Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 1 | /* |
| 2 | * The LM-OTS one-time public-key signature scheme |
| 3 | * |
| 4 | * Copyright The Mbed TLS Contributors |
| 5 | * SPDX-License-Identifier: Apache-2.0 |
| 6 | * |
| 7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 8 | * not use this file except in compliance with the License. |
| 9 | * You may obtain a copy of the License at |
| 10 | * |
| 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 12 | * |
| 13 | * Unless required by applicable law or agreed to in writing, software |
| 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 16 | * See the License for the specific language governing permissions and |
| 17 | * limitations under the License. |
| 18 | */ |
| 19 | |
| 20 | /* |
| 21 | * The following sources were referenced in the design of this implementation |
| 22 | * of the LM-OTS algorithm: |
| 23 | * |
| 24 | * [1] IETF RFC8554 |
| 25 | * D. McGrew, M. Curcio, S.Fluhrer |
| 26 | * https://datatracker.ietf.org/doc/html/rfc8554 |
| 27 | * |
| 28 | * [2] NIST Special Publication 800-208 |
| 29 | * David A. Cooper et. al. |
| 30 | * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-208.pdf |
| 31 | */ |
| 32 | |
| 33 | #include "common.h" |
| 34 | |
Raef Coles | 5127e85 | 2022-10-07 10:35:56 +0100 | [diff] [blame] | 35 | #if defined(MBEDTLS_LMS_C) |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 36 | |
| 37 | #include <string.h> |
| 38 | |
Raef Coles | 7dce69a | 2022-08-24 14:07:06 +0100 | [diff] [blame] | 39 | #include "lmots.h" |
| 40 | |
Raef Coles | c8f9604 | 2022-08-25 13:49:54 +0100 | [diff] [blame] | 41 | #include "mbedtls/lms.h" |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 42 | #include "mbedtls/platform_util.h" |
| 43 | #include "mbedtls/error.h" |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame^] | 44 | #include "mbedtls/psa_util.h" |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 45 | |
Raef Coles | c8f9604 | 2022-08-25 13:49:54 +0100 | [diff] [blame] | 46 | #include "psa/crypto.h" |
| 47 | |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame^] | 48 | #define PSA_TO_MBEDTLS_ERR(status) PSA_TO_MBEDTLS_ERR_LIST(status, \ |
| 49 | psa_to_lms_errors, \ |
| 50 | psa_generic_status_to_mbedtls) |
| 51 | |
Raef Coles | 57d5328 | 2022-09-27 11:30:51 +0100 | [diff] [blame] | 52 | #define PUBLIC_KEY_TYPE_OFFSET (0) |
| 53 | #define PUBLIC_KEY_I_KEY_ID_OFFSET (PUBLIC_KEY_TYPE_OFFSET + \ |
| 54 | MBEDTLS_LMOTS_TYPE_LEN) |
| 55 | #define PUBLIC_KEY_Q_LEAF_ID_OFFSET (PUBLIC_KEY_I_KEY_ID_OFFSET + \ |
| 56 | MBEDTLS_LMOTS_I_KEY_ID_LEN) |
| 57 | #define PUBLIC_KEY_KEY_HASH_OFFSET (PUBLIC_KEY_Q_LEAF_ID_OFFSET + \ |
| 58 | MBEDTLS_LMOTS_Q_LEAF_ID_LEN) |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 59 | |
| 60 | /* We only support parameter sets that use 8-bit digits, as it does not require |
| 61 | * translation logic between digits and bytes */ |
| 62 | #define W_WINTERNITZ_PARAMETER (8u) |
| 63 | #define CHECKSUM_LEN (2) |
| 64 | #define I_DIGIT_IDX_LEN (2) |
| 65 | #define J_HASH_IDX_LEN (1) |
| 66 | #define D_CONST_LEN (2) |
| 67 | |
Raef Coles | 9b88ee5 | 2022-09-02 12:04:21 +0100 | [diff] [blame] | 68 | #define DIGIT_MAX_VALUE ((1u << W_WINTERNITZ_PARAMETER) - 1u) |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 69 | |
Raef Coles | 9b88ee5 | 2022-09-02 12:04:21 +0100 | [diff] [blame] | 70 | #define D_CONST_LEN (2) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 71 | static const unsigned char D_PUBLIC_CONSTANT_BYTES[D_CONST_LEN] = { 0x80, 0x80 }; |
| 72 | static const unsigned char D_MESSAGE_CONSTANT_BYTES[D_CONST_LEN] = { 0x81, 0x81 }; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 73 | |
Raef Coles | 9c9027b | 2022-09-02 18:26:31 +0100 | [diff] [blame] | 74 | #if defined(MBEDTLS_TEST_HOOKS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 75 | int (*mbedtls_lmots_sign_private_key_invalidated_hook)(unsigned char *) = NULL; |
Raef Coles | 9c9027b | 2022-09-02 18:26:31 +0100 | [diff] [blame] | 76 | #endif /* defined(MBEDTLS_TEST_HOOKS) */ |
| 77 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 78 | void mbedtls_lms_unsigned_int_to_network_bytes(unsigned int val, size_t len, |
| 79 | unsigned char *bytes) |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 80 | { |
| 81 | size_t idx; |
| 82 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 83 | for (idx = 0; idx < len; idx++) { |
| 84 | bytes[idx] = (val >> ((len - 1 - idx) * 8)) & 0xFF; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 85 | } |
| 86 | } |
| 87 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 88 | unsigned int mbedtls_lms_network_bytes_to_unsigned_int(size_t len, |
| 89 | const unsigned char *bytes) |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 90 | { |
| 91 | size_t idx; |
| 92 | unsigned int val = 0; |
| 93 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 94 | for (idx = 0; idx < len; idx++) { |
| 95 | val |= ((unsigned int) bytes[idx]) << (8 * (len - 1 - idx)); |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 96 | } |
| 97 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 98 | return val; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 99 | } |
| 100 | |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 101 | /* Calculate the checksum digits that are appended to the end of the LMOTS digit |
| 102 | * string. See NIST SP800-208 section 3.1 or RFC8554 Algorithm 2 for details of |
| 103 | * the checksum algorithm. |
| 104 | * |
Raef Coles | 98d6e22 | 2022-09-23 09:04:04 +0100 | [diff] [blame] | 105 | * params The LMOTS parameter set, I and q values which |
| 106 | * describe the key being used. |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 107 | * |
Raef Coles | 98d6e22 | 2022-09-23 09:04:04 +0100 | [diff] [blame] | 108 | * digest The digit string to create the digest from. As |
| 109 | * this does not contain a checksum, it is the same |
| 110 | * size as a hash output. |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 111 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 112 | static unsigned short lmots_checksum_calculate(const mbedtls_lmots_parameters_t *params, |
| 113 | const unsigned char *digest) |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 114 | { |
| 115 | size_t idx; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 116 | unsigned sum = 0; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 117 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 118 | for (idx = 0; idx < MBEDTLS_LMOTS_N_HASH_LEN(params->type); idx++) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 119 | sum += DIGIT_MAX_VALUE - digest[idx]; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 120 | } |
| 121 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 122 | return sum; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 123 | } |
| 124 | |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 125 | /* Create the string of digest digits (in the base determined by the Winternitz |
| 126 | * parameter with the checksum appended to the end (Q || cksm(Q)). See NIST |
| 127 | * SP800-208 section 3.1 or RFC8554 Algorithm 3 step 5 (also used in Algorithm |
| 128 | * 4b step 3) for details. |
| 129 | * |
Raef Coles | 98d6e22 | 2022-09-23 09:04:04 +0100 | [diff] [blame] | 130 | * params The LMOTS parameter set, I and q values which |
| 131 | * describe the key being used. |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 132 | * |
Raef Coles | 98d6e22 | 2022-09-23 09:04:04 +0100 | [diff] [blame] | 133 | * msg The message that will be hashed to create the |
| 134 | * digest. |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 135 | * |
Raef Coles | 98d6e22 | 2022-09-23 09:04:04 +0100 | [diff] [blame] | 136 | * msg_size The size of the message. |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 137 | * |
Raef Coles | 98d6e22 | 2022-09-23 09:04:04 +0100 | [diff] [blame] | 138 | * C_random_value The random value that will be combined with the |
| 139 | * message digest. This is always the same size as a |
| 140 | * hash output for whichever hash algorithm is |
| 141 | * determined by the parameter set. |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 142 | * |
Raef Coles | 98d6e22 | 2022-09-23 09:04:04 +0100 | [diff] [blame] | 143 | * output An output containing the digit string (+ |
| 144 | * checksum) of length P digits (in the case of |
| 145 | * MBEDTLS_LMOTS_SHA256_N32_W8, this means it is of |
| 146 | * size P bytes). |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 147 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 148 | static int create_digit_array_with_checksum(const mbedtls_lmots_parameters_t *params, |
| 149 | const unsigned char *msg, |
| 150 | size_t msg_len, |
| 151 | const unsigned char *C_random_value, |
| 152 | unsigned char *out) |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 153 | { |
Raef Coles | be0c2f9 | 2022-10-07 11:27:35 +0100 | [diff] [blame] | 154 | psa_hash_operation_t op = PSA_HASH_OPERATION_INIT; |
| 155 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Raef Coles | c8f9604 | 2022-08-25 13:49:54 +0100 | [diff] [blame] | 156 | size_t output_hash_len; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 157 | unsigned short checksum; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 158 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 159 | status = psa_hash_setup(&op, PSA_ALG_SHA_256); |
| 160 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 161 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 162 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 163 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 164 | status = psa_hash_update(&op, params->I_key_identifier, |
| 165 | MBEDTLS_LMOTS_I_KEY_ID_LEN); |
| 166 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 167 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 168 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 169 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 170 | status = psa_hash_update(&op, params->q_leaf_identifier, |
| 171 | MBEDTLS_LMOTS_Q_LEAF_ID_LEN); |
| 172 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 173 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 174 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 175 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 176 | status = psa_hash_update(&op, D_MESSAGE_CONSTANT_BYTES, D_CONST_LEN); |
| 177 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 178 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 179 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 180 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 181 | status = psa_hash_update(&op, C_random_value, |
| 182 | MBEDTLS_LMOTS_C_RANDOM_VALUE_LEN(params->type)); |
| 183 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 184 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 185 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 186 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 187 | status = psa_hash_update(&op, msg, msg_len); |
| 188 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 189 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 190 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 191 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 192 | status = psa_hash_finish(&op, out, |
| 193 | MBEDTLS_LMOTS_N_HASH_LEN(params->type), |
| 194 | &output_hash_len); |
| 195 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 196 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 197 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 198 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 199 | checksum = lmots_checksum_calculate(params, out); |
| 200 | mbedtls_lms_unsigned_int_to_network_bytes(checksum, CHECKSUM_LEN, |
| 201 | out + MBEDTLS_LMOTS_N_HASH_LEN(params->type)); |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 202 | |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 203 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 204 | psa_hash_abort(&op); |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 205 | |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame^] | 206 | return PSA_TO_MBEDTLS_ERR(status); |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 207 | } |
| 208 | |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 209 | /* Hash each element of the string of digits (+ checksum), producing a hash |
| 210 | * output for each element. This is used in several places (by varying the |
| 211 | * hash_idx_min/max_values) in order to calculate a public key from a private |
| 212 | * key (RFC8554 Algorithm 1 step 4), in order to sign a message (RFC8554 |
| 213 | * Algorithm 3 step 5), and to calculate a public key candidate from a |
| 214 | * signature and message (RFC8554 Algorithm 4b step 3). |
| 215 | * |
Raef Coles | 98d6e22 | 2022-09-23 09:04:04 +0100 | [diff] [blame] | 216 | * params The LMOTS parameter set, I and q values which |
| 217 | * describe the key being used. |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 218 | * |
Raef Coles | 98d6e22 | 2022-09-23 09:04:04 +0100 | [diff] [blame] | 219 | * x_digit_array The array of digits (of size P, 34 in the case of |
| 220 | * MBEDTLS_LMOTS_SHA256_N32_W8). |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 221 | * |
Raef Coles | 98d6e22 | 2022-09-23 09:04:04 +0100 | [diff] [blame] | 222 | * hash_idx_min_values An array of the starting values of the j iterator |
| 223 | * for each of the members of the digit array. If |
| 224 | * this value in NULL, then all iterators will start |
| 225 | * at 0. |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 226 | * |
Raef Coles | 98d6e22 | 2022-09-23 09:04:04 +0100 | [diff] [blame] | 227 | * hash_idx_max_values An array of the upper bound values of the j |
| 228 | * iterator for each of the members of the digit |
| 229 | * array. If this value in NULL, then iterator is |
| 230 | * bounded to be less than 2^w - 1 (255 in the case |
| 231 | * of MBEDTLS_LMOTS_SHA256_N32_W8) |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 232 | * |
Raef Coles | 98d6e22 | 2022-09-23 09:04:04 +0100 | [diff] [blame] | 233 | * output An array containing a hash output for each member |
| 234 | * of the digit string P. In the case of |
| 235 | * MBEDTLS_LMOTS_SHA256_N32_W8, this is of size 32 * |
| 236 | * 34. |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 237 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 238 | static int hash_digit_array(const mbedtls_lmots_parameters_t *params, |
| 239 | const unsigned char *x_digit_array, |
| 240 | const unsigned char *hash_idx_min_values, |
| 241 | const unsigned char *hash_idx_max_values, |
| 242 | unsigned char *output) |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 243 | { |
Raef Coles | 8738a49 | 2022-09-02 17:13:01 +0100 | [diff] [blame] | 244 | unsigned int i_digit_idx; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 245 | unsigned char i_digit_idx_bytes[I_DIGIT_IDX_LEN]; |
Raef Coles | 8738a49 | 2022-09-02 17:13:01 +0100 | [diff] [blame] | 246 | unsigned int j_hash_idx; |
| 247 | unsigned char j_hash_idx_bytes[J_HASH_IDX_LEN]; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 248 | unsigned int j_hash_idx_min; |
| 249 | unsigned int j_hash_idx_max; |
Raef Coles | be0c2f9 | 2022-10-07 11:27:35 +0100 | [diff] [blame] | 250 | psa_hash_operation_t op = PSA_HASH_OPERATION_INIT; |
| 251 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Raef Coles | c8f9604 | 2022-08-25 13:49:54 +0100 | [diff] [blame] | 252 | size_t output_hash_len; |
Raef Coles | e9479a0 | 2022-09-01 16:06:35 +0100 | [diff] [blame] | 253 | unsigned char tmp_hash[MBEDTLS_LMOTS_N_HASH_LEN_MAX]; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 254 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 255 | for (i_digit_idx = 0; |
| 256 | i_digit_idx < MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(params->type); |
| 257 | i_digit_idx++) { |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 258 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 259 | memcpy(tmp_hash, |
| 260 | &x_digit_array[i_digit_idx * MBEDTLS_LMOTS_N_HASH_LEN(params->type)], |
| 261 | MBEDTLS_LMOTS_N_HASH_LEN(params->type)); |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 262 | |
Raef Coles | 366d67d | 2022-09-01 17:23:12 +0100 | [diff] [blame] | 263 | j_hash_idx_min = hash_idx_min_values != NULL ? |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 264 | hash_idx_min_values[i_digit_idx] : 0; |
Raef Coles | 366d67d | 2022-09-01 17:23:12 +0100 | [diff] [blame] | 265 | j_hash_idx_max = hash_idx_max_values != NULL ? |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 266 | hash_idx_max_values[i_digit_idx] : DIGIT_MAX_VALUE; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 267 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 268 | for (j_hash_idx = j_hash_idx_min; |
| 269 | j_hash_idx < j_hash_idx_max; |
| 270 | j_hash_idx++) { |
| 271 | status = psa_hash_setup(&op, PSA_ALG_SHA_256); |
| 272 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 273 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 274 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 275 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 276 | status = psa_hash_update(&op, |
| 277 | params->I_key_identifier, |
| 278 | MBEDTLS_LMOTS_I_KEY_ID_LEN); |
| 279 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 280 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 281 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 282 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 283 | status = psa_hash_update(&op, |
| 284 | params->q_leaf_identifier, |
| 285 | MBEDTLS_LMOTS_Q_LEAF_ID_LEN); |
| 286 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 287 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 288 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 289 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 290 | mbedtls_lms_unsigned_int_to_network_bytes(i_digit_idx, |
| 291 | I_DIGIT_IDX_LEN, |
| 292 | i_digit_idx_bytes); |
| 293 | status = psa_hash_update(&op, i_digit_idx_bytes, I_DIGIT_IDX_LEN); |
| 294 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 295 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 296 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 297 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 298 | mbedtls_lms_unsigned_int_to_network_bytes(j_hash_idx, |
| 299 | J_HASH_IDX_LEN, |
| 300 | j_hash_idx_bytes); |
| 301 | status = psa_hash_update(&op, j_hash_idx_bytes, J_HASH_IDX_LEN); |
| 302 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 303 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 304 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 305 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 306 | status = psa_hash_update(&op, tmp_hash, |
| 307 | MBEDTLS_LMOTS_N_HASH_LEN(params->type)); |
| 308 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 309 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 310 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 311 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 312 | status = psa_hash_finish(&op, tmp_hash, sizeof(tmp_hash), |
| 313 | &output_hash_len); |
| 314 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 315 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 316 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 317 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 318 | psa_hash_abort(&op); |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 319 | } |
| 320 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 321 | memcpy(&output[i_digit_idx * MBEDTLS_LMOTS_N_HASH_LEN(params->type)], |
| 322 | tmp_hash, MBEDTLS_LMOTS_N_HASH_LEN(params->type)); |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 323 | } |
| 324 | |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 325 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 326 | psa_hash_abort(&op); |
| 327 | mbedtls_platform_zeroize(tmp_hash, sizeof(tmp_hash)); |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 328 | |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame^] | 329 | return PSA_TO_MBEDTLS_ERR(status); |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 330 | } |
| 331 | |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 332 | /* Combine the hashes of the digit array into a public key. This is used in |
| 333 | * in order to calculate a public key from a private key (RFC8554 Algorithm 1 |
| 334 | * step 4), and to calculate a public key candidate from a signature and message |
| 335 | * (RFC8554 Algorithm 4b step 3). |
| 336 | * |
Raef Coles | 98d6e22 | 2022-09-23 09:04:04 +0100 | [diff] [blame] | 337 | * params The LMOTS parameter set, I and q values which describe |
| 338 | * the key being used. |
| 339 | * y_hashed_digits The array of hashes, one hash for each digit of the |
| 340 | * symbol array (which is of size P, 34 in the case of |
| 341 | * MBEDTLS_LMOTS_SHA256_N32_W8) |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 342 | * |
Raef Coles | 98d6e22 | 2022-09-23 09:04:04 +0100 | [diff] [blame] | 343 | * pub_key The output public key (or candidate public key in |
| 344 | * case this is being run as part of signature |
| 345 | * verification), in the form of a hash output. |
Raef Coles | 0a967cc | 2022-09-02 17:46:15 +0100 | [diff] [blame] | 346 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 347 | static int public_key_from_hashed_digit_array(const mbedtls_lmots_parameters_t *params, |
| 348 | const unsigned char *y_hashed_digits, |
| 349 | unsigned char *pub_key) |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 350 | { |
Raef Coles | be0c2f9 | 2022-10-07 11:27:35 +0100 | [diff] [blame] | 351 | psa_hash_operation_t op = PSA_HASH_OPERATION_INIT; |
| 352 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Raef Coles | c8f9604 | 2022-08-25 13:49:54 +0100 | [diff] [blame] | 353 | size_t output_hash_len; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 354 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 355 | status = psa_hash_setup(&op, PSA_ALG_SHA_256); |
| 356 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 357 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 358 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 359 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 360 | status = psa_hash_update(&op, |
| 361 | params->I_key_identifier, |
| 362 | MBEDTLS_LMOTS_I_KEY_ID_LEN); |
| 363 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 364 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 365 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 366 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 367 | status = psa_hash_update(&op, params->q_leaf_identifier, |
| 368 | MBEDTLS_LMOTS_Q_LEAF_ID_LEN); |
| 369 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 370 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 371 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 372 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 373 | status = psa_hash_update(&op, D_PUBLIC_CONSTANT_BYTES, D_CONST_LEN); |
| 374 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 375 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 376 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 377 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 378 | status = psa_hash_update(&op, y_hashed_digits, |
| 379 | MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(params->type) * |
| 380 | MBEDTLS_LMOTS_N_HASH_LEN(params->type)); |
| 381 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 382 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 383 | } |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 384 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 385 | status = psa_hash_finish(&op, pub_key, |
| 386 | MBEDTLS_LMOTS_N_HASH_LEN(params->type), |
| 387 | &output_hash_len); |
| 388 | if (status != PSA_SUCCESS) { |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 389 | |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 390 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 391 | psa_hash_abort(&op); |
| 392 | } |
Raef Coles | 29117d2 | 2022-10-07 11:46:06 +0100 | [diff] [blame] | 393 | |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame^] | 394 | return PSA_TO_MBEDTLS_ERR(status); |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 395 | } |
| 396 | |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame^] | 397 | #if !defined(MBEDTLS_DEPRECATED_REMOVED) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 398 | int mbedtls_lms_error_from_psa(psa_status_t status) |
Raef Coles | c8f9604 | 2022-08-25 13:49:54 +0100 | [diff] [blame] | 399 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 400 | switch (status) { |
Raef Coles | c8f9604 | 2022-08-25 13:49:54 +0100 | [diff] [blame] | 401 | case PSA_SUCCESS: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 402 | return 0; |
Raef Coles | c8f9604 | 2022-08-25 13:49:54 +0100 | [diff] [blame] | 403 | case PSA_ERROR_HARDWARE_FAILURE: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 404 | return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED; |
Raef Coles | c8f9604 | 2022-08-25 13:49:54 +0100 | [diff] [blame] | 405 | case PSA_ERROR_NOT_SUPPORTED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 406 | return MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED; |
Raef Coles | c8f9604 | 2022-08-25 13:49:54 +0100 | [diff] [blame] | 407 | case PSA_ERROR_BUFFER_TOO_SMALL: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 408 | return MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL; |
Raef Coles | c8f9604 | 2022-08-25 13:49:54 +0100 | [diff] [blame] | 409 | case PSA_ERROR_INVALID_ARGUMENT: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 410 | return MBEDTLS_ERR_LMS_BAD_INPUT_DATA; |
Raef Coles | c8f9604 | 2022-08-25 13:49:54 +0100 | [diff] [blame] | 411 | default: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 412 | return MBEDTLS_ERR_ERROR_GENERIC_ERROR; |
Raef Coles | c8f9604 | 2022-08-25 13:49:54 +0100 | [diff] [blame] | 413 | } |
| 414 | } |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame^] | 415 | #endif /* !MBEDTLS_DEPRECATED_REMOVED */ |
Raef Coles | c8f9604 | 2022-08-25 13:49:54 +0100 | [diff] [blame] | 416 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 417 | void mbedtls_lmots_public_init(mbedtls_lmots_public_t *ctx) |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 418 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 419 | memset(ctx, 0, sizeof(*ctx)); |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 420 | } |
| 421 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 422 | void mbedtls_lmots_public_free(mbedtls_lmots_public_t *ctx) |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 423 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 424 | mbedtls_platform_zeroize(ctx, sizeof(*ctx)); |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 425 | } |
| 426 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 427 | int mbedtls_lmots_import_public_key(mbedtls_lmots_public_t *ctx, |
| 428 | const unsigned char *key, size_t key_len) |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 429 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 430 | if (key_len < MBEDTLS_LMOTS_SIG_TYPE_OFFSET + MBEDTLS_LMOTS_TYPE_LEN) { |
| 431 | return MBEDTLS_ERR_LMS_BAD_INPUT_DATA; |
Raef Coles | e89488d | 2022-10-07 16:06:35 +0100 | [diff] [blame] | 432 | } |
| 433 | |
Raef Coles | f5632d3 | 2022-09-01 09:56:52 +0100 | [diff] [blame] | 434 | ctx->params.type = |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 435 | mbedtls_lms_network_bytes_to_unsigned_int(MBEDTLS_LMOTS_TYPE_LEN, |
| 436 | key + MBEDTLS_LMOTS_SIG_TYPE_OFFSET); |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 437 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 438 | if (key_len != MBEDTLS_LMOTS_PUBLIC_KEY_LEN(ctx->params.type)) { |
| 439 | return MBEDTLS_ERR_LMS_BAD_INPUT_DATA; |
Raef Coles | e9479a0 | 2022-09-01 16:06:35 +0100 | [diff] [blame] | 440 | } |
| 441 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 442 | memcpy(ctx->params.I_key_identifier, |
| 443 | key + PUBLIC_KEY_I_KEY_ID_OFFSET, |
| 444 | MBEDTLS_LMOTS_I_KEY_ID_LEN); |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 445 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 446 | memcpy(ctx->params.q_leaf_identifier, |
| 447 | key + PUBLIC_KEY_Q_LEAF_ID_OFFSET, |
| 448 | MBEDTLS_LMOTS_Q_LEAF_ID_LEN); |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 449 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 450 | memcpy(ctx->public_key, |
| 451 | key + PUBLIC_KEY_KEY_HASH_OFFSET, |
| 452 | MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type)); |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 453 | |
Raef Coles | f5632d3 | 2022-09-01 09:56:52 +0100 | [diff] [blame] | 454 | ctx->have_public_key = 1; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 455 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 456 | return 0; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 457 | } |
| 458 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 459 | int mbedtls_lmots_export_public_key(const mbedtls_lmots_public_t *ctx, |
| 460 | unsigned char *key, size_t key_size, |
| 461 | size_t *key_len) |
Raef Coles | 370cc43 | 2022-10-07 16:07:33 +0100 | [diff] [blame] | 462 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 463 | if (key_size < MBEDTLS_LMOTS_PUBLIC_KEY_LEN(ctx->params.type)) { |
| 464 | return MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL; |
Raef Coles | 370cc43 | 2022-10-07 16:07:33 +0100 | [diff] [blame] | 465 | } |
| 466 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 467 | if (!ctx->have_public_key) { |
| 468 | return MBEDTLS_ERR_LMS_BAD_INPUT_DATA; |
Raef Coles | 370cc43 | 2022-10-07 16:07:33 +0100 | [diff] [blame] | 469 | } |
| 470 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 471 | mbedtls_lms_unsigned_int_to_network_bytes(ctx->params.type, |
| 472 | MBEDTLS_LMOTS_TYPE_LEN, |
| 473 | key + MBEDTLS_LMOTS_SIG_TYPE_OFFSET); |
Raef Coles | 370cc43 | 2022-10-07 16:07:33 +0100 | [diff] [blame] | 474 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 475 | memcpy(key + PUBLIC_KEY_I_KEY_ID_OFFSET, |
| 476 | ctx->params.I_key_identifier, |
| 477 | MBEDTLS_LMOTS_I_KEY_ID_LEN); |
Raef Coles | 370cc43 | 2022-10-07 16:07:33 +0100 | [diff] [blame] | 478 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 479 | memcpy(key + PUBLIC_KEY_Q_LEAF_ID_OFFSET, |
| 480 | ctx->params.q_leaf_identifier, |
| 481 | MBEDTLS_LMOTS_Q_LEAF_ID_LEN); |
Raef Coles | 370cc43 | 2022-10-07 16:07:33 +0100 | [diff] [blame] | 482 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 483 | memcpy(key + PUBLIC_KEY_KEY_HASH_OFFSET, ctx->public_key, |
| 484 | MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type)); |
Raef Coles | 370cc43 | 2022-10-07 16:07:33 +0100 | [diff] [blame] | 485 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 486 | if (key_len != NULL) { |
Raef Coles | 370cc43 | 2022-10-07 16:07:33 +0100 | [diff] [blame] | 487 | *key_len = MBEDTLS_LMOTS_PUBLIC_KEY_LEN(ctx->params.type); |
| 488 | } |
| 489 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 490 | return 0; |
Raef Coles | 370cc43 | 2022-10-07 16:07:33 +0100 | [diff] [blame] | 491 | } |
| 492 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 493 | int mbedtls_lmots_calculate_public_key_candidate(const mbedtls_lmots_parameters_t *params, |
| 494 | const unsigned char *msg, |
| 495 | size_t msg_size, |
| 496 | const unsigned char *sig, |
| 497 | size_t sig_size, |
| 498 | unsigned char *out, |
| 499 | size_t out_size, |
| 500 | size_t *out_len) |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 501 | { |
Raef Coles | e9479a0 | 2022-09-01 16:06:35 +0100 | [diff] [blame] | 502 | unsigned char tmp_digit_array[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX]; |
| 503 | unsigned char y_hashed_digits[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX][MBEDTLS_LMOTS_N_HASH_LEN_MAX]; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 504 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 505 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 506 | if (msg == NULL && msg_size != 0) { |
| 507 | return MBEDTLS_ERR_LMS_BAD_INPUT_DATA; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 508 | } |
| 509 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 510 | if (sig_size != MBEDTLS_LMOTS_SIG_LEN(params->type) || |
| 511 | out_size < MBEDTLS_LMOTS_N_HASH_LEN(params->type)) { |
| 512 | return MBEDTLS_ERR_LMS_BAD_INPUT_DATA; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 513 | } |
| 514 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 515 | ret = create_digit_array_with_checksum(params, msg, msg_size, |
| 516 | sig + MBEDTLS_LMOTS_SIG_C_RANDOM_OFFSET, |
| 517 | tmp_digit_array); |
| 518 | if (ret) { |
| 519 | return ret; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 520 | } |
| 521 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 522 | ret = hash_digit_array(params, |
| 523 | sig + MBEDTLS_LMOTS_SIG_SIGNATURE_OFFSET(params->type), |
| 524 | tmp_digit_array, NULL, (unsigned char *) y_hashed_digits); |
| 525 | if (ret) { |
| 526 | return ret; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 527 | } |
| 528 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 529 | ret = public_key_from_hashed_digit_array(params, |
| 530 | (unsigned char *) y_hashed_digits, |
| 531 | out); |
| 532 | if (ret) { |
| 533 | return ret; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 534 | } |
| 535 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 536 | if (out_len != NULL) { |
Raef Coles | e9479a0 | 2022-09-01 16:06:35 +0100 | [diff] [blame] | 537 | *out_len = MBEDTLS_LMOTS_N_HASH_LEN(params->type); |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 538 | } |
| 539 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 540 | return 0; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 541 | } |
| 542 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 543 | int mbedtls_lmots_verify(const mbedtls_lmots_public_t *ctx, |
| 544 | const unsigned char *msg, size_t msg_size, |
| 545 | const unsigned char *sig, size_t sig_size) |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 546 | { |
Raef Coles | e9479a0 | 2022-09-01 16:06:35 +0100 | [diff] [blame] | 547 | unsigned char Kc_public_key_candidate[MBEDTLS_LMOTS_N_HASH_LEN_MAX]; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 548 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 549 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 550 | if (msg == NULL && msg_size != 0) { |
| 551 | return MBEDTLS_ERR_LMS_BAD_INPUT_DATA; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 552 | } |
| 553 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 554 | if (!ctx->have_public_key) { |
| 555 | return MBEDTLS_ERR_LMS_BAD_INPUT_DATA; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 556 | } |
| 557 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 558 | if (ctx->params.type != MBEDTLS_LMOTS_SHA256_N32_W8) { |
| 559 | return MBEDTLS_ERR_LMS_BAD_INPUT_DATA; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 560 | } |
| 561 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 562 | if (sig_size < MBEDTLS_LMOTS_SIG_TYPE_OFFSET + MBEDTLS_LMOTS_TYPE_LEN) { |
| 563 | return MBEDTLS_ERR_LMS_VERIFY_FAILED; |
Raef Coles | 4829459 | 2022-10-10 16:40:00 +0100 | [diff] [blame] | 564 | } |
| 565 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 566 | if (mbedtls_lms_network_bytes_to_unsigned_int(MBEDTLS_LMOTS_TYPE_LEN, |
| 567 | sig + MBEDTLS_LMOTS_SIG_TYPE_OFFSET) != |
| 568 | MBEDTLS_LMOTS_SHA256_N32_W8) { |
| 569 | return MBEDTLS_ERR_LMS_VERIFY_FAILED; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 570 | } |
| 571 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 572 | ret = mbedtls_lmots_calculate_public_key_candidate(&ctx->params, |
| 573 | msg, msg_size, sig, sig_size, |
| 574 | Kc_public_key_candidate, |
| 575 | MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type), |
| 576 | NULL); |
| 577 | if (ret) { |
| 578 | return MBEDTLS_ERR_LMS_VERIFY_FAILED; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 579 | } |
| 580 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 581 | if (memcmp(&Kc_public_key_candidate, ctx->public_key, |
| 582 | sizeof(ctx->public_key))) { |
| 583 | return MBEDTLS_ERR_LMS_VERIFY_FAILED; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 584 | } |
| 585 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 586 | return 0; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 587 | } |
| 588 | |
Raef Coles | 5127e85 | 2022-10-07 10:35:56 +0100 | [diff] [blame] | 589 | #if defined(MBEDTLS_LMS_PRIVATE) |
Raef Coles | ab4f874 | 2022-09-01 12:24:31 +0100 | [diff] [blame] | 590 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 591 | void mbedtls_lmots_private_init(mbedtls_lmots_private_t *ctx) |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 592 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 593 | memset(ctx, 0, sizeof(*ctx)); |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 594 | } |
| 595 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 596 | void mbedtls_lmots_private_free(mbedtls_lmots_private_t *ctx) |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 597 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 598 | mbedtls_platform_zeroize(ctx, |
| 599 | sizeof(*ctx)); |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 600 | } |
| 601 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 602 | int mbedtls_lmots_generate_private_key(mbedtls_lmots_private_t *ctx, |
| 603 | mbedtls_lmots_algorithm_type_t type, |
| 604 | const unsigned char I_key_identifier[MBEDTLS_LMOTS_I_KEY_ID_LEN], |
| 605 | uint32_t q_leaf_identifier, |
| 606 | const unsigned char *seed, |
| 607 | size_t seed_size) |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 608 | { |
Raef Coles | be0c2f9 | 2022-10-07 11:27:35 +0100 | [diff] [blame] | 609 | psa_hash_operation_t op = PSA_HASH_OPERATION_INIT; |
| 610 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 611 | size_t output_hash_len; |
| 612 | unsigned int i_digit_idx; |
| 613 | unsigned char i_digit_idx_bytes[2]; |
| 614 | unsigned char const_bytes[1]; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 615 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 616 | if (ctx->have_private_key) { |
| 617 | return MBEDTLS_ERR_LMS_BAD_INPUT_DATA; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 618 | } |
| 619 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 620 | if (type != MBEDTLS_LMOTS_SHA256_N32_W8) { |
| 621 | return MBEDTLS_ERR_LMS_BAD_INPUT_DATA; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 622 | } |
| 623 | |
Raef Coles | f5632d3 | 2022-09-01 09:56:52 +0100 | [diff] [blame] | 624 | ctx->params.type = type; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 625 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 626 | memcpy(ctx->params.I_key_identifier, |
| 627 | I_key_identifier, |
| 628 | sizeof(ctx->params.I_key_identifier)); |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 629 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 630 | mbedtls_lms_unsigned_int_to_network_bytes(q_leaf_identifier, |
| 631 | MBEDTLS_LMOTS_Q_LEAF_ID_LEN, |
| 632 | ctx->params.q_leaf_identifier); |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 633 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 634 | mbedtls_lms_unsigned_int_to_network_bytes(0xFF, sizeof(const_bytes), |
| 635 | const_bytes); |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 636 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 637 | for (i_digit_idx = 0; |
| 638 | i_digit_idx < MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(ctx->params.type); |
| 639 | i_digit_idx++) { |
| 640 | status = psa_hash_setup(&op, PSA_ALG_SHA_256); |
| 641 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 642 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 643 | } |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 644 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 645 | status = psa_hash_update(&op, |
| 646 | ctx->params.I_key_identifier, |
| 647 | sizeof(ctx->params.I_key_identifier)); |
| 648 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 649 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 650 | } |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 651 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 652 | status = psa_hash_update(&op, |
| 653 | ctx->params.q_leaf_identifier, |
| 654 | MBEDTLS_LMOTS_Q_LEAF_ID_LEN); |
| 655 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 656 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 657 | } |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 658 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 659 | mbedtls_lms_unsigned_int_to_network_bytes(i_digit_idx, I_DIGIT_IDX_LEN, |
| 660 | i_digit_idx_bytes); |
| 661 | status = psa_hash_update(&op, i_digit_idx_bytes, I_DIGIT_IDX_LEN); |
| 662 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 663 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 664 | } |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 665 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 666 | status = psa_hash_update(&op, const_bytes, sizeof(const_bytes)); |
| 667 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 668 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 669 | } |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 670 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 671 | status = psa_hash_update(&op, seed, seed_size); |
| 672 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 673 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 674 | } |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 675 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 676 | status = psa_hash_finish(&op, |
| 677 | ctx->private_key[i_digit_idx], |
| 678 | MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type), |
| 679 | &output_hash_len); |
| 680 | if (status != PSA_SUCCESS) { |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 681 | goto exit; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 682 | } |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 683 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 684 | psa_hash_abort(&op); |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 685 | } |
| 686 | |
Raef Coles | f5632d3 | 2022-09-01 09:56:52 +0100 | [diff] [blame] | 687 | ctx->have_private_key = 1; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 688 | |
| 689 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 690 | psa_hash_abort(&op); |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 691 | |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame^] | 692 | return PSA_TO_MBEDTLS_ERR(status); |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 693 | } |
| 694 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 695 | int mbedtls_lmots_calculate_public_key(mbedtls_lmots_public_t *ctx, |
| 696 | const mbedtls_lmots_private_t *priv_ctx) |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 697 | { |
Raef Coles | e9479a0 | 2022-09-01 16:06:35 +0100 | [diff] [blame] | 698 | unsigned char y_hashed_digits[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX][MBEDTLS_LMOTS_N_HASH_LEN_MAX]; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 699 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 700 | |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 701 | /* Check that a private key is loaded */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 702 | if (!priv_ctx->have_private_key) { |
| 703 | return MBEDTLS_ERR_LMS_BAD_INPUT_DATA; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 704 | } |
| 705 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 706 | ret = hash_digit_array(&priv_ctx->params, |
| 707 | (unsigned char *) priv_ctx->private_key, NULL, |
| 708 | NULL, (unsigned char *) y_hashed_digits); |
| 709 | if (ret) { |
Raef Coles | 142e577 | 2022-10-12 10:47:27 +0100 | [diff] [blame] | 710 | goto exit; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 711 | } |
| 712 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 713 | ret = public_key_from_hashed_digit_array(&priv_ctx->params, |
| 714 | (unsigned char *) y_hashed_digits, |
| 715 | ctx->public_key); |
| 716 | if (ret) { |
Raef Coles | 142e577 | 2022-10-12 10:47:27 +0100 | [diff] [blame] | 717 | goto exit; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 718 | } |
| 719 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 720 | memcpy(&ctx->params, &priv_ctx->params, |
| 721 | sizeof(ctx->params)); |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 722 | |
Raef Coles | 9b88ee5 | 2022-09-02 12:04:21 +0100 | [diff] [blame] | 723 | ctx->have_public_key = 1; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 724 | |
Raef Coles | 142e577 | 2022-10-12 10:47:27 +0100 | [diff] [blame] | 725 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 726 | mbedtls_platform_zeroize(y_hashed_digits, sizeof(y_hashed_digits)); |
Raef Coles | 142e577 | 2022-10-12 10:47:27 +0100 | [diff] [blame] | 727 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 728 | return ret; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 729 | } |
| 730 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 731 | int mbedtls_lmots_sign(mbedtls_lmots_private_t *ctx, |
| 732 | int (*f_rng)(void *, unsigned char *, size_t), |
| 733 | void *p_rng, const unsigned char *msg, size_t msg_size, |
| 734 | unsigned char *sig, size_t sig_size, size_t *sig_len) |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 735 | { |
Raef Coles | e9479a0 | 2022-09-01 16:06:35 +0100 | [diff] [blame] | 736 | unsigned char tmp_digit_array[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX]; |
Raef Coles | 891c613 | 2022-09-01 11:05:48 +0100 | [diff] [blame] | 737 | /* Create a temporary buffer to prepare the signature in. This allows us to |
| 738 | * finish creating a signature (ensuring the process doesn't fail), and then |
| 739 | * erase the private key **before** writing any data into the sig parameter |
| 740 | * buffer. If data were directly written into the sig buffer, it might leak |
| 741 | * a partial signature on failure, which effectively compromises the private |
| 742 | * key. |
| 743 | */ |
Raef Coles | e9479a0 | 2022-09-01 16:06:35 +0100 | [diff] [blame] | 744 | unsigned char tmp_sig[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX][MBEDTLS_LMOTS_N_HASH_LEN_MAX]; |
Raef Coles | d48f7e9 | 2022-10-10 13:10:07 +0100 | [diff] [blame] | 745 | unsigned char tmp_c_random[MBEDTLS_LMOTS_N_HASH_LEN_MAX]; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 746 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 747 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 748 | if (msg == NULL && msg_size != 0) { |
| 749 | return MBEDTLS_ERR_LMS_BAD_INPUT_DATA; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 750 | } |
| 751 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 752 | if (sig_size < MBEDTLS_LMOTS_SIG_LEN(ctx->params.type)) { |
| 753 | return MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL; |
Raef Coles | 01c71a1 | 2022-08-31 15:55:00 +0100 | [diff] [blame] | 754 | } |
| 755 | |
| 756 | /* Check that a private key is loaded */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 757 | if (!ctx->have_private_key) { |
| 758 | return MBEDTLS_ERR_LMS_BAD_INPUT_DATA; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 759 | } |
| 760 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 761 | ret = f_rng(p_rng, tmp_c_random, |
| 762 | MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type)); |
| 763 | if (ret) { |
| 764 | return ret; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 765 | } |
| 766 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 767 | ret = create_digit_array_with_checksum(&ctx->params, |
| 768 | msg, msg_size, |
| 769 | tmp_c_random, |
| 770 | tmp_digit_array); |
| 771 | if (ret) { |
Raef Coles | 142e577 | 2022-10-12 10:47:27 +0100 | [diff] [blame] | 772 | goto exit; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 773 | } |
| 774 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 775 | ret = hash_digit_array(&ctx->params, (unsigned char *) ctx->private_key, |
| 776 | NULL, tmp_digit_array, (unsigned char *) tmp_sig); |
| 777 | if (ret) { |
Raef Coles | 142e577 | 2022-10-12 10:47:27 +0100 | [diff] [blame] | 778 | goto exit; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 779 | } |
| 780 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 781 | mbedtls_lms_unsigned_int_to_network_bytes(ctx->params.type, |
| 782 | MBEDTLS_LMOTS_TYPE_LEN, |
| 783 | sig + MBEDTLS_LMOTS_SIG_TYPE_OFFSET); |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 784 | |
Raef Coles | 9c9027b | 2022-09-02 18:26:31 +0100 | [diff] [blame] | 785 | /* Test hook to check if sig is being written to before we invalidate the |
| 786 | * private key. |
| 787 | */ |
| 788 | #if defined(MBEDTLS_TEST_HOOKS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 789 | if (mbedtls_lmots_sign_private_key_invalidated_hook != NULL) { |
| 790 | ret = (*mbedtls_lmots_sign_private_key_invalidated_hook)(sig); |
| 791 | if (ret != 0) { |
| 792 | return ret; |
| 793 | } |
Raef Coles | 9c9027b | 2022-09-02 18:26:31 +0100 | [diff] [blame] | 794 | } |
| 795 | #endif /* defined(MBEDTLS_TEST_HOOKS) */ |
| 796 | |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 797 | /* We've got a valid signature now, so it's time to make sure the private |
| 798 | * key can't be reused. |
| 799 | */ |
Raef Coles | f5632d3 | 2022-09-01 09:56:52 +0100 | [diff] [blame] | 800 | ctx->have_private_key = 0; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 801 | mbedtls_platform_zeroize(ctx->private_key, |
| 802 | sizeof(ctx->private_key)); |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 803 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 804 | memcpy(sig + MBEDTLS_LMOTS_SIG_C_RANDOM_OFFSET, tmp_c_random, |
| 805 | MBEDTLS_LMOTS_C_RANDOM_VALUE_LEN(ctx->params.type)); |
Raef Coles | 891c613 | 2022-09-01 11:05:48 +0100 | [diff] [blame] | 806 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 807 | memcpy(sig + MBEDTLS_LMOTS_SIG_SIGNATURE_OFFSET(ctx->params.type), tmp_sig, |
| 808 | MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(ctx->params.type) |
| 809 | * MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type)); |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 810 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 811 | if (sig_len != NULL) { |
Raef Coles | e9479a0 | 2022-09-01 16:06:35 +0100 | [diff] [blame] | 812 | *sig_len = MBEDTLS_LMOTS_SIG_LEN(ctx->params.type); |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 813 | } |
| 814 | |
Raef Coles | 142e577 | 2022-10-12 10:47:27 +0100 | [diff] [blame] | 815 | ret = 0; |
| 816 | |
| 817 | exit: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 818 | mbedtls_platform_zeroize(tmp_digit_array, sizeof(tmp_digit_array)); |
| 819 | mbedtls_platform_zeroize(tmp_sig, sizeof(tmp_sig)); |
Raef Coles | 142e577 | 2022-10-12 10:47:27 +0100 | [diff] [blame] | 820 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 821 | return ret; |
Raef Coles | 8ff6df5 | 2021-07-21 12:42:15 +0100 | [diff] [blame] | 822 | } |
| 823 | |
Raef Coles | 5127e85 | 2022-10-07 10:35:56 +0100 | [diff] [blame] | 824 | #endif /* defined(MBEDTLS_LMS_PRIVATE) */ |
| 825 | #endif /* defined(MBEDTLS_LMS_C) */ |