11346280461

Committed 15 Oct 2024 12:42PM UTC coverage: 91.116% (-0.4%) from 91.512%

Build # 11346280461

Build Type

Pull #4291

github

Committed by

web-flow

Commit Message

Merge bfb91307b into 41619a286

Pull Request Pull Request #4291: PQC: SLH-DSA

Run Details

90991 of 99863 relevant lines covered (91.12%)

9298501.65 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

73.58

/src/lib/pubkey/sphincsplus/sphincsplus_common/sp_parameters.cpp

/*
 * SLH-DSA Parameters
 * (C) 2023 Jack Lloyd
 *     2023 Fabian Albert, René Meusel, Amos Treiber - Rohde & Schwarz Cybersecurity
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */

#include <botan/sp_parameters.h>

#include <botan/concepts.h>
#include <botan/exceptn.h>
#include <botan/internal/bit_ops.h>
#include <botan/internal/fmt.h>

#include <cmath>

namespace Botan {

namespace {
/// @returns pair: (parameter set, hash type)
std::pair<Sphincs_Parameter_Set, Sphincs_Hash_Type> set_and_hash_from_name(std::string_view name) {
   // SPHINCS+ Round 3.1 instances
   if(name == "SphincsPlus-sha2-128s-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs128Small, Sphincs_Hash_Type::Sha256};
   }
   if(name == "SphincsPlus-sha2-128f-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs128Fast, Sphincs_Hash_Type::Sha256};
   }
   if(name == "SphincsPlus-sha2-192s-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs192Small, Sphincs_Hash_Type::Sha256};
   }
   if(name == "SphincsPlus-sha2-192f-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs192Fast, Sphincs_Hash_Type::Sha256};
   }
   if(name == "SphincsPlus-sha2-256s-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs256Small, Sphincs_Hash_Type::Sha256};
   }
   if(name == "SphincsPlus-sha2-256f-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs256Fast, Sphincs_Hash_Type::Sha256};
   }

   if(name == "SphincsPlus-shake-128s-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs128Small, Sphincs_Hash_Type::Shake256};
   }
   if(name == "SphincsPlus-shake-128f-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs128Fast, Sphincs_Hash_Type::Shake256};
   }
   if(name == "SphincsPlus-shake-192s-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs192Small, Sphincs_Hash_Type::Shake256};
   }
   if(name == "SphincsPlus-shake-192f-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs192Fast, Sphincs_Hash_Type::Shake256};
   }
   if(name == "SphincsPlus-shake-256s-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs256Small, Sphincs_Hash_Type::Shake256};
   }
   if(name == "SphincsPlus-shake-256f-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs256Fast, Sphincs_Hash_Type::Shake256};
   }

   if(name == "SphincsPlus-haraka-128s-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs128Small, Sphincs_Hash_Type::Haraka};
   }
   if(name == "SphincsPlus-haraka-128f-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs128Fast, Sphincs_Hash_Type::Haraka};
   }
   if(name == "SphincsPlus-haraka-192s-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs192Small, Sphincs_Hash_Type::Haraka};
   }
   if(name == "SphincsPlus-haraka-192f-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs192Fast, Sphincs_Hash_Type::Haraka};
   }
   if(name == "SphincsPlus-haraka-256s-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs256Small, Sphincs_Hash_Type::Haraka};
   }
   if(name == "SphincsPlus-haraka-256f-r3.1") {
      return {Sphincs_Parameter_Set::Sphincs256Fast, Sphincs_Hash_Type::Haraka};
   }

   // SLH-DSA instances WITHOUT prehash mode
   if(name == "SLH-DSA-SHA2-128s") {
      return {Sphincs_Parameter_Set::SLHDSA128Small, Sphincs_Hash_Type::Sha256};
   }
   if(name == "SLH-DSA-SHA2-128f") {
      return {Sphincs_Parameter_Set::SLHDSA128Fast, Sphincs_Hash_Type::Sha256};
   }
   if(name == "SLH-DSA-SHA2-192s") {
      return {Sphincs_Parameter_Set::SLHDSA192Small, Sphincs_Hash_Type::Sha256};
   }
   if(name == "SLH-DSA-SHA2-192f") {
      return {Sphincs_Parameter_Set::SLHDSA192Fast, Sphincs_Hash_Type::Sha256};
   }
   if(name == "SLH-DSA-SHA2-256s") {
      return {Sphincs_Parameter_Set::SLHDSA256Small, Sphincs_Hash_Type::Sha256};
   }
   if(name == "SLH-DSA-SHA2-256f") {
      return {Sphincs_Parameter_Set::SLHDSA256Fast, Sphincs_Hash_Type::Sha256};
   }

   if(name == "SLH-DSA-SHAKE-128s") {
      return {Sphincs_Parameter_Set::SLHDSA128Small, Sphincs_Hash_Type::Shake256};
   }
   if(name == "SLH-DSA-SHAKE-128f") {
      return {Sphincs_Parameter_Set::SLHDSA128Fast, Sphincs_Hash_Type::Shake256};
   }
   if(name == "SLH-DSA-SHAKE-192s") {
      return {Sphincs_Parameter_Set::SLHDSA192Small, Sphincs_Hash_Type::Shake256};
   }
   if(name == "SLH-DSA-SHAKE-192f") {
      return {Sphincs_Parameter_Set::SLHDSA192Fast, Sphincs_Hash_Type::Shake256};
   }
   if(name == "SLH-DSA-SHAKE-256s") {
      return {Sphincs_Parameter_Set::SLHDSA256Small, Sphincs_Hash_Type::Shake256};
   }
   if(name == "SLH-DSA-SHAKE-256f") {
      return {Sphincs_Parameter_Set::SLHDSA256Fast, Sphincs_Hash_Type::Shake256};
   }

   // SLH-DSA instances WITH prehash mode
   if(name == "Hash-SLH-DSA-SHA2-128s-with-SHA256") {
      return {Sphincs_Parameter_Set::SLHDSA128Small, Sphincs_Hash_Type::Sha256};
   }
   if(name == "Hash-SLH-DSA-SHA2-128f-with-SHA256") {
      return {Sphincs_Parameter_Set::SLHDSA128Fast, Sphincs_Hash_Type::Sha256};
   }
   if(name == "Hash-SLH-DSA-SHA2-192s-with-SHA512") {
      return {Sphincs_Parameter_Set::SLHDSA192Small, Sphincs_Hash_Type::Sha256};
   }
   if(name == "Hash-SLH-DSA-SHA2-192f-with-SHA512") {
      return {Sphincs_Parameter_Set::SLHDSA192Fast, Sphincs_Hash_Type::Sha256};
   }
   if(name == "Hash-SLH-DSA-SHA2-256s-with-SHA512") {
      return {Sphincs_Parameter_Set::SLHDSA256Small, Sphincs_Hash_Type::Sha256};
   }
   if(name == "Hash-SLH-DSA-SHA2-256f-with-SHA512") {
      return {Sphincs_Parameter_Set::SLHDSA256Fast, Sphincs_Hash_Type::Sha256};
   }

   if(name == "Hash-SLH-DSA-SHAKE-128s-with-SHAKE128") {
      return {Sphincs_Parameter_Set::SLHDSA128Small, Sphincs_Hash_Type::Shake256};
   }
   if(name == "Hash-SLH-DSA-SHAKE-128f-with-SHAKE128") {
      return {Sphincs_Parameter_Set::SLHDSA128Fast, Sphincs_Hash_Type::Shake256};
   }
   if(name == "Hash-SLH-DSA-SHAKE-192s-with-SHAKE256") {
      return {Sphincs_Parameter_Set::SLHDSA192Small, Sphincs_Hash_Type::Shake256};
   }
   if(name == "Hash-SLH-DSA-SHAKE-192f-with-SHAKE256") {
      return {Sphincs_Parameter_Set::SLHDSA192Fast, Sphincs_Hash_Type::Shake256};
   }
   if(name == "Hash-SLH-DSA-SHAKE-256s-with-SHAKE256") {
      return {Sphincs_Parameter_Set::SLHDSA256Small, Sphincs_Hash_Type::Shake256};
   }
   if(name == "Hash-SLH-DSA-SHAKE-256f-with-SHAKE256") {
      return {Sphincs_Parameter_Set::SLHDSA256Fast, Sphincs_Hash_Type::Shake256};
   }

   throw Lookup_Error(fmt("No SLH-DSA (or SPHINCS+) parameter supported for: {}", name));
}

std::string name_from_set_and_hash(Sphincs_Parameter_Set set, Sphincs_Hash_Type hash) {
   if(hash == Sphincs_Hash_Type::Sha256) {
      switch(set) {
         case Sphincs_Parameter_Set::Sphincs128Small:
            return "SphincsPlus-sha2-128s-r3.1";
         case Sphincs_Parameter_Set::Sphincs128Fast:
            return "SphincsPlus-sha2-128f-r3.1";
         case Sphincs_Parameter_Set::Sphincs192Small:
            return "SphincsPlus-sha2-192s-r3.1";
         case Sphincs_Parameter_Set::Sphincs192Fast:
            return "SphincsPlus-sha2-192f-r3.1";
         case Sphincs_Parameter_Set::Sphincs256Small:
            return "SphincsPlus-sha2-256s-r3.1";
         case Sphincs_Parameter_Set::Sphincs256Fast:
            return "SphincsPlus-sha2-256f-r3.1";

         case Sphincs_Parameter_Set::SLHDSA128Small:
            return "SLH-DSA-SHA2-128s";
         case Sphincs_Parameter_Set::SLHDSA128Fast:
            return "SLH-DSA-SHA2-128f";
         case Sphincs_Parameter_Set::SLHDSA192Small:
            return "SLH-DSA-SHA2-192s";
         case Sphincs_Parameter_Set::SLHDSA192Fast:
            return "SLH-DSA-SHA2-192f";
         case Sphincs_Parameter_Set::SLHDSA256Small:
            return "SLH-DSA-SHA2-256s";
         case Sphincs_Parameter_Set::SLHDSA256Fast:
            return "SLH-DSA-SHA2-256f";
      }
   }

   if(hash == Sphincs_Hash_Type::Shake256) {
      switch(set) {
         case Sphincs_Parameter_Set::Sphincs128Small:
            return "SphincsPlus-shake-128s-r3.1";
         case Sphincs_Parameter_Set::Sphincs128Fast:
            return "SphincsPlus-shake-128f-r3.1";
         case Sphincs_Parameter_Set::Sphincs192Small:
            return "SphincsPlus-shake-192s-r3.1";
         case Sphincs_Parameter_Set::Sphincs192Fast:
            return "SphincsPlus-shake-192f-r3.1";
         case Sphincs_Parameter_Set::Sphincs256Small:
            return "SphincsPlus-shake-256s-r3.1";
         case Sphincs_Parameter_Set::Sphincs256Fast:
            return "SphincsPlus-shake-256f-r3.1";

         case Sphincs_Parameter_Set::SLHDSA128Small:
            return "SLH-DSA-SHAKE-128s";
         case Sphincs_Parameter_Set::SLHDSA128Fast:
            return "SLH-DSA-SHAKE-128f";
         case Sphincs_Parameter_Set::SLHDSA192Small:
            return "SLH-DSA-SHAKE-192s";
         case Sphincs_Parameter_Set::SLHDSA192Fast:
            return "SLH-DSA-SHAKE-192f";
         case Sphincs_Parameter_Set::SLHDSA256Small:
            return "SLH-DSA-SHAKE-256s";
         case Sphincs_Parameter_Set::SLHDSA256Fast:
            return "SLH-DSA-SHAKE-256f";
      }
   }

   if(hash == Sphincs_Hash_Type::Haraka) {
      switch(set) {
         case Sphincs_Parameter_Set::Sphincs128Small:
            return "SphincsPlus-haraka-128s-r3.1";
         case Sphincs_Parameter_Set::Sphincs128Fast:
            return "SphincsPlus-haraka-128f-r3.1";
         case Sphincs_Parameter_Set::Sphincs192Small:
            return "SphincsPlus-haraka-192s-r3.1";
         case Sphincs_Parameter_Set::Sphincs192Fast:
            return "SphincsPlus-haraka-192f-r3.1";
         case Sphincs_Parameter_Set::Sphincs256Small:
            return "SphincsPlus-haraka-256s-r3.1";
         case Sphincs_Parameter_Set::Sphincs256Fast:
            return "SphincsPlus-haraka-256f-r3.1";

         case Sphincs_Parameter_Set::SLHDSA128Small:
         case Sphincs_Parameter_Set::SLHDSA128Fast:
         case Sphincs_Parameter_Set::SLHDSA192Small:
         case Sphincs_Parameter_Set::SLHDSA192Fast:
         case Sphincs_Parameter_Set::SLHDSA256Small:
         case Sphincs_Parameter_Set::SLHDSA256Fast:
            throw Invalid_Argument("SLH-DSA does not support Haraka");
      }
   }
   throw Invalid_Argument("Cannot serialize invalid parameter combination");
}

constexpr bool is_slh_dsa_set(Sphincs_Parameter_Set set) {
   switch(set) {
      case Sphincs_Parameter_Set::SLHDSA128Small:
      case Sphincs_Parameter_Set::SLHDSA128Fast:
      case Sphincs_Parameter_Set::SLHDSA192Small:
      case Sphincs_Parameter_Set::SLHDSA192Fast:
      case Sphincs_Parameter_Set::SLHDSA256Small:
      case Sphincs_Parameter_Set::SLHDSA256Fast:
         return true;
      case Sphincs_Parameter_Set::Sphincs128Small:
      case Sphincs_Parameter_Set::Sphincs128Fast:
      case Sphincs_Parameter_Set::Sphincs192Small:
      case Sphincs_Parameter_Set::Sphincs192Fast:
      case Sphincs_Parameter_Set::Sphincs256Small:
      case Sphincs_Parameter_Set::Sphincs256Fast:
         return false;
   }
   BOTAN_ASSERT_UNREACHABLE();
}

}  // namespace

Sphincs_Parameters::Sphincs_Parameters(Sphincs_Parameter_Set set,
                                       Sphincs_Hash_Type hash_type,
                                       uint32_t n,
                                       uint32_t h,
                                       uint32_t d,
                                       uint32_t a,
                                       uint32_t k,
                                       uint32_t w,
                                       uint32_t bitsec) :
      m_set(set), m_hash_type(hash_type), m_n(n), m_h(h), m_d(d), m_a(a), m_k(k), m_w(w), m_bitsec(bitsec) {
   BOTAN_ARG_CHECK(!(hash_type == Sphincs_Hash_Type::Haraka && is_slh_dsa_set(set)),
                   "Haraka is not available for SLH-DSA");
   BOTAN_ARG_CHECK(w == 4 || w == 16 || w == 256, "Winternitz parameter must be one of 4, 16, 256");
   BOTAN_ARG_CHECK(n == 16 || n == 24 || n == 32, "n must be one of 16, 24, 32");
   BOTAN_ARG_CHECK(m_d > 0, "d must be greater than zero");

   m_xmss_tree_height = m_h / m_d;
   m_lg_w = ceil_log2(m_w);

   // base_2^b algorithm (Fips 205, Algorithm 4) only works
   // when m_log_w is a divisor of 8.
   BOTAN_ASSERT_NOMSG(m_lg_w <= 8 && 8 % m_lg_w == 0);

   // # Winternitz blocks of the message (len_1 of FIPS 205, Algorithm 1)
   m_wots_len1 = (m_n * 8) / m_lg_w;

   // # Winternitz blocks of the checksum (output of FIPS 205 Algorithm 1)
   m_wots_len2 = ceil_log2(m_wots_len1 * (m_w - 1)) / m_lg_w + 1;

   // # Winternitz blocks in the signature (len of FIPS 205, Equation 5.4)
   m_wots_len = m_wots_len1 + m_wots_len2;

   // byte length of WOTS+ signature as well as public key
   m_wots_bytes = m_wots_len * m_n;

   // # of bytes the WOTS+ checksum consists of
   m_wots_checksum_bytes = ceil_tobytes(m_wots_len2 * m_lg_w);

   m_fors_sig_bytes = (m_a + 1) * m_k * m_n;

   // byte length of the FORS input message
   m_fors_message_bytes = ceil_tobytes(m_k * m_a);

   m_xmss_sig_bytes = m_wots_bytes + m_xmss_tree_height * m_n;
   m_ht_sig_bytes = m_d * m_xmss_sig_bytes;
   m_sp_sig_bytes = m_n /* random */ + m_fors_sig_bytes + m_ht_sig_bytes;

   m_tree_digest_bytes = ceil_tobytes(m_h - m_xmss_tree_height);
   m_leaf_digest_bytes = ceil_tobytes(m_xmss_tree_height);
   m_h_msg_digest_bytes = m_fors_message_bytes + m_tree_digest_bytes + m_leaf_digest_bytes;
}

bool Sphincs_Parameters::is_available() const {
   [[maybe_unused]] const bool is_slh_dsa = is_slh_dsa_set(m_set);
#ifdef BOTAN_HAS_SLH_DSA_WITH_SHA2
   if(is_slh_dsa && m_hash_type == Sphincs_Hash_Type::Sha256) {
      return true;
   }
#endif
#ifdef BOTAN_HAS_SLH_DSA_WITH_SHAKE
   if(is_slh_dsa && m_hash_type == Sphincs_Hash_Type::Shake256) {
      return true;
   }
#endif
#ifdef BOTAN_HAS_SPHINCS_PLUS_WITH_SHA2
   if(!is_slh_dsa && m_hash_type == Sphincs_Hash_Type::Sha256) {
      return true;
   }
#endif
#ifdef BOTAN_HAS_SPHINCS_PLUS_WITH_SHAKE
   if(!is_slh_dsa && m_hash_type == Sphincs_Hash_Type::Shake256) {
      return true;
   }
#endif
   return false;
}

Sphincs_Parameters Sphincs_Parameters::create(
   Sphincs_Parameter_Set set, Sphincs_Hash_Type hash /*, SlhDsaInputMode input_mode [TODO: prehash mode]*/) {
   // See FIPS 205, Table 2
   switch(set) {
      case Sphincs_Parameter_Set::Sphincs128Small:
      case Sphincs_Parameter_Set::SLHDSA128Small:
         return Sphincs_Parameters(set, hash, 16, 63, 7, 12, 14, 16, 133);
      case Sphincs_Parameter_Set::Sphincs128Fast:
      case Sphincs_Parameter_Set::SLHDSA128Fast:
         return Sphincs_Parameters(set, hash, 16, 66, 22, 6, 33, 16, 128);

      case Sphincs_Parameter_Set::Sphincs192Small:
      case Sphincs_Parameter_Set::SLHDSA192Small:
         return Sphincs_Parameters(set, hash, 24, 63, 7, 14, 17, 16, 193);
      case Sphincs_Parameter_Set::Sphincs192Fast:
      case Sphincs_Parameter_Set::SLHDSA192Fast:
         return Sphincs_Parameters(set, hash, 24, 66, 22, 8, 33, 16, 194);

      case Sphincs_Parameter_Set::Sphincs256Small:
      case Sphincs_Parameter_Set::SLHDSA256Small:
         return Sphincs_Parameters(set, hash, 32, 64, 8, 14, 22, 16, 255);
      case Sphincs_Parameter_Set::Sphincs256Fast:
      case Sphincs_Parameter_Set::SLHDSA256Fast:
         return Sphincs_Parameters(set, hash, 32, 68, 17, 9, 35, 16, 255);
   }
   BOTAN_ASSERT_UNREACHABLE();
}

Sphincs_Parameters Sphincs_Parameters::create(std::string_view name) {
   auto [param_set, hash_type] = set_and_hash_from_name(name);
   return Sphincs_Parameters::create(param_set, hash_type);
}

bool Sphincs_Parameters::is_slh_dsa() const {
   return is_slh_dsa_set(m_set);
}

std::string Sphincs_Parameters::hash_name() const {
   switch(m_hash_type) {
      case Sphincs_Hash_Type::Sha256:
         return "SHA-256";
      case Sphincs_Hash_Type::Shake256:
         return fmt("SHAKE-256({})", 8 * n());
      case Sphincs_Hash_Type::Haraka:
         return "Haraka";
   }
   BOTAN_ASSERT_UNREACHABLE();
}

std::string Sphincs_Parameters::to_string() const {
   return name_from_set_and_hash(parameter_set(), hash_type());
}

Sphincs_Parameters Sphincs_Parameters::create(const OID& oid) {
   return Sphincs_Parameters::create(oid.to_formatted_string());
}

OID Sphincs_Parameters::object_identifier() const {
   return OID::from_string(to_string());
}

AlgorithmIdentifier Sphincs_Parameters::algorithm_identifier() const {
   return AlgorithmIdentifier(object_identifier(), AlgorithmIdentifier::USE_EMPTY_PARAM);
}

}  // namespace Botan

1	/*
2	* SLH-DSA Parameters
3	* (C) 2023 Jack Lloyd
4	* 2023 Fabian Albert, René Meusel, Amos Treiber - Rohde & Schwarz Cybersecurity
5	*
6	* Botan is released under the Simplified BSD License (see license.txt)
7	*/
8
9	#include <botan/sp_parameters.h>
10
11	#include <botan/concepts.h>
12	#include <botan/exceptn.h>
13	#include <botan/internal/bit_ops.h>
14	#include <botan/internal/fmt.h>
15
16	#include <cmath>
17
18	namespace Botan {
19
20	namespace {
21	/// @returns pair: (parameter set, hash type)
22	std::pair<Sphincs_Parameter_Set, Sphincs_Hash_Type> set_and_hash_from_name(std::string_view name) {	598✔
23	// SPHINCS+ Round 3.1 instances
24	if(name == "SphincsPlus-sha2-128s-r3.1") {	598✔
25	return {Sphincs_Parameter_Set::Sphincs128Small, Sphincs_Hash_Type::Sha256};	23✔
26	}
27	if(name == "SphincsPlus-sha2-128f-r3.1") {	575✔
28	return {Sphincs_Parameter_Set::Sphincs128Fast, Sphincs_Hash_Type::Sha256};	24✔
29	}
30	if(name == "SphincsPlus-sha2-192s-r3.1") {	551✔
31	return {Sphincs_Parameter_Set::Sphincs192Small, Sphincs_Hash_Type::Sha256};	23✔
32	}
33	if(name == "SphincsPlus-sha2-192f-r3.1") {	528✔
34	return {Sphincs_Parameter_Set::Sphincs192Fast, Sphincs_Hash_Type::Sha256};	23✔
35	}
36	if(name == "SphincsPlus-sha2-256s-r3.1") {	505✔
37	return {Sphincs_Parameter_Set::Sphincs256Small, Sphincs_Hash_Type::Sha256};	23✔
38	}
39	if(name == "SphincsPlus-sha2-256f-r3.1") {	482✔
40	return {Sphincs_Parameter_Set::Sphincs256Fast, Sphincs_Hash_Type::Sha256};	23✔
41	}
42
43	if(name == "SphincsPlus-shake-128s-r3.1") {	459✔
44	return {Sphincs_Parameter_Set::Sphincs128Small, Sphincs_Hash_Type::Shake256};	23✔
45	}
46	if(name == "SphincsPlus-shake-128f-r3.1") {	436✔
47	return {Sphincs_Parameter_Set::Sphincs128Fast, Sphincs_Hash_Type::Shake256};	24✔
48	}
49	if(name == "SphincsPlus-shake-192s-r3.1") {	412✔
50	return {Sphincs_Parameter_Set::Sphincs192Small, Sphincs_Hash_Type::Shake256};	23✔
51	}
52	if(name == "SphincsPlus-shake-192f-r3.1") {	389✔
53	return {Sphincs_Parameter_Set::Sphincs192Fast, Sphincs_Hash_Type::Shake256};	23✔
54	}
55	if(name == "SphincsPlus-shake-256s-r3.1") {	366✔
56	return {Sphincs_Parameter_Set::Sphincs256Small, Sphincs_Hash_Type::Shake256};	23✔
57	}
58	if(name == "SphincsPlus-shake-256f-r3.1") {	343✔
59	return {Sphincs_Parameter_Set::Sphincs256Fast, Sphincs_Hash_Type::Shake256};	23✔
60	}
61
62	if(name == "SphincsPlus-haraka-128s-r3.1") {	320✔
63	return {Sphincs_Parameter_Set::Sphincs128Small, Sphincs_Hash_Type::Haraka};	×
64	}
65	if(name == "SphincsPlus-haraka-128f-r3.1") {	320✔
66	return {Sphincs_Parameter_Set::Sphincs128Fast, Sphincs_Hash_Type::Haraka};	×
67	}
68	if(name == "SphincsPlus-haraka-192s-r3.1") {	320✔
69	return {Sphincs_Parameter_Set::Sphincs192Small, Sphincs_Hash_Type::Haraka};	×
70	}
71	if(name == "SphincsPlus-haraka-192f-r3.1") {	320✔
72	return {Sphincs_Parameter_Set::Sphincs192Fast, Sphincs_Hash_Type::Haraka};	×
73	}
74	if(name == "SphincsPlus-haraka-256s-r3.1") {	320✔
75	return {Sphincs_Parameter_Set::Sphincs256Small, Sphincs_Hash_Type::Haraka};	×
76	}
77	if(name == "SphincsPlus-haraka-256f-r3.1") {	320✔
78	return {Sphincs_Parameter_Set::Sphincs256Fast, Sphincs_Hash_Type::Haraka};	×
79	}
80
81	// SLH-DSA instances WITHOUT prehash mode
82	if(name == "SLH-DSA-SHA2-128s") {	320✔
83	return {Sphincs_Parameter_Set::SLHDSA128Small, Sphincs_Hash_Type::Sha256};	24✔
84	}
85	if(name == "SLH-DSA-SHA2-128f") {	296✔
86	return {Sphincs_Parameter_Set::SLHDSA128Fast, Sphincs_Hash_Type::Sha256};	45✔
87	}
88	if(name == "SLH-DSA-SHA2-192s") {	251✔
89	return {Sphincs_Parameter_Set::SLHDSA192Small, Sphincs_Hash_Type::Sha256};	24✔
90	}
91	if(name == "SLH-DSA-SHA2-192f") {	227✔
92	return {Sphincs_Parameter_Set::SLHDSA192Fast, Sphincs_Hash_Type::Sha256};	24✔
93	}
94	if(name == "SLH-DSA-SHA2-256s") {	203✔
95	return {Sphincs_Parameter_Set::SLHDSA256Small, Sphincs_Hash_Type::Sha256};	24✔
96	}
97	if(name == "SLH-DSA-SHA2-256f") {	179✔
98	return {Sphincs_Parameter_Set::SLHDSA256Fast, Sphincs_Hash_Type::Sha256};	24✔
99	}
100
101	if(name == "SLH-DSA-SHAKE-128s") {	155✔
102	return {Sphincs_Parameter_Set::SLHDSA128Small, Sphincs_Hash_Type::Shake256};	30✔
103	}
104	if(name == "SLH-DSA-SHAKE-128f") {	125✔
105	return {Sphincs_Parameter_Set::SLHDSA128Fast, Sphincs_Hash_Type::Shake256};	29✔
106	}
107	if(name == "SLH-DSA-SHAKE-192s") {	96✔
108	return {Sphincs_Parameter_Set::SLHDSA192Small, Sphincs_Hash_Type::Shake256};	24✔
109	}
110	if(name == "SLH-DSA-SHAKE-192f") {	72✔
111	return {Sphincs_Parameter_Set::SLHDSA192Fast, Sphincs_Hash_Type::Shake256};	24✔
112	}
113	if(name == "SLH-DSA-SHAKE-256s") {	48✔
114	return {Sphincs_Parameter_Set::SLHDSA256Small, Sphincs_Hash_Type::Shake256};	24✔
115	}
116	if(name == "SLH-DSA-SHAKE-256f") {	24✔
117	return {Sphincs_Parameter_Set::SLHDSA256Fast, Sphincs_Hash_Type::Shake256};	24✔
118	}
119
120	// SLH-DSA instances WITH prehash mode
121	if(name == "Hash-SLH-DSA-SHA2-128s-with-SHA256") {	×
122	return {Sphincs_Parameter_Set::SLHDSA128Small, Sphincs_Hash_Type::Sha256};	×
123	}
124	if(name == "Hash-SLH-DSA-SHA2-128f-with-SHA256") {	×
125	return {Sphincs_Parameter_Set::SLHDSA128Fast, Sphincs_Hash_Type::Sha256};	×
126	}
127	if(name == "Hash-SLH-DSA-SHA2-192s-with-SHA512") {	×
128	return {Sphincs_Parameter_Set::SLHDSA192Small, Sphincs_Hash_Type::Sha256};	×
129	}
130	if(name == "Hash-SLH-DSA-SHA2-192f-with-SHA512") {	×
131	return {Sphincs_Parameter_Set::SLHDSA192Fast, Sphincs_Hash_Type::Sha256};	×
132	}
133	if(name == "Hash-SLH-DSA-SHA2-256s-with-SHA512") {	×
134	return {Sphincs_Parameter_Set::SLHDSA256Small, Sphincs_Hash_Type::Sha256};	×
135	}
136	if(name == "Hash-SLH-DSA-SHA2-256f-with-SHA512") {	×
137	return {Sphincs_Parameter_Set::SLHDSA256Fast, Sphincs_Hash_Type::Sha256};	×
138	}
139
140	if(name == "Hash-SLH-DSA-SHAKE-128s-with-SHAKE128") {	×
141	return {Sphincs_Parameter_Set::SLHDSA128Small, Sphincs_Hash_Type::Shake256};	×
142	}
143	if(name == "Hash-SLH-DSA-SHAKE-128f-with-SHAKE128") {	×
144	return {Sphincs_Parameter_Set::SLHDSA128Fast, Sphincs_Hash_Type::Shake256};	×
145	}
146	if(name == "Hash-SLH-DSA-SHAKE-192s-with-SHAKE256") {	×
147	return {Sphincs_Parameter_Set::SLHDSA192Small, Sphincs_Hash_Type::Shake256};	×
148	}
149	if(name == "Hash-SLH-DSA-SHAKE-192f-with-SHAKE256") {	×
150	return {Sphincs_Parameter_Set::SLHDSA192Fast, Sphincs_Hash_Type::Shake256};	×
151	}
152	if(name == "Hash-SLH-DSA-SHAKE-256s-with-SHAKE256") {	×
153	return {Sphincs_Parameter_Set::SLHDSA256Small, Sphincs_Hash_Type::Shake256};	×
154	}
155	if(name == "Hash-SLH-DSA-SHAKE-256f-with-SHAKE256") {	×
156	return {Sphincs_Parameter_Set::SLHDSA256Fast, Sphincs_Hash_Type::Shake256};	×
157	}
158
159	throw Lookup_Error(fmt("No SLH-DSA (or SPHINCS+) parameter supported for: {}", name));	×
160	}
161
162	std::string name_from_set_and_hash(Sphincs_Parameter_Set set, Sphincs_Hash_Type hash) {	718✔
163	if(hash == Sphincs_Hash_Type::Sha256) {	718✔
164	switch(set) {	379✔
165	case Sphincs_Parameter_Set::Sphincs128Small:	27✔
166	return "SphincsPlus-sha2-128s-r3.1";	27✔
167	case Sphincs_Parameter_Set::Sphincs128Fast:	30✔
168	return "SphincsPlus-sha2-128f-r3.1";	30✔
169	case Sphincs_Parameter_Set::Sphincs192Small:	27✔
170	return "SphincsPlus-sha2-192s-r3.1";	27✔
171	case Sphincs_Parameter_Set::Sphincs192Fast:	27✔
172	return "SphincsPlus-sha2-192f-r3.1";	27✔
173	case Sphincs_Parameter_Set::Sphincs256Small:	27✔
174	return "SphincsPlus-sha2-256s-r3.1";	27✔
175	case Sphincs_Parameter_Set::Sphincs256Fast:	27✔
176	return "SphincsPlus-sha2-256f-r3.1";	27✔
177
178	case Sphincs_Parameter_Set::SLHDSA128Small:	28✔
179	return "SLH-DSA-SHA2-128s";	28✔
180	case Sphincs_Parameter_Set::SLHDSA128Fast:	74✔
181	return "SLH-DSA-SHA2-128f";	74✔
182	case Sphincs_Parameter_Set::SLHDSA192Small:	28✔
183	return "SLH-DSA-SHA2-192s";	28✔
184	case Sphincs_Parameter_Set::SLHDSA192Fast:	28✔
185	return "SLH-DSA-SHA2-192f";	28✔
186	case Sphincs_Parameter_Set::SLHDSA256Small:	28✔
187	return "SLH-DSA-SHA2-256s";	28✔
188	case Sphincs_Parameter_Set::SLHDSA256Fast:	28✔
189	return "SLH-DSA-SHA2-256f";	28✔
190	}
191	}
192
193	if(hash == Sphincs_Hash_Type::Shake256) {	339✔
194	switch(set) {	339✔
195	case Sphincs_Parameter_Set::Sphincs128Small:	27✔
196	return "SphincsPlus-shake-128s-r3.1";	27✔
197	case Sphincs_Parameter_Set::Sphincs128Fast:	30✔
198	return "SphincsPlus-shake-128f-r3.1";	30✔
199	case Sphincs_Parameter_Set::Sphincs192Small:	27✔
200	return "SphincsPlus-shake-192s-r3.1";	27✔
201	case Sphincs_Parameter_Set::Sphincs192Fast:	27✔
202	return "SphincsPlus-shake-192f-r3.1";	27✔
203	case Sphincs_Parameter_Set::Sphincs256Small:	27✔
204	return "SphincsPlus-shake-256s-r3.1";	27✔
205	case Sphincs_Parameter_Set::Sphincs256Fast:	27✔
206	return "SphincsPlus-shake-256f-r3.1";	27✔
207
208	case Sphincs_Parameter_Set::SLHDSA128Small:	30✔
209	return "SLH-DSA-SHAKE-128s";	30✔
210	case Sphincs_Parameter_Set::SLHDSA128Fast:	32✔
211	return "SLH-DSA-SHAKE-128f";	32✔
212	case Sphincs_Parameter_Set::SLHDSA192Small:	28✔
213	return "SLH-DSA-SHAKE-192s";	28✔
214	case Sphincs_Parameter_Set::SLHDSA192Fast:	28✔
215	return "SLH-DSA-SHAKE-192f";	28✔
216	case Sphincs_Parameter_Set::SLHDSA256Small:	28✔
217	return "SLH-DSA-SHAKE-256s";	28✔
218	case Sphincs_Parameter_Set::SLHDSA256Fast:	28✔
219	return "SLH-DSA-SHAKE-256f";	28✔
220	}
221	}
222
223	if(hash == Sphincs_Hash_Type::Haraka) {	×
224	switch(set) {	×
225	case Sphincs_Parameter_Set::Sphincs128Small:	×
226	return "SphincsPlus-haraka-128s-r3.1";	×
227	case Sphincs_Parameter_Set::Sphincs128Fast:	×
228	return "SphincsPlus-haraka-128f-r3.1";	×
229	case Sphincs_Parameter_Set::Sphincs192Small:	×
230	return "SphincsPlus-haraka-192s-r3.1";	×
231	case Sphincs_Parameter_Set::Sphincs192Fast:	×
232	return "SphincsPlus-haraka-192f-r3.1";	×
233	case Sphincs_Parameter_Set::Sphincs256Small:	×
234	return "SphincsPlus-haraka-256s-r3.1";	×
235	case Sphincs_Parameter_Set::Sphincs256Fast:	×
236	return "SphincsPlus-haraka-256f-r3.1";	×
237
238	case Sphincs_Parameter_Set::SLHDSA128Small:	×
239	case Sphincs_Parameter_Set::SLHDSA128Fast:	×
240	case Sphincs_Parameter_Set::SLHDSA192Small:	×
241	case Sphincs_Parameter_Set::SLHDSA192Fast:	×
242	case Sphincs_Parameter_Set::SLHDSA256Small:	×
243	case Sphincs_Parameter_Set::SLHDSA256Fast:	×
244	throw Invalid_Argument("SLH-DSA does not support Haraka");	×
245	}
246	}
247	throw Invalid_Argument("Cannot serialize invalid parameter combination");	×
248	}
249
250	constexpr bool is_slh_dsa_set(Sphincs_Parameter_Set set) {	2,416✔
251	switch(set) {	×
252	case Sphincs_Parameter_Set::SLHDSA128Small:
253	case Sphincs_Parameter_Set::SLHDSA128Fast:
254	case Sphincs_Parameter_Set::SLHDSA192Small:
255	case Sphincs_Parameter_Set::SLHDSA192Fast:
256	case Sphincs_Parameter_Set::SLHDSA256Small:
257	case Sphincs_Parameter_Set::SLHDSA256Fast:
258	return true;
259	case Sphincs_Parameter_Set::Sphincs128Small:	866✔
260	case Sphincs_Parameter_Set::Sphincs128Fast:	866✔
261	case Sphincs_Parameter_Set::Sphincs192Small:	866✔
262	case Sphincs_Parameter_Set::Sphincs192Fast:	866✔
263	case Sphincs_Parameter_Set::Sphincs256Small:	866✔
264	case Sphincs_Parameter_Set::Sphincs256Fast:	866✔
265	return false;	568✔
266	}
267	BOTAN_ASSERT_UNREACHABLE();	×
268	}
269
270	} // namespace
271
272	Sphincs_Parameters::Sphincs_Parameters(Sphincs_Parameter_Set set,	598✔
273	Sphincs_Hash_Type hash_type,
274	uint32_t n,
275	uint32_t h,
276	uint32_t d,
277	uint32_t a,
278	uint32_t k,
279	uint32_t w,
280	uint32_t bitsec) :	598✔
281	m_set(set), m_hash_type(hash_type), m_n(n), m_h(h), m_d(d), m_a(a), m_k(k), m_w(w), m_bitsec(bitsec) {	598✔
282	BOTAN_ARG_CHECK(!(hash_type == Sphincs_Hash_Type::Haraka && is_slh_dsa_set(set)),	598✔
283	"Haraka is not available for SLH-DSA");
284	BOTAN_ARG_CHECK(w == 4 \|\| w == 16 \|\| w == 256, "Winternitz parameter must be one of 4, 16, 256");	598✔
285	BOTAN_ARG_CHECK(n == 16 \|\| n == 24 \|\| n == 32, "n must be one of 16, 24, 32");	598✔
286	BOTAN_ARG_CHECK(m_d > 0, "d must be greater than zero");	598✔
287
288	m_xmss_tree_height = m_h / m_d;	598✔
289	m_lg_w = ceil_log2(m_w);	598✔
290
291	// base_2^b algorithm (Fips 205, Algorithm 4) only works
292	// when m_log_w is a divisor of 8.
293	BOTAN_ASSERT_NOMSG(m_lg_w <= 8 && 8 % m_lg_w == 0);	598✔
294
295	// # Winternitz blocks of the message (len_1 of FIPS 205, Algorithm 1)
296	m_wots_len1 = (m_n * 8) / m_lg_w;	598✔
297
298	// # Winternitz blocks of the checksum (output of FIPS 205 Algorithm 1)
299	m_wots_len2 = ceil_log2(m_wots_len1 * (m_w - 1)) / m_lg_w + 1;	598✔
300
301	// # Winternitz blocks in the signature (len of FIPS 205, Equation 5.4)
302	m_wots_len = m_wots_len1 + m_wots_len2;	598✔
303
304	// byte length of WOTS+ signature as well as public key
305	m_wots_bytes = m_wots_len * m_n;	598✔
306
307	// # of bytes the WOTS+ checksum consists of
308	m_wots_checksum_bytes = ceil_tobytes(m_wots_len2 * m_lg_w);	598✔
309
310	m_fors_sig_bytes = (m_a + 1) * m_k * m_n;	598✔
311
312	// byte length of the FORS input message
313	m_fors_message_bytes = ceil_tobytes(m_k * m_a);	598✔
314
315	m_xmss_sig_bytes = m_wots_bytes + m_xmss_tree_height * m_n;	598✔
316	m_ht_sig_bytes = m_d * m_xmss_sig_bytes;	598✔
317	m_sp_sig_bytes = m_n /* random */ + m_fors_sig_bytes + m_ht_sig_bytes;	598✔
318
319	m_tree_digest_bytes = ceil_tobytes(m_h - m_xmss_tree_height);	598✔
320	m_leaf_digest_bytes = ceil_tobytes(m_xmss_tree_height);	598✔
321	m_h_msg_digest_bytes = m_fors_message_bytes + m_tree_digest_bytes + m_leaf_digest_bytes;	598✔
322	}	598✔
323
324	bool Sphincs_Parameters::is_available() const {	779✔
325	[[maybe_unused]] const bool is_slh_dsa = is_slh_dsa_set(m_set);	779✔
326	#ifdef BOTAN_HAS_SLH_DSA_WITH_SHA2
327	if(is_slh_dsa && m_hash_type == Sphincs_Hash_Type::Sha256) {	481✔
328	return true;
329	}
330	#endif
331	#ifdef BOTAN_HAS_SLH_DSA_WITH_SHAKE
332	if(is_slh_dsa && m_hash_type == Sphincs_Hash_Type::Shake256) {	222✔
333	return true;	222✔
334	}
335	#endif
336	#ifdef BOTAN_HAS_SPHINCS_PLUS_WITH_SHA2
337	if(!is_slh_dsa && m_hash_type == Sphincs_Hash_Type::Sha256) {	298✔
338	return true;
339	}
340	#endif
341	#ifdef BOTAN_HAS_SPHINCS_PLUS_WITH_SHAKE
342	if(!is_slh_dsa && m_hash_type == Sphincs_Hash_Type::Shake256) {	149✔
343	return true;	149✔
344	}
345	#endif
346	return false;
347	}
348
349	Sphincs_Parameters Sphincs_Parameters::create(	598✔
350	Sphincs_Parameter_Set set, Sphincs_Hash_Type hash /, SlhDsaInputMode input_mode [TODO: prehash mode]/) {
351	// See FIPS 205, Table 2
352	switch(set) {	598✔
353	case Sphincs_Parameter_Set::Sphincs128Small:	100✔
354	case Sphincs_Parameter_Set::SLHDSA128Small:	100✔
355	return Sphincs_Parameters(set, hash, 16, 63, 7, 12, 14, 16, 133);	100✔
356	case Sphincs_Parameter_Set::Sphincs128Fast:	122✔
357	case Sphincs_Parameter_Set::SLHDSA128Fast:	122✔
358	return Sphincs_Parameters(set, hash, 16, 66, 22, 6, 33, 16, 128);	122✔
359
360	case Sphincs_Parameter_Set::Sphincs192Small:	94✔
361	case Sphincs_Parameter_Set::SLHDSA192Small:	94✔
362	return Sphincs_Parameters(set, hash, 24, 63, 7, 14, 17, 16, 193);	94✔
363	case Sphincs_Parameter_Set::Sphincs192Fast:	94✔
364	case Sphincs_Parameter_Set::SLHDSA192Fast:	94✔
365	return Sphincs_Parameters(set, hash, 24, 66, 22, 8, 33, 16, 194);	94✔
366
367	case Sphincs_Parameter_Set::Sphincs256Small:	94✔
368	case Sphincs_Parameter_Set::SLHDSA256Small:	94✔
369	return Sphincs_Parameters(set, hash, 32, 64, 8, 14, 22, 16, 255);	94✔
370	case Sphincs_Parameter_Set::Sphincs256Fast:	94✔
371	case Sphincs_Parameter_Set::SLHDSA256Fast:	94✔
372	return Sphincs_Parameters(set, hash, 32, 68, 17, 9, 35, 16, 255);	94✔
373	}
374	BOTAN_ASSERT_UNREACHABLE();	×
375	}
376
377	Sphincs_Parameters Sphincs_Parameters::create(std::string_view name) {	598✔
378	auto [param_set, hash_type] = set_and_hash_from_name(name);	598✔
379	return Sphincs_Parameters::create(param_set, hash_type);	598✔
380	}
381
382	bool Sphincs_Parameters::is_slh_dsa() const {	1,637✔
383	return is_slh_dsa_set(m_set);	1,637✔
384	}
385
386	std::string Sphincs_Parameters::hash_name() const {	×
387	switch(m_hash_type) {	×
388	case Sphincs_Hash_Type::Sha256:	×
389	return "SHA-256";	×
390	case Sphincs_Hash_Type::Shake256:	×
391	return fmt("SHAKE-256({})", 8 * n());	×
392	case Sphincs_Hash_Type::Haraka:	×
393	return "Haraka";	×
394	}
395	BOTAN_ASSERT_UNREACHABLE();	×
396	}
397
398	std::string Sphincs_Parameters::to_string() const {	718✔
399	return name_from_set_and_hash(parameter_set(), hash_type());	718✔
400	}
401
402	Sphincs_Parameters Sphincs_Parameters::create(const OID& oid) {	372✔
403	return Sphincs_Parameters::create(oid.to_formatted_string());	744✔
404	}
405
406	OID Sphincs_Parameters::object_identifier() const {	694✔
407	return OID::from_string(to_string());	1,388✔
408	}
409
410	AlgorithmIdentifier Sphincs_Parameters::algorithm_identifier() const {	532✔
411	return AlgorithmIdentifier(object_identifier(), AlgorithmIdentifier::USE_EMPTY_PARAM);	532✔
412	}
413
414	} // namespace Botan

randombit / botan / 11346280461

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous