1 // Copyright 2024 The BoringSSL Authors
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 //     https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 
15 #ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_PARAMS_H
16 #define OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_PARAMS_H
17 
18 #include <openssl/base.h>
19 #include "../bcm_interface.h"
20 
21 #if defined(__cplusplus)
22 extern "C" {
23 #endif
24 
25 // Total height of the tree structure.
26 #define SLHDSA_SHA2_128S_FULL_HEIGHT 63
27 // Number of subtree layers.
28 #define SLHDSA_SHA2_128S_D 7
29 // Height of the trees on each layer
30 #define SLHDSA_SHA2_128S_TREE_HEIGHT 9
31 // Height of each individual FORS tree.
32 #define SLHDSA_SHA2_128S_FORS_HEIGHT 12
33 // Total number of FORS tree used.
34 #define SLHDSA_SHA2_128S_FORS_TREES 14
35 // Size of a FORS signature
36 #define SLHDSA_SHA2_128S_FORS_BYTES                                   \
37   ((SLHDSA_SHA2_128S_FORS_HEIGHT + 1) * SLHDSA_SHA2_128S_FORS_TREES * \
38    BCM_SLHDSA_SHA2_128S_N)
39 
40 // Winternitz parameter and derived values
41 #define SLHDSA_SHA2_128S_WOTS_W 16
42 #define SLHDSA_SHA2_128S_WOTS_LOG_W 4
43 #define SLHDSA_SHA2_128S_WOTS_LEN1 32
44 #define SLHDSA_SHA2_128S_WOTS_LEN2 3
45 #define SLHDSA_SHA2_128S_WOTS_LEN 35
46 #define SLHDSA_SHA2_128S_WOTS_BYTES \
47   (BCM_SLHDSA_SHA2_128S_N * SLHDSA_SHA2_128S_WOTS_LEN)
48 
49 // XMSS sizes
50 #define SLHDSA_SHA2_128S_XMSS_BYTES \
51   (SLHDSA_SHA2_128S_WOTS_BYTES +    \
52    (BCM_SLHDSA_SHA2_128S_N * SLHDSA_SHA2_128S_TREE_HEIGHT))
53 
54 // Size of the message digest (NOTE: This is only correct for the SHA-256 params
55 // here)
56 #define SLHDSA_SHA2_128S_DIGEST_SIZE                                           \
57   (((SLHDSA_SHA2_128S_FORS_TREES * SLHDSA_SHA2_128S_FORS_HEIGHT) / 8) +        \
58    (((SLHDSA_SHA2_128S_FULL_HEIGHT - SLHDSA_SHA2_128S_TREE_HEIGHT) / 8) + 1) + \
59    (SLHDSA_SHA2_128S_TREE_HEIGHT / 8) + 1)
60 
61 // Compressed address size when using SHA-256
62 #define SLHDSA_SHA2_128S_SHA256_ADDR_BYTES 22
63 
64 // Size of the FORS message hash
65 #define SLHDSA_SHA2_128S_FORS_MSG_BYTES \
66   ((SLHDSA_SHA2_128S_FORS_HEIGHT * SLHDSA_SHA2_128S_FORS_TREES + 7) / 8)
67 #define SLHDSA_SHA2_128S_TREE_BITS \
68   (SLHDSA_SHA2_128S_TREE_HEIGHT * (SLHDSA_SHA2_128S_D - 1))
69 #define SLHDSA_SHA2_128S_TREE_BYTES ((SLHDSA_SHA2_128S_TREE_BITS + 7) / 8)
70 #define SLHDSA_SHA2_128S_LEAF_BITS SLHDSA_SHA2_128S_TREE_HEIGHT
71 #define SLHDSA_SHA2_128S_LEAF_BYTES ((SLHDSA_SHA2_128S_LEAF_BITS + 7) / 8)
72 
73 
74 #if defined(__cplusplus)
75 }  // extern C
76 #endif
77 
78 #endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_PARAMS_H
79