855 lines
29 KiB
C
855 lines
29 KiB
C
/*
|
|
* The LM-OTS one-time public-key signature scheme
|
|
*
|
|
* Copyright The Mbed TLS Contributors
|
|
* SPDX-License-Identifier: Apache-2.0
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
* not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
/*
|
|
* The following sources were referenced in the design of this implementation
|
|
* of the LM-OTS algorithm:
|
|
*
|
|
* [1] IETF RFC8554
|
|
* D. McGrew, M. Curcio, S.Fluhrer
|
|
* https://datatracker.ietf.org/doc/html/rfc8554
|
|
*
|
|
* [2] NIST Special Publication 800-208
|
|
* David A. Cooper et. al.
|
|
* https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-208.pdf
|
|
*/
|
|
|
|
#include "common.h"
|
|
|
|
#ifdef MBEDTLS_LMS_C
|
|
|
|
#include <string.h>
|
|
|
|
#include "lmots.h"
|
|
|
|
#include "mbedtls/lms.h"
|
|
#include "mbedtls/platform_util.h"
|
|
#include "mbedtls/error.h"
|
|
|
|
#include "psa/crypto.h"
|
|
|
|
#define PUBLIC_KEY_TYPE_OFFSET (0)
|
|
#define PUBLIC_KEY_I_KEY_ID_OFFSET (PUBLIC_KEY_TYPE_OFFSET + \
|
|
MBEDTLS_LMOTS_TYPE_LEN)
|
|
#define PUBLIC_KEY_Q_LEAF_ID_OFFSET (PUBLIC_KEY_I_KEY_ID_OFFSET + \
|
|
MBEDTLS_LMOTS_I_KEY_ID_LEN)
|
|
#define PUBLIC_KEY_KEY_HASH_OFFSET (PUBLIC_KEY_Q_LEAF_ID_OFFSET + \
|
|
MBEDTLS_LMOTS_Q_LEAF_ID_LEN)
|
|
|
|
/* We only support parameter sets that use 8-bit digits, as it does not require
|
|
* translation logic between digits and bytes */
|
|
#define W_WINTERNITZ_PARAMETER (8u)
|
|
#define CHECKSUM_LEN (2)
|
|
#define I_DIGIT_IDX_LEN (2)
|
|
#define J_HASH_IDX_LEN (1)
|
|
#define D_CONST_LEN (2)
|
|
|
|
/* Currently only defined for SHA256, 32 is the max hash output size */
|
|
#define C_RANDOM_VALUE_LEN_MAX (MBEDTLS_LMOTS_N_HASH_LEN_MAX)
|
|
|
|
#define DIGIT_MAX_VALUE ((1u << W_WINTERNITZ_PARAMETER) - 1u)
|
|
|
|
#define D_CONST_LEN (2)
|
|
static const unsigned char D_PUBLIC_CONSTANT_BYTES[D_CONST_LEN] = {0x80, 0x80};
|
|
static const unsigned char D_MESSAGE_CONSTANT_BYTES[D_CONST_LEN] = {0x81, 0x81};
|
|
|
|
#if defined(MBEDTLS_TEST_HOOKS)
|
|
int( *mbedtls_lmots_sign_private_key_invalidated_hook )( unsigned char * ) = NULL;
|
|
#endif /* defined(MBEDTLS_TEST_HOOKS) */
|
|
|
|
void mbedtls_lms_unsigned_int_to_network_bytes( unsigned int val, size_t len,
|
|
unsigned char *bytes )
|
|
{
|
|
size_t idx;
|
|
|
|
for ( idx = 0; idx < len; idx++ )
|
|
{
|
|
bytes[idx] = ( val >> ( ( len - 1 - idx ) * 8 ) ) & 0xFF;
|
|
}
|
|
}
|
|
|
|
unsigned int mbedtls_lms_network_bytes_to_unsigned_int( size_t len,
|
|
const unsigned char *bytes )
|
|
{
|
|
size_t idx;
|
|
unsigned int val = 0;
|
|
|
|
for ( idx = 0; idx < len; idx++ )
|
|
{
|
|
val |= ( ( unsigned int )bytes[idx] ) << (8 * ( len - 1 - idx ) );
|
|
}
|
|
|
|
return val;
|
|
}
|
|
|
|
/* Calculate the checksum digits that are appended to the end of the LMOTS digit
|
|
* string. See NIST SP800-208 section 3.1 or RFC8554 Algorithm 2 for details of
|
|
* the checksum algorithm.
|
|
*
|
|
* params The LMOTS parameter set, I and q values which
|
|
* describe the key being used.
|
|
*
|
|
* digest The digit string to create the digest from. As
|
|
* this does not contain a checksum, it is the same
|
|
* size as a hash output.
|
|
*/
|
|
static unsigned short lmots_checksum_calculate( const mbedtls_lmots_parameters_t *params,
|
|
const unsigned char* digest )
|
|
{
|
|
size_t idx;
|
|
unsigned sum = 0;
|
|
|
|
for ( idx = 0; idx < MBEDTLS_LMOTS_N_HASH_LEN(params->type); idx++ )
|
|
{
|
|
sum += DIGIT_MAX_VALUE - digest[idx];
|
|
}
|
|
|
|
return sum;
|
|
}
|
|
|
|
/* Create the string of digest digits (in the base determined by the Winternitz
|
|
* parameter with the checksum appended to the end (Q || cksm(Q)). See NIST
|
|
* SP800-208 section 3.1 or RFC8554 Algorithm 3 step 5 (also used in Algorithm
|
|
* 4b step 3) for details.
|
|
*
|
|
* params The LMOTS parameter set, I and q values which
|
|
* describe the key being used.
|
|
*
|
|
* msg The message that will be hashed to create the
|
|
* digest.
|
|
*
|
|
* msg_size The size of the message.
|
|
*
|
|
* C_random_value The random value that will be combined with the
|
|
* message digest. This is always the same size as a
|
|
* hash output for whichever hash algorithm is
|
|
* determined by the parameter set.
|
|
*
|
|
* output An output containing the digit string (+
|
|
* checksum) of length P digits (in the case of
|
|
* MBEDTLS_LMOTS_SHA256_N32_W8, this means it is of
|
|
* size P bytes).
|
|
*/
|
|
static int create_digit_array_with_checksum( const mbedtls_lmots_parameters_t *params,
|
|
const unsigned char *msg,
|
|
size_t msg_len,
|
|
const unsigned char *C_random_value,
|
|
unsigned char *out )
|
|
{
|
|
psa_hash_operation_t op;
|
|
psa_status_t status;
|
|
size_t output_hash_len;
|
|
unsigned short checksum;
|
|
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
|
|
|
op = psa_hash_operation_init( );
|
|
status = psa_hash_setup( &op, PSA_ALG_SHA_256 );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
status = psa_hash_update( &op, params->I_key_identifier,
|
|
MBEDTLS_LMOTS_I_KEY_ID_LEN );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
status = psa_hash_update( &op, params->q_leaf_identifier,
|
|
MBEDTLS_LMOTS_Q_LEAF_ID_LEN );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
status = psa_hash_update( &op, D_MESSAGE_CONSTANT_BYTES, D_CONST_LEN );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
status = psa_hash_update( &op, C_random_value,
|
|
MBEDTLS_LMOTS_C_RANDOM_VALUE_LEN(params->type) );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
status = psa_hash_update( &op, msg, msg_len );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
status = psa_hash_finish( &op, out,
|
|
MBEDTLS_LMOTS_N_HASH_LEN(params->type),
|
|
&output_hash_len );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
checksum = lmots_checksum_calculate( params, out );
|
|
mbedtls_lms_unsigned_int_to_network_bytes( checksum, CHECKSUM_LEN,
|
|
out + MBEDTLS_LMOTS_N_HASH_LEN(params->type) );
|
|
|
|
exit:
|
|
psa_hash_abort( &op );
|
|
|
|
return( ret );
|
|
}
|
|
|
|
/* Hash each element of the string of digits (+ checksum), producing a hash
|
|
* output for each element. This is used in several places (by varying the
|
|
* hash_idx_min/max_values) in order to calculate a public key from a private
|
|
* key (RFC8554 Algorithm 1 step 4), in order to sign a message (RFC8554
|
|
* Algorithm 3 step 5), and to calculate a public key candidate from a
|
|
* signature and message (RFC8554 Algorithm 4b step 3).
|
|
*
|
|
* params The LMOTS parameter set, I and q values which
|
|
* describe the key being used.
|
|
*
|
|
* x_digit_array The array of digits (of size P, 34 in the case of
|
|
* MBEDTLS_LMOTS_SHA256_N32_W8).
|
|
*
|
|
* hash_idx_min_values An array of the starting values of the j iterator
|
|
* for each of the members of the digit array. If
|
|
* this value in NULL, then all iterators will start
|
|
* at 0.
|
|
*
|
|
* hash_idx_max_values An array of the upper bound values of the j
|
|
* iterator for each of the members of the digit
|
|
* array. If this value in NULL, then iterator is
|
|
* bounded to be less than 2^w - 1 (255 in the case
|
|
* of MBEDTLS_LMOTS_SHA256_N32_W8)
|
|
*
|
|
* output An array containing a hash output for each member
|
|
* of the digit string P. In the case of
|
|
* MBEDTLS_LMOTS_SHA256_N32_W8, this is of size 32 *
|
|
* 34.
|
|
*/
|
|
static int hash_digit_array( const mbedtls_lmots_parameters_t *params,
|
|
const unsigned char *x_digit_array,
|
|
const unsigned char *hash_idx_min_values,
|
|
const unsigned char *hash_idx_max_values,
|
|
unsigned char *output )
|
|
{
|
|
unsigned int i_digit_idx;
|
|
unsigned char i_digit_idx_bytes[I_DIGIT_IDX_LEN];
|
|
unsigned int j_hash_idx;
|
|
unsigned char j_hash_idx_bytes[J_HASH_IDX_LEN];
|
|
unsigned int j_hash_idx_min;
|
|
unsigned int j_hash_idx_max;
|
|
psa_hash_operation_t op;
|
|
psa_status_t status;
|
|
size_t output_hash_len;
|
|
unsigned char tmp_hash[MBEDTLS_LMOTS_N_HASH_LEN_MAX];
|
|
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
|
|
|
op = psa_hash_operation_init( );
|
|
|
|
for ( i_digit_idx = 0;
|
|
i_digit_idx < MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(params->type);
|
|
i_digit_idx++ )
|
|
{
|
|
|
|
memcpy( tmp_hash,
|
|
&x_digit_array[i_digit_idx * MBEDTLS_LMOTS_N_HASH_LEN(params->type)],
|
|
MBEDTLS_LMOTS_N_HASH_LEN(params->type) );
|
|
|
|
j_hash_idx_min = hash_idx_min_values != NULL ?
|
|
hash_idx_min_values[i_digit_idx] : 0;
|
|
j_hash_idx_max = hash_idx_max_values != NULL ?
|
|
hash_idx_max_values[i_digit_idx] : DIGIT_MAX_VALUE;
|
|
|
|
for ( j_hash_idx = j_hash_idx_min;
|
|
j_hash_idx < j_hash_idx_max;
|
|
j_hash_idx++ )
|
|
{
|
|
status = psa_hash_setup( &op, PSA_ALG_SHA_256 );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
status = psa_hash_update( &op,
|
|
params->I_key_identifier,
|
|
MBEDTLS_LMOTS_I_KEY_ID_LEN );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
status = psa_hash_update( &op,
|
|
params->q_leaf_identifier,
|
|
MBEDTLS_LMOTS_Q_LEAF_ID_LEN );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
mbedtls_lms_unsigned_int_to_network_bytes( i_digit_idx,
|
|
I_DIGIT_IDX_LEN,
|
|
i_digit_idx_bytes );
|
|
status = psa_hash_update( &op, i_digit_idx_bytes, I_DIGIT_IDX_LEN );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
mbedtls_lms_unsigned_int_to_network_bytes( j_hash_idx,
|
|
J_HASH_IDX_LEN,
|
|
j_hash_idx_bytes );
|
|
status = psa_hash_update( &op, j_hash_idx_bytes, J_HASH_IDX_LEN );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
status = psa_hash_update( &op, tmp_hash,
|
|
MBEDTLS_LMOTS_N_HASH_LEN(params->type) );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
status = psa_hash_finish( &op, tmp_hash, sizeof( tmp_hash ),
|
|
&output_hash_len );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
psa_hash_abort( &op );
|
|
}
|
|
|
|
memcpy( &output[i_digit_idx * MBEDTLS_LMOTS_N_HASH_LEN(params->type)],
|
|
tmp_hash, MBEDTLS_LMOTS_N_HASH_LEN(params->type) );
|
|
}
|
|
|
|
exit:
|
|
if( ret != 0 )
|
|
{
|
|
psa_hash_abort( &op );
|
|
return( ret );
|
|
}
|
|
|
|
mbedtls_platform_zeroize( tmp_hash, sizeof( tmp_hash ) );
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* Combine the hashes of the digit array into a public key. This is used in
|
|
* in order to calculate a public key from a private key (RFC8554 Algorithm 1
|
|
* step 4), and to calculate a public key candidate from a signature and message
|
|
* (RFC8554 Algorithm 4b step 3).
|
|
*
|
|
* params The LMOTS parameter set, I and q values which describe
|
|
* the key being used.
|
|
* y_hashed_digits The array of hashes, one hash for each digit of the
|
|
* symbol array (which is of size P, 34 in the case of
|
|
* MBEDTLS_LMOTS_SHA256_N32_W8)
|
|
*
|
|
* pub_key The output public key (or candidate public key in
|
|
* case this is being run as part of signature
|
|
* verification), in the form of a hash output.
|
|
*/
|
|
static int public_key_from_hashed_digit_array( const mbedtls_lmots_parameters_t *params,
|
|
const unsigned char *y_hashed_digits,
|
|
unsigned char *pub_key )
|
|
{
|
|
psa_hash_operation_t op;
|
|
psa_status_t status;
|
|
size_t output_hash_len;
|
|
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
|
|
|
op = psa_hash_operation_init( );
|
|
status = psa_hash_setup( &op, PSA_ALG_SHA_256 );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
status = psa_hash_update( &op,
|
|
params->I_key_identifier,
|
|
MBEDTLS_LMOTS_I_KEY_ID_LEN );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
status = psa_hash_update( &op, params->q_leaf_identifier,
|
|
MBEDTLS_LMOTS_Q_LEAF_ID_LEN );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
status = psa_hash_update( &op, D_PUBLIC_CONSTANT_BYTES, D_CONST_LEN );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
status = psa_hash_update( &op, y_hashed_digits,
|
|
MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(params->type) *
|
|
MBEDTLS_LMOTS_N_HASH_LEN(params->type) );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
status = psa_hash_finish( &op, pub_key,
|
|
MBEDTLS_LMOTS_N_HASH_LEN(params->type),
|
|
&output_hash_len );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
|
|
exit:
|
|
psa_hash_abort( &op );
|
|
return( ret );
|
|
}
|
|
|
|
int mbedtls_lms_error_from_psa( psa_status_t status )
|
|
{
|
|
switch( status )
|
|
{
|
|
case PSA_SUCCESS:
|
|
return( 0 );
|
|
case PSA_ERROR_HARDWARE_FAILURE:
|
|
return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
|
|
case PSA_ERROR_NOT_SUPPORTED:
|
|
return( MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED );
|
|
case PSA_ERROR_BUFFER_TOO_SMALL:
|
|
return( MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL );
|
|
case PSA_ERROR_INVALID_ARGUMENT:
|
|
return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
|
|
default:
|
|
return( MBEDTLS_ERR_ERROR_GENERIC_ERROR );
|
|
}
|
|
}
|
|
|
|
void mbedtls_lmots_init_public( mbedtls_lmots_public_t *ctx )
|
|
{
|
|
mbedtls_platform_zeroize( ctx, sizeof( mbedtls_lmots_public_t ) ) ;
|
|
}
|
|
|
|
void mbedtls_lmots_free_public( mbedtls_lmots_public_t *ctx )
|
|
{
|
|
mbedtls_platform_zeroize( ctx, sizeof( mbedtls_lmots_public_t ) ) ;
|
|
}
|
|
|
|
int mbedtls_lmots_import_public_key( mbedtls_lmots_public_t *ctx,
|
|
const unsigned char *key, size_t key_len )
|
|
{
|
|
ctx->params.type =
|
|
mbedtls_lms_network_bytes_to_unsigned_int( MBEDTLS_LMOTS_TYPE_LEN,
|
|
key + MBEDTLS_LMOTS_SIG_TYPE_OFFSET );
|
|
|
|
if( key_len < MBEDTLS_LMOTS_PUBLIC_KEY_LEN(ctx->params.type) )
|
|
{
|
|
return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
|
|
}
|
|
|
|
memcpy( ctx->params.I_key_identifier,
|
|
key + PUBLIC_KEY_I_KEY_ID_OFFSET,
|
|
MBEDTLS_LMOTS_I_KEY_ID_LEN );
|
|
|
|
memcpy( ctx->params.q_leaf_identifier,
|
|
key + PUBLIC_KEY_Q_LEAF_ID_OFFSET,
|
|
MBEDTLS_LMOTS_Q_LEAF_ID_LEN );
|
|
|
|
memcpy( ctx->public_key,
|
|
key + PUBLIC_KEY_KEY_HASH_OFFSET,
|
|
MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type) );
|
|
|
|
ctx->have_public_key = 1;
|
|
|
|
return( 0 );
|
|
}
|
|
|
|
int mbedtls_lmots_calculate_public_key_candidate( const mbedtls_lmots_parameters_t *params,
|
|
const unsigned char *msg,
|
|
size_t msg_size,
|
|
const unsigned char *sig,
|
|
size_t sig_size,
|
|
unsigned char *out,
|
|
size_t out_size,
|
|
size_t *out_len )
|
|
{
|
|
unsigned char tmp_digit_array[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX];
|
|
unsigned char y_hashed_digits[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX][MBEDTLS_LMOTS_N_HASH_LEN_MAX];
|
|
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
|
|
|
if( msg == NULL && msg_size != 0 )
|
|
{
|
|
return ( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
|
|
}
|
|
|
|
if( sig_size != MBEDTLS_LMOTS_SIG_LEN(params->type) ||
|
|
out_size < MBEDTLS_LMOTS_N_HASH_LEN(params->type) )
|
|
{
|
|
return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
|
|
}
|
|
|
|
ret = create_digit_array_with_checksum( params, msg, msg_size,
|
|
sig + MBEDTLS_LMOTS_SIG_C_RANDOM_OFFSET,
|
|
tmp_digit_array );
|
|
if( ret )
|
|
{
|
|
return ( ret );
|
|
}
|
|
|
|
ret = hash_digit_array( params,
|
|
sig + MBEDTLS_LMOTS_SIG_SIGNATURE_OFFSET(params->type),
|
|
tmp_digit_array, NULL, ( unsigned char * )y_hashed_digits );
|
|
if( ret )
|
|
{
|
|
return ( ret );
|
|
}
|
|
|
|
ret = public_key_from_hashed_digit_array( params,
|
|
( unsigned char * )y_hashed_digits,
|
|
out );
|
|
if( ret )
|
|
{
|
|
return ( ret );
|
|
}
|
|
|
|
if( out_len != NULL )
|
|
{
|
|
*out_len = MBEDTLS_LMOTS_N_HASH_LEN(params->type);
|
|
}
|
|
|
|
return( 0 );
|
|
}
|
|
|
|
int mbedtls_lmots_verify( mbedtls_lmots_public_t *ctx, const unsigned char *msg,
|
|
size_t msg_size, const unsigned char *sig,
|
|
size_t sig_size )
|
|
{
|
|
unsigned char Kc_public_key_candidate[MBEDTLS_LMOTS_N_HASH_LEN_MAX];
|
|
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
|
|
|
if( msg == NULL && msg_size != 0 )
|
|
{
|
|
return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
|
|
}
|
|
|
|
if( !ctx->have_public_key )
|
|
{
|
|
return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
|
|
}
|
|
|
|
if( ctx->params.type != MBEDTLS_LMOTS_SHA256_N32_W8 )
|
|
{
|
|
return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
|
|
}
|
|
|
|
if( mbedtls_lms_network_bytes_to_unsigned_int( MBEDTLS_LMOTS_TYPE_LEN,
|
|
sig + MBEDTLS_LMOTS_SIG_TYPE_OFFSET ) != MBEDTLS_LMOTS_SHA256_N32_W8 )
|
|
{
|
|
return( MBEDTLS_ERR_LMS_VERIFY_FAILED );
|
|
}
|
|
|
|
ret = mbedtls_lmots_calculate_public_key_candidate( &ctx->params,
|
|
msg, msg_size, sig, sig_size,
|
|
Kc_public_key_candidate,
|
|
MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type),
|
|
NULL );
|
|
if( ret )
|
|
{
|
|
return( ret );
|
|
}
|
|
|
|
if( memcmp( &Kc_public_key_candidate, ctx->public_key,
|
|
sizeof( ctx->public_key ) ) )
|
|
{
|
|
return( MBEDTLS_ERR_LMS_VERIFY_FAILED );
|
|
}
|
|
|
|
return( 0 );
|
|
}
|
|
|
|
#ifdef MBEDTLS_LMS_PRIVATE
|
|
|
|
void mbedtls_lmots_init_private( mbedtls_lmots_private_t *ctx )
|
|
{
|
|
mbedtls_platform_zeroize( ctx, sizeof( mbedtls_lmots_private_t ) ) ;
|
|
}
|
|
|
|
void mbedtls_lmots_free_private( mbedtls_lmots_private_t *ctx )
|
|
{
|
|
mbedtls_platform_zeroize( ctx, sizeof( mbedtls_lmots_private_t ) ) ;
|
|
}
|
|
|
|
int mbedtls_lmots_generate_private_key( mbedtls_lmots_private_t *ctx,
|
|
mbedtls_lmots_algorithm_type_t type,
|
|
const unsigned char I_key_identifier[MBEDTLS_LMOTS_I_KEY_ID_LEN],
|
|
uint32_t q_leaf_identifier,
|
|
const unsigned char *seed,
|
|
size_t seed_size )
|
|
{
|
|
psa_hash_operation_t op;
|
|
psa_status_t status;
|
|
size_t output_hash_len;
|
|
unsigned int i_digit_idx;
|
|
unsigned char i_digit_idx_bytes[2];
|
|
unsigned char const_bytes[1];
|
|
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
|
|
|
if( ctx->have_private_key )
|
|
{
|
|
return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
|
|
}
|
|
|
|
if( type != MBEDTLS_LMOTS_SHA256_N32_W8 )
|
|
{
|
|
return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
|
|
}
|
|
|
|
op = psa_hash_operation_init( );
|
|
|
|
ctx->params.type = type;
|
|
|
|
memcpy( ctx->params.I_key_identifier,
|
|
I_key_identifier,
|
|
sizeof( ctx->params.I_key_identifier ) );
|
|
|
|
mbedtls_lms_unsigned_int_to_network_bytes( q_leaf_identifier,
|
|
MBEDTLS_LMOTS_Q_LEAF_ID_LEN,
|
|
ctx->params.q_leaf_identifier );
|
|
|
|
mbedtls_lms_unsigned_int_to_network_bytes( 0xFF, sizeof( const_bytes ),
|
|
const_bytes );
|
|
|
|
for ( i_digit_idx = 0;
|
|
i_digit_idx < MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(ctx->params.type);
|
|
i_digit_idx++ )
|
|
{
|
|
status = psa_hash_setup( &op, PSA_ALG_SHA_256 );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret != 0 )
|
|
goto exit;
|
|
|
|
ret = psa_hash_update( &op,
|
|
ctx->params.I_key_identifier,
|
|
sizeof( ctx->params.I_key_identifier ) );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret )
|
|
goto exit;
|
|
|
|
status = psa_hash_update( &op,
|
|
ctx->params.q_leaf_identifier,
|
|
MBEDTLS_LMOTS_Q_LEAF_ID_LEN );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret )
|
|
goto exit;
|
|
|
|
mbedtls_lms_unsigned_int_to_network_bytes( i_digit_idx, I_DIGIT_IDX_LEN,
|
|
i_digit_idx_bytes );
|
|
status = psa_hash_update( &op, i_digit_idx_bytes, I_DIGIT_IDX_LEN );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret )
|
|
goto exit;
|
|
|
|
status = psa_hash_update( &op, const_bytes, sizeof( const_bytes ) );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret )
|
|
goto exit;
|
|
|
|
status = psa_hash_update( &op, seed, seed_size );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret )
|
|
goto exit;
|
|
|
|
status = psa_hash_finish( &op,
|
|
ctx->private_key[i_digit_idx],
|
|
MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type),
|
|
&output_hash_len );
|
|
ret = mbedtls_lms_error_from_psa( status );
|
|
if( ret )
|
|
goto exit;
|
|
|
|
psa_hash_abort( &op );
|
|
}
|
|
|
|
ctx->have_private_key = 1;
|
|
|
|
exit:
|
|
if( ret != 0 )
|
|
{
|
|
psa_hash_abort( &op );
|
|
return( ret );
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
int mbedtls_lmots_calculate_public_key( mbedtls_lmots_public_t *ctx,
|
|
mbedtls_lmots_private_t *priv_ctx )
|
|
{
|
|
unsigned char y_hashed_digits[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX][MBEDTLS_LMOTS_N_HASH_LEN_MAX];
|
|
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
|
|
|
/* Check that a private key is loaded */
|
|
if( !priv_ctx->have_private_key )
|
|
{
|
|
return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
|
|
}
|
|
|
|
ret = hash_digit_array( &priv_ctx->params,
|
|
( unsigned char * )priv_ctx->private_key, NULL,
|
|
NULL, ( unsigned char * )y_hashed_digits );
|
|
if( ret )
|
|
{
|
|
return( ret );
|
|
}
|
|
|
|
ret = public_key_from_hashed_digit_array( &priv_ctx->params,
|
|
( unsigned char * )y_hashed_digits,
|
|
ctx->public_key );
|
|
if( ret )
|
|
{
|
|
return( ret );
|
|
}
|
|
|
|
memcpy( &ctx->params, &priv_ctx->params,
|
|
sizeof( ctx->params ) );
|
|
|
|
ctx->have_public_key = 1;
|
|
|
|
return( ret );
|
|
}
|
|
|
|
|
|
int mbedtls_lmots_export_public_key( mbedtls_lmots_public_t *ctx,
|
|
unsigned char *key, size_t key_size,
|
|
size_t *key_len )
|
|
{
|
|
if( key_size < MBEDTLS_LMOTS_PUBLIC_KEY_LEN(ctx->params.type) )
|
|
{
|
|
return( MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL );
|
|
}
|
|
|
|
if( ! ctx->have_public_key )
|
|
{
|
|
return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
|
|
}
|
|
|
|
mbedtls_lms_unsigned_int_to_network_bytes( ctx->params.type,
|
|
MBEDTLS_LMOTS_TYPE_LEN,
|
|
key + MBEDTLS_LMOTS_SIG_TYPE_OFFSET );
|
|
|
|
memcpy( key + PUBLIC_KEY_I_KEY_ID_OFFSET,
|
|
ctx->params.I_key_identifier,
|
|
MBEDTLS_LMOTS_I_KEY_ID_LEN );
|
|
|
|
memcpy( key + PUBLIC_KEY_Q_LEAF_ID_OFFSET,
|
|
ctx->params.q_leaf_identifier,
|
|
MBEDTLS_LMOTS_Q_LEAF_ID_LEN );
|
|
|
|
memcpy( key + PUBLIC_KEY_KEY_HASH_OFFSET, ctx->public_key,
|
|
MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type) );
|
|
|
|
if( key_len != NULL )
|
|
{
|
|
*key_len = MBEDTLS_LMOTS_PUBLIC_KEY_LEN(ctx->params.type);
|
|
}
|
|
|
|
return( 0 );
|
|
}
|
|
|
|
int mbedtls_lmots_sign( mbedtls_lmots_private_t *ctx,
|
|
int (*f_rng)(void *, unsigned char *, size_t),
|
|
void *p_rng, const unsigned char *msg, size_t msg_size,
|
|
unsigned char *sig, size_t sig_size, size_t* sig_len )
|
|
{
|
|
unsigned char tmp_digit_array[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX];
|
|
/* Create a temporary buffer to prepare the signature in. This allows us to
|
|
* finish creating a signature (ensuring the process doesn't fail), and then
|
|
* erase the private key **before** writing any data into the sig parameter
|
|
* buffer. If data were directly written into the sig buffer, it might leak
|
|
* a partial signature on failure, which effectively compromises the private
|
|
* key.
|
|
*/
|
|
unsigned char tmp_sig[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX][MBEDTLS_LMOTS_N_HASH_LEN_MAX];
|
|
unsigned char tmp_c_random[C_RANDOM_VALUE_LEN_MAX];
|
|
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
|
|
|
if( msg == NULL && msg_size != 0 )
|
|
{
|
|
return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
|
|
}
|
|
|
|
if( sig_size < MBEDTLS_LMOTS_SIG_LEN(ctx->params.type) )
|
|
{
|
|
return( MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL );
|
|
}
|
|
|
|
/* Check that a private key is loaded */
|
|
if( !ctx->have_private_key )
|
|
{
|
|
return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
|
|
}
|
|
|
|
ret = f_rng( p_rng, tmp_c_random,
|
|
MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type) );
|
|
if( ret )
|
|
{
|
|
return( ret );
|
|
}
|
|
|
|
ret = create_digit_array_with_checksum( &ctx->params,
|
|
msg, msg_size,
|
|
tmp_c_random,
|
|
tmp_digit_array );
|
|
if( ret )
|
|
{
|
|
return( ret );
|
|
}
|
|
|
|
ret = hash_digit_array( &ctx->params, ( unsigned char * )ctx->private_key,
|
|
NULL, tmp_digit_array, ( unsigned char * )tmp_sig );
|
|
if( ret )
|
|
{
|
|
return( ret );
|
|
}
|
|
|
|
mbedtls_lms_unsigned_int_to_network_bytes( ctx->params.type,
|
|
MBEDTLS_LMOTS_TYPE_LEN,
|
|
sig + MBEDTLS_LMOTS_SIG_TYPE_OFFSET );
|
|
|
|
/* Test hook to check if sig is being written to before we invalidate the
|
|
* private key.
|
|
*/
|
|
#if defined(MBEDTLS_TEST_HOOKS)
|
|
if( mbedtls_lmots_sign_private_key_invalidated_hook != NULL )
|
|
{
|
|
ret = ( *mbedtls_lmots_sign_private_key_invalidated_hook )( sig );
|
|
if( ret != 0 )
|
|
return( ret );
|
|
}
|
|
#endif /* defined(MBEDTLS_TEST_HOOKS) */
|
|
|
|
/* We've got a valid signature now, so it's time to make sure the private
|
|
* key can't be reused.
|
|
*/
|
|
ctx->have_private_key = 0;
|
|
mbedtls_platform_zeroize( ctx->private_key,
|
|
sizeof( ctx->private_key ) );
|
|
|
|
memcpy( sig + MBEDTLS_LMOTS_SIG_C_RANDOM_OFFSET, tmp_c_random,
|
|
MBEDTLS_LMOTS_C_RANDOM_VALUE_LEN(ctx->params.type) );
|
|
|
|
memcpy( sig + MBEDTLS_LMOTS_SIG_SIGNATURE_OFFSET(ctx->params.type), tmp_sig,
|
|
MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(ctx->params.type)
|
|
* MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type) );
|
|
|
|
if( sig_len != NULL )
|
|
{
|
|
*sig_len = MBEDTLS_LMOTS_SIG_LEN(ctx->params.type);
|
|
}
|
|
|
|
return( 0 );
|
|
}
|
|
|
|
#endif /* MBEDTLS_LMS_PRIVATE */
|
|
#endif /* MBEDTLS_LMS_C */
|