1 // Copyright 2024 The BoringSSL Authors 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // https://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 #ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_THASH_H 16 #define OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_THASH_H 17 18 #include "./params.h" 19 20 #if defined(__cplusplus) 21 extern "C" { 22 #endif 23 24 25 // Implements PRF_msg: a pseudo-random function that is used to generate the 26 // randomizer r for the randomized hashing of the message to be signed. 27 // (Section 4.1, page 11) 28 void slhdsa_thash_prfmsg(uint8_t output[BCM_SLHDSA_SHA2_128S_N], 29 const uint8_t sk_prf[BCM_SLHDSA_SHA2_128S_N], 30 const uint8_t opt_rand[BCM_SLHDSA_SHA2_128S_N], 31 const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], 32 const uint8_t *ctx, size_t ctx_len, const uint8_t *msg, 33 size_t msg_len); 34 35 // Implements H_msg: a hash function used to generate the digest of the message 36 // to be signed. (Section 4.1, page 11) 37 void slhdsa_thash_hmsg(uint8_t output[SLHDSA_SHA2_128S_DIGEST_SIZE], 38 const uint8_t r[BCM_SLHDSA_SHA2_128S_N], 39 const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N], 40 const uint8_t pk_root[BCM_SLHDSA_SHA2_128S_N], 41 const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], 42 const uint8_t *ctx, size_t ctx_len, const uint8_t *msg, 43 size_t msg_len); 44 45 // Implements PRF: a pseudo-random function that is used to generate the secret 46 // values in WOTS+ and FORS private keys. (Section 4.1, page 11) 47 void slhdsa_thash_prf(uint8_t output[BCM_SLHDSA_SHA2_128S_N], 48 const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N], 49 const uint8_t sk_seed[BCM_SLHDSA_SHA2_128S_N], 50 uint8_t addr[32]); 51 52 // Implements T_l: a hash function that maps an l*n-byte message to an n-byte 53 // message. Used for WOTS+ public key compression. (Section 4.1, page 11) 54 void slhdsa_thash_tl(uint8_t output[BCM_SLHDSA_SHA2_128S_N], 55 const uint8_t input[SLHDSA_SHA2_128S_WOTS_BYTES], 56 const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N], 57 uint8_t addr[32]); 58 59 // Implements H: a hash function that takes a 2*n-byte message as input and 60 // produces an n-byte output. (Section 4.1, page 11) 61 void slhdsa_thash_h(uint8_t output[BCM_SLHDSA_SHA2_128S_N], 62 const uint8_t input[2 * BCM_SLHDSA_SHA2_128S_N], 63 const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N], 64 uint8_t addr[32]); 65 66 // Implements F: a hash function that takes an n-byte message as input and 67 // produces an n-byte output. (Section 4.1, page 11) 68 void slhdsa_thash_f(uint8_t output[BCM_SLHDSA_SHA2_128S_N], 69 const uint8_t input[BCM_SLHDSA_SHA2_128S_N], 70 const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N], 71 uint8_t addr[32]); 72 73 // Implements T_k: a hash function that maps a k*n-byte message to an n-byte 74 // message. Used for FORS public key compression. (Section 4.1, page 11) 75 void slhdsa_thash_tk( 76 uint8_t output[BCM_SLHDSA_SHA2_128S_N], 77 const uint8_t input[SLHDSA_SHA2_128S_FORS_TREES * BCM_SLHDSA_SHA2_128S_N], 78 const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N], uint8_t addr[32]); 79 80 81 #if defined(__cplusplus) 82 } // extern C 83 #endif 84 85 #endif // OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_THASH_H 86