Use BDS for auth paths in XMSS (but not XMSSMT yet)

xmss_fast.c

@@ -79,6 +79,29 @@ Public domain.
   a[12] = (a[12] & 252) | ((v >> 22) & 3);}
 
 
+// TODO these defines still need to be merged into the parameter selection
+#define H 8
+#define K 2
+#define N 32
+
+typedef struct{
+  int h;
+  int next_idx;
+  unsigned int stackusage;
+  unsigned char completed;
+  unsigned char node[N];
+} treehash_inst;
+
+// TODO these data structures need to be non-global (especially for xmss_mt)
+unsigned char STACK[(H-K-1)*N];
+unsigned int STACKOFFSET = 0;
+unsigned char STACKLEVELS[H];
+
+unsigned char AUTH[H*N];
+unsigned char KEEP[H*N]; // this can be H / 2 + 1 rather than H, but that makes it  more tedious to index
+treehash_inst TREEHASH[H];
+unsigned char RETAIN[((1 << K) - K - 1) * N];
+
   /**
  * Used for pseudorandom keygeneration,
  * generates the seed for the WOTS keypair at address addr
@@ -184,12 +207,22 @@ static void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, con
   l_tree(leaf, pk, params, pub_seed, ltree_addr); 
 }
 
+static int treehash_minheight_on_stack(const xmss_params *params, const treehash_inst *treehash) {
+  int r = params->h, i;
+  for (i = 0; i < treehash->stackusage; i++) {
+    if (STACKLEVELS[STACKOFFSET - i - 1] < r) {
+      r = STACKLEVELS[STACKOFFSET - i - 1];
+    }
+  }
+  return r;
+}
+
 /**
  * Merkle's TreeHash algorithm. The address only needs to initialize the first 78 bits of addr. Everything else will be set by treehash.
  * Currently only used for key generation.
  * 
  */
-static void treehash(unsigned char *node, int height, int index, const unsigned char *sk_seed, const xmss_params *params, const unsigned char *pub_seed, const unsigned char addr[16])
+static void treehash_setup(unsigned char *node, int height, int index, const unsigned char *sk_seed, const xmss_params *params, const unsigned char *pub_seed, const unsigned char addr[16])
 {
 
   unsigned int idx = index;
@@ -212,8 +245,17 @@ static void treehash(unsigned char *node, int height, int index, const unsigned
   unsigned int  stacklevels[height+1];
   unsigned int  stackoffset=0;
   
+  int nodeh;
+
   lastnode = idx+(1<<height);
 
+  for(i = 0; i < H-K; i++) {
+    TREEHASH[i].h = i;
+    TREEHASH[i].completed = 1;
+    TREEHASH[i].stackusage = 0;
+  }
+
+  i = 0;
   for(;idx<lastnode;idx++) 
   {
     SET_LTREE_ADDRESS(ltree_addr,idx);
@@ -221,8 +263,23 @@ static void treehash(unsigned char *node, int height, int index, const unsigned
     gen_leaf_wots(stack+stackoffset*n,sk_seed,params, pub_seed, ltree_addr, ots_addr);
     stacklevels[stackoffset] = 0;
     stackoffset++;
+    if (H - K > 0 && i == 3) {
+      memcpy(TREEHASH[0].node, stack+stackoffset*n, n);
+    }
     while(stackoffset>1 && stacklevels[stackoffset-1] == stacklevels[stackoffset-2])
     {
+      nodeh = stacklevels[stackoffset-1];
+      if (i >> nodeh == 1) {
+        memcpy(AUTH + nodeh*n, stack+(stackoffset-1)*n, n);
+      }
+      else {
+        if (nodeh < H - K && i >> nodeh == 3) {
+          memcpy(TREEHASH[nodeh].node, stack+(stackoffset-1)*n, n);
+        }
+        else if (nodeh >= H - K) {
+          memcpy(RETAIN + ((1 << (H - 1 - nodeh)) + nodeh - H + (((i >> nodeh) - 3) >> 1)) * n, stack+(stackoffset-1)*n, n);
+        }
+      }
       SET_NODE_TREE_HEIGHT(node_addr,stacklevels[stackoffset-1]);
       SET_NODE_TREE_INDEX(node_addr, (idx >> (stacklevels[stackoffset-1]+1)));
       hash_2n_n(stack+(stackoffset-2)*n,stack+(stackoffset-2)*n, pub_seed,
@@ -230,11 +287,58 @@ static void treehash(unsigned char *node, int height, int index, const unsigned
       stacklevels[stackoffset-2]++;
       stackoffset--;
     }
+    i++;
   }
+
   for(i=0;i<n;i++)
     node[i] = stack[i];
 }
 
+static void treehash_update(treehash_inst *treehash, const unsigned char *sk_seed, const xmss_params *params, const unsigned char *pub_seed, const unsigned char addr[16]) {
+  int n = params->n;
+
+  unsigned char ots_addr[16];
+  unsigned char ltree_addr[16];
+  unsigned char node_addr[16];
+
+  memcpy(ots_addr, addr, 10);
+  SET_OTS_BIT(ots_addr, 1);
+  memcpy(ltree_addr, addr, 10);
+  SET_OTS_BIT(ltree_addr, 0);
+  SET_LTREE_BIT(ltree_addr, 1);
+  memcpy(node_addr, ltree_addr, 10);
+  SET_LTREE_BIT(node_addr, 0);
+  SET_NODE_PADDING(node_addr);
+
+  SET_LTREE_ADDRESS(ltree_addr, treehash->next_idx);
+  SET_OTS_ADDRESS(ots_addr, treehash->next_idx);
+
+  unsigned char nodebuffer[2 * n];
+  unsigned int nodeheight = 0;
+  gen_leaf_wots(nodebuffer, sk_seed, params, pub_seed, ltree_addr, ots_addr);
+  while (treehash->stackusage > 0 && STACKLEVELS[STACKOFFSET-1] == nodeheight) {
+    memcpy(nodebuffer + n, nodebuffer, n);
+    memcpy(nodebuffer, STACK + (STACKOFFSET-1)*n, n);
+    SET_NODE_TREE_HEIGHT(node_addr, nodeheight);
+    SET_NODE_TREE_INDEX(node_addr, (treehash->next_idx >> (nodeheight+1)));
+    hash_2n_n(nodebuffer, nodebuffer, pub_seed, node_addr, n);
+    nodeheight++;
+    treehash->stackusage--;
+    STACKOFFSET--;
+  }
+  if (nodeheight == treehash->h) { // this also implies stackusage == 0
+    memcpy(treehash->node, nodebuffer, n);
+    treehash->completed = 1;
+  }
+  else {
+    memcpy(STACK + STACKOFFSET*n, nodebuffer, n);
+    treehash->stackusage++;
+    STACKLEVELS[STACKOFFSET] = nodeheight;
+    STACKOFFSET++;
+    treehash->next_idx++;
+  }
+}
+
 /**
  * Computes a root node given a leaf and an authapth
  */
@@ -289,17 +393,27 @@ static void validate_authpath(unsigned char *root, const unsigned char *leaf, un
 }
 
 /**
- * Computes the authpath and the root. This method is using a lot of space as we build the whole tree and then select the authpath nodes.
+ * Returns the auth path for node leaf_idx and computes the auth path for the
- * For more efficient algorithms see e.g. the chapter on hash-based signatures in Bernstein, Buchmann, Dahmen. "Post-quantum Cryptography", Springer 2009.
+ * next leaf node, using the algorithm described by Buchmann, Dahmen and Szydlo
- * It returns the authpath in "authpath" with the node on level 0 at index 0.  
+ * in "Post Quantum Cryptography", Springer 2009.
  */
-static void compute_authpath_wots(unsigned char *root, unsigned char *authpath, unsigned long leaf_idx, const unsigned char *sk_seed, const xmss_params *params, unsigned char *pub_seed, unsigned char addr[16])
+static void compute_authpath_wots_fast(unsigned char *root, unsigned char *authpath, unsigned long leaf_idx, const unsigned char *sk_seed, const xmss_params *params, unsigned char *pub_seed, unsigned char addr[16])
 {
-  unsigned int i, j, level;
+  unsigned int i, j;
   int n = params->n;
   int h = params->h;
+  int k = K; // TODO retrieve this from params instead
 
-  unsigned char tree[2*(1<<h)*n];
+  // the auth path was already computed during the previous round
+  memcpy(authpath, AUTH, h*n);
+  // TODO but we don't have the root handy yet.
+  // memcpy(root, ???, n);
+
+  int tau = h;
+  int startidx;
+  int offset, rowidx;
+  int level, l_min, low;
+  unsigned char buf[2 * n];
 
   unsigned char ots_addr[16];
   unsigned char ltree_addr[16];
@@ -314,40 +428,72 @@ static void compute_authpath_wots(unsigned char *root, unsigned char *authpath,
   SET_LTREE_BIT(node_addr, 0);
   SET_NODE_PADDING(node_addr);
 
-  
+  for (i = 0; i < h; i++) {
-  // Compute all leaves
+    if (! ((leaf_idx >> i) & 1)) {
-  for(i = 0; i < (1<<h); i++)
+      tau = i;
-  {
+      break;
-    SET_LTREE_ADDRESS(ltree_addr,i);
-    SET_OTS_ADDRESS(ots_addr,i);
-    gen_leaf_wots(tree+((1<<h)*n + i*n), sk_seed, params, pub_seed, ltree_addr, ots_addr);
-  }
-  
-  
-  level = 0;
-  // Compute tree:
-  // Outer loop: For each inner layer 
-  for (i = (1<<h); i > 0; i>>=1)
-  {
-    SET_NODE_TREE_HEIGHT(node_addr, level);
-    // Inner loop: for each pair of sibling nodes
-    for (j = 0; j < i; j+=2)
-    {
-      SET_NODE_TREE_INDEX(node_addr, j>>1);
-      hash_2n_n(tree + (i>>1)*n + (j>>1) * n, tree + i*n + j*n, pub_seed, node_addr, n);
     }
-    level++;
   }
 
-  // copy authpath
+  if (!((leaf_idx >> (tau + 1)) & 1) && (tau < h - 1)) {
-  for(i=0;i<h;i++)
+    memcpy(KEEP + tau*n, AUTH + tau*n, n);
-    memcpy(authpath + i*n, tree + ((1<<h)>>i)*n + ((leaf_idx >> i) ^ 1) * n, n);
+  }
+  if (tau == 0) {
+    SET_LTREE_ADDRESS(ltree_addr,leaf_idx);
+    SET_OTS_ADDRESS(ots_addr,leaf_idx);
+    gen_leaf_wots(AUTH, sk_seed, params, pub_seed, ltree_addr, ots_addr);
+  }
+  else {
+    SET_NODE_TREE_HEIGHT(node_addr, (tau-1));
+    SET_NODE_TREE_INDEX(node_addr, leaf_idx >> tau);
+    memcpy(buf,     AUTH + (tau-1) * n, n);
+    memcpy(buf + n, KEEP + (tau-1) * n, n);
+    hash_2n_n(AUTH + tau * n, buf, pub_seed, node_addr, n);
+    for (i = 0; i < tau; i++) {
+      if (i < h - k) {
+        memcpy(AUTH + i * n, TREEHASH[i].node, n);
+      }
+      else {
+        offset = (1 << (h - 1 - i)) + i - h;
+        rowidx = ((leaf_idx >> i) - 1) >> 1;
+        memcpy(AUTH + i * n, RETAIN + (offset + rowidx) * n, n);
+      }
+    }
 
-  // copy root
+    for (i = 0; i < ((tau < h - k) ? tau : (h - k)); i++) {
-  memcpy(root, tree+n, n);
+      startidx = leaf_idx + 1 + 3 * (1 << i);
+      if (startidx < 1 << h) {
+        TREEHASH[i].h = i;
+        TREEHASH[i].next_idx = startidx;
+        TREEHASH[i].completed = 0;
+      }
+    }
+  }
+
+  for (i = 0; i < (h - k) >> 1; i++) {
+    l_min = h;
+    level = h - k;
+    for (j = 0; j < h - k; j++) {
+      if (TREEHASH[j].completed) {
+        low = h;
+      }
+      else if (TREEHASH[j].stackusage == 0) {
+        low = j;
+      }
+      else {
+        low = treehash_minheight_on_stack(params, &TREEHASH[j]);
+      }
+      if (low < l_min) {
+        level = j;
+        l_min = low;
+      }
+    }
+    if (level != h - k) {
+      treehash_update(&TREEHASH[level], sk_seed, params, pub_seed, addr);
+    }
+  }
 }
 
-
 /*
  * Generates a XMSS key pair for a given parameter set.
  * Format sk: [(32bit) idx || SK_SEED || SK_PRF || PUB_SEED]
@@ -369,7 +515,7 @@ int xmss_keypair(unsigned char *pk, unsigned char *sk, xmss_params *params)
 
   unsigned char addr[16] = {0,0,0,0};
   // Compute root
-  treehash(pk, params->h, 0, sk+4, params, sk+4+n+m, addr);
+  treehash_setup(pk, params->h, 0, sk+4, params, sk+4+n+m, addr);
   return 0;
 }
 
@@ -456,7 +602,7 @@ int xmss_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *sig
   sig_msg += params->wots_par.keysize;
   *sig_msg_len += params->wots_par.keysize;
 
-  compute_authpath_wots(root, sig_msg, idx, sk_seed, params, pub_seed, ots_addr);
+  compute_authpath_wots_fast(root, sig_msg, idx, sk_seed, params, pub_seed, ots_addr);
   sig_msg += params->h*n;
   *sig_msg_len += params->h*n;
   
@@ -581,7 +727,7 @@ int xmssmt_keypair(unsigned char *pk, unsigned char *sk, xmssmt_params *params)
   SET_LAYER_ADDRESS(addr, (params->d-1));
   
   // Compute root
-  treehash(pk, params->xmss_par.h, 0, sk+params->index_len, &(params->xmss_par), pk+n, addr);
+  treehash_setup(pk, params->xmss_par.h, 0, sk+params->index_len, &(params->xmss_par), pk+n, addr);
   return 0;
 }
 
@@ -681,7 +827,7 @@ int xmssmt_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *s
   sig_msg += params->xmss_par.wots_par.keysize;
   *sig_msg_len += params->xmss_par.wots_par.keysize;
 
-  compute_authpath_wots(root, sig_msg, idx_leaf, sk_seed, &(params->xmss_par), pub_seed, ots_addr);
+  compute_authpath_wots_fast(root, sig_msg, idx_leaf, sk_seed, &(params->xmss_par), pub_seed, ots_addr);
   sig_msg += tree_h*n;
   *sig_msg_len += tree_h*n;
   
@@ -704,7 +850,7 @@ int xmssmt_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *s
     sig_msg += params->xmss_par.wots_par.keysize;
     *sig_msg_len += params->xmss_par.wots_par.keysize;
 
-    compute_authpath_wots(root, sig_msg, idx_leaf, sk_seed, &(params->xmss_par), pub_seed, ots_addr);
+    compute_authpath_wots_fast(root, sig_msg, idx_leaf, sk_seed, &(params->xmss_par), pub_seed, ots_addr);
     sig_msg += tree_h*n;
     *sig_msg_len += tree_h*n;   
   }