1// Copyright 2024 The BoringSSL Authors 2// 3// Licensed under the Apache License, Version 2.0 (the "License"); 4// you may not use this file except in compliance with the License. 5// You may obtain a copy of the License at 6// 7// https://www.apache.org/licenses/LICENSE-2.0 8// 9// Unless required by applicable law or agreed to in writing, software 10// distributed under the License is distributed on an "AS IS" BASIS, 11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12// See the License for the specific language governing permissions and 13// limitations under the License. 14 15#include <openssl/base.h> 16 17#include <string.h> 18 19#include "../../internal.h" 20#include "./address.h" 21#include "./merkle.h" 22#include "./params.h" 23#include "./thash.h" 24#include "./wots.h" 25 26 27// Implements Algorithm 9: xmss_node function (page 23) 28void slhdsa_treehash(uint8_t out_pk[BCM_SLHDSA_SHA2_128S_N], 29 const uint8_t sk_seed[BCM_SLHDSA_SHA2_128S_N], 30 uint32_t i /*target node index*/, 31 uint32_t z /*target node height*/, 32 const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N], 33 uint8_t addr[32]) { 34 BSSL_CHECK(z <= SLHDSA_SHA2_128S_TREE_HEIGHT); 35 BSSL_CHECK(i < (uint32_t)(1 << (SLHDSA_SHA2_128S_TREE_HEIGHT - z))); 36 37 if (z == 0) { 38 slhdsa_set_type(addr, SLHDSA_SHA2_128S_ADDR_TYPE_WOTS); 39 slhdsa_set_keypair_addr(addr, i); 40 slhdsa_wots_pk_gen(out_pk, sk_seed, pk_seed, addr); 41 } else { 42 // Stores left node and right node. 43 uint8_t nodes[2 * BCM_SLHDSA_SHA2_128S_N]; 44 slhdsa_treehash(nodes, sk_seed, 2 * i, z - 1, pk_seed, addr); 45 slhdsa_treehash(nodes + BCM_SLHDSA_SHA2_128S_N, sk_seed, 2 * i + 1, z - 1, 46 pk_seed, addr); 47 slhdsa_set_type(addr, SLHDSA_SHA2_128S_ADDR_TYPE_HASHTREE); 48 slhdsa_set_tree_height(addr, z); 49 slhdsa_set_tree_index(addr, i); 50 slhdsa_thash_h(out_pk, nodes, pk_seed, addr); 51 } 52} 53 54// Implements Algorithm 10: xmss_sign function (page 24) 55void slhdsa_xmss_sign(uint8_t sig[SLHDSA_SHA2_128S_XMSS_BYTES], 56 const uint8_t msg[BCM_SLHDSA_SHA2_128S_N], unsigned int idx, 57 const uint8_t sk_seed[BCM_SLHDSA_SHA2_128S_N], 58 const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N], 59 uint8_t addr[32]) { 60 // Build authentication path 61 for (size_t j = 0; j < SLHDSA_SHA2_128S_TREE_HEIGHT; ++j) { 62 unsigned int k = (idx >> j) ^ 1; 63 slhdsa_treehash(sig + SLHDSA_SHA2_128S_WOTS_BYTES + j * BCM_SLHDSA_SHA2_128S_N, 64 sk_seed, k, j, pk_seed, addr); 65 } 66 67 // Compute WOTS+ signature 68 slhdsa_set_type(addr, SLHDSA_SHA2_128S_ADDR_TYPE_WOTS); 69 slhdsa_set_keypair_addr(addr, idx); 70 slhdsa_wots_sign(sig, msg, sk_seed, pk_seed, addr); 71} 72 73// Implements Algorithm 11: xmss_pkFromSig function (page 25) 74void slhdsa_xmss_pk_from_sig( 75 uint8_t root[BCM_SLHDSA_SHA2_128S_N], 76 const uint8_t xmss_sig[SLHDSA_SHA2_128S_XMSS_BYTES], unsigned int idx, 77 const uint8_t msg[BCM_SLHDSA_SHA2_128S_N], 78 const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N], uint8_t addr[32]) { 79 // Stores node[0] and node[1] from Algorithm 11 80 slhdsa_set_type(addr, SLHDSA_SHA2_128S_ADDR_TYPE_WOTS); 81 slhdsa_set_keypair_addr(addr, idx); 82 uint8_t node[2 * BCM_SLHDSA_SHA2_128S_N]; 83 slhdsa_wots_pk_from_sig(node, xmss_sig, msg, pk_seed, addr); 84 85 slhdsa_set_type(addr, SLHDSA_SHA2_128S_ADDR_TYPE_HASHTREE); 86 slhdsa_set_tree_index(addr, idx); 87 88 uint8_t tmp[2 * BCM_SLHDSA_SHA2_128S_N]; 89 const uint8_t *const auth = xmss_sig + SLHDSA_SHA2_128S_WOTS_BYTES; 90 for (size_t k = 0; k < SLHDSA_SHA2_128S_TREE_HEIGHT; ++k) { 91 slhdsa_set_tree_height(addr, k + 1); 92 if (((idx >> k) & 1) == 0) { 93 slhdsa_set_tree_index(addr, slhdsa_get_tree_index(addr) >> 1); 94 OPENSSL_memcpy(tmp, node, BCM_SLHDSA_SHA2_128S_N); 95 OPENSSL_memcpy(tmp + BCM_SLHDSA_SHA2_128S_N, auth + k * BCM_SLHDSA_SHA2_128S_N, 96 BCM_SLHDSA_SHA2_128S_N); 97 slhdsa_thash_h(node + BCM_SLHDSA_SHA2_128S_N, tmp, pk_seed, addr); 98 } else { 99 slhdsa_set_tree_index(addr, (slhdsa_get_tree_index(addr) - 1) >> 1); 100 OPENSSL_memcpy(tmp, auth + k * BCM_SLHDSA_SHA2_128S_N, BCM_SLHDSA_SHA2_128S_N); 101 OPENSSL_memcpy(tmp + BCM_SLHDSA_SHA2_128S_N, node, BCM_SLHDSA_SHA2_128S_N); 102 slhdsa_thash_h(node + BCM_SLHDSA_SHA2_128S_N, tmp, pk_seed, addr); 103 } 104 OPENSSL_memcpy(node, node + BCM_SLHDSA_SHA2_128S_N, BCM_SLHDSA_SHA2_128S_N); 105 } 106 OPENSSL_memcpy(root, node, BCM_SLHDSA_SHA2_128S_N); 107} 108 109// Implements Algorithm 12: ht_sign function (page 27) 110void slhdsa_ht_sign( 111 uint8_t sig[SLHDSA_SHA2_128S_XMSS_BYTES * SLHDSA_SHA2_128S_D], 112 const uint8_t message[BCM_SLHDSA_SHA2_128S_N], uint64_t idx_tree, 113 uint32_t idx_leaf, const uint8_t sk_seed[BCM_SLHDSA_SHA2_128S_N], 114 const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N]) { 115 uint8_t addr[32] = {0}; 116 slhdsa_set_tree_addr(addr, idx_tree); 117 118 // Layer 0 119 slhdsa_xmss_sign(sig, message, idx_leaf, sk_seed, pk_seed, addr); 120 uint8_t root[BCM_SLHDSA_SHA2_128S_N]; 121 slhdsa_xmss_pk_from_sig(root, sig, idx_leaf, message, pk_seed, addr); 122 sig += SLHDSA_SHA2_128S_XMSS_BYTES; 123 124 // All other layers 125 for (size_t j = 1; j < SLHDSA_SHA2_128S_D; ++j) { 126 idx_leaf = idx_tree % (1 << SLHDSA_SHA2_128S_TREE_HEIGHT); 127 idx_tree = idx_tree >> SLHDSA_SHA2_128S_TREE_HEIGHT; 128 slhdsa_set_layer_addr(addr, j); 129 slhdsa_set_tree_addr(addr, idx_tree); 130 slhdsa_xmss_sign(sig, root, idx_leaf, sk_seed, pk_seed, addr); 131 if (j < (SLHDSA_SHA2_128S_D - 1)) { 132 slhdsa_xmss_pk_from_sig(root, sig, idx_leaf, root, pk_seed, addr); 133 } 134 135 sig += SLHDSA_SHA2_128S_XMSS_BYTES; 136 } 137} 138 139// Implements Algorithm 13: ht_verify function (page 28) 140int slhdsa_ht_verify( 141 const uint8_t sig[SLHDSA_SHA2_128S_D * SLHDSA_SHA2_128S_XMSS_BYTES], 142 const uint8_t message[BCM_SLHDSA_SHA2_128S_N], uint64_t idx_tree, 143 uint32_t idx_leaf, const uint8_t pk_root[BCM_SLHDSA_SHA2_128S_N], 144 const uint8_t pk_seed[BCM_SLHDSA_SHA2_128S_N]) { 145 uint8_t addr[32] = {0}; 146 slhdsa_set_tree_addr(addr, idx_tree); 147 148 uint8_t node[BCM_SLHDSA_SHA2_128S_N]; 149 slhdsa_xmss_pk_from_sig(node, sig, idx_leaf, message, pk_seed, addr); 150 151 for (size_t j = 1; j < SLHDSA_SHA2_128S_D; ++j) { 152 idx_leaf = idx_tree % (1 << SLHDSA_SHA2_128S_TREE_HEIGHT); 153 idx_tree = idx_tree >> SLHDSA_SHA2_128S_TREE_HEIGHT; 154 slhdsa_set_layer_addr(addr, j); 155 slhdsa_set_tree_addr(addr, idx_tree); 156 157 slhdsa_xmss_pk_from_sig(node, sig + j * SLHDSA_SHA2_128S_XMSS_BYTES, 158 idx_leaf, node, pk_seed, addr); 159 } 160 return memcmp(node, pk_root, BCM_SLHDSA_SHA2_128S_N) == 0; 161} 162