Adds SHAKE support for XMSS

- Enables code for shake support
- Creating SHAKE hash function by name now allows to select output size
  of 256 Bit for SHAKE128 and 512 Bit for SHAKE256.
- Adds *self-generated*, unverified test vectors for XMSS/SHAKE.

4 files changed, 94 insertions, 102 deletions

diff --git a/src/lib/pubkey/xmss/xmss_parameters.cpp b/src/lib/pubkey/xmss/xmss_parameters.cpp
index 5a106320b..a51496eff 100644
--- a/src/lib/pubkey/xmss/xmss_parameters.cpp
+++ b/src/lib/pubkey/xmss/xmss_parameters.cpp
@@ -24,13 +24,13 @@ const std::map<std::string, XMSS_Parameters::xmss_algorithm_t>
       { "XMSS_SHA2-256_W16_H20", XMSS_SHA2_256_W16_H20 },
       { "XMSS_SHA2-512_W16_H10", XMSS_SHA2_512_W16_H10 },
       { "XMSS_SHA2-512_W16_H16", XMSS_SHA2_512_W16_H16 },
-      { "XMSS_SHA2-512_W16_H20", XMSS_SHA2_512_W16_H20 }
-//      { "XMSS_SHAKE128_W16_H10", xmss_algorithm_t::XMSS_SHAKE128_W16_H10 },
-//      { "XMSS_SHAKE128_W16_H16", xmss_algorithm_t::XMSS_SHAKE128_W16_H16 },
-//      { "XMSS_SHAKE128_W16_H20", xmss_algorithm_t::XMSS_SHAKE128_W16_H20 },
-//      { "XMSS_SHAKE256_W16_H10", xmss_algorithm_t::XMSS_SHAKE256_W16_H10 },
-//      { "XMSS_SHAKE256_W16_H16", xmss_algorithm_t::XMSS_SHAKE256_W16_H16 },
-//      { "XMSS_SHAKE256_W16_H20", xmss_algorithm_t::XMSS_SHAKE256_W16_H20 }
+      { "XMSS_SHA2-512_W16_H20", XMSS_SHA2_512_W16_H20 },
+      { "XMSS_SHAKE128_W16_H10", XMSS_SHAKE128_W16_H10 },
+      { "XMSS_SHAKE128_W16_H16", XMSS_SHAKE128_W16_H16 },
+      { "XMSS_SHAKE128_W16_H20", XMSS_SHAKE128_W16_H20 },
+      { "XMSS_SHAKE256_W16_H10", XMSS_SHAKE256_W16_H10 },
+      { "XMSS_SHAKE256_W16_H16", XMSS_SHAKE256_W16_H16 },
+      { "XMSS_SHAKE256_W16_H20", XMSS_SHAKE256_W16_H20 }
       };
 
 XMSS_Parameters::XMSS_Parameters(const std::string& algo_name)
@@ -102,73 +102,66 @@ XMSS_Parameters::XMSS_Parameters(xmss_algorithm_t oid)
          m_strength = 512;
          m_wots_oid = XMSS_WOTS_Parameters::ots_algorithm_t::WOTSP_SHA2_512_W16;
          break;
-// FIXME: Uncomment once SHAKE128/256 implementation is available in Botan.
-//      case XMSS_SHAKE128_W16_H10:
-//         m_element_size = 32;
-//         m_w = 16;
-//         m_len = 67;
-//         m_tree_height = 10;
-//         m_name = "XMSS_SHAKE128_W16_H10";
-//         m_hash_name = "";
-//         m_strength = 256;
-//         m_wots_oid = XMSS_WOTS_Parameters::ots_algorithm_t::WOTSP_SHAKE128_W16;
-//         BOTAN_ASSERT(false, "XMSS_SHAKE128_W16_H10 not implemented.");
-//         break;
-//      case XMSS_SHAKE128_W16_H16:
-//         m_element_size = 32;
-//         m_w = 16;
-//         m_len = 67;
-//         m_tree_height = 16;
-//         m_name = "XMSS_SHAKE128_W16_H16";
-//         m_hash_name = "";
-//         m_strength = 256;
-//         m_wots_oid = XMSS_WOTS_Parameters::ots_algorithm_t::WOTSP_SHAKE128_W16;
-//         BOTAN_ASSERT(false, "XMSS_SHAKE128_W16_H16 not implemented.");
-//         break;
-//      case XMSS_SHAKE128_W16_H20:
-//         m_element_size = 32;
-//         m_w = 16;
-//         m_len = 67;
-//         m_tree_height = 20;
-//         m_name = "XMSS_SHAKE128_W16_H20";
-//         m_hash_name = "";
-//         m_strength = 256;
-//         m_wots_oid = XMSS_WOTS_Parameters::ots_algorithm_t::WOTSP_SHAKE128_W16;
-//         BOTAN_ASSERT(false, "XMSS_SHAKE128_W16_H20 not implemented.");
-//         break;
-//      case XMSS_SHAKE256_W16_H10:
-//         m_element_size = 64;
-//         m_w = 16;
-//         m_len = 131;
-//         m_tree_height = 10;
-//         m_name = "XMSS_SHAKE256_W16_H10";
-//         m_hash_name = "";
-//         m_strength = 512;
-//         m_wots_oid = XMSS_WOTS_Parameters::ots_algorithm_t::WOTSP_SHAKE256_W16;
-//         BOTAN_ASSERT(false, "XMSS_SHAKE256_W16_H10 not implemented.");
-//         break;
-//      case XMSS_SHAKE256_W16_H16:
-//         m_element_size = 64;
-//         m_w = 16;
-//         m_len = 131;
-//         m_tree_height = 16;
-//         m_name = "XMSS_SHAKE256_W16_H16";
-//         m_hash_name = "";
-//         m_strength = 512;
-//         m_wots_oid = XMSS_WOTS_Parameters::ots_algorithm_t::WOTSP_SHAKE256_W16;
-//         BOTAN_ASSERT(false, "XMSS_SHAKE256_W16_H16 not implemented.");
-//         break;
-//      case XMSS_SHAKE256_W16_H20:
-//         m_element_size = 64;
-//         m_w = 16;
-//         m_len = 131;
-//         m_tree_height = 20;
-//         m_name = "XMSS_SHAKE256_W16_H20";
-//         m_hash_name = "";
-//         m_strength = 512;
-//         m_wots_oid = XMSS_WOTS_Parameters::ots_algorithm_t::WOTSP_SHAKE256_W16;
-//         BOTAN_ASSERT(false, "XMSS_SHAKE256_W16_H20 not implemented.");
-//         break;
+      case XMSS_SHAKE128_W16_H10:
+         m_element_size = 32;
+         m_w = 16;
+         m_len = 67;
+         m_tree_height = 10;
+         m_name = "XMSS_SHAKE128_W16_H10";
+         m_hash_name = "SHAKE-128(256)";
+         m_strength = 256;
+         m_wots_oid = XMSS_WOTS_Parameters::ots_algorithm_t::WOTSP_SHAKE128_W16;
+         break;
+      case XMSS_SHAKE128_W16_H16:
+         m_element_size = 32;
+         m_w = 16;
+         m_len = 67;
+         m_tree_height = 16;
+         m_name = "XMSS_SHAKE128_W16_H16";
+         m_hash_name = "SHAKE-128(256)";
+         m_strength = 256;
+         m_wots_oid = XMSS_WOTS_Parameters::ots_algorithm_t::WOTSP_SHAKE128_W16;
+         break;
+      case XMSS_SHAKE128_W16_H20:
+         m_element_size = 32;
+         m_w = 16;
+         m_len = 67;
+         m_tree_height = 20;
+         m_name = "XMSS_SHAKE128_W16_H20";
+         m_hash_name = "SHAKE-128(256)";
+         m_strength = 256;
+         m_wots_oid = XMSS_WOTS_Parameters::ots_algorithm_t::WOTSP_SHAKE128_W16;
+         break;
+      case XMSS_SHAKE256_W16_H10:
+         m_element_size = 64;
+         m_w = 16;
+         m_len = 131;
+         m_tree_height = 10;
+         m_name = "XMSS_SHAKE256_W16_H10";
+         m_hash_name = "SHAKE-256(512)";
+         m_strength = 512;
+         m_wots_oid = XMSS_WOTS_Parameters::ots_algorithm_t::WOTSP_SHAKE256_W16;
+         break;
+      case XMSS_SHAKE256_W16_H16:
+         m_element_size = 64;
+         m_w = 16;
+         m_len = 131;
+         m_tree_height = 16;
+         m_name = "XMSS_SHAKE256_W16_H16";
+         m_hash_name = "SHAKE-256(512)";
+         m_strength = 512;
+         m_wots_oid = XMSS_WOTS_Parameters::ots_algorithm_t::WOTSP_SHAKE256_W16;
+         break;
+      case XMSS_SHAKE256_W16_H20:
+         m_element_size = 64;
+         m_w = 16;
+         m_len = 131;
+         m_tree_height = 20;
+         m_name = "XMSS_SHAKE256_W16_H20";
+         m_hash_name = "SHAKE-256(512)";
+         m_strength = 512;
+         m_wots_oid = XMSS_WOTS_Parameters::ots_algorithm_t::WOTSP_SHAKE256_W16;
+         break;
       default:
          throw Unsupported_Argument(
             "Algorithm id does not match any XMSS algorithm id.");
diff --git a/src/lib/pubkey/xmss/xmss_parameters.h b/src/lib/pubkey/xmss/xmss_parameters.h
index eb5ff4422..48a31c801 100644
--- a/src/lib/pubkey/xmss/xmss_parameters.h
+++ b/src/lib/pubkey/xmss/xmss_parameters.h
@@ -36,13 +36,12 @@ class BOTAN_DLL XMSS_Parameters
          XMSS_SHA2_512_W16_H10 = 0x04000004,
          XMSS_SHA2_512_W16_H16 = 0x05000005,
          XMSS_SHA2_512_W16_H20 = 0x06000006,
-// FIXME: Uncomment once SHAKE128/256 implementation is available in Botan.
-//         XMSS_SHAKE128_W16_H10 = 0x07000007,
-//         XMSS_SHAKE128_W16_H16 = 0x08000008,
-//         XMSS_SHAKE128_W16_H20 = 0x09000009,
-//         XMSS_SHAKE256_W16_H10 = 0x0a00000a,
-//         XMSS_SHAKE256_W16_H16 = 0x0b00000b,
-//         XMSS_SHAKE256_W16_H20 = 0x0c00000c
+         XMSS_SHAKE128_W16_H10 = 0x07000007,
+         XMSS_SHAKE128_W16_H16 = 0x08000008,
+         XMSS_SHAKE128_W16_H20 = 0x09000009,
+         XMSS_SHAKE256_W16_H10 = 0x0a00000a,
+         XMSS_SHAKE256_W16_H16 = 0x0b00000b,
+         XMSS_SHAKE256_W16_H20 = 0x0c00000c
          };
 
       XMSS_Parameters(const std::string& algo_name);
diff --git a/src/lib/pubkey/xmss/xmss_wots_parameters.cpp b/src/lib/pubkey/xmss/xmss_wots_parameters.cpp
index 903885d72..febfa26bd 100644
--- a/src/lib/pubkey/xmss/xmss_wots_parameters.cpp
+++ b/src/lib/pubkey/xmss/xmss_wots_parameters.cpp
@@ -21,7 +21,9 @@ const std::map<std::string, XMSS_WOTS_Parameters::ots_algorithm_t>
    XMSS_WOTS_Parameters::m_oid_name_lut =
    {
    { "WOTSP_SHA2-256_W16", WOTSP_SHA2_256_W16 },
-   { "WOTSP_SHA2-512_W16", WOTSP_SHA2_512_W16 }
+   { "WOTSP_SHA2-512_W16", WOTSP_SHA2_512_W16 },
+   { "WOTSP_SHAKE128_W16", WOTSP_SHAKE128_W16 },
+   { "WOTSP_SHAKE256_W16", WOTSP_SHAKE256_W16 }
    };
 
 XMSS_WOTS_Parameters::XMSS_WOTS_Parameters(const std::string& algo_name)
@@ -49,23 +51,22 @@ XMSS_WOTS_Parameters::XMSS_WOTS_Parameters(ots_algorithm_t oid)
          m_hash_name = "SHA-512";
          m_strength = 512;
          break;
-// FIXME: Uncomment once SHAKE128/256 implementation is available in Botan.
-//      case WOTSP_SHAKE128_W16:
-//         m_element_size = 32;
-//         m_w = 16;
-//         m_len = 67;
-//         m_name = "WOTSP_SHAKE128_W16";
-//         m_hash_name = "<MISSING>";
-//         m_strength = 256;
-//         break;
-//      case WOTSP_SHAKE256_W16:
-//         m_element_size = 64;
-//         m_w = 16;
-//         m_len = 131;
-//         m_name = "WOTSP_SHAKE256_W16";
-//         m_hash_name = "<MISSING>";
-//         m_strength = 512;
-//         break;
+      case WOTSP_SHAKE128_W16:
+         m_element_size = 32;
+         m_w = 16;
+         m_len = 67;
+         m_name = "WOTSP_SHAKE128_W16";
+         m_hash_name = "SHAKE-128(256)";
+         m_strength = 256;
+         break;
+      case WOTSP_SHAKE256_W16:
+         m_element_size = 64;
+         m_w = 16;
+         m_len = 131;
+         m_name = "WOTSP_SHAKE256_W16";
+         m_hash_name = "SHAKE-256(512)";
+         m_strength = 512;
+         break;
       default:
          throw Unsupported_Argument(
             "Algorithm id does not match any XMSS WOTS algorithm id.");
diff --git a/src/lib/pubkey/xmss/xmss_wots_parameters.h b/src/lib/pubkey/xmss/xmss_wots_parameters.h
index a4840c354..1385f001b 100644
--- a/src/lib/pubkey/xmss/xmss_wots_parameters.h
+++ b/src/lib/pubkey/xmss/xmss_wots_parameters.h
@@ -38,9 +38,8 @@ class XMSS_WOTS_Parameters
          {
          WOTSP_SHA2_256_W16 = 0x01000001,
          WOTSP_SHA2_512_W16 = 0x02000002,
-// FIXME: Uncomment once SHAKE128/256 implementation is available in Botan.
-//         WOTSP_SHAKE128_W16 = 0x03000003,
-//         WOTSP_SHAKE256_W16 = 0x04000004
+         WOTSP_SHAKE128_W16 = 0x03000003,
+         WOTSP_SHAKE256_W16 = 0x04000004
          };
 
       XMSS_WOTS_Parameters(const std::string& algo_name);