
||||
*/
|
||||
void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8])
|
||||
{
|
||||
size_t i;
|
||||
for (i = 0; i < len; i++)
|
||||
printf("%02x", a[i]);
|
||||
unsigned char seed[XMSS_N];
|
||||
unsigned char pk[XMSS_WOTS_KEYSIZE];
|
||||
|
||||
get_seed(seed, sk_seed, ots_addr);
|
||||
wots_pkgen(pk, seed, pub_seed, ots_addr);
|
||||
|
||||
l_tree(leaf, pk, pub_seed, ltree_addr);
|
||||
}
|
||||
|
||||
/**
|
||||
* Used for pseudorandom keygeneration,
|
||||
* generates the seed for the WOTS keypair at address addr
|
||||
*
|
||||
* takes XMSS_N byte sk_seed and returns XMSS_N byte seed using 32 byte address addr.
|
||||
*/
|
||||
void get_seed(unsigned char *seed, const unsigned char *sk_seed, uint32_t addr[8])
|
||||
{
|
||||
unsigned char bytes[32];
|
||||
// Make sure that chain addr, hash addr, and key bit are 0!
|
||||
setChainADRS(addr, 0);
|
||||
setHashADRS(addr, 0);
|
||||
setKeyAndMask(addr, 0);
|
||||
// Generate pseudorandom value
|
||||
addr_to_byte(bytes, addr);
|
||||
prf(seed, bytes, sk_seed, XMSS_N);
|
||||
}
|
||||
|
||||
/**
|
||||
* Computes a leaf from a WOTS public key using an L-tree.
|
||||
*/
|
||||
void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8])
|
||||
{
|
||||
unsigned int l = XMSS_WOTS_LEN;
|
||||
uint32_t i = 0;
|
||||
uint32_t height = 0;
|
||||
uint32_t bound;
|
||||
|
||||
//ADRS.setTreeHeight(0);
|
||||
setTreeHeight(addr, height);
|
||||
|
||||
while (l > 1) {
|
||||
bound = l >> 1; //floor(l / 2);
|
||||
for (i = 0; i < bound; i++) {
|
||||
//ADRS.setTreeIndex(i);
|
||||
setTreeIndex(addr, i);
|
||||
//wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS);
|
||||
hash_h(wots_pk+i*XMSS_N, wots_pk+i*2*XMSS_N, pub_seed, addr, XMSS_N);
|
||||
}
|
||||
//if ( l % 2 == 1 ) {
|
||||
if (l & 1) {
|
||||
//pk[floor(l / 2) + 1] = pk[l];
|
||||
memcpy(wots_pk+(l>>1)*XMSS_N, wots_pk+(l-1)*XMSS_N, XMSS_N);
|
||||
//l = ceil(l / 2);
|
||||
l=(l>>1)+1;
|
||||
}
|
||||
else {
|
||||
//l = ceil(l / 2);
|
||||
l=(l>>1);
|
||||
}
|
||||
//ADRS.setTreeHeight(ADRS.getTreeHeight() + 1);
|
||||
height++;
|
||||
setTreeHeight(addr, height);
|
||||
}
|
||||
//return pk[0];
|
||||
memcpy(leaf, wots_pk, XMSS_N);
|
||||
}
|
||||
|
||||
/**
|
||||
* Computes a root node given a leaf and an authapth
|
||||
*/
|
||||
static void validate_authpath(unsigned char *root, const unsigned char *leaf, unsigned long leafidx, const unsigned char *authpath, const unsigned char *pub_seed, uint32_t addr[8])
|
||||
{
|
||||
uint32_t i, j;
|
||||
unsigned char buffer[2*XMSS_N];
|
||||
|
||||
// If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left.
|
||||
// Otherwise, it is the other way around
|
||||
if (leafidx & 1) {
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[XMSS_N+j] = leaf[j];
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[j] = authpath[j];
|
||||
}
|
||||
else {
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[j] = leaf[j];
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[XMSS_N+j] = authpath[j];
|
||||
}
|
||||
authpath += XMSS_N;
|
||||
|
||||
for (i=0; i < XMSS_TREEHEIGHT-1; i++) {
|
||||
setTreeHeight(addr, i);
|
||||
leafidx >>= 1;
|
||||
setTreeIndex(addr, leafidx);
|
||||
if (leafidx&1) {
|
||||
hash_h(buffer+XMSS_N, buffer, pub_seed, addr, XMSS_N);
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[j] = authpath[j];
|
||||
}
|
||||
else {
|
||||
hash_h(buffer, buffer, pub_seed, addr, XMSS_N);
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[j+XMSS_N] = authpath[j];
|
||||
}
|
||||
authpath += XMSS_N;
|
||||
}
|
||||
setTreeHeight(addr, (XMSS_TREEHEIGHT-1));
|
||||
leafidx >>= 1;
|
||||
setTreeIndex(addr, leafidx);
|
||||
hash_h(root, buffer, pub_seed, addr, XMSS_N);
|
||||
}
|
||||
|
||||
/**
|
||||
* Verifies a given message signature pair under a given public key.
|
||||
*/
|
||||
int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
|
||||
{
|
||||
|
||||
unsigned long long i, m_len;
|
||||
unsigned long idx=0;
|
||||
unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
|
||||
unsigned char pkhash[XMSS_N];
|
||||
unsigned char root[XMSS_N];
|
||||
unsigned char msg_h[XMSS_N];
|
||||
unsigned char hash_key[3*XMSS_N];
|
||||
|
||||
unsigned char pub_seed[XMSS_N];
|
||||
memcpy(pub_seed, pk+XMSS_N, XMSS_N);
|
||||
|
||||
// Init addresses
|
||||
uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
|
||||
setType(ots_addr, 0);
|
||||
setType(ltree_addr, 1);
|
||||
setType(node_addr, 2);
|
||||
|
||||
// Extract index
|
||||
idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3];
|
||||
printf("verify:: idx = %lu\n", idx);
|
||||
|
||||
// Generate hash key (R || root || idx)
|
||||
memcpy(hash_key, sig_msg+4,XMSS_N);
|
||||
memcpy(hash_key+XMSS_N, pk, XMSS_N);
|
||||
to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
|
||||
|
||||
sig_msg += (XMSS_N+4);
|
||||
sig_msg_len -= (XMSS_N+4);
|
||||
|
||||
|
||||
// hash message
|
||||
unsigned long long tmp_sig_len = XMSS_WOTS_KEYSIZE+XMSS_TREEHEIGHT*XMSS_N;
|
||||
m_len = sig_msg_len - tmp_sig_len;
|
||||
h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);
|
||||
|
||||
//-----------------------
|
||||
// Verify signature
|
||||
//-----------------------
|
||||
|
||||
// Prepare Address
|
||||
setOTSADRS(ots_addr, idx);
|
||||
// Check WOTS signature
|
||||
wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);
|
||||
|
||||
sig_msg += XMSS_WOTS_KEYSIZE;
|
||||
sig_msg_len -= XMSS_WOTS_KEYSIZE;
|
||||
|
||||
// Compute Ltree
|
||||
setLtreeADRS(ltree_addr, idx);
|
||||
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
|
||||
|
||||
// Compute root
|
||||
validate_authpath(root, pkhash, idx, sig_msg, pub_seed, node_addr);
|
||||
|
||||
sig_msg += XMSS_TREEHEIGHT*XMSS_N;
|
||||
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
|
||||
|
||||
for (i=0; i < XMSS_N; i++)
|
||||
if (root[i] != pk[i])
|
||||
goto fail;
|
||||
|
||||
*msglen = sig_msg_len;
|
||||
for (i=0; i < *msglen; i++)
|
||||
msg[i] = sig_msg[i];
|
||||
|
||||
return 0;
|
||||
|
||||
|
||||
fail:
|
||||
*msglen = sig_msg_len;
|
||||
for (i=0; i < *msglen; i++)
|
||||
msg[i] = 0;
|
||||
*msglen = -1;
|
||||
return -1;
|
||||
}
|
||||
|
||||
/**
|
||||
* Verifies a given message signature pair under a given public key.
|
||||
*/
|
||||
int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
|
||||
{
|
||||
uint64_t idx_tree;
|
||||
uint32_t idx_leaf;
|
||||
|
||||
unsigned long long i, m_len;
|
||||
unsigned long long idx=0;
|
||||
unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
|
||||
unsigned char pkhash[XMSS_N];
|
||||
unsigned char root[XMSS_N];
|
||||
unsigned char msg_h[XMSS_N];
|
||||
unsigned char hash_key[3*XMSS_N];
|
||||
|
||||
unsigned char pub_seed[XMSS_N];
|
||||
memcpy(pub_seed, pk+XMSS_N, XMSS_N);
|
||||
|
||||
// Init addresses
|
||||
uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
|
||||
// Extract index
|
||||
for (i = 0; i < XMSS_INDEX_LEN; i++) {
|
||||
idx |= ((unsigned long long)sig_msg[i]) << (8*(XMSS_INDEX_LEN - 1 - i));
|
||||
}
|
||||
printf("verify:: idx = %llu\n", idx);
|
||||
sig_msg += XMSS_INDEX_LEN;
|
||||
sig_msg_len -= XMSS_INDEX_LEN;
|
||||
|
||||
// Generate hash key (R || root || idx)
|
||||
memcpy(hash_key, sig_msg,XMSS_N);
|
||||
memcpy(hash_key+XMSS_N, pk, XMSS_N);
|
||||
to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
|
||||
|
||||
sig_msg += XMSS_N;
|
||||
sig_msg_len -= XMSS_N;
|
||||
|
||||
// hash message
|
||||
unsigned long long tmp_sig_len = (XMSS_D * XMSS_WOTS_KEYSIZE) + (XMSS_FULLHEIGHT * XMSS_N);
|
||||
m_len = sig_msg_len - tmp_sig_len;
|
||||
h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);
|
||||
|
||||
|
||||
//-----------------------
|
||||
// Verify signature
|
||||
//-----------------------
|
||||
|
||||
// Prepare Address
|
||||
idx_tree = idx >> XMSS_TREEHEIGHT;
|
||||
idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1));
|
||||
setLayerADRS(ots_addr, 0);
|
||||
setTreeADRS(ots_addr, idx_tree);
|
||||
setType(ots_addr, 0);
|
||||
|
||||
memcpy(ltree_addr, ots_addr, 12);
|
||||
setType(ltree_addr, 1);
|
||||
|
||||
memcpy(node_addr, ltree_addr, 12);
|
||||
setType(node_addr, 2);
|
||||
|
||||
setOTSADRS(ots_addr, idx_leaf);
|
||||
|
||||
// Check WOTS signature
|
||||
wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);
|
||||
|
||||
sig_msg += XMSS_WOTS_KEYSIZE;
|
||||
sig_msg_len -= XMSS_WOTS_KEYSIZE;
|
||||
|
||||
// Compute Ltree
|
||||
setLtreeADRS(ltree_addr, idx_leaf);
|
||||
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
|
||||
|
||||
// Compute root
|
||||
validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);
|
||||
|
||||
sig_msg += XMSS_TREEHEIGHT*XMSS_N;
|
||||
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
|
||||
|
||||
for (i = 1; i < XMSS_D; i++) {
|
||||
// Prepare Address
|
||||
idx_leaf = (idx_tree & ((1 << XMSS_TREEHEIGHT)-1));
|
||||
idx_tree = idx_tree >> XMSS_TREEHEIGHT;
|
||||
|
||||
setLayerADRS(ots_addr, i);
|
||||
setTreeADRS(ots_addr, idx_tree);
|
||||
setType(ots_addr, 0);
|
||||
|
||||
memcpy(ltree_addr, ots_addr, 12);
|
||||
setType(ltree_addr, 1);
|
||||
|
||||
memcpy(node_addr, ltree_addr, 12);
|
||||
setType(node_addr, 2);
|
||||
|
||||
setOTSADRS(ots_addr, idx_leaf);
|
||||
|
||||
// Check WOTS signature
|
||||
wots_pkFromSig(wots_pk, sig_msg, root, pub_seed, ots_addr);
|
||||
|
||||
sig_msg += XMSS_WOTS_KEYSIZE;
|
||||
sig_msg_len -= XMSS_WOTS_KEYSIZE;
|
||||
|
||||
// Compute Ltree
|
||||
setLtreeADRS(ltree_addr, idx_leaf);
|
||||
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
|
||||
|
||||
// Compute root
|
||||
validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);
|
||||
|
||||
sig_msg += XMSS_TREEHEIGHT*XMSS_N;
|
||||
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
|
||||
|
||||
}
|
||||
|
||||
for (i=0; i < XMSS_N; i++)
|
||||
if (root[i] != pk[i])
|
||||
goto fail;
|
||||
|
||||
*msglen = sig_msg_len;
|
||||
for (i=0; i < *msglen; i++)
|
||||
msg[i] = sig_msg[i];
|
||||
|
||||
return 0;
|
||||
|
||||
|
||||
fail:
|
||||
*msglen = sig_msg_len;
|
||||
for (i=0; i < *msglen; i++)
|
||||
msg[i] = 0;
|
||||
*msglen = -1;
|
||||
return -1;
|
||||
}
|
||||
@ -12,4 +12,9 @@ Public domain.
|
||||
|
||||
void to_byte(unsigned char *output, unsigned long long in, uint32_t bytes);
|
||||
void hexdump(const unsigned char *a, size_t len);
|
||||
void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8]);
|
||||
void get_seed(unsigned char *seed, const unsigned char *sk_seed, uint32_t addr[8]);
|
||||
void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8]);
|
||||
int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk);
|
||||
int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk);
|
||||
#endif
|
||||
344
xmss_fast.c
344
xmss_fast.c
@ -19,24 +19,6 @@ Public domain.
|
||||
#include "hash_address.h"
|
||||
#include "params.h"
|
||||
|
||||
/**
|
||||
* Used for pseudorandom keygeneration,
|
||||
* generates the seed for the WOTS keypair at address addr
|
||||
*
|
||||
* takes n byte sk_seed and returns n byte seed using 32 byte address addr.
|
||||
*/
|
||||
static void get_seed(unsigned char *seed, const unsigned char *sk_seed, int n, uint32_t addr[8])
|
||||
{
|
||||
unsigned char bytes[32];
|
||||
// Make sure that chain addr, hash addr, and key bit are 0!
|
||||
setChainADRS(addr,0);
|
||||
setHashADRS(addr,0);
|
||||
setKeyAndMask(addr,0);
|
||||
// Generate pseudorandom value
|
||||
addr_to_byte(bytes, addr);
|
||||
prf(seed, bytes, sk_seed, n);
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize BDS state struct
|
||||
* parameter names are the same as used in the description of the BDS traversal
|
||||
@ -53,61 +35,6 @@ void xmss_set_bds_state(bds_state *state, unsigned char *stack, int stackoffset,
|
||||
state->next_leaf = next_leaf;
|
||||
}
|
||||
|
||||
/**
|
||||
* Computes a leaf from a WOTS public key using an L-tree.
|
||||
*/
|
||||
static void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8])
|
||||
{
|
||||
unsigned int l = XMSS_WOTS_LEN;
|
||||
unsigned int n = XMSS_N;
|
||||
uint32_t i = 0;
|
||||
uint32_t height = 0;
|
||||
uint32_t bound;
|
||||
|
||||
//ADRS.setTreeHeight(0);
|
||||
setTreeHeight(addr, height);
|
||||
|
||||
while (l > 1) {
|
||||
bound = l >> 1; //floor(l / 2);
|
||||
for (i = 0; i < bound; i++) {
|
||||
//ADRS.setTreeIndex(i);
|
||||
setTreeIndex(addr, i);
|
||||
//wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS);
|
||||
hash_h(wots_pk+i*n, wots_pk+i*2*n, pub_seed, addr, n);
|
||||
}
|
||||
//if ( l % 2 == 1 ) {
|
||||
if (l & 1) {
|
||||
//pk[floor(l / 2) + 1] = pk[l];
|
||||
memcpy(wots_pk+(l>>1)*n, wots_pk+(l-1)*n, n);
|
||||
//l = ceil(l / 2);
|
||||
l=(l>>1)+1;
|
||||
}
|
||||
else {
|
||||
//l = ceil(l / 2);
|
||||
l=(l>>1);
|
||||
}
|
||||
//ADRS.setTreeHeight(ADRS.getTreeHeight() + 1);
|
||||
height++;
|
||||
setTreeHeight(addr, height);
|
||||
}
|
||||
//return pk[0];
|
||||
memcpy(leaf, wots_pk, n);
|
||||
}
|
||||
|
||||
/**
|
||||
* Computes the leaf at a given address. First generates the WOTS key pair, then computes leaf using l_tree. As this happens position independent, we only require that addr encodes the right ltree-address.
|
||||
*/
|
||||
static void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8])
|
||||
{
|
||||
unsigned char seed[XMSS_N];
|
||||
unsigned char pk[XMSS_WOTS_KEYSIZE];
|
||||
|
||||
get_seed(seed, sk_seed, XMSS_N, ots_addr);
|
||||
wots_pkgen(pk, seed, pub_seed, ots_addr);
|
||||
|
||||
l_tree(leaf, pk, pub_seed, ltree_addr);
|
||||
}
|
||||
|
||||
static int treehash_minheight_on_stack(bds_state* state, const treehash_inst *treehash) {
|
||||
unsigned int r = XMSS_TREEHEIGHT, i;
|
||||
for (i = 0; i < treehash->stackusage; i++) {
|
||||
@ -233,52 +160,6 @@ static void treehash_update(treehash_inst *treehash, bds_state *state, const uns
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Computes a root node given a leaf and an authapth
|
||||
*/
|
||||
static void validate_authpath(unsigned char *root, const unsigned char *leaf, unsigned long leafidx, const unsigned char *authpath, const unsigned char *pub_seed, uint32_t addr[8])
|
||||
{
|
||||
uint32_t i, j;
|
||||
unsigned char buffer[2*XMSS_N];
|
||||
|
||||
// If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left.
|
||||
// Otherwise, it is the other way around
|
||||
if (leafidx & 1) {
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[XMSS_N+j] = leaf[j];
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[j] = authpath[j];
|
||||
}
|
||||
else {
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[j] = leaf[j];
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[XMSS_N+j] = authpath[j];
|
||||
}
|
||||
authpath += XMSS_N;
|
||||
|
||||
for (i=0; i < XMSS_TREEHEIGHT-1; i++) {
|
||||
setTreeHeight(addr, i);
|
||||
leafidx >>= 1;
|
||||
setTreeIndex(addr, leafidx);
|
||||
if (leafidx&1) {
|
||||
hash_h(buffer+XMSS_N, buffer, pub_seed, addr, XMSS_N);
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[j] = authpath[j];
|
||||
}
|
||||
else {
|
||||
hash_h(buffer, buffer, pub_seed, addr, XMSS_N);
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[j+XMSS_N] = authpath[j];
|
||||
}
|
||||
authpath += XMSS_N;
|
||||
}
|
||||
setTreeHeight(addr, (XMSS_TREEHEIGHT-1));
|
||||
leafidx >>= 1;
|
||||
setTreeIndex(addr, leafidx);
|
||||
hash_h(root, buffer, pub_seed, addr, XMSS_N);
|
||||
}
|
||||
|
||||
/**
|
||||
* Performs one treehash update on the instance that needs it the most.
|
||||
* Returns 1 if such an instance was not found
|
||||
@ -553,7 +434,7 @@ int xmss_sign(unsigned char *sk, bds_state *state, unsigned char *sig_msg, unsig
|
||||
setOTSADRS(ots_addr, idx);
|
||||
|
||||
// Compute seed for OTS key pair
|
||||
get_seed(ots_seed, sk_seed, XMSS_N, ots_addr);
|
||||
get_seed(ots_seed, sk_seed, ots_addr);
|
||||
|
||||
// Compute WOTS signature
|
||||
wots_sign(sig_msg, msg_h, ots_seed, pub_seed, ots_addr);
|
||||
@ -578,88 +459,6 @@ int xmss_sign(unsigned char *sk, bds_state *state, unsigned char *sig_msg, unsig
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Verifies a given message signature pair under a given public key.
|
||||
*/
|
||||
int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
|
||||
{
|
||||
unsigned long long i, m_len;
|
||||
unsigned long idx=0;
|
||||
unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
|
||||
unsigned char pkhash[XMSS_N];
|
||||
unsigned char root[XMSS_N];
|
||||
unsigned char msg_h[XMSS_N];
|
||||
unsigned char hash_key[3*XMSS_N];
|
||||
|
||||
unsigned char pub_seed[XMSS_N];
|
||||
memcpy(pub_seed, pk+XMSS_N, XMSS_N);
|
||||
|
||||
// Init addresses
|
||||
uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
|
||||
setType(ots_addr, 0);
|
||||
setType(ltree_addr, 1);
|
||||
setType(node_addr, 2);
|
||||
|
||||
// Extract index
|
||||
idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3];
|
||||
|
||||
// Generate hash key (R || root || idx)
|
||||
memcpy(hash_key, sig_msg+4,XMSS_N);
|
||||
memcpy(hash_key+XMSS_N, pk, XMSS_N);
|
||||
to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
|
||||
|
||||
sig_msg += (XMSS_N+4);
|
||||
sig_msg_len -= (XMSS_N+4);
|
||||
|
||||
// hash message
|
||||
unsigned long long tmp_sig_len = XMSS_WOTS_KEYSIZE+XMSS_TREEHEIGHT*XMSS_N;
|
||||
m_len = sig_msg_len - tmp_sig_len;
|
||||
h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);
|
||||
|
||||
//-----------------------
|
||||
// Verify signature
|
||||
//-----------------------
|
||||
|
||||
// Prepare Address
|
||||
setOTSADRS(ots_addr, idx);
|
||||
// Check WOTS signature
|
||||
wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);
|
||||
|
||||
sig_msg += XMSS_WOTS_KEYSIZE;
|
||||
sig_msg_len -= XMSS_WOTS_KEYSIZE;
|
||||
|
||||
// Compute Ltree
|
||||
setLtreeADRS(ltree_addr, idx);
|
||||
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
|
||||
|
||||
// Compute root
|
||||
validate_authpath(root, pkhash, idx, sig_msg, pub_seed, node_addr);
|
||||
|
||||
sig_msg += XMSS_TREEHEIGHT*XMSS_N;
|
||||
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
|
||||
|
||||
for (i = 0; i < XMSS_N; i++)
|
||||
if (root[i] != pk[i])
|
||||
goto fail;
|
||||
|
||||
*msglen = sig_msg_len;
|
||||
for (i = 0; i < *msglen; i++)
|
||||
msg[i] = sig_msg[i];
|
||||
|
||||
return 0;
|
||||
|
||||
|
||||
fail:
|
||||
*msglen = sig_msg_len;
|
||||
for (i = 0; i < *msglen; i++)
|
||||
msg[i] = 0;
|
||||
*msglen = -1;
|
||||
return -1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Generates a XMSSMT key pair for a given parameter set.
|
||||
* Format sk: [(ceil(h/8) bit) idx || SK_SEED || SK_PRF || PUB_SEED || root]
|
||||
@ -686,7 +485,7 @@ int xmssmt_keypair(unsigned char *pk, unsigned char *sk, bds_state *states, unsi
|
||||
// Compute seed for OTS key pair
|
||||
treehash_setup(pk, XMSS_TREEHEIGHT, 0, states + i, sk+XMSS_INDEX_LEN, pk+XMSS_N, addr);
|
||||
setLayerADRS(addr, (i+1));
|
||||
get_seed(ots_seed, sk+XMSS_INDEX_LEN, XMSS_N, addr);
|
||||
get_seed(ots_seed, sk+XMSS_INDEX_LEN, addr);
|
||||
wots_sign(wots_sigs + i*XMSS_WOTS_KEYSIZE, pk, ots_seed, pk+XMSS_N, addr);
|
||||
}
|
||||
// Address now points to the single tree on layer d-1
|
||||
@ -790,7 +589,7 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs,
|
||||
setOTSADRS(ots_addr, idx_leaf);
|
||||
|
||||
// Compute seed for OTS key pair
|
||||
get_seed(ots_seed, sk_seed, XMSS_N, ots_addr);
|
||||
get_seed(ots_seed, sk_seed, ots_addr);
|
||||
|
||||
// Compute WOTS signature
|
||||
wots_sign(sig_msg, msg_h, ots_seed, pub_seed, ots_addr);
|
||||
@ -853,7 +652,7 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs,
|
||||
setTreeADRS(ots_addr, ((idx + 1) >> ((i+2) * XMSS_TREEHEIGHT)));
|
||||
setOTSADRS(ots_addr, (((idx >> ((i+1) * XMSS_TREEHEIGHT)) + 1) & ((1 << XMSS_TREEHEIGHT)-1)));
|
||||
|
||||
get_seed(ots_seed, sk+XMSS_INDEX_LEN, XMSS_N, ots_addr);
|
||||
get_seed(ots_seed, sk+XMSS_INDEX_LEN, ots_addr);
|
||||
wots_sign(wots_sigs + i*XMSS_WOTS_KEYSIZE, states[i].stack, ots_seed, pub_seed, ots_addr);
|
||||
|
||||
states[XMSS_D + i].stackoffset = 0;
|
||||
@ -872,138 +671,3 @@ int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs,
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Verifies a given message signature pair under a given public key.
|
||||
*/
|
||||
int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)
|
||||
{
|
||||
uint64_t idx_tree;
|
||||
uint32_t idx_leaf;
|
||||
|
||||
unsigned long long i, m_len;
|
||||
unsigned long long idx=0;
|
||||
unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
|
||||
unsigned char pkhash[XMSS_N];
|
||||
unsigned char root[XMSS_N];
|
||||
unsigned char msg_h[XMSS_N];
|
||||
unsigned char hash_key[3*XMSS_N];
|
||||
|
||||
unsigned char pub_seed[XMSS_N];
|
||||
memcpy(pub_seed, pk+XMSS_N, XMSS_N);
|
||||
|
||||
// Init addresses
|
||||
uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
|
||||
// Extract index
|
||||
for (i = 0; i < XMSS_INDEX_LEN; i++) {
|
||||
idx |= ((unsigned long long)sig_msg[i]) << (8*(XMSS_INDEX_LEN - 1 - i));
|
||||
}
|
||||
sig_msg += XMSS_INDEX_LEN;
|
||||
sig_msg_len -= XMSS_INDEX_LEN;
|
||||
|
||||
// Generate hash key (R || root || idx)
|
||||
memcpy(hash_key, sig_msg,XMSS_N);
|
||||
memcpy(hash_key+XMSS_N, pk, XMSS_N);
|
||||
to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
|
||||
|
||||
sig_msg += XMSS_N;
|
||||
sig_msg_len -= XMSS_N;
|
||||
|
||||
|
||||
// hash message (recall, R is now on pole position at sig_msg
|
||||
unsigned long long tmp_sig_len = (XMSS_D * XMSS_WOTS_KEYSIZE) + (XMSS_FULLHEIGHT * XMSS_N);
|
||||
m_len = sig_msg_len - tmp_sig_len;
|
||||
h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);
|
||||
|
||||
|
||||
//-----------------------
|
||||
// Verify signature
|
||||
//-----------------------
|
||||
|
||||
// Prepare Address
|
||||
idx_tree = idx >> XMSS_TREEHEIGHT;
|
||||
idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1));
|
||||
setLayerADRS(ots_addr, 0);
|
||||
setTreeADRS(ots_addr, idx_tree);
|
||||
setType(ots_addr, 0);
|
||||
|
||||
memcpy(ltree_addr, ots_addr, 12);
|
||||
setType(ltree_addr, 1);
|
||||
|
||||
memcpy(node_addr, ltree_addr, 12);
|
||||
setType(node_addr, 2);
|
||||
|
||||
setOTSADRS(ots_addr, idx_leaf);
|
||||
|
||||
// Check WOTS signature
|
||||
wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);
|
||||
|
||||
sig_msg += XMSS_WOTS_KEYSIZE;
|
||||
sig_msg_len -= XMSS_WOTS_KEYSIZE;
|
||||
|
||||
// Compute Ltree
|
||||
setLtreeADRS(ltree_addr, idx_leaf);
|
||||
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
|
||||
|
||||
// Compute root
|
||||
validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);
|
||||
|
||||
sig_msg += XMSS_TREEHEIGHT*XMSS_N;
|
||||
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
|
||||
|
||||
for (i = 1; i < XMSS_D; i++) {
|
||||
// Prepare Address
|
||||
idx_leaf = (idx_tree & ((1 << XMSS_TREEHEIGHT)-1));
|
||||
idx_tree = idx_tree >> XMSS_TREEHEIGHT;
|
||||
|
||||
setLayerADRS(ots_addr, i);
|
||||
setTreeADRS(ots_addr, idx_tree);
|
||||
setType(ots_addr, 0);
|
||||
|
||||
memcpy(ltree_addr, ots_addr, 12);
|
||||
setType(ltree_addr, 1);
|
||||
|
||||
memcpy(node_addr, ltree_addr, 12);
|
||||
setType(node_addr, 2);
|
||||
|
||||
setOTSADRS(ots_addr, idx_leaf);
|
||||
|
||||
// Check WOTS signature
|
||||
wots_pkFromSig(wots_pk, sig_msg, root, pub_seed, ots_addr);
|
||||
|
||||
sig_msg += XMSS_WOTS_KEYSIZE;
|
||||
sig_msg_len -= XMSS_WOTS_KEYSIZE;
|
||||
|
||||
// Compute Ltree
|
||||
setLtreeADRS(ltree_addr, idx_leaf);
|
||||
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
|
||||
|
||||
// Compute root
|
||||
validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);
|
||||
|
||||
sig_msg += XMSS_TREEHEIGHT*XMSS_N;
|
||||
sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;
|
||||
|
||||
}
|
||||
|
||||
for (i = 0; i < XMSS_N; i++)
|
||||
if (root[i] != pk[i])
|
||||
goto fail;
|
||||
|
||||
*msglen = sig_msg_len;
|
||||
for (i = 0; i < *msglen; i++)
|
||||
msg[i] = sig_msg[i];
|
||||
|
||||
return 0;
|
||||
|
||||
|
||||
fail:
|
||||
*msglen = sig_msg_len;
|
||||
for (i = 0; i < *msglen; i++)
|
||||
msg[i] = 0;
|
||||
*msglen = -1;
|
||||
return -1;
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user