Refactor for more consistent style and readability
This commit is contained in:
Joost Rijneveld
parent
1076b37321
commit
9d5884e120
81
fips202.c
81
fips202.c
@ -26,7 +26,7 @@ static void store64(uint8_t *x, uint64_t u)
|
||||
{
|
||||
unsigned int i;
|
||||
|
||||
for(i=0; i<8; ++i) {
|
||||
for (i = 0; i < 8; ++i) {
|
||||
x[i] = u;
|
||||
u >>= 8;
|
||||
}
|
||||
@ -104,8 +104,7 @@ void KeccakF1600_StatePermute(uint64_t * state)
|
||||
Aso = state[23];
|
||||
Asu = state[24];
|
||||
|
||||
for( round = 0; round < NROUNDS; round += 2 )
|
||||
{
|
||||
for (round = 0; round < NROUNDS; round += 2) {
|
||||
// prepareTheta
|
||||
BCa = Aba^Aga^Aka^Ama^Asa;
|
||||
BCe = Abe^Age^Ake^Ame^Ase;
|
||||
@ -323,95 +322,95 @@ void KeccakF1600_StatePermute(uint64_t * state)
|
||||
state[22] = Asi;
|
||||
state[23] = Aso;
|
||||
state[24] = Asu;
|
||||
|
||||
#undef round
|
||||
}
|
||||
|
||||
#include <string.h>
|
||||
#define MIN(a, b) ((a) < (b) ? (a) : (b))
|
||||
|
||||
|
||||
static void keccak_absorb(uint64_t *s,
|
||||
unsigned int r,
|
||||
const unsigned char *m, unsigned long long int mlen,
|
||||
static void keccak_absorb(uint64_t *s, unsigned int r,
|
||||
const unsigned char *m, unsigned long long mlen,
|
||||
unsigned char p)
|
||||
{
|
||||
unsigned long long i;
|
||||
unsigned char t[200];
|
||||
|
||||
while (mlen >= r)
|
||||
{
|
||||
for (i = 0; i < r / 8; ++i)
|
||||
while (mlen >= r) {
|
||||
for (i = 0; i < r / 8; ++i) {
|
||||
s[i] ^= load64(m + 8 * i);
|
||||
}
|
||||
KeccakF1600_StatePermute(s);
|
||||
mlen -= r;
|
||||
m += r;
|
||||
}
|
||||
|
||||
for (i = 0; i < r; ++i)
|
||||
for (i = 0; i < r; ++i) {
|
||||
t[i] = 0;
|
||||
for (i = 0; i < mlen; ++i)
|
||||
}
|
||||
for (i = 0; i < mlen; ++i) {
|
||||
t[i] = m[i];
|
||||
}
|
||||
t[i] = p;
|
||||
t[r - 1] |= 128;
|
||||
for (i = 0; i < r / 8; ++i)
|
||||
for (i = 0; i < r / 8; ++i) {
|
||||
s[i] ^= load64(t + 8 * i);
|
||||
}
|
||||
}
|
||||
|
||||
static void keccak_squeezeblocks(unsigned char *h, unsigned long long int nblocks,
|
||||
uint64_t *s,
|
||||
unsigned int r)
|
||||
static void keccak_squeezeblocks(unsigned char *h, unsigned long long nblocks,
|
||||
uint64_t *s, unsigned int r)
|
||||
{
|
||||
unsigned int i;
|
||||
while(nblocks > 0)
|
||||
{
|
||||
|
||||
while (nblocks > 0) {
|
||||
KeccakF1600_StatePermute(s);
|
||||
for(i=0;i<(r>>3);i++)
|
||||
{
|
||||
store64(h+8*i, s[i]);
|
||||
for (i = 0; i < (r >> 3); i++) {
|
||||
store64(h + 8*i, s[i]);
|
||||
}
|
||||
h += r;
|
||||
nblocks--;
|
||||
}
|
||||
}
|
||||
|
||||
void shake128(unsigned char *output, unsigned int outputByteLen, const unsigned char *input, unsigned int inputByteLen)
|
||||
void shake128(unsigned char *out, unsigned long long outlen,
|
||||
const unsigned char *in, unsigned long long inlen)
|
||||
{
|
||||
unsigned int i;
|
||||
unsigned long long i;
|
||||
uint64_t s[25];
|
||||
unsigned char d[SHAKE128_RATE];
|
||||
|
||||
for(i = 0; i < 25; i++)
|
||||
for (i = 0; i < 25; i++) {
|
||||
s[i] = 0;
|
||||
keccak_absorb(s, SHAKE128_RATE, input, inputByteLen, 0x1F);
|
||||
}
|
||||
keccak_absorb(s, SHAKE128_RATE, in, inlen, 0x1F);
|
||||
|
||||
keccak_squeezeblocks(output, outputByteLen/SHAKE128_RATE, s, SHAKE128_RATE);
|
||||
output += (outputByteLen/SHAKE128_RATE)*SHAKE128_RATE;
|
||||
keccak_squeezeblocks(out, outlen / SHAKE128_RATE, s, SHAKE128_RATE);
|
||||
out += (outlen / SHAKE128_RATE) * SHAKE128_RATE;
|
||||
|
||||
if (outputByteLen % SHAKE128_RATE) {
|
||||
if (outlen % SHAKE128_RATE) {
|
||||
keccak_squeezeblocks(d, 1, s, SHAKE128_RATE);
|
||||
for(i = 0; i < outputByteLen % SHAKE128_RATE; i++) {
|
||||
output[i] = d[i];
|
||||
for (i = 0; i < outlen % SHAKE128_RATE; i++) {
|
||||
out[i] = d[i];
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void shake256(unsigned char *output, unsigned int outputByteLen, const unsigned char *input, unsigned int inputByteLen)
|
||||
void shake256(unsigned char *output, unsigned long long outlen,
|
||||
const unsigned char *in, unsigned long long inlen)
|
||||
{
|
||||
unsigned int i;
|
||||
unsigned long long i;
|
||||
uint64_t s[25];
|
||||
unsigned char d[SHAKE256_RATE];
|
||||
|
||||
for(i = 0; i < 25; i++)
|
||||
for (i = 0; i < 25; i++) {
|
||||
s[i] = 0;
|
||||
keccak_absorb(s, SHAKE256_RATE, input, inputByteLen, 0x1F);
|
||||
}
|
||||
keccak_absorb(s, SHAKE256_RATE, in, inlen, 0x1F);
|
||||
|
||||
keccak_squeezeblocks(output, outputByteLen/SHAKE256_RATE, s, SHAKE256_RATE);
|
||||
output += (outputByteLen/SHAKE256_RATE)*SHAKE256_RATE;
|
||||
keccak_squeezeblocks(output, outlen / SHAKE256_RATE, s, SHAKE256_RATE);
|
||||
output += (outlen / SHAKE256_RATE) * SHAKE256_RATE;
|
||||
|
||||
if (outputByteLen % SHAKE256_RATE) {
|
||||
if (outlen % SHAKE256_RATE) {
|
||||
keccak_squeezeblocks(d, 1, s, SHAKE256_RATE);
|
||||
for(i = 0; i < outputByteLen % SHAKE256_RATE; i++) {
|
||||
for (i = 0; i < outlen % SHAKE256_RATE; i++) {
|
||||
output[i] = d[i];
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,12 +1,13 @@
|
||||
#ifndef FIPS202_H
|
||||
#define FIPS202_H
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
#define SHAKE128_RATE 168
|
||||
#define SHAKE256_RATE 136
|
||||
|
||||
void shake128(unsigned char *output, unsigned int outputByteLen, const unsigned char *input, unsigned int inputByteLen);
|
||||
void shake256(unsigned char *output, unsigned int outputByteLen, const unsigned char *input, unsigned int inputByteLen);
|
||||
void shake128(unsigned char *out, unsigned long long outlen,
|
||||
const unsigned char *in, unsigned long long inlen);
|
||||
|
||||
void shake256(unsigned char *out, unsigned long long outlen,
|
||||
const unsigned char *in, unsigned long long inlen);
|
||||
|
||||
#endif
|
||||
|
||||
52
hash.c
52
hash.c
@ -11,8 +11,6 @@ Public domain.
|
||||
#include "hash.h"
|
||||
#include "fips202.h"
|
||||
|
||||
#include <stddef.h>
|
||||
#include <stdio.h>
|
||||
#include <stdint.h>
|
||||
#include <string.h>
|
||||
#include <openssl/sha.h>
|
||||
@ -20,24 +18,25 @@ Public domain.
|
||||
unsigned char* addr_to_byte(unsigned char *bytes, const uint32_t addr[8])
|
||||
{
|
||||
#if IS_LITTLE_ENDIAN==1
|
||||
int i = 0;
|
||||
for(i=0;i<8;i++)
|
||||
to_byte(bytes+i*4, addr[i],4);
|
||||
return bytes;
|
||||
int i;
|
||||
for (i = 0; i < 8; i++) {
|
||||
to_byte(bytes + i*4, addr[i], 4);
|
||||
}
|
||||
#else
|
||||
memcpy(bytes, addr, 32);
|
||||
return bytes;
|
||||
#endif
|
||||
return bytes;
|
||||
}
|
||||
|
||||
static int core_hash(unsigned char *out, const unsigned int type, const unsigned char *key, unsigned int keylen, const unsigned char *in, unsigned long long inlen, int n)
|
||||
static int core_hash(unsigned char *out, const unsigned int type,
|
||||
const unsigned char *key, unsigned int keylen,
|
||||
const unsigned char *in, unsigned long long inlen, int n)
|
||||
{
|
||||
unsigned long long i = 0;
|
||||
unsigned char buf[inlen + n + keylen];
|
||||
|
||||
// Input is (toByte(X, 32) || KEY || M)
|
||||
/* Input is of the form (toByte(X, 32) || KEY || M). */
|
||||
|
||||
// set toByte
|
||||
to_byte(buf, type, n);
|
||||
|
||||
for (i=0; i < keylen; i++) {
|
||||
@ -66,30 +65,24 @@ static int core_hash(unsigned char *out, const unsigned int type, const unsigned
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implements PRF
|
||||
*/
|
||||
int prf(unsigned char *out, const unsigned char *in, const unsigned char *key, unsigned int keylen)
|
||||
int prf(unsigned char *out, const unsigned char *in,
|
||||
const unsigned char *key, unsigned int keylen)
|
||||
{
|
||||
return core_hash(out, 3, key, keylen, in, 32, keylen);
|
||||
}
|
||||
|
||||
/*
|
||||
* Implemts H_msg
|
||||
*/
|
||||
int h_msg(unsigned char *out, const unsigned char *in, unsigned long long inlen, const unsigned char *key, const unsigned int keylen)
|
||||
int h_msg(unsigned char *out,
|
||||
const unsigned char *in, unsigned long long inlen,
|
||||
const unsigned char *key, const unsigned int keylen)
|
||||
{
|
||||
if (keylen != 3*XMSS_N){
|
||||
fprintf(stderr, "H_msg takes 3n-bit keys, we got n=%d but a keylength of %d.\n", XMSS_N, keylen);
|
||||
return 1;
|
||||
}
|
||||
return core_hash(out, 2, key, keylen, in, inlen, XMSS_N);
|
||||
}
|
||||
|
||||
/**
|
||||
* We assume the left half is in in[0]...in[n-1]
|
||||
*/
|
||||
int hash_h(unsigned char *out, const unsigned char *in, const unsigned char *pub_seed, uint32_t addr[8])
|
||||
int hash_h(unsigned char *out, const unsigned char *in,
|
||||
const unsigned char *pub_seed, uint32_t addr[8])
|
||||
{
|
||||
unsigned char buf[2*XMSS_N];
|
||||
unsigned char key[XMSS_N];
|
||||
@ -97,14 +90,14 @@ int hash_h(unsigned char *out, const unsigned char *in, const unsigned char *pub
|
||||
unsigned char byte_addr[32];
|
||||
unsigned int i;
|
||||
|
||||
setKeyAndMask(addr, 0);
|
||||
set_key_and_mask(addr, 0);
|
||||
addr_to_byte(byte_addr, addr);
|
||||
prf(key, byte_addr, pub_seed, XMSS_N);
|
||||
// Use MSB order
|
||||
setKeyAndMask(addr, 1);
|
||||
set_key_and_mask(addr, 1);
|
||||
addr_to_byte(byte_addr, addr);
|
||||
prf(bitmask, byte_addr, pub_seed, XMSS_N);
|
||||
setKeyAndMask(addr, 2);
|
||||
set_key_and_mask(addr, 2);
|
||||
addr_to_byte(byte_addr, addr);
|
||||
prf(bitmask+XMSS_N, byte_addr, pub_seed, XMSS_N);
|
||||
for (i = 0; i < 2*XMSS_N; i++) {
|
||||
@ -113,7 +106,8 @@ int hash_h(unsigned char *out, const unsigned char *in, const unsigned char *pub
|
||||
return core_hash(out, 1, key, XMSS_N, buf, 2*XMSS_N, XMSS_N);
|
||||
}
|
||||
|
||||
int hash_f(unsigned char *out, const unsigned char *in, const unsigned char *pub_seed, uint32_t addr[8])
|
||||
int hash_f(unsigned char *out, const unsigned char *in,
|
||||
const unsigned char *pub_seed, uint32_t addr[8])
|
||||
{
|
||||
unsigned char buf[XMSS_N];
|
||||
unsigned char key[XMSS_N];
|
||||
@ -121,11 +115,11 @@ int hash_f(unsigned char *out, const unsigned char *in, const unsigned char *pub
|
||||
unsigned char byte_addr[32];
|
||||
unsigned int i;
|
||||
|
||||
setKeyAndMask(addr, 0);
|
||||
set_key_and_mask(addr, 0);
|
||||
addr_to_byte(byte_addr, addr);
|
||||
prf(key, byte_addr, pub_seed, XMSS_N);
|
||||
|
||||
setKeyAndMask(addr, 1);
|
||||
set_key_and_mask(addr, 1);
|
||||
addr_to_byte(byte_addr, addr);
|
||||
prf(bitmask, byte_addr, pub_seed, XMSS_N);
|
||||
|
||||
|
||||
17
hash.h
17
hash.h
@ -11,9 +11,18 @@ Public domain.
|
||||
#define IS_LITTLE_ENDIAN 1
|
||||
|
||||
unsigned char* addr_to_byte(unsigned char *bytes, const uint32_t addr[8]);
|
||||
int prf(unsigned char *out, const unsigned char *in, const unsigned char *key, unsigned int keylen);
|
||||
int h_msg(unsigned char *out,const unsigned char *in,unsigned long long inlen, const unsigned char *key, const unsigned int keylen);
|
||||
int hash_h(unsigned char *out, const unsigned char *in, const unsigned char *pub_seed, uint32_t addr[8]);
|
||||
int hash_f(unsigned char *out, const unsigned char *in, const unsigned char *pub_seed, uint32_t addr[8]);
|
||||
|
||||
int prf(unsigned char *out, const unsigned char *in,
|
||||
const unsigned char *key, unsigned int keylen);
|
||||
|
||||
int h_msg(unsigned char *out,
|
||||
const unsigned char *in, unsigned long long inlen,
|
||||
const unsigned char *key, const unsigned int keylen);
|
||||
|
||||
int hash_h(unsigned char *out, const unsigned char *in,
|
||||
const unsigned char *pub_seed, uint32_t addr[8]);
|
||||
|
||||
int hash_f(unsigned char *out, const unsigned char *in,
|
||||
const unsigned char *pub_seed, uint32_t addr[8]);
|
||||
|
||||
#endif
|
||||
|
||||
@ -6,53 +6,54 @@ Public domain.
|
||||
*/
|
||||
#include <stdint.h>
|
||||
|
||||
void setLayerADRS(uint32_t adrs[8], uint32_t layer){
|
||||
adrs[0] = layer;
|
||||
void set_layer_addr(uint32_t addr[8], uint32_t layer) {
|
||||
addr[0] = layer;
|
||||
}
|
||||
|
||||
void setTreeADRS(uint32_t adrs[8], uint64_t tree){
|
||||
adrs[1] = (uint32_t) (tree >> 32);
|
||||
adrs[2] = (uint32_t) tree;
|
||||
void set_tree_addr(uint32_t addr[8], uint64_t tree) {
|
||||
addr[1] = (uint32_t) (tree >> 32);
|
||||
addr[2] = (uint32_t) tree;
|
||||
}
|
||||
|
||||
void setType(uint32_t adrs[8], uint32_t type){
|
||||
adrs[3] = type;
|
||||
void set_type(uint32_t addr[8], uint32_t type) {
|
||||
int i;
|
||||
for(i = 4; i < 8; i++){
|
||||
adrs[i] = 0;
|
||||
|
||||
addr[3] = type;
|
||||
for (i = 4; i < 8; i++) {
|
||||
addr[i] = 0;
|
||||
}
|
||||
}
|
||||
|
||||
void setKeyAndMask(uint32_t adrs[8], uint32_t keyAndMask){
|
||||
adrs[7] = keyAndMask;
|
||||
void set_key_and_mask(uint32_t addr[8], uint32_t key_and_mask) {
|
||||
addr[7] = key_and_mask;
|
||||
}
|
||||
|
||||
// OTS
|
||||
/* These functions are used for OTS addresses. */
|
||||
|
||||
void setOTSADRS(uint32_t adrs[8], uint32_t ots){
|
||||
adrs[4] = ots;
|
||||
void set_ots_addr(uint32_t addr[8], uint32_t ots) {
|
||||
addr[4] = ots;
|
||||
}
|
||||
|
||||
void setChainADRS(uint32_t adrs[8], uint32_t chain){
|
||||
adrs[5] = chain;
|
||||
void set_chain_addr(uint32_t addr[8], uint32_t chain) {
|
||||
addr[5] = chain;
|
||||
}
|
||||
|
||||
void setHashADRS(uint32_t adrs[8], uint32_t hash){
|
||||
adrs[6] = hash;
|
||||
void set_hash_addr(uint32_t addr[8], uint32_t hash) {
|
||||
addr[6] = hash;
|
||||
}
|
||||
|
||||
// L-tree
|
||||
/* This function is used for L-trees. */
|
||||
|
||||
void setLtreeADRS(uint32_t adrs[8], uint32_t ltree){
|
||||
adrs[4] = ltree;
|
||||
void set_ltree_addr(uint32_t addr[8], uint32_t ltree) {
|
||||
addr[4] = ltree;
|
||||
}
|
||||
|
||||
// Hash Tree & L-tree
|
||||
/* These functions are used for hash tree addresses. */
|
||||
|
||||
void setTreeHeight(uint32_t adrs[8], uint32_t treeHeight){
|
||||
adrs[5] = treeHeight;
|
||||
void set_tree_height(uint32_t addr[8], uint32_t treeHeight) {
|
||||
addr[5] = treeHeight;
|
||||
}
|
||||
|
||||
void setTreeIndex(uint32_t adrs[8], uint32_t treeIndex){
|
||||
adrs[6] = treeIndex;
|
||||
void set_tree_index(uint32_t addr[8], uint32_t treeIndex) {
|
||||
addr[6] = treeIndex;
|
||||
}
|
||||
@ -7,31 +7,28 @@ Public domain.
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
void setLayerADRS(uint32_t adrs[8], uint32_t layer);
|
||||
void set_layer_addr(uint32_t addr[8], uint32_t layer);
|
||||
|
||||
void setTreeADRS(uint32_t adrs[8], uint64_t tree);
|
||||
void set_tree_addr(uint32_t addr[8], uint64_t tree);
|
||||
|
||||
void setType(uint32_t adrs[8], uint32_t type);
|
||||
void set_type(uint32_t addr[8], uint32_t type);
|
||||
|
||||
void setKeyAndMask(uint32_t adrs[8], uint32_t keyAndMask);
|
||||
void set_key_and_mask(uint32_t addr[8], uint32_t key_and_mask);
|
||||
|
||||
// OTS
|
||||
/* These functions are used for OTS addresses. */
|
||||
|
||||
void setOTSADRS(uint32_t adrs[8], uint32_t ots);
|
||||
void set_ots_addr(uint32_t addr[8], uint32_t ots);
|
||||
|
||||
void setChainADRS(uint32_t adrs[8], uint32_t chain);
|
||||
void set_chain_addr(uint32_t addr[8], uint32_t chain);
|
||||
|
||||
void setHashADRS(uint32_t adrs[8], uint32_t hash);
|
||||
void set_hash_addr(uint32_t addr[8], uint32_t hash);
|
||||
|
||||
// L-tree
|
||||
/* This function is used for L-trees. */
|
||||
|
||||
void setLtreeADRS(uint32_t adrs[8], uint32_t ltree);
|
||||
|
||||
// Hash Tree & L-tree
|
||||
|
||||
void setTreeHeight(uint32_t adrs[8], uint32_t treeHeight);
|
||||
|
||||
void setTreeIndex(uint32_t adrs[8], uint32_t treeIndex);
|
||||
void set_ltree_addr(uint32_t addr[8], uint32_t ltree);
|
||||
|
||||
/* These functions are used for hash tree addresses. */
|
||||
|
||||
void set_tree_height(uint32_t addr[8], uint32_t treeHeight);
|
||||
|
||||
void set_tree_index(uint32_t addr[8], uint32_t treeIndex);
|
||||
|
||||
@ -2,13 +2,9 @@
|
||||
This code was taken from the SPHINCS reference implementation and is public domain.
|
||||
*/
|
||||
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <fcntl.h>
|
||||
#include <unistd.h>
|
||||
|
||||
/* it's really stupid that there isn't a syscall for this */
|
||||
|
||||
static int fd = -1;
|
||||
|
||||
void randombytes(unsigned char *x, unsigned long long xlen)
|
||||
@ -18,13 +14,20 @@ void randombytes(unsigned char *x, unsigned long long xlen)
|
||||
if (fd == -1) {
|
||||
for (;;) {
|
||||
fd = open("/dev/urandom", O_RDONLY);
|
||||
if (fd != -1) break;
|
||||
if (fd != -1) {
|
||||
break;
|
||||
}
|
||||
sleep(1);
|
||||
}
|
||||
}
|
||||
|
||||
while (xlen > 0) {
|
||||
if (xlen < 1048576) i = xlen; else i = 1048576;
|
||||
if (xlen < 1048576) {
|
||||
i = xlen;
|
||||
}
|
||||
else {
|
||||
i = 1048576;
|
||||
}
|
||||
|
||||
i = read(fd, x, i);
|
||||
if (i < 1) {
|
||||
|
||||
@ -34,7 +34,7 @@ int main()
|
||||
|
||||
wots_pkgen(pk1, seed, pub_seed, addr);
|
||||
wots_sign(sig, msg, seed, pub_seed, addr);
|
||||
wots_pkFromSig(pk2, sig, msg, pub_seed, addr);
|
||||
wots_pk_from_sig(pk2, sig, msg, pub_seed, addr);
|
||||
|
||||
for (i = 0; i < sig_len; i++)
|
||||
if (pk1[i] != pk2[i]) {
|
||||
|
||||
80
wots.c
80
wots.c
@ -5,9 +5,7 @@ Joost Rijneveld
|
||||
Public domain.
|
||||
*/
|
||||
|
||||
#include "math.h"
|
||||
#include "stdio.h"
|
||||
#include "stdint.h"
|
||||
#include <stdint.h>
|
||||
#include "xmss_commons.h"
|
||||
#include "hash.h"
|
||||
#include "wots.h"
|
||||
@ -21,9 +19,10 @@ Public domain.
|
||||
*/
|
||||
static void expand_seed(unsigned char *outseeds, const unsigned char *inseed)
|
||||
{
|
||||
uint32_t i = 0;
|
||||
uint32_t i;
|
||||
unsigned char ctr[32];
|
||||
for(i = 0; i < XMSS_WOTS_LEN; i++){
|
||||
|
||||
for (i = 0; i < XMSS_WOTS_LEN; i++) {
|
||||
to_byte(ctr, i, 32);
|
||||
prf(outseeds + i*XMSS_N, ctr, inseed, XMSS_N);
|
||||
}
|
||||
@ -36,22 +35,24 @@ static void expand_seed(unsigned char *outseeds, const unsigned char *inseed)
|
||||
* interpretes in as start-th value of the chain
|
||||
* addr has to contain the address of the chain
|
||||
*/
|
||||
static void gen_chain(unsigned char *out, const unsigned char *in, unsigned int start, unsigned int steps, const unsigned char *pub_seed, uint32_t addr[8])
|
||||
static void gen_chain(unsigned char *out, const unsigned char *in,
|
||||
unsigned int start, unsigned int steps,
|
||||
const unsigned char *pub_seed, uint32_t addr[8])
|
||||
{
|
||||
uint32_t i, j;
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
out[j] = in[j];
|
||||
uint32_t i;
|
||||
|
||||
for (i = 0; i < XMSS_N; i++) {
|
||||
out[i] = in[i];
|
||||
}
|
||||
|
||||
for (i = start; i < (start+steps) && i < XMSS_WOTS_W; i++) {
|
||||
setHashADRS(addr, i);
|
||||
set_hash_addr(addr, i);
|
||||
hash_f(out, out, pub_seed, addr);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* base_w algorithm as described in draft.
|
||||
*
|
||||
*
|
||||
*/
|
||||
static void base_w(int *output, const int out_len, const unsigned char *input)
|
||||
{
|
||||
@ -59,9 +60,9 @@ static void base_w(int *output, const int out_len, const unsigned char *input)
|
||||
int out = 0;
|
||||
uint8_t total = 0;
|
||||
int bits = 0;
|
||||
int consumed = 0;
|
||||
int i;
|
||||
|
||||
for (consumed = 0; consumed < out_len; consumed++) {
|
||||
for (i = 0; i < out_len; i++) {
|
||||
if (bits == 0) {
|
||||
total = input[in];
|
||||
in++;
|
||||
@ -73,37 +74,39 @@ static void base_w(int *output, const int out_len, const unsigned char *input)
|
||||
}
|
||||
}
|
||||
|
||||
void wots_pkgen(unsigned char *pk, const unsigned char *sk, const unsigned char *pub_seed, uint32_t addr[8])
|
||||
void wots_pkgen(unsigned char *pk, const unsigned char *sk,
|
||||
const unsigned char *pub_seed, uint32_t addr[8])
|
||||
{
|
||||
uint32_t i;
|
||||
|
||||
expand_seed(pk, sk);
|
||||
for (i=0; i < XMSS_WOTS_LEN; i++) {
|
||||
setChainADRS(addr, i);
|
||||
gen_chain(pk+i*XMSS_N, pk+i*XMSS_N, 0, XMSS_WOTS_W-1, pub_seed, addr);
|
||||
for (i = 0; i < XMSS_WOTS_LEN; i++) {
|
||||
set_chain_addr(addr, i);
|
||||
gen_chain(pk + i*XMSS_N, pk + i*XMSS_N,
|
||||
0, XMSS_WOTS_W-1, pub_seed, addr);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
void wots_sign(unsigned char *sig, const unsigned char *msg, const unsigned char *sk, const unsigned char *pub_seed, uint32_t addr[8])
|
||||
void wots_sign(unsigned char *sig, const unsigned char *msg,
|
||||
const unsigned char *sk, const unsigned char *pub_seed,
|
||||
uint32_t addr[8])
|
||||
{
|
||||
int basew[XMSS_WOTS_LEN];
|
||||
int csum = 0;
|
||||
uint32_t i = 0;
|
||||
unsigned char csum_bytes[((XMSS_WOTS_LEN2 * XMSS_WOTS_LOG_W) + 7) / 8];
|
||||
int csum_basew[XMSS_WOTS_LEN2];
|
||||
uint32_t i;
|
||||
|
||||
base_w(basew, XMSS_WOTS_LEN1, msg);
|
||||
|
||||
for (i=0; i < XMSS_WOTS_LEN1; i++) {
|
||||
for (i = 0; i < XMSS_WOTS_LEN1; i++) {
|
||||
csum += XMSS_WOTS_W - 1 - basew[i];
|
||||
}
|
||||
|
||||
csum = csum << (8 - ((XMSS_WOTS_LEN2 * XMSS_WOTS_LOG_W) % 8));
|
||||
|
||||
int len_2_bytes = ((XMSS_WOTS_LEN2 * XMSS_WOTS_LOG_W) + 7) / 8;
|
||||
|
||||
unsigned char csum_bytes[len_2_bytes];
|
||||
to_byte(csum_bytes, csum, len_2_bytes);
|
||||
|
||||
int csum_basew[XMSS_WOTS_LEN2];
|
||||
to_byte(csum_bytes, csum, ((XMSS_WOTS_LEN2 * XMSS_WOTS_LOG_W) + 7) / 8);
|
||||
base_w(csum_basew, XMSS_WOTS_LEN2, csum_bytes);
|
||||
|
||||
for (i = 0; i < XMSS_WOTS_LEN2; i++) {
|
||||
@ -113,15 +116,20 @@ void wots_sign(unsigned char *sig, const unsigned char *msg, const unsigned char
|
||||
expand_seed(sig, sk);
|
||||
|
||||
for (i = 0; i < XMSS_WOTS_LEN; i++) {
|
||||
setChainADRS(addr, i);
|
||||
gen_chain(sig+i*XMSS_N, sig+i*XMSS_N, 0, basew[i], pub_seed, addr);
|
||||
set_chain_addr(addr, i);
|
||||
gen_chain(sig + i*XMSS_N, sig + i*XMSS_N,
|
||||
0, basew[i], pub_seed, addr);
|
||||
}
|
||||
}
|
||||
|
||||
void wots_pkFromSig(unsigned char *pk, const unsigned char *sig, const unsigned char *msg, const unsigned char *pub_seed, uint32_t addr[8])
|
||||
void wots_pk_from_sig(unsigned char *pk,
|
||||
const unsigned char *sig, const unsigned char *msg,
|
||||
const unsigned char *pub_seed, uint32_t addr[8])
|
||||
{
|
||||
int basew[XMSS_WOTS_LEN];
|
||||
int csum = 0;
|
||||
unsigned char csum_bytes[((XMSS_WOTS_LEN2 * XMSS_WOTS_LOG_W) + 7) / 8];
|
||||
int csum_basew[XMSS_WOTS_LEN2];
|
||||
uint32_t i = 0;
|
||||
|
||||
base_w(basew, XMSS_WOTS_LEN1, msg);
|
||||
@ -132,19 +140,15 @@ void wots_pkFromSig(unsigned char *pk, const unsigned char *sig, const unsigned
|
||||
|
||||
csum = csum << (8 - ((XMSS_WOTS_LEN2 * XMSS_WOTS_LOG_W) % 8));
|
||||
|
||||
int len_2_bytes = ((XMSS_WOTS_LEN2 * XMSS_WOTS_LOG_W) + 7) / 8;
|
||||
|
||||
unsigned char csum_bytes[len_2_bytes];
|
||||
to_byte(csum_bytes, csum, len_2_bytes);
|
||||
|
||||
int csum_basew[XMSS_WOTS_LEN2];
|
||||
to_byte(csum_bytes, csum, ((XMSS_WOTS_LEN2 * XMSS_WOTS_LOG_W) + 7) / 8);
|
||||
base_w(csum_basew, XMSS_WOTS_LEN2, csum_bytes);
|
||||
|
||||
for (i = 0; i < XMSS_WOTS_LEN2; i++) {
|
||||
basew[XMSS_WOTS_LEN1 + i] = csum_basew[i];
|
||||
}
|
||||
for (i=0; i < XMSS_WOTS_LEN; i++) {
|
||||
setChainADRS(addr, i);
|
||||
gen_chain(pk+i*XMSS_N, sig+i*XMSS_N, basew[i], XMSS_WOTS_W-1-basew[i], pub_seed, addr);
|
||||
set_chain_addr(addr, i);
|
||||
gen_chain(pk + i*XMSS_N, sig + i*XMSS_N,
|
||||
basew[i], XMSS_WOTS_W-1-basew[i], pub_seed, addr);
|
||||
}
|
||||
}
|
||||
|
||||
13
wots.h
13
wots.h
@ -16,18 +16,21 @@ Public domain.
|
||||
*
|
||||
* Places the computed public key at address pk.
|
||||
*/
|
||||
void wots_pkgen(unsigned char *pk, const unsigned char *sk, const unsigned char *pub_seed, uint32_t addr[8]);
|
||||
void wots_pkgen(unsigned char *pk, const unsigned char *sk,
|
||||
const unsigned char *pub_seed, uint32_t addr[8]);
|
||||
|
||||
/**
|
||||
* Takes a m-byte message and the 32-byte seed for the secret key to compute a signature that is placed at "sig".
|
||||
*
|
||||
*/
|
||||
void wots_sign(unsigned char *sig, const unsigned char *msg, const unsigned char *sk, const unsigned char *pub_seed, uint32_t addr[8]);
|
||||
void wots_sign(unsigned char *sig, const unsigned char *msg,
|
||||
const unsigned char *sk, const unsigned char *pub_seed,
|
||||
uint32_t addr[8]);
|
||||
|
||||
/**
|
||||
* Takes a WOTS signature, a m-byte message and computes a WOTS public key that it places at pk.
|
||||
*
|
||||
*/
|
||||
void wots_pkFromSig(unsigned char *pk, const unsigned char *sig, const unsigned char *msg, const unsigned char *pub_seed, uint32_t addr[8]);
|
||||
void wots_pk_from_sig(unsigned char *pk,
|
||||
const unsigned char *sig, const unsigned char *msg,
|
||||
const unsigned char *pub_seed, uint32_t addr[8]);
|
||||
|
||||
#endif
|
||||
|
||||
1
xmss.c
1
xmss.c
@ -1,4 +1,5 @@
|
||||
#include <stdint.h>
|
||||
|
||||
#include "params_runtime.h"
|
||||
#include "xmss_core.h"
|
||||
|
||||
|
||||
21
xmss.h
21
xmss.h
@ -9,19 +9,25 @@
|
||||
* Format pk: [oid || root || PUB_SEED]
|
||||
*/
|
||||
int xmss_keypair(unsigned char *pk, unsigned char *sk, const uint32_t oid);
|
||||
|
||||
/**
|
||||
* Signs a message.
|
||||
* Returns
|
||||
* 1. an array containing the signature followed by the message AND
|
||||
* 2. an updated secret key!
|
||||
*/
|
||||
int xmss_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *sig_msg_len, const unsigned char *msg, unsigned long long msglen);
|
||||
int xmss_sign(unsigned char *sk,
|
||||
unsigned char *sm, unsigned long long *smlen,
|
||||
const unsigned char *m, unsigned long long mlen);
|
||||
|
||||
/**
|
||||
* Verifies a given message signature pair under a given public key.
|
||||
*
|
||||
* Note: msg and msglen are pure outputs which carry the message in case verification succeeds. The (input) message is assumed to be within sig_msg which has the form (sig||msg).
|
||||
*/
|
||||
int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk);
|
||||
int xmss_sign_open(unsigned char *m, unsigned long long *mlen,
|
||||
const unsigned char *sm, unsigned long long smlen,
|
||||
const unsigned char *pk);
|
||||
|
||||
/*
|
||||
* Generates a XMSSMT key pair for a given parameter set.
|
||||
@ -29,16 +35,21 @@ int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigne
|
||||
* Format pk: [oid || root || PUB_SEED]
|
||||
*/
|
||||
int xmssmt_keypair(unsigned char *pk, unsigned char *sk, const uint32_t oid);
|
||||
|
||||
/**
|
||||
* Signs a message.
|
||||
* Returns
|
||||
* 1. an array containing the signature followed by the message AND
|
||||
* 2. an updated secret key!
|
||||
*/
|
||||
int xmssmt_sign(unsigned char *sk, unsigned char *sig_msg, unsigned long long *sig_msg_len, const unsigned char *msg, unsigned long long msglen);
|
||||
int xmssmt_sign(unsigned char *sk,
|
||||
unsigned char *sm, unsigned long long *smlen,
|
||||
const unsigned char *m, unsigned long long mlen);
|
||||
|
||||
/**
|
||||
* Verifies a given message signature pair under a given public key.
|
||||
*/
|
||||
int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk);
|
||||
int xmssmt_sign_open(unsigned char *m, unsigned long long *mlen,
|
||||
const unsigned char *sm, unsigned long long smlen,
|
||||
const unsigned char *pk);
|
||||
#endif
|
||||
|
||||
|
||||
384
xmss_commons.c
384
xmss_commons.c
@ -5,20 +5,20 @@ Joost Rijneveld
|
||||
Public domain.
|
||||
*/
|
||||
|
||||
#include "xmss_commons.h"
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#include "wots.h"
|
||||
#include "hash.h"
|
||||
#include "hash_address.h"
|
||||
#include "params.h"
|
||||
#include "wots.h"
|
||||
#include "xmss_commons.h"
|
||||
|
||||
void to_byte(unsigned char *out, unsigned long long in, uint32_t bytes)
|
||||
{
|
||||
int32_t i;
|
||||
int i;
|
||||
|
||||
for (i = bytes-1; i >= 0; i--) {
|
||||
out[i] = in & 0xff;
|
||||
in = in >> 8;
|
||||
@ -28,7 +28,9 @@ void to_byte(unsigned char *out, unsigned long long in, uint32_t bytes)
|
||||
/**
|
||||
* Computes the leaf at a given address. First generates the WOTS key pair, then computes leaf using l_tree. As this happens position independent, we only require that addr encodes the right ltree-address.
|
||||
*/
|
||||
void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8])
|
||||
void gen_leaf_wots(unsigned char *leaf,
|
||||
const unsigned char *sk_seed, const unsigned char *pub_seed,
|
||||
uint32_t ltree_addr[8], uint32_t ots_addr[8])
|
||||
{
|
||||
unsigned char seed[XMSS_N];
|
||||
unsigned char pk[XMSS_WOTS_KEYSIZE];
|
||||
@ -45,13 +47,15 @@ void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsi
|
||||
*
|
||||
* takes XMSS_N byte sk_seed and returns XMSS_N byte seed using 32 byte address addr.
|
||||
*/
|
||||
void get_seed(unsigned char *seed, const unsigned char *sk_seed, uint32_t addr[8])
|
||||
void get_seed(unsigned char *seed,
|
||||
const unsigned char *sk_seed, uint32_t addr[8])
|
||||
{
|
||||
unsigned char bytes[32];
|
||||
|
||||
// Make sure that chain addr, hash addr, and key bit are 0!
|
||||
setChainADRS(addr, 0);
|
||||
setHashADRS(addr, 0);
|
||||
setKeyAndMask(addr, 0);
|
||||
set_chain_addr(addr, 0);
|
||||
set_hash_addr(addr, 0);
|
||||
set_key_and_mask(addr, 0);
|
||||
// Generate pseudorandom value
|
||||
addr_to_byte(bytes, addr);
|
||||
prf(seed, bytes, sk_seed, XMSS_N);
|
||||
@ -60,47 +64,42 @@ void get_seed(unsigned char *seed, const unsigned char *sk_seed, uint32_t addr[8
|
||||
/**
|
||||
* Computes a leaf from a WOTS public key using an L-tree.
|
||||
*/
|
||||
void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8])
|
||||
void l_tree(unsigned char *leaf, unsigned char *wots_pk,
|
||||
const unsigned char *pub_seed, uint32_t addr[8])
|
||||
{
|
||||
unsigned int l = XMSS_WOTS_LEN;
|
||||
uint32_t i = 0;
|
||||
uint32_t height = 0;
|
||||
uint32_t bound;
|
||||
|
||||
//ADRS.setTreeHeight(0);
|
||||
setTreeHeight(addr, height);
|
||||
set_tree_height(addr, height);
|
||||
|
||||
while (l > 1) {
|
||||
bound = l >> 1; //floor(l / 2);
|
||||
bound = l >> 1;
|
||||
for (i = 0; i < bound; i++) {
|
||||
//ADRS.setTreeIndex(i);
|
||||
setTreeIndex(addr, i);
|
||||
//wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS);
|
||||
hash_h(wots_pk+i*XMSS_N, wots_pk+i*2*XMSS_N, pub_seed, addr);
|
||||
set_tree_index(addr, i);
|
||||
hash_h(wots_pk + i*XMSS_N, wots_pk + i*2*XMSS_N, pub_seed, addr);
|
||||
}
|
||||
//if ( l % 2 == 1 ) {
|
||||
if (l & 1) {
|
||||
//pk[floor(l / 2) + 1] = pk[l];
|
||||
memcpy(wots_pk+(l>>1)*XMSS_N, wots_pk+(l-1)*XMSS_N, XMSS_N);
|
||||
//l = ceil(l / 2);
|
||||
l=(l>>1)+1;
|
||||
memcpy(wots_pk + (l >> 1)*XMSS_N, wots_pk + (l - 1)*XMSS_N, XMSS_N);
|
||||
l = (l >> 1) + 1;
|
||||
}
|
||||
else {
|
||||
//l = ceil(l / 2);
|
||||
l=(l>>1);
|
||||
l = l >> 1;
|
||||
}
|
||||
//ADRS.setTreeHeight(ADRS.getTreeHeight() + 1);
|
||||
height++;
|
||||
setTreeHeight(addr, height);
|
||||
set_tree_height(addr, height);
|
||||
}
|
||||
//return pk[0];
|
||||
memcpy(leaf, wots_pk, XMSS_N);
|
||||
}
|
||||
|
||||
/**
|
||||
* Computes a root node given a leaf and an authapth
|
||||
*/
|
||||
static void validate_authpath(unsigned char *root, const unsigned char *leaf, unsigned long leafidx, const unsigned char *authpath, const unsigned char *pub_seed, uint32_t addr[8])
|
||||
static void validate_authpath(unsigned char *root,
|
||||
const unsigned char *leaf, unsigned long leafidx,
|
||||
const unsigned char *authpath,
|
||||
const unsigned char *pub_seed, uint32_t addr[8])
|
||||
{
|
||||
uint32_t i, j;
|
||||
unsigned char buffer[2*XMSS_N];
|
||||
@ -108,48 +107,52 @@ static void validate_authpath(unsigned char *root, const unsigned char *leaf, un
|
||||
// If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left.
|
||||
// Otherwise, it is the other way around
|
||||
if (leafidx & 1) {
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[XMSS_N+j] = leaf[j];
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
for (j = 0; j < XMSS_N; j++) {
|
||||
buffer[XMSS_N + j] = leaf[j];
|
||||
buffer[j] = authpath[j];
|
||||
}
|
||||
}
|
||||
else {
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
for (j = 0; j < XMSS_N; j++) {
|
||||
buffer[j] = leaf[j];
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[XMSS_N+j] = authpath[j];
|
||||
buffer[XMSS_N + j] = authpath[j];
|
||||
}
|
||||
}
|
||||
authpath += XMSS_N;
|
||||
|
||||
for (i = 0; i < XMSS_TREEHEIGHT-1; i++) {
|
||||
setTreeHeight(addr, i);
|
||||
set_tree_height(addr, i);
|
||||
leafidx >>= 1;
|
||||
setTreeIndex(addr, leafidx);
|
||||
if (leafidx&1) {
|
||||
hash_h(buffer+XMSS_N, buffer, pub_seed, addr);
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
set_tree_index(addr, leafidx);
|
||||
if (leafidx & 1) {
|
||||
hash_h(buffer + XMSS_N, buffer, pub_seed, addr);
|
||||
for (j = 0; j < XMSS_N; j++) {
|
||||
buffer[j] = authpath[j];
|
||||
}
|
||||
}
|
||||
else {
|
||||
hash_h(buffer, buffer, pub_seed, addr);
|
||||
for (j = 0; j < XMSS_N; j++)
|
||||
buffer[j+XMSS_N] = authpath[j];
|
||||
for (j = 0; j < XMSS_N; j++) {
|
||||
buffer[j + XMSS_N] = authpath[j];
|
||||
}
|
||||
}
|
||||
authpath += XMSS_N;
|
||||
}
|
||||
setTreeHeight(addr, (XMSS_TREEHEIGHT-1));
|
||||
set_tree_height(addr, XMSS_TREEHEIGHT - 1);
|
||||
leafidx >>= 1;
|
||||
setTreeIndex(addr, leafidx);
|
||||
set_tree_index(addr, leafidx);
|
||||
hash_h(root, buffer, pub_seed, addr);
|
||||
}
|
||||
|
||||
/**
|
||||
* Verifies a given message signature pair under a given public key.
|
||||
*/
|
||||
int xmss_core_sign_open(unsigned char *m, unsigned long long *mlen, const unsigned char *sm, unsigned long long smlen, const unsigned char *pk)
|
||||
int xmss_core_sign_open(unsigned char *m, unsigned long long *mlen,
|
||||
const unsigned char *sm, unsigned long long smlen,
|
||||
const unsigned char *pk)
|
||||
{
|
||||
unsigned long long i, m_len;
|
||||
unsigned long idx=0;
|
||||
unsigned long long i;
|
||||
unsigned long idx = 0;
|
||||
unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
|
||||
unsigned char pkhash[XMSS_N];
|
||||
unsigned char root[XMSS_N];
|
||||
@ -157,204 +160,147 @@ int xmss_core_sign_open(unsigned char *m, unsigned long long *mlen, const unsign
|
||||
unsigned char hash_key[3*XMSS_N];
|
||||
|
||||
unsigned char pub_seed[XMSS_N];
|
||||
memcpy(pub_seed, pk+XMSS_N, XMSS_N);
|
||||
memcpy(pub_seed, pk + XMSS_N, XMSS_N);
|
||||
|
||||
// Init addresses
|
||||
uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t ots_addr[8] = {0};
|
||||
uint32_t ltree_addr[8] = {0};
|
||||
uint32_t node_addr[8] = {0};
|
||||
|
||||
setType(ots_addr, 0);
|
||||
setType(ltree_addr, 1);
|
||||
setType(node_addr, 2);
|
||||
set_type(ots_addr, 0);
|
||||
set_type(ltree_addr, 1);
|
||||
set_type(node_addr, 2);
|
||||
|
||||
// Extract index
|
||||
idx = ((unsigned long)sm[0] << 24) | ((unsigned long)sm[1] << 16) | ((unsigned long)sm[2] << 8) | sm[3];
|
||||
|
||||
// Generate hash key (R || root || idx)
|
||||
memcpy(hash_key, sm+4,XMSS_N);
|
||||
memcpy(hash_key+XMSS_N, pk, XMSS_N);
|
||||
to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
|
||||
|
||||
sm += (XMSS_N+4);
|
||||
smlen -= (XMSS_N+4);
|
||||
|
||||
|
||||
// hash message
|
||||
unsigned long long tmp_sig_len = XMSS_WOTS_KEYSIZE+XMSS_TREEHEIGHT*XMSS_N;
|
||||
m_len = smlen - tmp_sig_len;
|
||||
h_msg(msg_h, sm + tmp_sig_len, m_len, hash_key, 3*XMSS_N);
|
||||
|
||||
//-----------------------
|
||||
// Verify signature
|
||||
//-----------------------
|
||||
|
||||
// Prepare Address
|
||||
setOTSADRS(ots_addr, idx);
|
||||
// Check WOTS signature
|
||||
wots_pkFromSig(wots_pk, sm, msg_h, pub_seed, ots_addr);
|
||||
|
||||
sm += XMSS_WOTS_KEYSIZE;
|
||||
smlen -= XMSS_WOTS_KEYSIZE;
|
||||
|
||||
// Compute Ltree
|
||||
setLtreeADRS(ltree_addr, idx);
|
||||
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
|
||||
|
||||
// Compute root
|
||||
validate_authpath(root, pkhash, idx, sm, pub_seed, node_addr);
|
||||
|
||||
sm += XMSS_TREEHEIGHT*XMSS_N;
|
||||
smlen -= XMSS_TREEHEIGHT*XMSS_N;
|
||||
|
||||
for (i = 0; i < XMSS_N; i++)
|
||||
if (root[i] != pk[i])
|
||||
goto fail;
|
||||
|
||||
*mlen = smlen;
|
||||
for (i = 0; i < *mlen; i++)
|
||||
m[i] = sm[i];
|
||||
|
||||
return 0;
|
||||
|
||||
|
||||
fail:
|
||||
*mlen = smlen;
|
||||
for (i = 0; i < *mlen; i++)
|
||||
m[i] = 0;
|
||||
*mlen = -1;
|
||||
return -1;
|
||||
}
|
||||
|
||||
/**
|
||||
* Verifies a given message signature pair under a given public key.
|
||||
*/
|
||||
int xmssmt_core_sign_open(unsigned char *m, unsigned long long *mlen, const unsigned char *sm, unsigned long long smlen, const unsigned char *pk)
|
||||
{
|
||||
uint64_t idx_tree;
|
||||
uint32_t idx_leaf;
|
||||
|
||||
unsigned long long i, m_len;
|
||||
unsigned long long idx=0;
|
||||
unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
|
||||
unsigned char pkhash[XMSS_N];
|
||||
unsigned char root[XMSS_N];
|
||||
unsigned char msg_h[XMSS_N];
|
||||
unsigned char hash_key[3*XMSS_N];
|
||||
|
||||
unsigned char pub_seed[XMSS_N];
|
||||
memcpy(pub_seed, pk+XMSS_N, XMSS_N);
|
||||
|
||||
// Init addresses
|
||||
uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
*mlen = smlen - XMSS_BYTES;
|
||||
|
||||
// Extract index
|
||||
for (i = 0; i < XMSS_INDEX_LEN; i++) {
|
||||
idx |= ((unsigned long long)sm[i]) << (8*(XMSS_INDEX_LEN - 1 - i));
|
||||
}
|
||||
sm += XMSS_INDEX_LEN;
|
||||
smlen -= XMSS_INDEX_LEN;
|
||||
|
||||
// Generate hash key (R || root || idx)
|
||||
memcpy(hash_key, sm,XMSS_N);
|
||||
memcpy(hash_key+XMSS_N, pk, XMSS_N);
|
||||
to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
|
||||
|
||||
sm += XMSS_N;
|
||||
smlen -= XMSS_N;
|
||||
memcpy(hash_key, sm + XMSS_INDEX_LEN, XMSS_N);
|
||||
memcpy(hash_key + XMSS_N, pk, XMSS_N);
|
||||
to_byte(hash_key + 2*XMSS_N, idx, XMSS_N);
|
||||
|
||||
// hash message
|
||||
unsigned long long tmp_sig_len = (XMSS_D * XMSS_WOTS_KEYSIZE) + (XMSS_FULLHEIGHT * XMSS_N);
|
||||
m_len = smlen - tmp_sig_len;
|
||||
h_msg(msg_h, sm + tmp_sig_len, m_len, hash_key, 3*XMSS_N);
|
||||
|
||||
//-----------------------
|
||||
// Verify signature
|
||||
//-----------------------
|
||||
h_msg(msg_h, sm + XMSS_BYTES, *mlen, hash_key, 3*XMSS_N);
|
||||
sm += XMSS_INDEX_LEN + XMSS_N;
|
||||
|
||||
// Prepare Address
|
||||
idx_tree = idx >> XMSS_TREEHEIGHT;
|
||||
idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1));
|
||||
setLayerADRS(ots_addr, 0);
|
||||
setTreeADRS(ots_addr, idx_tree);
|
||||
setType(ots_addr, 0);
|
||||
|
||||
memcpy(ltree_addr, ots_addr, 12);
|
||||
setType(ltree_addr, 1);
|
||||
|
||||
memcpy(node_addr, ltree_addr, 12);
|
||||
setType(node_addr, 2);
|
||||
|
||||
setOTSADRS(ots_addr, idx_leaf);
|
||||
|
||||
set_ots_addr(ots_addr, idx);
|
||||
// Check WOTS signature
|
||||
wots_pkFromSig(wots_pk, sm, msg_h, pub_seed, ots_addr);
|
||||
|
||||
wots_pk_from_sig(wots_pk, sm, msg_h, pub_seed, ots_addr);
|
||||
sm += XMSS_WOTS_KEYSIZE;
|
||||
smlen -= XMSS_WOTS_KEYSIZE;
|
||||
|
||||
// Compute Ltree
|
||||
setLtreeADRS(ltree_addr, idx_leaf);
|
||||
set_ltree_addr(ltree_addr, idx);
|
||||
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
|
||||
|
||||
// Compute root
|
||||
validate_authpath(root, pkhash, idx_leaf, sm, pub_seed, node_addr);
|
||||
|
||||
validate_authpath(root, pkhash, idx, sm, pub_seed, node_addr);
|
||||
sm += XMSS_TREEHEIGHT*XMSS_N;
|
||||
smlen -= XMSS_TREEHEIGHT*XMSS_N;
|
||||
|
||||
for (i = 1; i < XMSS_D; i++) {
|
||||
// Prepare Address
|
||||
idx_leaf = (idx_tree & ((1 << XMSS_TREEHEIGHT)-1));
|
||||
idx_tree = idx_tree >> XMSS_TREEHEIGHT;
|
||||
|
||||
setLayerADRS(ots_addr, i);
|
||||
setTreeADRS(ots_addr, idx_tree);
|
||||
setType(ots_addr, 0);
|
||||
|
||||
memcpy(ltree_addr, ots_addr, 12);
|
||||
setType(ltree_addr, 1);
|
||||
|
||||
memcpy(node_addr, ltree_addr, 12);
|
||||
setType(node_addr, 2);
|
||||
|
||||
setOTSADRS(ots_addr, idx_leaf);
|
||||
|
||||
// Check WOTS signature
|
||||
wots_pkFromSig(wots_pk, sm, root, pub_seed, ots_addr);
|
||||
|
||||
sm += XMSS_WOTS_KEYSIZE;
|
||||
smlen -= XMSS_WOTS_KEYSIZE;
|
||||
|
||||
// Compute Ltree
|
||||
setLtreeADRS(ltree_addr, idx_leaf);
|
||||
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
|
||||
|
||||
// Compute root
|
||||
validate_authpath(root, pkhash, idx_leaf, sm, pub_seed, node_addr);
|
||||
|
||||
sm += XMSS_TREEHEIGHT*XMSS_N;
|
||||
smlen -= XMSS_TREEHEIGHT*XMSS_N;
|
||||
|
||||
}
|
||||
|
||||
for (i = 0; i < XMSS_N; i++)
|
||||
if (root[i] != pk[i])
|
||||
goto fail;
|
||||
|
||||
*mlen = smlen;
|
||||
for (i = 0; i < *mlen; i++)
|
||||
m[i] = sm[i];
|
||||
|
||||
return 0;
|
||||
|
||||
|
||||
fail:
|
||||
*mlen = smlen;
|
||||
for (i = 0; i < *mlen; i++)
|
||||
for (i = 0; i < XMSS_N; i++) {
|
||||
if (root[i] != pk[i]) {
|
||||
for (i = 0; i < *mlen; i++) {
|
||||
m[i] = 0;
|
||||
}
|
||||
*mlen = -1;
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
for (i = 0; i < *mlen; i++) {
|
||||
m[i] = sm[i];
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Verifies a given message signature pair under a given public key.
|
||||
*/
|
||||
int xmssmt_core_sign_open(unsigned char *m, unsigned long long *mlen,
|
||||
const unsigned char *sm, unsigned long long smlen,
|
||||
const unsigned char *pk)
|
||||
{
|
||||
uint32_t idx_leaf;
|
||||
unsigned long long i;
|
||||
unsigned long long idx = 0;
|
||||
unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
|
||||
unsigned char pkhash[XMSS_N];
|
||||
unsigned char root[XMSS_N];
|
||||
unsigned char *msg_h = root;
|
||||
unsigned char hash_key[3*XMSS_N];
|
||||
const unsigned char *pub_seed = pk + XMSS_N;
|
||||
|
||||
// Init addresses
|
||||
uint32_t ots_addr[8] = {0};
|
||||
uint32_t ltree_addr[8] = {0};
|
||||
uint32_t node_addr[8] = {0};
|
||||
|
||||
set_type(ots_addr, 0);
|
||||
set_type(ltree_addr, 1);
|
||||
set_type(node_addr, 2);
|
||||
|
||||
*mlen = smlen - XMSS_BYTES;
|
||||
|
||||
// Extract index
|
||||
for (i = 0; i < XMSS_INDEX_LEN; i++) {
|
||||
idx |= ((unsigned long long)sm[i]) << (8*(XMSS_INDEX_LEN - 1 - i));
|
||||
}
|
||||
|
||||
// Generate hash key (R || root || idx)
|
||||
memcpy(hash_key, sm + XMSS_INDEX_LEN, XMSS_N);
|
||||
memcpy(hash_key + XMSS_N, pk, XMSS_N);
|
||||
to_byte(hash_key + 2*XMSS_N, idx, XMSS_N);
|
||||
|
||||
// hash message
|
||||
h_msg(msg_h, sm + XMSS_BYTES, *mlen, hash_key, 3*XMSS_N);
|
||||
sm += XMSS_INDEX_LEN + XMSS_N;
|
||||
|
||||
for (i = 0; i < XMSS_D; i++) {
|
||||
// Prepare Address
|
||||
idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1));
|
||||
idx = idx >> XMSS_TREEHEIGHT;
|
||||
|
||||
set_layer_addr(ots_addr, i);
|
||||
set_layer_addr(ltree_addr, i);
|
||||
set_layer_addr(node_addr, i);
|
||||
|
||||
set_tree_addr(ltree_addr, idx);
|
||||
set_tree_addr(ots_addr, idx);
|
||||
set_tree_addr(node_addr, idx);
|
||||
|
||||
set_ots_addr(ots_addr, idx_leaf);
|
||||
|
||||
// Check WOTS signature
|
||||
wots_pk_from_sig(wots_pk, sm, root, pub_seed, ots_addr);
|
||||
sm += XMSS_WOTS_KEYSIZE;
|
||||
|
||||
// Compute Ltree
|
||||
set_ltree_addr(ltree_addr, idx_leaf);
|
||||
l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
|
||||
|
||||
// Compute root
|
||||
validate_authpath(root, pkhash, idx_leaf, sm, pub_seed, node_addr);
|
||||
sm += XMSS_TREEHEIGHT*XMSS_N;
|
||||
}
|
||||
|
||||
for (i = 0; i < XMSS_N; i++) {
|
||||
if (root[i] != pk[i]) {
|
||||
for (i = 0; i < *mlen; i++) {
|
||||
m[i] = 0;
|
||||
}
|
||||
*mlen = -1;
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
for (i = 0; i < *mlen; i++) {
|
||||
m[i] = sm[i];
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@ -11,10 +11,24 @@ Public domain.
|
||||
#include <stdint.h>
|
||||
|
||||
void to_byte(unsigned char *output, unsigned long long in, uint32_t bytes);
|
||||
|
||||
void hexdump(const unsigned char *a, size_t len);
|
||||
void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8]);
|
||||
void get_seed(unsigned char *seed, const unsigned char *sk_seed, uint32_t addr[8]);
|
||||
void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8]);
|
||||
int xmss_core_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk);
|
||||
int xmssmt_core_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk);
|
||||
|
||||
void gen_leaf_wots(unsigned char *leaf,
|
||||
const unsigned char *sk_seed, const unsigned char *pub_seed,
|
||||
uint32_t ltree_addr[8], uint32_t ots_addr[8]);
|
||||
|
||||
void get_seed(unsigned char *seed,
|
||||
const unsigned char *sk_seed, uint32_t addr[8]);
|
||||
|
||||
void l_tree(unsigned char *leaf, unsigned char *wots_pk,
|
||||
const unsigned char *pub_seed, uint32_t addr[8]);
|
||||
|
||||
int xmss_core_sign_open(unsigned char *m, unsigned long long *mlen,
|
||||
const unsigned char *sm, unsigned long long smlen,
|
||||
const unsigned char *pk);
|
||||
|
||||
int xmssmt_core_sign_open(unsigned char *m, unsigned long long *mlen,
|
||||
const unsigned char *sm, unsigned long long smlen,
|
||||
const unsigned char *pk);
|
||||
#endif
|
||||
|
||||
67
xmss_core.c
67
xmss_core.c
@ -5,17 +5,17 @@ Joost Rijneveld
|
||||
Public domain.
|
||||
*/
|
||||
|
||||
#include "xmss_core.h"
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#include "randombytes.h"
|
||||
#include "wots.h"
|
||||
#include "hash.h"
|
||||
#include "xmss_commons.h"
|
||||
#include "hash_address.h"
|
||||
#include "params.h"
|
||||
#include "randombytes.h"
|
||||
#include "wots.h"
|
||||
#include "xmss_commons.h"
|
||||
#include "xmss_core.h"
|
||||
|
||||
/**
|
||||
* Merkle's TreeHash algorithm. The address only needs to initialize the first 78 bits of addr. Everything else will be set by treehash.
|
||||
@ -32,11 +32,11 @@ static void treehash(unsigned char *node, uint32_t index, const unsigned char *s
|
||||
// only copy layer and tree address parts
|
||||
memcpy(ots_addr, addr, 12);
|
||||
// type = ots
|
||||
setType(ots_addr, 0);
|
||||
set_type(ots_addr, 0);
|
||||
memcpy(ltree_addr, addr, 12);
|
||||
setType(ltree_addr, 1);
|
||||
set_type(ltree_addr, 1);
|
||||
memcpy(node_addr, addr, 12);
|
||||
setType(node_addr, 2);
|
||||
set_type(node_addr, 2);
|
||||
|
||||
uint32_t lastnode, i;
|
||||
unsigned char stack[(XMSS_TREEHEIGHT+1)*XMSS_N];
|
||||
@ -46,21 +46,22 @@ static void treehash(unsigned char *node, uint32_t index, const unsigned char *s
|
||||
lastnode = idx+(1 << XMSS_TREEHEIGHT);
|
||||
|
||||
for (; idx < lastnode; idx++) {
|
||||
setLtreeADRS(ltree_addr, idx);
|
||||
setOTSADRS(ots_addr, idx);
|
||||
set_ltree_addr(ltree_addr, idx);
|
||||
set_ots_addr(ots_addr, idx);
|
||||
gen_leaf_wots(stack+stackoffset*XMSS_N, sk_seed, pub_seed, ltree_addr, ots_addr);
|
||||
stacklevels[stackoffset] = 0;
|
||||
stackoffset++;
|
||||
while (stackoffset>1 && stacklevels[stackoffset-1] == stacklevels[stackoffset-2]) {
|
||||
setTreeHeight(node_addr, stacklevels[stackoffset-1]);
|
||||
setTreeIndex(node_addr, (idx >> (stacklevels[stackoffset-1]+1)));
|
||||
set_tree_height(node_addr, stacklevels[stackoffset-1]);
|
||||
set_tree_index(node_addr, (idx >> (stacklevels[stackoffset-1]+1)));
|
||||
hash_h(stack+(stackoffset-2)*XMSS_N, stack+(stackoffset-2)*XMSS_N, pub_seed, node_addr);
|
||||
stacklevels[stackoffset-2]++;
|
||||
stackoffset--;
|
||||
}
|
||||
}
|
||||
for (i = 0; i < XMSS_N; i++)
|
||||
for (i = 0; i < XMSS_N; i++) {
|
||||
node[i] = stack[i];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
@ -79,16 +80,16 @@ static void compute_authpath_wots(unsigned char *root, unsigned char *authpath,
|
||||
uint32_t node_addr[8];
|
||||
|
||||
memcpy(ots_addr, addr, 12);
|
||||
setType(ots_addr, 0);
|
||||
set_type(ots_addr, 0);
|
||||
memcpy(ltree_addr, addr, 12);
|
||||
setType(ltree_addr, 1);
|
||||
set_type(ltree_addr, 1);
|
||||
memcpy(node_addr, addr, 12);
|
||||
setType(node_addr, 2);
|
||||
set_type(node_addr, 2);
|
||||
|
||||
// Compute all leaves
|
||||
for (i = 0; i < (1U << XMSS_TREEHEIGHT); i++) {
|
||||
setLtreeADRS(ltree_addr, i);
|
||||
setOTSADRS(ots_addr, i);
|
||||
set_ltree_addr(ltree_addr, i);
|
||||
set_ots_addr(ots_addr, i);
|
||||
gen_leaf_wots(tree+((1<<XMSS_TREEHEIGHT)*XMSS_N + i*XMSS_N), sk_seed, pub_seed, ltree_addr, ots_addr);
|
||||
}
|
||||
|
||||
@ -97,21 +98,22 @@ static void compute_authpath_wots(unsigned char *root, unsigned char *authpath,
|
||||
// Compute tree:
|
||||
// Outer loop: For each inner layer
|
||||
for (i = (1<<XMSS_TREEHEIGHT); i > 1; i>>=1) {
|
||||
setTreeHeight(node_addr, level);
|
||||
set_tree_height(node_addr, level);
|
||||
// Inner loop: for each pair of sibling nodes
|
||||
for (j = 0; j < i; j+=2) {
|
||||
setTreeIndex(node_addr, j>>1);
|
||||
set_tree_index(node_addr, j>>1);
|
||||
hash_h(tree + (i>>1)*XMSS_N + (j>>1) * XMSS_N, tree + i*XMSS_N + j*XMSS_N, pub_seed, node_addr);
|
||||
}
|
||||
level++;
|
||||
}
|
||||
|
||||
// copy authpath
|
||||
for (i = 0; i < XMSS_TREEHEIGHT; i++)
|
||||
for (i = 0; i < XMSS_TREEHEIGHT; i++) {
|
||||
memcpy(authpath + i*XMSS_N, tree + ((1<<XMSS_TREEHEIGHT)>>i)*XMSS_N + ((leaf_idx >> i) ^ 1) * XMSS_N, XMSS_N);
|
||||
}
|
||||
|
||||
// copy root
|
||||
memcpy(root, tree+XMSS_N, XMSS_N);
|
||||
memcpy(root, tree+XMSS_N, XMSS_N);
|
||||
}
|
||||
|
||||
|
||||
@ -219,8 +221,8 @@ int xmss_core_sign(unsigned char *sk, unsigned char *sm, unsigned long long *sml
|
||||
// ----------------------------------
|
||||
|
||||
// Prepare Address
|
||||
setType(ots_addr, 0);
|
||||
setOTSADRS(ots_addr, idx);
|
||||
set_type(ots_addr, 0);
|
||||
set_ots_addr(ots_addr, idx);
|
||||
|
||||
// Compute seed for OTS key pair
|
||||
get_seed(ots_seed, sk_seed, ots_addr);
|
||||
@ -260,7 +262,7 @@ int xmssmt_core_keypair(unsigned char *pk, unsigned char *sk)
|
||||
|
||||
// Set address to point on the single tree on layer d-1
|
||||
uint32_t addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
setLayerADRS(addr, (XMSS_D-1));
|
||||
set_layer_addr(addr, (XMSS_D-1));
|
||||
|
||||
// Compute root
|
||||
treehash(pk, 0, sk+XMSS_INDEX_LEN, pk+XMSS_N, addr);
|
||||
@ -339,8 +341,9 @@ int xmssmt_core_sign(unsigned char *sk, unsigned char *sm, unsigned long long *s
|
||||
*smlen += XMSS_INDEX_LEN;
|
||||
|
||||
// Copy R to signature
|
||||
for (i = 0; i < XMSS_N; i++)
|
||||
for (i = 0; i < XMSS_N; i++) {
|
||||
sm[i] = R[i];
|
||||
}
|
||||
|
||||
sm += XMSS_N;
|
||||
*smlen += XMSS_N;
|
||||
@ -352,12 +355,12 @@ int xmssmt_core_sign(unsigned char *sk, unsigned char *sm, unsigned long long *s
|
||||
// Handle lowest layer separately as it is slightly different...
|
||||
|
||||
// Prepare Address
|
||||
setType(ots_addr, 0);
|
||||
set_type(ots_addr, 0);
|
||||
idx_tree = idx >> XMSS_TREEHEIGHT;
|
||||
idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1));
|
||||
setLayerADRS(ots_addr, 0);
|
||||
setTreeADRS(ots_addr, idx_tree);
|
||||
setOTSADRS(ots_addr, idx_leaf);
|
||||
set_layer_addr(ots_addr, 0);
|
||||
set_tree_addr(ots_addr, idx_tree);
|
||||
set_ots_addr(ots_addr, idx_leaf);
|
||||
|
||||
// Compute seed for OTS key pair
|
||||
get_seed(ots_seed, sk_seed, ots_addr);
|
||||
@ -378,9 +381,9 @@ int xmssmt_core_sign(unsigned char *sk, unsigned char *sm, unsigned long long *s
|
||||
// Prepare Address
|
||||
idx_leaf = (idx_tree & ((1 << XMSS_TREEHEIGHT)-1));
|
||||
idx_tree = idx_tree >> XMSS_TREEHEIGHT;
|
||||
setLayerADRS(ots_addr, j);
|
||||
setTreeADRS(ots_addr, idx_tree);
|
||||
setOTSADRS(ots_addr, idx_leaf);
|
||||
set_layer_addr(ots_addr, j);
|
||||
set_tree_addr(ots_addr, idx_tree);
|
||||
set_ots_addr(ots_addr, idx_leaf);
|
||||
|
||||
// Compute seed for OTS key pair
|
||||
get_seed(ots_seed, sk_seed, ots_addr);
|
||||
|
||||
184
xmss_core_fast.c
184
xmss_core_fast.c
@ -5,24 +5,27 @@ Joost Rijneveld
|
||||
Public domain.
|
||||
*/
|
||||
|
||||
#include "xmss_core_fast.h"
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#include "randombytes.h"
|
||||
#include "wots.h"
|
||||
#include "hash.h"
|
||||
|
||||
#include "xmss_commons.h"
|
||||
#include "hash_address.h"
|
||||
#include "params.h"
|
||||
#include "randombytes.h"
|
||||
#include "wots.h"
|
||||
#include "xmss_commons.h"
|
||||
#include "xmss_core_fast.h"
|
||||
|
||||
/**
|
||||
* Initialize BDS state struct
|
||||
* parameter names are the same as used in the description of the BDS traversal
|
||||
*/
|
||||
void xmss_set_bds_state(bds_state *state, unsigned char *stack, int stackoffset, unsigned char *stacklevels, unsigned char *auth, unsigned char *keep, treehash_inst *treehash, unsigned char *retain, int next_leaf)
|
||||
void xmss_set_bds_state(bds_state *state, unsigned char *stack,
|
||||
int stackoffset, unsigned char *stacklevels,
|
||||
unsigned char *auth, unsigned char *keep,
|
||||
treehash_inst *treehash, unsigned char *retain,
|
||||
int next_leaf)
|
||||
{
|
||||
state->stack = stack;
|
||||
state->stackoffset = stackoffset;
|
||||
@ -34,9 +37,11 @@ void xmss_set_bds_state(bds_state *state, unsigned char *stack, int stackoffset,
|
||||
state->next_leaf = next_leaf;
|
||||
}
|
||||
|
||||
static int treehash_minheight_on_stack(bds_state* state, const treehash_inst *treehash)
|
||||
static int treehash_minheight_on_stack(bds_state* state,
|
||||
const treehash_inst *treehash)
|
||||
{
|
||||
unsigned int r = XMSS_TREEHEIGHT, i;
|
||||
|
||||
for (i = 0; i < treehash->stackusage; i++) {
|
||||
if (state->stacklevels[state->stackoffset - i - 1] < r) {
|
||||
r = state->stacklevels[state->stackoffset - i - 1];
|
||||
@ -50,7 +55,9 @@ static int treehash_minheight_on_stack(bds_state* state, const treehash_inst *tr
|
||||
* Currently only used for key generation.
|
||||
*
|
||||
*/
|
||||
static void treehash_setup(unsigned char *node, int height, int index, bds_state *state, const unsigned char *sk_seed, const unsigned char *pub_seed, const uint32_t addr[8])
|
||||
static void treehash_init(unsigned char *node, int height, int index,
|
||||
bds_state *state, const unsigned char *sk_seed,
|
||||
const unsigned char *pub_seed, const uint32_t addr[8])
|
||||
{
|
||||
unsigned int idx = index;
|
||||
// use three different addresses because at this point we use all three formats in parallel
|
||||
@ -60,11 +67,11 @@ static void treehash_setup(unsigned char *node, int height, int index, bds_state
|
||||
// only copy layer and tree address parts
|
||||
memcpy(ots_addr, addr, 12);
|
||||
// type = ots
|
||||
setType(ots_addr, 0);
|
||||
set_type(ots_addr, 0);
|
||||
memcpy(ltree_addr, addr, 12);
|
||||
setType(ltree_addr, 1);
|
||||
set_type(ltree_addr, 1);
|
||||
memcpy(node_addr, addr, 12);
|
||||
setType(node_addr, 2);
|
||||
set_type(node_addr, 2);
|
||||
|
||||
uint32_t lastnode, i;
|
||||
unsigned char stack[(height+1)*XMSS_N];
|
||||
@ -82,16 +89,15 @@ static void treehash_setup(unsigned char *node, int height, int index, bds_state
|
||||
|
||||
i = 0;
|
||||
for (; idx < lastnode; idx++) {
|
||||
setLtreeADRS(ltree_addr, idx);
|
||||
setOTSADRS(ots_addr, idx);
|
||||
set_ltree_addr(ltree_addr, idx);
|
||||
set_ots_addr(ots_addr, idx);
|
||||
gen_leaf_wots(stack+stackoffset*XMSS_N, sk_seed, pub_seed, ltree_addr, ots_addr);
|
||||
stacklevels[stackoffset] = 0;
|
||||
stackoffset++;
|
||||
if (XMSS_TREEHEIGHT - XMSS_BDS_K > 0 && i == 3) {
|
||||
memcpy(state->treehash[0].node, stack+stackoffset*XMSS_N, XMSS_N);
|
||||
}
|
||||
while (stackoffset>1 && stacklevels[stackoffset-1] == stacklevels[stackoffset-2])
|
||||
{
|
||||
while (stackoffset>1 && stacklevels[stackoffset-1] == stacklevels[stackoffset-2]) {
|
||||
nodeh = stacklevels[stackoffset-1];
|
||||
if (i >> nodeh == 1) {
|
||||
memcpy(state->auth + nodeh*XMSS_N, stack+(stackoffset-1)*XMSS_N, XMSS_N);
|
||||
@ -104,8 +110,8 @@ static void treehash_setup(unsigned char *node, int height, int index, bds_state
|
||||
memcpy(state->retain + ((1 << (XMSS_TREEHEIGHT - 1 - nodeh)) + nodeh - XMSS_TREEHEIGHT + (((i >> nodeh) - 3) >> 1)) * XMSS_N, stack+(stackoffset-1)*XMSS_N, XMSS_N);
|
||||
}
|
||||
}
|
||||
setTreeHeight(node_addr, stacklevels[stackoffset-1]);
|
||||
setTreeIndex(node_addr, (idx >> (stacklevels[stackoffset-1]+1)));
|
||||
set_tree_height(node_addr, stacklevels[stackoffset-1]);
|
||||
set_tree_index(node_addr, (idx >> (stacklevels[stackoffset-1]+1)));
|
||||
hash_h(stack+(stackoffset-2)*XMSS_N, stack+(stackoffset-2)*XMSS_N, pub_seed, node_addr);
|
||||
stacklevels[stackoffset-2]++;
|
||||
stackoffset--;
|
||||
@ -113,11 +119,15 @@ static void treehash_setup(unsigned char *node, int height, int index, bds_state
|
||||
i++;
|
||||
}
|
||||
|
||||
for (i = 0; i < XMSS_N; i++)
|
||||
for (i = 0; i < XMSS_N; i++) {
|
||||
node[i] = stack[i];
|
||||
}
|
||||
}
|
||||
|
||||
static void treehash_update(treehash_inst *treehash, bds_state *state, const unsigned char *sk_seed, const unsigned char *pub_seed, const uint32_t addr[8])
|
||||
static void treehash_update(treehash_inst *treehash, bds_state *state,
|
||||
const unsigned char *sk_seed,
|
||||
const unsigned char *pub_seed,
|
||||
const uint32_t addr[8])
|
||||
{
|
||||
uint32_t ots_addr[8];
|
||||
uint32_t ltree_addr[8];
|
||||
@ -125,14 +135,14 @@ static void treehash_update(treehash_inst *treehash, bds_state *state, const uns
|
||||
// only copy layer and tree address parts
|
||||
memcpy(ots_addr, addr, 12);
|
||||
// type = ots
|
||||
setType(ots_addr, 0);
|
||||
set_type(ots_addr, 0);
|
||||
memcpy(ltree_addr, addr, 12);
|
||||
setType(ltree_addr, 1);
|
||||
set_type(ltree_addr, 1);
|
||||
memcpy(node_addr, addr, 12);
|
||||
setType(node_addr, 2);
|
||||
set_type(node_addr, 2);
|
||||
|
||||
setLtreeADRS(ltree_addr, treehash->next_idx);
|
||||
setOTSADRS(ots_addr, treehash->next_idx);
|
||||
set_ltree_addr(ltree_addr, treehash->next_idx);
|
||||
set_ots_addr(ots_addr, treehash->next_idx);
|
||||
|
||||
unsigned char nodebuffer[2 * XMSS_N];
|
||||
unsigned int nodeheight = 0;
|
||||
@ -140,8 +150,8 @@ static void treehash_update(treehash_inst *treehash, bds_state *state, const uns
|
||||
while (treehash->stackusage > 0 && state->stacklevels[state->stackoffset-1] == nodeheight) {
|
||||
memcpy(nodebuffer + XMSS_N, nodebuffer, XMSS_N);
|
||||
memcpy(nodebuffer, state->stack + (state->stackoffset-1)*XMSS_N, XMSS_N);
|
||||
setTreeHeight(node_addr, nodeheight);
|
||||
setTreeIndex(node_addr, (treehash->next_idx >> (nodeheight+1)));
|
||||
set_tree_height(node_addr, nodeheight);
|
||||
set_tree_index(node_addr, (treehash->next_idx >> (nodeheight+1)));
|
||||
hash_h(nodebuffer, nodebuffer, pub_seed, node_addr);
|
||||
nodeheight++;
|
||||
treehash->stackusage--;
|
||||
@ -164,7 +174,11 @@ static void treehash_update(treehash_inst *treehash, bds_state *state, const uns
|
||||
* Performs one treehash update on the instance that needs it the most.
|
||||
* Returns 1 if such an instance was not found
|
||||
**/
|
||||
static char bds_treehash_update(bds_state *state, unsigned int updates, const unsigned char *sk_seed, unsigned char *pub_seed, const uint32_t addr[8]) {
|
||||
static char bds_treehash_update(bds_state *state, unsigned int updates,
|
||||
const unsigned char *sk_seed,
|
||||
unsigned char *pub_seed,
|
||||
const uint32_t addr[8])
|
||||
{
|
||||
uint32_t i, j;
|
||||
unsigned int level, l_min, low;
|
||||
unsigned int used = 0;
|
||||
@ -200,7 +214,10 @@ static char bds_treehash_update(bds_state *state, unsigned int updates, const un
|
||||
* Updates the state (typically NEXT_i) by adding a leaf and updating the stack
|
||||
* Returns 1 if all leaf nodes have already been processed
|
||||
**/
|
||||
static char bds_state_update(bds_state *state, const unsigned char *sk_seed, unsigned char *pub_seed, const uint32_t addr[8]) {
|
||||
static char bds_state_update(bds_state *state, const unsigned char *sk_seed,
|
||||
const unsigned char *pub_seed,
|
||||
const uint32_t addr[8])
|
||||
{
|
||||
uint32_t ltree_addr[8];
|
||||
uint32_t node_addr[8];
|
||||
uint32_t ots_addr[8];
|
||||
@ -214,14 +231,14 @@ static char bds_state_update(bds_state *state, const unsigned char *sk_seed, uns
|
||||
// only copy layer and tree address parts
|
||||
memcpy(ots_addr, addr, 12);
|
||||
// type = ots
|
||||
setType(ots_addr, 0);
|
||||
set_type(ots_addr, 0);
|
||||
memcpy(ltree_addr, addr, 12);
|
||||
setType(ltree_addr, 1);
|
||||
set_type(ltree_addr, 1);
|
||||
memcpy(node_addr, addr, 12);
|
||||
setType(node_addr, 2);
|
||||
set_type(node_addr, 2);
|
||||
|
||||
setOTSADRS(ots_addr, idx);
|
||||
setLtreeADRS(ltree_addr, idx);
|
||||
set_ots_addr(ots_addr, idx);
|
||||
set_ltree_addr(ltree_addr, idx);
|
||||
|
||||
gen_leaf_wots(state->stack+state->stackoffset*XMSS_N, sk_seed, pub_seed, ltree_addr, ots_addr);
|
||||
|
||||
@ -243,8 +260,8 @@ static char bds_state_update(bds_state *state, const unsigned char *sk_seed, uns
|
||||
memcpy(state->retain + ((1 << (XMSS_TREEHEIGHT - 1 - nodeh)) + nodeh - XMSS_TREEHEIGHT + (((idx >> nodeh) - 3) >> 1)) * XMSS_N, state->stack+(state->stackoffset-1)*XMSS_N, XMSS_N);
|
||||
}
|
||||
}
|
||||
setTreeHeight(node_addr, state->stacklevels[state->stackoffset-1]);
|
||||
setTreeIndex(node_addr, (idx >> (state->stacklevels[state->stackoffset-1]+1)));
|
||||
set_tree_height(node_addr, state->stacklevels[state->stackoffset-1]);
|
||||
set_tree_index(node_addr, (idx >> (state->stacklevels[state->stackoffset-1]+1)));
|
||||
hash_h(state->stack+(state->stackoffset-2)*XMSS_N, state->stack+(state->stackoffset-2)*XMSS_N, pub_seed, node_addr);
|
||||
|
||||
state->stacklevels[state->stackoffset-2]++;
|
||||
@ -259,7 +276,9 @@ static char bds_state_update(bds_state *state, const unsigned char *sk_seed, uns
|
||||
* next leaf node, using the algorithm described by Buchmann, Dahmen and Szydlo
|
||||
* in "Post Quantum Cryptography", Springer 2009.
|
||||
*/
|
||||
static void bds_round(bds_state *state, const unsigned long leaf_idx, const unsigned char *sk_seed, unsigned char *pub_seed, uint32_t addr[8])
|
||||
static void bds_round(bds_state *state, const unsigned long leaf_idx,
|
||||
const unsigned char *sk_seed,
|
||||
const unsigned char *pub_seed, uint32_t addr[8])
|
||||
{
|
||||
unsigned int i;
|
||||
unsigned int tau = XMSS_TREEHEIGHT;
|
||||
@ -273,11 +292,11 @@ static void bds_round(bds_state *state, const unsigned long leaf_idx, const unsi
|
||||
// only copy layer and tree address parts
|
||||
memcpy(ots_addr, addr, 12);
|
||||
// type = ots
|
||||
setType(ots_addr, 0);
|
||||
set_type(ots_addr, 0);
|
||||
memcpy(ltree_addr, addr, 12);
|
||||
setType(ltree_addr, 1);
|
||||
set_type(ltree_addr, 1);
|
||||
memcpy(node_addr, addr, 12);
|
||||
setType(node_addr, 2);
|
||||
set_type(node_addr, 2);
|
||||
|
||||
for (i = 0; i < XMSS_TREEHEIGHT; i++) {
|
||||
if (! ((leaf_idx >> i) & 1)) {
|
||||
@ -295,13 +314,13 @@ static void bds_round(bds_state *state, const unsigned long leaf_idx, const unsi
|
||||
memcpy(state->keep + (tau >> 1)*XMSS_N, state->auth + tau*XMSS_N, XMSS_N);
|
||||
}
|
||||
if (tau == 0) {
|
||||
setLtreeADRS(ltree_addr, leaf_idx);
|
||||
setOTSADRS(ots_addr, leaf_idx);
|
||||
set_ltree_addr(ltree_addr, leaf_idx);
|
||||
set_ots_addr(ots_addr, leaf_idx);
|
||||
gen_leaf_wots(state->auth, sk_seed, pub_seed, ltree_addr, ots_addr);
|
||||
}
|
||||
else {
|
||||
setTreeHeight(node_addr, (tau-1));
|
||||
setTreeIndex(node_addr, leaf_idx >> tau);
|
||||
set_tree_height(node_addr, (tau-1));
|
||||
set_tree_index(node_addr, leaf_idx >> tau);
|
||||
hash_h(state->auth + tau * XMSS_N, buf, pub_seed, node_addr);
|
||||
for (i = 0; i < tau; i++) {
|
||||
if (i < XMSS_TREEHEIGHT - XMSS_BDS_K) {
|
||||
@ -333,22 +352,22 @@ static void bds_round(bds_state *state, const unsigned long leaf_idx, const unsi
|
||||
*/
|
||||
int xmss_core_keypair(unsigned char *pk, unsigned char *sk, bds_state *state)
|
||||
{
|
||||
uint32_t addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
|
||||
// Set idx = 0
|
||||
sk[0] = 0;
|
||||
sk[1] = 0;
|
||||
sk[2] = 0;
|
||||
sk[3] = 0;
|
||||
// Init SK_SEED (n byte), SK_PRF (n byte), and PUB_SEED (n byte)
|
||||
randombytes(sk+4, 3*XMSS_N);
|
||||
randombytes(sk + XMSS_INDEX_LEN, 3*XMSS_N);
|
||||
// Copy PUB_SEED to public key
|
||||
memcpy(pk+XMSS_N, sk+4+2*XMSS_N, XMSS_N);
|
||||
|
||||
uint32_t addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
memcpy(pk + XMSS_N, sk + XMSS_INDEX_LEN + 2*XMSS_N, XMSS_N);
|
||||
|
||||
// Compute root
|
||||
treehash_setup(pk, XMSS_TREEHEIGHT, 0, state, sk+4, sk+4+2*XMSS_N, addr);
|
||||
// copy root to sk
|
||||
memcpy(sk+4+3*XMSS_N, pk, XMSS_N);
|
||||
treehash_init(pk, XMSS_TREEHEIGHT, 0, state, sk + XMSS_INDEX_LEN, sk + XMSS_INDEX_LEN + 2*XMSS_N, addr);
|
||||
// copy root o sk
|
||||
memcpy(sk + XMSS_INDEX_LEN + 3*XMSS_N, pk, XMSS_N);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@ -359,18 +378,20 @@ int xmss_core_keypair(unsigned char *pk, unsigned char *sk, bds_state *state)
|
||||
* 2. an updated secret key!
|
||||
*
|
||||
*/
|
||||
int xmss_core_sign(unsigned char *sk, bds_state *state, unsigned char *sm, unsigned long long *smlen, const unsigned char *m, unsigned long long mlen)
|
||||
int xmss_core_sign(unsigned char *sk, bds_state *state,
|
||||
unsigned char *sm, unsigned long long *smlen,
|
||||
const unsigned char *m, unsigned long long mlen)
|
||||
{
|
||||
uint16_t i = 0;
|
||||
|
||||
// Extract SK
|
||||
unsigned long idx = ((unsigned long)sk[0] << 24) | ((unsigned long)sk[1] << 16) | ((unsigned long)sk[2] << 8) | sk[3];
|
||||
unsigned char sk_seed[XMSS_N];
|
||||
memcpy(sk_seed, sk+4, XMSS_N);
|
||||
memcpy(sk_seed, sk + XMSS_INDEX_LEN, XMSS_N);
|
||||
unsigned char sk_prf[XMSS_N];
|
||||
memcpy(sk_prf, sk+4+XMSS_N, XMSS_N);
|
||||
memcpy(sk_prf, sk + XMSS_INDEX_LEN + XMSS_N, XMSS_N);
|
||||
unsigned char pub_seed[XMSS_N];
|
||||
memcpy(pub_seed, sk+4+2*XMSS_N, XMSS_N);
|
||||
memcpy(pub_seed, sk + XMSS_INDEX_LEN + 2*XMSS_N, XMSS_N);
|
||||
|
||||
// index as 32 bytes string
|
||||
unsigned char idx_bytes_32[32];
|
||||
@ -419,8 +440,9 @@ int xmss_core_sign(unsigned char *sk, bds_state *state, unsigned char *sm, unsig
|
||||
*smlen += 4;
|
||||
|
||||
// Copy R to signature
|
||||
for (i = 0; i < XMSS_N; i++)
|
||||
for (i = 0; i < XMSS_N; i++) {
|
||||
sm[i] = R[i];
|
||||
}
|
||||
|
||||
sm += XMSS_N;
|
||||
*smlen += XMSS_N;
|
||||
@ -430,8 +452,8 @@ int xmss_core_sign(unsigned char *sk, bds_state *state, unsigned char *sm, unsig
|
||||
// ----------------------------------
|
||||
|
||||
// Prepare Address
|
||||
setType(ots_addr, 0);
|
||||
setOTSADRS(ots_addr, idx);
|
||||
set_type(ots_addr, 0);
|
||||
set_ots_addr(ots_addr, idx);
|
||||
|
||||
// Compute seed for OTS key pair
|
||||
get_seed(ots_seed, sk_seed, ots_addr);
|
||||
@ -464,10 +486,13 @@ int xmss_core_sign(unsigned char *sk, bds_state *state, unsigned char *sm, unsig
|
||||
* Format sk: [(ceil(h/8) bit) idx || SK_SEED || SK_PRF || PUB_SEED || root]
|
||||
* Format pk: [root || PUB_SEED] omitting algo oid.
|
||||
*/
|
||||
int xmssmt_core_keypair(unsigned char *pk, unsigned char *sk, bds_state *states, unsigned char *wots_sigs)
|
||||
int xmssmt_core_keypair(unsigned char *pk, unsigned char *sk,
|
||||
bds_state *states, unsigned char *wots_sigs)
|
||||
{
|
||||
unsigned char ots_seed[XMSS_N];
|
||||
uint32_t addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
int i;
|
||||
|
||||
// Set idx = 0
|
||||
for (i = 0; i < XMSS_INDEX_LEN; i++) {
|
||||
sk[i] = 0;
|
||||
@ -477,20 +502,19 @@ int xmssmt_core_keypair(unsigned char *pk, unsigned char *sk, bds_state *states,
|
||||
// Copy PUB_SEED to public key
|
||||
memcpy(pk+XMSS_N, sk+XMSS_INDEX_LEN+2*XMSS_N, XMSS_N);
|
||||
|
||||
uint32_t addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
|
||||
// Start with the bottom-most layer
|
||||
setLayerADRS(addr, 0);
|
||||
set_layer_addr(addr, 0);
|
||||
// Set up state and compute wots signatures for all but topmost tree root
|
||||
for (i = 0; i < XMSS_D - 1; i++) {
|
||||
// Compute seed for OTS key pair
|
||||
treehash_setup(pk, XMSS_TREEHEIGHT, 0, states + i, sk+XMSS_INDEX_LEN, pk+XMSS_N, addr);
|
||||
setLayerADRS(addr, (i+1));
|
||||
get_seed(ots_seed, sk+XMSS_INDEX_LEN, addr);
|
||||
treehash_init(pk, XMSS_TREEHEIGHT, 0, states + i, sk+XMSS_INDEX_LEN, pk+XMSS_N, addr);
|
||||
set_layer_addr(addr, (i+1));
|
||||
get_seed(ots_seed, sk + XMSS_INDEX_LEN, addr);
|
||||
wots_sign(wots_sigs + i*XMSS_WOTS_KEYSIZE, pk, ots_seed, pk+XMSS_N, addr);
|
||||
}
|
||||
// Address now points to the single tree on layer d-1
|
||||
treehash_setup(pk, XMSS_TREEHEIGHT, 0, states + i, sk+XMSS_INDEX_LEN, pk+XMSS_N, addr);
|
||||
memcpy(sk+XMSS_INDEX_LEN+3*XMSS_N, pk, XMSS_N);
|
||||
treehash_init(pk, XMSS_TREEHEIGHT, 0, states + i, sk+XMSS_INDEX_LEN, pk+XMSS_N, addr);
|
||||
memcpy(sk + XMSS_INDEX_LEN + 3*XMSS_N, pk, XMSS_N);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@ -501,7 +525,10 @@ int xmssmt_core_keypair(unsigned char *pk, unsigned char *sk, bds_state *states,
|
||||
* 2. an updated secret key!
|
||||
*
|
||||
*/
|
||||
int xmssmt_core_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs, unsigned char *sm, unsigned long long *smlen, const unsigned char *m, unsigned long long mlen)
|
||||
int xmssmt_core_sign(unsigned char *sk,
|
||||
bds_state *states, unsigned char *wots_sigs,
|
||||
unsigned char *sm, unsigned long long *smlen,
|
||||
const unsigned char *m, unsigned long long mlen)
|
||||
{
|
||||
uint64_t idx_tree;
|
||||
uint32_t idx_leaf;
|
||||
@ -568,8 +595,9 @@ int xmssmt_core_sign(unsigned char *sk, bds_state *states, unsigned char *wots_s
|
||||
*smlen += XMSS_INDEX_LEN;
|
||||
|
||||
// Copy R to signature
|
||||
for (i = 0; i < XMSS_N; i++)
|
||||
for (i = 0; i < XMSS_N; i++) {
|
||||
sm[i] = R[i];
|
||||
}
|
||||
|
||||
sm += XMSS_N;
|
||||
*smlen += XMSS_N;
|
||||
@ -581,12 +609,12 @@ int xmssmt_core_sign(unsigned char *sk, bds_state *states, unsigned char *wots_s
|
||||
// Handle lowest layer separately as it is slightly different...
|
||||
|
||||
// Prepare Address
|
||||
setType(ots_addr, 0);
|
||||
set_type(ots_addr, 0);
|
||||
idx_tree = idx >> XMSS_TREEHEIGHT;
|
||||
idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1));
|
||||
setLayerADRS(ots_addr, 0);
|
||||
setTreeADRS(ots_addr, idx_tree);
|
||||
setOTSADRS(ots_addr, idx_leaf);
|
||||
set_layer_addr(ots_addr, 0);
|
||||
set_tree_addr(ots_addr, idx_tree);
|
||||
set_ots_addr(ots_addr, idx_leaf);
|
||||
|
||||
// Compute seed for OTS key pair
|
||||
get_seed(ots_seed, sk_seed, ots_addr);
|
||||
@ -617,7 +645,7 @@ int xmssmt_core_sign(unsigned char *sk, bds_state *states, unsigned char *wots_s
|
||||
|
||||
updates = (XMSS_TREEHEIGHT - XMSS_BDS_K) >> 1;
|
||||
|
||||
setTreeADRS(addr, (idx_tree + 1));
|
||||
set_tree_addr(addr, (idx_tree + 1));
|
||||
// mandatory update for NEXT_0 (does not count towards h-k/2) if NEXT_0 exists
|
||||
if ((1 + idx_tree) * (1 << XMSS_TREEHEIGHT) + idx_leaf < (1ULL << XMSS_FULLHEIGHT)) {
|
||||
bds_state_update(&states[XMSS_D], sk_seed, pub_seed, addr);
|
||||
@ -628,13 +656,13 @@ int xmssmt_core_sign(unsigned char *sk, bds_state *states, unsigned char *wots_s
|
||||
if (! (((idx + 1) & ((1ULL << ((i+1)*XMSS_TREEHEIGHT)) - 1)) == 0)) {
|
||||
idx_leaf = (idx >> (XMSS_TREEHEIGHT * i)) & ((1 << XMSS_TREEHEIGHT)-1);
|
||||
idx_tree = (idx >> (XMSS_TREEHEIGHT * (i+1)));
|
||||
setLayerADRS(addr, i);
|
||||
setTreeADRS(addr, idx_tree);
|
||||
set_layer_addr(addr, i);
|
||||
set_tree_addr(addr, idx_tree);
|
||||
if (i == (unsigned int) (needswap_upto + 1)) {
|
||||
bds_round(&states[i], idx_leaf, sk_seed, pub_seed, addr);
|
||||
}
|
||||
updates = bds_treehash_update(&states[i], updates, sk_seed, pub_seed, addr);
|
||||
setTreeADRS(addr, (idx_tree + 1));
|
||||
set_tree_addr(addr, (idx_tree + 1));
|
||||
// if a NEXT-tree exists for this level;
|
||||
if ((1 + idx_tree) * (1 << XMSS_TREEHEIGHT) + idx_leaf < (1ULL << (XMSS_FULLHEIGHT - XMSS_TREEHEIGHT * i))) {
|
||||
if (i > 0 && updates > 0 && states[XMSS_D + i].next_leaf < (1ULL << XMSS_FULLHEIGHT)) {
|
||||
@ -648,9 +676,9 @@ int xmssmt_core_sign(unsigned char *sk, bds_state *states, unsigned char *wots_s
|
||||
memcpy(states+XMSS_D + i, states + i, sizeof(bds_state));
|
||||
memcpy(states + i, &tmp, sizeof(bds_state));
|
||||
|
||||
setLayerADRS(ots_addr, (i+1));
|
||||
setTreeADRS(ots_addr, ((idx + 1) >> ((i+2) * XMSS_TREEHEIGHT)));
|
||||
setOTSADRS(ots_addr, (((idx >> ((i+1) * XMSS_TREEHEIGHT)) + 1) & ((1 << XMSS_TREEHEIGHT)-1)));
|
||||
set_layer_addr(ots_addr, (i+1));
|
||||
set_tree_addr(ots_addr, ((idx + 1) >> ((i+2) * XMSS_TREEHEIGHT)));
|
||||
set_ots_addr(ots_addr, (((idx >> ((i+1) * XMSS_TREEHEIGHT)) + 1) & ((1 << XMSS_TREEHEIGHT)-1)));
|
||||
|
||||
get_seed(ots_seed, sk+XMSS_INDEX_LEN, ots_addr);
|
||||
wots_sign(wots_sigs + i*XMSS_WOTS_KEYSIZE, states[i].stack, ots_seed, pub_seed, ots_addr);
|
||||
|
||||
@ -5,8 +5,6 @@ Joost Rijneveld
|
||||
Public domain.
|
||||
*/
|
||||
|
||||
#include "wots.h"
|
||||
|
||||
#ifndef XMSS_CORE_H
|
||||
#define XMSS_CORE_H
|
||||
|
||||
@ -33,7 +31,11 @@ typedef struct {
|
||||
* Initialize BDS state struct
|
||||
* parameter names are the same as used in the description of the BDS traversal
|
||||
*/
|
||||
void xmss_set_bds_state(bds_state *state, unsigned char *stack, int stackoffset, unsigned char *stacklevels, unsigned char *auth, unsigned char *keep, treehash_inst *treehash, unsigned char *retain, int next_leaf);
|
||||
void xmss_set_bds_state(bds_state *state, unsigned char *stack,
|
||||
int stackoffset, unsigned char *stacklevels,
|
||||
unsigned char *auth, unsigned char *keep,
|
||||
treehash_inst *treehash, unsigned char *retain,
|
||||
int next_leaf);
|
||||
/**
|
||||
* Generates a XMSS key pair for a given parameter set.
|
||||
* Format sk: [(32bit) idx || SK_SEED || SK_PRF || PUB_SEED || root]
|
||||
@ -45,33 +47,42 @@ int xmss_core_keypair(unsigned char *pk, unsigned char *sk, bds_state *state);
|
||||
* Returns
|
||||
* 1. an array containing the signature followed by the message AND
|
||||
* 2. an updated secret key!
|
||||
*
|
||||
*/
|
||||
int xmss_core_sign(unsigned char *sk, bds_state *state, unsigned char *sig_msg, unsigned long long *sig_msg_len, const unsigned char *msg,unsigned long long msglen);
|
||||
int xmss_core_sign(unsigned char *sk, bds_state *state,
|
||||
unsigned char *sm, unsigned long long *smlen,
|
||||
const unsigned char *m, unsigned long long mlen);
|
||||
/**
|
||||
* Verifies a given message signature pair under a given public key.
|
||||
*
|
||||
* Note: msg and msglen are pure outputs which carry the message in case verification succeeds. The (input) message is assumed to be within sig_msg which has the form (sig||msg).
|
||||
* Note: msg and mlen are pure outputs which carry the message in case verification succeeds. The (input) message is assumed to be within sm which has the form (sig||msg).
|
||||
*/
|
||||
int xmss_core_sign_open(unsigned char *msg,unsigned long long *msglen, const unsigned char *sig_msg,unsigned long long sig_msg_len, const unsigned char *pk);
|
||||
int xmss_core_sign_open(unsigned char *m, unsigned long long *mlen,
|
||||
const unsigned char *sm, unsigned long long smlen,
|
||||
const unsigned char *pk);
|
||||
|
||||
/*
|
||||
* Generates a XMSSMT key pair for a given parameter set.
|
||||
* Format sk: [(ceil(h/8) bit) idx || SK_SEED || SK_PRF || PUB_SEED || root]
|
||||
* Format pk: [root || PUB_SEED] omitting algo oid.
|
||||
*/
|
||||
int xmssmt_core_keypair(unsigned char *pk, unsigned char *sk, bds_state *states, unsigned char *wots_sigs);
|
||||
int xmssmt_core_keypair(unsigned char *pk, unsigned char *sk,
|
||||
bds_state *states, unsigned char *wots_sigs);
|
||||
|
||||
/**
|
||||
* Signs a message.
|
||||
* Returns
|
||||
* 1. an array containing the signature followed by the message AND
|
||||
* 2. an updated secret key!
|
||||
*
|
||||
*/
|
||||
int xmssmt_core_sign(unsigned char *sk, bds_state *state, unsigned char *wots_sigs, unsigned char *sig_msg, unsigned long long *sig_msg_len, const unsigned char *msg, unsigned long long msglen);
|
||||
int xmssmt_core_sign(unsigned char *sk,
|
||||
bds_state *states, unsigned char *wots_sigs,
|
||||
unsigned char *sm, unsigned long long *smlen,
|
||||
const unsigned char *m, unsigned long long mlen);
|
||||
|
||||
/**
|
||||
* Verifies a given message signature pair under a given public key.
|
||||
*/
|
||||
int xmssmt_core_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk);
|
||||
int xmssmt_core_sign_open(unsigned char *m, unsigned long long *mlen,
|
||||
const unsigned char *sm, unsigned long long smlen,
|
||||
const unsigned char *pk);
|
||||
#endif
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user