/src/openssl41/crypto/slh_dsa/slh_wots.c

Source
/*
 * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <string.h>
#include <openssl/crypto.h>
#include "slh_dsa_local.h"
#include "slh_dsa_key.h"

/* For the parameter sets defined there is only one w value */
#define SLH_WOTS_LOGW 4
#define SLH_WOTS_W 16
#define SLH_WOTS_LEN1(n) (2 * (n))
#define SLH_WOTS_LEN2 3
#define SLH_WOTS_CHECKSUM_LEN ((SLH_WOTS_LEN2 + SLH_WOTS_LOGW + 7) / 8)
#define SLH_WOTS_LEN_MAX SLH_WOTS_LEN(SLH_MAX_N)
#define NIBBLE_MASK 15
#define NIBBLE_SHIFT 4

/*
 * @brief Convert a byte array to a byte array of (4 bit) nibbles
 * This is a Variant of the FIPS 205 Algorithm 4 base_2^b function.
 *
 * @param in A byte message to convert
 * @param in_len The size of |in|.
 * @param out The returned array of nibbles, with a size of 2*|in_len|
 */
static ossl_inline void slh_bytes_to_nibbles(const uint8_t *in, size_t in_len,
    uint8_t *out)
{
    size_t consumed = 0;

    for (consumed = 0; consumed < in_len; consumed++) {
        *out++ = (*in >> NIBBLE_SHIFT);
        *out++ = (*in++ & NIBBLE_MASK);
    }
}

/*
 * With w = 16 the maximum checksum is 0xF * n which fits into 12 bits
 * which is 3 nibbles.
 *
 * This is effectively a cutdown version of Algorithm 7: steps 3 to 6
 * which does a complicated base2^b(tobyte()) operation.
 */
static ossl_inline void compute_checksum_nibbles(const uint8_t *in, size_t in_len,
    uint8_t *out)
{
    size_t i;
    uint16_t csum = 0;

    /* Compute checksum */
    for (i = 0; i < in_len; ++i)
        csum += in[i];
    /*
     * This line is effectively the same as doing csum += NIBBLE_MASK - in[i]
     * in the loop above.
     */
    csum = (uint16_t)(NIBBLE_MASK * in_len) - csum;

    /* output checksum as 3 nibbles */
    out[0] = (csum >> (2 * NIBBLE_SHIFT)) & NIBBLE_MASK;
    out[1] = (csum >> NIBBLE_SHIFT) & NIBBLE_MASK;
    out[2] = csum & NIBBLE_MASK;
}

/**
 * @brief WOTS+ Chaining function
 * See FIPS 205 Section 5 Algorithm 5
 *
 * Iterates using a hash function on the input |steps| times starting at index
 * |start|. (Internally the |adrs| hash address is used to update the chaining
 * index).
 *
 * @param ctx Contains SLH_DSA algorithm functions and constants.
 * @param in An input string of |n| bytes
 * @param start_index The chaining start index
 * @param steps The number of iterations starting from |start_index|
 *              Note |start_index| + |steps| < w
 *              (where w = 16 indicates the length of the hash chains)
 * @param pk_seed A public key seed (which is added to the hash)
 * @param adrs An ADRS object which has a type of WOTS_HASH, and has a layer
 *             address, tree address, key pair address and chain address
 * @params wpkt A WPACKET object to write the hash chain to (n bytes are written)
 * @returns 1 on success, or 0 on error.
 */
static int slh_wots_chain(SLH_DSA_HASH_CTX *ctx, const uint8_t *in,
    uint8_t start_index, uint8_t steps,
    const uint8_t *pk_seed, uint8_t *adrs, WPACKET *wpkt)
{
    const SLH_DSA_KEY *key = ctx->key;
    SLH_HASH_FUNC_DECLARE(key, hashf);
    SLH_ADRS_FUNC_DECLARE(key, adrsf);
    SLH_HASH_FN_DECLARE(hashf, F);
    SLH_ADRS_FN_DECLARE(adrsf, set_hash_address);
    size_t j = start_index, end_index;
    size_t n = key->params->n;
    uint8_t *tmp; /* Pointer into the |wpkt| buffer */
    size_t tmp_len = n;

    if (steps == 0)
        return WPACKET_memcpy(wpkt, in, n);

    if (!WPACKET_allocate_bytes(wpkt, tmp_len, &tmp))
        return 0;

    set_hash_address(adrs, (uint32_t)(j++));
    if (!F(ctx, pk_seed, adrs, in, n, tmp, tmp_len))
        return 0;

    end_index = start_index + steps;
    for (; j < end_index; ++j) {
        set_hash_address(adrs, (uint32_t)j);
        if (!F(ctx, pk_seed, adrs, tmp, n, tmp, tmp_len))
            return 0;
    }
    return 1;
}

/**
 * @brief WOTS+ Public key generation.
 * See FIPS 205 Section 5.1 Algorithm 6
 *
 * @param ctx Contains SLH_DSA algorithm functions and constants.
 * @param sk_seed A private key seed of size |n|
 * @param pk_seed A public key seed of size |n|
 * @param adrs An ADRS object containing the layer address, tree address and
 *             keypair address of the WOTS+ public key to generate.
 * @param pk_out The generated public key of size |n|
 * @param pk_out_len The maximum size of |pk_out|
 * @returns 1 on success, or 0 on error.
 */
int ossl_slh_wots_pk_gen(SLH_DSA_HASH_CTX *ctx,
    const uint8_t *sk_seed, const uint8_t *pk_seed,
    uint8_t *adrs, uint8_t *pk_out, size_t pk_out_len)
{
    int ret = 0;
    const SLH_DSA_KEY *key = ctx->key;
    size_t n = key->params->n;
    size_t len = SLH_WOTS_LEN(n); /* 2 * n + 3 */
    uint8_t tmp[SLH_WOTS_LEN_MAX * SLH_MAX_N];
    size_t tmp_len = n * len;

    SLH_HASH_FUNC_DECLARE(key, hashf);
    SLH_ADRS_FUNC_DECLARE(key, adrsf);
    SLH_ADRS_DECLARE(wots_pk_adrs);

    if (!hashf->wots_pk_gen(ctx, sk_seed, pk_seed, adrs, tmp, tmp_len))
        goto end;

    adrsf->copy(wots_pk_adrs, adrs);
    adrsf->set_type_and_clear(wots_pk_adrs, SLH_ADRS_TYPE_WOTS_PK);
    adrsf->copy_keypair_address(wots_pk_adrs, adrs);
    ret = hashf->T(ctx, pk_seed, wots_pk_adrs, tmp, tmp_len, pk_out, pk_out_len);
end:
    OPENSSL_cleanse(tmp, tmp_len);
    return ret;
}

/**
 * @brief WOTS+ Signature generation
 * See FIPS 205 Section 5.2 Algorithm 7
 *
 * The returned signature size is len * |n| bytes (where len = 2 * |n| + 3).
 *
 * @param ctx Contains SLH_DSA algorithm functions and constants.
 * @param msg An input message of size |n| bytes.
 *            The message is either an XMSS or FORS public key
 * @param sk_seed The private key seed of size |n| bytes
 * @param pk_seed The public key seed  of size |n| bytes
 * @param adrs An address containing the layer address, tree address and key
 *             pair address. The size is either 32 or 22 bytes.
 * @param sig_wpkt A WPACKET object to write the signature to.
 * @returns 1 on success, or 0 on error.
 */
int ossl_slh_wots_sign(SLH_DSA_HASH_CTX *ctx, const uint8_t *msg,
    const uint8_t *sk_seed, const uint8_t *pk_seed,
    uint8_t *adrs, WPACKET *sig_wpkt)
{
    int ret = 0;
    const SLH_DSA_KEY *key = ctx->key;
    uint8_t msg_and_csum_nibbles[SLH_WOTS_LEN_MAX]; /* size is >= 2 * n + 3 */
    uint8_t sk[SLH_MAX_N];
    size_t i;
    size_t n = key->params->n;
    size_t len1 = SLH_WOTS_LEN1(n); /* 2 * n = the msg length in nibbles */
    size_t len = len1 + SLH_WOTS_LEN2; /* 2 * n + 3 (3 checksum nibbles) */

    SLH_ADRS_DECLARE(sk_adrs);
    SLH_HASH_FUNC_DECLARE(key, hashf);
    SLH_ADRS_FUNC_DECLARE(key, adrsf);
    SLH_HASH_FN_DECLARE(hashf, PRF);
    SLH_ADRS_FN_DECLARE(adrsf, set_chain_address);

    /*
     * Convert n message bytes to 2*n base w=16 integers
     * i.e. Convert message to an array of 2*n nibbles.
     */
    slh_bytes_to_nibbles(msg, n, msg_and_csum_nibbles);
    /* Compute a 12 bit checksum and add it to the end */
    compute_checksum_nibbles(msg_and_csum_nibbles, len1, msg_and_csum_nibbles + len1);

    adrsf->copy(sk_adrs, adrs);
    adrsf->set_type_and_clear(sk_adrs, SLH_ADRS_TYPE_WOTS_PRF);
    adrsf->copy_keypair_address(sk_adrs, adrs);

    for (i = 0; i < len; ++i) {
        set_chain_address(sk_adrs, (uint32_t)i);
        /* compute chain i secret */
        if (!PRF(ctx, pk_seed, sk_seed, sk_adrs, sk, sizeof(sk)))
            goto err;
        set_chain_address(adrs, (uint32_t)i);
        /* compute chain i signature */
        if (!slh_wots_chain(ctx, sk, 0, msg_and_csum_nibbles[i],
                pk_seed, adrs, sig_wpkt))
            goto err;
    }
    ret = 1;
err:
    OPENSSL_cleanse(sk, sizeof(sk));
    OPENSSL_cleanse(msg_and_csum_nibbles, sizeof(msg_and_csum_nibbles));
    return ret;
}

/**
 * @brief Compute a candidate WOTS+ public key from a message and signature
 * See FIPS 205 Section 5.3 Algorithm 8
 *
 * The size of the signature is len * |n| bytes (where len = 2 * |n| + 3).
 *
 * @param ctx Contains SLH_DSA algorithm functions and constants.
 * @param sig_rpkt A PACKET object to read a WOTS+ signature from
 * @param msg A message of size |n| bytes.
 * @param pk_seed The public key seed of size |n|.
 * @param adrs An ADRS object containing the layer address, tree address and
 *             key pair address that of the WOTS+ key used to sign the message.
 * @param pk_out The returned public key candidate of size |n|
 * @param pk_out_len The maximum size of |pk_out|
 * @returns 1 on success, or 0 on error.
 */
int ossl_slh_wots_pk_from_sig(SLH_DSA_HASH_CTX *ctx,
    PACKET *sig_rpkt, const uint8_t *msg,
    const uint8_t *pk_seed, uint8_t *adrs,
    uint8_t *pk_out, size_t pk_out_len)
{
    int ret = 0;
    const SLH_DSA_KEY *key = ctx->key;
    uint8_t msg_and_csum_nibbles[SLH_WOTS_LEN_MAX];
    size_t i;
    size_t n = key->params->n;
    size_t len1 = SLH_WOTS_LEN1(n);
    size_t len = len1 + SLH_WOTS_LEN2; /* 2n + 3 */
    const uint8_t *sig_i; /* Pointer into |sig_rpkt| buffer */
    uint8_t tmp[SLH_WOTS_LEN_MAX * SLH_MAX_N];
    WPACKET pkt, *tmp_pkt = &pkt;
    size_t tmp_len = 0;

    SLH_HASH_FUNC_DECLARE(key, hashf);
    SLH_ADRS_FUNC_DECLARE(key, adrsf);
    SLH_ADRS_FN_DECLARE(adrsf, set_chain_address);
    SLH_ADRS_DECLARE(wots_pk_adrs);

    if (!WPACKET_init_static_len(tmp_pkt, tmp, sizeof(tmp), 0))
        return 0;

    slh_bytes_to_nibbles(msg, n, msg_and_csum_nibbles);
    compute_checksum_nibbles(msg_and_csum_nibbles, len1, msg_and_csum_nibbles + len1);

    /* Compute the end nodes for each of the chains */
    for (i = 0; i < len; ++i) {
        set_chain_address(adrs, (uint32_t)i);
        if (!PACKET_get_bytes(sig_rpkt, &sig_i, n)
            || !slh_wots_chain(ctx, sig_i, msg_and_csum_nibbles[i],
                NIBBLE_MASK - msg_and_csum_nibbles[i],
                pk_seed, adrs, tmp_pkt))
            goto err;
    }
    /* compress the computed public key value */
    adrsf->copy(wots_pk_adrs, adrs);
    adrsf->set_type_and_clear(wots_pk_adrs, SLH_ADRS_TYPE_WOTS_PK);
    adrsf->copy_keypair_address(wots_pk_adrs, adrs);
    if (!WPACKET_get_total_written(tmp_pkt, &tmp_len))
        goto err;
    ret = hashf->T(ctx, pk_seed, wots_pk_adrs, tmp, tmp_len,
        pk_out, pk_out_len);
err:
    if (!WPACKET_finish(tmp_pkt))
        ret = 0;
    OPENSSL_cleanse(tmp, sizeof(tmp));
    OPENSSL_cleanse(msg_and_csum_nibbles, sizeof(msg_and_csum_nibbles));
    return ret;
}

Coverage Report

Created: 2026-09-12 06:55

Line	Count	Source
1		/*
2		* Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		#include <string.h>
11		#include <openssl/crypto.h>
12		#include "slh_dsa_local.h"
13		#include "slh_dsa_key.h"
14
15		/* For the parameter sets defined there is only one w value */
16		#define SLH_WOTS_LOGW 4
17		#define SLH_WOTS_W 16
18	48.1k	#define SLH_WOTS_LEN1(n) (2 * (n))
19	48.1k	#define SLH_WOTS_LEN2 3
20		#define SLH_WOTS_CHECKSUM_LEN ((SLH_WOTS_LEN2 + SLH_WOTS_LOGW + 7) / 8)
21		#define SLH_WOTS_LEN_MAX SLH_WOTS_LEN(SLH_MAX_N)
22	2.84M	#define NIBBLE_MASK 15
23	1.19M	#define NIBBLE_SHIFT 4
24
25		/*
26		* @brief Convert a byte array to a byte array of (4 bit) nibbles
27		* This is a Variant of the FIPS 205 Algorithm 4 base_2^b function.
28		*
29		* @param in A byte message to convert
30		* @param in_len The size of \|in\|.
31		* @param out The returned array of nibbles, with a size of 2*\|in_len\|
32		*/
33		static ossl_inline void slh_bytes_to_nibbles(const uint8_t *in, size_t in_len,
34		uint8_t *out)
35	48.1k	{
36	48.1k	size_t consumed = 0;
37
38	1.15M	for (consumed = 0; consumed < in_len; consumed++) {
39	1.10M	out++ = (in >> NIBBLE_SHIFT);
40	1.10M	out++ = (in++ & NIBBLE_MASK);
41	1.10M	}
42	48.1k	}
43
44		/*
45		* With w = 16 the maximum checksum is 0xF * n which fits into 12 bits
46		* which is 3 nibbles.
47		*
48		* This is effectively a cutdown version of Algorithm 7: steps 3 to 6
49		* which does a complicated base2^b(tobyte()) operation.
50		*/
51		static ossl_inline void compute_checksum_nibbles(const uint8_t *in, size_t in_len,
52		uint8_t *out)
53	48.1k	{
54	48.1k	size_t i;
55	48.1k	uint16_t csum = 0;
56
57		/* Compute checksum */
58	2.25M	for (i = 0; i < in_len; ++i)
59	2.20M	csum += in[i];
60		/*
61		* This line is effectively the same as doing csum += NIBBLE_MASK - in[i]
62		* in the loop above.
63		*/
64	48.1k	csum = (uint16_t)(NIBBLE_MASK * in_len) - csum;
65
66		/* output checksum as 3 nibbles */
67	48.1k	out[0] = (csum >> (2 * NIBBLE_SHIFT)) & NIBBLE_MASK;
68	48.1k	out[1] = (csum >> NIBBLE_SHIFT) & NIBBLE_MASK;
69	48.1k	out[2] = csum & NIBBLE_MASK;
70	48.1k	}
71
72		/**
73		* @brief WOTS+ Chaining function
74		* See FIPS 205 Section 5 Algorithm 5
75		*
76		* Iterates using a hash function on the input \|steps\| times starting at index
77		* \|start\|. (Internally the \|adrs\| hash address is used to update the chaining
78		* index).
79		*
80		* @param ctx Contains SLH_DSA algorithm functions and constants.
81		* @param in An input string of \|n\| bytes
82		* @param start_index The chaining start index
83		* @param steps The number of iterations starting from \|start_index\|
84		* Note \|start_index\| + \|steps\| < w
85		* (where w = 16 indicates the length of the hash chains)
86		* @param pk_seed A public key seed (which is added to the hash)
87		* @param adrs An ADRS object which has a type of WOTS_HASH, and has a layer
88		* address, tree address, key pair address and chain address
89		* @params wpkt A WPACKET object to write the hash chain to (n bytes are written)
90		* @returns 1 on success, or 0 on error.
91		*/
92		static int slh_wots_chain(SLH_DSA_HASH_CTX ctx, const uint8_t in,
93		uint8_t start_index, uint8_t steps,
94		const uint8_t pk_seed, uint8_t adrs, WPACKET *wpkt)
95	35.0M	{
96	35.0M	const SLH_DSA_KEY *key = ctx->key;
97	35.0M	SLH_HASH_FUNC_DECLARE(key, hashf);
98	35.0M	SLH_ADRS_FUNC_DECLARE(key, adrsf);
99	35.0M	SLH_HASH_FN_DECLARE(hashf, F);
100	35.0M	SLH_ADRS_FN_DECLARE(adrsf, set_hash_address);
101	35.0M	size_t j = start_index, end_index;
102	35.0M	size_t n = key->params->n;
103	35.0M	uint8_t tmp; / Pointer into the \|wpkt\| buffer */
104	35.0M	size_t tmp_len = n;
105
106	35.0M	if (steps == 0)
107	149k	return WPACKET_memcpy(wpkt, in, n);
108
109	34.8M	if (!WPACKET_allocate_bytes(wpkt, tmp_len, &tmp))
110	0	return 0;
111
112	34.8M	set_hash_address(adrs, (uint32_t)(j++));
113	34.8M	if (!F(ctx, pk_seed, adrs, in, n, tmp, tmp_len))
114	0	return 0;
115
116	34.8M	end_index = start_index + steps;
117	507M	for (; j < end_index; ++j) {
118	472M	set_hash_address(adrs, (uint32_t)j);
119	472M	if (!F(ctx, pk_seed, adrs, tmp, n, tmp, tmp_len))
120	0	return 0;
121	472M	}
122	34.8M	return 1;
123	34.8M	}
124
125		/**
126		* @brief WOTS+ Public key generation.
127		* See FIPS 205 Section 5.1 Algorithm 6
128		*
129		* @param ctx Contains SLH_DSA algorithm functions and constants.
130		* @param sk_seed A private key seed of size \|n\|
131		* @param pk_seed A public key seed of size \|n\|
132		* @param adrs An ADRS object containing the layer address, tree address and
133		* keypair address of the WOTS+ public key to generate.
134		* @param pk_out The generated public key of size \|n\|
135		* @param pk_out_len The maximum size of \|pk_out\|
136		* @returns 1 on success, or 0 on error.
137		*/
138		int ossl_slh_wots_pk_gen(SLH_DSA_HASH_CTX *ctx,
139		const uint8_t sk_seed, const uint8_t pk_seed,
140		uint8_t adrs, uint8_t pk_out, size_t pk_out_len)
141	629k	{
142	629k	int ret = 0;
143	629k	const SLH_DSA_KEY *key = ctx->key;
144	629k	size_t n = key->params->n;
145	629k	size_t len = SLH_WOTS_LEN(n); /* 2 * n + 3 */
146	629k	uint8_t tmp[SLH_WOTS_LEN_MAX * SLH_MAX_N];
147	629k	size_t tmp_len = n * len;
148
149	629k	SLH_HASH_FUNC_DECLARE(key, hashf);
150	629k	SLH_ADRS_FUNC_DECLARE(key, adrsf);
151	629k	SLH_ADRS_DECLARE(wots_pk_adrs);
152
153	629k	if (!hashf->wots_pk_gen(ctx, sk_seed, pk_seed, adrs, tmp, tmp_len))
154	0	goto end;
155
156	629k	adrsf->copy(wots_pk_adrs, adrs);
157	629k	adrsf->set_type_and_clear(wots_pk_adrs, SLH_ADRS_TYPE_WOTS_PK);
158	629k	adrsf->copy_keypair_address(wots_pk_adrs, adrs);
159	629k	ret = hashf->T(ctx, pk_seed, wots_pk_adrs, tmp, tmp_len, pk_out, pk_out_len);
160	629k	end:
161	629k	OPENSSL_cleanse(tmp, tmp_len);
162	629k	return ret;
163	629k	}
164
165		/**
166		* @brief WOTS+ Signature generation
167		* See FIPS 205 Section 5.2 Algorithm 7
168		*
169		* The returned signature size is len * \|n\| bytes (where len = 2 * \|n\| + 3).
170		*
171		* @param ctx Contains SLH_DSA algorithm functions and constants.
172		* @param msg An input message of size \|n\| bytes.
173		* The message is either an XMSS or FORS public key
174		* @param sk_seed The private key seed of size \|n\| bytes
175		* @param pk_seed The public key seed of size \|n\| bytes
176		* @param adrs An address containing the layer address, tree address and key
177		* pair address. The size is either 32 or 22 bytes.
178		* @param sig_wpkt A WPACKET object to write the signature to.
179		* @returns 1 on success, or 0 on error.
180		*/
181		int ossl_slh_wots_sign(SLH_DSA_HASH_CTX ctx, const uint8_t msg,
182		const uint8_t sk_seed, const uint8_t pk_seed,
183		uint8_t adrs, WPACKET sig_wpkt)
184	16.3k	{
185	16.3k	int ret = 0;
186	16.3k	const SLH_DSA_KEY *key = ctx->key;
187	16.3k	uint8_t msg_and_csum_nibbles[SLH_WOTS_LEN_MAX]; /* size is >= 2 * n + 3 */
188	16.3k	uint8_t sk[SLH_MAX_N];
189	16.3k	size_t i;
190	16.3k	size_t n = key->params->n;
191	16.3k	size_t len1 = SLH_WOTS_LEN1(n); /* 2 * n = the msg length in nibbles */
192	16.3k	size_t len = len1 + SLH_WOTS_LEN2; /* 2 * n + 3 (3 checksum nibbles) */
193
194	16.3k	SLH_ADRS_DECLARE(sk_adrs);
195	16.3k	SLH_HASH_FUNC_DECLARE(key, hashf);
196	16.3k	SLH_ADRS_FUNC_DECLARE(key, adrsf);
197	16.3k	SLH_HASH_FN_DECLARE(hashf, PRF);
198	16.3k	SLH_ADRS_FN_DECLARE(adrsf, set_chain_address);
199
200		/*
201		* Convert n message bytes to 2*n base w=16 integers
202		* i.e. Convert message to an array of 2*n nibbles.
203		*/
204	16.3k	slh_bytes_to_nibbles(msg, n, msg_and_csum_nibbles);
205		/* Compute a 12 bit checksum and add it to the end */
206	16.3k	compute_checksum_nibbles(msg_and_csum_nibbles, len1, msg_and_csum_nibbles + len1);
207
208	16.3k	adrsf->copy(sk_adrs, adrs);
209	16.3k	adrsf->set_type_and_clear(sk_adrs, SLH_ADRS_TYPE_WOTS_PRF);
210	16.3k	adrsf->copy_keypair_address(sk_adrs, adrs);
211
212	815k	for (i = 0; i < len; ++i) {
213	799k	set_chain_address(sk_adrs, (uint32_t)i);
214		/* compute chain i secret */
215	799k	if (!PRF(ctx, pk_seed, sk_seed, sk_adrs, sk, sizeof(sk)))
216	0	goto err;
217	799k	set_chain_address(adrs, (uint32_t)i);
218		/* compute chain i signature */
219	799k	if (!slh_wots_chain(ctx, sk, 0, msg_and_csum_nibbles[i],
220	799k	pk_seed, adrs, sig_wpkt))
221	0	goto err;
222	799k	}
223	16.3k	ret = 1;
224	16.3k	err:
225	16.3k	OPENSSL_cleanse(sk, sizeof(sk));
226	16.3k	OPENSSL_cleanse(msg_and_csum_nibbles, sizeof(msg_and_csum_nibbles));
227	16.3k	return ret;
228	16.3k	}
229
230		/**
231		* @brief Compute a candidate WOTS+ public key from a message and signature
232		* See FIPS 205 Section 5.3 Algorithm 8
233		*
234		* The size of the signature is len * \|n\| bytes (where len = 2 * \|n\| + 3).
235		*
236		* @param ctx Contains SLH_DSA algorithm functions and constants.
237		* @param sig_rpkt A PACKET object to read a WOTS+ signature from
238		* @param msg A message of size \|n\| bytes.
239		* @param pk_seed The public key seed of size \|n\|.
240		* @param adrs An ADRS object containing the layer address, tree address and
241		* key pair address that of the WOTS+ key used to sign the message.
242		* @param pk_out The returned public key candidate of size \|n\|
243		* @param pk_out_len The maximum size of \|pk_out\|
244		* @returns 1 on success, or 0 on error.
245		*/
246		int ossl_slh_wots_pk_from_sig(SLH_DSA_HASH_CTX *ctx,
247		PACKET sig_rpkt, const uint8_t msg,
248		const uint8_t pk_seed, uint8_t adrs,
249		uint8_t *pk_out, size_t pk_out_len)
250	31.7k	{
251	31.7k	int ret = 0;
252	31.7k	const SLH_DSA_KEY *key = ctx->key;
253	31.7k	uint8_t msg_and_csum_nibbles[SLH_WOTS_LEN_MAX];
254	31.7k	size_t i;
255	31.7k	size_t n = key->params->n;
256	31.7k	size_t len1 = SLH_WOTS_LEN1(n);
257	31.7k	size_t len = len1 + SLH_WOTS_LEN2; /* 2n + 3 */
258	31.7k	const uint8_t sig_i; / Pointer into \|sig_rpkt\| buffer */
259	31.7k	uint8_t tmp[SLH_WOTS_LEN_MAX * SLH_MAX_N];
260	31.7k	WPACKET pkt, *tmp_pkt = &pkt;
261	31.7k	size_t tmp_len = 0;
262
263	31.7k	SLH_HASH_FUNC_DECLARE(key, hashf);
264	31.7k	SLH_ADRS_FUNC_DECLARE(key, adrsf);
265	31.7k	SLH_ADRS_FN_DECLARE(adrsf, set_chain_address);
266	31.7k	SLH_ADRS_DECLARE(wots_pk_adrs);
267
268	31.7k	if (!WPACKET_init_static_len(tmp_pkt, tmp, sizeof(tmp), 0))
269	0	return 0;
270
271	31.7k	slh_bytes_to_nibbles(msg, n, msg_and_csum_nibbles);
272	31.7k	compute_checksum_nibbles(msg_and_csum_nibbles, len1, msg_and_csum_nibbles + len1);
273
274		/* Compute the end nodes for each of the chains */
275	1.58M	for (i = 0; i < len; ++i) {
276	1.55M	set_chain_address(adrs, (uint32_t)i);
277	1.55M	if (!PACKET_get_bytes(sig_rpkt, &sig_i, n)
278	1.55M	\|\| !slh_wots_chain(ctx, sig_i, msg_and_csum_nibbles[i],
279	1.55M	NIBBLE_MASK - msg_and_csum_nibbles[i],
280	1.55M	pk_seed, adrs, tmp_pkt))
281	0	goto err;
282	1.55M	}
283		/* compress the computed public key value */
284	31.7k	adrsf->copy(wots_pk_adrs, adrs);
285	31.7k	adrsf->set_type_and_clear(wots_pk_adrs, SLH_ADRS_TYPE_WOTS_PK);
286	31.7k	adrsf->copy_keypair_address(wots_pk_adrs, adrs);
287	31.7k	if (!WPACKET_get_total_written(tmp_pkt, &tmp_len))
288	0	goto err;
289	31.7k	ret = hashf->T(ctx, pk_seed, wots_pk_adrs, tmp, tmp_len,
290	31.7k	pk_out, pk_out_len);
291	31.7k	err:
292	31.7k	if (!WPACKET_finish(tmp_pkt))
293	0	ret = 0;
294	31.7k	OPENSSL_cleanse(tmp, sizeof(tmp));
295	31.7k	OPENSSL_cleanse(msg_and_csum_nibbles, sizeof(msg_and_csum_nibbles));
296	31.7k	return ret;
297	31.7k	}