From a212b17099ee3e76407e6c42fe9aa729ead8172f Mon Sep 17 00:00:00 2001 From: Zhi Guan Date: Thu, 15 Jan 2026 18:27:20 +0800 Subject: [PATCH] Update LMS/HSS Set SHA-256/SM3 independently. --- include/gmssl/lms.h | 71 ++++++----- src/lms.c | 289 +++++++++++++++++++++++--------------------- tests/lmstest.c | 20 +-- 3 files changed, 202 insertions(+), 178 deletions(-) diff --git a/include/gmssl/lms.h b/include/gmssl/lms.h index 8b08ae9a..f64ca9b7 100644 --- a/include/gmssl/lms.h +++ b/include/gmssl/lms.h @@ -15,7 +15,6 @@ #include #include #include -#include #ifdef ENABLE_SHA2 #include #endif @@ -30,12 +29,24 @@ extern "C" { #define LMS_MAX_HEIGHT 25 +typedef uint8_t lms_hash256_t[32]; + + // Crosscheck with data from LMS-reference (SHA-256), except the LMS signature. +#if defined(ENABLE_LMS_CROSSCHECK) && defined(ENABLE_SHA2) && !defined(LMS_HASH256_CTX) +# define LMS_HASH256_CTX SHA256_CTX +# define lms_hash256_init sha256_init +# define lms_hash256_update sha256_update +# define lms_hash256_finish sha256_finish +#else +# define LMS_HASH256_CTX SM3_CTX +# define lms_hash256_init sm3_init +# define lms_hash256_update sm3_update +# define lms_hash256_finish sm3_finish +#endif + + #if defined(ENABLE_LMS_CROSSCHECK) && defined(ENABLE_SHA2) -# define HASH256_CTX SHA256_CTX -# define hash256_init sha256_init -# define hash256_update sha256_update -# define hash256_finish sha256_finish # define LMOTS_HASH256_N32_W8 LMOTS_SHA256_N32_W8 # define LMOTS_HASH256_N32_W8_NAME "LMOTS_SHA256_N32_W8" # define LMS_HASH256_M32_H5 LMS_SHA256_M32_H5 @@ -49,10 +60,6 @@ extern "C" { # define LMS_HASH256_M32_H20_NAME "LMS_SHA256_M32_H20" # define LMS_HASH256_M32_H25_NAME "LMS_SHA256_M32_H25" #else -# define HASH256_CTX SM3_CTX -# define hash256_init sm3_init -# define hash256_update sm3_update -# define hash256_finish sm3_finish # define LMOTS_HASH256_N32_W8 LMOTS_SM3_N32_W8 # define LMOTS_HASH256_N32_W8_NAME "LMOTS_SM3_N32_W8" # define LMS_HASH256_M32_H5 LMS_SM3_M32_H5 @@ -67,6 +74,7 @@ extern "C" { # define LMS_HASH256_M32_H25_NAME "LMS_SM3_M32_H25" #endif + enum { LMOTS_RESERVED = 0, LMOTS_SHA256_N32_W1 = 1, @@ -98,50 +106,51 @@ enum { char *lmots_type_name(int lmots_type); -void lmots_derive_secrets(const hash256_t seed, const uint8_t I[16], int q, hash256_t x[34]); -void lmots_secrets_to_public_hash(const uint8_t I[16], int q, const hash256_t x[34], hash256_t pub); -void lmots_compute_signature(const uint8_t I[16], int q, const hash256_t dgst, const hash256_t x[34], hash256_t y[34]); -void lmots_signature_to_public_hash(const uint8_t I[16], int q, const hash256_t y[34], const hash256_t dgst, hash256_t pub); +void lmots_derive_secrets(const lms_hash256_t seed, const uint8_t I[16], int q, lms_hash256_t x[34]); +void lmots_secrets_to_public_hash(const uint8_t I[16], int q, const lms_hash256_t x[34], lms_hash256_t pub); +void lmots_compute_signature(const uint8_t I[16], int q, const lms_hash256_t dgst, const lms_hash256_t x[34], lms_hash256_t y[34]); +void lmots_signature_to_public_hash(const uint8_t I[16], int q, const lms_hash256_t y[34], const lms_hash256_t dgst, lms_hash256_t pub); char *lms_type_name(int lms_type); int lms_type_from_name(const char *name); int lms_type_to_height(int type, size_t *height); -void lms_derive_merkle_tree(const hash256_t seed, const uint8_t I[16], int height, hash256_t *tree); -void lms_derive_merkle_root(const hash256_t seed, const uint8_t I[16], int height, hash256_t root); +void lms_derive_merkle_tree(const lms_hash256_t seed, const uint8_t I[16], int height, lms_hash256_t *tree); +void lms_derive_merkle_root(const lms_hash256_t seed, const uint8_t I[16], int height, lms_hash256_t root); typedef struct { int lms_type; int lmots_type; uint8_t I[16]; // lms key identifier - hash256_t root; // merkle tree root + lms_hash256_t root; // merkle tree root } LMS_PUBLIC_KEY; #define LMS_PUBLIC_KEY_SIZE (4 + 4 + 16 + 32) // = 56 bytes typedef struct { LMS_PUBLIC_KEY public_key; - hash256_t *tree; - hash256_t seed; - uint32_t q; // in [0, 2^h - 1], q++ after every sign + lms_hash256_t *tree; + lms_hash256_t seed; + uint32_t q; // in [0, 2^h - 1], q++ after every sign // 应该改为index } LMS_KEY; #define LMS_PRIVATE_KEY_SIZE (LMS_PUBLIC_KEY_SIZE + 32 + 4) // = 92 bytes // FIXME: do we need a function to update lms_key->q ? -int lms_key_generate_ex(LMS_KEY *key, int lms_type, const hash256_t seed, const uint8_t I[16], int cache_tree); +int lms_key_generate_ex(LMS_KEY *key, int lms_type, const lms_hash256_t seed, const uint8_t I[16], int cache_tree); int lms_key_generate(LMS_KEY *key, int lms_type); int lms_key_check(const LMS_KEY *key, const LMS_PUBLIC_KEY *pub); int lms_key_remaining_signs(const LMS_KEY *key, size_t *count); + int lms_public_key_to_bytes(const LMS_KEY *key, uint8_t **out, size_t *outlen); -int lms_public_key_from_bytes_ex(const LMS_PUBLIC_KEY **key, const uint8_t **in, size_t *inlen); +int lms_public_key_from_bytes_ex(const LMS_PUBLIC_KEY **key, const uint8_t **in, size_t *inlen); // 这个函数需要修改 int lms_public_key_from_bytes(LMS_KEY *key, const uint8_t **in, size_t *inlen); int lms_private_key_to_bytes(const LMS_KEY *key, uint8_t **out, size_t *outlen); int lms_private_key_from_bytes(LMS_KEY *key, const uint8_t **in, size_t *inlen); int lms_public_key_print(FILE *fp, int fmt, int ind, const char *label, const LMS_PUBLIC_KEY *pub); -int lms_key_print(FILE *fp, int fmt, int ind, const char *label, const LMS_KEY *key); +int lms_key_print(FILE *fp, int fmt, int ind, const char *label, const LMS_KEY *key); // void lms_key_cleanup(LMS_KEY *key); @@ -150,11 +159,11 @@ typedef struct { int q; // index of LMS tree leaf, in [0, 2^h - 1] struct { int lmots_type; // LMOTS_SM3_N32_W8 or LMOTS_SHA256_N32_W8 in compile time - hash256_t C; // randomness of every LMOTS signature - hash256_t y[34]; // for w = 8 and hash256, 34 winternitz chains + lms_hash256_t C; // randomness of every LMOTS signature + lms_hash256_t y[34]; // for w = 8 and hash256, 34 winternitz chains } lmots_sig; int lms_type; - hash256_t path[25]; // max tree height = 25 when LMS_SM3_M32_H25 + lms_hash256_t path[25]; // max tree height = 25 when LMS_SM3_M32_H25 } LMS_SIGNATURE; // encoded size, SHOULD be changed when supporting text/der encoding @@ -163,8 +172,8 @@ typedef struct { int lms_signature_to_merkle_root(const uint8_t I[16], size_t h, int q, - const hash256_t y[34], const hash256_t *path, - const hash256_t dgst, hash256_t root); + const lms_hash256_t y[34], const lms_hash256_t *path, + const lms_hash256_t dgst, lms_hash256_t root); /* @@ -178,22 +187,22 @@ int lms_signature_size(int lms_type, size_t *siglen); int lms_key_get_signature_size(const LMS_KEY *key, size_t *siglen); int lms_signature_to_bytes(const LMS_SIGNATURE *sig, uint8_t **out, size_t *outlen); -int lms_signature_from_bytes_ex(const LMS_SIGNATURE **sig, size_t *siglen, const uint8_t **in, size_t *inlen); +int lms_signature_from_bytes_ex(const LMS_SIGNATURE **sig, size_t *siglen, const uint8_t **in, size_t *inlen);// 这个接口有点奇怪，siglen? int lms_signature_from_bytes(LMS_SIGNATURE *sig, const uint8_t **in, size_t *inlen); int lms_signature_print_ex(FILE *fp, int fmt, int ind, const char *label, const LMS_SIGNATURE *sig); int lms_signature_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *sig, size_t siglen); typedef struct { - HASH256_CTX hash256_ctx; + LMS_HASH256_CTX lms_hash256_ctx; LMS_PUBLIC_KEY lms_public_key; // FIXME: or use LMS_PUBLIC_KEY to re-use tree? LMS_SIGNATURE lms_sig; } LMS_SIGN_CTX; int lms_sign_init(LMS_SIGN_CTX *ctx, LMS_KEY *key); int lms_sign_update(LMS_SIGN_CTX *ctx, const uint8_t *data, size_t datalen); -int lms_sign_finish(LMS_SIGN_CTX *ctx, uint8_t *sig, size_t *siglen); int lms_sign_finish_ex(LMS_SIGN_CTX *ctx, LMS_SIGNATURE *sig); +int lms_sign_finish(LMS_SIGN_CTX *ctx, uint8_t *sig, size_t *siglen); int lms_verify_init_ex(LMS_SIGN_CTX *ctx, const LMS_KEY *key, const LMS_SIGNATURE *sig); int lms_verify_init(LMS_SIGN_CTX *ctx, const LMS_KEY *key, const uint8_t *sigbuf, size_t siglen); int lms_verify_update(LMS_SIGN_CTX *ctx, const uint8_t *data, size_t datalen); @@ -204,13 +213,11 @@ int lms_verify_finish(LMS_SIGN_CTX *ctx); void lms_sign_ctx_cleanup(LMS_SIGN_CTX *ctx); -/* // just for reference, HSS_PUBLIC_KEY memory layout might not compatible with HSS_KEY typedef struct { uint32_t levels; LMS_PUBLIC_KEY lms_public_key; } HSS_PUBLIC_KEY; -*/ // HSS_PUBLIC_KEY: { level, lms_key[0].public_key } #define HSS_PUBLIC_KEY_SIZE (4 + LMS_PUBLIC_KEY_SIZE) diff --git a/src/lms.c b/src/lms.c index b494e818..fa760a7c 100644 --- a/src/lms.c +++ b/src/lms.c @@ -14,6 +14,8 @@ #include #include + + /* * TODO: * 1. add key_update callback @@ -94,9 +96,9 @@ int lms_type_to_height(int type, size_t *height) return 1; } -void lmots_derive_secrets(const hash256_t seed, const uint8_t I[16], int q, hash256_t x[34]) +void lmots_derive_secrets(const lms_hash256_t seed, const uint8_t I[16], int q, lms_hash256_t x[34]) { - HASH256_CTX ctx; + LMS_HASH256_CTX ctx; uint8_t qbytes[4]; uint8_t ibytes[2]; const uint8_t jbytes[1] = { 0xff }; @@ -108,25 +110,25 @@ void lmots_derive_secrets(const hash256_t seed, const uint8_t I[16], int q, hash for (i = 0; i < 34; i++) { PUTU16(ibytes, i); - hash256_init(&ctx); - hash256_update(&ctx, I, 16); - hash256_update(&ctx, qbytes, 4); - hash256_update(&ctx, ibytes, 2); - hash256_update(&ctx, jbytes, 1); - hash256_update(&ctx, seed, 32); - hash256_finish(&ctx, x[i]); + lms_hash256_init(&ctx); + lms_hash256_update(&ctx, I, 16); + lms_hash256_update(&ctx, qbytes, 4); + lms_hash256_update(&ctx, ibytes, 2); + lms_hash256_update(&ctx, jbytes, 1); + lms_hash256_update(&ctx, seed, 32); + lms_hash256_finish(&ctx, x[i]); } gmssl_secure_clear(&ctx, sizeof(ctx)); } -void lmots_secrets_to_public_hash(const uint8_t I[16], int q, const hash256_t x[34], hash256_t pub) +void lmots_secrets_to_public_hash(const uint8_t I[16], int q, const lms_hash256_t x[34], lms_hash256_t pub) { - HASH256_CTX ctx; + LMS_HASH256_CTX ctx; uint8_t qbytes[4]; uint8_t ibytes[2]; uint8_t jbytes[1]; - hash256_t z[34]; + lms_hash256_t z[34]; int i, j; PUTU32(qbytes, q); @@ -138,28 +140,28 @@ void lmots_secrets_to_public_hash(const uint8_t I[16], int q, const hash256_t x[ for (j = 0; j < 255; j++) { jbytes[0] = (uint8_t)j; - hash256_init(&ctx); - hash256_update(&ctx, I, 16); - hash256_update(&ctx, qbytes, 4); - hash256_update(&ctx, ibytes, 2); - hash256_update(&ctx, jbytes, 1); - hash256_update(&ctx, z[i], 32); - hash256_finish(&ctx, z[i]); + lms_hash256_init(&ctx); + lms_hash256_update(&ctx, I, 16); + lms_hash256_update(&ctx, qbytes, 4); + lms_hash256_update(&ctx, ibytes, 2); + lms_hash256_update(&ctx, jbytes, 1); + lms_hash256_update(&ctx, z[i], 32); + lms_hash256_finish(&ctx, z[i]); } } // K = H(I || u32str(q) || u16str(D_PBLC) || y[0] || ... || y[p-1]) - hash256_init(&ctx); - hash256_update(&ctx, I, 16); - hash256_update(&ctx, qbytes, 4); - hash256_update(&ctx, D_PBLC, 2); + lms_hash256_init(&ctx); + lms_hash256_update(&ctx, I, 16); + lms_hash256_update(&ctx, qbytes, 4); + lms_hash256_update(&ctx, D_PBLC, 2); for (i = 0; i < 34; i++) { - hash256_update(&ctx, z[i], 32); + lms_hash256_update(&ctx, z[i], 32); } - hash256_finish(&ctx, pub); + lms_hash256_finish(&ctx, pub); } -static void winternitz_checksum(const hash256_t dgst, uint8_t checksum[2]) +static void winternitz_checksum(const lms_hash256_t dgst, uint8_t checksum[2]) { uint16_t sum = 0; int i; @@ -172,9 +174,9 @@ static void winternitz_checksum(const hash256_t dgst, uint8_t checksum[2]) } // signed digest Q = H(I || u32str(q) || u16str(D_MESG) || C || message) -void lmots_compute_signature(const uint8_t I[16], int q, const hash256_t dgst, const hash256_t x[34], hash256_t y[34]) +void lmots_compute_signature(const uint8_t I[16], int q, const lms_hash256_t dgst, const lms_hash256_t x[34], lms_hash256_t y[34]) { - HASH256_CTX ctx; + LMS_HASH256_CTX ctx; uint8_t checksum[2]; uint8_t qbytes[4]; uint8_t ibytes[2]; @@ -194,22 +196,22 @@ void lmots_compute_signature(const uint8_t I[16], int q, const hash256_t dgst, c for (j = 0; j < a; j++) { jbytes[0] = j; - hash256_init(&ctx); - hash256_update(&ctx, I, 16); - hash256_update(&ctx, qbytes, 4); - hash256_update(&ctx, ibytes, 2); - hash256_update(&ctx, jbytes, 1); - hash256_update(&ctx, y[i], 32); - hash256_finish(&ctx, y[i]); + lms_hash256_init(&ctx); + lms_hash256_update(&ctx, I, 16); + lms_hash256_update(&ctx, qbytes, 4); + lms_hash256_update(&ctx, ibytes, 2); + lms_hash256_update(&ctx, jbytes, 1); + lms_hash256_update(&ctx, y[i], 32); + lms_hash256_finish(&ctx, y[i]); } } } -void lmots_signature_to_public_hash(const uint8_t I[16], int q, const hash256_t y[34], const hash256_t dgst, hash256_t pub) +void lmots_signature_to_public_hash(const uint8_t I[16], int q, const lms_hash256_t y[34], const lms_hash256_t dgst, lms_hash256_t pub) { uint8_t checksum[2]; - HASH256_CTX ctx; - hash256_t z[34]; + LMS_HASH256_CTX ctx; + lms_hash256_t z[34]; uint8_t qbytes[4]; uint8_t ibytes[2]; uint8_t jbytes[1]; @@ -228,36 +230,36 @@ void lmots_signature_to_public_hash(const uint8_t I[16], int q, const hash256_t for (j = a; j < 255; j++) { jbytes[0] = (uint8_t)j; - hash256_init(&ctx); - hash256_update(&ctx, I, 16); - hash256_update(&ctx, qbytes, 4); - hash256_update(&ctx, ibytes, 2); - hash256_update(&ctx, jbytes, 1); - hash256_update(&ctx, z[i], 32); - hash256_finish(&ctx, z[i]); + lms_hash256_init(&ctx); + lms_hash256_update(&ctx, I, 16); + lms_hash256_update(&ctx, qbytes, 4); + lms_hash256_update(&ctx, ibytes, 2); + lms_hash256_update(&ctx, jbytes, 1); + lms_hash256_update(&ctx, z[i], 32); + lms_hash256_finish(&ctx, z[i]); } } // Kc = H(I || u32str(q) || u16str(D_PBLC) || z[0] || z[1] || ... || z[p-1]) - hash256_init(&ctx); - hash256_update(&ctx, I, 16); - hash256_update(&ctx, qbytes, 4); - hash256_update(&ctx, D_PBLC, 2); + lms_hash256_init(&ctx); + lms_hash256_update(&ctx, I, 16); + lms_hash256_update(&ctx, qbytes, 4); + lms_hash256_update(&ctx, D_PBLC, 2); for (i = 0; i < 34; i++) { - hash256_update(&ctx, z[i], 32); + lms_hash256_update(&ctx, z[i], 32); } - hash256_finish(&ctx, pub); + lms_hash256_finish(&ctx, pub); } // derive full merkle tree[2^h * 2 - 1] from seed, tree[0] is the root -void lms_derive_merkle_tree(const hash256_t seed, const uint8_t I[16], int h, hash256_t *tree) +void lms_derive_merkle_tree(const lms_hash256_t seed, const uint8_t I[16], int h, lms_hash256_t *tree) { int r, n = (1 << h); uint8_t rbytes[4]; - HASH256_CTX ctx; - hash256_t x[34]; - hash256_t pub; - hash256_t *T = tree - 1; + LMS_HASH256_CTX ctx; + lms_hash256_t x[34]; + lms_hash256_t pub; + lms_hash256_t *T = tree - 1; for (r = 2*n - 1; r >= 1; r--) { @@ -269,34 +271,34 @@ void lms_derive_merkle_tree(const hash256_t seed, const uint8_t I[16], int h, ha lmots_secrets_to_public_hash(I, q, x, pub); // H(I||u32str(r)||u16str(D_LEAF)||OTS_PUB_HASH[r-2^h]) - hash256_init(&ctx); - hash256_update(&ctx, I, 16); - hash256_update(&ctx, rbytes, 4); - hash256_update(&ctx, D_LEAF, 2); - hash256_update(&ctx, pub, 32); - hash256_finish(&ctx, T[r]); + lms_hash256_init(&ctx); + lms_hash256_update(&ctx, I, 16); + lms_hash256_update(&ctx, rbytes, 4); + lms_hash256_update(&ctx, D_LEAF, 2); + lms_hash256_update(&ctx, pub, 32); + lms_hash256_finish(&ctx, T[r]); } else { // H(I||u32str(r)||u16str(D_INTR)||T[2*r]||T[2*r+1]) - hash256_init(&ctx); - hash256_update(&ctx, I, 16); - hash256_update(&ctx, rbytes, 4); - hash256_update(&ctx, D_INTR, 2); - hash256_update(&ctx, T[2*r], 32); - hash256_update(&ctx, T[2*r + 1], 32); - hash256_finish(&ctx, T[r]); + lms_hash256_init(&ctx); + lms_hash256_update(&ctx, I, 16); + lms_hash256_update(&ctx, rbytes, 4); + lms_hash256_update(&ctx, D_INTR, 2); + lms_hash256_update(&ctx, T[2*r], 32); + lms_hash256_update(&ctx, T[2*r + 1], 32); + lms_hash256_finish(&ctx, T[r]); } } } -void lms_derive_merkle_root(const hash256_t seed, const uint8_t I[16], int h, hash256_t root) +void lms_derive_merkle_root(const lms_hash256_t seed, const uint8_t I[16], int h, lms_hash256_t root) { int q, r, n = 1 << h; int qbits; - HASH256_CTX ctx; - hash256_t stack[25]; + LMS_HASH256_CTX ctx; + lms_hash256_t stack[25]; int num = 0; - hash256_t x[34]; + lms_hash256_t x[34]; uint8_t rbytes[4]; for (q = 0; q < n; q++) { @@ -308,12 +310,12 @@ void lms_derive_merkle_root(const hash256_t seed, const uint8_t I[16], int h, ha PUTU32(rbytes, r); // H(I||u32str(r)||u16str(D_LEAF)||OTS_PUB_HASH[r-2^h]) - hash256_init(&ctx); - hash256_update(&ctx, I, 16); - hash256_update(&ctx, rbytes, 4); - hash256_update(&ctx, D_LEAF, 2); - hash256_update(&ctx, stack[num], 32); - hash256_finish(&ctx, stack[num]); + lms_hash256_init(&ctx); + lms_hash256_update(&ctx, I, 16); + lms_hash256_update(&ctx, rbytes, 4); + lms_hash256_update(&ctx, D_LEAF, 2); + lms_hash256_update(&ctx, stack[num], 32); + lms_hash256_finish(&ctx, stack[num]); num++; qbits = q; @@ -323,13 +325,13 @@ void lms_derive_merkle_root(const hash256_t seed, const uint8_t I[16], int h, ha r = r/2; PUTU32(rbytes, r); - hash256_init(&ctx); - hash256_update(&ctx, I, 16); - hash256_update(&ctx, rbytes, 4); - hash256_update(&ctx, D_INTR, 2); - hash256_update(&ctx, stack[num - 2], 32); - hash256_update(&ctx, stack[num - 1], 32); - hash256_finish(&ctx, stack[num - 2]); + lms_hash256_init(&ctx); + lms_hash256_update(&ctx, I, 16); + lms_hash256_update(&ctx, rbytes, 4); + lms_hash256_update(&ctx, D_INTR, 2); + lms_hash256_update(&ctx, stack[num - 2], 32); + lms_hash256_update(&ctx, stack[num - 1], 32); + lms_hash256_finish(&ctx, stack[num - 2]); num--; qbits >>= 1; @@ -481,7 +483,7 @@ int lms_private_key_from_bytes(LMS_KEY *key, const uint8_t **in, size_t *inlen) if (cache_tree) { size_t n = 1 << height; - if (!(key->tree = (hash256_t *)malloc(sizeof(hash256_t) * (2*n - 1)))) { + if (!(key->tree = (lms_hash256_t *)malloc(sizeof(lms_hash256_t) * (2*n - 1)))) { error_print(); return -1; } @@ -533,7 +535,7 @@ void lms_key_cleanup(LMS_KEY *key) } } -int lms_key_generate_ex(LMS_KEY *key, int lms_type, const hash256_t seed, const uint8_t I[16], int cache_tree) +int lms_key_generate_ex(LMS_KEY *key, int lms_type, const lms_hash256_t seed, const uint8_t I[16], int cache_tree) { size_t h, n; @@ -555,7 +557,7 @@ int lms_key_generate_ex(LMS_KEY *key, int lms_type, const hash256_t seed, const memcpy(key->seed, seed, 32); if (cache_tree) { - if (!(key->tree = (hash256_t *)malloc(sizeof(hash256_t) * (2*n - 1)))) { + if (!(key->tree = (lms_hash256_t *)malloc(sizeof(lms_hash256_t) * (2*n - 1)))) { error_print(); return -1; } @@ -572,7 +574,7 @@ int lms_key_generate_ex(LMS_KEY *key, int lms_type, const hash256_t seed, const int lms_key_generate(LMS_KEY *key, int lms_type) { - hash256_t seed; + lms_hash256_t seed; uint8_t I[16]; int cache_tree = 1; @@ -605,10 +607,10 @@ int lms_signature_size(int lms_type, size_t *len) } *len = sizeof(uint32_t) // q + sizeof(uint32_t) // lmots_type - + sizeof(hash256_t) // C - + sizeof(hash256_t) * 34 // y[34] + + sizeof(lms_hash256_t) // C + + sizeof(lms_hash256_t) * 34 // y[34] + sizeof(uint32_t) // lms_type - + sizeof(hash256_t) * height; // path[hegith] + + sizeof(lms_hash256_t) * height; // path[hegith] return 1; } @@ -818,12 +820,12 @@ int lms_signature_from_bytes(LMS_SIGNATURE *sig, const uint8_t **in, size_t *inl } int lms_signature_to_merkle_root(const uint8_t I[16], size_t h, int q, - const hash256_t y[34], const hash256_t *path, - const hash256_t dgst, hash256_t root) + const lms_hash256_t y[34], const lms_hash256_t *path, + const lms_hash256_t dgst, lms_hash256_t root) { size_t n, r; uint8_t rbytes[4]; - HASH256_CTX ctx; + LMS_HASH256_CTX ctx; size_t i; n = 1 << h; @@ -837,28 +839,28 @@ int lms_signature_to_merkle_root(const uint8_t I[16], size_t h, int q, lmots_signature_to_public_hash(I, q, y, dgst, root); // leaf[q] = H(I||u32str(r)||u16str(D_LEAF)||OTS_PUB_HASH[r-2^h]) - hash256_init(&ctx); - hash256_update(&ctx, I, 16); - hash256_update(&ctx, rbytes, 4); - hash256_update(&ctx, D_LEAF, 2); - hash256_update(&ctx, root, 32); - hash256_finish(&ctx, root); + lms_hash256_init(&ctx); + lms_hash256_update(&ctx, I, 16); + lms_hash256_update(&ctx, rbytes, 4); + lms_hash256_update(&ctx, D_LEAF, 2); + lms_hash256_update(&ctx, root, 32); + lms_hash256_finish(&ctx, root); for (i = 0; i < h; i++) { PUTU32(rbytes, r/2); - hash256_init(&ctx); - hash256_update(&ctx, I, 16); - hash256_update(&ctx, rbytes, 4); - hash256_update(&ctx, D_INTR, 2); + lms_hash256_init(&ctx); + lms_hash256_update(&ctx, I, 16); + lms_hash256_update(&ctx, rbytes, 4); + lms_hash256_update(&ctx, D_INTR, 2); if (r & 0x01) { - hash256_update(&ctx, path[i], 32); - hash256_update(&ctx, root, 32); + lms_hash256_update(&ctx, path[i], 32); + lms_hash256_update(&ctx, root, 32); } else { - hash256_update(&ctx, root, 32); - hash256_update(&ctx, path[i], 32); + lms_hash256_update(&ctx, root, 32); + lms_hash256_update(&ctx, path[i], 32); } - hash256_finish(&ctx, root); + lms_hash256_finish(&ctx, root); r = r/2; } @@ -868,7 +870,7 @@ int lms_signature_to_merkle_root(const uint8_t I[16], size_t h, int q, void lms_sign_ctx_cleanup(LMS_SIGN_CTX *ctx) { if (ctx) { - gmssl_secure_clear(ctx->lms_sig.lmots_sig.y, sizeof(hash256_t)*34); + gmssl_secure_clear(ctx->lms_sig.lmots_sig.y, sizeof(lms_hash256_t)*34); } } @@ -876,7 +878,7 @@ int lms_sign_init(LMS_SIGN_CTX *ctx, LMS_KEY *key) { LMS_SIGNATURE *lms_sig; uint8_t qbytes[4]; - const hash256_t *T; + const lms_hash256_t *T; size_t height, r, i; if (!ctx || !key) { @@ -929,11 +931,11 @@ int lms_sign_init(LMS_SIGN_CTX *ctx, LMS_KEY *key) r /= 2; } - hash256_init(&ctx->hash256_ctx); - hash256_update(&ctx->hash256_ctx, key->public_key.I, 16); - hash256_update(&ctx->hash256_ctx, qbytes, 4); - hash256_update(&ctx->hash256_ctx, D_MESG, 2); - hash256_update(&ctx->hash256_ctx, lms_sig->lmots_sig.C, 32); + lms_hash256_init(&ctx->lms_hash256_ctx); + lms_hash256_update(&ctx->lms_hash256_ctx, key->public_key.I, 16); + lms_hash256_update(&ctx->lms_hash256_ctx, qbytes, 4); + lms_hash256_update(&ctx->lms_hash256_ctx, D_MESG, 2); + lms_hash256_update(&ctx->lms_hash256_ctx, lms_sig->lmots_sig.C, 32); return 1; } @@ -945,7 +947,7 @@ int lms_sign_update(LMS_SIGN_CTX *ctx, const uint8_t *data, size_t datalen) return -1; } if (data && datalen > 0) { - hash256_update(&ctx->hash256_ctx, data, datalen); + lms_hash256_update(&ctx->lms_hash256_ctx, data, datalen); } return 1; } @@ -960,7 +962,7 @@ int lms_sign_finish_ex(LMS_SIGN_CTX *ctx, LMS_SIGNATURE *sig) return -1; } - hash256_finish(&ctx->hash256_ctx, dgst); + lms_hash256_finish(&ctx->lms_hash256_ctx, dgst); lms_sig = &ctx->lms_sig; lmots_compute_signature(ctx->lms_public_key.I, lms_sig->q, dgst, lms_sig->lmots_sig.y, lms_sig->lmots_sig.y); @@ -979,7 +981,7 @@ int lms_sign_finish(LMS_SIGN_CTX *ctx, uint8_t *sig, size_t *siglen) return -1; } - hash256_finish(&ctx->hash256_ctx, dgst); + lms_hash256_finish(&ctx->lms_hash256_ctx, dgst); lms_sig = &ctx->lms_sig; lmots_compute_signature(ctx->lms_public_key.I, lms_sig->q, dgst, lms_sig->lmots_sig.y, lms_sig->lmots_sig.y); @@ -1020,11 +1022,11 @@ int lms_verify_init_ex(LMS_SIGN_CTX *ctx, const LMS_KEY *key, const LMS_SIGNATUR PUTU32(qbytes, lms_sig->q); - hash256_init(&ctx->hash256_ctx); - hash256_update(&ctx->hash256_ctx, key->public_key.I, 16); - hash256_update(&ctx->hash256_ctx, qbytes, 4); - hash256_update(&ctx->hash256_ctx, D_MESG, 2); - hash256_update(&ctx->hash256_ctx, lms_sig->lmots_sig.C, 32); + lms_hash256_init(&ctx->lms_hash256_ctx); + lms_hash256_update(&ctx->lms_hash256_ctx, key->public_key.I, 16); + lms_hash256_update(&ctx->lms_hash256_ctx, qbytes, 4); + lms_hash256_update(&ctx->lms_hash256_ctx, D_MESG, 2); + lms_hash256_update(&ctx->lms_hash256_ctx, lms_sig->lmots_sig.C, 32); return 1; } @@ -1064,11 +1066,11 @@ int lms_verify_init(LMS_SIGN_CTX *ctx, const LMS_KEY *key, const uint8_t *sig, s PUTU32(qbytes, lms_sig->q); - hash256_init(&ctx->hash256_ctx); - hash256_update(&ctx->hash256_ctx, key->public_key.I, 16); - hash256_update(&ctx->hash256_ctx, qbytes, 4); - hash256_update(&ctx->hash256_ctx, D_MESG, 2); - hash256_update(&ctx->hash256_ctx, lms_sig->lmots_sig.C, 32); + lms_hash256_init(&ctx->lms_hash256_ctx); + lms_hash256_update(&ctx->lms_hash256_ctx, key->public_key.I, 16); + lms_hash256_update(&ctx->lms_hash256_ctx, qbytes, 4); + lms_hash256_update(&ctx->lms_hash256_ctx, D_MESG, 2); + lms_hash256_update(&ctx->lms_hash256_ctx, lms_sig->lmots_sig.C, 32); return 1; } @@ -1080,7 +1082,7 @@ int lms_verify_update(LMS_SIGN_CTX *ctx, const uint8_t *data, size_t datalen) return -1; } if (data && datalen > 0) { - hash256_update(&ctx->hash256_ctx, data, datalen); + lms_hash256_update(&ctx->lms_hash256_ctx, data, datalen); } return 1; } @@ -1088,9 +1090,9 @@ int lms_verify_update(LMS_SIGN_CTX *ctx, const uint8_t *data, size_t datalen) int lms_verify_finish(LMS_SIGN_CTX *ctx) { LMS_SIGNATURE *lms_sig; - hash256_t dgst; + lms_hash256_t dgst; size_t height; - hash256_t root; + lms_hash256_t root; if (!ctx) { error_print(); @@ -1103,7 +1105,7 @@ int lms_verify_finish(LMS_SIGN_CTX *ctx) return -1; } - hash256_finish(&ctx->hash256_ctx, dgst); + lms_hash256_finish(&ctx->lms_hash256_ctx, dgst); if (lms_signature_to_merkle_root(ctx->lms_public_key.I, height, lms_sig->q, lms_sig->lmots_sig.y, lms_sig->path, dgst, root) != 1) { @@ -1330,7 +1332,7 @@ void hss_key_cleanup(HSS_KEY *key) int hss_key_generate(HSS_KEY *key, const int *lms_types, size_t levels) { int ret = -1; - hash256_t seed; + lms_hash256_t seed; uint8_t I[16]; LMS_SIGN_CTX ctx; uint8_t buf[LMS_SIGNATURE_MAX_SIZE]; // LMS_SIGNATURE_MAX_SIZE > SM3_PUBLIC_KEY_SIZE @@ -1955,6 +1957,21 @@ int hss_private_key_size(const int *lms_types, size_t levels, size_t *len) } // X.509 related + +/* + SubjectPublicKeyInfo ::= SEQUENCE { + algorithm AlgorithmIdentifier, + subjectPublicKey BIT STRING + } + + in RFC 8708 (HSS/LMS in CMS) + only HSS has OID id-alg-hss-lms-hashsig (1.2.840.113549.1.9.16.3.17) + so only HSS public key is supported in x509_ functions + + hss_public_key_to_bytes encode HSS_PUBLIC_KEY to SubjectPublicKeyInfo.subjectPublicKey + the public_key raw data (not OCTET STRING TLV) is encoded into a BIT STRING TLV + same as EC_POINT +*/ int hss_public_key_to_der(const HSS_KEY *key, uint8_t **out, size_t *outlen) { uint8_t octets[HSS_PUBLIC_KEY_SIZE]; diff --git a/tests/lmstest.c b/tests/lmstest.c index 0f8c70e9..7004bdef 100644 --- a/tests/lmstest.c +++ b/tests/lmstest.c @@ -233,14 +233,14 @@ static int test_rfc8554_test1(void) static int test_sm3_lmots(void) { - hash256_t seed = {0}; // TODO: change to test vector + lms_hash256_t seed = {0}; // TODO: change to test vector uint8_t I[16] = {0}; int q = 0; - hash256_t dgst = {0}; - hash256_t x[34]; - hash256_t y[34]; - hash256_t pub; - hash256_t pub2; + lms_hash256_t dgst = {0}; + lms_hash256_t x[34]; + lms_hash256_t y[34]; + lms_hash256_t pub; + lms_hash256_t pub2; lmots_derive_secrets(seed, I, q, x); // TODO: compare results with test vector lmots_secrets_to_public_hash(I, q, x, pub); // TODO: compare results with test vector @@ -259,14 +259,14 @@ static int test_sm3_lmots(void) static int test_lms_derive_merkle_root(void) { - hash256_t seed = {0}; // TODO: change to test vector + lms_hash256_t seed = {0}; // TODO: change to test vector uint8_t I[16] = {0}; int h = 5; int n = 1<