blob: 4061edde04878a1ec1566203145f9a00aa39c9b5 [file] [log] [blame]
Raef Coles8ff6df52021-07-21 12:42:15 +01001/*
2 * The LM-OTS one-time public-key signature scheme
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 */
19
20/*
21 * The following sources were referenced in the design of this implementation
22 * of the LM-OTS algorithm:
23 *
24 * [1] IETF RFC8554
25 * D. McGrew, M. Curcio, S.Fluhrer
26 * https://datatracker.ietf.org/doc/html/rfc8554
27 *
28 * [2] NIST Special Publication 800-208
29 * David A. Cooper et. al.
30 * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-208.pdf
31 */
32
33#include "common.h"
34
Raef Coles5127e852022-10-07 10:35:56 +010035#if defined(MBEDTLS_LMS_C)
Raef Coles8ff6df52021-07-21 12:42:15 +010036
37#include <string.h>
38
Raef Coles7dce69a2022-08-24 14:07:06 +010039#include "lmots.h"
40
Raef Colesc8f96042022-08-25 13:49:54 +010041#include "mbedtls/lms.h"
Raef Coles8ff6df52021-07-21 12:42:15 +010042#include "mbedtls/platform_util.h"
43#include "mbedtls/error.h"
Andrzej Kurek8a045ce2022-12-23 11:00:06 -050044#include "mbedtls/psa_util.h"
Raef Coles8ff6df52021-07-21 12:42:15 +010045
Raef Colesc8f96042022-08-25 13:49:54 +010046#include "psa/crypto.h"
47
Andrzej Kurek8a045ce2022-12-23 11:00:06 -050048#define PSA_TO_MBEDTLS_ERR(status) PSA_TO_MBEDTLS_ERR_LIST(status, \
49 psa_to_lms_errors, \
50 psa_generic_status_to_mbedtls)
51
Raef Coles57d53282022-09-27 11:30:51 +010052#define PUBLIC_KEY_TYPE_OFFSET (0)
53#define PUBLIC_KEY_I_KEY_ID_OFFSET (PUBLIC_KEY_TYPE_OFFSET + \
54 MBEDTLS_LMOTS_TYPE_LEN)
55#define PUBLIC_KEY_Q_LEAF_ID_OFFSET (PUBLIC_KEY_I_KEY_ID_OFFSET + \
56 MBEDTLS_LMOTS_I_KEY_ID_LEN)
57#define PUBLIC_KEY_KEY_HASH_OFFSET (PUBLIC_KEY_Q_LEAF_ID_OFFSET + \
58 MBEDTLS_LMOTS_Q_LEAF_ID_LEN)
Raef Coles01c71a12022-08-31 15:55:00 +010059
60/* We only support parameter sets that use 8-bit digits, as it does not require
61 * translation logic between digits and bytes */
62#define W_WINTERNITZ_PARAMETER (8u)
63#define CHECKSUM_LEN (2)
64#define I_DIGIT_IDX_LEN (2)
65#define J_HASH_IDX_LEN (1)
66#define D_CONST_LEN (2)
67
Raef Coles9b88ee52022-09-02 12:04:21 +010068#define DIGIT_MAX_VALUE ((1u << W_WINTERNITZ_PARAMETER) - 1u)
Raef Coles01c71a12022-08-31 15:55:00 +010069
Raef Coles9b88ee52022-09-02 12:04:21 +010070#define D_CONST_LEN (2)
Gilles Peskine449bd832023-01-11 14:50:10 +010071static const unsigned char D_PUBLIC_CONSTANT_BYTES[D_CONST_LEN] = { 0x80, 0x80 };
72static const unsigned char D_MESSAGE_CONSTANT_BYTES[D_CONST_LEN] = { 0x81, 0x81 };
Raef Coles8ff6df52021-07-21 12:42:15 +010073
Raef Coles9c9027b2022-09-02 18:26:31 +010074#if defined(MBEDTLS_TEST_HOOKS)
Gilles Peskine449bd832023-01-11 14:50:10 +010075int (*mbedtls_lmots_sign_private_key_invalidated_hook)(unsigned char *) = NULL;
Raef Coles9c9027b2022-09-02 18:26:31 +010076#endif /* defined(MBEDTLS_TEST_HOOKS) */
77
Gilles Peskine449bd832023-01-11 14:50:10 +010078void mbedtls_lms_unsigned_int_to_network_bytes(unsigned int val, size_t len,
79 unsigned char *bytes)
Raef Coles8ff6df52021-07-21 12:42:15 +010080{
81 size_t idx;
82
Gilles Peskine449bd832023-01-11 14:50:10 +010083 for (idx = 0; idx < len; idx++) {
84 bytes[idx] = (val >> ((len - 1 - idx) * 8)) & 0xFF;
Raef Coles8ff6df52021-07-21 12:42:15 +010085 }
86}
87
Gilles Peskine449bd832023-01-11 14:50:10 +010088unsigned int mbedtls_lms_network_bytes_to_unsigned_int(size_t len,
89 const unsigned char *bytes)
Raef Coles8ff6df52021-07-21 12:42:15 +010090{
91 size_t idx;
92 unsigned int val = 0;
93
Gilles Peskine449bd832023-01-11 14:50:10 +010094 for (idx = 0; idx < len; idx++) {
95 val |= ((unsigned int) bytes[idx]) << (8 * (len - 1 - idx));
Raef Coles8ff6df52021-07-21 12:42:15 +010096 }
97
Gilles Peskine449bd832023-01-11 14:50:10 +010098 return val;
Raef Coles8ff6df52021-07-21 12:42:15 +010099}
100
Raef Coles0a967cc2022-09-02 17:46:15 +0100101/* Calculate the checksum digits that are appended to the end of the LMOTS digit
102 * string. See NIST SP800-208 section 3.1 or RFC8554 Algorithm 2 for details of
103 * the checksum algorithm.
104 *
Raef Coles98d6e222022-09-23 09:04:04 +0100105 * params The LMOTS parameter set, I and q values which
106 * describe the key being used.
Raef Coles0a967cc2022-09-02 17:46:15 +0100107 *
Raef Coles98d6e222022-09-23 09:04:04 +0100108 * digest The digit string to create the digest from. As
109 * this does not contain a checksum, it is the same
110 * size as a hash output.
Raef Coles0a967cc2022-09-02 17:46:15 +0100111 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100112static unsigned short lmots_checksum_calculate(const mbedtls_lmots_parameters_t *params,
113 const unsigned char *digest)
Raef Coles8ff6df52021-07-21 12:42:15 +0100114{
115 size_t idx;
Raef Coles01c71a12022-08-31 15:55:00 +0100116 unsigned sum = 0;
Raef Coles8ff6df52021-07-21 12:42:15 +0100117
Gilles Peskine449bd832023-01-11 14:50:10 +0100118 for (idx = 0; idx < MBEDTLS_LMOTS_N_HASH_LEN(params->type); idx++) {
Raef Coles01c71a12022-08-31 15:55:00 +0100119 sum += DIGIT_MAX_VALUE - digest[idx];
Raef Coles8ff6df52021-07-21 12:42:15 +0100120 }
121
Gilles Peskine449bd832023-01-11 14:50:10 +0100122 return sum;
Raef Coles8ff6df52021-07-21 12:42:15 +0100123}
124
Raef Coles0a967cc2022-09-02 17:46:15 +0100125/* Create the string of digest digits (in the base determined by the Winternitz
126 * parameter with the checksum appended to the end (Q || cksm(Q)). See NIST
127 * SP800-208 section 3.1 or RFC8554 Algorithm 3 step 5 (also used in Algorithm
128 * 4b step 3) for details.
129 *
Raef Coles98d6e222022-09-23 09:04:04 +0100130 * params The LMOTS parameter set, I and q values which
131 * describe the key being used.
Raef Coles0a967cc2022-09-02 17:46:15 +0100132 *
Raef Coles98d6e222022-09-23 09:04:04 +0100133 * msg The message that will be hashed to create the
134 * digest.
Raef Coles0a967cc2022-09-02 17:46:15 +0100135 *
Raef Coles98d6e222022-09-23 09:04:04 +0100136 * msg_size The size of the message.
Raef Coles0a967cc2022-09-02 17:46:15 +0100137 *
Raef Coles98d6e222022-09-23 09:04:04 +0100138 * C_random_value The random value that will be combined with the
139 * message digest. This is always the same size as a
140 * hash output for whichever hash algorithm is
141 * determined by the parameter set.
Raef Coles0a967cc2022-09-02 17:46:15 +0100142 *
Raef Coles98d6e222022-09-23 09:04:04 +0100143 * output An output containing the digit string (+
144 * checksum) of length P digits (in the case of
145 * MBEDTLS_LMOTS_SHA256_N32_W8, this means it is of
146 * size P bytes).
Raef Coles0a967cc2022-09-02 17:46:15 +0100147 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100148static int create_digit_array_with_checksum(const mbedtls_lmots_parameters_t *params,
149 const unsigned char *msg,
150 size_t msg_len,
151 const unsigned char *C_random_value,
152 unsigned char *out)
Raef Coles8ff6df52021-07-21 12:42:15 +0100153{
Raef Colesbe0c2f92022-10-07 11:27:35 +0100154 psa_hash_operation_t op = PSA_HASH_OPERATION_INIT;
155 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Raef Colesc8f96042022-08-25 13:49:54 +0100156 size_t output_hash_len;
Raef Coles8ff6df52021-07-21 12:42:15 +0100157 unsigned short checksum;
Raef Coles8ff6df52021-07-21 12:42:15 +0100158
Gilles Peskine449bd832023-01-11 14:50:10 +0100159 status = psa_hash_setup(&op, PSA_ALG_SHA_256);
160 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100161 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100162 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100163
Gilles Peskine449bd832023-01-11 14:50:10 +0100164 status = psa_hash_update(&op, params->I_key_identifier,
165 MBEDTLS_LMOTS_I_KEY_ID_LEN);
166 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100167 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100168 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100169
Gilles Peskine449bd832023-01-11 14:50:10 +0100170 status = psa_hash_update(&op, params->q_leaf_identifier,
171 MBEDTLS_LMOTS_Q_LEAF_ID_LEN);
172 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100173 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100174 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100175
Gilles Peskine449bd832023-01-11 14:50:10 +0100176 status = psa_hash_update(&op, D_MESSAGE_CONSTANT_BYTES, D_CONST_LEN);
177 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100178 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100179 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100180
Gilles Peskine449bd832023-01-11 14:50:10 +0100181 status = psa_hash_update(&op, C_random_value,
182 MBEDTLS_LMOTS_C_RANDOM_VALUE_LEN(params->type));
183 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100184 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100185 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100186
Gilles Peskine449bd832023-01-11 14:50:10 +0100187 status = psa_hash_update(&op, msg, msg_len);
188 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100189 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100190 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100191
Gilles Peskine449bd832023-01-11 14:50:10 +0100192 status = psa_hash_finish(&op, out,
193 MBEDTLS_LMOTS_N_HASH_LEN(params->type),
194 &output_hash_len);
195 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100196 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100197 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100198
Gilles Peskine449bd832023-01-11 14:50:10 +0100199 checksum = lmots_checksum_calculate(params, out);
200 mbedtls_lms_unsigned_int_to_network_bytes(checksum, CHECKSUM_LEN,
201 out + MBEDTLS_LMOTS_N_HASH_LEN(params->type));
Raef Coles8ff6df52021-07-21 12:42:15 +0100202
Raef Coles01c71a12022-08-31 15:55:00 +0100203exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100204 psa_hash_abort(&op);
Raef Coles8ff6df52021-07-21 12:42:15 +0100205
Andrzej Kurek8a045ce2022-12-23 11:00:06 -0500206 return PSA_TO_MBEDTLS_ERR(status);
Raef Coles8ff6df52021-07-21 12:42:15 +0100207}
208
Raef Coles0a967cc2022-09-02 17:46:15 +0100209/* Hash each element of the string of digits (+ checksum), producing a hash
210 * output for each element. This is used in several places (by varying the
211 * hash_idx_min/max_values) in order to calculate a public key from a private
212 * key (RFC8554 Algorithm 1 step 4), in order to sign a message (RFC8554
213 * Algorithm 3 step 5), and to calculate a public key candidate from a
214 * signature and message (RFC8554 Algorithm 4b step 3).
215 *
Raef Coles98d6e222022-09-23 09:04:04 +0100216 * params The LMOTS parameter set, I and q values which
217 * describe the key being used.
Raef Coles0a967cc2022-09-02 17:46:15 +0100218 *
Raef Coles98d6e222022-09-23 09:04:04 +0100219 * x_digit_array The array of digits (of size P, 34 in the case of
220 * MBEDTLS_LMOTS_SHA256_N32_W8).
Raef Coles0a967cc2022-09-02 17:46:15 +0100221 *
Raef Coles98d6e222022-09-23 09:04:04 +0100222 * hash_idx_min_values An array of the starting values of the j iterator
223 * for each of the members of the digit array. If
224 * this value in NULL, then all iterators will start
225 * at 0.
Raef Coles0a967cc2022-09-02 17:46:15 +0100226 *
Raef Coles98d6e222022-09-23 09:04:04 +0100227 * hash_idx_max_values An array of the upper bound values of the j
228 * iterator for each of the members of the digit
229 * array. If this value in NULL, then iterator is
230 * bounded to be less than 2^w - 1 (255 in the case
231 * of MBEDTLS_LMOTS_SHA256_N32_W8)
Raef Coles0a967cc2022-09-02 17:46:15 +0100232 *
Raef Coles98d6e222022-09-23 09:04:04 +0100233 * output An array containing a hash output for each member
234 * of the digit string P. In the case of
235 * MBEDTLS_LMOTS_SHA256_N32_W8, this is of size 32 *
236 * 34.
Raef Coles0a967cc2022-09-02 17:46:15 +0100237 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100238static int hash_digit_array(const mbedtls_lmots_parameters_t *params,
239 const unsigned char *x_digit_array,
240 const unsigned char *hash_idx_min_values,
241 const unsigned char *hash_idx_max_values,
242 unsigned char *output)
Raef Coles8ff6df52021-07-21 12:42:15 +0100243{
Raef Coles8738a492022-09-02 17:13:01 +0100244 unsigned int i_digit_idx;
Raef Coles01c71a12022-08-31 15:55:00 +0100245 unsigned char i_digit_idx_bytes[I_DIGIT_IDX_LEN];
Raef Coles8738a492022-09-02 17:13:01 +0100246 unsigned int j_hash_idx;
247 unsigned char j_hash_idx_bytes[J_HASH_IDX_LEN];
Raef Coles01c71a12022-08-31 15:55:00 +0100248 unsigned int j_hash_idx_min;
249 unsigned int j_hash_idx_max;
Raef Colesbe0c2f92022-10-07 11:27:35 +0100250 psa_hash_operation_t op = PSA_HASH_OPERATION_INIT;
251 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Raef Colesc8f96042022-08-25 13:49:54 +0100252 size_t output_hash_len;
Raef Colese9479a02022-09-01 16:06:35 +0100253 unsigned char tmp_hash[MBEDTLS_LMOTS_N_HASH_LEN_MAX];
Raef Coles8ff6df52021-07-21 12:42:15 +0100254
Gilles Peskine449bd832023-01-11 14:50:10 +0100255 for (i_digit_idx = 0;
256 i_digit_idx < MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(params->type);
257 i_digit_idx++) {
Raef Coles8ff6df52021-07-21 12:42:15 +0100258
Gilles Peskine449bd832023-01-11 14:50:10 +0100259 memcpy(tmp_hash,
260 &x_digit_array[i_digit_idx * MBEDTLS_LMOTS_N_HASH_LEN(params->type)],
261 MBEDTLS_LMOTS_N_HASH_LEN(params->type));
Raef Coles8ff6df52021-07-21 12:42:15 +0100262
Raef Coles366d67d2022-09-01 17:23:12 +0100263 j_hash_idx_min = hash_idx_min_values != NULL ?
Gilles Peskine449bd832023-01-11 14:50:10 +0100264 hash_idx_min_values[i_digit_idx] : 0;
Raef Coles366d67d2022-09-01 17:23:12 +0100265 j_hash_idx_max = hash_idx_max_values != NULL ?
Gilles Peskine449bd832023-01-11 14:50:10 +0100266 hash_idx_max_values[i_digit_idx] : DIGIT_MAX_VALUE;
Raef Coles8ff6df52021-07-21 12:42:15 +0100267
Gilles Peskine449bd832023-01-11 14:50:10 +0100268 for (j_hash_idx = j_hash_idx_min;
269 j_hash_idx < j_hash_idx_max;
270 j_hash_idx++) {
271 status = psa_hash_setup(&op, PSA_ALG_SHA_256);
272 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100273 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100274 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100275
Gilles Peskine449bd832023-01-11 14:50:10 +0100276 status = psa_hash_update(&op,
277 params->I_key_identifier,
278 MBEDTLS_LMOTS_I_KEY_ID_LEN);
279 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100280 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100281 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100282
Gilles Peskine449bd832023-01-11 14:50:10 +0100283 status = psa_hash_update(&op,
284 params->q_leaf_identifier,
285 MBEDTLS_LMOTS_Q_LEAF_ID_LEN);
286 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100287 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100288 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100289
Gilles Peskine449bd832023-01-11 14:50:10 +0100290 mbedtls_lms_unsigned_int_to_network_bytes(i_digit_idx,
291 I_DIGIT_IDX_LEN,
292 i_digit_idx_bytes);
293 status = psa_hash_update(&op, i_digit_idx_bytes, I_DIGIT_IDX_LEN);
294 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100295 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100296 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100297
Gilles Peskine449bd832023-01-11 14:50:10 +0100298 mbedtls_lms_unsigned_int_to_network_bytes(j_hash_idx,
299 J_HASH_IDX_LEN,
300 j_hash_idx_bytes);
301 status = psa_hash_update(&op, j_hash_idx_bytes, J_HASH_IDX_LEN);
302 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100303 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100304 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100305
Gilles Peskine449bd832023-01-11 14:50:10 +0100306 status = psa_hash_update(&op, tmp_hash,
307 MBEDTLS_LMOTS_N_HASH_LEN(params->type));
308 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100309 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100310 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100311
Gilles Peskine449bd832023-01-11 14:50:10 +0100312 status = psa_hash_finish(&op, tmp_hash, sizeof(tmp_hash),
313 &output_hash_len);
314 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100315 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100316 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100317
Gilles Peskine449bd832023-01-11 14:50:10 +0100318 psa_hash_abort(&op);
Raef Coles8ff6df52021-07-21 12:42:15 +0100319 }
320
Gilles Peskine449bd832023-01-11 14:50:10 +0100321 memcpy(&output[i_digit_idx * MBEDTLS_LMOTS_N_HASH_LEN(params->type)],
322 tmp_hash, MBEDTLS_LMOTS_N_HASH_LEN(params->type));
Raef Coles8ff6df52021-07-21 12:42:15 +0100323 }
324
Raef Coles01c71a12022-08-31 15:55:00 +0100325exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100326 psa_hash_abort(&op);
327 mbedtls_platform_zeroize(tmp_hash, sizeof(tmp_hash));
Raef Coles01c71a12022-08-31 15:55:00 +0100328
Andrzej Kurek8a045ce2022-12-23 11:00:06 -0500329 return PSA_TO_MBEDTLS_ERR(status);
Raef Coles8ff6df52021-07-21 12:42:15 +0100330}
331
Raef Coles0a967cc2022-09-02 17:46:15 +0100332/* Combine the hashes of the digit array into a public key. This is used in
333 * in order to calculate a public key from a private key (RFC8554 Algorithm 1
334 * step 4), and to calculate a public key candidate from a signature and message
335 * (RFC8554 Algorithm 4b step 3).
336 *
Raef Coles98d6e222022-09-23 09:04:04 +0100337 * params The LMOTS parameter set, I and q values which describe
338 * the key being used.
339 * y_hashed_digits The array of hashes, one hash for each digit of the
340 * symbol array (which is of size P, 34 in the case of
341 * MBEDTLS_LMOTS_SHA256_N32_W8)
Raef Coles0a967cc2022-09-02 17:46:15 +0100342 *
Raef Coles98d6e222022-09-23 09:04:04 +0100343 * pub_key The output public key (or candidate public key in
344 * case this is being run as part of signature
345 * verification), in the form of a hash output.
Raef Coles0a967cc2022-09-02 17:46:15 +0100346 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100347static int public_key_from_hashed_digit_array(const mbedtls_lmots_parameters_t *params,
348 const unsigned char *y_hashed_digits,
349 unsigned char *pub_key)
Raef Coles8ff6df52021-07-21 12:42:15 +0100350{
Raef Colesbe0c2f92022-10-07 11:27:35 +0100351 psa_hash_operation_t op = PSA_HASH_OPERATION_INIT;
352 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Raef Colesc8f96042022-08-25 13:49:54 +0100353 size_t output_hash_len;
Raef Coles8ff6df52021-07-21 12:42:15 +0100354
Gilles Peskine449bd832023-01-11 14:50:10 +0100355 status = psa_hash_setup(&op, PSA_ALG_SHA_256);
356 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100357 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100358 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100359
Gilles Peskine449bd832023-01-11 14:50:10 +0100360 status = psa_hash_update(&op,
361 params->I_key_identifier,
362 MBEDTLS_LMOTS_I_KEY_ID_LEN);
363 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100364 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100365 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100366
Gilles Peskine449bd832023-01-11 14:50:10 +0100367 status = psa_hash_update(&op, params->q_leaf_identifier,
368 MBEDTLS_LMOTS_Q_LEAF_ID_LEN);
369 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100370 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100371 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100372
Gilles Peskine449bd832023-01-11 14:50:10 +0100373 status = psa_hash_update(&op, D_PUBLIC_CONSTANT_BYTES, D_CONST_LEN);
374 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100375 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100376 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100377
Gilles Peskine449bd832023-01-11 14:50:10 +0100378 status = psa_hash_update(&op, y_hashed_digits,
379 MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(params->type) *
380 MBEDTLS_LMOTS_N_HASH_LEN(params->type));
381 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100382 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100383 }
Raef Coles8ff6df52021-07-21 12:42:15 +0100384
Gilles Peskine449bd832023-01-11 14:50:10 +0100385 status = psa_hash_finish(&op, pub_key,
386 MBEDTLS_LMOTS_N_HASH_LEN(params->type),
387 &output_hash_len);
388 if (status != PSA_SUCCESS) {
Raef Coles8ff6df52021-07-21 12:42:15 +0100389
Raef Coles01c71a12022-08-31 15:55:00 +0100390exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100391 psa_hash_abort(&op);
392 }
Raef Coles29117d22022-10-07 11:46:06 +0100393
Andrzej Kurek8a045ce2022-12-23 11:00:06 -0500394 return PSA_TO_MBEDTLS_ERR(status);
Raef Coles8ff6df52021-07-21 12:42:15 +0100395}
396
Andrzej Kurek8a045ce2022-12-23 11:00:06 -0500397#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Gilles Peskine449bd832023-01-11 14:50:10 +0100398int mbedtls_lms_error_from_psa(psa_status_t status)
Raef Colesc8f96042022-08-25 13:49:54 +0100399{
Gilles Peskine449bd832023-01-11 14:50:10 +0100400 switch (status) {
Raef Colesc8f96042022-08-25 13:49:54 +0100401 case PSA_SUCCESS:
Gilles Peskine449bd832023-01-11 14:50:10 +0100402 return 0;
Raef Colesc8f96042022-08-25 13:49:54 +0100403 case PSA_ERROR_HARDWARE_FAILURE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100404 return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
Raef Colesc8f96042022-08-25 13:49:54 +0100405 case PSA_ERROR_NOT_SUPPORTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100406 return MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED;
Raef Colesc8f96042022-08-25 13:49:54 +0100407 case PSA_ERROR_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100408 return MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL;
Raef Colesc8f96042022-08-25 13:49:54 +0100409 case PSA_ERROR_INVALID_ARGUMENT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100410 return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
Raef Colesc8f96042022-08-25 13:49:54 +0100411 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100412 return MBEDTLS_ERR_ERROR_GENERIC_ERROR;
Raef Colesc8f96042022-08-25 13:49:54 +0100413 }
414}
Andrzej Kurek8a045ce2022-12-23 11:00:06 -0500415#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Raef Colesc8f96042022-08-25 13:49:54 +0100416
Gilles Peskine449bd832023-01-11 14:50:10 +0100417void mbedtls_lmots_public_init(mbedtls_lmots_public_t *ctx)
Raef Coles8ff6df52021-07-21 12:42:15 +0100418{
Gilles Peskine449bd832023-01-11 14:50:10 +0100419 memset(ctx, 0, sizeof(*ctx));
Raef Coles8ff6df52021-07-21 12:42:15 +0100420}
421
Gilles Peskine449bd832023-01-11 14:50:10 +0100422void mbedtls_lmots_public_free(mbedtls_lmots_public_t *ctx)
Raef Coles8ff6df52021-07-21 12:42:15 +0100423{
Gilles Peskine449bd832023-01-11 14:50:10 +0100424 mbedtls_platform_zeroize(ctx, sizeof(*ctx));
Raef Coles8ff6df52021-07-21 12:42:15 +0100425}
426
Gilles Peskine449bd832023-01-11 14:50:10 +0100427int mbedtls_lmots_import_public_key(mbedtls_lmots_public_t *ctx,
428 const unsigned char *key, size_t key_len)
Raef Coles8ff6df52021-07-21 12:42:15 +0100429{
Gilles Peskine449bd832023-01-11 14:50:10 +0100430 if (key_len < MBEDTLS_LMOTS_SIG_TYPE_OFFSET + MBEDTLS_LMOTS_TYPE_LEN) {
431 return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
Raef Colese89488d2022-10-07 16:06:35 +0100432 }
433
Raef Colesf5632d32022-09-01 09:56:52 +0100434 ctx->params.type =
Gilles Peskine449bd832023-01-11 14:50:10 +0100435 mbedtls_lms_network_bytes_to_unsigned_int(MBEDTLS_LMOTS_TYPE_LEN,
436 key + MBEDTLS_LMOTS_SIG_TYPE_OFFSET);
Raef Coles01c71a12022-08-31 15:55:00 +0100437
Gilles Peskine449bd832023-01-11 14:50:10 +0100438 if (key_len != MBEDTLS_LMOTS_PUBLIC_KEY_LEN(ctx->params.type)) {
439 return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
Raef Colese9479a02022-09-01 16:06:35 +0100440 }
441
Gilles Peskine449bd832023-01-11 14:50:10 +0100442 memcpy(ctx->params.I_key_identifier,
443 key + PUBLIC_KEY_I_KEY_ID_OFFSET,
444 MBEDTLS_LMOTS_I_KEY_ID_LEN);
Raef Coles01c71a12022-08-31 15:55:00 +0100445
Gilles Peskine449bd832023-01-11 14:50:10 +0100446 memcpy(ctx->params.q_leaf_identifier,
447 key + PUBLIC_KEY_Q_LEAF_ID_OFFSET,
448 MBEDTLS_LMOTS_Q_LEAF_ID_LEN);
Raef Coles01c71a12022-08-31 15:55:00 +0100449
Gilles Peskine449bd832023-01-11 14:50:10 +0100450 memcpy(ctx->public_key,
451 key + PUBLIC_KEY_KEY_HASH_OFFSET,
452 MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type));
Raef Coles01c71a12022-08-31 15:55:00 +0100453
Raef Colesf5632d32022-09-01 09:56:52 +0100454 ctx->have_public_key = 1;
Raef Coles8ff6df52021-07-21 12:42:15 +0100455
Gilles Peskine449bd832023-01-11 14:50:10 +0100456 return 0;
Raef Coles8ff6df52021-07-21 12:42:15 +0100457}
458
Gilles Peskine449bd832023-01-11 14:50:10 +0100459int mbedtls_lmots_export_public_key(const mbedtls_lmots_public_t *ctx,
460 unsigned char *key, size_t key_size,
461 size_t *key_len)
Raef Coles370cc432022-10-07 16:07:33 +0100462{
Gilles Peskine449bd832023-01-11 14:50:10 +0100463 if (key_size < MBEDTLS_LMOTS_PUBLIC_KEY_LEN(ctx->params.type)) {
464 return MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL;
Raef Coles370cc432022-10-07 16:07:33 +0100465 }
466
Gilles Peskine449bd832023-01-11 14:50:10 +0100467 if (!ctx->have_public_key) {
468 return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
Raef Coles370cc432022-10-07 16:07:33 +0100469 }
470
Gilles Peskine449bd832023-01-11 14:50:10 +0100471 mbedtls_lms_unsigned_int_to_network_bytes(ctx->params.type,
472 MBEDTLS_LMOTS_TYPE_LEN,
473 key + MBEDTLS_LMOTS_SIG_TYPE_OFFSET);
Raef Coles370cc432022-10-07 16:07:33 +0100474
Gilles Peskine449bd832023-01-11 14:50:10 +0100475 memcpy(key + PUBLIC_KEY_I_KEY_ID_OFFSET,
476 ctx->params.I_key_identifier,
477 MBEDTLS_LMOTS_I_KEY_ID_LEN);
Raef Coles370cc432022-10-07 16:07:33 +0100478
Gilles Peskine449bd832023-01-11 14:50:10 +0100479 memcpy(key + PUBLIC_KEY_Q_LEAF_ID_OFFSET,
480 ctx->params.q_leaf_identifier,
481 MBEDTLS_LMOTS_Q_LEAF_ID_LEN);
Raef Coles370cc432022-10-07 16:07:33 +0100482
Gilles Peskine449bd832023-01-11 14:50:10 +0100483 memcpy(key + PUBLIC_KEY_KEY_HASH_OFFSET, ctx->public_key,
484 MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type));
Raef Coles370cc432022-10-07 16:07:33 +0100485
Gilles Peskine449bd832023-01-11 14:50:10 +0100486 if (key_len != NULL) {
Raef Coles370cc432022-10-07 16:07:33 +0100487 *key_len = MBEDTLS_LMOTS_PUBLIC_KEY_LEN(ctx->params.type);
488 }
489
Gilles Peskine449bd832023-01-11 14:50:10 +0100490 return 0;
Raef Coles370cc432022-10-07 16:07:33 +0100491}
492
Gilles Peskine449bd832023-01-11 14:50:10 +0100493int mbedtls_lmots_calculate_public_key_candidate(const mbedtls_lmots_parameters_t *params,
494 const unsigned char *msg,
495 size_t msg_size,
496 const unsigned char *sig,
497 size_t sig_size,
498 unsigned char *out,
499 size_t out_size,
500 size_t *out_len)
Raef Coles8ff6df52021-07-21 12:42:15 +0100501{
Raef Colese9479a02022-09-01 16:06:35 +0100502 unsigned char tmp_digit_array[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX];
503 unsigned char y_hashed_digits[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX][MBEDTLS_LMOTS_N_HASH_LEN_MAX];
Raef Coles8ff6df52021-07-21 12:42:15 +0100504 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
505
Gilles Peskine449bd832023-01-11 14:50:10 +0100506 if (msg == NULL && msg_size != 0) {
507 return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
Raef Coles01c71a12022-08-31 15:55:00 +0100508 }
509
Gilles Peskine449bd832023-01-11 14:50:10 +0100510 if (sig_size != MBEDTLS_LMOTS_SIG_LEN(params->type) ||
511 out_size < MBEDTLS_LMOTS_N_HASH_LEN(params->type)) {
512 return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
Raef Coles8ff6df52021-07-21 12:42:15 +0100513 }
514
Gilles Peskine449bd832023-01-11 14:50:10 +0100515 ret = create_digit_array_with_checksum(params, msg, msg_size,
516 sig + MBEDTLS_LMOTS_SIG_C_RANDOM_OFFSET,
517 tmp_digit_array);
518 if (ret) {
519 return ret;
Raef Coles8ff6df52021-07-21 12:42:15 +0100520 }
521
Gilles Peskine449bd832023-01-11 14:50:10 +0100522 ret = hash_digit_array(params,
523 sig + MBEDTLS_LMOTS_SIG_SIGNATURE_OFFSET(params->type),
524 tmp_digit_array, NULL, (unsigned char *) y_hashed_digits);
525 if (ret) {
526 return ret;
Raef Coles8ff6df52021-07-21 12:42:15 +0100527 }
528
Gilles Peskine449bd832023-01-11 14:50:10 +0100529 ret = public_key_from_hashed_digit_array(params,
530 (unsigned char *) y_hashed_digits,
531 out);
532 if (ret) {
533 return ret;
Raef Coles8ff6df52021-07-21 12:42:15 +0100534 }
535
Gilles Peskine449bd832023-01-11 14:50:10 +0100536 if (out_len != NULL) {
Raef Colese9479a02022-09-01 16:06:35 +0100537 *out_len = MBEDTLS_LMOTS_N_HASH_LEN(params->type);
Raef Coles01c71a12022-08-31 15:55:00 +0100538 }
539
Gilles Peskine449bd832023-01-11 14:50:10 +0100540 return 0;
Raef Coles8ff6df52021-07-21 12:42:15 +0100541}
542
Gilles Peskine449bd832023-01-11 14:50:10 +0100543int mbedtls_lmots_verify(const mbedtls_lmots_public_t *ctx,
544 const unsigned char *msg, size_t msg_size,
545 const unsigned char *sig, size_t sig_size)
Raef Coles8ff6df52021-07-21 12:42:15 +0100546{
Raef Colese9479a02022-09-01 16:06:35 +0100547 unsigned char Kc_public_key_candidate[MBEDTLS_LMOTS_N_HASH_LEN_MAX];
Raef Coles8ff6df52021-07-21 12:42:15 +0100548 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
549
Gilles Peskine449bd832023-01-11 14:50:10 +0100550 if (msg == NULL && msg_size != 0) {
551 return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
Raef Coles01c71a12022-08-31 15:55:00 +0100552 }
553
Gilles Peskine449bd832023-01-11 14:50:10 +0100554 if (!ctx->have_public_key) {
555 return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
Raef Coles01c71a12022-08-31 15:55:00 +0100556 }
557
Gilles Peskine449bd832023-01-11 14:50:10 +0100558 if (ctx->params.type != MBEDTLS_LMOTS_SHA256_N32_W8) {
559 return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
Raef Coles01c71a12022-08-31 15:55:00 +0100560 }
561
Gilles Peskine449bd832023-01-11 14:50:10 +0100562 if (sig_size < MBEDTLS_LMOTS_SIG_TYPE_OFFSET + MBEDTLS_LMOTS_TYPE_LEN) {
563 return MBEDTLS_ERR_LMS_VERIFY_FAILED;
Raef Coles48294592022-10-10 16:40:00 +0100564 }
565
Gilles Peskine449bd832023-01-11 14:50:10 +0100566 if (mbedtls_lms_network_bytes_to_unsigned_int(MBEDTLS_LMOTS_TYPE_LEN,
567 sig + MBEDTLS_LMOTS_SIG_TYPE_OFFSET) !=
568 MBEDTLS_LMOTS_SHA256_N32_W8) {
569 return MBEDTLS_ERR_LMS_VERIFY_FAILED;
Raef Coles01c71a12022-08-31 15:55:00 +0100570 }
571
Gilles Peskine449bd832023-01-11 14:50:10 +0100572 ret = mbedtls_lmots_calculate_public_key_candidate(&ctx->params,
573 msg, msg_size, sig, sig_size,
574 Kc_public_key_candidate,
575 MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type),
576 NULL);
577 if (ret) {
578 return MBEDTLS_ERR_LMS_VERIFY_FAILED;
Raef Coles01c71a12022-08-31 15:55:00 +0100579 }
580
Gilles Peskine449bd832023-01-11 14:50:10 +0100581 if (memcmp(&Kc_public_key_candidate, ctx->public_key,
582 sizeof(ctx->public_key))) {
583 return MBEDTLS_ERR_LMS_VERIFY_FAILED;
Raef Coles01c71a12022-08-31 15:55:00 +0100584 }
585
Gilles Peskine449bd832023-01-11 14:50:10 +0100586 return 0;
Raef Coles01c71a12022-08-31 15:55:00 +0100587}
588
Raef Coles5127e852022-10-07 10:35:56 +0100589#if defined(MBEDTLS_LMS_PRIVATE)
Raef Colesab4f8742022-09-01 12:24:31 +0100590
Gilles Peskine449bd832023-01-11 14:50:10 +0100591void mbedtls_lmots_private_init(mbedtls_lmots_private_t *ctx)
Raef Coles01c71a12022-08-31 15:55:00 +0100592{
Gilles Peskine449bd832023-01-11 14:50:10 +0100593 memset(ctx, 0, sizeof(*ctx));
Raef Coles01c71a12022-08-31 15:55:00 +0100594}
595
Gilles Peskine449bd832023-01-11 14:50:10 +0100596void mbedtls_lmots_private_free(mbedtls_lmots_private_t *ctx)
Raef Coles01c71a12022-08-31 15:55:00 +0100597{
Gilles Peskine449bd832023-01-11 14:50:10 +0100598 mbedtls_platform_zeroize(ctx,
599 sizeof(*ctx));
Raef Coles01c71a12022-08-31 15:55:00 +0100600}
601
Gilles Peskine449bd832023-01-11 14:50:10 +0100602int mbedtls_lmots_generate_private_key(mbedtls_lmots_private_t *ctx,
603 mbedtls_lmots_algorithm_type_t type,
604 const unsigned char I_key_identifier[MBEDTLS_LMOTS_I_KEY_ID_LEN],
605 uint32_t q_leaf_identifier,
606 const unsigned char *seed,
607 size_t seed_size)
Raef Coles01c71a12022-08-31 15:55:00 +0100608{
Raef Colesbe0c2f92022-10-07 11:27:35 +0100609 psa_hash_operation_t op = PSA_HASH_OPERATION_INIT;
610 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Raef Coles01c71a12022-08-31 15:55:00 +0100611 size_t output_hash_len;
612 unsigned int i_digit_idx;
613 unsigned char i_digit_idx_bytes[2];
614 unsigned char const_bytes[1];
Raef Coles01c71a12022-08-31 15:55:00 +0100615
Gilles Peskine449bd832023-01-11 14:50:10 +0100616 if (ctx->have_private_key) {
617 return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
Raef Coles01c71a12022-08-31 15:55:00 +0100618 }
619
Gilles Peskine449bd832023-01-11 14:50:10 +0100620 if (type != MBEDTLS_LMOTS_SHA256_N32_W8) {
621 return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
Raef Coles01c71a12022-08-31 15:55:00 +0100622 }
623
Raef Colesf5632d32022-09-01 09:56:52 +0100624 ctx->params.type = type;
Raef Coles01c71a12022-08-31 15:55:00 +0100625
Gilles Peskine449bd832023-01-11 14:50:10 +0100626 memcpy(ctx->params.I_key_identifier,
627 I_key_identifier,
628 sizeof(ctx->params.I_key_identifier));
Raef Coles01c71a12022-08-31 15:55:00 +0100629
Gilles Peskine449bd832023-01-11 14:50:10 +0100630 mbedtls_lms_unsigned_int_to_network_bytes(q_leaf_identifier,
631 MBEDTLS_LMOTS_Q_LEAF_ID_LEN,
632 ctx->params.q_leaf_identifier);
Raef Coles01c71a12022-08-31 15:55:00 +0100633
Gilles Peskine449bd832023-01-11 14:50:10 +0100634 mbedtls_lms_unsigned_int_to_network_bytes(0xFF, sizeof(const_bytes),
635 const_bytes);
Raef Coles01c71a12022-08-31 15:55:00 +0100636
Gilles Peskine449bd832023-01-11 14:50:10 +0100637 for (i_digit_idx = 0;
638 i_digit_idx < MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(ctx->params.type);
639 i_digit_idx++) {
640 status = psa_hash_setup(&op, PSA_ALG_SHA_256);
641 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100642 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100643 }
Raef Coles01c71a12022-08-31 15:55:00 +0100644
Gilles Peskine449bd832023-01-11 14:50:10 +0100645 status = psa_hash_update(&op,
646 ctx->params.I_key_identifier,
647 sizeof(ctx->params.I_key_identifier));
648 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100649 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100650 }
Raef Coles01c71a12022-08-31 15:55:00 +0100651
Gilles Peskine449bd832023-01-11 14:50:10 +0100652 status = psa_hash_update(&op,
653 ctx->params.q_leaf_identifier,
654 MBEDTLS_LMOTS_Q_LEAF_ID_LEN);
655 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100656 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100657 }
Raef Coles01c71a12022-08-31 15:55:00 +0100658
Gilles Peskine449bd832023-01-11 14:50:10 +0100659 mbedtls_lms_unsigned_int_to_network_bytes(i_digit_idx, I_DIGIT_IDX_LEN,
660 i_digit_idx_bytes);
661 status = psa_hash_update(&op, i_digit_idx_bytes, I_DIGIT_IDX_LEN);
662 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100663 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100664 }
Raef Coles01c71a12022-08-31 15:55:00 +0100665
Gilles Peskine449bd832023-01-11 14:50:10 +0100666 status = psa_hash_update(&op, const_bytes, sizeof(const_bytes));
667 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100668 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100669 }
Raef Coles01c71a12022-08-31 15:55:00 +0100670
Gilles Peskine449bd832023-01-11 14:50:10 +0100671 status = psa_hash_update(&op, seed, seed_size);
672 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100673 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100674 }
Raef Coles01c71a12022-08-31 15:55:00 +0100675
Gilles Peskine449bd832023-01-11 14:50:10 +0100676 status = psa_hash_finish(&op,
677 ctx->private_key[i_digit_idx],
678 MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type),
679 &output_hash_len);
680 if (status != PSA_SUCCESS) {
Raef Coles01c71a12022-08-31 15:55:00 +0100681 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100682 }
Raef Coles01c71a12022-08-31 15:55:00 +0100683
Gilles Peskine449bd832023-01-11 14:50:10 +0100684 psa_hash_abort(&op);
Raef Coles01c71a12022-08-31 15:55:00 +0100685 }
686
Raef Colesf5632d32022-09-01 09:56:52 +0100687 ctx->have_private_key = 1;
Raef Coles01c71a12022-08-31 15:55:00 +0100688
689exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100690 psa_hash_abort(&op);
Raef Coles01c71a12022-08-31 15:55:00 +0100691
Andrzej Kurek8a045ce2022-12-23 11:00:06 -0500692 return PSA_TO_MBEDTLS_ERR(status);
Raef Coles01c71a12022-08-31 15:55:00 +0100693}
694
Gilles Peskine449bd832023-01-11 14:50:10 +0100695int mbedtls_lmots_calculate_public_key(mbedtls_lmots_public_t *ctx,
696 const mbedtls_lmots_private_t *priv_ctx)
Raef Coles01c71a12022-08-31 15:55:00 +0100697{
Raef Colese9479a02022-09-01 16:06:35 +0100698 unsigned char y_hashed_digits[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX][MBEDTLS_LMOTS_N_HASH_LEN_MAX];
Raef Coles01c71a12022-08-31 15:55:00 +0100699 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
700
Raef Coles8ff6df52021-07-21 12:42:15 +0100701 /* Check that a private key is loaded */
Gilles Peskine449bd832023-01-11 14:50:10 +0100702 if (!priv_ctx->have_private_key) {
703 return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
Raef Coles01c71a12022-08-31 15:55:00 +0100704 }
705
Gilles Peskine449bd832023-01-11 14:50:10 +0100706 ret = hash_digit_array(&priv_ctx->params,
707 (unsigned char *) priv_ctx->private_key, NULL,
708 NULL, (unsigned char *) y_hashed_digits);
709 if (ret) {
Raef Coles142e5772022-10-12 10:47:27 +0100710 goto exit;
Raef Coles01c71a12022-08-31 15:55:00 +0100711 }
712
Gilles Peskine449bd832023-01-11 14:50:10 +0100713 ret = public_key_from_hashed_digit_array(&priv_ctx->params,
714 (unsigned char *) y_hashed_digits,
715 ctx->public_key);
716 if (ret) {
Raef Coles142e5772022-10-12 10:47:27 +0100717 goto exit;
Raef Coles01c71a12022-08-31 15:55:00 +0100718 }
719
Gilles Peskine449bd832023-01-11 14:50:10 +0100720 memcpy(&ctx->params, &priv_ctx->params,
721 sizeof(ctx->params));
Raef Coles01c71a12022-08-31 15:55:00 +0100722
Raef Coles9b88ee52022-09-02 12:04:21 +0100723 ctx->have_public_key = 1;
Raef Coles01c71a12022-08-31 15:55:00 +0100724
Raef Coles142e5772022-10-12 10:47:27 +0100725exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100726 mbedtls_platform_zeroize(y_hashed_digits, sizeof(y_hashed_digits));
Raef Coles142e5772022-10-12 10:47:27 +0100727
Gilles Peskine449bd832023-01-11 14:50:10 +0100728 return ret;
Raef Coles01c71a12022-08-31 15:55:00 +0100729}
730
Gilles Peskine449bd832023-01-11 14:50:10 +0100731int mbedtls_lmots_sign(mbedtls_lmots_private_t *ctx,
732 int (*f_rng)(void *, unsigned char *, size_t),
733 void *p_rng, const unsigned char *msg, size_t msg_size,
734 unsigned char *sig, size_t sig_size, size_t *sig_len)
Raef Coles01c71a12022-08-31 15:55:00 +0100735{
Raef Colese9479a02022-09-01 16:06:35 +0100736 unsigned char tmp_digit_array[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX];
Raef Coles891c6132022-09-01 11:05:48 +0100737 /* Create a temporary buffer to prepare the signature in. This allows us to
738 * finish creating a signature (ensuring the process doesn't fail), and then
739 * erase the private key **before** writing any data into the sig parameter
740 * buffer. If data were directly written into the sig buffer, it might leak
741 * a partial signature on failure, which effectively compromises the private
742 * key.
743 */
Raef Colese9479a02022-09-01 16:06:35 +0100744 unsigned char tmp_sig[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX][MBEDTLS_LMOTS_N_HASH_LEN_MAX];
Raef Colesd48f7e92022-10-10 13:10:07 +0100745 unsigned char tmp_c_random[MBEDTLS_LMOTS_N_HASH_LEN_MAX];
Raef Coles01c71a12022-08-31 15:55:00 +0100746 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
747
Gilles Peskine449bd832023-01-11 14:50:10 +0100748 if (msg == NULL && msg_size != 0) {
749 return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
Raef Coles01c71a12022-08-31 15:55:00 +0100750 }
751
Gilles Peskine449bd832023-01-11 14:50:10 +0100752 if (sig_size < MBEDTLS_LMOTS_SIG_LEN(ctx->params.type)) {
753 return MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL;
Raef Coles01c71a12022-08-31 15:55:00 +0100754 }
755
756 /* Check that a private key is loaded */
Gilles Peskine449bd832023-01-11 14:50:10 +0100757 if (!ctx->have_private_key) {
758 return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
Raef Coles8ff6df52021-07-21 12:42:15 +0100759 }
760
Gilles Peskine449bd832023-01-11 14:50:10 +0100761 ret = f_rng(p_rng, tmp_c_random,
762 MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type));
763 if (ret) {
764 return ret;
Raef Coles8ff6df52021-07-21 12:42:15 +0100765 }
766
Gilles Peskine449bd832023-01-11 14:50:10 +0100767 ret = create_digit_array_with_checksum(&ctx->params,
768 msg, msg_size,
769 tmp_c_random,
770 tmp_digit_array);
771 if (ret) {
Raef Coles142e5772022-10-12 10:47:27 +0100772 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100773 }
774
Gilles Peskine449bd832023-01-11 14:50:10 +0100775 ret = hash_digit_array(&ctx->params, (unsigned char *) ctx->private_key,
776 NULL, tmp_digit_array, (unsigned char *) tmp_sig);
777 if (ret) {
Raef Coles142e5772022-10-12 10:47:27 +0100778 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100779 }
780
Gilles Peskine449bd832023-01-11 14:50:10 +0100781 mbedtls_lms_unsigned_int_to_network_bytes(ctx->params.type,
782 MBEDTLS_LMOTS_TYPE_LEN,
783 sig + MBEDTLS_LMOTS_SIG_TYPE_OFFSET);
Raef Coles8ff6df52021-07-21 12:42:15 +0100784
Raef Coles9c9027b2022-09-02 18:26:31 +0100785 /* Test hook to check if sig is being written to before we invalidate the
786 * private key.
787 */
788#if defined(MBEDTLS_TEST_HOOKS)
Gilles Peskine449bd832023-01-11 14:50:10 +0100789 if (mbedtls_lmots_sign_private_key_invalidated_hook != NULL) {
790 ret = (*mbedtls_lmots_sign_private_key_invalidated_hook)(sig);
791 if (ret != 0) {
792 return ret;
793 }
Raef Coles9c9027b2022-09-02 18:26:31 +0100794 }
795#endif /* defined(MBEDTLS_TEST_HOOKS) */
796
Raef Coles8ff6df52021-07-21 12:42:15 +0100797 /* We've got a valid signature now, so it's time to make sure the private
798 * key can't be reused.
799 */
Raef Colesf5632d32022-09-01 09:56:52 +0100800 ctx->have_private_key = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +0100801 mbedtls_platform_zeroize(ctx->private_key,
802 sizeof(ctx->private_key));
Raef Coles8ff6df52021-07-21 12:42:15 +0100803
Gilles Peskine449bd832023-01-11 14:50:10 +0100804 memcpy(sig + MBEDTLS_LMOTS_SIG_C_RANDOM_OFFSET, tmp_c_random,
805 MBEDTLS_LMOTS_C_RANDOM_VALUE_LEN(ctx->params.type));
Raef Coles891c6132022-09-01 11:05:48 +0100806
Gilles Peskine449bd832023-01-11 14:50:10 +0100807 memcpy(sig + MBEDTLS_LMOTS_SIG_SIGNATURE_OFFSET(ctx->params.type), tmp_sig,
808 MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(ctx->params.type)
809 * MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type));
Raef Coles8ff6df52021-07-21 12:42:15 +0100810
Gilles Peskine449bd832023-01-11 14:50:10 +0100811 if (sig_len != NULL) {
Raef Colese9479a02022-09-01 16:06:35 +0100812 *sig_len = MBEDTLS_LMOTS_SIG_LEN(ctx->params.type);
Raef Coles8ff6df52021-07-21 12:42:15 +0100813 }
814
Raef Coles142e5772022-10-12 10:47:27 +0100815 ret = 0;
816
817exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100818 mbedtls_platform_zeroize(tmp_digit_array, sizeof(tmp_digit_array));
819 mbedtls_platform_zeroize(tmp_sig, sizeof(tmp_sig));
Raef Coles142e5772022-10-12 10:47:27 +0100820
Gilles Peskine449bd832023-01-11 14:50:10 +0100821 return ret;
Raef Coles8ff6df52021-07-21 12:42:15 +0100822}
823
Raef Coles5127e852022-10-07 10:35:56 +0100824#endif /* defined(MBEDTLS_LMS_PRIVATE) */
825#endif /* defined(MBEDTLS_LMS_C) */