You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

361 regels
9.1 KiB

  1. /*
  2. xmss_commons.c 20160722
  3. Andreas Hülsing
  4. Joost Rijneveld
  5. Public domain.
  6. */
  7. #include "xmss_commons.h"
  8. #include <stdlib.h>
  9. #include <string.h>
  10. #include <stdint.h>
  11. #include "wots.h"
  12. #include "hash.h"
  13. #include "hash_address.h"
  14. #include "params.h"
  15. void to_byte(unsigned char *out, unsigned long long in, uint32_t bytes)
  16. {
  17. int32_t i;
  18. for (i = bytes-1; i >= 0; i--) {
  19. out[i] = in & 0xff;
  20. in = in >> 8;
  21. }
  22. }
  23. /**
  24. * Computes the leaf at a given address. First generates the WOTS key pair, then computes leaf using l_tree. As this happens position independent, we only require that addr encodes the right ltree-address.
  25. */
  26. void gen_leaf_wots(unsigned char *leaf, const unsigned char *sk_seed, const unsigned char *pub_seed, uint32_t ltree_addr[8], uint32_t ots_addr[8])
  27. {
  28. unsigned char seed[XMSS_N];
  29. unsigned char pk[XMSS_WOTS_KEYSIZE];
  30. get_seed(seed, sk_seed, ots_addr);
  31. wots_pkgen(pk, seed, pub_seed, ots_addr);
  32. l_tree(leaf, pk, pub_seed, ltree_addr);
  33. }
  34. /**
  35. * Used for pseudorandom keygeneration,
  36. * generates the seed for the WOTS keypair at address addr
  37. *
  38. * takes XMSS_N byte sk_seed and returns XMSS_N byte seed using 32 byte address addr.
  39. */
  40. void get_seed(unsigned char *seed, const unsigned char *sk_seed, uint32_t addr[8])
  41. {
  42. unsigned char bytes[32];
  43. // Make sure that chain addr, hash addr, and key bit are 0!
  44. setChainADRS(addr, 0);
  45. setHashADRS(addr, 0);
  46. setKeyAndMask(addr, 0);
  47. // Generate pseudorandom value
  48. addr_to_byte(bytes, addr);
  49. prf(seed, bytes, sk_seed, XMSS_N);
  50. }
  51. /**
  52. * Computes a leaf from a WOTS public key using an L-tree.
  53. */
  54. void l_tree(unsigned char *leaf, unsigned char *wots_pk, const unsigned char *pub_seed, uint32_t addr[8])
  55. {
  56. unsigned int l = XMSS_WOTS_LEN;
  57. uint32_t i = 0;
  58. uint32_t height = 0;
  59. uint32_t bound;
  60. //ADRS.setTreeHeight(0);
  61. setTreeHeight(addr, height);
  62. while (l > 1) {
  63. bound = l >> 1; //floor(l / 2);
  64. for (i = 0; i < bound; i++) {
  65. //ADRS.setTreeIndex(i);
  66. setTreeIndex(addr, i);
  67. //wots_pk[i] = RAND_HASH(pk[2i], pk[2i + 1], SEED, ADRS);
  68. hash_h(wots_pk+i*XMSS_N, wots_pk+i*2*XMSS_N, pub_seed, addr);
  69. }
  70. //if ( l % 2 == 1 ) {
  71. if (l & 1) {
  72. //pk[floor(l / 2) + 1] = pk[l];
  73. memcpy(wots_pk+(l>>1)*XMSS_N, wots_pk+(l-1)*XMSS_N, XMSS_N);
  74. //l = ceil(l / 2);
  75. l=(l>>1)+1;
  76. }
  77. else {
  78. //l = ceil(l / 2);
  79. l=(l>>1);
  80. }
  81. //ADRS.setTreeHeight(ADRS.getTreeHeight() + 1);
  82. height++;
  83. setTreeHeight(addr, height);
  84. }
  85. //return pk[0];
  86. memcpy(leaf, wots_pk, XMSS_N);
  87. }
  88. /**
  89. * Computes a root node given a leaf and an authapth
  90. */
  91. static void validate_authpath(unsigned char *root, const unsigned char *leaf, unsigned long leafidx, const unsigned char *authpath, const unsigned char *pub_seed, uint32_t addr[8])
  92. {
  93. uint32_t i, j;
  94. unsigned char buffer[2*XMSS_N];
  95. // If leafidx is odd (last bit = 1), current path element is a right child and authpath has to go to the left.
  96. // Otherwise, it is the other way around
  97. if (leafidx & 1) {
  98. for (j = 0; j < XMSS_N; j++)
  99. buffer[XMSS_N+j] = leaf[j];
  100. for (j = 0; j < XMSS_N; j++)
  101. buffer[j] = authpath[j];
  102. }
  103. else {
  104. for (j = 0; j < XMSS_N; j++)
  105. buffer[j] = leaf[j];
  106. for (j = 0; j < XMSS_N; j++)
  107. buffer[XMSS_N+j] = authpath[j];
  108. }
  109. authpath += XMSS_N;
  110. for (i = 0; i < XMSS_TREEHEIGHT-1; i++) {
  111. setTreeHeight(addr, i);
  112. leafidx >>= 1;
  113. setTreeIndex(addr, leafidx);
  114. if (leafidx&1) {
  115. hash_h(buffer+XMSS_N, buffer, pub_seed, addr);
  116. for (j = 0; j < XMSS_N; j++)
  117. buffer[j] = authpath[j];
  118. }
  119. else {
  120. hash_h(buffer, buffer, pub_seed, addr);
  121. for (j = 0; j < XMSS_N; j++)
  122. buffer[j+XMSS_N] = authpath[j];
  123. }
  124. authpath += XMSS_N;
  125. }
  126. setTreeHeight(addr, (XMSS_TREEHEIGHT-1));
  127. leafidx >>= 1;
  128. setTreeIndex(addr, leafidx);
  129. hash_h(root, buffer, pub_seed, addr);
  130. }
  131. /**
  132. * Verifies a given message signature pair under a given public key.
  133. */
  134. int xmss_sign_open(unsigned char *m, unsigned long long *mlen, const unsigned char *sm, unsigned long long smlen, const unsigned char *pk)
  135. {
  136. unsigned long long i, m_len;
  137. unsigned long idx=0;
  138. unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
  139. unsigned char pkhash[XMSS_N];
  140. unsigned char root[XMSS_N];
  141. unsigned char msg_h[XMSS_N];
  142. unsigned char hash_key[3*XMSS_N];
  143. unsigned char pub_seed[XMSS_N];
  144. memcpy(pub_seed, pk+XMSS_N, XMSS_N);
  145. // Init addresses
  146. uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
  147. uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
  148. uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
  149. setType(ots_addr, 0);
  150. setType(ltree_addr, 1);
  151. setType(node_addr, 2);
  152. // Extract index
  153. idx = ((unsigned long)sm[0] << 24) | ((unsigned long)sm[1] << 16) | ((unsigned long)sm[2] << 8) | sm[3];
  154. // Generate hash key (R || root || idx)
  155. memcpy(hash_key, sm+4,XMSS_N);
  156. memcpy(hash_key+XMSS_N, pk, XMSS_N);
  157. to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
  158. sm += (XMSS_N+4);
  159. smlen -= (XMSS_N+4);
  160. // hash message
  161. unsigned long long tmp_sig_len = XMSS_WOTS_KEYSIZE+XMSS_TREEHEIGHT*XMSS_N;
  162. m_len = smlen - tmp_sig_len;
  163. h_msg(msg_h, sm + tmp_sig_len, m_len, hash_key, 3*XMSS_N);
  164. //-----------------------
  165. // Verify signature
  166. //-----------------------
  167. // Prepare Address
  168. setOTSADRS(ots_addr, idx);
  169. // Check WOTS signature
  170. wots_pkFromSig(wots_pk, sm, msg_h, pub_seed, ots_addr);
  171. sm += XMSS_WOTS_KEYSIZE;
  172. smlen -= XMSS_WOTS_KEYSIZE;
  173. // Compute Ltree
  174. setLtreeADRS(ltree_addr, idx);
  175. l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
  176. // Compute root
  177. validate_authpath(root, pkhash, idx, sm, pub_seed, node_addr);
  178. sm += XMSS_TREEHEIGHT*XMSS_N;
  179. smlen -= XMSS_TREEHEIGHT*XMSS_N;
  180. for (i = 0; i < XMSS_N; i++)
  181. if (root[i] != pk[i])
  182. goto fail;
  183. *mlen = smlen;
  184. for (i = 0; i < *mlen; i++)
  185. m[i] = sm[i];
  186. return 0;
  187. fail:
  188. *mlen = smlen;
  189. for (i = 0; i < *mlen; i++)
  190. m[i] = 0;
  191. *mlen = -1;
  192. return -1;
  193. }
  194. /**
  195. * Verifies a given message signature pair under a given public key.
  196. */
  197. int xmssmt_sign_open(unsigned char *m, unsigned long long *mlen, const unsigned char *sm, unsigned long long smlen, const unsigned char *pk)
  198. {
  199. uint64_t idx_tree;
  200. uint32_t idx_leaf;
  201. unsigned long long i, m_len;
  202. unsigned long long idx=0;
  203. unsigned char wots_pk[XMSS_WOTS_KEYSIZE];
  204. unsigned char pkhash[XMSS_N];
  205. unsigned char root[XMSS_N];
  206. unsigned char msg_h[XMSS_N];
  207. unsigned char hash_key[3*XMSS_N];
  208. unsigned char pub_seed[XMSS_N];
  209. memcpy(pub_seed, pk+XMSS_N, XMSS_N);
  210. // Init addresses
  211. uint32_t ots_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
  212. uint32_t ltree_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
  213. uint32_t node_addr[8] = {0, 0, 0, 0, 0, 0, 0, 0};
  214. // Extract index
  215. for (i = 0; i < XMSS_INDEX_LEN; i++) {
  216. idx |= ((unsigned long long)sm[i]) << (8*(XMSS_INDEX_LEN - 1 - i));
  217. }
  218. sm += XMSS_INDEX_LEN;
  219. smlen -= XMSS_INDEX_LEN;
  220. // Generate hash key (R || root || idx)
  221. memcpy(hash_key, sm,XMSS_N);
  222. memcpy(hash_key+XMSS_N, pk, XMSS_N);
  223. to_byte(hash_key+2*XMSS_N, idx, XMSS_N);
  224. sm += XMSS_N;
  225. smlen -= XMSS_N;
  226. // hash message
  227. unsigned long long tmp_sig_len = (XMSS_D * XMSS_WOTS_KEYSIZE) + (XMSS_FULLHEIGHT * XMSS_N);
  228. m_len = smlen - tmp_sig_len;
  229. h_msg(msg_h, sm + tmp_sig_len, m_len, hash_key, 3*XMSS_N);
  230. //-----------------------
  231. // Verify signature
  232. //-----------------------
  233. // Prepare Address
  234. idx_tree = idx >> XMSS_TREEHEIGHT;
  235. idx_leaf = (idx & ((1 << XMSS_TREEHEIGHT)-1));
  236. setLayerADRS(ots_addr, 0);
  237. setTreeADRS(ots_addr, idx_tree);
  238. setType(ots_addr, 0);
  239. memcpy(ltree_addr, ots_addr, 12);
  240. setType(ltree_addr, 1);
  241. memcpy(node_addr, ltree_addr, 12);
  242. setType(node_addr, 2);
  243. setOTSADRS(ots_addr, idx_leaf);
  244. // Check WOTS signature
  245. wots_pkFromSig(wots_pk, sm, msg_h, pub_seed, ots_addr);
  246. sm += XMSS_WOTS_KEYSIZE;
  247. smlen -= XMSS_WOTS_KEYSIZE;
  248. // Compute Ltree
  249. setLtreeADRS(ltree_addr, idx_leaf);
  250. l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
  251. // Compute root
  252. validate_authpath(root, pkhash, idx_leaf, sm, pub_seed, node_addr);
  253. sm += XMSS_TREEHEIGHT*XMSS_N;
  254. smlen -= XMSS_TREEHEIGHT*XMSS_N;
  255. for (i = 1; i < XMSS_D; i++) {
  256. // Prepare Address
  257. idx_leaf = (idx_tree & ((1 << XMSS_TREEHEIGHT)-1));
  258. idx_tree = idx_tree >> XMSS_TREEHEIGHT;
  259. setLayerADRS(ots_addr, i);
  260. setTreeADRS(ots_addr, idx_tree);
  261. setType(ots_addr, 0);
  262. memcpy(ltree_addr, ots_addr, 12);
  263. setType(ltree_addr, 1);
  264. memcpy(node_addr, ltree_addr, 12);
  265. setType(node_addr, 2);
  266. setOTSADRS(ots_addr, idx_leaf);
  267. // Check WOTS signature
  268. wots_pkFromSig(wots_pk, sm, root, pub_seed, ots_addr);
  269. sm += XMSS_WOTS_KEYSIZE;
  270. smlen -= XMSS_WOTS_KEYSIZE;
  271. // Compute Ltree
  272. setLtreeADRS(ltree_addr, idx_leaf);
  273. l_tree(pkhash, wots_pk, pub_seed, ltree_addr);
  274. // Compute root
  275. validate_authpath(root, pkhash, idx_leaf, sm, pub_seed, node_addr);
  276. sm += XMSS_TREEHEIGHT*XMSS_N;
  277. smlen -= XMSS_TREEHEIGHT*XMSS_N;
  278. }
  279. for (i = 0; i < XMSS_N; i++)
  280. if (root[i] != pk[i])
  281. goto fail;
  282. *mlen = smlen;
  283. for (i = 0; i < *mlen; i++)
  284. m[i] = sm[i];
  285. return 0;
  286. fail:
  287. *mlen = smlen;
  288. for (i = 0; i < *mlen; i++)
  289. m[i] = 0;
  290. *mlen = -1;
  291. return -1;
  292. }