kris
/
xmss-KAT-generator
1
0
Форк 0
Код Проблеми 0 Запити на злиття 0 Релізи 0 Вікі Активність
Ви не можете вибрати більше 25 тем Теми мають розпочинатися з літери або цифри, можуть містити дефіси (-) і не повинні перевищувати 35 символів.
42 Коміти
1 Гілка
488 KiB
 
 
Дерево: 1e00c92c18
Гілки Теги
${ item.name }
Створити гілку ${ searchTerm }
з '1e00c92c18'
${ noResults }
xmss-KAT-generator/xmss_fast.c

1009 рядки
31 KiB
Неформатований Звинувачення Історія 

  1. /*

  2. xmss_fast.c version 20160722

  3. Andreas Hülsing

  4. Joost Rijneveld

  5. Public domain.

  6. */

  7. 

  8. #include "xmss_fast.h"

  9. #include <stdlib.h>

  10. #include <string.h>

  11. #include <stdint.h>

  12. #include <math.h>

  13. 

  14. #include "randombytes.h"

  15. #include "wots.h"

  16. #include "hash.h"

  17. 

  18. #include "xmss_commons.h"

  19. #include "hash_address.h"

  20. #include "params.h"

  21. 

  22. /**

  23.  * Used for pseudorandom keygeneration,

  24.  * generates the seed for the WOTS keypair at address addr

  25.  *

  26.  * takes n byte sk_seed and returns n byte seed using 32 byte address addr.

  27.  */

  28. static void get_seed(unsigned char *seed, const unsigned char *sk_seed, int n, uint32_t addr[8])

  29. {

  30.   unsigned char bytes[32];

  31.   // Make sure that chain addr, hash addr, and key bit are 0!

  32.   setChainADRS(addr,0);

  33.   setHashADRS(addr,0);

  34.   setKeyAndMask(addr,0);

  35.   // Generate pseudorandom value

  36.   addr_to_byte(bytes, addr);

  37.   prf(seed, bytes, sk_seed, n);

  38. }

  39. 

  40. /**

  41.  * Initialize BDS state struct

  42.  * parameter names are the same as used in the description of the BDS traversal

  43.  */

  44. void xmss_set_bds_state(bds_state *state, unsigned char *stack, int stackoffset, unsigned char *stacklevels, unsigned char *auth, unsigned char *keep, treehash_inst *treehash, unsigned char *retain, int next_leaf)

  45. {

  46.   state->stack = stack;

  47.   state->stackoffset = stackoffset;

  48.   state->stacklevels = stacklevels;

  49.   state->auth = auth;

  50.   state->keep = keep;

  51.   state->treehash = treehash;

  52.   state->retain = retain;

  53.   state->next_leaf = next_leaf;

  54. }

  55. 

  56. /**

  57.  * Computes a leaf from a WOTS public key using an L-tree.

  58.  */

  59. static void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8])

  60. {

  61.   unsigned int l = XMSS_WOTS_LEN;

  62.   unsigned int n = XMSS_N;

  63.   uint32_t i = 0;

  64.   uint32_t height = 0;

  65.   uint32_t bound;

  66. 

  67.   //ADRS.setTreeHeight(0);

  68.   setTreeHeight(addr, height);

  69.   

  70.   while (l > 1) {

  71.      bound = l >> 1; //floor(l / 2);

  72.      for (i = 0; i < bound; i++) {

  73.        //ADRS.setTreeIndex(i);

  74.        setTreeIndex(addr, i);

  75.        //wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS);

  76.        hash_h(wots_pk+i*n, wots_pk+i*2*n, pub_seed, addr, n);

  77.      }

  78.      //if ( l % 2 == 1 ) {

  79.      if (l & 1) {

  80.        //pk[floor(l / 2) + 1] = pk[l];

  81.        memcpy(wots_pk+(l>>1)*n, wots_pk+(l-1)*n, n);

  82.        //l = ceil(l / 2);

  83.        l=(l>>1)+1;

  84.      }

  85.      else {

  86.        //l = ceil(l / 2);

  87.        l=(l>>1);

  88.      }

  89.      //ADRS.setTreeHeight(ADRS.getTreeHeight() + 1);

  90.      height++;

  91.      setTreeHeight(addr, height);

  92.    }

  93.    //return pk[0];

  94.    memcpy(leaf, wots_pk, n);

  95. }

  96. 

  97. /**

  98.  * Computes the leaf at a given address. First generates the WOTS key pair, then computes leaf using l_tree. As this happens position independent, we only require that addr encodes the right ltree-address.

  99.  */

  100. static void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8])

  101. {

  102.   unsigned char seed[XMSS_N];

  103.   unsigned char pk[XMSS_WOTS_KEYSIZE];

  104. 

  105.   get_seed(seed, sk_seed, XMSS_N, ots_addr);

  106.   wots_pkgen(pk, seed, pub_seed, ots_addr);

  107. 

  108.   l_tree(leaf, pk, pub_seed, ltree_addr);

  109. }

  110. 

  111. static int treehash_minheight_on_stack(bds_state* state, const treehash_inst *treehash) {

  112.   unsigned int r = XMSS_TREEHEIGHT, i;

  113.   for (i = 0; i < treehash->stackusage; i++) {

  114.     if (state->stacklevels[state->stackoffset - i - 1] < r) {

  115.       r = state->stacklevels[state->stackoffset - i - 1];

  116.     }

  117.   }

  118.   return r;

  119. }

  120. 

  121. /**

  122.  * Merkle's TreeHash algorithm. The address only needs to initialize the first 78 bits of addr. Everything else will be set by treehash.

  123.  * Currently only used for key generation.

  124.  *

  125.  */

  126. static void treehash_setup(unsigned char *node, int height, int index, bds_state *state, const unsigned char *sk_seed, const unsigned char *pub_seed, const uint32_t addr[8])

  127. {

  128.   unsigned int idx = index;

  129.   // use three different addresses because at this point we use all three formats in parallel

  130.   uint32_t ots_addr[8];

  131.   uint32_t ltree_addr[8];

  132.   uint32_t node_addr[8];

  133.   // only copy layer and tree address parts

  134.   memcpy(ots_addr, addr, 12);

  135.   // type = ots

  136.   setType(ots_addr, 0);

  137.   memcpy(ltree_addr, addr, 12);

  138.   setType(ltree_addr, 1);

  139.   memcpy(node_addr, addr, 12);

  140.   setType(node_addr, 2);

  141. 

  142.   uint32_t lastnode, i;

  143.   unsigned char stack[(height+1)*XMSS_N];

  144.   unsigned int stacklevels[height+1];

  145.   unsigned int stackoffset=0;

  146.   unsigned int nodeh;

  147. 

  148.   lastnode = idx+(1<<height);

  149. 

  150.   for (i = 0; i < XMSS_TREEHEIGHT-XMSS_BDS_K; i++) {

  151.     state->treehash[i].h = i;

  152.     state->treehash[i].completed = 1;

  153.     state->treehash[i].stackusage = 0;

  154.   }

  155. 

  156.   i = 0;

  157.   for (; idx < lastnode; idx++) {

  158.     setLtreeADRS(ltree_addr, idx);

  159.     setOTSADRS(ots_addr, idx);

  160.     gen_leaf_wots(stack+stackoffset*XMSS_N, sk_seed, pub_seed, ltree_addr, ots_addr);

  161.     stacklevels[stackoffset] = 0;

  162.     stackoffset++;

  163.     if (XMSS_TREEHEIGHT - XMSS_BDS_K > 0 && i == 3) {

  164.       memcpy(state->treehash[0].node, stack+stackoffset*XMSS_N, XMSS_N);

  165.     }

  166.     while (stackoffset>1 && stacklevels[stackoffset-1] == stacklevels[stackoffset-2])

  167.     {

  168.       nodeh = stacklevels[stackoffset-1];

  169.       if (i >> nodeh == 1) {

  170.         memcpy(state->auth + nodeh*XMSS_N, stack+(stackoffset-1)*XMSS_N, XMSS_N);

  171.       }

  172.       else {

  173.         if (nodeh < XMSS_TREEHEIGHT - XMSS_BDS_K && i >> nodeh == 3) {

  174.           memcpy(state->treehash[nodeh].node, stack+(stackoffset-1)*XMSS_N, XMSS_N);

  175.         }

  176.         else if (nodeh >= XMSS_TREEHEIGHT - XMSS_BDS_K) {

  177.           memcpy(state->retain + ((1 << (XMSS_TREEHEIGHT - 1 - nodeh)) + nodeh - XMSS_TREEHEIGHT + (((i >> nodeh) - 3) >> 1)) * XMSS_N, stack+(stackoffset-1)*XMSS_N, XMSS_N);

  178.         }

  179.       }

  180.       setTreeHeight(node_addr, stacklevels[stackoffset-1]);

  181.       setTreeIndex(node_addr, (idx >> (stacklevels[stackoffset-1]+1)));

  182.       hash_h(stack+(stackoffset-2)*XMSS_N, stack+(stackoffset-2)*XMSS_N, pub_seed,

  183.           node_addr, XMSS_N);

  184.       stacklevels[stackoffset-2]++;

  185.       stackoffset--;

  186.     }

  187.     i++;

  188.   }

  189. 

  190.   for (i = 0; i < XMSS_N; i++)

  191.     node[i] = stack[i];

  192. }

  193. 

  194. static void treehash_update(treehash_inst *treehash, bds_state *state, const unsigned char *sk_seed, const unsigned char *pub_seed, const uint32_t addr[8]) {

  195.   uint32_t ots_addr[8];

  196.   uint32_t ltree_addr[8];

  197.   uint32_t node_addr[8];

  198.   // only copy layer and tree address parts

  199.   memcpy(ots_addr, addr, 12);

  200.   // type = ots

  201.   setType(ots_addr, 0);

  202.   memcpy(ltree_addr, addr, 12);

  203.   setType(ltree_addr, 1);

  204.   memcpy(node_addr, addr, 12);

  205.   setType(node_addr, 2);

  206. 

  207.   setLtreeADRS(ltree_addr, treehash->next_idx);

  208.   setOTSADRS(ots_addr, treehash->next_idx);

  209. 

  210.   unsigned char nodebuffer[2 * XMSS_N];

  211.   unsigned int nodeheight = 0;

  212.   gen_leaf_wots(nodebuffer, sk_seed, pub_seed, ltree_addr, ots_addr);

  213.   while (treehash->stackusage > 0 && state->stacklevels[state->stackoffset-1] == nodeheight) {

  214.     memcpy(nodebuffer + XMSS_N, nodebuffer, XMSS_N);

  215.     memcpy(nodebuffer, state->stack + (state->stackoffset-1)*XMSS_N, XMSS_N);

  216.     setTreeHeight(node_addr, nodeheight);

  217.     setTreeIndex(node_addr, (treehash->next_idx >> (nodeheight+1)));

  218.     hash_h(nodebuffer, nodebuffer, pub_seed, node_addr, XMSS_N);

  219.     nodeheight++;

  220.     treehash->stackusage--;

  221.     state->stackoffset--;

  222.   }

  223.   if (nodeheight == treehash->h) { // this also implies stackusage == 0

  224.     memcpy(treehash->node, nodebuffer, XMSS_N);

  225.     treehash->completed = 1;

  226.   }

  227.   else {

  228.     memcpy(state->stack + state->stackoffset*XMSS_N, nodebuffer, XMSS_N);

  229.     treehash->stackusage++;

  230.     state->stacklevels[state->stackoffset] = nodeheight;

  231.     state->stackoffset++;

  232.     treehash->next_idx++;

  233.   }

  234. }

  235. 

  236. /**

  237.  * Computes a root node given a leaf and an authapth

  238.  */

  239. static void validate_authpath(unsigned char *root, const unsigned char *leaf, unsigned long leafidx, const unsigned char *authpath, const unsigned char *pub_seed, uint32_t addr[8])

  240. {

  241.   uint32_t i, j;

  242.   unsigned char buffer[2*XMSS_N];

  243. 

  244.   // If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left.

  245.   // Otherwise, it is the other way around

  246.   if (leafidx & 1) {

  247.     for (j = 0; j < XMSS_N; j++)

  248.       buffer[XMSS_N+j] = leaf[j];

  249.     for (j = 0; j < XMSS_N; j++)

  250.       buffer[j] = authpath[j];

  251.   }

  252.   else {

  253.     for (j = 0; j < XMSS_N; j++)

  254.       buffer[j] = leaf[j];

  255.     for (j = 0; j < XMSS_N; j++)

  256.       buffer[XMSS_N+j] = authpath[j];

  257.   }

  258.   authpath += XMSS_N;

  259. 

  260.   for (i=0; i < XMSS_TREEHEIGHT-1; i++) {

  261.     setTreeHeight(addr, i);

  262.     leafidx >>= 1;

  263.     setTreeIndex(addr, leafidx);

  264.     if (leafidx&1) {

  265.       hash_h(buffer+XMSS_N, buffer, pub_seed, addr, XMSS_N);

  266.       for (j = 0; j < XMSS_N; j++)

  267.         buffer[j] = authpath[j];

  268.     }

  269.     else {

  270.       hash_h(buffer, buffer, pub_seed, addr, XMSS_N);

  271.       for (j = 0; j < XMSS_N; j++)

  272.         buffer[j+XMSS_N] = authpath[j];

  273.     }

  274.     authpath += XMSS_N;

  275.   }

  276.   setTreeHeight(addr, (XMSS_TREEHEIGHT-1));

  277.   leafidx >>= 1;

  278.   setTreeIndex(addr, leafidx);

  279.   hash_h(root, buffer, pub_seed, addr, XMSS_N);

  280. }

  281. 

  282. /**

  283.  * Performs one treehash update on the instance that needs it the most.

  284.  * Returns 1 if such an instance was not found

  285.  **/

  286. static char bds_treehash_update(bds_state *state, unsigned int updates, const unsigned char *sk_seed, unsigned char *pub_seed, const uint32_t addr[8]) {

  287.   uint32_t i, j;

  288.   unsigned int level, l_min, low;

  289.   unsigned int used = 0;

  290. 

  291.   for (j = 0; j < updates; j++) {

  292.     l_min = XMSS_TREEHEIGHT;

  293.     level = XMSS_TREEHEIGHT - XMSS_BDS_K;

  294.     for (i = 0; i < XMSS_TREEHEIGHT - XMSS_BDS_K; i++) {

  295.       if (state->treehash[i].completed) {

  296.         low = XMSS_TREEHEIGHT;

  297.       }

  298.       else if (state->treehash[i].stackusage == 0) {

  299.         low = i;

  300.       }

  301.       else {

  302.         low = treehash_minheight_on_stack(state, &(state->treehash[i]));

  303.       }

  304.       if (low < l_min) {

  305.         level = i;

  306.         l_min = low;

  307.       }

  308.     }

  309.     if (level == XMSS_TREEHEIGHT - XMSS_BDS_K) {

  310.       break;

  311.     }

  312.     treehash_update(&(state->treehash[level]), state, sk_seed, pub_seed, addr);

  313.     used++;

  314.   }

  315.   return updates - used;

  316. }

  317. 

  318. /**

  319.  * Updates the state (typically NEXT_i) by adding a leaf and updating the stack

  320.  * Returns 1 if all leaf nodes have already been processed

  321.  **/

  322. static char bds_state_update(bds_state *state, const unsigned char *sk_seed, unsigned char *pub_seed, const uint32_t addr[8]) {

  323.   uint32_t ltree_addr[8];

  324.   uint32_t node_addr[8];

  325.   uint32_t ots_addr[8];

  326. 

  327.   int nodeh;

  328.   int idx = state->next_leaf;

  329.   if (idx == 1 << XMSS_TREEHEIGHT) {

  330.     return 1;

  331.   }

  332. 

  333.   // only copy layer and tree address parts

  334.   memcpy(ots_addr, addr, 12);

  335.   // type = ots

  336.   setType(ots_addr, 0);

  337.   memcpy(ltree_addr, addr, 12);

  338.   setType(ltree_addr, 1);

  339.   memcpy(node_addr, addr, 12);

  340.   setType(node_addr, 2);

  341.   

  342.   setOTSADRS(ots_addr, idx);

  343.   setLtreeADRS(ltree_addr, idx);

  344. 

  345.   gen_leaf_wots(state->stack+state->stackoffset*XMSS_N, sk_seed, pub_seed, ltree_addr, ots_addr);

  346. 

  347.   state->stacklevels[state->stackoffset] = 0;

  348.   state->stackoffset++;

  349.   if (XMSS_TREEHEIGHT - XMSS_BDS_K > 0 && idx == 3) {

  350.     memcpy(state->treehash[0].node, state->stack+state->stackoffset*XMSS_N, XMSS_N);

  351.   }

  352.   while (state->stackoffset>1 && state->stacklevels[state->stackoffset-1] == state->stacklevels[state->stackoffset-2]) {

  353.     nodeh = state->stacklevels[state->stackoffset-1];

  354.     if (idx >> nodeh == 1) {

  355.       memcpy(state->auth + nodeh*XMSS_N, state->stack+(state->stackoffset-1)*XMSS_N, XMSS_N);

  356.     }

  357.     else {

  358.       if (nodeh < XMSS_TREEHEIGHT - XMSS_BDS_K && idx >> nodeh == 3) {

  359.         memcpy(state->treehash[nodeh].node, state->stack+(state->stackoffset-1)*XMSS_N, XMSS_N);

  360.       }

  361.       else if (nodeh >= XMSS_TREEHEIGHT - XMSS_BDS_K) {

  362.         memcpy(state->retain + ((1 << (XMSS_TREEHEIGHT - 1 - nodeh)) + nodeh - XMSS_TREEHEIGHT + (((idx >> nodeh) - 3) >> 1)) * XMSS_N, state->stack+(state->stackoffset-1)*XMSS_N, XMSS_N);

  363.       }

  364.     }

  365.     setTreeHeight(node_addr, state->stacklevels[state->stackoffset-1]);

  366.     setTreeIndex(node_addr, (idx >> (state->stacklevels[state->stackoffset-1]+1)));

  367.     hash_h(state->stack+(state->stackoffset-2)*XMSS_N, state->stack+(state->stackoffset-2)*XMSS_N, pub_seed, node_addr, XMSS_N);

  368. 

  369.     state->stacklevels[state->stackoffset-2]++;

  370.     state->stackoffset--;

  371.   }

  372.   state->next_leaf++;

  373.   return 0;

  374. }

  375. 

  376. /**

  377.  * Returns the auth path for node leaf_idx and computes the auth path for the

  378.  * next leaf node, using the algorithm described by Buchmann, Dahmen and Szydlo

  379.  * in "Post Quantum Cryptography", Springer 2009.

  380.  */

  381. static void bds_round(bds_state *state, const unsigned long leaf_idx, const unsigned char *sk_seed, unsigned char *pub_seed, uint32_t addr[8])

  382. {

  383.   unsigned int i;

  384.   unsigned int tau = XMSS_TREEHEIGHT;

  385.   unsigned int startidx;

  386.   unsigned int offset, rowidx;

  387.   unsigned char buf[2 * XMSS_N];

  388. 

  389.   uint32_t ots_addr[8];

  390.   uint32_t ltree_addr[8];

  391.   uint32_t node_addr[8];

  392.   // only copy layer and tree address parts

  393.   memcpy(ots_addr, addr, 12);

  394.   // type = ots

  395.   setType(ots_addr, 0);

  396.   memcpy(ltree_addr, addr, 12);

  397.   setType(ltree_addr, 1);

  398.   memcpy(node_addr, addr, 12);

  399.   setType(node_addr, 2);

  400. 

  401.   for (i = 0; i < XMSS_TREEHEIGHT; i++) {

  402.     if (! ((leaf_idx >> i) & 1)) {

  403.       tau = i;

  404.       break;

  405.     }

  406.   }

  407. 

  408.   if (tau > 0) {

  409.     memcpy(buf,     state->auth + (tau-1) * XMSS_N, XMSS_N);

  410.     // we need to do this before refreshing state->keep to prevent overwriting

  411.     memcpy(buf + XMSS_N, state->keep + ((tau-1) >> 1) * XMSS_N, XMSS_N);

  412.   }

  413.   if (!((leaf_idx >> (tau + 1)) & 1) && (tau < XMSS_TREEHEIGHT - 1)) {

  414.     memcpy(state->keep + (tau >> 1)*XMSS_N, state->auth + tau*XMSS_N, XMSS_N);

  415.   }

  416.   if (tau == 0) {

  417.     setLtreeADRS(ltree_addr, leaf_idx);

  418.     setOTSADRS(ots_addr, leaf_idx);

  419.     gen_leaf_wots(state->auth, sk_seed, pub_seed, ltree_addr, ots_addr);

  420.   }

  421.   else {

  422.     setTreeHeight(node_addr, (tau-1));

  423.     setTreeIndex(node_addr, leaf_idx >> tau);

  424.     hash_h(state->auth + tau * XMSS_N, buf, pub_seed, node_addr, XMSS_N);

  425.     for (i = 0; i < tau; i++) {

  426.       if (i < XMSS_TREEHEIGHT - XMSS_BDS_K) {

  427.         memcpy(state->auth + i * XMSS_N, state->treehash[i].node, XMSS_N);

  428.       }

  429.       else {

  430.         offset = (1 << (XMSS_TREEHEIGHT - 1 - i)) + i - XMSS_TREEHEIGHT;

  431.         rowidx = ((leaf_idx >> i) - 1) >> 1;

  432.         memcpy(state->auth + i * XMSS_N, state->retain + (offset + rowidx) * XMSS_N, XMSS_N);

  433.       }

  434.     }

  435. 

  436.     for (i = 0; i < ((tau < XMSS_TREEHEIGHT - XMSS_BDS_K) ? tau : (XMSS_TREEHEIGHT - XMSS_BDS_K)); i++) {

  437.       startidx = leaf_idx + 1 + 3 * (1 << i);

  438.       if (startidx < 1U << XMSS_TREEHEIGHT) {

  439.         state->treehash[i].h = i;

  440.         state->treehash[i].next_idx = startidx;

  441.         state->treehash[i].completed = 0;

  442.         state->treehash[i].stackusage = 0;

  443.       }

  444.     }

  445.   }

  446. }

  447. 

  448. /*

  449.  * Generates a XMSS key pair for a given parameter set.

  450.  * Format sk: [(32bit) idx || SK_SEED || SK_PRF || PUB_SEED || root]

  451.  * Format pk: [root || PUB_SEED] omitting algo oid.

  452.  */

  453. int xmss_keypair(unsigned char *pk, unsigned char *sk, bds_state *state)

  454. {

  455.   // Set idx = 0

  456.   sk[0] = 0;

  457.   sk[1] = 0;

  458.   sk[2] = 0;

  459.   sk[3] = 0;

  460.   // Init SK_SEED (n byte), SK_PRF (n byte), and PUB_SEED (n byte)

  461.   randombytes(sk+4, 3*XMSS_N);

  462.   // Copy PUB_SEED to public key

  463.   memcpy(pk+XMSS_N, sk+4+2*XMSS_N, XMSS_N);

  464. 

  465.   uint32_t addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

  466. 

  467.   // Compute root

  468.   treehash_setup(pk, XMSS_TREEHEIGHT, 0, state, sk+4, sk+4+2*XMSS_N, addr);

  469.   // copy root to sk

  470.   memcpy(sk+4+3*XMSS_N, pk, XMSS_N);

  471.   return 0;

  472. }

  473. 

  474. /**

  475.  * Signs a message.

  476.  * Returns

  477.  * 1. an array containing the signature followed by the message AND

  478.  * 2. an updated secret key!

  479.  *

  480.  */

  481. int xmss_sign(unsigned char *sk, bds_state *state, unsigned char *sig_msg, unsigned long long *sig_msg_len, const unsigned char *msg, unsigned long long msglen)

  482. {

  483.   uint16_t i = 0;

  484. 

  485.   // Extract SK

  486.   unsigned long idx = ((unsigned long)sk[0] << 24) | ((unsigned long)sk[1] << 16) | ((unsigned long)sk[2] << 8) | sk[3];

  487.   unsigned char sk_seed[XMSS_N];

  488.   memcpy(sk_seed, sk+4, XMSS_N);

  489.   unsigned char sk_prf[XMSS_N];

  490.   memcpy(sk_prf, sk+4+XMSS_N, XMSS_N);

  491.   unsigned char pub_seed[XMSS_N];

  492.   memcpy(pub_seed, sk+4+2*XMSS_N, XMSS_N);

  493.   

  494.   // index as 32 bytes string

  495.   unsigned char idx_bytes_32[32];

  496.   to_byte(idx_bytes_32, idx, 32);

  497.   

  498.   unsigned char hash_key[3*XMSS_N];

  499.   

  500.   // Update SK

  501.   sk[0] = ((idx + 1) >> 24) & 255;

  502.   sk[1] = ((idx + 1) >> 16) & 255;

  503.   sk[2] = ((idx + 1) >> 8) & 255;

  504.   sk[3] = (idx + 1) & 255;

  505.   // -- Secret key for this non-forward-secure version is now updated.

  506.   // -- A productive implementation should use a file handle instead and write the updated secret key at this point!

  507. 

  508.   // Init working params

  509.   unsigned char R[XMSS_N];

  510.   unsigned char msg_h[XMSS_N];

  511.   unsigned char ots_seed[XMSS_N];

  512.   uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

  513. 

  514.   // ---------------------------------

  515.   // Message Hashing

  516.   // ---------------------------------

  517. 

  518.   // Message Hash:

  519.   // First compute pseudorandom value

  520.   prf(R, idx_bytes_32, sk_prf, XMSS_N);

  521.   // Generate hash key (R || root || idx)

  522.   memcpy(hash_key, R, XMSS_N);

  523.   memcpy(hash_key+XMSS_N, sk+4+3*XMSS_N, XMSS_N);

  524.   to_byte(hash_key+2*XMSS_N, idx, XMSS_N);

  525.   // Then use it for message digest

  526.   h_msg(msg_h, msg, msglen, hash_key, 3*XMSS_N, XMSS_N);

  527. 

  528.   // Start collecting signature

  529.   *sig_msg_len = 0;

  530. 

  531.   // Copy index to signature

  532.   sig_msg[0] = (idx >> 24) & 255;

  533.   sig_msg[1] = (idx >> 16) & 255;

  534.   sig_msg[2] = (idx >> 8) & 255;

  535.   sig_msg[3] = idx & 255;

  536. 

  537.   sig_msg += 4;

  538.   *sig_msg_len += 4;

  539. 

  540.   // Copy R to signature

  541.   for (i = 0; i < XMSS_N; i++)

  542.     sig_msg[i] = R[i];

  543. 

  544.   sig_msg += XMSS_N;

  545.   *sig_msg_len += XMSS_N;

  546. 

  547.   // ----------------------------------

  548.   // Now we start to "really sign"

  549.   // ----------------------------------

  550. 

  551.   // Prepare Address

  552.   setType(ots_addr, 0);

  553.   setOTSADRS(ots_addr, idx);

  554. 

  555.   // Compute seed for OTS key pair

  556.   get_seed(ots_seed, sk_seed, XMSS_N, ots_addr);

  557. 

  558.   // Compute WOTS signature

  559.   wots_sign(sig_msg, msg_h, ots_seed, pub_seed, ots_addr);

  560. 

  561.   sig_msg += XMSS_WOTS_KEYSIZE;

  562.   *sig_msg_len += XMSS_WOTS_KEYSIZE;

  563. 

  564.   // the auth path was already computed during the previous round

  565.   memcpy(sig_msg, state->auth, XMSS_TREEHEIGHT*XMSS_N);

  566. 

  567.   if (idx < (1U << XMSS_TREEHEIGHT) - 1) {

  568.     bds_round(state, idx, sk_seed, pub_seed, ots_addr);

  569.     bds_treehash_update(state, (XMSS_TREEHEIGHT - XMSS_BDS_K) >> 1, sk_seed, pub_seed, ots_addr);

  570.   }

  571. 

  572.   sig_msg += XMSS_TREEHEIGHT*XMSS_N;

  573.   *sig_msg_len += XMSS_TREEHEIGHT*XMSS_N;

  574. 

  575.   memcpy(sig_msg, msg, msglen);

  576.   *sig_msg_len += msglen;

  577. 

  578.   return 0;

  579. }

  580. 

  581. /**

  582.  * Verifies a given message signature pair under a given public key.

  583.  */

  584. int xmss_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)

  585. {

  586.   unsigned long long i, m_len;

  587.   unsigned long idx=0;

  588.   unsigned char wots_pk[XMSS_WOTS_KEYSIZE];

  589.   unsigned char pkhash[XMSS_N];

  590.   unsigned char root[XMSS_N];

  591.   unsigned char msg_h[XMSS_N];

  592.   unsigned char hash_key[3*XMSS_N];

  593. 

  594.   unsigned char pub_seed[XMSS_N];

  595.   memcpy(pub_seed, pk+XMSS_N, XMSS_N);

  596. 

  597.   // Init addresses

  598.   uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

  599.   uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

  600.   uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

  601. 

  602.   setType(ots_addr, 0);

  603.   setType(ltree_addr, 1);

  604.   setType(node_addr, 2);

  605. 

  606.   // Extract index

  607.   idx = ((unsigned long)sig_msg[0] << 24) | ((unsigned long)sig_msg[1] << 16) | ((unsigned long)sig_msg[2] << 8) | sig_msg[3];

  608.   

  609.   // Generate hash key (R || root || idx)

  610.   memcpy(hash_key, sig_msg+4,XMSS_N);

  611.   memcpy(hash_key+XMSS_N, pk, XMSS_N);

  612.   to_byte(hash_key+2*XMSS_N, idx, XMSS_N);

  613.   

  614.   sig_msg += (XMSS_N+4);

  615.   sig_msg_len -= (XMSS_N+4);

  616. 

  617.   // hash message 

  618.   unsigned long long tmp_sig_len = XMSS_WOTS_KEYSIZE+XMSS_TREEHEIGHT*XMSS_N;

  619.   m_len = sig_msg_len - tmp_sig_len;

  620.   h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);

  621. 

  622.   //-----------------------

  623.   // Verify signature

  624.   //-----------------------

  625. 

  626.   // Prepare Address

  627.   setOTSADRS(ots_addr, idx);

  628.   // Check WOTS signature

  629.   wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);

  630. 

  631.   sig_msg += XMSS_WOTS_KEYSIZE;

  632.   sig_msg_len -= XMSS_WOTS_KEYSIZE;

  633. 

  634.   // Compute Ltree

  635.   setLtreeADRS(ltree_addr, idx);

  636.   l_tree(pkhash, wots_pk, pub_seed, ltree_addr);

  637. 

  638.   // Compute root

  639.   validate_authpath(root, pkhash, idx, sig_msg, pub_seed, node_addr);

  640. 

  641.   sig_msg += XMSS_TREEHEIGHT*XMSS_N;

  642.   sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;

  643. 

  644.   for (i = 0; i < XMSS_N; i++)

  645.     if (root[i] != pk[i])

  646.       goto fail;

  647. 

  648.   *msglen = sig_msg_len;

  649.   for (i = 0; i < *msglen; i++)

  650.     msg[i] = sig_msg[i];

  651. 

  652.   return 0;

  653. 

  654. 

  655. fail:

  656.   *msglen = sig_msg_len;

  657.   for (i = 0; i < *msglen; i++)

  658.     msg[i] = 0;

  659.   *msglen = -1;

  660.   return -1;

  661. }

  662. 

  663. /*

  664.  * Generates a XMSSMT key pair for a given parameter set.

  665.  * Format sk: [(ceil(h/8) bit) idx || SK_SEED || SK_PRF || PUB_SEED || root]

  666.  * Format pk: [root || PUB_SEED] omitting algo oid.

  667.  */

  668. int xmssmt_keypair(unsigned char *pk, unsigned char *sk, bds_state *states, unsigned char *wots_sigs)

  669. {

  670.   unsigned char ots_seed[XMSS_N];

  671.   int i;

  672.   // Set idx = 0

  673.   for (i = 0; i < XMSS_INDEX_LEN; i++) {

  674.     sk[i] = 0;

  675.   }

  676.   // Init SK_SEED (XMSS_N byte), SK_PRF (XMSS_N byte), and PUB_SEED (XMSS_N byte)

  677.   randombytes(sk+XMSS_INDEX_LEN, 3*XMSS_N);

  678.   // Copy PUB_SEED to public key

  679.   memcpy(pk+XMSS_N, sk+XMSS_INDEX_LEN+2*XMSS_N, XMSS_N);

  680. 

  681.   uint32_t addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

  682.   // Start with the bottom-most layer

  683.   setLayerADRS(addr, 0);

  684.   // Set up state and compute wots signatures for all but topmost tree root

  685.   for (i = 0; i < XMSS_D - 1; i++) {

  686.     // Compute seed for OTS key pair

  687.     treehash_setup(pk, XMSS_TREEHEIGHT, 0, states + i, sk+XMSS_INDEX_LEN, pk+XMSS_N, addr);

  688.     setLayerADRS(addr, (i+1));

  689.     get_seed(ots_seed, sk+XMSS_INDEX_LEN, XMSS_N, addr);

  690.     wots_sign(wots_sigs + i*XMSS_WOTS_KEYSIZE, pk, ots_seed, pk+XMSS_N, addr);

  691.   }

  692.   // Address now points to the single tree on layer d-1

  693.   treehash_setup(pk, XMSS_TREEHEIGHT, 0, states + i, sk+XMSS_INDEX_LEN, pk+XMSS_N, addr);

  694.   memcpy(sk+XMSS_INDEX_LEN+3*XMSS_N, pk, XMSS_N);

  695.   return 0;

  696. }

  697. 

  698. /**

  699.  * Signs a message.

  700.  * Returns

  701.  * 1. an array containing the signature followed by the message AND

  702.  * 2. an updated secret key!

  703.  *

  704.  */

  705. int xmssmt_sign(unsigned char *sk, bds_state *states, unsigned char *wots_sigs, unsigned char *sig_msg, unsigned long long *sig_msg_len, const unsigned char *msg, unsigned long long msglen)

  706. {

  707.   uint64_t idx_tree;

  708.   uint32_t idx_leaf;

  709.   uint64_t i, j;

  710.   int needswap_upto = -1;

  711.   unsigned int updates;

  712. 

  713.   unsigned char sk_seed[XMSS_N];

  714.   unsigned char sk_prf[XMSS_N];

  715.   unsigned char pub_seed[XMSS_N];

  716.   // Init working params

  717.   unsigned char R[XMSS_N];

  718.   unsigned char msg_h[XMSS_N];

  719.   unsigned char hash_key[3*XMSS_N];

  720.   unsigned char ots_seed[XMSS_N];

  721.   uint32_t addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

  722.   uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

  723.   unsigned char idx_bytes_32[32];

  724.   bds_state tmp;

  725. 

  726.   // Extract SK 

  727.   unsigned long long idx = 0;

  728.   for (i = 0; i < XMSS_INDEX_LEN; i++) {

  729.     idx |= ((unsigned long long)sk[i]) << 8*(XMSS_INDEX_LEN - 1 - i);

  730.   }

  731. 

  732.   memcpy(sk_seed, sk+XMSS_INDEX_LEN, XMSS_N);

  733.   memcpy(sk_prf, sk+XMSS_INDEX_LEN+XMSS_N, XMSS_N);

  734.   memcpy(pub_seed, sk+XMSS_INDEX_LEN+2*XMSS_N, XMSS_N);

  735. 

  736.   // Update SK

  737.   for (i = 0; i < XMSS_INDEX_LEN; i++) {

  738.     sk[i] = ((idx + 1) >> 8*(XMSS_INDEX_LEN - 1 - i)) & 255;

  739.   }

  740.   // -- Secret key for this non-forward-secure version is now updated.

  741.   // -- A productive implementation should use a file handle instead and write the updated secret key at this point!

  742. 

  743. 

  744.   // ---------------------------------

  745.   // Message Hashing

  746.   // ---------------------------------

  747. 

  748.   // Message Hash:

  749.   // First compute pseudorandom value

  750.   to_byte(idx_bytes_32, idx, 32);

  751.   prf(R, idx_bytes_32, sk_prf, XMSS_N);

  752.   // Generate hash key (R || root || idx)

  753.   memcpy(hash_key, R, XMSS_N);

  754.   memcpy(hash_key+XMSS_N, sk+XMSS_INDEX_LEN+3*XMSS_N, XMSS_N);

  755.   to_byte(hash_key+2*XMSS_N, idx, XMSS_N);

  756.   

  757.   // Then use it for message digest

  758.   h_msg(msg_h, msg, msglen, hash_key, 3*XMSS_N, XMSS_N);

  759. 

  760.   // Start collecting signature

  761.   *sig_msg_len = 0;

  762. 

  763.   // Copy index to signature

  764.   for (i = 0; i < XMSS_INDEX_LEN; i++) {

  765.     sig_msg[i] = (idx >> 8*(XMSS_INDEX_LEN - 1 - i)) & 255;

  766.   }

  767. 

  768.   sig_msg += XMSS_INDEX_LEN;

  769.   *sig_msg_len += XMSS_INDEX_LEN;

  770. 

  771.   // Copy R to signature

  772.   for (i = 0; i < XMSS_N; i++)

  773.     sig_msg[i] = R[i];

  774. 

  775.   sig_msg += XMSS_N;

  776.   *sig_msg_len += XMSS_N;

  777. 

  778.   // ----------------------------------

  779.   // Now we start to "really sign"

  780.   // ----------------------------------

  781. 

  782.   // Handle lowest layer separately as it is slightly different...

  783. 

  784.   // Prepare Address

  785.   setType(ots_addr, 0);

  786.   idx_tree = idx >> XMSS_TREEHEIGHT;

  787.   idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1));

  788.   setLayerADRS(ots_addr, 0);

  789.   setTreeADRS(ots_addr, idx_tree);

  790.   setOTSADRS(ots_addr, idx_leaf);

  791. 

  792.   // Compute seed for OTS key pair

  793.   get_seed(ots_seed, sk_seed, XMSS_N, ots_addr);

  794. 

  795.   // Compute WOTS signature

  796.   wots_sign(sig_msg, msg_h, ots_seed, pub_seed, ots_addr);

  797. 

  798.   sig_msg += XMSS_WOTS_KEYSIZE;

  799.   *sig_msg_len += XMSS_WOTS_KEYSIZE;

  800. 

  801.   memcpy(sig_msg, states[0].auth, XMSS_TREEHEIGHT*XMSS_N);

  802.   sig_msg += XMSS_TREEHEIGHT*XMSS_N;

  803.   *sig_msg_len += XMSS_TREEHEIGHT*XMSS_N;

  804. 

  805.   // prepare signature of remaining layers

  806.   for (i = 1; i < XMSS_D; i++) {

  807.     // put WOTS signature in place

  808.     memcpy(sig_msg, wots_sigs + (i-1)*XMSS_WOTS_KEYSIZE, XMSS_WOTS_KEYSIZE);

  809. 

  810.     sig_msg += XMSS_WOTS_KEYSIZE;

  811.     *sig_msg_len += XMSS_WOTS_KEYSIZE;

  812. 

  813.     // put AUTH nodes in place

  814.     memcpy(sig_msg, states[i].auth, XMSS_TREEHEIGHT*XMSS_N);

  815.     sig_msg += XMSS_TREEHEIGHT*XMSS_N;

  816.     *sig_msg_len += XMSS_TREEHEIGHT*XMSS_N;

  817.   }

  818. 

  819.   updates = (XMSS_TREEHEIGHT - XMSS_BDS_K) >> 1;

  820. 

  821.   setTreeADRS(addr, (idx_tree + 1));

  822.   // mandatory update for NEXT_0 (does not count towards h-k/2) if NEXT_0 exists

  823.   if ((1 + idx_tree) * (1 << XMSS_TREEHEIGHT) + idx_leaf < (1ULL << XMSS_FULLHEIGHT)) {

  824.     bds_state_update(&states[XMSS_D], sk_seed, pub_seed, addr);

  825.   }

  826. 

  827.   for (i = 0; i < XMSS_D; i++) {

  828.     // check if we're not at the end of a tree

  829.     if (! (((idx + 1) & ((1ULL << ((i+1)*XMSS_TREEHEIGHT)) - 1)) == 0)) {

  830.       idx_leaf = (idx >> (XMSS_TREEHEIGHT * i)) & ((1 << XMSS_TREEHEIGHT)-1);

  831.       idx_tree = (idx >> (XMSS_TREEHEIGHT * (i+1)));

  832.       setLayerADRS(addr, i);

  833.       setTreeADRS(addr, idx_tree);

  834.       if (i == (unsigned int) (needswap_upto + 1)) {

  835.         bds_round(&states[i], idx_leaf, sk_seed, pub_seed, addr);

  836.       }

  837.       updates = bds_treehash_update(&states[i], updates, sk_seed, pub_seed, addr);

  838.       setTreeADRS(addr, (idx_tree + 1));

  839.       // if a NEXT-tree exists for this level;

  840.       if ((1 + idx_tree) * (1 << XMSS_TREEHEIGHT) + idx_leaf < (1ULL << (XMSS_FULLHEIGHT - XMSS_TREEHEIGHT * i))) {

  841.         if (i > 0 && updates > 0 && states[XMSS_D + i].next_leaf < (1ULL << XMSS_FULLHEIGHT)) {

  842.           bds_state_update(&states[XMSS_D + i], sk_seed, pub_seed, addr);

  843.           updates--;

  844.         }

  845.       }

  846.     }

  847.     else if (idx < (1ULL << XMSS_FULLHEIGHT) - 1) {

  848.       memcpy(&tmp, states+XMSS_D + i, sizeof(bds_state));

  849.       memcpy(states+XMSS_D + i, states + i, sizeof(bds_state));

  850.       memcpy(states + i, &tmp, sizeof(bds_state));

  851. 

  852.       setLayerADRS(ots_addr, (i+1));

  853.       setTreeADRS(ots_addr, ((idx + 1) >> ((i+2) * XMSS_TREEHEIGHT)));

  854.       setOTSADRS(ots_addr, (((idx >> ((i+1) * XMSS_TREEHEIGHT)) + 1) & ((1 << XMSS_TREEHEIGHT)-1)));

  855. 

  856.       get_seed(ots_seed, sk+XMSS_INDEX_LEN, XMSS_N, ots_addr);

  857.       wots_sign(wots_sigs + i*XMSS_WOTS_KEYSIZE, states[i].stack, ots_seed, pub_seed, ots_addr);

  858. 

  859.       states[XMSS_D + i].stackoffset = 0;

  860.       states[XMSS_D + i].next_leaf = 0;

  861. 

  862.       updates--; // WOTS-signing counts as one update

  863.       needswap_upto = i;

  864.       for (j = 0; j < XMSS_TREEHEIGHT-XMSS_BDS_K; j++) {

  865.         states[i].treehash[j].completed = 1;

  866.       }

  867.     }

  868.   }

  869. 

  870.   memcpy(sig_msg, msg, msglen);

  871.   *sig_msg_len += msglen;

  872. 

  873.   return 0;

  874. }

  875. 

  876. /**

  877.  * Verifies a given message signature pair under a given public key.

  878.  */

  879. int xmssmt_sign_open(unsigned char *msg, unsigned long long *msglen, const unsigned char *sig_msg, unsigned long long sig_msg_len, const unsigned char *pk)

  880. {

  881.   uint64_t idx_tree;

  882.   uint32_t idx_leaf;

  883. 

  884.   unsigned long long i, m_len;

  885.   unsigned long long idx=0;

  886.   unsigned char wots_pk[XMSS_WOTS_KEYSIZE];

  887.   unsigned char pkhash[XMSS_N];

  888.   unsigned char root[XMSS_N];

  889.   unsigned char msg_h[XMSS_N];

  890.   unsigned char hash_key[3*XMSS_N];

  891. 

  892.   unsigned char pub_seed[XMSS_N];

  893.   memcpy(pub_seed, pk+XMSS_N, XMSS_N);

  894. 

  895.   // Init addresses

  896.   uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

  897.   uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

  898.   uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};

  899. 

  900.   // Extract index

  901.   for (i = 0; i < XMSS_INDEX_LEN; i++) {

  902.     idx |= ((unsigned long long)sig_msg[i]) << (8*(XMSS_INDEX_LEN - 1 - i));

  903.   }

  904.   sig_msg += XMSS_INDEX_LEN;

  905.   sig_msg_len -= XMSS_INDEX_LEN;

  906.   

  907.   // Generate hash key (R || root || idx)

  908.   memcpy(hash_key, sig_msg,XMSS_N);

  909.   memcpy(hash_key+XMSS_N, pk, XMSS_N);

  910.   to_byte(hash_key+2*XMSS_N, idx, XMSS_N);

  911. 

  912.   sig_msg += XMSS_N;

  913.   sig_msg_len -= XMSS_N;

  914.   

  915. 

  916.   // hash message (recall, R is now on pole position at sig_msg

  917.   unsigned long long tmp_sig_len = (XMSS_D * XMSS_WOTS_KEYSIZE) + (XMSS_FULLHEIGHT * XMSS_N);

  918.   m_len = sig_msg_len - tmp_sig_len;

  919.   h_msg(msg_h, sig_msg + tmp_sig_len, m_len, hash_key, 3*XMSS_N, XMSS_N);

  920. 

  921.   

  922.   //-----------------------

  923.   // Verify signature

  924.   //-----------------------

  925. 

  926.   // Prepare Address

  927.   idx_tree = idx >> XMSS_TREEHEIGHT;

  928.   idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1));

  929.   setLayerADRS(ots_addr, 0);

  930.   setTreeADRS(ots_addr, idx_tree);

  931.   setType(ots_addr, 0);

  932. 

  933.   memcpy(ltree_addr, ots_addr, 12);

  934.   setType(ltree_addr, 1);

  935. 

  936.   memcpy(node_addr, ltree_addr, 12);

  937.   setType(node_addr, 2);

  938.   

  939.   setOTSADRS(ots_addr, idx_leaf);

  940. 

  941.   // Check WOTS signature

  942.   wots_pkFromSig(wots_pk, sig_msg, msg_h, pub_seed, ots_addr);

  943. 

  944.   sig_msg += XMSS_WOTS_KEYSIZE;

  945.   sig_msg_len -= XMSS_WOTS_KEYSIZE;

  946. 

  947.   // Compute Ltree

  948.   setLtreeADRS(ltree_addr, idx_leaf);

  949.   l_tree(pkhash, wots_pk, pub_seed, ltree_addr);

  950. 

  951.   // Compute root

  952.   validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);

  953. 

  954.   sig_msg += XMSS_TREEHEIGHT*XMSS_N;

  955.   sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;

  956. 

  957.   for (i = 1; i < XMSS_D; i++) {

  958.     // Prepare Address

  959.     idx_leaf = (idx_tree & ((1 << XMSS_TREEHEIGHT)-1));

  960.     idx_tree = idx_tree >> XMSS_TREEHEIGHT;

  961. 

  962.     setLayerADRS(ots_addr, i);

  963.     setTreeADRS(ots_addr, idx_tree);

  964.     setType(ots_addr, 0);

  965. 

  966.     memcpy(ltree_addr, ots_addr, 12);

  967.     setType(ltree_addr, 1);

  968. 

  969.     memcpy(node_addr, ltree_addr, 12);

  970.     setType(node_addr, 2);

  971. 

  972.     setOTSADRS(ots_addr, idx_leaf);

  973. 

  974.     // Check WOTS signature

  975.     wots_pkFromSig(wots_pk, sig_msg, root, pub_seed, ots_addr);

  976. 

  977.     sig_msg += XMSS_WOTS_KEYSIZE;

  978.     sig_msg_len -= XMSS_WOTS_KEYSIZE;

  979. 

  980.     // Compute Ltree

  981.     setLtreeADRS(ltree_addr, idx_leaf);

  982.     l_tree(pkhash, wots_pk, pub_seed, ltree_addr);

  983. 

  984.     // Compute root

  985.     validate_authpath(root, pkhash, idx_leaf, sig_msg, pub_seed, node_addr);

  986. 

  987.     sig_msg += XMSS_TREEHEIGHT*XMSS_N;

  988.     sig_msg_len -= XMSS_TREEHEIGHT*XMSS_N;

  989. 

  990.   }

  991. 

  992.   for (i = 0; i < XMSS_N; i++)

  993.     if (root[i] != pk[i])

  994.       goto fail;

  995. 

  996.   *msglen = sig_msg_len;

  997.   for (i = 0; i < *msglen; i++)

  998.     msg[i] = sig_msg[i];

  999. 

  1000.   return 0;

  1001. 

  1002. 

  1003. fail:

  1004.   *msglen = sig_msg_len;

  1005.   for (i = 0; i < *msglen; i++)

  1006.     msg[i] = 0;

  1007.   *msglen = -1;

  1008.   return -1;

  1009. }