1 #include <stdint.h>
2 #include <string.h>
3 
4 #include "address.h"
5 #include "hash.h"
6 #include "params.h"
7 #include "utils.h"
8 
9 #include "sha2.h"
10 #include "sha256.h"
11 
12 /* For SHA256, there is no immediate reason to initialize at the start,
13    so this function is an empty operation. */
PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_initialize_hash_function(hash_state * hash_state_seeded,const unsigned char * pub_seed,const unsigned char * sk_seed)14 void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_initialize_hash_function(
15     hash_state *hash_state_seeded,
16     const unsigned char *pub_seed, const unsigned char *sk_seed) {
17     PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_seed_state(hash_state_seeded, pub_seed);
18     (void)sk_seed; /* Suppress an 'unused parameter' warning. */
19 }
20 
21 /* Clean up hash state */
PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_destroy_hash_function(hash_state * hash_state_seeded)22 void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_destroy_hash_function(hash_state *hash_state_seeded) {
23     sha256_inc_ctx_release(hash_state_seeded);
24 }
25 
26 /*
27  * Computes PRF(key, addr), given a secret key of PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N bytes and an address
28  */
PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_prf_addr(unsigned char * out,const unsigned char * key,const uint32_t addr[8],const hash_state * hash_state_seeded)29 void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_prf_addr(
30     unsigned char *out, const unsigned char *key, const uint32_t addr[8],
31     const hash_state *hash_state_seeded) {
32     unsigned char buf[PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_ADDR_BYTES];
33     unsigned char outbuf[PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_OUTPUT_BYTES];
34 
35     memcpy(buf, key, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
36     PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_compress_address(buf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N, addr);
37 
38     sha256(outbuf, buf, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_ADDR_BYTES);
39     memcpy(out, outbuf, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
40 
41     (void)hash_state_seeded; /* Prevent unused parameter warning. */
42 }
43 
44 /**
45  * Computes the message-dependent randomness R, using a secret seed as a key
46  * for HMAC, and an optional randomization value prefixed to the message.
47  * This requires m to have at least PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N space
48  * available in front of the pointer, i.e. before the message to use for the
49  * prefix. This is necessary to prevent having to move the message around (and
50  * allocate memory for it).
51  */
PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_gen_message_random(unsigned char * R,const unsigned char * sk_prf,const unsigned char * optrand,const unsigned char * m,size_t mlen,const hash_state * hash_state_seeded)52 void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_gen_message_random(
53     unsigned char *R,
54     const unsigned char *sk_prf, const unsigned char *optrand,
55     const unsigned char *m, size_t mlen, const hash_state *hash_state_seeded) {
56     unsigned char buf[PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_OUTPUT_BYTES];
57     sha256ctx state;
58     int i;
59 
60     /* This implements HMAC-SHA256 */
61     for (i = 0; i < PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N; i++) {
62         buf[i] = 0x36 ^ sk_prf[i];
63     }
64     memset(buf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N, 0x36, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
65 
66     sha256_inc_init(&state);
67     sha256_inc_blocks(&state, buf, 1);
68 
69     memcpy(buf, optrand, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
70 
71     /* If optrand + message cannot fill up an entire block */
72     if (PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N + mlen < PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES) {
73         memcpy(buf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N, m, mlen);
74         sha256_inc_finalize(buf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES, &state,
75                             buf, mlen + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
76     }
77     /* Otherwise first fill a block, so that finalize only uses the message */
78     else {
79         memcpy(buf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N, m, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
80         sha256_inc_blocks(&state, buf, 1);
81 
82         m += PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N;
83         mlen -= PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N;
84         sha256_inc_finalize(buf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES, &state, m, mlen);
85     }
86 
87     for (i = 0; i < PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N; i++) {
88         buf[i] = 0x5c ^ sk_prf[i];
89     }
90     memset(buf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N, 0x5c, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
91 
92     sha256(buf, buf, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_OUTPUT_BYTES);
93     memcpy(R, buf, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
94 
95     (void)hash_state_seeded; /* Prevent unused parameter warning. */
96 }
97 
98 /**
99  * Computes the message hash using R, the public key, and the message.
100  * Outputs the message digest and the index of the leaf. The index is split in
101  * the tree index and the leaf index, for convenient copying to an address.
102  */
PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_hash_message(unsigned char * digest,uint64_t * tree,uint32_t * leaf_idx,const unsigned char * R,const unsigned char * pk,const unsigned char * m,size_t mlen,const hash_state * hash_state_seeded)103 void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_hash_message(
104     unsigned char *digest, uint64_t *tree, uint32_t *leaf_idx,
105     const unsigned char *R, const unsigned char *pk,
106     const unsigned char *m, size_t mlen,
107     const hash_state *hash_state_seeded) {
108 #define PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_BITS (PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_HEIGHT * (PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_D - 1))
109 #define PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_BYTES ((PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_BITS + 7) / 8)
110 #define PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_LEAF_BITS PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_HEIGHT
111 #define PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_LEAF_BYTES ((PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_LEAF_BITS + 7) / 8)
112 #define PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_DGST_BYTES (PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_FORS_MSG_BYTES + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_BYTES + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_LEAF_BYTES)
113 
114     unsigned char seed[PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_OUTPUT_BYTES + 4];
115 
116     /* Round to nearest multiple of PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES */
117 #define PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_INBLOCKS (((PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - 1) & \
118         -PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES) / PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES)
119     unsigned char inbuf[PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_INBLOCKS * PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES];
120 
121     unsigned char buf[PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_DGST_BYTES];
122     unsigned char *bufp = buf;
123     sha256ctx state;
124 
125     sha256_inc_init(&state);
126 
127     memcpy(inbuf, R, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N);
128     memcpy(inbuf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N, pk, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES);
129 
130     /* If R + pk + message cannot fill up an entire block */
131     if (PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES + mlen < PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_INBLOCKS * PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES) {
132         memcpy(inbuf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES, m, mlen);
133         sha256_inc_finalize(seed, &state, inbuf, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES + mlen);
134     }
135     /* Otherwise first fill a block, so that finalize only uses the message */
136     else {
137         memcpy(inbuf + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N + PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES, m,
138                PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_INBLOCKS * PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES);
139         sha256_inc_blocks(&state, inbuf, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_INBLOCKS);
140 
141         m += PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_INBLOCKS * PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES;
142         mlen -= PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_INBLOCKS * PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_BLOCK_BYTES - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_N - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_PK_BYTES;
143         sha256_inc_finalize(seed, &state, m, mlen);
144     }
145 
146     /* By doing this in two steps, we prevent hashing the message twice;
147        otherwise each iteration in MGF1 would hash the message again. */
148     PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_mgf1(bufp, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_DGST_BYTES, seed, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_SHA256_OUTPUT_BYTES);
149 
150     memcpy(digest, bufp, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_FORS_MSG_BYTES);
151     bufp += PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_FORS_MSG_BYTES;
152 
153     *tree = PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_bytes_to_ull(bufp, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_BYTES);
154     *tree &= (~(uint64_t)0) >> (64 - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_BITS);
155     bufp += PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_TREE_BYTES;
156 
157     *leaf_idx = (uint32_t)PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_bytes_to_ull(
158                     bufp, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_LEAF_BYTES);
159     *leaf_idx &= (~(uint32_t)0) >> (32 - PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_LEAF_BITS);
160 
161     (void)hash_state_seeded; /* Prevent unused parameter warning. */
162 }
163