/*

 * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.

 *

 * Licensed under the Apache License 2.0 (the "License").  You may not use

 * this file except in compliance with the License.  You can obtain a copy

 * in the file LICENSE in the source distribution or at

 * https://www.openssl.org/source/license.html

 */

#include <string.h>

#include <openssl/crypto.h>

#include "slh_dsa_local.h"

#include "slh_dsa_key.h"

/**

 * @brief Compute the root Public key of a XMSS tree.

 * See FIPS 205 Section 6.1 Algorithm 9.

 * This is a recursive function that starts at an leaf index, that calculates

 * the hash of each parent using 2 child nodes.

 *

 * @param ctx Contains SLH_DSA algorithm functions and constants.

 * @param sk_seed A SLH-DSA private key seed of size |n|

 * @param nodeid The index of the target node being computed

 *               (which must be < 2^(hm - height)

 * @param h The height within the tree of the node being computed.

 *          (which must be <= hm) (hm is one of 3, 4, 8 or 9)

 *          At height=0 There are 2^hm leaf nodes,

 *          and the root node is at height = hm)

 * @param pk_seed A SLH-DSA public key seed of size |n|

 * @param adrs An ADRS object containing the layer address and tree address set

 *             to the XMSS tree within which the XMSS tree is being computed.

 * @param pk_out The generated public key of size |n|

 * @param pk_out_len The maximum size of |pk_out|

 * @returns 1 on success, or 0 on error.

 */

int ossl_slh_xmss_node(SLH_DSA_HASH_CTX *ctx, const uint8_t *sk_seed,

    uint32_t node_id, uint32_t h,

    const uint8_t *pk_seed, uint8_t *adrs,

    uint8_t *pk_out, size_t pk_out_len)

{

    const SLH_DSA_KEY *key = ctx->key;

    SLH_ADRS_FUNC_DECLARE(key, adrsf);

    int ret = 0;

    if (h == 0) {

        /* For leaf nodes generate the public key */

        adrsf->set_type_and_clear(adrs, SLH_ADRS_TYPE_WOTS_HASH);

        adrsf->set_keypair_address(adrs, node_id);

        if (ossl_slh_wots_pk_gen(ctx, sk_seed, pk_seed, adrs,

                pk_out, pk_out_len))

            ret = 1;

    } else {

        uint8_t lnode[SLH_MAX_N], rnode[SLH_MAX_N];

        if (ossl_slh_xmss_node(ctx, sk_seed, 2 * node_id, h - 1, pk_seed, adrs,

                lnode, sizeof(lnode))

            && ossl_slh_xmss_node(ctx, sk_seed, 2 * node_id + 1, h - 1,

                pk_seed, adrs, rnode, sizeof(rnode))) {

            adrsf->set_type_and_clear(adrs, SLH_ADRS_TYPE_TREE);

            adrsf->set_tree_height(adrs, h);

            adrsf->set_tree_index(adrs, node_id);

            ret = key->hash_func->H(ctx, pk_seed, adrs, lnode, rnode, pk_out, pk_out_len);

        }

        OPENSSL_cleanse(lnode, sizeof(lnode));

        OPENSSL_cleanse(rnode, sizeof(rnode));

    }

    return ret;

}

/**

 * @brief Generate an XMSS signature using a message and key.

 * See FIPS 205 Section 6.2 Algorithm 10

 *

 * The generated signature consists of:

 *  - A WOTS+ signature of size (2 * n + 3) * n

 *  - An array of authentication paths of size (XMSS tree_height) * n.

 *

 * @param ctx Contains SLH_DSA algorithm functions and constants.

 * @param msg A message of size |n| bytes to sign

 * @param sk_seed A private key seed of size |n|

 * @param node_id The index of a WOTS+ key within the XMSS tree to use for signing.

 * @param pk_seed A public key seed f size |n|

 * @param adrs An ADRS object containing the layer address and tree address set

 *              to the XMSS key being used to sign the message.

 * @param sig_wpkt A WPACKET object to write the generated XMSS signature to.

 * @returns 1 on success, or 0 on error.

 */

int ossl_slh_xmss_sign(SLH_DSA_HASH_CTX *ctx, const uint8_t *msg,

    const uint8_t *sk_seed, uint32_t node_id,

    const uint8_t *pk_seed, uint8_t *adrs, WPACKET *sig_wpkt)

{

    const SLH_DSA_KEY *key = ctx->key;

    SLH_ADRS_FUNC_DECLARE(key, adrsf);

    SLH_ADRS_DECLARE(tmp_adrs);

    size_t n = key->params->n;

    uint32_t h, hm = key->params->hm;

    uint32_t id = node_id;

    uint8_t *auth_path; /* Pointer to a buffer offset inside |sig_wpkt| */

    size_t auth_path_len = n;

    /*

     * This code reverses the order of the FIPS 205 code so that it does the

     * sign first. This simplifies the WPACKET writing.

     */

    adrsf->copy(tmp_adrs, adrs);

    adrsf->set_type_and_clear(adrs, SLH_ADRS_TYPE_WOTS_HASH);

    adrsf->set_keypair_address(adrs, node_id);

    if (!ossl_slh_wots_sign(ctx, msg, sk_seed, pk_seed, adrs, sig_wpkt))

        return 0;

    adrsf->copy(adrs, tmp_adrs);

    for (h = 0; h < hm; ++h) {

        if (!WPACKET_allocate_bytes(sig_wpkt, auth_path_len, &auth_path)

            || !ossl_slh_xmss_node(ctx, sk_seed, id ^ 1, h, pk_seed, adrs,

                auth_path, auth_path_len))

            return 0;

        id >>= 1;

    }

    return 1;

}

/**

 * @brief Compute a candidate XMSS public key from a message and XMSS signature

 * See FIPS 205 Section 6.3 Algorithm 11

 *

 * * The signature consists of:

 *  - A WOTS+ signature of size (2 * n + 3) * n

 *  - An array of authentication paths of size (XMSS tree height) * n.

 *

 * @param ctx Contains SLH_DSA algorithm functions and constants.

 * @param node_id Must be set to the |node_id| used in xmss_sign().

 * @param sig_rpkt A Packet to read a XMSS signature from.

 * @param msg A message of size |n| bytes

 * @param sk_seed A private key seed of size |n|

 * @param pk_seed A public key seed of size |n|

 * @param adrs An ADRS object containing a layer address and tree address of an

 *             XMSS key used for signing the message.

 * @param pk_out The returned candidate XMSS public key of size |n|.

 * @param pk_out_len The maximum size of |pk_out|.

 * @returns 1 on success, or 0 on error.

 */

int ossl_slh_xmss_pk_from_sig(SLH_DSA_HASH_CTX *ctx, uint32_t node_id,

    PACKET *sig_rpkt, const uint8_t *msg,

    const uint8_t *pk_seed, uint8_t *adrs,

    uint8_t *pk_out, size_t pk_out_len)

{

    const SLH_DSA_KEY *key = ctx->key;

    SLH_HASH_FUNC_DECLARE(key, hashf);

    SLH_ADRS_FUNC_DECLARE(key, adrsf);

    SLH_HASH_FN_DECLARE(hashf, H);

    SLH_ADRS_FN_DECLARE(adrsf, set_tree_index);

    SLH_ADRS_FN_DECLARE(adrsf, set_tree_height);

    uint32_t k;

    size_t n = key->params->n;

    uint32_t hm = key->params->hm;

    uint8_t *node = pk_out;

    const uint8_t *auth_path; /* Pointer to buffer offset in |pkt_sig| */

    adrsf->set_type_and_clear(adrs, SLH_ADRS_TYPE_WOTS_HASH);

    adrsf->set_keypair_address(adrs, node_id);

    if (!ossl_slh_wots_pk_from_sig(ctx, sig_rpkt, msg, pk_seed, adrs,

            node, pk_out_len))

        return 0;

    adrsf->set_type_and_clear(adrs, SLH_ADRS_TYPE_TREE);

    for (k = 0; k < hm; ++k) {

        if (!PACKET_get_bytes(sig_rpkt, &auth_path, n))

            return 0;

        set_tree_height(adrs, k + 1);

        if ((node_id & 1) == 0) { /* even */

            node_id >>= 1;

            set_tree_index(adrs, node_id);

            if (!H(ctx, pk_seed, adrs, node, auth_path, node, pk_out_len))

                return 0;

        } else { /* odd */

            node_id = (node_id - 1) >> 1;

            set_tree_index(adrs, node_id);

            if (!H(ctx, pk_seed, adrs, auth_path, node, node, pk_out_len))

                return 0;

        }

    }

    return 1;

}