bbbb95e869
This produced repeated indices when reaching 2^32 signatures.
This was introduced in 9b35b00d98
with the re-introduction of runtime parameters. Compile-time parameters
did not contain this error.
265 satır
9.6 KiB
C
265 satır
9.6 KiB
C
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <stdint.h>
|
|
|
|
#include "hash.h"
|
|
#include "hash_address.h"
|
|
#include "params.h"
|
|
#include "randombytes.h"
|
|
#include "wots.h"
|
|
#include "xmss_commons.h"
|
|
#include "xmss_core.h"
|
|
|
|
/**
|
|
* For a given leaf index, computes the authentication path and the resulting
|
|
* root node using Merkle's TreeHash algorithm.
|
|
* Expects the layer and tree parts of subtree_addr to be set.
|
|
*/
|
|
static void treehash(const xmss_params *params,
|
|
unsigned char *root, unsigned char *auth_path,
|
|
const unsigned char *sk_seed,
|
|
const unsigned char *pub_seed,
|
|
uint32_t leaf_idx, const uint32_t subtree_addr[8])
|
|
{
|
|
unsigned char stack[(params->tree_height+1)*params->n];
|
|
unsigned int heights[params->tree_height+1];
|
|
unsigned int offset = 0;
|
|
|
|
/* The subtree has at most 2^20 leafs, so uint32_t suffices. */
|
|
uint32_t idx;
|
|
uint32_t tree_idx;
|
|
|
|
/* We need all three types of addresses in parallel. */
|
|
uint32_t ots_addr[8] = {0};
|
|
uint32_t ltree_addr[8] = {0};
|
|
uint32_t node_addr[8] = {0};
|
|
|
|
/* Select the required subtree. */
|
|
copy_subtree_addr(ots_addr, subtree_addr);
|
|
copy_subtree_addr(ltree_addr, subtree_addr);
|
|
copy_subtree_addr(node_addr, subtree_addr);
|
|
|
|
set_type(ots_addr, XMSS_ADDR_TYPE_OTS);
|
|
set_type(ltree_addr, XMSS_ADDR_TYPE_LTREE);
|
|
set_type(node_addr, XMSS_ADDR_TYPE_HASHTREE);
|
|
|
|
for (idx = 0; idx < (uint32_t)(1 << params->tree_height); idx++) {
|
|
/* Add the next leaf node to the stack. */
|
|
set_ltree_addr(ltree_addr, idx);
|
|
set_ots_addr(ots_addr, idx);
|
|
gen_leaf_wots(params, stack + offset*params->n,
|
|
sk_seed, pub_seed, ltree_addr, ots_addr);
|
|
offset++;
|
|
heights[offset - 1] = 0;
|
|
|
|
/* If this is a node we need for the auth path.. */
|
|
if ((leaf_idx ^ 0x1) == idx) {
|
|
memcpy(auth_path, stack + (offset - 1)*params->n, params->n);
|
|
}
|
|
|
|
/* While the top-most nodes are of equal height.. */
|
|
while (offset >= 2 && heights[offset - 1] == heights[offset - 2]) {
|
|
/* Compute index of the new node, in the next layer. */
|
|
tree_idx = (idx >> (heights[offset - 1] + 1));
|
|
|
|
/* Hash the top-most nodes from the stack together. */
|
|
/* Note that tree height is the 'lower' layer, even though we use
|
|
the index of the new node on the 'higher' layer. This follows
|
|
from the fact that we address the hash function calls. */
|
|
set_tree_height(node_addr, heights[offset - 1]);
|
|
set_tree_index(node_addr, tree_idx);
|
|
hash_h(params, stack + (offset-2)*params->n,
|
|
stack + (offset-2)*params->n, pub_seed, node_addr);
|
|
offset--;
|
|
/* Note that the top-most node is now one layer higher. */
|
|
heights[offset - 1]++;
|
|
|
|
/* If this is a node we need for the auth path.. */
|
|
if (((leaf_idx >> heights[offset - 1]) ^ 0x1) == tree_idx) {
|
|
memcpy(auth_path + heights[offset - 1]*params->n,
|
|
stack + (offset - 1)*params->n, params->n);
|
|
}
|
|
}
|
|
}
|
|
memcpy(root, stack, params->n);
|
|
}
|
|
|
|
/*
|
|
* Generates a XMSS key pair for a given parameter set.
|
|
* Format sk: [(32bit) index || SK_SEED || SK_PRF || PUB_SEED || root]
|
|
* Format pk: [root || PUB_SEED], omitting algorithm OID.
|
|
*/
|
|
int xmss_core_keypair(const xmss_params *params,
|
|
unsigned char *pk, unsigned char *sk)
|
|
{
|
|
/* The key generation procedure of XMSS and XMSSMT is exactly the same.
|
|
The only important detail is that the right subtree must be selected;
|
|
this requires us to correctly set the d=1 parameter for XMSS. */
|
|
return xmssmt_core_keypair(params, pk, sk);
|
|
}
|
|
|
|
/**
|
|
* Signs a message. Returns an array containing the signature followed by the
|
|
* message and an updated secret key.
|
|
*/
|
|
int xmss_core_sign(const xmss_params *params,
|
|
unsigned char *sk,
|
|
unsigned char *sm, unsigned long long *smlen,
|
|
const unsigned char *m, unsigned long long mlen)
|
|
{
|
|
const unsigned char *sk_seed = sk + params->index_len;
|
|
const unsigned char *sk_prf = sk + params->index_len + params->n;
|
|
const unsigned char *pub_seed = sk + params->index_len + 2*params->n;
|
|
const unsigned char *pub_root = sk + params->index_len + 3*params->n;
|
|
|
|
unsigned char root[params->n];
|
|
unsigned char mhash[params->n];
|
|
unsigned char ots_seed[params->n];
|
|
unsigned long idx;
|
|
unsigned char idx_bytes_32[32];
|
|
|
|
uint32_t ots_addr[8] = {0};
|
|
set_type(ots_addr, XMSS_ADDR_TYPE_OTS);
|
|
|
|
/* Read and use the current index from the secret key. */
|
|
idx = (unsigned long)bytes_to_ull(sk, params->index_len);
|
|
memcpy(sm, sk, params->index_len);
|
|
sm += params->index_len;
|
|
|
|
/*************************************************************************
|
|
* THIS IS WHERE PRODUCTION IMPLEMENTATIONS WOULD UPDATE THE SECRET KEY. *
|
|
*************************************************************************/
|
|
/* Increment the index in the secret key. */
|
|
ull_to_bytes(sk, params->index_len, idx + 1);
|
|
|
|
/* Compute the digest randomization value. */
|
|
ull_to_bytes(idx_bytes_32, 32, idx);
|
|
prf(params, sm, idx_bytes_32, sk_prf, params->n);
|
|
|
|
/* Compute the message hash. */
|
|
hash_message(params, mhash, sm, pub_root, idx, m, mlen);
|
|
sm += params->n;
|
|
|
|
set_ots_addr(ots_addr, idx);
|
|
|
|
/* Get a seed for the WOTS keypair. */
|
|
get_seed(params, ots_seed, sk_seed, ots_addr);
|
|
|
|
/* Compute a WOTS signature on the message hash. */
|
|
wots_sign(params, sm, mhash, ots_seed, pub_seed, ots_addr);
|
|
sm += params->wots_keysize;
|
|
|
|
/* Compute the authentication path for the used WOTS leaf. */
|
|
treehash(params, root, sm, sk_seed, pub_seed, idx, ots_addr);
|
|
sm += params->tree_height*params->n;
|
|
|
|
memcpy(sm, m, mlen);
|
|
*smlen = params->bytes + mlen;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* Generates a XMSSMT key pair for a given parameter set.
|
|
* Format sk: [(ceil(h/8) bit) index || SK_SEED || SK_PRF || PUB_SEED]
|
|
* Format pk: [root || PUB_SEED] omitting algorithm OID.
|
|
*/
|
|
int xmssmt_core_keypair(const xmss_params *params,
|
|
unsigned char *pk, unsigned char *sk)
|
|
{
|
|
/* We do not need the auth path in key generation, but it simplifies the
|
|
code to have just one treehash routine that computes both root and path
|
|
in one function. */
|
|
unsigned char auth_path[params->tree_height * params->n];
|
|
uint32_t top_tree_addr[8] = {0};
|
|
set_layer_addr(top_tree_addr, params->d - 1);
|
|
|
|
/* Initialize index to 0. */
|
|
memset(sk, 0, params->index_len);
|
|
sk += params->index_len;
|
|
|
|
/* Initialize SK_SEED, SK_PRF and PUB_SEED. */
|
|
randombytes(sk, 3 * params->n);
|
|
memcpy(pk + params->n, sk + 2*params->n, params->n);
|
|
|
|
/* Compute root node of the top-most subtree. */
|
|
treehash(params, pk, auth_path, sk, pk + params->n, 0, top_tree_addr);
|
|
memcpy(sk + 3*params->n, pk, params->n);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* Signs a message. Returns an array containing the signature followed by the
|
|
* message and an updated secret key.
|
|
*/
|
|
int xmssmt_core_sign(const xmss_params *params,
|
|
unsigned char *sk,
|
|
unsigned char *sm, unsigned long long *smlen,
|
|
const unsigned char *m, unsigned long long mlen)
|
|
{
|
|
const unsigned char *sk_seed = sk + params->index_len;
|
|
const unsigned char *sk_prf = sk + params->index_len + params->n;
|
|
const unsigned char *pub_seed = sk + params->index_len + 2*params->n;
|
|
const unsigned char *pub_root = sk + params->index_len + 3*params->n;
|
|
|
|
unsigned char root[params->n];
|
|
unsigned char *mhash = root;
|
|
unsigned char ots_seed[params->n];
|
|
unsigned long long idx;
|
|
unsigned char idx_bytes_32[32];
|
|
unsigned int i;
|
|
uint32_t idx_leaf;
|
|
|
|
uint32_t ots_addr[8] = {0};
|
|
set_type(ots_addr, XMSS_ADDR_TYPE_OTS);
|
|
|
|
/* Read and use the current index from the secret key. */
|
|
idx = (unsigned long)bytes_to_ull(sk, params->index_len);
|
|
memcpy(sm, sk, params->index_len);
|
|
sm += params->index_len;
|
|
|
|
/*************************************************************************
|
|
* THIS IS WHERE PRODUCTION IMPLEMENTATIONS WOULD UPDATE THE SECRET KEY. *
|
|
*************************************************************************/
|
|
/* Increment the index in the secret key. */
|
|
ull_to_bytes(sk, params->index_len, idx + 1);
|
|
|
|
/* Compute the digest randomization value. */
|
|
ull_to_bytes(idx_bytes_32, 32, idx);
|
|
prf(params, sm, idx_bytes_32, sk_prf, params->n);
|
|
|
|
/* Compute the message hash. */
|
|
hash_message(params, mhash, sm, pub_root, idx, m, mlen);
|
|
sm += params->n;
|
|
|
|
set_type(ots_addr, XMSS_ADDR_TYPE_OTS);
|
|
|
|
for (i = 0; i < params->d; i++) {
|
|
idx_leaf = (idx & ((1 << params->tree_height)-1));
|
|
idx = idx >> params->tree_height;
|
|
|
|
set_layer_addr(ots_addr, i);
|
|
set_tree_addr(ots_addr, idx);
|
|
set_ots_addr(ots_addr, idx_leaf);
|
|
|
|
/* Get a seed for the WOTS keypair. */
|
|
get_seed(params, ots_seed, sk_seed, ots_addr);
|
|
|
|
/* Compute a WOTS signature. */
|
|
/* Initially, root = mhash, but on subsequent iterations it is the root
|
|
of the subtree below the currently processed subtree. */
|
|
wots_sign(params, sm, root, ots_seed, pub_seed, ots_addr);
|
|
sm += params->wots_keysize;
|
|
|
|
/* Compute the authentication path for the used WOTS leaf. */
|
|
treehash(params, root, sm, sk_seed, pub_seed, idx_leaf, ots_addr);
|
|
sm += params->tree_height*params->n;
|
|
}
|
|
|
|
memcpy(sm, m, mlen);
|
|
*smlen = params->bytes + mlen;
|
|
|
|
return 0;
|
|
}
|