xref: /openssh-portable/xmss_hash.c (revision cfc1897a)
1 /* $OpenBSD: xmss_hash.c,v 1.2 2018/02/26 03:56:44 dtucker Exp $ */
2 /*
3 hash.c version 20160722
4 Andreas Hülsing
5 Joost Rijneveld
6 Public domain.
7 */
8 
9 #include "includes.h"
10 #ifdef WITH_XMSS
11 
12 #include "xmss_hash_address.h"
13 #include "xmss_commons.h"
14 #include "xmss_hash.h"
15 
16 #include <stddef.h>
17 #ifdef HAVE_STDINT_H
18 # include <stdint.h>
19 #endif
20 #include <stdio.h>
21 #include <string.h>
22 #include <openssl/sha.h>
23 #include <openssl/hmac.h>
24 #include <openssl/evp.h>
25 
26 int core_hash_SHA2(unsigned char *, const unsigned int, const unsigned char *,
27     unsigned int, const unsigned char *, unsigned long long, unsigned int);
28 
addr_to_byte(unsigned char * bytes,const uint32_t addr[8])29 unsigned char* addr_to_byte(unsigned char *bytes, const uint32_t addr[8]){
30 #if IS_LITTLE_ENDIAN==1
31   int i = 0;
32   for(i=0;i<8;i++)
33     to_byte(bytes+i*4, addr[i],4);
34   return bytes;
35 #else
36   memcpy(bytes, addr, 32);
37   return bytes;
38 #endif
39 }
40 
core_hash_SHA2(unsigned char * out,const unsigned int type,const unsigned char * key,unsigned int keylen,const unsigned char * in,unsigned long long inlen,unsigned int n)41 int core_hash_SHA2(unsigned char *out, const unsigned int type, const unsigned char *key, unsigned int keylen, const unsigned char *in, unsigned long long inlen, unsigned int n){
42   unsigned long long i = 0;
43   unsigned char buf[inlen + n + keylen];
44 
45   // Input is (toByte(X, 32) || KEY || M)
46 
47   // set toByte
48   to_byte(buf, type, n);
49 
50   for (i=0; i < keylen; i++) {
51     buf[i+n] = key[i];
52   }
53 
54   for (i=0; i < inlen; i++) {
55     buf[keylen + n + i] = in[i];
56   }
57 
58   if (n == 32) {
59     SHA256(buf, inlen + keylen + n, out);
60     return 0;
61   }
62   else {
63     if (n == 64) {
64       SHA512(buf, inlen + keylen + n, out);
65       return 0;
66     }
67   }
68   return 1;
69 }
70 
71 /**
72  * Implements PRF
73  */
prf(unsigned char * out,const unsigned char * in,const unsigned char * key,unsigned int keylen)74 int prf(unsigned char *out, const unsigned char *in, const unsigned char *key, unsigned int keylen)
75 {
76   return core_hash_SHA2(out, 3, key, keylen, in, 32, keylen);
77 }
78 
79 /*
80  * Implemts H_msg
81  */
h_msg(unsigned char * out,const unsigned char * in,unsigned long long inlen,const unsigned char * key,const unsigned int keylen,const unsigned int n)82 int h_msg(unsigned char *out, const unsigned char *in, unsigned long long inlen, const unsigned char *key, const unsigned int keylen, const unsigned int n)
83 {
84   if (keylen != 3*n){
85     // H_msg takes 3n-bit keys, but n does not match the keylength of keylen
86     return -1;
87   }
88   return core_hash_SHA2(out, 2, key, keylen, in, inlen, n);
89 }
90 
91 /**
92  * We assume the left half is in in[0]...in[n-1]
93  */
hash_h(unsigned char * out,const unsigned char * in,const unsigned char * pub_seed,uint32_t addr[8],const unsigned int n)94 int hash_h(unsigned char *out, const unsigned char *in, const unsigned char *pub_seed, uint32_t addr[8], const unsigned int n)
95 {
96 
97   unsigned char buf[2*n];
98   unsigned char key[n];
99   unsigned char bitmask[2*n];
100   unsigned char byte_addr[32];
101   unsigned int i;
102 
103   setKeyAndMask(addr, 0);
104   addr_to_byte(byte_addr, addr);
105   prf(key, byte_addr, pub_seed, n);
106   // Use MSB order
107   setKeyAndMask(addr, 1);
108   addr_to_byte(byte_addr, addr);
109   prf(bitmask, byte_addr, pub_seed, n);
110   setKeyAndMask(addr, 2);
111   addr_to_byte(byte_addr, addr);
112   prf(bitmask+n, byte_addr, pub_seed, n);
113   for (i = 0; i < 2*n; i++) {
114     buf[i] = in[i] ^ bitmask[i];
115   }
116   return core_hash_SHA2(out, 1, key, n, buf, 2*n, n);
117 }
118 
hash_f(unsigned char * out,const unsigned char * in,const unsigned char * pub_seed,uint32_t addr[8],const unsigned int n)119 int hash_f(unsigned char *out, const unsigned char *in, const unsigned char *pub_seed, uint32_t addr[8], const unsigned int n)
120 {
121   unsigned char buf[n];
122   unsigned char key[n];
123   unsigned char bitmask[n];
124   unsigned char byte_addr[32];
125   unsigned int i;
126 
127   setKeyAndMask(addr, 0);
128   addr_to_byte(byte_addr, addr);
129   prf(key, byte_addr, pub_seed, n);
130 
131   setKeyAndMask(addr, 1);
132   addr_to_byte(byte_addr, addr);
133   prf(bitmask, byte_addr, pub_seed, n);
134 
135   for (i = 0; i < n; i++) {
136     buf[i] = in[i] ^ bitmask[i];
137   }
138   return core_hash_SHA2(out, 0, key, n, buf, n, n);
139 }
140 #endif /* WITH_XMSS */
141