Coverage Report

Created: 2020-06-30 13:58

/src/botan/src/lib/pubkey/xmss/xmss_verification_operation.cpp
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * XMSS Verification Operation
3
 * Provides signature verification capabilities for Extended Hash-Based
4
 * Signatures (XMSS).
5
 *
6
 * (C) 2016,2017 Matthias Gierlings
7
 *
8
 * Botan is released under the Simplified BSD License (see license.txt)
9
 **/
10
11
#include <botan/internal/xmss_verification_operation.h>
12
#include <botan/xmss_common_ops.h>
13
14
namespace Botan {
15
16
XMSS_Verification_Operation::XMSS_Verification_Operation(
17
   const XMSS_PublicKey& public_key) :
18
   m_pub_key(public_key),
19
   m_hash(public_key.xmss_hash_function()),
20
   m_msg_buf(0)
21
0
   {
22
0
   }
Unexecuted instantiation: Botan::XMSS_Verification_Operation::XMSS_Verification_Operation(Botan::XMSS_PublicKey const&)
Unexecuted instantiation: Botan::XMSS_Verification_Operation::XMSS_Verification_Operation(Botan::XMSS_PublicKey const&)
23
24
secure_vector<uint8_t>
25
XMSS_Verification_Operation::root_from_signature(const XMSS_Signature& sig,
26
      const secure_vector<uint8_t>& msg,
27
      XMSS_Address& adrs,
28
      const secure_vector<uint8_t>& seed)
29
0
   {
30
0
   const auto params = m_pub_key.xmss_parameters();
31
0
32
0
   const uint32_t next_index = static_cast<uint32_t>(sig.unused_leaf_index());
33
0
   adrs.set_type(XMSS_Address::Type::OTS_Hash_Address);
34
0
   adrs.set_ots_address(next_index);
35
0
36
0
   XMSS_WOTS_PublicKey pub_key_ots(m_pub_key.wots_parameters().oid(),
37
0
                                   msg,
38
0
                                   sig.tree().ots_signature(),
39
0
                                   adrs,
40
0
                                   seed);
41
0
42
0
   adrs.set_type(XMSS_Address::Type::LTree_Address);
43
0
   adrs.set_ltree_address(next_index);
44
0
45
0
   std::array<secure_vector<uint8_t>, 2> node;
46
0
   XMSS_Common_Ops::create_l_tree(node[0], pub_key_ots, adrs, seed, m_hash, params);
47
0
48
0
   adrs.set_type(XMSS_Address::Type::Hash_Tree_Address);
49
0
   adrs.set_tree_index(next_index);
50
0
51
0
   for(size_t k = 0; k < params.tree_height(); k++)
52
0
      {
53
0
      adrs.set_tree_height(static_cast<uint32_t>(k));
54
0
      if(((next_index / (static_cast<size_t>(1) << k)) & 0x01) == 0)
55
0
         {
56
0
         adrs.set_tree_index(adrs.get_tree_index() >> 1);
57
0
         XMSS_Common_Ops::randomize_tree_hash(node[1],
58
0
                                              node[0],
59
0
                                              sig.tree().authentication_path()[k],
60
0
                                              adrs,
61
0
                                              seed,
62
0
                                              m_hash,
63
0
                                              params);
64
0
         }
65
0
      else
66
0
         {
67
0
         adrs.set_tree_index((adrs.get_tree_index() - 1) >> 1);
68
0
         XMSS_Common_Ops::randomize_tree_hash(node[1],
69
0
                                              sig.tree().authentication_path()[k],
70
0
                                              node[0],
71
0
                                              adrs,
72
0
                                              seed,
73
0
                                              m_hash,
74
0
                                              params);
75
0
         }
76
0
      node[0] = node[1];
77
0
      }
78
0
   return node[0];
79
0
   }
80
81
bool
82
XMSS_Verification_Operation::verify(const XMSS_Signature& sig,
83
                                    const secure_vector<uint8_t>& msg,
84
                                    const XMSS_PublicKey& public_key)
85
0
   {
86
0
   XMSS_Address adrs;
87
0
   secure_vector<uint8_t> index_bytes;
88
0
   XMSS_Tools::concat(index_bytes,
89
0
                      sig.unused_leaf_index(),
90
0
                      m_pub_key.xmss_parameters().element_size());
91
0
   secure_vector<uint8_t> msg_digest =
92
0
      m_hash.h_msg(sig.randomness(),
93
0
                   public_key.root(),
94
0
                   index_bytes,
95
0
                   msg);
96
0
97
0
   secure_vector<uint8_t> node = root_from_signature(sig,
98
0
                                 msg_digest,
99
0
                                 adrs,
100
0
                                 public_key.public_seed());
101
0
102
0
   return (node == public_key.root());
103
0
   }
104
105
// FIXME: XMSS signature verification requires the "randomness" parameter out
106
// of the XMSS signature, which is part of the prefix that is hashed before
107
// msg. Since the signature is unknown till sign() is called all message
108
// content has to be buffered. For large messages this can be inconvenient or
109
// impossible.
110
// Possible solution: Change PK_Ops::Verification interface to take the
111
// signature as constructor argument, make sign a parameterless member call.
112
void XMSS_Verification_Operation::update(const uint8_t msg[], size_t msg_len)
113
0
   {
114
0
   std::copy(msg, msg + msg_len, std::back_inserter(m_msg_buf));
115
0
   }
116
117
bool XMSS_Verification_Operation::is_valid_signature(const uint8_t sig[],
118
      size_t sig_len)
119
0
   {
120
0
   try
121
0
      {
122
0
      XMSS_Signature signature(m_pub_key.xmss_parameters().oid(),
123
0
                               secure_vector<uint8_t>(sig, sig + sig_len));
124
0
      bool result = verify(signature, m_msg_buf, m_pub_key);
125
0
      m_msg_buf.clear();
126
0
      return result;
127
0
      }
128
0
   catch(...)
129
0
      {
130
0
      m_msg_buf.clear();
131
0
      return false;
132
0
      }
133
0
   }
134
135
}
136