| /* |
| * The LM-OTS one-time public-key signature scheme |
| * |
| * Copyright The Mbed TLS Contributors |
| * SPDX-License-Identifier: Apache-2.0 |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| * not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| /* |
| * The following sources were referenced in the design of this implementation |
| * of the LM-OTS algorithm: |
| * |
| * [1] IETF RFC8554 |
| * D. McGrew, M. Curcio, S.Fluhrer |
| * https://datatracker.ietf.org/doc/html/rfc8554 |
| * |
| * [2] NIST Special Publication 800-208 |
| * David A. Cooper et. al. |
| * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-208.pdf |
| */ |
| |
| #include "common.h" |
| |
| #if defined(MBEDTLS_LMS_C) |
| |
| #include <string.h> |
| |
| #include "lmots.h" |
| |
| #include "mbedtls/lms.h" |
| #include "mbedtls/platform_util.h" |
| #include "mbedtls/error.h" |
| |
| #include "psa/crypto.h" |
| |
| #define PUBLIC_KEY_TYPE_OFFSET (0) |
| #define PUBLIC_KEY_I_KEY_ID_OFFSET (PUBLIC_KEY_TYPE_OFFSET + \ |
| MBEDTLS_LMOTS_TYPE_LEN) |
| #define PUBLIC_KEY_Q_LEAF_ID_OFFSET (PUBLIC_KEY_I_KEY_ID_OFFSET + \ |
| MBEDTLS_LMOTS_I_KEY_ID_LEN) |
| #define PUBLIC_KEY_KEY_HASH_OFFSET (PUBLIC_KEY_Q_LEAF_ID_OFFSET + \ |
| MBEDTLS_LMOTS_Q_LEAF_ID_LEN) |
| |
| /* We only support parameter sets that use 8-bit digits, as it does not require |
| * translation logic between digits and bytes */ |
| #define W_WINTERNITZ_PARAMETER (8u) |
| #define CHECKSUM_LEN (2) |
| #define I_DIGIT_IDX_LEN (2) |
| #define J_HASH_IDX_LEN (1) |
| #define D_CONST_LEN (2) |
| |
| #define DIGIT_MAX_VALUE ((1u << W_WINTERNITZ_PARAMETER) - 1u) |
| |
| #define D_CONST_LEN (2) |
| static const unsigned char D_PUBLIC_CONSTANT_BYTES[D_CONST_LEN] = {0x80, 0x80}; |
| static const unsigned char D_MESSAGE_CONSTANT_BYTES[D_CONST_LEN] = {0x81, 0x81}; |
| |
| #if defined(MBEDTLS_TEST_HOOKS) |
| int( *mbedtls_lmots_sign_private_key_invalidated_hook )( unsigned char * ) = NULL; |
| #endif /* defined(MBEDTLS_TEST_HOOKS) */ |
| |
| void mbedtls_lms_unsigned_int_to_network_bytes( unsigned int val, size_t len, |
| unsigned char *bytes ) |
| { |
| size_t idx; |
| |
| for ( idx = 0; idx < len; idx++ ) |
| { |
| bytes[idx] = ( val >> ( ( len - 1 - idx ) * 8 ) ) & 0xFF; |
| } |
| } |
| |
| unsigned int mbedtls_lms_network_bytes_to_unsigned_int( size_t len, |
| const unsigned char *bytes ) |
| { |
| size_t idx; |
| unsigned int val = 0; |
| |
| for ( idx = 0; idx < len; idx++ ) |
| { |
| val |= ( ( unsigned int )bytes[idx] ) << (8 * ( len - 1 - idx ) ); |
| } |
| |
| return ( val ); |
| } |
| |
| /* Calculate the checksum digits that are appended to the end of the LMOTS digit |
| * string. See NIST SP800-208 section 3.1 or RFC8554 Algorithm 2 for details of |
| * the checksum algorithm. |
| * |
| * params The LMOTS parameter set, I and q values which |
| * describe the key being used. |
| * |
| * digest The digit string to create the digest from. As |
| * this does not contain a checksum, it is the same |
| * size as a hash output. |
| */ |
| static unsigned short lmots_checksum_calculate( const mbedtls_lmots_parameters_t *params, |
| const unsigned char* digest ) |
| { |
| size_t idx; |
| unsigned sum = 0; |
| |
| for ( idx = 0; idx < MBEDTLS_LMOTS_N_HASH_LEN(params->type); idx++ ) |
| { |
| sum += DIGIT_MAX_VALUE - digest[idx]; |
| } |
| |
| return ( sum ); |
| } |
| |
| /* Create the string of digest digits (in the base determined by the Winternitz |
| * parameter with the checksum appended to the end (Q || cksm(Q)). See NIST |
| * SP800-208 section 3.1 or RFC8554 Algorithm 3 step 5 (also used in Algorithm |
| * 4b step 3) for details. |
| * |
| * params The LMOTS parameter set, I and q values which |
| * describe the key being used. |
| * |
| * msg The message that will be hashed to create the |
| * digest. |
| * |
| * msg_size The size of the message. |
| * |
| * C_random_value The random value that will be combined with the |
| * message digest. This is always the same size as a |
| * hash output for whichever hash algorithm is |
| * determined by the parameter set. |
| * |
| * output An output containing the digit string (+ |
| * checksum) of length P digits (in the case of |
| * MBEDTLS_LMOTS_SHA256_N32_W8, this means it is of |
| * size P bytes). |
| */ |
| static int create_digit_array_with_checksum( const mbedtls_lmots_parameters_t *params, |
| const unsigned char *msg, |
| size_t msg_len, |
| const unsigned char *C_random_value, |
| unsigned char *out ) |
| { |
| psa_hash_operation_t op = PSA_HASH_OPERATION_INIT; |
| psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| size_t output_hash_len; |
| unsigned short checksum; |
| |
| status = psa_hash_setup( &op, PSA_ALG_SHA_256 ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_update( &op, params->I_key_identifier, |
| MBEDTLS_LMOTS_I_KEY_ID_LEN ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_update( &op, params->q_leaf_identifier, |
| MBEDTLS_LMOTS_Q_LEAF_ID_LEN ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_update( &op, D_MESSAGE_CONSTANT_BYTES, D_CONST_LEN ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_update( &op, C_random_value, |
| MBEDTLS_LMOTS_C_RANDOM_VALUE_LEN(params->type) ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_update( &op, msg, msg_len ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_finish( &op, out, |
| MBEDTLS_LMOTS_N_HASH_LEN(params->type), |
| &output_hash_len ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| checksum = lmots_checksum_calculate( params, out ); |
| mbedtls_lms_unsigned_int_to_network_bytes( checksum, CHECKSUM_LEN, |
| out + MBEDTLS_LMOTS_N_HASH_LEN(params->type) ); |
| |
| exit: |
| psa_hash_abort( &op ); |
| |
| return( mbedtls_lms_error_from_psa( status ) ); |
| } |
| |
| /* Hash each element of the string of digits (+ checksum), producing a hash |
| * output for each element. This is used in several places (by varying the |
| * hash_idx_min/max_values) in order to calculate a public key from a private |
| * key (RFC8554 Algorithm 1 step 4), in order to sign a message (RFC8554 |
| * Algorithm 3 step 5), and to calculate a public key candidate from a |
| * signature and message (RFC8554 Algorithm 4b step 3). |
| * |
| * params The LMOTS parameter set, I and q values which |
| * describe the key being used. |
| * |
| * x_digit_array The array of digits (of size P, 34 in the case of |
| * MBEDTLS_LMOTS_SHA256_N32_W8). |
| * |
| * hash_idx_min_values An array of the starting values of the j iterator |
| * for each of the members of the digit array. If |
| * this value in NULL, then all iterators will start |
| * at 0. |
| * |
| * hash_idx_max_values An array of the upper bound values of the j |
| * iterator for each of the members of the digit |
| * array. If this value in NULL, then iterator is |
| * bounded to be less than 2^w - 1 (255 in the case |
| * of MBEDTLS_LMOTS_SHA256_N32_W8) |
| * |
| * output An array containing a hash output for each member |
| * of the digit string P. In the case of |
| * MBEDTLS_LMOTS_SHA256_N32_W8, this is of size 32 * |
| * 34. |
| */ |
| static int hash_digit_array( const mbedtls_lmots_parameters_t *params, |
| const unsigned char *x_digit_array, |
| const unsigned char *hash_idx_min_values, |
| const unsigned char *hash_idx_max_values, |
| unsigned char *output ) |
| { |
| unsigned int i_digit_idx; |
| unsigned char i_digit_idx_bytes[I_DIGIT_IDX_LEN]; |
| unsigned int j_hash_idx; |
| unsigned char j_hash_idx_bytes[J_HASH_IDX_LEN]; |
| unsigned int j_hash_idx_min; |
| unsigned int j_hash_idx_max; |
| psa_hash_operation_t op = PSA_HASH_OPERATION_INIT; |
| psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| size_t output_hash_len; |
| unsigned char tmp_hash[MBEDTLS_LMOTS_N_HASH_LEN_MAX]; |
| |
| for ( i_digit_idx = 0; |
| i_digit_idx < MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(params->type); |
| i_digit_idx++ ) |
| { |
| |
| memcpy( tmp_hash, |
| &x_digit_array[i_digit_idx * MBEDTLS_LMOTS_N_HASH_LEN(params->type)], |
| MBEDTLS_LMOTS_N_HASH_LEN(params->type) ); |
| |
| j_hash_idx_min = hash_idx_min_values != NULL ? |
| hash_idx_min_values[i_digit_idx] : 0; |
| j_hash_idx_max = hash_idx_max_values != NULL ? |
| hash_idx_max_values[i_digit_idx] : DIGIT_MAX_VALUE; |
| |
| for ( j_hash_idx = j_hash_idx_min; |
| j_hash_idx < j_hash_idx_max; |
| j_hash_idx++ ) |
| { |
| status = psa_hash_setup( &op, PSA_ALG_SHA_256 ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_update( &op, |
| params->I_key_identifier, |
| MBEDTLS_LMOTS_I_KEY_ID_LEN ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_update( &op, |
| params->q_leaf_identifier, |
| MBEDTLS_LMOTS_Q_LEAF_ID_LEN ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| mbedtls_lms_unsigned_int_to_network_bytes( i_digit_idx, |
| I_DIGIT_IDX_LEN, |
| i_digit_idx_bytes ); |
| status = psa_hash_update( &op, i_digit_idx_bytes, I_DIGIT_IDX_LEN ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| mbedtls_lms_unsigned_int_to_network_bytes( j_hash_idx, |
| J_HASH_IDX_LEN, |
| j_hash_idx_bytes ); |
| status = psa_hash_update( &op, j_hash_idx_bytes, J_HASH_IDX_LEN ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_update( &op, tmp_hash, |
| MBEDTLS_LMOTS_N_HASH_LEN(params->type) ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_finish( &op, tmp_hash, sizeof( tmp_hash ), |
| &output_hash_len ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| psa_hash_abort( &op ); |
| } |
| |
| memcpy( &output[i_digit_idx * MBEDTLS_LMOTS_N_HASH_LEN(params->type)], |
| tmp_hash, MBEDTLS_LMOTS_N_HASH_LEN(params->type) ); |
| } |
| |
| exit: |
| psa_hash_abort( &op ); |
| mbedtls_platform_zeroize( tmp_hash, sizeof( tmp_hash ) ); |
| |
| return( mbedtls_lms_error_from_psa( status ) ); |
| } |
| |
| /* Combine the hashes of the digit array into a public key. This is used in |
| * in order to calculate a public key from a private key (RFC8554 Algorithm 1 |
| * step 4), and to calculate a public key candidate from a signature and message |
| * (RFC8554 Algorithm 4b step 3). |
| * |
| * params The LMOTS parameter set, I and q values which describe |
| * the key being used. |
| * y_hashed_digits The array of hashes, one hash for each digit of the |
| * symbol array (which is of size P, 34 in the case of |
| * MBEDTLS_LMOTS_SHA256_N32_W8) |
| * |
| * pub_key The output public key (or candidate public key in |
| * case this is being run as part of signature |
| * verification), in the form of a hash output. |
| */ |
| static int public_key_from_hashed_digit_array( const mbedtls_lmots_parameters_t *params, |
| const unsigned char *y_hashed_digits, |
| unsigned char *pub_key ) |
| { |
| psa_hash_operation_t op = PSA_HASH_OPERATION_INIT; |
| psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| size_t output_hash_len; |
| |
| status = psa_hash_setup( &op, PSA_ALG_SHA_256 ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_update( &op, |
| params->I_key_identifier, |
| MBEDTLS_LMOTS_I_KEY_ID_LEN ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_update( &op, params->q_leaf_identifier, |
| MBEDTLS_LMOTS_Q_LEAF_ID_LEN ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_update( &op, D_PUBLIC_CONSTANT_BYTES, D_CONST_LEN ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_update( &op, y_hashed_digits, |
| MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(params->type) * |
| MBEDTLS_LMOTS_N_HASH_LEN(params->type) ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_finish( &op, pub_key, |
| MBEDTLS_LMOTS_N_HASH_LEN(params->type), |
| &output_hash_len ); |
| if( status != PSA_SUCCESS ) |
| |
| exit: |
| psa_hash_abort( &op ); |
| |
| return( mbedtls_lms_error_from_psa( status ) ); |
| } |
| |
| int mbedtls_lms_error_from_psa( psa_status_t status ) |
| { |
| switch( status ) |
| { |
| case PSA_SUCCESS: |
| return( 0 ); |
| case PSA_ERROR_HARDWARE_FAILURE: |
| return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED ); |
| case PSA_ERROR_NOT_SUPPORTED: |
| return( MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED ); |
| case PSA_ERROR_BUFFER_TOO_SMALL: |
| return( MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL ); |
| case PSA_ERROR_INVALID_ARGUMENT: |
| return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA ); |
| default: |
| return( MBEDTLS_ERR_ERROR_GENERIC_ERROR ); |
| } |
| } |
| |
| void mbedtls_lmots_public_init( mbedtls_lmots_public_t *ctx ) |
| { |
| memset( ctx, 0, sizeof( *ctx ) ) ; |
| } |
| |
| void mbedtls_lmots_public_free( mbedtls_lmots_public_t *ctx ) |
| { |
| mbedtls_platform_zeroize( ctx, sizeof( *ctx ) ) ; |
| } |
| |
| int mbedtls_lmots_import_public_key( mbedtls_lmots_public_t *ctx, |
| const unsigned char *key, size_t key_len ) |
| { |
| if( key_len < MBEDTLS_LMOTS_SIG_TYPE_OFFSET + MBEDTLS_LMOTS_TYPE_LEN ) |
| { |
| return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA ); |
| } |
| |
| ctx->params.type = |
| mbedtls_lms_network_bytes_to_unsigned_int( MBEDTLS_LMOTS_TYPE_LEN, |
| key + MBEDTLS_LMOTS_SIG_TYPE_OFFSET ); |
| |
| if( key_len != MBEDTLS_LMOTS_PUBLIC_KEY_LEN(ctx->params.type) ) |
| { |
| return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA ); |
| } |
| |
| memcpy( ctx->params.I_key_identifier, |
| key + PUBLIC_KEY_I_KEY_ID_OFFSET, |
| MBEDTLS_LMOTS_I_KEY_ID_LEN ); |
| |
| memcpy( ctx->params.q_leaf_identifier, |
| key + PUBLIC_KEY_Q_LEAF_ID_OFFSET, |
| MBEDTLS_LMOTS_Q_LEAF_ID_LEN ); |
| |
| memcpy( ctx->public_key, |
| key + PUBLIC_KEY_KEY_HASH_OFFSET, |
| MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type) ); |
| |
| ctx->have_public_key = 1; |
| |
| return( 0 ); |
| } |
| |
| int mbedtls_lmots_export_public_key( const mbedtls_lmots_public_t *ctx, |
| unsigned char *key, size_t key_size, |
| size_t *key_len ) |
| { |
| if( key_size < MBEDTLS_LMOTS_PUBLIC_KEY_LEN(ctx->params.type) ) |
| { |
| return( MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL ); |
| } |
| |
| if( ! ctx->have_public_key ) |
| { |
| return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA ); |
| } |
| |
| mbedtls_lms_unsigned_int_to_network_bytes( ctx->params.type, |
| MBEDTLS_LMOTS_TYPE_LEN, |
| key + MBEDTLS_LMOTS_SIG_TYPE_OFFSET ); |
| |
| memcpy( key + PUBLIC_KEY_I_KEY_ID_OFFSET, |
| ctx->params.I_key_identifier, |
| MBEDTLS_LMOTS_I_KEY_ID_LEN ); |
| |
| memcpy( key + PUBLIC_KEY_Q_LEAF_ID_OFFSET, |
| ctx->params.q_leaf_identifier, |
| MBEDTLS_LMOTS_Q_LEAF_ID_LEN ); |
| |
| memcpy( key + PUBLIC_KEY_KEY_HASH_OFFSET, ctx->public_key, |
| MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type) ); |
| |
| if( key_len != NULL ) |
| { |
| *key_len = MBEDTLS_LMOTS_PUBLIC_KEY_LEN(ctx->params.type); |
| } |
| |
| return( 0 ); |
| } |
| |
| int mbedtls_lmots_calculate_public_key_candidate( const mbedtls_lmots_parameters_t *params, |
| const unsigned char *msg, |
| size_t msg_size, |
| const unsigned char *sig, |
| size_t sig_size, |
| unsigned char *out, |
| size_t out_size, |
| size_t *out_len ) |
| { |
| unsigned char tmp_digit_array[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX]; |
| unsigned char y_hashed_digits[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX][MBEDTLS_LMOTS_N_HASH_LEN_MAX]; |
| int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| |
| if( msg == NULL && msg_size != 0 ) |
| { |
| return ( MBEDTLS_ERR_LMS_BAD_INPUT_DATA ); |
| } |
| |
| if( sig_size != MBEDTLS_LMOTS_SIG_LEN(params->type) || |
| out_size < MBEDTLS_LMOTS_N_HASH_LEN(params->type) ) |
| { |
| return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA ); |
| } |
| |
| ret = create_digit_array_with_checksum( params, msg, msg_size, |
| sig + MBEDTLS_LMOTS_SIG_C_RANDOM_OFFSET, |
| tmp_digit_array ); |
| if( ret ) |
| { |
| return ( ret ); |
| } |
| |
| ret = hash_digit_array( params, |
| sig + MBEDTLS_LMOTS_SIG_SIGNATURE_OFFSET(params->type), |
| tmp_digit_array, NULL, ( unsigned char * )y_hashed_digits ); |
| if( ret ) |
| { |
| return ( ret ); |
| } |
| |
| ret = public_key_from_hashed_digit_array( params, |
| ( unsigned char * )y_hashed_digits, |
| out ); |
| if( ret ) |
| { |
| return ( ret ); |
| } |
| |
| if( out_len != NULL ) |
| { |
| *out_len = MBEDTLS_LMOTS_N_HASH_LEN(params->type); |
| } |
| |
| return( 0 ); |
| } |
| |
| int mbedtls_lmots_verify( const mbedtls_lmots_public_t *ctx, |
| const unsigned char *msg, size_t msg_size, |
| const unsigned char *sig, size_t sig_size ) |
| { |
| unsigned char Kc_public_key_candidate[MBEDTLS_LMOTS_N_HASH_LEN_MAX]; |
| int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| |
| if( msg == NULL && msg_size != 0 ) |
| { |
| return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA ); |
| } |
| |
| if( !ctx->have_public_key ) |
| { |
| return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA ); |
| } |
| |
| if( ctx->params.type != MBEDTLS_LMOTS_SHA256_N32_W8 ) |
| { |
| return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA ); |
| } |
| |
| if( sig_size < MBEDTLS_LMOTS_SIG_TYPE_OFFSET + MBEDTLS_LMOTS_TYPE_LEN ) |
| { |
| return( MBEDTLS_ERR_LMS_VERIFY_FAILED ); |
| } |
| |
| if( mbedtls_lms_network_bytes_to_unsigned_int( MBEDTLS_LMOTS_TYPE_LEN, |
| sig + MBEDTLS_LMOTS_SIG_TYPE_OFFSET ) != MBEDTLS_LMOTS_SHA256_N32_W8 ) |
| { |
| return( MBEDTLS_ERR_LMS_VERIFY_FAILED ); |
| } |
| |
| ret = mbedtls_lmots_calculate_public_key_candidate( &ctx->params, |
| msg, msg_size, sig, sig_size, |
| Kc_public_key_candidate, |
| MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type), |
| NULL ); |
| if( ret ) |
| { |
| return( MBEDTLS_ERR_LMS_VERIFY_FAILED ); |
| } |
| |
| if( memcmp( &Kc_public_key_candidate, ctx->public_key, |
| sizeof( ctx->public_key ) ) ) |
| { |
| return( MBEDTLS_ERR_LMS_VERIFY_FAILED ); |
| } |
| |
| return( 0 ); |
| } |
| |
| #if defined(MBEDTLS_LMS_PRIVATE) |
| |
| void mbedtls_lmots_private_init( mbedtls_lmots_private_t *ctx ) |
| { |
| memset( ctx, 0, sizeof( *ctx ) ) ; |
| } |
| |
| void mbedtls_lmots_private_free( mbedtls_lmots_private_t *ctx ) |
| { |
| mbedtls_platform_zeroize( ctx, sizeof( *ctx ) ) ; |
| } |
| |
| int mbedtls_lmots_generate_private_key( mbedtls_lmots_private_t *ctx, |
| mbedtls_lmots_algorithm_type_t type, |
| const unsigned char I_key_identifier[MBEDTLS_LMOTS_I_KEY_ID_LEN], |
| uint32_t q_leaf_identifier, |
| const unsigned char *seed, |
| size_t seed_size ) |
| { |
| psa_hash_operation_t op = PSA_HASH_OPERATION_INIT; |
| psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| size_t output_hash_len; |
| unsigned int i_digit_idx; |
| unsigned char i_digit_idx_bytes[2]; |
| unsigned char const_bytes[1]; |
| |
| if( ctx->have_private_key ) |
| { |
| return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA ); |
| } |
| |
| if( type != MBEDTLS_LMOTS_SHA256_N32_W8 ) |
| { |
| return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA ); |
| } |
| |
| ctx->params.type = type; |
| |
| memcpy( ctx->params.I_key_identifier, |
| I_key_identifier, |
| sizeof( ctx->params.I_key_identifier ) ); |
| |
| mbedtls_lms_unsigned_int_to_network_bytes( q_leaf_identifier, |
| MBEDTLS_LMOTS_Q_LEAF_ID_LEN, |
| ctx->params.q_leaf_identifier ); |
| |
| mbedtls_lms_unsigned_int_to_network_bytes( 0xFF, sizeof( const_bytes ), |
| const_bytes ); |
| |
| for ( i_digit_idx = 0; |
| i_digit_idx < MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(ctx->params.type); |
| i_digit_idx++ ) |
| { |
| status = psa_hash_setup( &op, PSA_ALG_SHA_256 ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_update( &op, |
| ctx->params.I_key_identifier, |
| sizeof( ctx->params.I_key_identifier ) ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_update( &op, |
| ctx->params.q_leaf_identifier, |
| MBEDTLS_LMOTS_Q_LEAF_ID_LEN ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| mbedtls_lms_unsigned_int_to_network_bytes( i_digit_idx, I_DIGIT_IDX_LEN, |
| i_digit_idx_bytes ); |
| status = psa_hash_update( &op, i_digit_idx_bytes, I_DIGIT_IDX_LEN ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_update( &op, const_bytes, sizeof( const_bytes ) ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_update( &op, seed, seed_size ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_hash_finish( &op, |
| ctx->private_key[i_digit_idx], |
| MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type), |
| &output_hash_len ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| psa_hash_abort( &op ); |
| } |
| |
| ctx->have_private_key = 1; |
| |
| exit: |
| psa_hash_abort( &op ); |
| |
| return ( mbedtls_lms_error_from_psa( status ) ); |
| } |
| |
| int mbedtls_lmots_calculate_public_key( mbedtls_lmots_public_t *ctx, |
| const mbedtls_lmots_private_t *priv_ctx ) |
| { |
| unsigned char y_hashed_digits[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX][MBEDTLS_LMOTS_N_HASH_LEN_MAX]; |
| int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| |
| /* Check that a private key is loaded */ |
| if( !priv_ctx->have_private_key ) |
| { |
| return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA ); |
| } |
| |
| ret = hash_digit_array( &priv_ctx->params, |
| ( unsigned char * )priv_ctx->private_key, NULL, |
| NULL, ( unsigned char * )y_hashed_digits ); |
| if( ret ) |
| { |
| goto exit; |
| } |
| |
| ret = public_key_from_hashed_digit_array( &priv_ctx->params, |
| ( unsigned char * )y_hashed_digits, |
| ctx->public_key ); |
| if( ret ) |
| { |
| goto exit; |
| } |
| |
| memcpy( &ctx->params, &priv_ctx->params, |
| sizeof( ctx->params ) ); |
| |
| ctx->have_public_key = 1; |
| |
| exit: |
| mbedtls_platform_zeroize( y_hashed_digits, sizeof( y_hashed_digits ) ); |
| |
| return( ret ); |
| } |
| |
| int mbedtls_lmots_sign( mbedtls_lmots_private_t *ctx, |
| int (*f_rng)(void *, unsigned char *, size_t), |
| void *p_rng, const unsigned char *msg, size_t msg_size, |
| unsigned char *sig, size_t sig_size, size_t* sig_len ) |
| { |
| unsigned char tmp_digit_array[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX]; |
| /* Create a temporary buffer to prepare the signature in. This allows us to |
| * finish creating a signature (ensuring the process doesn't fail), and then |
| * erase the private key **before** writing any data into the sig parameter |
| * buffer. If data were directly written into the sig buffer, it might leak |
| * a partial signature on failure, which effectively compromises the private |
| * key. |
| */ |
| unsigned char tmp_sig[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX][MBEDTLS_LMOTS_N_HASH_LEN_MAX]; |
| unsigned char tmp_c_random[MBEDTLS_LMOTS_N_HASH_LEN_MAX]; |
| int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| |
| if( msg == NULL && msg_size != 0 ) |
| { |
| return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA ); |
| } |
| |
| if( sig_size < MBEDTLS_LMOTS_SIG_LEN(ctx->params.type) ) |
| { |
| return( MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL ); |
| } |
| |
| /* Check that a private key is loaded */ |
| if( !ctx->have_private_key ) |
| { |
| return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA ); |
| } |
| |
| ret = f_rng( p_rng, tmp_c_random, |
| MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type) ); |
| if( ret ) |
| { |
| return( ret ); |
| } |
| |
| ret = create_digit_array_with_checksum( &ctx->params, |
| msg, msg_size, |
| tmp_c_random, |
| tmp_digit_array ); |
| if( ret ) |
| { |
| goto exit; |
| } |
| |
| ret = hash_digit_array( &ctx->params, ( unsigned char * )ctx->private_key, |
| NULL, tmp_digit_array, ( unsigned char * )tmp_sig ); |
| if( ret ) |
| { |
| goto exit; |
| } |
| |
| mbedtls_lms_unsigned_int_to_network_bytes( ctx->params.type, |
| MBEDTLS_LMOTS_TYPE_LEN, |
| sig + MBEDTLS_LMOTS_SIG_TYPE_OFFSET ); |
| |
| /* Test hook to check if sig is being written to before we invalidate the |
| * private key. |
| */ |
| #if defined(MBEDTLS_TEST_HOOKS) |
| if( mbedtls_lmots_sign_private_key_invalidated_hook != NULL ) |
| { |
| ret = ( *mbedtls_lmots_sign_private_key_invalidated_hook )( sig ); |
| if( ret != 0 ) |
| return( ret ); |
| } |
| #endif /* defined(MBEDTLS_TEST_HOOKS) */ |
| |
| /* We've got a valid signature now, so it's time to make sure the private |
| * key can't be reused. |
| */ |
| ctx->have_private_key = 0; |
| mbedtls_platform_zeroize( ctx->private_key, |
| sizeof( ctx->private_key ) ); |
| |
| memcpy( sig + MBEDTLS_LMOTS_SIG_C_RANDOM_OFFSET, tmp_c_random, |
| MBEDTLS_LMOTS_C_RANDOM_VALUE_LEN(ctx->params.type) ); |
| |
| memcpy( sig + MBEDTLS_LMOTS_SIG_SIGNATURE_OFFSET(ctx->params.type), tmp_sig, |
| MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(ctx->params.type) |
| * MBEDTLS_LMOTS_N_HASH_LEN(ctx->params.type) ); |
| |
| if( sig_len != NULL ) |
| { |
| *sig_len = MBEDTLS_LMOTS_SIG_LEN(ctx->params.type); |
| } |
| |
| ret = 0; |
| |
| exit: |
| mbedtls_platform_zeroize( tmp_digit_array, sizeof( tmp_digit_array ) ); |
| mbedtls_platform_zeroize( tmp_sig, sizeof( tmp_sig ) ); |
| |
| return ( ret ); |
| } |
| |
| #endif /* defined(MBEDTLS_LMS_PRIVATE) */ |
| #endif /* defined(MBEDTLS_LMS_C) */ |
