abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-05-07 00:46:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

Update LMS/HSS

Browse Source 
Set SHA-256/SM3 independently.
This commit is contained in:
Zhi Guan
2026-01-15 18:27:20 +08:00
parent 02d3d0224e
commit a212b17099
3 changed files with 202 additions and 178 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
include/gmssl/lms.h
View File

@@ -15,7 +15,6 @@
#include <string.h> #include <string.h>
#include <stdint.h> #include <stdint.h>
#include <gmssl/sm3.h> #include <gmssl/sm3.h>
#include <gmssl/hash256.h>
#ifdef ENABLE_SHA2 #ifdef ENABLE_SHA2
#include <gmssl/sha2.h> #include <gmssl/sha2.h>
#endif #endif
@@ -30,12 +29,24 @@ extern "C" {
#define LMS_MAX_HEIGHT 25 #define LMS_MAX_HEIGHT 25
typedef uint8_t lms_hash256_t[32];
// Crosscheck with data from LMS-reference (SHA-256), except the LMS signature. // Crosscheck with data from LMS-reference (SHA-256), except the LMS signature.
#if defined(ENABLE_LMS_CROSSCHECK) && defined(ENABLE_SHA2) && !defined(LMS_HASH256_CTX)
# define LMS_HASH256_CTX SHA256_CTX
# define lms_hash256_init sha256_init
# define lms_hash256_update sha256_update
# define lms_hash256_finish sha256_finish
#else
# define LMS_HASH256_CTX SM3_CTX
# define lms_hash256_init sm3_init
# define lms_hash256_update sm3_update
# define lms_hash256_finish sm3_finish
#endif
#if defined(ENABLE_LMS_CROSSCHECK) && defined(ENABLE_SHA2) #if defined(ENABLE_LMS_CROSSCHECK) && defined(ENABLE_SHA2)
# define HASH256_CTX SHA256_CTX
# define hash256_init sha256_init
# define hash256_update sha256_update
# define hash256_finish sha256_finish
# define LMOTS_HASH256_N32_W8 LMOTS_SHA256_N32_W8 # define LMOTS_HASH256_N32_W8 LMOTS_SHA256_N32_W8
# define LMOTS_HASH256_N32_W8_NAME "LMOTS_SHA256_N32_W8" # define LMOTS_HASH256_N32_W8_NAME "LMOTS_SHA256_N32_W8"
# define LMS_HASH256_M32_H5 LMS_SHA256_M32_H5 # define LMS_HASH256_M32_H5 LMS_SHA256_M32_H5
@@ -49,10 +60,6 @@ extern "C" {
# define LMS_HASH256_M32_H20_NAME "LMS_SHA256_M32_H20" # define LMS_HASH256_M32_H20_NAME "LMS_SHA256_M32_H20"
# define LMS_HASH256_M32_H25_NAME "LMS_SHA256_M32_H25" # define LMS_HASH256_M32_H25_NAME "LMS_SHA256_M32_H25"
#else #else
# define HASH256_CTX SM3_CTX
# define hash256_init sm3_init
# define hash256_update sm3_update
# define hash256_finish sm3_finish
# define LMOTS_HASH256_N32_W8 LMOTS_SM3_N32_W8 # define LMOTS_HASH256_N32_W8 LMOTS_SM3_N32_W8
# define LMOTS_HASH256_N32_W8_NAME "LMOTS_SM3_N32_W8" # define LMOTS_HASH256_N32_W8_NAME "LMOTS_SM3_N32_W8"
# define LMS_HASH256_M32_H5 LMS_SM3_M32_H5 # define LMS_HASH256_M32_H5 LMS_SM3_M32_H5
@@ -67,6 +74,7 @@ extern "C" {
# define LMS_HASH256_M32_H25_NAME "LMS_SM3_M32_H25" # define LMS_HASH256_M32_H25_NAME "LMS_SM3_M32_H25"
#endif #endif
enum { enum {
LMOTS_RESERVED = 0, LMOTS_RESERVED = 0,
LMOTS_SHA256_N32_W1 = 1, LMOTS_SHA256_N32_W1 = 1,
@@ -98,50 +106,51 @@ enum {
char *lmots_type_name(int lmots_type); char *lmots_type_name(int lmots_type);
void lmots_derive_secrets(const hash256_t seed, const uint8_t I[16], int q, hash256_t x[34]); void lmots_derive_secrets(const lms_hash256_t seed, const uint8_t I[16], int q, lms_hash256_t x[34]);
void lmots_secrets_to_public_hash(const uint8_t I[16], int q, const hash256_t x[34], hash256_t pub); void lmots_secrets_to_public_hash(const uint8_t I[16], int q, const lms_hash256_t x[34], lms_hash256_t pub);
void lmots_compute_signature(const uint8_t I[16], int q, const hash256_t dgst, const hash256_t x[34], hash256_t y[34]); void lmots_compute_signature(const uint8_t I[16], int q, const lms_hash256_t dgst, const lms_hash256_t x[34], lms_hash256_t y[34]);
void lmots_signature_to_public_hash(const uint8_t I[16], int q, const hash256_t y[34], const hash256_t dgst, hash256_t pub); void lmots_signature_to_public_hash(const uint8_t I[16], int q, const lms_hash256_t y[34], const lms_hash256_t dgst, lms_hash256_t pub);
char *lms_type_name(int lms_type); char *lms_type_name(int lms_type);
int lms_type_from_name(const char *name); int lms_type_from_name(const char *name);
int lms_type_to_height(int type, size_t *height); int lms_type_to_height(int type, size_t *height);
void lms_derive_merkle_tree(const hash256_t seed, const uint8_t I[16], int height, hash256_t *tree); void lms_derive_merkle_tree(const lms_hash256_t seed, const uint8_t I[16], int height, lms_hash256_t *tree);
void lms_derive_merkle_root(const hash256_t seed, const uint8_t I[16], int height, hash256_t root); void lms_derive_merkle_root(const lms_hash256_t seed, const uint8_t I[16], int height, lms_hash256_t root);
typedef struct { typedef struct {
int lms_type; int lms_type;
int lmots_type; int lmots_type;
uint8_t I[16]; // lms key identifier uint8_t I[16]; // lms key identifier
hash256_t root; // merkle tree root lms_hash256_t root; // merkle tree root
} LMS_PUBLIC_KEY; } LMS_PUBLIC_KEY;
#define LMS_PUBLIC_KEY_SIZE (4 + 4 + 16 + 32) // = 56 bytes #define LMS_PUBLIC_KEY_SIZE (4 + 4 + 16 + 32) // = 56 bytes
typedef struct { typedef struct {
LMS_PUBLIC_KEY public_key; LMS_PUBLIC_KEY public_key;
hash256_t *tree; lms_hash256_t *tree;
hash256_t seed; lms_hash256_t seed;
uint32_t q; // in [0, 2^h - 1], q++ after every sign uint32_t q; // in [0, 2^h - 1], q++ after every sign // 应该改为index
} LMS_KEY; } LMS_KEY;
#define LMS_PRIVATE_KEY_SIZE (LMS_PUBLIC_KEY_SIZE + 32 + 4) // = 92 bytes #define LMS_PRIVATE_KEY_SIZE (LMS_PUBLIC_KEY_SIZE + 32 + 4) // = 92 bytes
// FIXME: do we need a function to update lms_key->q ? // FIXME: do we need a function to update lms_key->q ?
int lms_key_generate_ex(LMS_KEY *key, int lms_type, const hash256_t seed, const uint8_t I[16], int cache_tree); int lms_key_generate_ex(LMS_KEY *key, int lms_type, const lms_hash256_t seed, const uint8_t I[16], int cache_tree);
int lms_key_generate(LMS_KEY *key, int lms_type); int lms_key_generate(LMS_KEY *key, int lms_type);
int lms_key_check(const LMS_KEY *key, const LMS_PUBLIC_KEY *pub); int lms_key_check(const LMS_KEY *key, const LMS_PUBLIC_KEY *pub);
int lms_key_remaining_signs(const LMS_KEY *key, size_t *count); int lms_key_remaining_signs(const LMS_KEY *key, size_t *count);
int lms_public_key_to_bytes(const LMS_KEY *key, uint8_t **out, size_t *outlen); int lms_public_key_to_bytes(const LMS_KEY *key, uint8_t **out, size_t *outlen);
int lms_public_key_from_bytes_ex(const LMS_PUBLIC_KEY **key, const uint8_t **in, size_t *inlen); int lms_public_key_from_bytes_ex(const LMS_PUBLIC_KEY **key, const uint8_t **in, size_t *inlen); // 这个函数需要修改
int lms_public_key_from_bytes(LMS_KEY *key, const uint8_t **in, size_t *inlen); int lms_public_key_from_bytes(LMS_KEY *key, const uint8_t **in, size_t *inlen);
int lms_private_key_to_bytes(const LMS_KEY *key, uint8_t **out, size_t *outlen); int lms_private_key_to_bytes(const LMS_KEY *key, uint8_t **out, size_t *outlen);
int lms_private_key_from_bytes(LMS_KEY *key, const uint8_t **in, size_t *inlen); int lms_private_key_from_bytes(LMS_KEY *key, const uint8_t **in, size_t *inlen);
int lms_public_key_print(FILE *fp, int fmt, int ind, const char *label, const LMS_PUBLIC_KEY *pub); int lms_public_key_print(FILE *fp, int fmt, int ind, const char *label, const LMS_PUBLIC_KEY *pub);
int lms_key_print(FILE *fp, int fmt, int ind, const char *label, const LMS_KEY *key); int lms_key_print(FILE *fp, int fmt, int ind, const char *label, const LMS_KEY *key); //
void lms_key_cleanup(LMS_KEY *key); void lms_key_cleanup(LMS_KEY *key);
@@ -150,11 +159,11 @@ typedef struct {
int q; // index of LMS tree leaf, in [0, 2^h - 1] int q; // index of LMS tree leaf, in [0, 2^h - 1]
struct { struct {
int lmots_type; // LMOTS_SM3_N32_W8 or LMOTS_SHA256_N32_W8 in compile time int lmots_type; // LMOTS_SM3_N32_W8 or LMOTS_SHA256_N32_W8 in compile time
hash256_t C; // randomness of every LMOTS signature lms_hash256_t C; // randomness of every LMOTS signature
hash256_t y[34]; // for w = 8 and hash256, 34 winternitz chains lms_hash256_t y[34]; // for w = 8 and hash256, 34 winternitz chains
} lmots_sig; } lmots_sig;
int lms_type; int lms_type;
hash256_t path[25]; // max tree height = 25 when LMS_SM3_M32_H25 lms_hash256_t path[25]; // max tree height = 25 when LMS_SM3_M32_H25
} LMS_SIGNATURE; } LMS_SIGNATURE;
// encoded size, SHOULD be changed when supporting text/der encoding // encoded size, SHOULD be changed when supporting text/der encoding
@@ -163,8 +172,8 @@ typedef struct {
int lms_signature_to_merkle_root(const uint8_t I[16], size_t h, int q, int lms_signature_to_merkle_root(const uint8_t I[16], size_t h, int q,
const hash256_t y[34], const hash256_t *path, const lms_hash256_t y[34], const lms_hash256_t *path,
const hash256_t dgst, hash256_t root); const lms_hash256_t dgst, lms_hash256_t root);
/* /*
@@ -178,22 +187,22 @@ int lms_signature_size(int lms_type, size_t *siglen);
int lms_key_get_signature_size(const LMS_KEY *key, size_t *siglen); int lms_key_get_signature_size(const LMS_KEY *key, size_t *siglen);
int lms_signature_to_bytes(const LMS_SIGNATURE *sig, uint8_t **out, size_t *outlen); int lms_signature_to_bytes(const LMS_SIGNATURE *sig, uint8_t **out, size_t *outlen);
int lms_signature_from_bytes_ex(const LMS_SIGNATURE **sig, size_t *siglen, const uint8_t **in, size_t *inlen); int lms_signature_from_bytes_ex(const LMS_SIGNATURE **sig, size_t *siglen, const uint8_t **in, size_t *inlen);// 这个接口有点奇怪，siglen?
int lms_signature_from_bytes(LMS_SIGNATURE *sig, const uint8_t **in, size_t *inlen); int lms_signature_from_bytes(LMS_SIGNATURE *sig, const uint8_t **in, size_t *inlen);
int lms_signature_print_ex(FILE *fp, int fmt, int ind, const char *label, const LMS_SIGNATURE *sig); int lms_signature_print_ex(FILE *fp, int fmt, int ind, const char *label, const LMS_SIGNATURE *sig);
int lms_signature_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *sig, size_t siglen); int lms_signature_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *sig, size_t siglen);
typedef struct { typedef struct {
HASH256_CTX hash256_ctx; LMS_HASH256_CTX lms_hash256_ctx;
LMS_PUBLIC_KEY lms_public_key; // FIXME: or use LMS_PUBLIC_KEY to re-use tree? LMS_PUBLIC_KEY lms_public_key; // FIXME: or use LMS_PUBLIC_KEY to re-use tree?
LMS_SIGNATURE lms_sig; LMS_SIGNATURE lms_sig;
} LMS_SIGN_CTX; } LMS_SIGN_CTX;
int lms_sign_init(LMS_SIGN_CTX *ctx, LMS_KEY *key); int lms_sign_init(LMS_SIGN_CTX *ctx, LMS_KEY *key);
int lms_sign_update(LMS_SIGN_CTX *ctx, const uint8_t *data, size_t datalen); int lms_sign_update(LMS_SIGN_CTX *ctx, const uint8_t *data, size_t datalen);
int lms_sign_finish(LMS_SIGN_CTX *ctx, uint8_t *sig, size_t *siglen);
int lms_sign_finish_ex(LMS_SIGN_CTX *ctx, LMS_SIGNATURE *sig); int lms_sign_finish_ex(LMS_SIGN_CTX *ctx, LMS_SIGNATURE *sig);
int lms_sign_finish(LMS_SIGN_CTX *ctx, uint8_t *sig, size_t *siglen);
int lms_verify_init_ex(LMS_SIGN_CTX *ctx, const LMS_KEY *key, const LMS_SIGNATURE *sig); int lms_verify_init_ex(LMS_SIGN_CTX *ctx, const LMS_KEY *key, const LMS_SIGNATURE *sig);
int lms_verify_init(LMS_SIGN_CTX *ctx, const LMS_KEY *key, const uint8_t *sigbuf, size_t siglen); int lms_verify_init(LMS_SIGN_CTX *ctx, const LMS_KEY *key, const uint8_t *sigbuf, size_t siglen);
int lms_verify_update(LMS_SIGN_CTX *ctx, const uint8_t *data, size_t datalen); int lms_verify_update(LMS_SIGN_CTX *ctx, const uint8_t *data, size_t datalen);
@@ -204,13 +213,11 @@ int lms_verify_finish(LMS_SIGN_CTX *ctx);
void lms_sign_ctx_cleanup(LMS_SIGN_CTX *ctx); void lms_sign_ctx_cleanup(LMS_SIGN_CTX *ctx);
/*
// just for reference, HSS_PUBLIC_KEY memory layout might not compatible with HSS_KEY // just for reference, HSS_PUBLIC_KEY memory layout might not compatible with HSS_KEY
typedef struct { typedef struct {
uint32_t levels; uint32_t levels;
LMS_PUBLIC_KEY lms_public_key; LMS_PUBLIC_KEY lms_public_key;
} HSS_PUBLIC_KEY; } HSS_PUBLIC_KEY;
*/
// HSS_PUBLIC_KEY: { level, lms_key[0].public_key } // HSS_PUBLIC_KEY: { level, lms_key[0].public_key }
#define HSS_PUBLIC_KEY_SIZE (4 + LMS_PUBLIC_KEY_SIZE) #define HSS_PUBLIC_KEY_SIZE (4 + LMS_PUBLIC_KEY_SIZE)

289
src/lms.c
View File

@@ -14,6 +14,8 @@
#include <gmssl/lms.h> #include <gmssl/lms.h>
#include <gmssl/x509_alg.h> #include <gmssl/x509_alg.h>
/* /*
* TODO: * TODO:
* 1. add key_update callback * 1. add key_update callback
@@ -94,9 +96,9 @@ int lms_type_to_height(int type, size_t *height)
return 1; return 1;
} }
void lmots_derive_secrets(const hash256_t seed, const uint8_t I[16], int q, hash256_t x[34]) void lmots_derive_secrets(const lms_hash256_t seed, const uint8_t I[16], int q, lms_hash256_t x[34])
{ {
HASH256_CTX ctx; LMS_HASH256_CTX ctx;
uint8_t qbytes[4]; uint8_t qbytes[4];
uint8_t ibytes[2]; uint8_t ibytes[2];
const uint8_t jbytes[1] = { 0xff }; const uint8_t jbytes[1] = { 0xff };
@@ -108,25 +110,25 @@ void lmots_derive_secrets(const hash256_t seed, const uint8_t I[16], int q, hash
for (i = 0; i < 34; i++) { for (i = 0; i < 34; i++) {
PUTU16(ibytes, i); PUTU16(ibytes, i);
hash256_init(&ctx); lms_hash256_init(&ctx);
hash256_update(&ctx, I, 16); lms_hash256_update(&ctx, I, 16);
hash256_update(&ctx, qbytes, 4); lms_hash256_update(&ctx, qbytes, 4);
hash256_update(&ctx, ibytes, 2); lms_hash256_update(&ctx, ibytes, 2);
hash256_update(&ctx, jbytes, 1); lms_hash256_update(&ctx, jbytes, 1);
hash256_update(&ctx, seed, 32); lms_hash256_update(&ctx, seed, 32);
hash256_finish(&ctx, x[i]); lms_hash256_finish(&ctx, x[i]);
} }
gmssl_secure_clear(&ctx, sizeof(ctx)); gmssl_secure_clear(&ctx, sizeof(ctx));
} }
void lmots_secrets_to_public_hash(const uint8_t I[16], int q, const hash256_t x[34], hash256_t pub) void lmots_secrets_to_public_hash(const uint8_t I[16], int q, const lms_hash256_t x[34], lms_hash256_t pub)
{ {
HASH256_CTX ctx; LMS_HASH256_CTX ctx;
uint8_t qbytes[4]; uint8_t qbytes[4];
uint8_t ibytes[2]; uint8_t ibytes[2];
uint8_t jbytes[1]; uint8_t jbytes[1];
hash256_t z[34]; lms_hash256_t z[34];
int i, j; int i, j;
PUTU32(qbytes, q); PUTU32(qbytes, q);
@@ -138,28 +140,28 @@ void lmots_secrets_to_public_hash(const uint8_t I[16], int q, const hash256_t x[
for (j = 0; j < 255; j++) { for (j = 0; j < 255; j++) {
jbytes[0] = (uint8_t)j; jbytes[0] = (uint8_t)j;
hash256_init(&ctx); lms_hash256_init(&ctx);
hash256_update(&ctx, I, 16); lms_hash256_update(&ctx, I, 16);
hash256_update(&ctx, qbytes, 4); lms_hash256_update(&ctx, qbytes, 4);
hash256_update(&ctx, ibytes, 2); lms_hash256_update(&ctx, ibytes, 2);
hash256_update(&ctx, jbytes, 1); lms_hash256_update(&ctx, jbytes, 1);
hash256_update(&ctx, z[i], 32); lms_hash256_update(&ctx, z[i], 32);
hash256_finish(&ctx, z[i]); lms_hash256_finish(&ctx, z[i]);
} }
} }
// K = H(I || u32str(q) || u16str(D_PBLC) || y[0] || ... || y[p-1]) // K = H(I || u32str(q) || u16str(D_PBLC) || y[0] || ... || y[p-1])
hash256_init(&ctx); lms_hash256_init(&ctx);
hash256_update(&ctx, I, 16); lms_hash256_update(&ctx, I, 16);
hash256_update(&ctx, qbytes, 4); lms_hash256_update(&ctx, qbytes, 4);
hash256_update(&ctx, D_PBLC, 2); lms_hash256_update(&ctx, D_PBLC, 2);
for (i = 0; i < 34; i++) { for (i = 0; i < 34; i++) {
hash256_update(&ctx, z[i], 32); lms_hash256_update(&ctx, z[i], 32);
} }
hash256_finish(&ctx, pub); lms_hash256_finish(&ctx, pub);
} }
static void winternitz_checksum(const hash256_t dgst, uint8_t checksum[2]) static void winternitz_checksum(const lms_hash256_t dgst, uint8_t checksum[2])
{ {
uint16_t sum = 0; uint16_t sum = 0;
int i; int i;
@@ -172,9 +174,9 @@ static void winternitz_checksum(const hash256_t dgst, uint8_t checksum[2])
} }
// signed digest Q = H(I || u32str(q) || u16str(D_MESG) || C || message) // signed digest Q = H(I || u32str(q) || u16str(D_MESG) || C || message)
void lmots_compute_signature(const uint8_t I[16], int q, const hash256_t dgst, const hash256_t x[34], hash256_t y[34]) void lmots_compute_signature(const uint8_t I[16], int q, const lms_hash256_t dgst, const lms_hash256_t x[34], lms_hash256_t y[34])
{ {
HASH256_CTX ctx; LMS_HASH256_CTX ctx;
uint8_t checksum[2]; uint8_t checksum[2];
uint8_t qbytes[4]; uint8_t qbytes[4];
uint8_t ibytes[2]; uint8_t ibytes[2];
@@ -194,22 +196,22 @@ void lmots_compute_signature(const uint8_t I[16], int q, const hash256_t dgst, c
for (j = 0; j < a; j++) { for (j = 0; j < a; j++) {
jbytes[0] = j; jbytes[0] = j;
hash256_init(&ctx); lms_hash256_init(&ctx);
hash256_update(&ctx, I, 16); lms_hash256_update(&ctx, I, 16);
hash256_update(&ctx, qbytes, 4); lms_hash256_update(&ctx, qbytes, 4);
hash256_update(&ctx, ibytes, 2); lms_hash256_update(&ctx, ibytes, 2);
hash256_update(&ctx, jbytes, 1); lms_hash256_update(&ctx, jbytes, 1);
hash256_update(&ctx, y[i], 32); lms_hash256_update(&ctx, y[i], 32);
hash256_finish(&ctx, y[i]); lms_hash256_finish(&ctx, y[i]);
} }
} }
} }
void lmots_signature_to_public_hash(const uint8_t I[16], int q, const hash256_t y[34], const hash256_t dgst, hash256_t pub) void lmots_signature_to_public_hash(const uint8_t I[16], int q, const lms_hash256_t y[34], const lms_hash256_t dgst, lms_hash256_t pub)
{ {
uint8_t checksum[2]; uint8_t checksum[2];
HASH256_CTX ctx; LMS_HASH256_CTX ctx;
hash256_t z[34]; lms_hash256_t z[34];
uint8_t qbytes[4]; uint8_t qbytes[4];
uint8_t ibytes[2]; uint8_t ibytes[2];
uint8_t jbytes[1]; uint8_t jbytes[1];
@@ -228,36 +230,36 @@ void lmots_signature_to_public_hash(const uint8_t I[16], int q, const hash256_t
for (j = a; j < 255; j++) { for (j = a; j < 255; j++) {
jbytes[0] = (uint8_t)j; jbytes[0] = (uint8_t)j;
hash256_init(&ctx); lms_hash256_init(&ctx);
hash256_update(&ctx, I, 16); lms_hash256_update(&ctx, I, 16);
hash256_update(&ctx, qbytes, 4); lms_hash256_update(&ctx, qbytes, 4);
hash256_update(&ctx, ibytes, 2); lms_hash256_update(&ctx, ibytes, 2);
hash256_update(&ctx, jbytes, 1); lms_hash256_update(&ctx, jbytes, 1);
hash256_update(&ctx, z[i], 32); lms_hash256_update(&ctx, z[i], 32);
hash256_finish(&ctx, z[i]); lms_hash256_finish(&ctx, z[i]);
} }
} }
// Kc = H(I || u32str(q) || u16str(D_PBLC) || z[0] || z[1] || ... || z[p-1]) // Kc = H(I || u32str(q) || u16str(D_PBLC) || z[0] || z[1] || ... || z[p-1])
hash256_init(&ctx); lms_hash256_init(&ctx);
hash256_update(&ctx, I, 16); lms_hash256_update(&ctx, I, 16);
hash256_update(&ctx, qbytes, 4); lms_hash256_update(&ctx, qbytes, 4);
hash256_update(&ctx, D_PBLC, 2); lms_hash256_update(&ctx, D_PBLC, 2);
for (i = 0; i < 34; i++) { for (i = 0; i < 34; i++) {
hash256_update(&ctx, z[i], 32); lms_hash256_update(&ctx, z[i], 32);
} }
hash256_finish(&ctx, pub); lms_hash256_finish(&ctx, pub);
} }
// derive full merkle tree[2^h * 2 - 1] from seed, tree[0] is the root // derive full merkle tree[2^h * 2 - 1] from seed, tree[0] is the root
void lms_derive_merkle_tree(const hash256_t seed, const uint8_t I[16], int h, hash256_t *tree) void lms_derive_merkle_tree(const lms_hash256_t seed, const uint8_t I[16], int h, lms_hash256_t *tree)
{ {
int r, n = (1 << h); int r, n = (1 << h);
uint8_t rbytes[4]; uint8_t rbytes[4];
HASH256_CTX ctx; LMS_HASH256_CTX ctx;
hash256_t x[34]; lms_hash256_t x[34];
hash256_t pub; lms_hash256_t pub;
hash256_t *T = tree - 1; lms_hash256_t *T = tree - 1;
for (r = 2*n - 1; r >= 1; r--) { for (r = 2*n - 1; r >= 1; r--) {
@@ -269,34 +271,34 @@ void lms_derive_merkle_tree(const hash256_t seed, const uint8_t I[16], int h, ha
lmots_secrets_to_public_hash(I, q, x, pub); lmots_secrets_to_public_hash(I, q, x, pub);
// H(I||u32str(r)||u16str(D_LEAF)||OTS_PUB_HASH[r-2^h]) // H(I||u32str(r)||u16str(D_LEAF)||OTS_PUB_HASH[r-2^h])
hash256_init(&ctx); lms_hash256_init(&ctx);
hash256_update(&ctx, I, 16); lms_hash256_update(&ctx, I, 16);
hash256_update(&ctx, rbytes, 4); lms_hash256_update(&ctx, rbytes, 4);
hash256_update(&ctx, D_LEAF, 2); lms_hash256_update(&ctx, D_LEAF, 2);
hash256_update(&ctx, pub, 32); lms_hash256_update(&ctx, pub, 32);
hash256_finish(&ctx, T[r]); lms_hash256_finish(&ctx, T[r]);
} else { } else {
// H(I||u32str(r)||u16str(D_INTR)||T[2*r]||T[2*r+1]) // H(I||u32str(r)||u16str(D_INTR)||T[2*r]||T[2*r+1])
hash256_init(&ctx); lms_hash256_init(&ctx);
hash256_update(&ctx, I, 16); lms_hash256_update(&ctx, I, 16);
hash256_update(&ctx, rbytes, 4); lms_hash256_update(&ctx, rbytes, 4);
hash256_update(&ctx, D_INTR, 2); lms_hash256_update(&ctx, D_INTR, 2);
hash256_update(&ctx, T[2*r], 32); lms_hash256_update(&ctx, T[2*r], 32);
hash256_update(&ctx, T[2*r + 1], 32); lms_hash256_update(&ctx, T[2*r + 1], 32);
hash256_finish(&ctx, T[r]); lms_hash256_finish(&ctx, T[r]);
} }
} }
} }
void lms_derive_merkle_root(const hash256_t seed, const uint8_t I[16], int h, hash256_t root) void lms_derive_merkle_root(const lms_hash256_t seed, const uint8_t I[16], int h, lms_hash256_t root)
{ {
int q, r, n = 1 << h; int q, r, n = 1 << h;
int qbits; int qbits;
HASH256_CTX ctx; LMS_HASH256_CTX ctx;
hash256_t stack[25]; lms_hash256_t stack[25];
int num = 0; int num = 0;
hash256_t x[34]; lms_hash256_t x[34];
uint8_t rbytes[4]; uint8_t rbytes[4];
for (q = 0; q < n; q++) { for (q = 0; q < n; q++) {
@@ -308,12 +310,12 @@ void lms_derive_merkle_root(const hash256_t seed, const uint8_t I[16], int h, ha
PUTU32(rbytes, r); PUTU32(rbytes, r);
// H(I||u32str(r)||u16str(D_LEAF)||OTS_PUB_HASH[r-2^h]) // H(I||u32str(r)||u16str(D_LEAF)||OTS_PUB_HASH[r-2^h])
hash256_init(&ctx); lms_hash256_init(&ctx);
hash256_update(&ctx, I, 16); lms_hash256_update(&ctx, I, 16);
hash256_update(&ctx, rbytes, 4); lms_hash256_update(&ctx, rbytes, 4);
hash256_update(&ctx, D_LEAF, 2); lms_hash256_update(&ctx, D_LEAF, 2);
hash256_update(&ctx, stack[num], 32); lms_hash256_update(&ctx, stack[num], 32);
hash256_finish(&ctx, stack[num]); lms_hash256_finish(&ctx, stack[num]);
num++; num++;
qbits = q; qbits = q;
@@ -323,13 +325,13 @@ void lms_derive_merkle_root(const hash256_t seed, const uint8_t I[16], int h, ha
r = r/2; r = r/2;
PUTU32(rbytes, r); PUTU32(rbytes, r);
hash256_init(&ctx); lms_hash256_init(&ctx);
hash256_update(&ctx, I, 16); lms_hash256_update(&ctx, I, 16);
hash256_update(&ctx, rbytes, 4); lms_hash256_update(&ctx, rbytes, 4);
hash256_update(&ctx, D_INTR, 2); lms_hash256_update(&ctx, D_INTR, 2);
hash256_update(&ctx, stack[num - 2], 32); lms_hash256_update(&ctx, stack[num - 2], 32);
hash256_update(&ctx, stack[num - 1], 32); lms_hash256_update(&ctx, stack[num - 1], 32);
hash256_finish(&ctx, stack[num - 2]); lms_hash256_finish(&ctx, stack[num - 2]);
num--; num--;
qbits >>= 1; qbits >>= 1;
@@ -481,7 +483,7 @@ int lms_private_key_from_bytes(LMS_KEY *key, const uint8_t **in, size_t *inlen)
if (cache_tree) { if (cache_tree) {
size_t n = 1 << height; size_t n = 1 << height;
if (!(key->tree = (hash256_t *)malloc(sizeof(hash256_t) * (2*n - 1)))) { if (!(key->tree = (lms_hash256_t *)malloc(sizeof(lms_hash256_t) * (2*n - 1)))) {
error_print(); error_print();
return -1; return -1;
} }
@@ -533,7 +535,7 @@ void lms_key_cleanup(LMS_KEY *key)
} }
} }
int lms_key_generate_ex(LMS_KEY *key, int lms_type, const hash256_t seed, const uint8_t I[16], int cache_tree) int lms_key_generate_ex(LMS_KEY *key, int lms_type, const lms_hash256_t seed, const uint8_t I[16], int cache_tree)
{ {
size_t h, n; size_t h, n;
@@ -555,7 +557,7 @@ int lms_key_generate_ex(LMS_KEY *key, int lms_type, const hash256_t seed, const
memcpy(key->seed, seed, 32); memcpy(key->seed, seed, 32);
if (cache_tree) { if (cache_tree) {
if (!(key->tree = (hash256_t *)malloc(sizeof(hash256_t) * (2*n - 1)))) { if (!(key->tree = (lms_hash256_t *)malloc(sizeof(lms_hash256_t) * (2*n - 1)))) {
error_print(); error_print();
return -1; return -1;
} }
@@ -572,7 +574,7 @@ int lms_key_generate_ex(LMS_KEY *key, int lms_type, const hash256_t seed, const
int lms_key_generate(LMS_KEY *key, int lms_type) int lms_key_generate(LMS_KEY *key, int lms_type)
{ {
hash256_t seed; lms_hash256_t seed;
uint8_t I[16]; uint8_t I[16];
int cache_tree = 1; int cache_tree = 1;
@@ -605,10 +607,10 @@ int lms_signature_size(int lms_type, size_t *len)
} }
*len = sizeof(uint32_t) // q *len = sizeof(uint32_t) // q
+ sizeof(uint32_t) // lmots_type + sizeof(uint32_t) // lmots_type
+ sizeof(hash256_t) // C + sizeof(lms_hash256_t) // C
+ sizeof(hash256_t) * 34 // y[34] + sizeof(lms_hash256_t) * 34 // y[34]
+ sizeof(uint32_t) // lms_type + sizeof(uint32_t) // lms_type
+ sizeof(hash256_t) * height; // path[hegith] + sizeof(lms_hash256_t) * height; // path[hegith]
return 1; return 1;
} }
@@ -818,12 +820,12 @@ int lms_signature_from_bytes(LMS_SIGNATURE *sig, const uint8_t **in, size_t *inl
} }
int lms_signature_to_merkle_root(const uint8_t I[16], size_t h, int q, int lms_signature_to_merkle_root(const uint8_t I[16], size_t h, int q,
const hash256_t y[34], const hash256_t *path, const lms_hash256_t y[34], const lms_hash256_t *path,
const hash256_t dgst, hash256_t root) const lms_hash256_t dgst, lms_hash256_t root)
{ {
size_t n, r; size_t n, r;
uint8_t rbytes[4]; uint8_t rbytes[4];
HASH256_CTX ctx; LMS_HASH256_CTX ctx;
size_t i; size_t i;
n = 1 << h; n = 1 << h;
@@ -837,28 +839,28 @@ int lms_signature_to_merkle_root(const uint8_t I[16], size_t h, int q,
lmots_signature_to_public_hash(I, q, y, dgst, root); lmots_signature_to_public_hash(I, q, y, dgst, root);
// leaf[q] = H(I||u32str(r)||u16str(D_LEAF)||OTS_PUB_HASH[r-2^h]) // leaf[q] = H(I||u32str(r)||u16str(D_LEAF)||OTS_PUB_HASH[r-2^h])
hash256_init(&ctx); lms_hash256_init(&ctx);
hash256_update(&ctx, I, 16); lms_hash256_update(&ctx, I, 16);
hash256_update(&ctx, rbytes, 4); lms_hash256_update(&ctx, rbytes, 4);
hash256_update(&ctx, D_LEAF, 2); lms_hash256_update(&ctx, D_LEAF, 2);
hash256_update(&ctx, root, 32); lms_hash256_update(&ctx, root, 32);
hash256_finish(&ctx, root); lms_hash256_finish(&ctx, root);
for (i = 0; i < h; i++) { for (i = 0; i < h; i++) {
PUTU32(rbytes, r/2); PUTU32(rbytes, r/2);
hash256_init(&ctx); lms_hash256_init(&ctx);
hash256_update(&ctx, I, 16); lms_hash256_update(&ctx, I, 16);
hash256_update(&ctx, rbytes, 4); lms_hash256_update(&ctx, rbytes, 4);
hash256_update(&ctx, D_INTR, 2); lms_hash256_update(&ctx, D_INTR, 2);
if (r & 0x01) { if (r & 0x01) {
hash256_update(&ctx, path[i], 32); lms_hash256_update(&ctx, path[i], 32);
hash256_update(&ctx, root, 32); lms_hash256_update(&ctx, root, 32);
} else { } else {
hash256_update(&ctx, root, 32); lms_hash256_update(&ctx, root, 32);
hash256_update(&ctx, path[i], 32); lms_hash256_update(&ctx, path[i], 32);
} }
hash256_finish(&ctx, root); lms_hash256_finish(&ctx, root);
r = r/2; r = r/2;
} }
@@ -868,7 +870,7 @@ int lms_signature_to_merkle_root(const uint8_t I[16], size_t h, int q,
void lms_sign_ctx_cleanup(LMS_SIGN_CTX *ctx) void lms_sign_ctx_cleanup(LMS_SIGN_CTX *ctx)
{ {
if (ctx) { if (ctx) {
gmssl_secure_clear(ctx->lms_sig.lmots_sig.y, sizeof(hash256_t)*34); gmssl_secure_clear(ctx->lms_sig.lmots_sig.y, sizeof(lms_hash256_t)*34);
} }
} }
@@ -876,7 +878,7 @@ int lms_sign_init(LMS_SIGN_CTX *ctx, LMS_KEY *key)
{ {
LMS_SIGNATURE *lms_sig; LMS_SIGNATURE *lms_sig;
uint8_t qbytes[4]; uint8_t qbytes[4];
const hash256_t *T; const lms_hash256_t *T;
size_t height, r, i; size_t height, r, i;
if (!ctx || !key) { if (!ctx || !key) {
@@ -929,11 +931,11 @@ int lms_sign_init(LMS_SIGN_CTX *ctx, LMS_KEY *key)
r /= 2; r /= 2;
} }
hash256_init(&ctx->hash256_ctx); lms_hash256_init(&ctx->lms_hash256_ctx);
hash256_update(&ctx->hash256_ctx, key->public_key.I, 16); lms_hash256_update(&ctx->lms_hash256_ctx, key->public_key.I, 16);
hash256_update(&ctx->hash256_ctx, qbytes, 4); lms_hash256_update(&ctx->lms_hash256_ctx, qbytes, 4);
hash256_update(&ctx->hash256_ctx, D_MESG, 2); lms_hash256_update(&ctx->lms_hash256_ctx, D_MESG, 2);
hash256_update(&ctx->hash256_ctx, lms_sig->lmots_sig.C, 32); lms_hash256_update(&ctx->lms_hash256_ctx, lms_sig->lmots_sig.C, 32);
return 1; return 1;
} }
@@ -945,7 +947,7 @@ int lms_sign_update(LMS_SIGN_CTX *ctx, const uint8_t *data, size_t datalen)
return -1; return -1;
} }
if (data && datalen > 0) { if (data && datalen > 0) {
hash256_update(&ctx->hash256_ctx, data, datalen); lms_hash256_update(&ctx->lms_hash256_ctx, data, datalen);
} }
return 1; return 1;
} }
@@ -960,7 +962,7 @@ int lms_sign_finish_ex(LMS_SIGN_CTX *ctx, LMS_SIGNATURE *sig)
return -1; return -1;
} }
hash256_finish(&ctx->hash256_ctx, dgst); lms_hash256_finish(&ctx->lms_hash256_ctx, dgst);
lms_sig = &ctx->lms_sig; lms_sig = &ctx->lms_sig;
lmots_compute_signature(ctx->lms_public_key.I, lms_sig->q, dgst, lms_sig->lmots_sig.y, lms_sig->lmots_sig.y); lmots_compute_signature(ctx->lms_public_key.I, lms_sig->q, dgst, lms_sig->lmots_sig.y, lms_sig->lmots_sig.y);
@@ -979,7 +981,7 @@ int lms_sign_finish(LMS_SIGN_CTX *ctx, uint8_t *sig, size_t *siglen)
return -1; return -1;
} }
hash256_finish(&ctx->hash256_ctx, dgst); lms_hash256_finish(&ctx->lms_hash256_ctx, dgst);
lms_sig = &ctx->lms_sig; lms_sig = &ctx->lms_sig;
lmots_compute_signature(ctx->lms_public_key.I, lms_sig->q, dgst, lms_sig->lmots_sig.y, lms_sig->lmots_sig.y); lmots_compute_signature(ctx->lms_public_key.I, lms_sig->q, dgst, lms_sig->lmots_sig.y, lms_sig->lmots_sig.y);
@@ -1020,11 +1022,11 @@ int lms_verify_init_ex(LMS_SIGN_CTX *ctx, const LMS_KEY *key, const LMS_SIGNATUR
PUTU32(qbytes, lms_sig->q); PUTU32(qbytes, lms_sig->q);
hash256_init(&ctx->hash256_ctx); lms_hash256_init(&ctx->lms_hash256_ctx);
hash256_update(&ctx->hash256_ctx, key->public_key.I, 16); lms_hash256_update(&ctx->lms_hash256_ctx, key->public_key.I, 16);
hash256_update(&ctx->hash256_ctx, qbytes, 4); lms_hash256_update(&ctx->lms_hash256_ctx, qbytes, 4);
hash256_update(&ctx->hash256_ctx, D_MESG, 2); lms_hash256_update(&ctx->lms_hash256_ctx, D_MESG, 2);
hash256_update(&ctx->hash256_ctx, lms_sig->lmots_sig.C, 32); lms_hash256_update(&ctx->lms_hash256_ctx, lms_sig->lmots_sig.C, 32);
return 1; return 1;
} }
@@ -1064,11 +1066,11 @@ int lms_verify_init(LMS_SIGN_CTX *ctx, const LMS_KEY *key, const uint8_t *sig, s
PUTU32(qbytes, lms_sig->q); PUTU32(qbytes, lms_sig->q);
hash256_init(&ctx->hash256_ctx); lms_hash256_init(&ctx->lms_hash256_ctx);
hash256_update(&ctx->hash256_ctx, key->public_key.I, 16); lms_hash256_update(&ctx->lms_hash256_ctx, key->public_key.I, 16);
hash256_update(&ctx->hash256_ctx, qbytes, 4); lms_hash256_update(&ctx->lms_hash256_ctx, qbytes, 4);
hash256_update(&ctx->hash256_ctx, D_MESG, 2); lms_hash256_update(&ctx->lms_hash256_ctx, D_MESG, 2);
hash256_update(&ctx->hash256_ctx, lms_sig->lmots_sig.C, 32); lms_hash256_update(&ctx->lms_hash256_ctx, lms_sig->lmots_sig.C, 32);
return 1; return 1;
} }
@@ -1080,7 +1082,7 @@ int lms_verify_update(LMS_SIGN_CTX *ctx, const uint8_t *data, size_t datalen)
return -1; return -1;
} }
if (data && datalen > 0) { if (data && datalen > 0) {
hash256_update(&ctx->hash256_ctx, data, datalen); lms_hash256_update(&ctx->lms_hash256_ctx, data, datalen);
} }
return 1; return 1;
} }
@@ -1088,9 +1090,9 @@ int lms_verify_update(LMS_SIGN_CTX *ctx, const uint8_t *data, size_t datalen)
int lms_verify_finish(LMS_SIGN_CTX *ctx) int lms_verify_finish(LMS_SIGN_CTX *ctx)
{ {
LMS_SIGNATURE *lms_sig; LMS_SIGNATURE *lms_sig;
hash256_t dgst; lms_hash256_t dgst;
size_t height; size_t height;
hash256_t root; lms_hash256_t root;
if (!ctx) { if (!ctx) {
error_print(); error_print();
@@ -1103,7 +1105,7 @@ int lms_verify_finish(LMS_SIGN_CTX *ctx)
return -1; return -1;
} }
hash256_finish(&ctx->hash256_ctx, dgst); lms_hash256_finish(&ctx->lms_hash256_ctx, dgst);
if (lms_signature_to_merkle_root(ctx->lms_public_key.I, height, if (lms_signature_to_merkle_root(ctx->lms_public_key.I, height,
lms_sig->q, lms_sig->lmots_sig.y, lms_sig->path, dgst, root) != 1) { lms_sig->q, lms_sig->lmots_sig.y, lms_sig->path, dgst, root) != 1) {
@@ -1330,7 +1332,7 @@ void hss_key_cleanup(HSS_KEY *key)
int hss_key_generate(HSS_KEY *key, const int *lms_types, size_t levels) int hss_key_generate(HSS_KEY *key, const int *lms_types, size_t levels)
{ {
int ret = -1; int ret = -1;
hash256_t seed; lms_hash256_t seed;
uint8_t I[16]; uint8_t I[16];
LMS_SIGN_CTX ctx; LMS_SIGN_CTX ctx;
uint8_t buf[LMS_SIGNATURE_MAX_SIZE]; // LMS_SIGNATURE_MAX_SIZE > SM3_PUBLIC_KEY_SIZE uint8_t buf[LMS_SIGNATURE_MAX_SIZE]; // LMS_SIGNATURE_MAX_SIZE > SM3_PUBLIC_KEY_SIZE
@@ -1955,6 +1957,21 @@ int hss_private_key_size(const int *lms_types, size_t levels, size_t *len)
} }
// X.509 related // X.509 related
/*
SubjectPublicKeyInfo ::= SEQUENCE {
algorithm AlgorithmIdentifier,
subjectPublicKey BIT STRING
}
in RFC 8708 (HSS/LMS in CMS)
only HSS has OID id-alg-hss-lms-hashsig (1.2.840.113549.1.9.16.3.17)
so only HSS public key is supported in x509_ functions
hss_public_key_to_bytes encode HSS_PUBLIC_KEY to SubjectPublicKeyInfo.subjectPublicKey
the public_key raw data (not OCTET STRING TLV) is encoded into a BIT STRING TLV
same as EC_POINT
*/
int hss_public_key_to_der(const HSS_KEY *key, uint8_t **out, size_t *outlen) int hss_public_key_to_der(const HSS_KEY *key, uint8_t **out, size_t *outlen)
{ {
uint8_t octets[HSS_PUBLIC_KEY_SIZE]; uint8_t octets[HSS_PUBLIC_KEY_SIZE];

20
tests/lmstest.c
View File

@@ -233,14 +233,14 @@ static int test_rfc8554_test1(void)
static int test_sm3_lmots(void) static int test_sm3_lmots(void)
{ {
hash256_t seed = {0}; // TODO: change to test vector lms_hash256_t seed = {0}; // TODO: change to test vector
uint8_t I[16] = {0}; uint8_t I[16] = {0};
int q = 0; int q = 0;
hash256_t dgst = {0}; lms_hash256_t dgst = {0};
hash256_t x[34]; lms_hash256_t x[34];
hash256_t y[34]; lms_hash256_t y[34];
hash256_t pub; lms_hash256_t pub;
hash256_t pub2; lms_hash256_t pub2;
lmots_derive_secrets(seed, I, q, x); // TODO: compare results with test vector lmots_derive_secrets(seed, I, q, x); // TODO: compare results with test vector
lmots_secrets_to_public_hash(I, q, x, pub); // TODO: compare results with test vector lmots_secrets_to_public_hash(I, q, x, pub); // TODO: compare results with test vector
@@ -259,14 +259,14 @@ static int test_sm3_lmots(void)
static int test_lms_derive_merkle_root(void) static int test_lms_derive_merkle_root(void)
{ {
hash256_t seed = {0}; // TODO: change to test vector lms_hash256_t seed = {0}; // TODO: change to test vector
uint8_t I[16] = {0}; uint8_t I[16] = {0};
int h = 5; int h = 5;
int n = 1<<h; int n = 1<<h;
hash256_t *tree = NULL; lms_hash256_t *tree = NULL;
hash256_t root; lms_hash256_t root;
if (!(tree = (hash256_t *)malloc(sizeof(hash256_t)*(2*n - 1)))) { if (!(tree = (lms_hash256_t *)malloc(sizeof(lms_hash256_t)*(2*n - 1)))) {
error_print(); error_print();
return -1; return -1;
} }