open-quantum-safe / liboqs / 37519535979

84%

Build Type

push

github

Committed by web-flow

Commit Message

Fail closed in LMS stateful signing and validate LMS parameter sets (#2608)

* Fail closed in LMS stateful signing, serialization and deserialization

The LMS stateful-signature paths bypassed the public stateful-signature
lock helpers, which reject incomplete lock tuples and propagate lock
callback failures. Instead they tested only whether a lock callback and
mutex were both present, discarded the callback's return value, and
proceeded to consume a one-time key. This affected
OQS_SIG_STFL_alg_lms_sign() and OQS_SIG_STFL_lms_sigs_left() in
sig_stfl_lms_functions.c, and OQS_SECRET_KEY_LMS_serialize_key() in
sig_stfl_lms.c.

The consequences are LM-OTS key reuse and therefore signature forgery:
signing proceeds when the lock callback returns OQS_ERROR; locking is
skipped silently when the lock tuple is only partially configured, with
no error reported; and serialization can return a stale pre-signing
snapshot when its lock fails, which an application may reload and sign
from again. Each yields several signatures at the same one-time index,
from which a signature over an unrelated message can be derived and is
accepted by OQS_SIG_STFL_verify.

Route LMS lock acquisition through the public helpers and propagate
their failures so that signing and serialization fail closed.

The same change regenerates the LMS wrappers per parameter set, giving
each variant its own algorithm identifier and declared signature length.
Those are then used to fix four further defects in the same layer:

- the secret-key deserializer accepted a serialized key whose embedded
  parameter set differed from the receiving object's, after which
  signing derived the output length from the imported key and overflowed
  the caller's buffer;
- the signing error path cleansed the output buffer using a caller-
  supplied length before setting it to zero, permitting an out-of-bounds
  write;
- the verifier accepted signatures produced under a parameter set other
  than the one declared;
- ... (continued)

Coverage Stats

0 of 12 new or added lines in 1 file covered. (0.0%)

259 existing lines in 20 files now uncovered.

176277 of 219515 relevant lines covered (80.3%)

3499450.68 hits per line