/src/openssl/providers/implementations/signature/slh_dsa_sig.c

Source
/*
 * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <openssl/core_names.h>
#include <openssl/err.h>
#include <openssl/rand.h>
#include <openssl/proverr.h>
#include <openssl/self_test.h>
#include "prov/implementations.h"
#include "prov/providercommon.h"
#include "prov/provider_ctx.h"
#include "prov/der_slh_dsa.h"
#include "crypto/slh_dsa.h"
#include "internal/cryptlib.h"
#include "internal/sizes.h"
#include "internal/fips.h"
#include "fips/fipsindicator.h"
#include "providers/implementations/signature/slh_dsa_sig.inc"

#define SLH_DSA_MAX_ADD_RANDOM_LEN 32

#define SLH_DSA_MESSAGE_ENCODE_RAW 0
#define SLH_DSA_MESSAGE_ENCODE_PURE 1

static OSSL_FUNC_signature_sign_message_init_fn slh_dsa_sign_msg_init;
static OSSL_FUNC_signature_sign_fn slh_dsa_sign;
static OSSL_FUNC_signature_verify_message_init_fn slh_dsa_verify_msg_init;
static OSSL_FUNC_signature_verify_fn slh_dsa_verify;
static OSSL_FUNC_signature_digest_sign_init_fn slh_dsa_digest_signverify_init;
static OSSL_FUNC_signature_digest_sign_fn slh_dsa_digest_sign;
static OSSL_FUNC_signature_digest_verify_fn slh_dsa_digest_verify;
static OSSL_FUNC_signature_freectx_fn slh_dsa_freectx;
static OSSL_FUNC_signature_dupctx_fn slh_dsa_dupctx;
static OSSL_FUNC_signature_set_ctx_params_fn slh_dsa_set_ctx_params;
static OSSL_FUNC_signature_settable_ctx_params_fn slh_dsa_settable_ctx_params;

static int slh_dsa_self_check(OSSL_LIB_CTX *libctx, const char *alg)
{
    if (!ossl_prov_is_running())
        return 0;

#ifdef FIPS_MODULE
    if (strstr(alg, "SLH-DSA-SHAKE"))
        return ossl_deferred_self_test(libctx, ST_ID_SIG_SLH_DSA_SHAKE_128F);
    else
        return ossl_deferred_self_test(libctx, ST_ID_SIG_SLH_DSA_SHA2_128F);
#else
    return 1;
#endif
}

/*
 * NOTE: Any changes to this structure may require updating slh_dsa_dupctx().
 */
typedef struct {
    SLH_DSA_KEY *key; /* Note that the key is not owned by this object */
    SLH_DSA_HASH_CTX *hash_ctx;
    uint8_t context_string[SLH_DSA_MAX_CONTEXT_STRING_LEN];
    size_t context_string_len;
    uint8_t add_random[SLH_DSA_MAX_ADD_RANDOM_LEN];
    size_t add_random_len;
    int msg_encode;
    int deterministic;
    OSSL_LIB_CTX *libctx;
    char *propq;
    const char *alg;
    /* The Algorithm Identifier of the signature algorithm */
    uint8_t aid_buf[OSSL_MAX_ALGORITHM_ID_SIZE];
    size_t aid_len;
} PROV_SLH_DSA_CTX;

static void slh_dsa_freectx(void *vctx)
{
    PROV_SLH_DSA_CTX *ctx = (PROV_SLH_DSA_CTX *)vctx;

    ossl_slh_dsa_hash_ctx_free(ctx->hash_ctx);
    OPENSSL_free(ctx->propq);
    OPENSSL_cleanse(ctx->add_random, sizeof(ctx->add_random));
    OPENSSL_free(ctx);
}

static void *slh_dsa_newctx(void *provctx, const char *alg, const char *propq)
{
    PROV_SLH_DSA_CTX *ctx;

    if (!slh_dsa_self_check(PROV_LIBCTX_OF(provctx), alg))
        return NULL;

    ctx = OPENSSL_zalloc(sizeof(PROV_SLH_DSA_CTX));
    if (ctx == NULL)
        return NULL;

    ctx->libctx = PROV_LIBCTX_OF(provctx);
    if (propq != NULL && (ctx->propq = OPENSSL_strdup(propq)) == NULL)
        goto err;
    ctx->alg = alg;
    ctx->msg_encode = SLH_DSA_MESSAGE_ENCODE_PURE;
    return ctx;
err:
    slh_dsa_freectx(ctx);
    return NULL;
}

static void *slh_dsa_dupctx(void *vctx)
{
    PROV_SLH_DSA_CTX *src = (PROV_SLH_DSA_CTX *)vctx;
    PROV_SLH_DSA_CTX *ret;

    if (!ossl_prov_is_running())
        return NULL;

    /*
     * Note that the SLH_DSA_KEY is ref counted via EVP_PKEY so we can just copy
     * the key here.
     */
    ret = OPENSSL_memdup(src, sizeof(*src));
    if (ret == NULL)
        return NULL;
    ret->propq = NULL;
    ret->hash_ctx = NULL;
    if (src->propq != NULL && (ret->propq = OPENSSL_strdup(src->propq)) == NULL)
        goto err;
    ret->hash_ctx = ossl_slh_dsa_hash_ctx_dup(src->hash_ctx);
    if (ret->hash_ctx == NULL)
        goto err;

    return ret;
err:
    slh_dsa_freectx(ret);
    return NULL;
}

static int slh_dsa_set_alg_id_buffer(PROV_SLH_DSA_CTX *ctx)
{
    int ret;
    WPACKET pkt;
    uint8_t *aid = NULL;

    /*
     * We do not care about DER writing errors.
     * All it really means is that for some reason, there's no
     * AlgorithmIdentifier to be had, but the operation itself is
     * still valid, just as long as it's not used to construct
     * anything that needs an AlgorithmIdentifier.
     */
    ctx->aid_len = 0;
    ret = WPACKET_init_der(&pkt, ctx->aid_buf, sizeof(ctx->aid_buf));
    ret = ret && ossl_DER_w_algorithmIdentifier_SLH_DSA(&pkt, -1, ctx->key);
    if (ret && WPACKET_finish(&pkt)) {
        WPACKET_get_total_written(&pkt, &ctx->aid_len);
        aid = WPACKET_get_curr(&pkt);
    }
    WPACKET_cleanup(&pkt);
    if (aid != NULL && ctx->aid_len != 0)
        memmove(ctx->aid_buf, aid, ctx->aid_len);
    return 1;
}

static int slh_dsa_signverify_msg_init(void *vctx, void *vkey,
    const OSSL_PARAM params[], int operation,
    const char *desc)
{
    PROV_SLH_DSA_CTX *ctx = (PROV_SLH_DSA_CTX *)vctx;
    SLH_DSA_KEY *key = vkey;

    if (!ossl_prov_is_running()
        || ctx == NULL)
        return 0;

    if (vkey == NULL && ctx->key == NULL) {
        ERR_raise(ERR_LIB_PROV, PROV_R_NO_KEY_SET);
        return 0;
    }

    if (key != NULL) {
        if (!ossl_slh_dsa_key_type_matches(key, ctx->alg))
            return 0;
        ctx->hash_ctx = ossl_slh_dsa_hash_ctx_new(key);
        if (ctx->hash_ctx == NULL)
            return 0;
        ctx->key = vkey;
    }

    slh_dsa_set_alg_id_buffer(ctx);
    if (!slh_dsa_set_ctx_params(ctx, params))
        return 0;
    return 1;
}

static int slh_dsa_sign_msg_init(void *vctx, void *vkey, const OSSL_PARAM params[])
{
    return slh_dsa_signverify_msg_init(vctx, vkey, params,
        EVP_PKEY_OP_SIGN, "SLH_DSA Sign Init");
}

static int slh_dsa_digest_signverify_init(void *vctx, const char *mdname,
    void *vkey, const OSSL_PARAM params[])
{
    PROV_SLH_DSA_CTX *ctx = (PROV_SLH_DSA_CTX *)vctx;

    if (mdname != NULL && mdname[0] != '\0') {
        ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
            "Explicit digest not supported for SLH-DSA operations");
        return 0;
    }

    if (vkey == NULL && ctx->key != NULL)
        return slh_dsa_set_ctx_params(ctx, params);

    return slh_dsa_signverify_msg_init(vctx, vkey, params,
        EVP_PKEY_OP_SIGN, "SLH_DSA Sign Init");
}

static int slh_dsa_sign(void *vctx, unsigned char *sig, size_t *siglen,
    size_t sigsize, const unsigned char *msg, size_t msg_len)
{
    int ret = 0;
    PROV_SLH_DSA_CTX *ctx = (PROV_SLH_DSA_CTX *)vctx;
    uint8_t add_rand[SLH_DSA_MAX_ADD_RANDOM_LEN], *opt_rand = NULL;
    size_t n = 0;

    if (!ossl_prov_is_running())
        return 0;

    if (sig != NULL) {
        if (ctx->add_random_len != 0) {
            opt_rand = ctx->add_random;
        } else if (ctx->deterministic == 0) {
            n = ossl_slh_dsa_key_get_n(ctx->key);
            if (RAND_priv_bytes_ex(ctx->libctx, add_rand, n, 0) <= 0)
                return 0;
            opt_rand = add_rand;
        }
    }
    ret = ossl_slh_dsa_sign(ctx->hash_ctx, msg, msg_len,
        ctx->context_string, ctx->context_string_len,
        opt_rand, ctx->msg_encode,
        sig, siglen, sigsize);
    /* Only cleanse the temporary buffer generated for this signature. */
    if (opt_rand == add_rand)
        OPENSSL_cleanse(add_rand, sizeof(add_rand));
    return ret;
}

static int slh_dsa_digest_sign(void *vctx, uint8_t *sig, size_t *siglen, size_t sigsize,
    const uint8_t *tbs, size_t tbslen)
{
    return slh_dsa_sign(vctx, sig, siglen, sigsize, tbs, tbslen);
}

static int slh_dsa_verify_msg_init(void *vctx, void *vkey, const OSSL_PARAM params[])
{
    return slh_dsa_signverify_msg_init(vctx, vkey, params, EVP_PKEY_OP_VERIFY,
        "SLH_DSA Verify Init");
}

static int slh_dsa_verify(void *vctx, const uint8_t *sig, size_t siglen,
    const uint8_t *msg, size_t msg_len)
{
    PROV_SLH_DSA_CTX *ctx = (PROV_SLH_DSA_CTX *)vctx;

    if (!ossl_prov_is_running())
        return 0;
    return ossl_slh_dsa_verify(ctx->hash_ctx, msg, msg_len,
        ctx->context_string, ctx->context_string_len,
        ctx->msg_encode, sig, siglen);
}
static int slh_dsa_digest_verify(void *vctx, const uint8_t *sig, size_t siglen,
    const uint8_t *tbs, size_t tbslen)
{
    return slh_dsa_verify(vctx, sig, siglen, tbs, tbslen);
}

static int slh_dsa_set_ctx_params(void *vctx, const OSSL_PARAM params[])
{
    PROV_SLH_DSA_CTX *pctx = (PROV_SLH_DSA_CTX *)vctx;
    struct slh_dsa_set_ctx_params_st p;

    if (pctx == NULL || !slh_dsa_set_ctx_params_decoder(params, &p))
        return 0;

    if (p.context != NULL) {
        void *vp = pctx->context_string;

        if (!OSSL_PARAM_get_octet_string(p.context, &vp,
                sizeof(pctx->context_string),
                &(pctx->context_string_len))) {
            pctx->context_string_len = 0;
            return 0;
        }
    }

    if (p.entropy != NULL) {
        void *vp = pctx->add_random;
        size_t n = ossl_slh_dsa_key_get_n(pctx->key);

        if (!OSSL_PARAM_get_octet_string(p.entropy, &vp, n, &(pctx->add_random_len))
            || pctx->add_random_len != n) {
            pctx->add_random_len = 0;
            return 0;
        }
    }

    if (p.det != NULL && !OSSL_PARAM_get_int(p.det, &pctx->deterministic))
        return 0;

    if (p.msgenc != NULL && !OSSL_PARAM_get_int(p.msgenc, &pctx->msg_encode))
        return 0;
    return 1;
}

static const OSSL_PARAM *slh_dsa_settable_ctx_params(void *vctx,
    ossl_unused void *provctx)
{
    return slh_dsa_set_ctx_params_list;
}

static const OSSL_PARAM *slh_dsa_gettable_ctx_params(ossl_unused void *vctx,
    ossl_unused void *provctx)
{
    return slh_dsa_get_ctx_params_list;
}

static int slh_dsa_get_ctx_params(void *vctx, OSSL_PARAM *params)
{
    PROV_SLH_DSA_CTX *ctx = (PROV_SLH_DSA_CTX *)vctx;
    struct slh_dsa_get_ctx_params_st p;

    if (ctx == NULL || !slh_dsa_get_ctx_params_decoder(params, &p))
        return 0;

    if (p.algid != NULL
        && !OSSL_PARAM_set_octet_string(p.algid,
            ctx->aid_len == 0 ? NULL : ctx->aid_buf,
            ctx->aid_len))
        return 0;

    if (!OSSL_FIPS_IND_GET_PARAM_CONDITIONAL(p.ind,
            ctx->add_random_len == 0))
        return 0;

    return 1;
}

#define MAKE_SIGNATURE_FUNCTIONS(alg, fn)                                               \
    static OSSL_FUNC_signature_newctx_fn slh_dsa_##fn##_newctx;                         \
    static void *slh_dsa_##fn##_newctx(void *provctx, const char *propq)                \
    {                                                                                   \
        return slh_dsa_newctx(provctx, alg, propq);                                     \
    }                                                                                   \
    const OSSL_DISPATCH ossl_slh_dsa_##fn##_signature_functions[] = {                   \
        { OSSL_FUNC_SIGNATURE_NEWCTX, (void (*)(void))slh_dsa_##fn##_newctx },          \
        { OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT,                                        \
            (void (*)(void))slh_dsa_sign_msg_init },                                    \
        { OSSL_FUNC_SIGNATURE_SIGN, (void (*)(void))slh_dsa_sign },                     \
        { OSSL_FUNC_SIGNATURE_VERIFY_MESSAGE_INIT,                                      \
            (void (*)(void))slh_dsa_verify_msg_init },                                  \
        { OSSL_FUNC_SIGNATURE_VERIFY, (void (*)(void))slh_dsa_verify },                 \
        { OSSL_FUNC_SIGNATURE_DIGEST_SIGN_INIT,                                         \
            (void (*)(void))slh_dsa_digest_signverify_init },                           \
        { OSSL_FUNC_SIGNATURE_DIGEST_SIGN,                                              \
            (void (*)(void))slh_dsa_digest_sign },                                      \
        { OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_INIT,                                       \
            (void (*)(void))slh_dsa_digest_signverify_init },                           \
        { OSSL_FUNC_SIGNATURE_DIGEST_VERIFY,                                            \
            (void (*)(void))slh_dsa_digest_verify },                                    \
        { OSSL_FUNC_SIGNATURE_FREECTX, (void (*)(void))slh_dsa_freectx },               \
        { OSSL_FUNC_SIGNATURE_DUPCTX, (void (*)(void))slh_dsa_dupctx },                 \
        { OSSL_FUNC_SIGNATURE_SET_CTX_PARAMS, (void (*)(void))slh_dsa_set_ctx_params }, \
        { OSSL_FUNC_SIGNATURE_SETTABLE_CTX_PARAMS,                                      \
            (void (*)(void))slh_dsa_settable_ctx_params },                              \
        { OSSL_FUNC_SIGNATURE_GET_CTX_PARAMS,                                           \
            (void (*)(void))slh_dsa_get_ctx_params },                                   \
        { OSSL_FUNC_SIGNATURE_GETTABLE_CTX_PARAMS,                                      \
            (void (*)(void))slh_dsa_gettable_ctx_params },                              \
        OSSL_DISPATCH_END                                                               \
    }

MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHA2-128s", sha2_128s);
MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHA2-128f", sha2_128f);
MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHA2-192s", sha2_192s);
MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHA2-192f", sha2_192f);
MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHA2-256s", sha2_256s);
MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHA2-256f", sha2_256f);
MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHAKE-128s", shake_128s);
MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHAKE-128f", shake_128f);
MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHAKE-192s", shake_192s);
MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHAKE-192f", shake_192f);
MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHAKE-256s", shake_256s);
MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHAKE-256f", shake_256f);

Coverage Report

Created: 2026-10-16 07:07

Line	Count	Source
1		/*
2		* Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		#include <openssl/core_names.h>
11		#include <openssl/err.h>
12		#include <openssl/rand.h>
13		#include <openssl/proverr.h>
14		#include <openssl/self_test.h>
15		#include "prov/implementations.h"
16		#include "prov/providercommon.h"
17		#include "prov/provider_ctx.h"
18		#include "prov/der_slh_dsa.h"
19		#include "crypto/slh_dsa.h"
20		#include "internal/cryptlib.h"
21		#include "internal/sizes.h"
22		#include "internal/fips.h"
23		#include "fips/fipsindicator.h"
24		#include "providers/implementations/signature/slh_dsa_sig.inc"
25
26		#define SLH_DSA_MAX_ADD_RANDOM_LEN 32
27
28		#define SLH_DSA_MESSAGE_ENCODE_RAW 0
29	0	#define SLH_DSA_MESSAGE_ENCODE_PURE 1
30
31		static OSSL_FUNC_signature_sign_message_init_fn slh_dsa_sign_msg_init;
32		static OSSL_FUNC_signature_sign_fn slh_dsa_sign;
33		static OSSL_FUNC_signature_verify_message_init_fn slh_dsa_verify_msg_init;
34		static OSSL_FUNC_signature_verify_fn slh_dsa_verify;
35		static OSSL_FUNC_signature_digest_sign_init_fn slh_dsa_digest_signverify_init;
36		static OSSL_FUNC_signature_digest_sign_fn slh_dsa_digest_sign;
37		static OSSL_FUNC_signature_digest_verify_fn slh_dsa_digest_verify;
38		static OSSL_FUNC_signature_freectx_fn slh_dsa_freectx;
39		static OSSL_FUNC_signature_dupctx_fn slh_dsa_dupctx;
40		static OSSL_FUNC_signature_set_ctx_params_fn slh_dsa_set_ctx_params;
41		static OSSL_FUNC_signature_settable_ctx_params_fn slh_dsa_settable_ctx_params;
42
43		static int slh_dsa_self_check(OSSL_LIB_CTX libctx, const char alg)
44	0	{
45	0	if (!ossl_prov_is_running())
46	0	return 0;
47
48		#ifdef FIPS_MODULE
49		if (strstr(alg, "SLH-DSA-SHAKE"))
50		return ossl_deferred_self_test(libctx, ST_ID_SIG_SLH_DSA_SHAKE_128F);
51		else
52		return ossl_deferred_self_test(libctx, ST_ID_SIG_SLH_DSA_SHA2_128F);
53		#else
54	0	return 1;
55	0	#endif
56	0	}
57
58		/*
59		* NOTE: Any changes to this structure may require updating slh_dsa_dupctx().
60		*/
61		typedef struct {
62		SLH_DSA_KEY key; / Note that the key is not owned by this object */
63		SLH_DSA_HASH_CTX *hash_ctx;
64		uint8_t context_string[SLH_DSA_MAX_CONTEXT_STRING_LEN];
65		size_t context_string_len;
66		uint8_t add_random[SLH_DSA_MAX_ADD_RANDOM_LEN];
67		size_t add_random_len;
68		int msg_encode;
69		int deterministic;
70		OSSL_LIB_CTX *libctx;
71		char *propq;
72		const char *alg;
73		/* The Algorithm Identifier of the signature algorithm */
74		uint8_t aid_buf[OSSL_MAX_ALGORITHM_ID_SIZE];
75		size_t aid_len;
76		} PROV_SLH_DSA_CTX;
77
78		static void slh_dsa_freectx(void *vctx)
79	0	{
80	0	PROV_SLH_DSA_CTX ctx = (PROV_SLH_DSA_CTX )vctx;
81
82	0	ossl_slh_dsa_hash_ctx_free(ctx->hash_ctx);
83	0	OPENSSL_free(ctx->propq);
84	0	OPENSSL_cleanse(ctx->add_random, sizeof(ctx->add_random));
85	0	OPENSSL_free(ctx);
86	0	}
87
88		static void slh_dsa_newctx(void provctx, const char alg, const char propq)
89	0	{
90	0	PROV_SLH_DSA_CTX *ctx;
91
92	0	if (!slh_dsa_self_check(PROV_LIBCTX_OF(provctx), alg))
93	0	return NULL;
94
95	0	ctx = OPENSSL_zalloc(sizeof(PROV_SLH_DSA_CTX));
96	0	if (ctx == NULL)
97	0	return NULL;
98
99	0	ctx->libctx = PROV_LIBCTX_OF(provctx);
100	0	if (propq != NULL && (ctx->propq = OPENSSL_strdup(propq)) == NULL)
101	0	goto err;
102	0	ctx->alg = alg;
103	0	ctx->msg_encode = SLH_DSA_MESSAGE_ENCODE_PURE;
104	0	return ctx;
105	0	err:
106	0	slh_dsa_freectx(ctx);
107	0	return NULL;
108	0	}
109
110		static void slh_dsa_dupctx(void vctx)
111	0	{
112	0	PROV_SLH_DSA_CTX src = (PROV_SLH_DSA_CTX )vctx;
113	0	PROV_SLH_DSA_CTX *ret;
114
115	0	if (!ossl_prov_is_running())
116	0	return NULL;
117
118		/*
119		* Note that the SLH_DSA_KEY is ref counted via EVP_PKEY so we can just copy
120		* the key here.
121		*/
122	0	ret = OPENSSL_memdup(src, sizeof(*src));
123	0	if (ret == NULL)
124	0	return NULL;
125	0	ret->propq = NULL;
126	0	ret->hash_ctx = NULL;
127	0	if (src->propq != NULL && (ret->propq = OPENSSL_strdup(src->propq)) == NULL)
128	0	goto err;
129	0	ret->hash_ctx = ossl_slh_dsa_hash_ctx_dup(src->hash_ctx);
130	0	if (ret->hash_ctx == NULL)
131	0	goto err;
132
133	0	return ret;
134	0	err:
135	0	slh_dsa_freectx(ret);
136	0	return NULL;
137	0	}
138
139		static int slh_dsa_set_alg_id_buffer(PROV_SLH_DSA_CTX *ctx)
140	0	{
141	0	int ret;
142	0	WPACKET pkt;
143	0	uint8_t *aid = NULL;
144
145		/*
146		* We do not care about DER writing errors.
147		* All it really means is that for some reason, there's no
148		* AlgorithmIdentifier to be had, but the operation itself is
149		* still valid, just as long as it's not used to construct
150		* anything that needs an AlgorithmIdentifier.
151		*/
152	0	ctx->aid_len = 0;
153	0	ret = WPACKET_init_der(&pkt, ctx->aid_buf, sizeof(ctx->aid_buf));
154	0	ret = ret && ossl_DER_w_algorithmIdentifier_SLH_DSA(&pkt, -1, ctx->key);
155	0	if (ret && WPACKET_finish(&pkt)) {
156	0	WPACKET_get_total_written(&pkt, &ctx->aid_len);
157	0	aid = WPACKET_get_curr(&pkt);
158	0	}
159	0	WPACKET_cleanup(&pkt);
160	0	if (aid != NULL && ctx->aid_len != 0)
161	0	memmove(ctx->aid_buf, aid, ctx->aid_len);
162	0	return 1;
163	0	}
164
165		static int slh_dsa_signverify_msg_init(void vctx, void vkey,
166		const OSSL_PARAM params[], int operation,
167		const char *desc)
168	0	{
169	0	PROV_SLH_DSA_CTX ctx = (PROV_SLH_DSA_CTX )vctx;
170	0	SLH_DSA_KEY *key = vkey;
171
172	0	if (!ossl_prov_is_running()
173	0	\|\| ctx == NULL)
174	0	return 0;
175
176	0	if (vkey == NULL && ctx->key == NULL) {
177	0	ERR_raise(ERR_LIB_PROV, PROV_R_NO_KEY_SET);
178	0	return 0;
179	0	}
180
181	0	if (key != NULL) {
182	0	if (!ossl_slh_dsa_key_type_matches(key, ctx->alg))
183	0	return 0;
184	0	ctx->hash_ctx = ossl_slh_dsa_hash_ctx_new(key);
185	0	if (ctx->hash_ctx == NULL)
186	0	return 0;
187	0	ctx->key = vkey;
188	0	}
189
190	0	slh_dsa_set_alg_id_buffer(ctx);
191	0	if (!slh_dsa_set_ctx_params(ctx, params))
192	0	return 0;
193	0	return 1;
194	0	}
195
196		static int slh_dsa_sign_msg_init(void vctx, void vkey, const OSSL_PARAM params[])
197	0	{
198	0	return slh_dsa_signverify_msg_init(vctx, vkey, params,
199	0	EVP_PKEY_OP_SIGN, "SLH_DSA Sign Init");
200	0	}
201
202		static int slh_dsa_digest_signverify_init(void vctx, const char mdname,
203		void *vkey, const OSSL_PARAM params[])
204	0	{
205	0	PROV_SLH_DSA_CTX ctx = (PROV_SLH_DSA_CTX )vctx;
206
207	0	if (mdname != NULL && mdname[0] != '\0') {
208	0	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
209	0	"Explicit digest not supported for SLH-DSA operations");
210	0	return 0;
211	0	}
212
213	0	if (vkey == NULL && ctx->key != NULL)
214	0	return slh_dsa_set_ctx_params(ctx, params);
215
216	0	return slh_dsa_signverify_msg_init(vctx, vkey, params,
217	0	EVP_PKEY_OP_SIGN, "SLH_DSA Sign Init");
218	0	}
219
220		static int slh_dsa_sign(void vctx, unsigned char sig, size_t *siglen,
221		size_t sigsize, const unsigned char *msg, size_t msg_len)
222	0	{
223	0	int ret = 0;
224	0	PROV_SLH_DSA_CTX ctx = (PROV_SLH_DSA_CTX )vctx;
225	0	uint8_t add_rand[SLH_DSA_MAX_ADD_RANDOM_LEN], *opt_rand = NULL;
226	0	size_t n = 0;
227
228	0	if (!ossl_prov_is_running())
229	0	return 0;
230
231	0	if (sig != NULL) {
232	0	if (ctx->add_random_len != 0) {
233	0	opt_rand = ctx->add_random;
234	0	} else if (ctx->deterministic == 0) {
235	0	n = ossl_slh_dsa_key_get_n(ctx->key);
236	0	if (RAND_priv_bytes_ex(ctx->libctx, add_rand, n, 0) <= 0)
237	0	return 0;
238	0	opt_rand = add_rand;
239	0	}
240	0	}
241	0	ret = ossl_slh_dsa_sign(ctx->hash_ctx, msg, msg_len,
242	0	ctx->context_string, ctx->context_string_len,
243	0	opt_rand, ctx->msg_encode,
244	0	sig, siglen, sigsize);
245		/* Only cleanse the temporary buffer generated for this signature. */
246	0	if (opt_rand == add_rand)
247	0	OPENSSL_cleanse(add_rand, sizeof(add_rand));
248	0	return ret;
249	0	}
250
251		static int slh_dsa_digest_sign(void vctx, uint8_t sig, size_t *siglen, size_t sigsize,
252		const uint8_t *tbs, size_t tbslen)
253	0	{
254	0	return slh_dsa_sign(vctx, sig, siglen, sigsize, tbs, tbslen);
255	0	}
256
257		static int slh_dsa_verify_msg_init(void vctx, void vkey, const OSSL_PARAM params[])
258	0	{
259	0	return slh_dsa_signverify_msg_init(vctx, vkey, params, EVP_PKEY_OP_VERIFY,
260	0	"SLH_DSA Verify Init");
261	0	}
262
263		static int slh_dsa_verify(void vctx, const uint8_t sig, size_t siglen,
264		const uint8_t *msg, size_t msg_len)
265	0	{
266	0	PROV_SLH_DSA_CTX ctx = (PROV_SLH_DSA_CTX )vctx;
267
268	0	if (!ossl_prov_is_running())
269	0	return 0;
270	0	return ossl_slh_dsa_verify(ctx->hash_ctx, msg, msg_len,
271	0	ctx->context_string, ctx->context_string_len,
272	0	ctx->msg_encode, sig, siglen);
273	0	}
274		static int slh_dsa_digest_verify(void vctx, const uint8_t sig, size_t siglen,
275		const uint8_t *tbs, size_t tbslen)
276	0	{
277	0	return slh_dsa_verify(vctx, sig, siglen, tbs, tbslen);
278	0	}
279
280		static int slh_dsa_set_ctx_params(void *vctx, const OSSL_PARAM params[])
281	0	{
282	0	PROV_SLH_DSA_CTX pctx = (PROV_SLH_DSA_CTX )vctx;
283	0	struct slh_dsa_set_ctx_params_st p;
284
285	0	if (pctx == NULL \|\| !slh_dsa_set_ctx_params_decoder(params, &p))
286	0	return 0;
287
288	0	if (p.context != NULL) {
289	0	void *vp = pctx->context_string;
290
291	0	if (!OSSL_PARAM_get_octet_string(p.context, &vp,
292	0	sizeof(pctx->context_string),
293	0	&(pctx->context_string_len))) {
294	0	pctx->context_string_len = 0;
295	0	return 0;
296	0	}
297	0	}
298
299	0	if (p.entropy != NULL) {
300	0	void *vp = pctx->add_random;
301	0	size_t n = ossl_slh_dsa_key_get_n(pctx->key);
302
303	0	if (!OSSL_PARAM_get_octet_string(p.entropy, &vp, n, &(pctx->add_random_len))
304	0	\|\| pctx->add_random_len != n) {
305	0	pctx->add_random_len = 0;
306	0	return 0;
307	0	}
308	0	}
309
310	0	if (p.det != NULL && !OSSL_PARAM_get_int(p.det, &pctx->deterministic))
311	0	return 0;
312
313	0	if (p.msgenc != NULL && !OSSL_PARAM_get_int(p.msgenc, &pctx->msg_encode))
314	0	return 0;
315	0	return 1;
316	0	}
317
318		static const OSSL_PARAM slh_dsa_settable_ctx_params(void vctx,
319		ossl_unused void *provctx)
320	0	{
321	0	return slh_dsa_set_ctx_params_list;
322	0	}
323
324		static const OSSL_PARAM slh_dsa_gettable_ctx_params(ossl_unused void vctx,
325		ossl_unused void *provctx)
326	0	{
327	0	return slh_dsa_get_ctx_params_list;
328	0	}
329
330		static int slh_dsa_get_ctx_params(void vctx, OSSL_PARAM params)
331	0	{
332	0	PROV_SLH_DSA_CTX ctx = (PROV_SLH_DSA_CTX )vctx;
333	0	struct slh_dsa_get_ctx_params_st p;
334
335	0	if (ctx == NULL \|\| !slh_dsa_get_ctx_params_decoder(params, &p))
336	0	return 0;
337
338	0	if (p.algid != NULL
339	0	&& !OSSL_PARAM_set_octet_string(p.algid,
340	0	ctx->aid_len == 0 ? NULL : ctx->aid_buf,
341	0	ctx->aid_len))
342	0	return 0;
343
344	0	if (!OSSL_FIPS_IND_GET_PARAM_CONDITIONAL(p.ind,
345	0	ctx->add_random_len == 0))
346	0	return 0;
347
348	0	return 1;
349	0	}
350
351		#define MAKE_SIGNATURE_FUNCTIONS(alg, fn) \
352		static OSSL_FUNC_signature_newctx_fn slh_dsa_##fn##_newctx; \
353		static void slh_dsa_##fn##_newctx(void provctx, const char *propq) \
354	0	{ \
355	0	return slh_dsa_newctx(provctx, alg, propq); \
356	0	} \ Unexecuted instantiation: slh_dsa_sig.c:slh_dsa_sha2_128s_newctx Unexecuted instantiation: slh_dsa_sig.c:slh_dsa_sha2_128f_newctx Unexecuted instantiation: slh_dsa_sig.c:slh_dsa_sha2_192s_newctx Unexecuted instantiation: slh_dsa_sig.c:slh_dsa_sha2_192f_newctx Unexecuted instantiation: slh_dsa_sig.c:slh_dsa_sha2_256s_newctx Unexecuted instantiation: slh_dsa_sig.c:slh_dsa_sha2_256f_newctx Unexecuted instantiation: slh_dsa_sig.c:slh_dsa_shake_128s_newctx Unexecuted instantiation: slh_dsa_sig.c:slh_dsa_shake_128f_newctx Unexecuted instantiation: slh_dsa_sig.c:slh_dsa_shake_192s_newctx Unexecuted instantiation: slh_dsa_sig.c:slh_dsa_shake_192f_newctx Unexecuted instantiation: slh_dsa_sig.c:slh_dsa_shake_256s_newctx Unexecuted instantiation: slh_dsa_sig.c:slh_dsa_shake_256f_newctx
357		const OSSL_DISPATCH ossl_slh_dsa_##fn##_signature_functions[] = { \
358		{ OSSL_FUNC_SIGNATURE_NEWCTX, (void (*)(void))slh_dsa_##fn##_newctx }, \
359		{ OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT, \
360		(void (*)(void))slh_dsa_sign_msg_init }, \
361		{ OSSL_FUNC_SIGNATURE_SIGN, (void (*)(void))slh_dsa_sign }, \
362		{ OSSL_FUNC_SIGNATURE_VERIFY_MESSAGE_INIT, \
363		(void (*)(void))slh_dsa_verify_msg_init }, \
364		{ OSSL_FUNC_SIGNATURE_VERIFY, (void (*)(void))slh_dsa_verify }, \
365		{ OSSL_FUNC_SIGNATURE_DIGEST_SIGN_INIT, \
366		(void (*)(void))slh_dsa_digest_signverify_init }, \
367		{ OSSL_FUNC_SIGNATURE_DIGEST_SIGN, \
368		(void (*)(void))slh_dsa_digest_sign }, \
369		{ OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_INIT, \
370		(void (*)(void))slh_dsa_digest_signverify_init }, \
371		{ OSSL_FUNC_SIGNATURE_DIGEST_VERIFY, \
372		(void (*)(void))slh_dsa_digest_verify }, \
373		{ OSSL_FUNC_SIGNATURE_FREECTX, (void (*)(void))slh_dsa_freectx }, \
374		{ OSSL_FUNC_SIGNATURE_DUPCTX, (void (*)(void))slh_dsa_dupctx }, \
375		{ OSSL_FUNC_SIGNATURE_SET_CTX_PARAMS, (void (*)(void))slh_dsa_set_ctx_params }, \
376		{ OSSL_FUNC_SIGNATURE_SETTABLE_CTX_PARAMS, \
377		(void (*)(void))slh_dsa_settable_ctx_params }, \
378		{ OSSL_FUNC_SIGNATURE_GET_CTX_PARAMS, \
379		(void (*)(void))slh_dsa_get_ctx_params }, \
380		{ OSSL_FUNC_SIGNATURE_GETTABLE_CTX_PARAMS, \
381		(void (*)(void))slh_dsa_gettable_ctx_params }, \
382		OSSL_DISPATCH_END \
383		}
384
385		MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHA2-128s", sha2_128s);
386		MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHA2-128f", sha2_128f);
387		MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHA2-192s", sha2_192s);
388		MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHA2-192f", sha2_192f);
389		MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHA2-256s", sha2_256s);
390		MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHA2-256f", sha2_256f);
391		MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHAKE-128s", shake_128s);
392		MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHAKE-128f", shake_128f);
393		MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHAKE-192s", shake_192s);
394		MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHAKE-192f", shake_192f);
395		MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHAKE-256s", shake_256s);
396		MAKE_SIGNATURE_FUNCTIONS("SLH-DSA-SHAKE-256f", shake_256f);