1 #include <stdint.h>
2 #include <string.h>
3
4 #include "address.h"
5 #include "hash.h"
6 #include "params.h"
7 #include "utils.h"
8
9 #include "sha2.h"
10 #include "sha256.h"
11
12 /* For SHA256, there is no immediate reason to initialize at the start,
13 so this function is an empty operation. */
PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_initialize_hash_function(hash_state * hash_state_seeded,const unsigned char * pub_seed,const unsigned char * sk_seed)14 void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_initialize_hash_function(
15 hash_state *hash_state_seeded,
16 const unsigned char *pub_seed, const unsigned char *sk_seed) {
17 PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_seed_state(hash_state_seeded, pub_seed);
18 (void)sk_seed; /* Suppress an 'unused parameter' warning. */
19 }
20
21 /* Clean up hash state */
PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_destroy_hash_function(hash_state * hash_state_seeded)22 void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_destroy_hash_function(hash_state *hash_state_seeded) {
23 sha256_inc_ctx_release(hash_state_seeded);
24 }
25
26 /*
27 * Computes PRF(key, addr), given a secret key of PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N bytes and an address
28 */
PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_prf_addr(unsigned char * out,const unsigned char * key,const uint32_t addr[8],const hash_state * hash_state_seeded)29 void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_prf_addr(
30 unsigned char *out, const unsigned char *key, const uint32_t addr[8],
31 const hash_state *hash_state_seeded) {
32 unsigned char buf[PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_ADDR_BYTES];
33 unsigned char outbuf[PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_OUTPUT_BYTES];
34
35 memcpy(buf, key, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
36 PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_compress_address(buf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N, addr);
37
38 sha256(outbuf, buf, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_ADDR_BYTES);
39 memcpy(out, outbuf, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
40
41 (void)hash_state_seeded; /* Prevent unused parameter warning. */
42 }
43
44 /**
45 * Computes the message-dependent randomness R, using a secret seed as a key
46 * for HMAC, and an optional randomization value prefixed to the message.
47 * This requires m to have at least PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N space
48 * available in front of the pointer, i.e. before the message to use for the
49 * prefix. This is necessary to prevent having to move the message around (and
50 * allocate memory for it).
51 */
PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_gen_message_random(unsigned char * R,const unsigned char * sk_prf,const unsigned char * optrand,const unsigned char * m,size_t mlen,const hash_state * hash_state_seeded)52 void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_gen_message_random(
53 unsigned char *R,
54 const unsigned char *sk_prf, const unsigned char *optrand,
55 const unsigned char *m, size_t mlen, const hash_state *hash_state_seeded) {
56 unsigned char buf[PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_OUTPUT_BYTES];
57 sha256ctx state;
58 int i;
59
60 /* This implements HMAC-SHA256 */
61 for (i = 0; i < PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N; i++) {
62 buf[i] = 0x36 ^ sk_prf[i];
63 }
64 memset(buf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N, 0x36, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
65
66 sha256_inc_init(&state);
67 sha256_inc_blocks(&state, buf, 1);
68
69 memcpy(buf, optrand, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
70
71 /* If optrand + message cannot fill up an entire block */
72 if (PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N + mlen < PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES) {
73 memcpy(buf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N, m, mlen);
74 sha256_inc_finalize(buf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES, &state,
75 buf, mlen + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
76 }
77 /* Otherwise first fill a block, so that finalize only uses the message */
78 else {
79 memcpy(buf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N, m, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
80 sha256_inc_blocks(&state, buf, 1);
81
82 m += PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N;
83 mlen -= PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N;
84 sha256_inc_finalize(buf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES, &state, m, mlen);
85 }
86
87 for (i = 0; i < PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N; i++) {
88 buf[i] = 0x5c ^ sk_prf[i];
89 }
90 memset(buf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N, 0x5c, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
91
92 sha256(buf, buf, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_OUTPUT_BYTES);
93 memcpy(R, buf, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
94
95 (void)hash_state_seeded; /* Prevent unused parameter warning. */
96 }
97
98 /**
99 * Computes the message hash using R, the public key, and the message.
100 * Outputs the message digest and the index of the leaf. The index is split in
101 * the tree index and the leaf index, for convenient copying to an address.
102 */
PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_hash_message(unsigned char * digest,uint64_t * tree,uint32_t * leaf_idx,const unsigned char * R,const unsigned char * pk,const unsigned char * m,size_t mlen,const hash_state * hash_state_seeded)103 void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_hash_message(
104 unsigned char *digest, uint64_t *tree, uint32_t *leaf_idx,
105 const unsigned char *R, const unsigned char *pk,
106 const unsigned char *m, size_t mlen,
107 const hash_state *hash_state_seeded) {
108 #define PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_BITS (PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_HEIGHT * (PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_D - 1))
109 #define PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_BYTES ((PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_BITS + 7) / 8)
110 #define PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_LEAF_BITS PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_HEIGHT
111 #define PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_LEAF_BYTES ((PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_LEAF_BITS + 7) / 8)
112 #define PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_DGST_BYTES (PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_FORS_MSG_BYTES + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_BYTES + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_LEAF_BYTES)
113
114 unsigned char seed[PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_OUTPUT_BYTES + 4];
115
116 /* Round to nearest multiple of PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES */
117 #define PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_INBLOCKS (((PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - 1) & \
118 -PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES) / PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES)
119 unsigned char inbuf[PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_INBLOCKS * PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES];
120
121 unsigned char buf[PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_DGST_BYTES];
122 unsigned char *bufp = buf;
123 sha256ctx state;
124
125 sha256_inc_init(&state);
126
127 memcpy(inbuf, R, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
128 memcpy(inbuf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N, pk, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES);
129
130 /* If R + pk + message cannot fill up an entire block */
131 if (PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES + mlen < PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_INBLOCKS * PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES) {
132 memcpy(inbuf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES, m, mlen);
133 sha256_inc_finalize(seed, &state, inbuf, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES + mlen);
134 }
135 /* Otherwise first fill a block, so that finalize only uses the message */
136 else {
137 memcpy(inbuf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES, m,
138 PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_INBLOCKS * PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES);
139 sha256_inc_blocks(&state, inbuf, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_INBLOCKS);
140
141 m += PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_INBLOCKS * PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES;
142 mlen -= PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_INBLOCKS * PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES;
143 sha256_inc_finalize(seed, &state, m, mlen);
144 }
145
146 /* By doing this in two steps, we prevent hashing the message twice;
147 otherwise each iteration in MGF1 would hash the message again. */
148 PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_mgf1(bufp, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_DGST_BYTES, seed, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_OUTPUT_BYTES);
149
150 memcpy(digest, bufp, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_FORS_MSG_BYTES);
151 bufp += PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_FORS_MSG_BYTES;
152
153 *tree = PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_bytes_to_ull(bufp, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_BYTES);
154 *tree &= (~(uint64_t)0) >> (64 - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_BITS);
155 bufp += PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_BYTES;
156
157 *leaf_idx = (uint32_t)PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_bytes_to_ull(
158 bufp, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_LEAF_BYTES);
159 *leaf_idx &= (~(uint32_t)0) >> (32 - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_LEAF_BITS);
160
161 (void)hash_state_seeded; /* Prevent unused parameter warning. */
162 }
163