blob: bb4326e374a13d99ebfc31fb64b5dd9dadb82941 [file] [log] [blame]
Raef Coles8ff6df52021-07-21 12:42:15 +01001/*
2 * The LM-OTS one-time public-key signature scheme
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 */
19
20/*
21 * The following sources were referenced in the design of this implementation
22 * of the LM-OTS algorithm:
23 *
24 * [1] IETF RFC8554
25 * D. McGrew, M. Curcio, S.Fluhrer
26 * https://datatracker.ietf.org/doc/html/rfc8554
27 *
28 * [2] NIST Special Publication 800-208
29 * David A. Cooper et. al.
30 * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-208.pdf
31 */
32
33#include "common.h"
34
Raef Coles5127e852022-10-07 10:35:56 +010035#if defined(MBEDTLS_LMS_C)
Raef Coles8ff6df52021-07-21 12:42:15 +010036
37#include <string.h>
38
Raef Coles7dce69a2022-08-24 14:07:06 +010039#include "lmots.h"
40
Raef Colesc8f96042022-08-25 13:49:54 +010041#include "mbedtls/lms.h"
Raef Coles8ff6df52021-07-21 12:42:15 +010042#include "mbedtls/platform_util.h"
43#include "mbedtls/error.h"
44
Raef Colesc8f96042022-08-25 13:49:54 +010045#include "psa/crypto.h"
46
Raef Coles57d53282022-09-27 11:30:51 +010047#define PUBLIC_KEY_TYPE_OFFSET (0)
48#define PUBLIC_KEY_I_KEY_ID_OFFSET (PUBLIC_KEY_TYPE_OFFSET + \
49 MBEDTLS_LMOTS_TYPE_LEN)
50#define PUBLIC_KEY_Q_LEAF_ID_OFFSET (PUBLIC_KEY_I_KEY_ID_OFFSET + \
51 MBEDTLS_LMOTS_I_KEY_ID_LEN)
52#define PUBLIC_KEY_KEY_HASH_OFFSET (PUBLIC_KEY_Q_LEAF_ID_OFFSET + \
53 MBEDTLS_LMOTS_Q_LEAF_ID_LEN)
Raef Coles01c71a12022-08-31 15:55:00 +010054
55/* We only support parameter sets that use 8-bit digits, as it does not require
56 * translation logic between digits and bytes */
57#define W_WINTERNITZ_PARAMETER (8u)
58#define CHECKSUM_LEN (2)
59#define I_DIGIT_IDX_LEN (2)
60#define J_HASH_IDX_LEN (1)
61#define D_CONST_LEN (2)
62
Raef Colese9479a02022-09-01 16:06:35 +010063/* Currently only defined for SHA256, 32 is the max hash output size */
Raef Coles57d53282022-09-27 11:30:51 +010064#define C_RANDOM_VALUE_LEN_MAX (MBEDTLS_LMOTS_N_HASH_LEN_MAX)
Raef Colese9479a02022-09-01 16:06:35 +010065
Raef Coles9b88ee52022-09-02 12:04:21 +010066#define DIGIT_MAX_VALUE ((1u << W_WINTERNITZ_PARAMETER) - 1u)
Raef Coles01c71a12022-08-31 15:55:00 +010067
Raef Coles9b88ee52022-09-02 12:04:21 +010068#define D_CONST_LEN (2)
Raef Coles01c71a12022-08-31 15:55:00 +010069static const unsigned char D_PUBLIC_CONSTANT_BYTES[D_CONST_LEN] = {0x80, 0x80};
70static const unsigned char D_MESSAGE_CONSTANT_BYTES[D_CONST_LEN] = {0x81, 0x81};
Raef Coles8ff6df52021-07-21 12:42:15 +010071
Raef Coles9c9027b2022-09-02 18:26:31 +010072#if defined(MBEDTLS_TEST_HOOKS)
73int( *mbedtls_lmots_sign_private_key_invalidated_hook )( unsigned char * ) = NULL;
74#endif /* defined(MBEDTLS_TEST_HOOKS) */
75
Raef Colesad054252022-09-27 10:59:16 +010076void mbedtls_lms_unsigned_int_to_network_bytes( unsigned int val, size_t len,
77 unsigned char *bytes )
Raef Coles8ff6df52021-07-21 12:42:15 +010078{
79 size_t idx;
80
Raef Coles9b88ee52022-09-02 12:04:21 +010081 for ( idx = 0; idx < len; idx++ )
82 {
83 bytes[idx] = ( val >> ( ( len - 1 - idx ) * 8 ) ) & 0xFF;
Raef Coles8ff6df52021-07-21 12:42:15 +010084 }
85}
86
Raef Colesad054252022-09-27 10:59:16 +010087unsigned int mbedtls_lms_network_bytes_to_unsigned_int( size_t len,
88 const unsigned char *bytes )
Raef Coles8ff6df52021-07-21 12:42:15 +010089{
90 size_t idx;
91 unsigned int val = 0;
92
Raef Coles9b88ee52022-09-02 12:04:21 +010093 for ( idx = 0; idx < len; idx++ )
94 {
95 val |= ( ( unsigned int )bytes[idx] ) << (8 * ( len - 1 - idx ) );
Raef Coles8ff6df52021-07-21 12:42:15 +010096 }
97
98 return val;
99}
100
Raef Coles0a967cc2022-09-02 17:46:15 +0100101/* Calculate the checksum digits that are appended to the end of the LMOTS digit
102 * string. See NIST SP800-208 section 3.1 or RFC8554 Algorithm 2 for details of
103 * the checksum algorithm.
104 *
Raef Coles98d6e222022-09-23 09:04:04 +0100105 * params The LMOTS parameter set, I and q values which
106 * describe the key being used.
Raef Coles0a967cc2022-09-02 17:46:15 +0100107 *
Raef Coles98d6e222022-09-23 09:04:04 +0100108 * digest The digit string to create the digest from. As
109 * this does not contain a checksum, it is the same
110 * size as a hash output.
Raef Coles0a967cc2022-09-02 17:46:15 +0100111 */
Raef Colese9479a02022-09-01 16:06:35 +0100112static unsigned short lmots_checksum_calculate( const mbedtls_lmots_parameters_t *params,
113 const unsigned char* digest )
Raef Coles8ff6df52021-07-21 12:42:15 +0100114{
115 size_t idx;
Raef Coles01c71a12022-08-31 15:55:00 +0100116 unsigned sum = 0;
Raef Coles8ff6df52021-07-21 12:42:15 +0100117
Raef Colese9479a02022-09-01 16:06:35 +0100118 for ( idx = 0; idx < MBEDTLS_LMOTS_N_HASH_LEN(params->type); idx++ )
Raef Coles8ff6df52021-07-21 12:42:15 +0100119 {
Raef Coles01c71a12022-08-31 15:55:00 +0100120 sum += DIGIT_MAX_VALUE - digest[idx];
Raef Coles8ff6df52021-07-21 12:42:15 +0100121 }
122
123 return sum;
124}
125
Raef Coles0a967cc2022-09-02 17:46:15 +0100126/* Create the string of digest digits (in the base determined by the Winternitz
127 * parameter with the checksum appended to the end (Q || cksm(Q)). See NIST
128 * SP800-208 section 3.1 or RFC8554 Algorithm 3 step 5 (also used in Algorithm
129 * 4b step 3) for details.
130 *
Raef Coles98d6e222022-09-23 09:04:04 +0100131 * params The LMOTS parameter set, I and q values which
132 * describe the key being used.
Raef Coles0a967cc2022-09-02 17:46:15 +0100133 *
Raef Coles98d6e222022-09-23 09:04:04 +0100134 * msg The message that will be hashed to create the
135 * digest.
Raef Coles0a967cc2022-09-02 17:46:15 +0100136 *
Raef Coles98d6e222022-09-23 09:04:04 +0100137 * msg_size The size of the message.
Raef Coles0a967cc2022-09-02 17:46:15 +0100138 *
Raef Coles98d6e222022-09-23 09:04:04 +0100139 * C_random_value The random value that will be combined with the
140 * message digest. This is always the same size as a
141 * hash output for whichever hash algorithm is
142 * determined by the parameter set.
Raef Coles0a967cc2022-09-02 17:46:15 +0100143 *
Raef Coles98d6e222022-09-23 09:04:04 +0100144 * output An output containing the digit string (+
145 * checksum) of length P digits (in the case of
146 * MBEDTLS_LMOTS_SHA256_N32_W8, this means it is of
147 * size P bytes).
Raef Coles0a967cc2022-09-02 17:46:15 +0100148 */
Raef Coles01c71a12022-08-31 15:55:00 +0100149static int create_digit_array_with_checksum( const mbedtls_lmots_parameters_t *params,
150 const unsigned char *msg,
151 size_t msg_len,
Raef Colese9479a02022-09-01 16:06:35 +0100152 const unsigned char *C_random_value,
153 unsigned char *out )
Raef Coles8ff6df52021-07-21 12:42:15 +0100154{
Raef Colesbe0c2f92022-10-07 11:27:35 +0100155 psa_hash_operation_t op = PSA_HASH_OPERATION_INIT;
156 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Raef Colesc8f96042022-08-25 13:49:54 +0100157 size_t output_hash_len;
Raef Coles8ff6df52021-07-21 12:42:15 +0100158 unsigned short checksum;
Raef Coles8ff6df52021-07-21 12:42:15 +0100159
Raef Colesc8f96042022-08-25 13:49:54 +0100160 status = psa_hash_setup( &op, PSA_ALG_SHA_256 );
Raef Coles29117d22022-10-07 11:46:06 +0100161 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100162 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100163
Raef Colesf5632d32022-09-01 09:56:52 +0100164 status = psa_hash_update( &op, params->I_key_identifier,
Raef Coles01c71a12022-08-31 15:55:00 +0100165 MBEDTLS_LMOTS_I_KEY_ID_LEN );
Raef Coles29117d22022-10-07 11:46:06 +0100166 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100167 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100168
Raef Colesf5632d32022-09-01 09:56:52 +0100169 status = psa_hash_update( &op, params->q_leaf_identifier,
Raef Coles01c71a12022-08-31 15:55:00 +0100170 MBEDTLS_LMOTS_Q_LEAF_ID_LEN );
Raef Coles29117d22022-10-07 11:46:06 +0100171 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100172 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100173
Raef Coles01c71a12022-08-31 15:55:00 +0100174 status = psa_hash_update( &op, D_MESSAGE_CONSTANT_BYTES, D_CONST_LEN );
Raef Coles29117d22022-10-07 11:46:06 +0100175 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100176 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100177
Raef Colese9479a02022-09-01 16:06:35 +0100178 status = psa_hash_update( &op, C_random_value,
179 MBEDTLS_LMOTS_C_RANDOM_VALUE_LEN(params->type) );
Raef Coles29117d22022-10-07 11:46:06 +0100180 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100181 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100182
Raef Colesc8f96042022-08-25 13:49:54 +0100183 status = psa_hash_update( &op, msg, msg_len );
Raef Coles29117d22022-10-07 11:46:06 +0100184 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100185 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100186
Raef Colese9479a02022-09-01 16:06:35 +0100187 status = psa_hash_finish( &op, out,
Raef Colesfa24f9d2022-09-02 17:46:52 +0100188 MBEDTLS_LMOTS_N_HASH_LEN(params->type),
Raef Colesc8f96042022-08-25 13:49:54 +0100189 &output_hash_len );
Raef Coles29117d22022-10-07 11:46:06 +0100190 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100191 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100192
Raef Colese9479a02022-09-01 16:06:35 +0100193 checksum = lmots_checksum_calculate( params, out );
Raef Colesad054252022-09-27 10:59:16 +0100194 mbedtls_lms_unsigned_int_to_network_bytes( checksum, CHECKSUM_LEN,
195 out + MBEDTLS_LMOTS_N_HASH_LEN(params->type) );
Raef Coles8ff6df52021-07-21 12:42:15 +0100196
Raef Coles01c71a12022-08-31 15:55:00 +0100197exit:
Raef Colesc8f96042022-08-25 13:49:54 +0100198 psa_hash_abort( &op );
Raef Coles8ff6df52021-07-21 12:42:15 +0100199
Raef Coles29117d22022-10-07 11:46:06 +0100200 return( mbedtls_lms_error_from_psa( status ) );
Raef Coles8ff6df52021-07-21 12:42:15 +0100201}
202
Raef Coles0a967cc2022-09-02 17:46:15 +0100203/* Hash each element of the string of digits (+ checksum), producing a hash
204 * output for each element. This is used in several places (by varying the
205 * hash_idx_min/max_values) in order to calculate a public key from a private
206 * key (RFC8554 Algorithm 1 step 4), in order to sign a message (RFC8554
207 * Algorithm 3 step 5), and to calculate a public key candidate from a
208 * signature and message (RFC8554 Algorithm 4b step 3).
209 *
Raef Coles98d6e222022-09-23 09:04:04 +0100210 * params The LMOTS parameter set, I and q values which
211 * describe the key being used.
Raef Coles0a967cc2022-09-02 17:46:15 +0100212 *
Raef Coles98d6e222022-09-23 09:04:04 +0100213 * x_digit_array The array of digits (of size P, 34 in the case of
214 * MBEDTLS_LMOTS_SHA256_N32_W8).
Raef Coles0a967cc2022-09-02 17:46:15 +0100215 *
Raef Coles98d6e222022-09-23 09:04:04 +0100216 * hash_idx_min_values An array of the starting values of the j iterator
217 * for each of the members of the digit array. If
218 * this value in NULL, then all iterators will start
219 * at 0.
Raef Coles0a967cc2022-09-02 17:46:15 +0100220 *
Raef Coles98d6e222022-09-23 09:04:04 +0100221 * hash_idx_max_values An array of the upper bound values of the j
222 * iterator for each of the members of the digit
223 * array. If this value in NULL, then iterator is
224 * bounded to be less than 2^w - 1 (255 in the case
225 * of MBEDTLS_LMOTS_SHA256_N32_W8)
Raef Coles0a967cc2022-09-02 17:46:15 +0100226 *
Raef Coles98d6e222022-09-23 09:04:04 +0100227 * output An array containing a hash output for each member
228 * of the digit string P. In the case of
229 * MBEDTLS_LMOTS_SHA256_N32_W8, this is of size 32 *
230 * 34.
Raef Coles0a967cc2022-09-02 17:46:15 +0100231 */
Raef Coles01c71a12022-08-31 15:55:00 +0100232static int hash_digit_array( const mbedtls_lmots_parameters_t *params,
Raef Colese9479a02022-09-01 16:06:35 +0100233 const unsigned char *x_digit_array,
Raef Coles01c71a12022-08-31 15:55:00 +0100234 const unsigned char *hash_idx_min_values,
235 const unsigned char *hash_idx_max_values,
Raef Colese9479a02022-09-01 16:06:35 +0100236 unsigned char *output )
Raef Coles8ff6df52021-07-21 12:42:15 +0100237{
Raef Coles8738a492022-09-02 17:13:01 +0100238 unsigned int i_digit_idx;
Raef Coles01c71a12022-08-31 15:55:00 +0100239 unsigned char i_digit_idx_bytes[I_DIGIT_IDX_LEN];
Raef Coles8738a492022-09-02 17:13:01 +0100240 unsigned int j_hash_idx;
241 unsigned char j_hash_idx_bytes[J_HASH_IDX_LEN];
Raef Coles01c71a12022-08-31 15:55:00 +0100242 unsigned int j_hash_idx_min;
243 unsigned int j_hash_idx_max;
Raef Colesbe0c2f92022-10-07 11:27:35 +0100244 psa_hash_operation_t op = PSA_HASH_OPERATION_INIT;
245 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Raef Colesc8f96042022-08-25 13:49:54 +0100246 size_t output_hash_len;
Raef Colese9479a02022-09-01 16:06:35 +0100247 unsigned char tmp_hash[MBEDTLS_LMOTS_N_HASH_LEN_MAX];
Raef Coles8ff6df52021-07-21 12:42:15 +0100248
Raef Colese9479a02022-09-01 16:06:35 +0100249 for ( i_digit_idx = 0;
250 i_digit_idx < MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(params->type);
251 i_digit_idx++ )
Raef Coles8ff6df52021-07-21 12:42:15 +0100252 {
253
Raef Coles366d67d2022-09-01 17:23:12 +0100254 memcpy( tmp_hash,
255 &x_digit_array[i_digit_idx * MBEDTLS_LMOTS_N_HASH_LEN(params->type)],
Raef Colese9479a02022-09-01 16:06:35 +0100256 MBEDTLS_LMOTS_N_HASH_LEN(params->type) );
Raef Coles8ff6df52021-07-21 12:42:15 +0100257
Raef Coles366d67d2022-09-01 17:23:12 +0100258 j_hash_idx_min = hash_idx_min_values != NULL ?
259 hash_idx_min_values[i_digit_idx] : 0;
260 j_hash_idx_max = hash_idx_max_values != NULL ?
261 hash_idx_max_values[i_digit_idx] : DIGIT_MAX_VALUE;
Raef Coles8ff6df52021-07-21 12:42:15 +0100262
Raef Coles8738a492022-09-02 17:13:01 +0100263 for ( j_hash_idx = j_hash_idx_min;
Raef Coles366d67d2022-09-01 17:23:12 +0100264 j_hash_idx < j_hash_idx_max;
265 j_hash_idx++ )
Raef Coles8ff6df52021-07-21 12:42:15 +0100266 {
Raef Colesc8f96042022-08-25 13:49:54 +0100267 status = psa_hash_setup( &op, PSA_ALG_SHA_256 );
Raef Coles29117d22022-10-07 11:46:06 +0100268 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100269 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100270
Raef Coles01c71a12022-08-31 15:55:00 +0100271 status = psa_hash_update( &op,
Raef Colesf5632d32022-09-01 09:56:52 +0100272 params->I_key_identifier,
Raef Coles01c71a12022-08-31 15:55:00 +0100273 MBEDTLS_LMOTS_I_KEY_ID_LEN );
Raef Coles29117d22022-10-07 11:46:06 +0100274 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100275 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100276
Raef Coles01c71a12022-08-31 15:55:00 +0100277 status = psa_hash_update( &op,
Raef Colesf5632d32022-09-01 09:56:52 +0100278 params->q_leaf_identifier,
Raef Coles01c71a12022-08-31 15:55:00 +0100279 MBEDTLS_LMOTS_Q_LEAF_ID_LEN );
Raef Coles29117d22022-10-07 11:46:06 +0100280 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100281 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100282
Raef Colesad054252022-09-27 10:59:16 +0100283 mbedtls_lms_unsigned_int_to_network_bytes( i_digit_idx,
284 I_DIGIT_IDX_LEN,
285 i_digit_idx_bytes );
Raef Coles01c71a12022-08-31 15:55:00 +0100286 status = psa_hash_update( &op, i_digit_idx_bytes, I_DIGIT_IDX_LEN );
Raef Coles29117d22022-10-07 11:46:06 +0100287 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100288 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100289
Raef Colesad054252022-09-27 10:59:16 +0100290 mbedtls_lms_unsigned_int_to_network_bytes( j_hash_idx,
291 J_HASH_IDX_LEN,
292 j_hash_idx_bytes );
Raef Colesc8f96042022-08-25 13:49:54 +0100293 status = psa_hash_update( &op, j_hash_idx_bytes, J_HASH_IDX_LEN );
Raef Coles29117d22022-10-07 11:46:06 +0100294 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100295 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100296
Raef Colese9479a02022-09-01 16:06:35 +0100297 status = psa_hash_update( &op, tmp_hash,
298 MBEDTLS_LMOTS_N_HASH_LEN(params->type) );
Raef Coles29117d22022-10-07 11:46:06 +0100299 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100300 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100301
Raef Coles366d67d2022-09-01 17:23:12 +0100302 status = psa_hash_finish( &op, tmp_hash, sizeof( tmp_hash ),
303 &output_hash_len );
Raef Coles29117d22022-10-07 11:46:06 +0100304 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100305 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100306
Raef Colesc8f96042022-08-25 13:49:54 +0100307 psa_hash_abort( &op );
Raef Coles8ff6df52021-07-21 12:42:15 +0100308 }
309
Raef Coles366d67d2022-09-01 17:23:12 +0100310 memcpy( &output[i_digit_idx * MBEDTLS_LMOTS_N_HASH_LEN(params->type)],
311 tmp_hash, MBEDTLS_LMOTS_N_HASH_LEN(params->type) );
Raef Coles8ff6df52021-07-21 12:42:15 +0100312 }
313
Raef Coles01c71a12022-08-31 15:55:00 +0100314exit:
Raef Coles29117d22022-10-07 11:46:06 +0100315 psa_hash_abort( &op );
Raef Coles01c71a12022-08-31 15:55:00 +0100316 mbedtls_platform_zeroize( tmp_hash, sizeof( tmp_hash ) );
317
Raef Coles29117d22022-10-07 11:46:06 +0100318 return( mbedtls_lms_error_from_psa( status ) );
Raef Coles8ff6df52021-07-21 12:42:15 +0100319}
320
Raef Coles0a967cc2022-09-02 17:46:15 +0100321/* Combine the hashes of the digit array into a public key. This is used in
322 * in order to calculate a public key from a private key (RFC8554 Algorithm 1
323 * step 4), and to calculate a public key candidate from a signature and message
324 * (RFC8554 Algorithm 4b step 3).
325 *
Raef Coles98d6e222022-09-23 09:04:04 +0100326 * params The LMOTS parameter set, I and q values which describe
327 * the key being used.
328 * y_hashed_digits The array of hashes, one hash for each digit of the
329 * symbol array (which is of size P, 34 in the case of
330 * MBEDTLS_LMOTS_SHA256_N32_W8)
Raef Coles0a967cc2022-09-02 17:46:15 +0100331 *
Raef Coles98d6e222022-09-23 09:04:04 +0100332 * pub_key The output public key (or candidate public key in
333 * case this is being run as part of signature
334 * verification), in the form of a hash output.
Raef Coles0a967cc2022-09-02 17:46:15 +0100335 */
Raef Coles01c71a12022-08-31 15:55:00 +0100336static int public_key_from_hashed_digit_array( const mbedtls_lmots_parameters_t *params,
Raef Colese9479a02022-09-01 16:06:35 +0100337 const unsigned char *y_hashed_digits,
Raef Coles01c71a12022-08-31 15:55:00 +0100338 unsigned char *pub_key )
Raef Coles8ff6df52021-07-21 12:42:15 +0100339{
Raef Colesbe0c2f92022-10-07 11:27:35 +0100340 psa_hash_operation_t op = PSA_HASH_OPERATION_INIT;
341 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Raef Colesc8f96042022-08-25 13:49:54 +0100342 size_t output_hash_len;
Raef Coles8ff6df52021-07-21 12:42:15 +0100343
Raef Colesc8f96042022-08-25 13:49:54 +0100344 status = psa_hash_setup( &op, PSA_ALG_SHA_256 );
Raef Coles29117d22022-10-07 11:46:06 +0100345 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100346 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100347
Raef Coles01c71a12022-08-31 15:55:00 +0100348 status = psa_hash_update( &op,
Raef Colesf5632d32022-09-01 09:56:52 +0100349 params->I_key_identifier,
Raef Coles01c71a12022-08-31 15:55:00 +0100350 MBEDTLS_LMOTS_I_KEY_ID_LEN );
Raef Coles29117d22022-10-07 11:46:06 +0100351 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100352 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100353
Raef Colesf5632d32022-09-01 09:56:52 +0100354 status = psa_hash_update( &op, params->q_leaf_identifier,
Raef Coles01c71a12022-08-31 15:55:00 +0100355 MBEDTLS_LMOTS_Q_LEAF_ID_LEN );
Raef Coles29117d22022-10-07 11:46:06 +0100356 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100357 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100358
Raef Coles01c71a12022-08-31 15:55:00 +0100359 status = psa_hash_update( &op, D_PUBLIC_CONSTANT_BYTES, D_CONST_LEN );
Raef Coles29117d22022-10-07 11:46:06 +0100360 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100361 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100362
Raef Colese9479a02022-09-01 16:06:35 +0100363 status = psa_hash_update( &op, y_hashed_digits,
364 MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(params->type) *
365 MBEDTLS_LMOTS_N_HASH_LEN(params->type) );
Raef Coles29117d22022-10-07 11:46:06 +0100366 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100367 goto exit;
Raef Coles8ff6df52021-07-21 12:42:15 +0100368
Raef Coles366d67d2022-09-01 17:23:12 +0100369 status = psa_hash_finish( &op, pub_key,
370 MBEDTLS_LMOTS_N_HASH_LEN(params->type),
Raef Colese9479a02022-09-01 16:06:35 +0100371 &output_hash_len );
Raef Coles29117d22022-10-07 11:46:06 +0100372 if( status != PSA_SUCCESS )
Raef Coles8ff6df52021-07-21 12:42:15 +0100373
Raef Coles01c71a12022-08-31 15:55:00 +0100374exit:
Raef Colesc8f96042022-08-25 13:49:54 +0100375 psa_hash_abort( &op );
Raef Coles29117d22022-10-07 11:46:06 +0100376
377 return( mbedtls_lms_error_from_psa( status ) );
Raef Coles8ff6df52021-07-21 12:42:15 +0100378}
379
Raef Coles9b88ee52022-09-02 12:04:21 +0100380int mbedtls_lms_error_from_psa( psa_status_t status )
Raef Colesc8f96042022-08-25 13:49:54 +0100381{
Raef Coles9b88ee52022-09-02 12:04:21 +0100382 switch( status )
383 {
Raef Colesc8f96042022-08-25 13:49:54 +0100384 case PSA_SUCCESS:
385 return( 0 );
386 case PSA_ERROR_HARDWARE_FAILURE:
387 return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
388 case PSA_ERROR_NOT_SUPPORTED:
389 return( MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED );
390 case PSA_ERROR_BUFFER_TOO_SMALL:
391 return( MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL );
392 case PSA_ERROR_INVALID_ARGUMENT:
393 return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
394 default:
395 return( MBEDTLS_ERR_ERROR_GENERIC_ERROR );
396 }
397}
398
Raef Colesbe3bdd82022-10-07 12:04:24 +0100399void mbedtls_lmots_public_init( mbedtls_lmots_public_t *ctx )
Raef Coles8ff6df52021-07-21 12:42:15 +0100400{
Raef Colesbe3bdd82022-10-07 12:04:24 +0100401 mbedtls_platform_zeroize( ctx, sizeof( *ctx ) ) ;
Raef Coles8ff6df52021-07-21 12:42:15 +0100402}
403
Raef Colesbe3bdd82022-10-07 12:04:24 +0100404void mbedtls_lmots_public_free( mbedtls_lmots_public_t *ctx )
Raef Coles8ff6df52021-07-21 12:42:15 +0100405{
Raef Colesbe3bdd82022-10-07 12:04:24 +0100406 mbedtls_platform_zeroize( ctx, sizeof( *ctx ) ) ;
Raef Coles8ff6df52021-07-21 12:42:15 +0100407}
408
Raef Coles01c71a12022-08-31 15:55:00 +0100409int mbedtls_lmots_import_public_key( mbedtls_lmots_public_t *ctx,
410 const unsigned char *key, size_t key_len )
Raef Coles8ff6df52021-07-21 12:42:15 +0100411{
Raef Colese89488d2022-10-07 16:06:35 +0100412 if( key_len < MBEDTLS_LMOTS_SIG_TYPE_OFFSET + MBEDTLS_LMOTS_TYPE_LEN )
413 {
414 return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
415 }
416
Raef Colesf5632d32022-09-01 09:56:52 +0100417 ctx->params.type =
Raef Colesad054252022-09-27 10:59:16 +0100418 mbedtls_lms_network_bytes_to_unsigned_int( MBEDTLS_LMOTS_TYPE_LEN,
419 key + MBEDTLS_LMOTS_SIG_TYPE_OFFSET );
Raef Coles01c71a12022-08-31 15:55:00 +0100420
Raef Colese0a17612022-09-02 16:04:47 +0100421 if( key_len < MBEDTLS_LMOTS_PUBLIC_KEY_LEN(ctx->params.type) )
Raef Colese9479a02022-09-01 16:06:35 +0100422 {
423 return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
424 }
425
Raef Colesf5632d32022-09-01 09:56:52 +0100426 memcpy( ctx->params.I_key_identifier,
Raef Coles57d53282022-09-27 11:30:51 +0100427 key + PUBLIC_KEY_I_KEY_ID_OFFSET,
Raef Coles366d67d2022-09-01 17:23:12 +0100428 MBEDTLS_LMOTS_I_KEY_ID_LEN );
Raef Coles01c71a12022-08-31 15:55:00 +0100429
Raef Colesf5632d32022-09-01 09:56:52 +0100430 memcpy( ctx->params.q_leaf_identifier,
Raef Coles57d53282022-09-27 11:30:51 +0100431 key + PUBLIC_KEY_Q_LEAF_ID_OFFSET,
Raef Coles366d67d2022-09-01 17:23:12 +0100432 MBEDTLS_LMOTS_Q_LEAF_ID_LEN );
Raef Coles01c71a12022-08-31 15:55:00 +0100433
Raef Colesf5632d32022-09-01 09:56:52 +0100434 memcpy( ctx->public_key,
Raef Coles57d53282022-09-27 11:30:51 +0100435 key + PUBLIC_KEY_KEY_HASH_OFFSET,
Raef Colese9479a02022-09-01 16:06:35 +0100436 MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type) );
Raef Coles01c71a12022-08-31 15:55:00 +0100437
Raef Colesf5632d32022-09-01 09:56:52 +0100438 ctx->have_public_key = 1;
Raef Coles8ff6df52021-07-21 12:42:15 +0100439
440 return( 0 );
441}
442
Raef Coles370cc432022-10-07 16:07:33 +0100443int mbedtls_lmots_export_public_key( const mbedtls_lmots_public_t *ctx,
444 unsigned char *key, size_t key_size,
445 size_t *key_len )
446{
447 if( key_size < MBEDTLS_LMOTS_PUBLIC_KEY_LEN(ctx->params.type) )
448 {
449 return( MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL );
450 }
451
452 if( ! ctx->have_public_key )
453 {
454 return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
455 }
456
457 mbedtls_lms_unsigned_int_to_network_bytes( ctx->params.type,
458 MBEDTLS_LMOTS_TYPE_LEN,
459 key + MBEDTLS_LMOTS_SIG_TYPE_OFFSET );
460
461 memcpy( key + PUBLIC_KEY_I_KEY_ID_OFFSET,
462 ctx->params.I_key_identifier,
463 MBEDTLS_LMOTS_I_KEY_ID_LEN );
464
465 memcpy( key + PUBLIC_KEY_Q_LEAF_ID_OFFSET,
466 ctx->params.q_leaf_identifier,
467 MBEDTLS_LMOTS_Q_LEAF_ID_LEN );
468
469 memcpy( key + PUBLIC_KEY_KEY_HASH_OFFSET, ctx->public_key,
470 MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type) );
471
472 if( key_len != NULL )
473 {
474 *key_len = MBEDTLS_LMOTS_PUBLIC_KEY_LEN(ctx->params.type);
475 }
476
477 return( 0 );
478}
479
Raef Coles01c71a12022-08-31 15:55:00 +0100480int mbedtls_lmots_calculate_public_key_candidate( const mbedtls_lmots_parameters_t *params,
481 const unsigned char *msg,
482 size_t msg_size,
483 const unsigned char *sig,
484 size_t sig_size,
485 unsigned char *out,
486 size_t out_size,
Raef Coles9b88ee52022-09-02 12:04:21 +0100487 size_t *out_len )
Raef Coles8ff6df52021-07-21 12:42:15 +0100488{
Raef Colese9479a02022-09-01 16:06:35 +0100489 unsigned char tmp_digit_array[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX];
490 unsigned char y_hashed_digits[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX][MBEDTLS_LMOTS_N_HASH_LEN_MAX];
Raef Coles8ff6df52021-07-21 12:42:15 +0100491 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
492
Raef Colese0a17612022-09-02 16:04:47 +0100493 if( msg == NULL && msg_size != 0 )
Raef Coles01c71a12022-08-31 15:55:00 +0100494 {
495 return ( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
496 }
497
Raef Colese0a17612022-09-02 16:04:47 +0100498 if( sig_size != MBEDTLS_LMOTS_SIG_LEN(params->type) ||
Raef Colese9479a02022-09-01 16:06:35 +0100499 out_size < MBEDTLS_LMOTS_N_HASH_LEN(params->type) )
Raef Coles8ff6df52021-07-21 12:42:15 +0100500 {
Raef Coles7dce69a2022-08-24 14:07:06 +0100501 return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
Raef Coles8ff6df52021-07-21 12:42:15 +0100502 }
503
Raef Coles01c71a12022-08-31 15:55:00 +0100504 ret = create_digit_array_with_checksum( params, msg, msg_size,
505 sig + MBEDTLS_LMOTS_SIG_C_RANDOM_OFFSET,
506 tmp_digit_array );
Raef Colese0a17612022-09-02 16:04:47 +0100507 if( ret )
Raef Coles8ff6df52021-07-21 12:42:15 +0100508 {
509 return ( ret );
510 }
511
Raef Coles01c71a12022-08-31 15:55:00 +0100512 ret = hash_digit_array( params,
Raef Colese9479a02022-09-01 16:06:35 +0100513 sig + MBEDTLS_LMOTS_SIG_SIGNATURE_OFFSET(params->type),
Raef Coles9b88ee52022-09-02 12:04:21 +0100514 tmp_digit_array, NULL, ( unsigned char * )y_hashed_digits );
Raef Colese0a17612022-09-02 16:04:47 +0100515 if( ret )
Raef Coles8ff6df52021-07-21 12:42:15 +0100516 {
517 return ( ret );
518 }
519
Raef Colese9479a02022-09-01 16:06:35 +0100520 ret = public_key_from_hashed_digit_array( params,
Raef Coles9b88ee52022-09-02 12:04:21 +0100521 ( unsigned char * )y_hashed_digits,
Raef Colese9479a02022-09-01 16:06:35 +0100522 out );
Raef Colese0a17612022-09-02 16:04:47 +0100523 if( ret )
Raef Coles8ff6df52021-07-21 12:42:15 +0100524 {
525 return ( ret );
526 }
527
Raef Colese0a17612022-09-02 16:04:47 +0100528 if( out_len != NULL )
Raef Coles01c71a12022-08-31 15:55:00 +0100529 {
Raef Colese9479a02022-09-01 16:06:35 +0100530 *out_len = MBEDTLS_LMOTS_N_HASH_LEN(params->type);
Raef Coles01c71a12022-08-31 15:55:00 +0100531 }
532
Raef Coles8ff6df52021-07-21 12:42:15 +0100533 return( 0 );
534}
535
Raef Coles2ac352a2022-10-07 11:12:27 +0100536int mbedtls_lmots_verify( const mbedtls_lmots_public_t *ctx,
537 const unsigned char *msg, size_t msg_size,
538 const unsigned char *sig, size_t sig_size )
Raef Coles8ff6df52021-07-21 12:42:15 +0100539{
Raef Colese9479a02022-09-01 16:06:35 +0100540 unsigned char Kc_public_key_candidate[MBEDTLS_LMOTS_N_HASH_LEN_MAX];
Raef Coles8ff6df52021-07-21 12:42:15 +0100541 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
542
Raef Colese0a17612022-09-02 16:04:47 +0100543 if( msg == NULL && msg_size != 0 )
Raef Coles01c71a12022-08-31 15:55:00 +0100544 {
545 return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
546 }
547
Raef Colese0a17612022-09-02 16:04:47 +0100548 if( !ctx->have_public_key )
Raef Coles01c71a12022-08-31 15:55:00 +0100549 {
550 return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
551 }
552
Raef Coles9b88ee52022-09-02 12:04:21 +0100553 if( ctx->params.type != MBEDTLS_LMOTS_SHA256_N32_W8 )
Raef Coles01c71a12022-08-31 15:55:00 +0100554 {
555 return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
556 }
557
Raef Colesad054252022-09-27 10:59:16 +0100558 if( mbedtls_lms_network_bytes_to_unsigned_int( MBEDTLS_LMOTS_TYPE_LEN,
Raef Coles366d67d2022-09-01 17:23:12 +0100559 sig + MBEDTLS_LMOTS_SIG_TYPE_OFFSET ) != MBEDTLS_LMOTS_SHA256_N32_W8 )
Raef Coles01c71a12022-08-31 15:55:00 +0100560 {
561 return( MBEDTLS_ERR_LMS_VERIFY_FAILED );
562 }
563
Raef Colesf5632d32022-09-01 09:56:52 +0100564 ret = mbedtls_lmots_calculate_public_key_candidate( &ctx->params,
Raef Coles01c71a12022-08-31 15:55:00 +0100565 msg, msg_size, sig, sig_size,
566 Kc_public_key_candidate,
Raef Colese9479a02022-09-01 16:06:35 +0100567 MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type),
Raef Coles9b88ee52022-09-02 12:04:21 +0100568 NULL );
Raef Colese0a17612022-09-02 16:04:47 +0100569 if( ret )
Raef Coles01c71a12022-08-31 15:55:00 +0100570 {
571 return( ret );
572 }
573
Raef Colese0a17612022-09-02 16:04:47 +0100574 if( memcmp( &Kc_public_key_candidate, ctx->public_key,
Raef Colesf5632d32022-09-01 09:56:52 +0100575 sizeof( ctx->public_key ) ) )
Raef Coles01c71a12022-08-31 15:55:00 +0100576 {
577 return( MBEDTLS_ERR_LMS_VERIFY_FAILED );
578 }
579
580 return( 0 );
581}
582
Raef Coles5127e852022-10-07 10:35:56 +0100583#if defined(MBEDTLS_LMS_PRIVATE)
Raef Colesab4f8742022-09-01 12:24:31 +0100584
Raef Colesbe3bdd82022-10-07 12:04:24 +0100585void mbedtls_lmots_private_init( mbedtls_lmots_private_t *ctx )
Raef Coles01c71a12022-08-31 15:55:00 +0100586{
Raef Colesbe3bdd82022-10-07 12:04:24 +0100587 mbedtls_platform_zeroize( ctx, sizeof( *ctx ) ) ;
Raef Coles01c71a12022-08-31 15:55:00 +0100588}
589
Raef Colesbe3bdd82022-10-07 12:04:24 +0100590void mbedtls_lmots_private_free( mbedtls_lmots_private_t *ctx )
Raef Coles01c71a12022-08-31 15:55:00 +0100591{
Raef Colesbe3bdd82022-10-07 12:04:24 +0100592 mbedtls_platform_zeroize( ctx, sizeof( *ctx ) ) ;
Raef Coles01c71a12022-08-31 15:55:00 +0100593}
594
595int mbedtls_lmots_generate_private_key( mbedtls_lmots_private_t *ctx,
596 mbedtls_lmots_algorithm_type_t type,
597 const unsigned char I_key_identifier[MBEDTLS_LMOTS_I_KEY_ID_LEN],
598 uint32_t q_leaf_identifier,
599 const unsigned char *seed,
600 size_t seed_size )
601{
Raef Colesbe0c2f92022-10-07 11:27:35 +0100602 psa_hash_operation_t op = PSA_HASH_OPERATION_INIT;
603 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Raef Coles01c71a12022-08-31 15:55:00 +0100604 size_t output_hash_len;
605 unsigned int i_digit_idx;
606 unsigned char i_digit_idx_bytes[2];
607 unsigned char const_bytes[1];
Raef Coles01c71a12022-08-31 15:55:00 +0100608
Raef Colese0a17612022-09-02 16:04:47 +0100609 if( ctx->have_private_key )
Raef Coles01c71a12022-08-31 15:55:00 +0100610 {
611 return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
612 }
613
Raef Colese0a17612022-09-02 16:04:47 +0100614 if( type != MBEDTLS_LMOTS_SHA256_N32_W8 )
Raef Coles9b88ee52022-09-02 12:04:21 +0100615 {
Raef Coles01c71a12022-08-31 15:55:00 +0100616 return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
617 }
618
Raef Colesf5632d32022-09-01 09:56:52 +0100619 ctx->params.type = type;
Raef Coles01c71a12022-08-31 15:55:00 +0100620
Raef Colesf5632d32022-09-01 09:56:52 +0100621 memcpy( ctx->params.I_key_identifier,
Raef Coles01c71a12022-08-31 15:55:00 +0100622 I_key_identifier,
Raef Colesf5632d32022-09-01 09:56:52 +0100623 sizeof( ctx->params.I_key_identifier ) );
Raef Coles01c71a12022-08-31 15:55:00 +0100624
Raef Colesad054252022-09-27 10:59:16 +0100625 mbedtls_lms_unsigned_int_to_network_bytes( q_leaf_identifier,
626 MBEDTLS_LMOTS_Q_LEAF_ID_LEN,
627 ctx->params.q_leaf_identifier );
Raef Coles01c71a12022-08-31 15:55:00 +0100628
Raef Colesad054252022-09-27 10:59:16 +0100629 mbedtls_lms_unsigned_int_to_network_bytes( 0xFF, sizeof( const_bytes ),
630 const_bytes );
Raef Coles01c71a12022-08-31 15:55:00 +0100631
Raef Colese9479a02022-09-01 16:06:35 +0100632 for ( i_digit_idx = 0;
633 i_digit_idx < MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(ctx->params.type);
634 i_digit_idx++ )
Raef Coles01c71a12022-08-31 15:55:00 +0100635 {
Raef Coles01c71a12022-08-31 15:55:00 +0100636 status = psa_hash_setup( &op, PSA_ALG_SHA_256 );
Raef Coles29117d22022-10-07 11:46:06 +0100637 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100638 goto exit;
639
Raef Coles29117d22022-10-07 11:46:06 +0100640 status = psa_hash_update( &op,
Raef Colesf5632d32022-09-01 09:56:52 +0100641 ctx->params.I_key_identifier,
642 sizeof( ctx->params.I_key_identifier ) );
Raef Coles29117d22022-10-07 11:46:06 +0100643 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100644 goto exit;
645
646 status = psa_hash_update( &op,
Raef Colesf5632d32022-09-01 09:56:52 +0100647 ctx->params.q_leaf_identifier,
Raef Coles01c71a12022-08-31 15:55:00 +0100648 MBEDTLS_LMOTS_Q_LEAF_ID_LEN );
Raef Coles29117d22022-10-07 11:46:06 +0100649 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100650 goto exit;
651
Raef Colesad054252022-09-27 10:59:16 +0100652 mbedtls_lms_unsigned_int_to_network_bytes( i_digit_idx, I_DIGIT_IDX_LEN,
653 i_digit_idx_bytes );
Raef Coles01c71a12022-08-31 15:55:00 +0100654 status = psa_hash_update( &op, i_digit_idx_bytes, I_DIGIT_IDX_LEN );
Raef Coles29117d22022-10-07 11:46:06 +0100655 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100656 goto exit;
657
Raef Coles9b88ee52022-09-02 12:04:21 +0100658 status = psa_hash_update( &op, const_bytes, sizeof( const_bytes ) );
Raef Coles29117d22022-10-07 11:46:06 +0100659 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100660 goto exit;
661
662 status = psa_hash_update( &op, seed, seed_size );
Raef Coles29117d22022-10-07 11:46:06 +0100663 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100664 goto exit;
665
666 status = psa_hash_finish( &op,
Raef Colesf5632d32022-09-01 09:56:52 +0100667 ctx->private_key[i_digit_idx],
Raef Colese9479a02022-09-01 16:06:35 +0100668 MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type),
669 &output_hash_len );
Raef Coles29117d22022-10-07 11:46:06 +0100670 if( status != PSA_SUCCESS )
Raef Coles01c71a12022-08-31 15:55:00 +0100671 goto exit;
672
673 psa_hash_abort( &op );
674 }
675
Raef Colesf5632d32022-09-01 09:56:52 +0100676 ctx->have_private_key = 1;
Raef Coles01c71a12022-08-31 15:55:00 +0100677
678exit:
Raef Coles29117d22022-10-07 11:46:06 +0100679 psa_hash_abort( &op );
Raef Coles01c71a12022-08-31 15:55:00 +0100680
Raef Coles29117d22022-10-07 11:46:06 +0100681 return ( mbedtls_lms_error_from_psa( status ) );
Raef Coles01c71a12022-08-31 15:55:00 +0100682}
683
684int mbedtls_lmots_calculate_public_key( mbedtls_lmots_public_t *ctx,
Raef Coles2ac352a2022-10-07 11:12:27 +0100685 const mbedtls_lmots_private_t *priv_ctx )
Raef Coles01c71a12022-08-31 15:55:00 +0100686{
Raef Colese9479a02022-09-01 16:06:35 +0100687 unsigned char y_hashed_digits[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX][MBEDTLS_LMOTS_N_HASH_LEN_MAX];
Raef Coles01c71a12022-08-31 15:55:00 +0100688 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
689
Raef Coles8ff6df52021-07-21 12:42:15 +0100690 /* Check that a private key is loaded */
Raef Colese0a17612022-09-02 16:04:47 +0100691 if( !priv_ctx->have_private_key )
Raef Coles01c71a12022-08-31 15:55:00 +0100692 {
693 return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
694 }
695
Raef Colese9479a02022-09-01 16:06:35 +0100696 ret = hash_digit_array( &priv_ctx->params,
Raef Coles9b88ee52022-09-02 12:04:21 +0100697 ( unsigned char * )priv_ctx->private_key, NULL,
698 NULL, ( unsigned char * )y_hashed_digits );
Raef Colese0a17612022-09-02 16:04:47 +0100699 if( ret )
Raef Coles01c71a12022-08-31 15:55:00 +0100700 {
701 return( ret );
702 }
703
Raef Colesf5632d32022-09-01 09:56:52 +0100704 ret = public_key_from_hashed_digit_array( &priv_ctx->params,
Raef Coles9b88ee52022-09-02 12:04:21 +0100705 ( unsigned char * )y_hashed_digits,
Raef Coles0c88d4e2022-09-01 10:48:32 +0100706 ctx->public_key );
Raef Colese0a17612022-09-02 16:04:47 +0100707 if( ret )
Raef Coles01c71a12022-08-31 15:55:00 +0100708 {
709 return( ret );
710 }
711
Raef Colesf5632d32022-09-01 09:56:52 +0100712 memcpy( &ctx->params, &priv_ctx->params,
713 sizeof( ctx->params ) );
Raef Coles01c71a12022-08-31 15:55:00 +0100714
Raef Coles9b88ee52022-09-02 12:04:21 +0100715 ctx->have_public_key = 1;
Raef Coles01c71a12022-08-31 15:55:00 +0100716
717 return( ret );
718}
719
Raef Coles01c71a12022-08-31 15:55:00 +0100720int mbedtls_lmots_sign( mbedtls_lmots_private_t *ctx,
721 int (*f_rng)(void *, unsigned char *, size_t),
722 void *p_rng, const unsigned char *msg, size_t msg_size,
723 unsigned char *sig, size_t sig_size, size_t* sig_len )
724{
Raef Colese9479a02022-09-01 16:06:35 +0100725 unsigned char tmp_digit_array[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX];
Raef Coles891c6132022-09-01 11:05:48 +0100726 /* Create a temporary buffer to prepare the signature in. This allows us to
727 * finish creating a signature (ensuring the process doesn't fail), and then
728 * erase the private key **before** writing any data into the sig parameter
729 * buffer. If data were directly written into the sig buffer, it might leak
730 * a partial signature on failure, which effectively compromises the private
731 * key.
732 */
Raef Colese9479a02022-09-01 16:06:35 +0100733 unsigned char tmp_sig[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX][MBEDTLS_LMOTS_N_HASH_LEN_MAX];
Raef Coles57d53282022-09-27 11:30:51 +0100734 unsigned char tmp_c_random[C_RANDOM_VALUE_LEN_MAX];
Raef Coles01c71a12022-08-31 15:55:00 +0100735 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
736
Raef Colese0a17612022-09-02 16:04:47 +0100737 if( msg == NULL && msg_size != 0 )
Raef Coles01c71a12022-08-31 15:55:00 +0100738 {
739 return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
740 }
741
Raef Colese9479a02022-09-01 16:06:35 +0100742 if( sig_size < MBEDTLS_LMOTS_SIG_LEN(ctx->params.type) )
Raef Coles01c71a12022-08-31 15:55:00 +0100743 {
744 return( MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL );
745 }
746
747 /* Check that a private key is loaded */
Raef Colese0a17612022-09-02 16:04:47 +0100748 if( !ctx->have_private_key )
Raef Coles8ff6df52021-07-21 12:42:15 +0100749 {
Raef Coles7dce69a2022-08-24 14:07:06 +0100750 return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
Raef Coles8ff6df52021-07-21 12:42:15 +0100751 }
752
Raef Coles366d67d2022-09-01 17:23:12 +0100753 ret = f_rng( p_rng, tmp_c_random,
754 MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type) );
Raef Colese0a17612022-09-02 16:04:47 +0100755 if( ret )
Raef Coles8ff6df52021-07-21 12:42:15 +0100756 {
757 return( ret );
758 }
759
Raef Colesf5632d32022-09-01 09:56:52 +0100760 ret = create_digit_array_with_checksum( &ctx->params,
Raef Coles01c71a12022-08-31 15:55:00 +0100761 msg, msg_size,
Raef Coles891c6132022-09-01 11:05:48 +0100762 tmp_c_random,
Raef Coles01c71a12022-08-31 15:55:00 +0100763 tmp_digit_array );
Raef Colese0a17612022-09-02 16:04:47 +0100764 if( ret )
Raef Coles8ff6df52021-07-21 12:42:15 +0100765 {
766 return( ret );
767 }
768
Raef Coles9b88ee52022-09-02 12:04:21 +0100769 ret = hash_digit_array( &ctx->params, ( unsigned char * )ctx->private_key,
770 NULL, tmp_digit_array, ( unsigned char * )tmp_sig );
Raef Colese0a17612022-09-02 16:04:47 +0100771 if( ret )
Raef Coles8ff6df52021-07-21 12:42:15 +0100772 {
773 return( ret );
774 }
775
Raef Colesad054252022-09-27 10:59:16 +0100776 mbedtls_lms_unsigned_int_to_network_bytes( ctx->params.type,
777 MBEDTLS_LMOTS_TYPE_LEN,
778 sig + MBEDTLS_LMOTS_SIG_TYPE_OFFSET );
Raef Coles8ff6df52021-07-21 12:42:15 +0100779
Raef Coles9c9027b2022-09-02 18:26:31 +0100780 /* Test hook to check if sig is being written to before we invalidate the
781 * private key.
782 */
783#if defined(MBEDTLS_TEST_HOOKS)
784 if( mbedtls_lmots_sign_private_key_invalidated_hook != NULL )
785 {
786 ret = ( *mbedtls_lmots_sign_private_key_invalidated_hook )( sig );
787 if( ret != 0 )
788 return( ret );
789 }
790#endif /* defined(MBEDTLS_TEST_HOOKS) */
791
Raef Coles8ff6df52021-07-21 12:42:15 +0100792 /* We've got a valid signature now, so it's time to make sure the private
793 * key can't be reused.
794 */
Raef Colesf5632d32022-09-01 09:56:52 +0100795 ctx->have_private_key = 0;
Raef Coles9b88ee52022-09-02 12:04:21 +0100796 mbedtls_platform_zeroize( ctx->private_key,
797 sizeof( ctx->private_key ) );
Raef Coles8ff6df52021-07-21 12:42:15 +0100798
Raef Coles891c6132022-09-01 11:05:48 +0100799 memcpy( sig + MBEDTLS_LMOTS_SIG_C_RANDOM_OFFSET, tmp_c_random,
Raef Colese9479a02022-09-01 16:06:35 +0100800 MBEDTLS_LMOTS_C_RANDOM_VALUE_LEN(ctx->params.type) );
Raef Coles891c6132022-09-01 11:05:48 +0100801
Raef Colese9479a02022-09-01 16:06:35 +0100802 memcpy( sig + MBEDTLS_LMOTS_SIG_SIGNATURE_OFFSET(ctx->params.type), tmp_sig,
803 MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(ctx->params.type)
804 * MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type) );
Raef Coles8ff6df52021-07-21 12:42:15 +0100805
Raef Coles01c71a12022-08-31 15:55:00 +0100806 if( sig_len != NULL )
Raef Coles8ff6df52021-07-21 12:42:15 +0100807 {
Raef Colese9479a02022-09-01 16:06:35 +0100808 *sig_len = MBEDTLS_LMOTS_SIG_LEN(ctx->params.type);
Raef Coles8ff6df52021-07-21 12:42:15 +0100809 }
810
811 return( 0 );
812}
813
Raef Coles5127e852022-10-07 10:35:56 +0100814#endif /* defined(MBEDTLS_LMS_PRIVATE) */
815#endif /* defined(MBEDTLS_LMS_C) */