Added Extended Hash-Based Signatures (XMSS)

[1] XMSS: Extended Hash-Based Signatures,
    draft-itrf-cfrg-xmss-hash-based-signatures-06
    Release: July 2016.
    https://datatracker.ietf.org/doc/
    draft-irtf-cfrg-xmss-hash-based-signatures/?include_text=1

Provides XMSS_PublicKey and XMSS_PrivateKey classes as well as implementations
for the Botan interfaces PK_Ops::Signature and PK_Ops::Verification. XMSS has
been integrated into the Botan test bench, signature generation and verification
can be tested independently by invoking "botan-test xmss_sign" and
"botan-test xmss_verify"

- Some headers that are not required to be exposed to users of the library have
  to be declared as public in `info.txt`. Declaring those headers private will
  cause the amalgamation build to fail. The following headers have been
  declared public inside `info.txt`, even though they are only intended for
  internal use:
    * atomic.h
    * xmss_hash.h
    * xmss_index_registry.h
    * xmss_address.h
    * xmss_common_ops.h
    * xmss_tools.h
    * xmss_wots_parameters.h
    * xmss_wots_privatekey.h
    * xmss_wots_publickey.h

- XMSS_Verification_Operation Requires the "randomness" parameter out of the
  XMSS signature. "Randomness" is part of the prefix that is hashed *before*
  the message. Since the signature is unknown till sign() is called, all
  message content has to be buffered. For large messages this can be
  inconvenient or impossible.

  **Possible solution**: Change PK_Ops::Verification interface to take
  the signature as constructor argument, and provide a setter method to be able
  to update reuse the instance on multiple signatures. Make sign a parameterless
  member call. This solution requires interface changes in botan.

  **Suggested workaround** for signing large messages is to not sign the message
  itself, but to precompute the message hash manually using Botan::HashFunctio
  and sign the message hash instead of the message itself.

- Some of the available test vectors for the XMSS signature verification have
  been commented out in order to reduce testbench runtime.

1 files changed, 66 insertions, 0 deletions

diff --git a/src/lib/pubkey/xmss/xmss_wots_publickey.cpp b/src/lib/pubkey/xmss/xmss_wots_publickey.cpp
new file mode 100644
index 000000000..aa0240be8
--- /dev/null
+++ b/src/lib/pubkey/xmss/xmss_wots_publickey.cpp
@@ -0,0 +1,66 @@
+/**
+ * XMSS WOTS Public Key
+ * A Winternitz One Time Signature public key for use with Extended Hash-Based
+ * Signatures.
+ *
+ * (C) 2016 Matthias Gierlings
+ *
+ * Botan is released under the Simplified BSD License (see license.txt)
+ **/
+
+#include <botan/xmss_wots_publickey.h>
+
+namespace Botan {
+
+void
+XMSS_WOTS_PublicKey::chain(secure_vector<byte>& result,
+                           size_t start_idx,
+                           size_t steps,
+                           XMSS_Address& adrs,
+                           const secure_vector<byte>& seed)
+   {
+   for(size_t i = start_idx;
+         i < (start_idx + steps) && i < m_wots_params.wots_parameter();
+         i++)
+      {
+      adrs.set_hash_address(i);
+
+      //Calculate tmp XOR bitmask
+      adrs.set_key_mask_mode(XMSS_Address::Key_Mask::Mask_Mode);
+      xor_buf(result, m_hash.prf(seed, adrs.bytes()), result.size());
+
+      // Calculate key
+      adrs.set_key_mask_mode(XMSS_Address::Key_Mask::Key_Mode);
+
+      //Calculate f(key, tmp XOR bitmask)
+      m_hash.f(result, m_hash.prf(seed, adrs.bytes()), result);
+      }
+   }
+
+wots_keysig_t
+XMSS_WOTS_PublicKey::pub_key_from_signature(const secure_vector<byte>& msg,
+      const wots_keysig_t& sig,
+      XMSS_Address& adrs,
+      const secure_vector<byte>& seed)
+   {
+   secure_vector<byte> msg_digest
+      {
+      m_wots_params.base_w(msg, m_wots_params.len_1())
+      };
+
+   m_wots_params.append_checksum(msg_digest);
+   wots_keysig_t result(sig);
+
+   for(size_t i = 0; i < m_wots_params.len(); i++)
+      {
+      adrs.set_chain_address(i);
+      chain(result[i],
+            msg_digest[i],
+            m_wots_params.wots_parameter() - 1 - msg_digest[i],
+            adrs,
+            seed);
+      }
+   return result;
+   }
+
+}