aboutsummaryrefslogtreecommitdiffstats
path: root/src/lib/pubkey/xmss/xmss_tools.h
diff options
context:
space:
mode:
authorMatthias Gierlings <[email protected]>2016-10-08 20:45:53 +0200
committerMatthias Gierlings <[email protected]>2016-11-11 12:52:26 +0100
commit8b06b4fe5fbe189c7d5250becb189bf2b87b9013 (patch)
treec73fbb3bf4eddcddf1d3f37983799d80204e8f2c /src/lib/pubkey/xmss/xmss_tools.h
parent618f890fd7ede74c728612ca8bc590c72ee353f1 (diff)
Added Extended Hash-Based Signatures (XMSS)
[1] XMSS: Extended Hash-Based Signatures, draft-itrf-cfrg-xmss-hash-based-signatures-06 Release: July 2016. https://datatracker.ietf.org/doc/ draft-irtf-cfrg-xmss-hash-based-signatures/?include_text=1 Provides XMSS_PublicKey and XMSS_PrivateKey classes as well as implementations for the Botan interfaces PK_Ops::Signature and PK_Ops::Verification. XMSS has been integrated into the Botan test bench, signature generation and verification can be tested independently by invoking "botan-test xmss_sign" and "botan-test xmss_verify" - Some headers that are not required to be exposed to users of the library have to be declared as public in `info.txt`. Declaring those headers private will cause the amalgamation build to fail. The following headers have been declared public inside `info.txt`, even though they are only intended for internal use: * atomic.h * xmss_hash.h * xmss_index_registry.h * xmss_address.h * xmss_common_ops.h * xmss_tools.h * xmss_wots_parameters.h * xmss_wots_privatekey.h * xmss_wots_publickey.h - XMSS_Verification_Operation Requires the "randomness" parameter out of the XMSS signature. "Randomness" is part of the prefix that is hashed *before* the message. Since the signature is unknown till sign() is called, all message content has to be buffered. For large messages this can be inconvenient or impossible. **Possible solution**: Change PK_Ops::Verification interface to take the signature as constructor argument, and provide a setter method to be able to update reuse the instance on multiple signatures. Make sign a parameterless member call. This solution requires interface changes in botan. **Suggested workaround** for signing large messages is to not sign the message itself, but to precompute the message hash manually using Botan::HashFunctio and sign the message hash instead of the message itself. - Some of the available test vectors for the XMSS signature verification have been commented out in order to reduce testbench runtime.
Diffstat (limited to 'src/lib/pubkey/xmss/xmss_tools.h')
-rw-r--r--src/lib/pubkey/xmss/xmss_tools.h111
1 files changed, 111 insertions, 0 deletions
diff --git a/src/lib/pubkey/xmss/xmss_tools.h b/src/lib/pubkey/xmss/xmss_tools.h
new file mode 100644
index 000000000..07e36ea71
--- /dev/null
+++ b/src/lib/pubkey/xmss/xmss_tools.h
@@ -0,0 +1,111 @@
+/**
+ * XMSS Address
+ * (C) 2016 Matthias Gierlings
+ *
+ * Botan is released under the Simplified BSD License (see license.txt)
+ **/
+
+#ifndef BOTAN_XMSS_TOOLS_H__
+#define BOTAN_XMSS_TOOLS_H__
+
+#include <stdint.h>
+#include <iterator>
+#include <type_traits>
+#include <botan/types.h>
+#include <botan/secmem.h>
+
+namespace Botan {
+
+/**
+ * Helper tools for low level byte operations required
+ * for the XMSS implementation.
+ **/
+ class XMSS_Tools
+ {
+ public:
+ XMSS_Tools(const XMSS_Tools&) = delete;
+ void operator=(const XMSS_Tools&) = delete;
+
+ static const XMSS_Tools& get();
+
+ /**
+ * Retrieves information about endianess
+ *
+ * @return true if machine uses little-endian byte order, false
+ * otherwise.
+ **/
+ inline bool is_little_endian() const { return m_is_little_endian; }
+
+ /**
+ * Concatenates the byte representation in big-endian order of any
+ * integral value to a secure_vector.
+ *
+ * @param target Vector to concatenate the byte representation of the
+ * integral value to.
+ * @param src integral value to concatenate.
+ **/
+ template<typename T,
+ typename U = typename std::enable_if<std::is_integral<T>::value,
+ void>::type>
+ void concat(secure_vector<byte>& target, const T& src) const;
+
+ /**
+ * Concatenates the last n bytes of the byte representation in big-endian
+ * order of any integral value to a to a secure_vector.
+ *
+ * @param target Vector to concatenate the byte representation of the
+ * integral value to.
+ * @param src Integral value to concatenate.
+ * @param len number of bytes to concatenate. This value must be smaller
+ * or equal to the size of type T.
+ **/
+ template <typename T,
+ typename U = typename std::enable_if<std::is_integral<T>::value,
+ void>::type>
+ void concat(secure_vector<byte>& target, const T& src, size_t len) const;
+
+ private:
+ XMSS_Tools();
+
+ bool m_is_little_endian;
+ };
+
+template <typename T, typename U>
+void XMSS_Tools::concat(secure_vector<byte>& target, const T& src) const
+ {
+ const byte* src_bytes = reinterpret_cast<const byte*>(&src);
+ if(is_little_endian())
+ std::reverse_copy(src_bytes,
+ src_bytes + sizeof(src),
+ std::back_inserter(target));
+ else
+ std::copy(src_bytes,
+ src_bytes + sizeof(src),
+ std::back_inserter(target));
+ }
+
+
+template <typename T, typename U>
+void XMSS_Tools::concat(secure_vector<byte>& target,
+ const T& src,
+ size_t len) const
+ {
+ size_t c = static_cast<size_t>(std::min(len, sizeof(src)));
+ if(len > sizeof(src))
+ {
+ target.resize(target.size() + len - sizeof(src), 0);
+ }
+
+ const byte* src_bytes = reinterpret_cast<const byte*>(&src);
+ if(is_little_endian())
+ std::reverse_copy(src_bytes,
+ src_bytes + c,
+ std::back_inserter(target));
+ else
+ std::copy(src_bytes + sizeof(src) - c,
+ src_bytes + sizeof(src),
+ std::back_inserter(target));
+ }
+}
+
+#endif