/src/botan/src/lib/pubkey/xmss/xmss_verification_operation.cpp
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * XMSS Verification Operation |
3 | | * Provides signature verification capabilities for Extended Hash-Based |
4 | | * Signatures (XMSS). |
5 | | * |
6 | | * (C) 2016,2017 Matthias Gierlings |
7 | | * |
8 | | * Botan is released under the Simplified BSD License (see license.txt) |
9 | | **/ |
10 | | |
11 | | #include <botan/internal/xmss_verification_operation.h> |
12 | | |
13 | | namespace Botan { |
14 | | |
15 | | XMSS_Verification_Operation::XMSS_Verification_Operation( |
16 | | const XMSS_PublicKey& public_key) |
17 | | : XMSS_Common_Ops(public_key.xmss_oid()), |
18 | | m_pub_key(public_key), |
19 | | m_msg_buf(0) |
20 | 0 | { |
21 | 0 | } Unexecuted instantiation: Botan::XMSS_Verification_Operation::XMSS_Verification_Operation(Botan::XMSS_PublicKey const&) Unexecuted instantiation: Botan::XMSS_Verification_Operation::XMSS_Verification_Operation(Botan::XMSS_PublicKey const&) |
22 | | |
23 | | secure_vector<uint8_t> |
24 | | XMSS_Verification_Operation::root_from_signature(const XMSS_Signature& sig, |
25 | | const secure_vector<uint8_t>& msg, |
26 | | XMSS_Address& adrs, |
27 | | const secure_vector<uint8_t>& seed) |
28 | 0 | { |
29 | 0 | const uint32_t next_index = static_cast<uint32_t>(sig.unused_leaf_index()); |
30 | 0 | adrs.set_type(XMSS_Address::Type::OTS_Hash_Address); |
31 | 0 | adrs.set_ots_address(next_index); |
32 | 0 |
|
33 | 0 | XMSS_WOTS_PublicKey pub_key_ots(m_pub_key.wots_parameters().oid(), |
34 | 0 | msg, |
35 | 0 | sig.tree().ots_signature(), |
36 | 0 | adrs, |
37 | 0 | seed); |
38 | 0 |
|
39 | 0 | adrs.set_type(XMSS_Address::Type::LTree_Address); |
40 | 0 | adrs.set_ltree_address(next_index); |
41 | 0 |
|
42 | 0 | std::array<secure_vector<uint8_t>, 2> node; |
43 | 0 | create_l_tree(node[0], pub_key_ots, adrs, seed); |
44 | 0 |
|
45 | 0 | adrs.set_type(XMSS_Address::Type::Hash_Tree_Address); |
46 | 0 | adrs.set_tree_index(next_index); |
47 | 0 |
|
48 | 0 | for(size_t k = 0; k < m_xmss_params.tree_height(); k++) |
49 | 0 | { |
50 | 0 | adrs.set_tree_height(static_cast<uint32_t>(k)); |
51 | 0 | if(((next_index / (static_cast<size_t>(1) << k)) & 0x01) == 0) |
52 | 0 | { |
53 | 0 | adrs.set_tree_index(adrs.get_tree_index() >> 1); |
54 | 0 | randomize_tree_hash(node[1], |
55 | 0 | node[0], |
56 | 0 | sig.tree().authentication_path()[k], |
57 | 0 | adrs, |
58 | 0 | seed); |
59 | 0 | } |
60 | 0 | else |
61 | 0 | { |
62 | 0 | adrs.set_tree_index((adrs.get_tree_index() - 1) >> 1); |
63 | 0 | randomize_tree_hash(node[1], |
64 | 0 | sig.tree().authentication_path()[k], |
65 | 0 | node[0], |
66 | 0 | adrs, |
67 | 0 | seed); |
68 | 0 | } |
69 | 0 | node[0] = node[1]; |
70 | 0 | } |
71 | 0 | return node[0]; |
72 | 0 | } |
73 | | |
74 | | bool |
75 | | XMSS_Verification_Operation::verify(const XMSS_Signature& sig, |
76 | | const secure_vector<uint8_t>& msg, |
77 | | const XMSS_PublicKey& public_key) |
78 | 0 | { |
79 | 0 | XMSS_Address adrs; |
80 | 0 | secure_vector<uint8_t> index_bytes; |
81 | 0 | XMSS_Tools::concat(index_bytes, |
82 | 0 | sig.unused_leaf_index(), |
83 | 0 | m_xmss_params.element_size()); |
84 | 0 | secure_vector<uint8_t> msg_digest = |
85 | 0 | m_hash.h_msg(sig.randomness(), |
86 | 0 | public_key.root(), |
87 | 0 | index_bytes, |
88 | 0 | msg); |
89 | 0 |
|
90 | 0 | secure_vector<uint8_t> node = root_from_signature(sig, |
91 | 0 | msg_digest, |
92 | 0 | adrs, |
93 | 0 | public_key.public_seed()); |
94 | 0 |
|
95 | 0 | return (node == public_key.root()); |
96 | 0 | } |
97 | | |
98 | | // FIXME: XMSS signature verification requires the "randomness" parameter out |
99 | | // of the XMSS signature, which is part of the prefix that is hashed before |
100 | | // msg. Since the signature is unknown till sign() is called all message |
101 | | // content has to be buffered. For large messages this can be inconvenient or |
102 | | // impossible. |
103 | | // Possible solution: Change PK_Ops::Verification interface to take the |
104 | | // signature as constructor argument, make sign a parameterless member call. |
105 | | void XMSS_Verification_Operation::update(const uint8_t msg[], size_t msg_len) |
106 | 0 | { |
107 | 0 | std::copy(msg, msg + msg_len, std::back_inserter(m_msg_buf)); |
108 | 0 | } |
109 | | |
110 | | bool XMSS_Verification_Operation::is_valid_signature(const uint8_t sig[], |
111 | | size_t sig_len) |
112 | 0 | { |
113 | 0 | try |
114 | 0 | { |
115 | 0 | XMSS_Signature signature(m_pub_key.xmss_parameters().oid(), |
116 | 0 | secure_vector<uint8_t>(sig, sig + sig_len)); |
117 | 0 | bool result = verify(signature, m_msg_buf, m_pub_key); |
118 | 0 | m_msg_buf.clear(); |
119 | 0 | return result; |
120 | 0 | } |
121 | 0 | catch(...) |
122 | 0 | { |
123 | 0 | m_msg_buf.clear(); |
124 | 0 | return false; |
125 | 0 | } |
126 | 0 | } |
127 | | |
128 | | } |
129 | | |