• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  *  The LMS stateful-hash public-key signature scheme
3  *
4  *  Copyright The Mbed TLS Contributors
5  *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6  */
7 
8 /*
9  *  The following sources were referenced in the design of this implementation
10  *  of the LMS algorithm:
11  *
12  *  [1] IETF RFC8554
13  *      D. McGrew, M. Curcio, S.Fluhrer
14  *      https://datatracker.ietf.org/doc/html/rfc8554
15  *
16  *  [2] NIST Special Publication 800-208
17  *      David A. Cooper et. al.
18  *      https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-208.pdf
19  */
20 
21 #include "common.h"
22 
23 #if defined(MBEDTLS_LMS_C)
24 
25 #include <string.h>
26 
27 #include "lmots.h"
28 
29 #include "psa/crypto.h"
30 #include "psa_util_internal.h"
31 #include "mbedtls/lms.h"
32 #include "mbedtls/error.h"
33 #include "mbedtls/platform_util.h"
34 
35 #include "mbedtls/platform.h"
36 
37 /* Define a local translating function to save code size by not using too many
38  * arguments in each translating place. */
local_err_translation(psa_status_t status)39 static int local_err_translation(psa_status_t status)
40 {
41     return psa_status_to_mbedtls(status, psa_to_lms_errors,
42                                  ARRAY_LENGTH(psa_to_lms_errors),
43                                  psa_generic_status_to_mbedtls);
44 }
45 #define PSA_TO_MBEDTLS_ERR(status) local_err_translation(status)
46 
47 #define SIG_Q_LEAF_ID_OFFSET     (0)
48 #define SIG_OTS_SIG_OFFSET       (SIG_Q_LEAF_ID_OFFSET + \
49                                   MBEDTLS_LMOTS_Q_LEAF_ID_LEN)
50 #define SIG_TYPE_OFFSET(otstype) (SIG_OTS_SIG_OFFSET   + \
51                                   MBEDTLS_LMOTS_SIG_LEN(otstype))
52 #define SIG_PATH_OFFSET(otstype) (SIG_TYPE_OFFSET(otstype) + \
53                                   MBEDTLS_LMS_TYPE_LEN)
54 
55 #define PUBLIC_KEY_TYPE_OFFSET      (0)
56 #define PUBLIC_KEY_OTSTYPE_OFFSET   (PUBLIC_KEY_TYPE_OFFSET + \
57                                      MBEDTLS_LMS_TYPE_LEN)
58 #define PUBLIC_KEY_I_KEY_ID_OFFSET  (PUBLIC_KEY_OTSTYPE_OFFSET  + \
59                                      MBEDTLS_LMOTS_TYPE_LEN)
60 #define PUBLIC_KEY_ROOT_NODE_OFFSET (PUBLIC_KEY_I_KEY_ID_OFFSET + \
61                                      MBEDTLS_LMOTS_I_KEY_ID_LEN)
62 
63 
64 /* Currently only support H=10 */
65 #define H_TREE_HEIGHT_MAX                  10
66 #define MERKLE_TREE_NODE_AM(type)          ((size_t) 1 << (MBEDTLS_LMS_H_TREE_HEIGHT(type) + 1u))
67 #define MERKLE_TREE_LEAF_NODE_AM(type)     ((size_t) 1 << MBEDTLS_LMS_H_TREE_HEIGHT(type))
68 #define MERKLE_TREE_INTERNAL_NODE_AM(type) ((unsigned int) \
69                                             (1u << MBEDTLS_LMS_H_TREE_HEIGHT(type)))
70 
71 #define D_CONST_LEN           (2)
72 static const unsigned char D_LEAF_CONSTANT_BYTES[D_CONST_LEN] = { 0x82, 0x82 };
73 static const unsigned char D_INTR_CONSTANT_BYTES[D_CONST_LEN] = { 0x83, 0x83 };
74 
75 
76 /* Calculate the value of a leaf node of the Merkle tree (which is a hash of a
77  * public key and some other parameters like the leaf index). This function
78  * implements RFC8554 section 5.3, in the case where r >= 2^h.
79  *
80  *  params              The LMS parameter set, the underlying LMOTS
81  *                      parameter set, and I value which describe the key
82  *                      being used.
83  *
84  *  pub_key             The public key of the private whose index
85  *                      corresponds to the index of this leaf node. This
86  *                      is a hash output.
87  *
88  *  r_node_idx          The index of this node in the Merkle tree. Note
89  *                      that the root node of the Merkle tree is
90  *                      1-indexed.
91  *
92  *  out                 The output node value, which is a hash output.
93  */
create_merkle_leaf_value(const mbedtls_lms_parameters_t * params,unsigned char * pub_key,unsigned int r_node_idx,unsigned char * out)94 static int create_merkle_leaf_value(const mbedtls_lms_parameters_t *params,
95                                     unsigned char *pub_key,
96                                     unsigned int r_node_idx,
97                                     unsigned char *out)
98 {
99     psa_hash_operation_t op;
100     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
101     size_t output_hash_len;
102     unsigned char r_node_idx_bytes[4];
103 
104     /* Always zeroize the output buffer because it may contain data from the previous invocation */
105     memset(out, 0, MBEDTLS_LMS_M_NODE_BYTES(params->type));
106 
107     op = psa_hash_operation_init();
108     status = psa_hash_setup(&op, PSA_ALG_SHA_256);
109     if (status != PSA_SUCCESS) {
110         goto exit;
111     }
112 
113     status = psa_hash_update(&op, params->I_key_identifier,
114                              MBEDTLS_LMOTS_I_KEY_ID_LEN);
115     if (status != PSA_SUCCESS) {
116         goto exit;
117     }
118 
119     MBEDTLS_PUT_UINT32_BE(r_node_idx, r_node_idx_bytes, 0);
120     status = psa_hash_update(&op, r_node_idx_bytes, 4);
121     if (status != PSA_SUCCESS) {
122         goto exit;
123     }
124 
125     status = psa_hash_update(&op, D_LEAF_CONSTANT_BYTES, D_CONST_LEN);
126     if (status != PSA_SUCCESS) {
127         goto exit;
128     }
129 
130     status = psa_hash_update(&op, pub_key,
131                              MBEDTLS_LMOTS_N_HASH_LEN(params->otstype));
132     if (status != PSA_SUCCESS) {
133         goto exit;
134     }
135 
136     status = psa_hash_finish(&op, out, MBEDTLS_LMS_M_NODE_BYTES(params->type),
137                              &output_hash_len);
138     if (status != PSA_SUCCESS) {
139         goto exit;
140     }
141 
142 exit:
143     psa_hash_abort(&op);
144 
145     return PSA_TO_MBEDTLS_ERR(status);
146 }
147 
148 /* Calculate the value of an internal node of the Merkle tree (which is a hash
149  * of a public key and some other parameters like the node index). This function
150  * implements RFC8554 section 5.3, in the case where r < 2^h.
151  *
152  *  params              The LMS parameter set, the underlying LMOTS
153  *                      parameter set, and I value which describe the key
154  *                      being used.
155  *
156  *  left_node           The value of the child of this node which is on
157  *                      the left-hand side. As with all nodes on the
158  *                      Merkle tree, this is a hash output.
159  *
160  *  right_node          The value of the child of this node which is on
161  *                      the right-hand side. As with all nodes on the
162  *                      Merkle tree, this is a hash output.
163  *
164  *  r_node_idx          The index of this node in the Merkle tree. Note
165  *                      that the root node of the Merkle tree is
166  *                      1-indexed.
167  *
168  *  out                 The output node value, which is a hash output.
169  */
create_merkle_internal_value(const mbedtls_lms_parameters_t * params,const unsigned char * left_node,const unsigned char * right_node,unsigned int r_node_idx,unsigned char * out)170 static int create_merkle_internal_value(const mbedtls_lms_parameters_t *params,
171                                         const unsigned char *left_node,
172                                         const unsigned char *right_node,
173                                         unsigned int r_node_idx,
174                                         unsigned char *out)
175 {
176     psa_hash_operation_t op;
177     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
178     size_t output_hash_len;
179     unsigned char r_node_idx_bytes[4];
180 
181     op = psa_hash_operation_init();
182     status = psa_hash_setup(&op, PSA_ALG_SHA_256);
183     if (status != PSA_SUCCESS) {
184         goto exit;
185     }
186 
187     status = psa_hash_update(&op, params->I_key_identifier,
188                              MBEDTLS_LMOTS_I_KEY_ID_LEN);
189     if (status != PSA_SUCCESS) {
190         goto exit;
191     }
192 
193     MBEDTLS_PUT_UINT32_BE(r_node_idx, r_node_idx_bytes, 0);
194     status = psa_hash_update(&op, r_node_idx_bytes, 4);
195     if (status != PSA_SUCCESS) {
196         goto exit;
197     }
198 
199     status = psa_hash_update(&op, D_INTR_CONSTANT_BYTES, D_CONST_LEN);
200     if (status != PSA_SUCCESS) {
201         goto exit;
202     }
203 
204     status = psa_hash_update(&op, left_node,
205                              MBEDTLS_LMS_M_NODE_BYTES(params->type));
206     if (status != PSA_SUCCESS) {
207         goto exit;
208     }
209 
210     status = psa_hash_update(&op, right_node,
211                              MBEDTLS_LMS_M_NODE_BYTES(params->type));
212     if (status != PSA_SUCCESS) {
213         goto exit;
214     }
215 
216     status = psa_hash_finish(&op, out, MBEDTLS_LMS_M_NODE_BYTES(params->type),
217                              &output_hash_len);
218     if (status != PSA_SUCCESS) {
219         goto exit;
220     }
221 
222 exit:
223     psa_hash_abort(&op);
224 
225     return PSA_TO_MBEDTLS_ERR(status);
226 }
227 
mbedtls_lms_public_init(mbedtls_lms_public_t * ctx)228 void mbedtls_lms_public_init(mbedtls_lms_public_t *ctx)
229 {
230     memset(ctx, 0, sizeof(*ctx));
231 }
232 
mbedtls_lms_public_free(mbedtls_lms_public_t * ctx)233 void mbedtls_lms_public_free(mbedtls_lms_public_t *ctx)
234 {
235     mbedtls_platform_zeroize(ctx, sizeof(*ctx));
236 }
237 
mbedtls_lms_import_public_key(mbedtls_lms_public_t * ctx,const unsigned char * key,size_t key_size)238 int mbedtls_lms_import_public_key(mbedtls_lms_public_t *ctx,
239                                   const unsigned char *key, size_t key_size)
240 {
241     if (key_size < 4) {
242         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
243     }
244 
245     uint32_t type = MBEDTLS_GET_UINT32_BE(key, PUBLIC_KEY_TYPE_OFFSET);
246     if (type != (uint32_t) MBEDTLS_LMS_SHA256_M32_H10) {
247         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
248     }
249     ctx->params.type = (mbedtls_lms_algorithm_type_t) type;
250 
251     if (key_size != MBEDTLS_LMS_PUBLIC_KEY_LEN(ctx->params.type)) {
252         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
253     }
254 
255     uint32_t otstype = MBEDTLS_GET_UINT32_BE(key, PUBLIC_KEY_OTSTYPE_OFFSET);
256     if (otstype != (uint32_t) MBEDTLS_LMOTS_SHA256_N32_W8) {
257         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
258     }
259     ctx->params.otstype = (mbedtls_lmots_algorithm_type_t) otstype;
260 
261     memcpy(ctx->params.I_key_identifier,
262            key + PUBLIC_KEY_I_KEY_ID_OFFSET,
263            MBEDTLS_LMOTS_I_KEY_ID_LEN);
264     memcpy(ctx->T_1_pub_key, key + PUBLIC_KEY_ROOT_NODE_OFFSET,
265            MBEDTLS_LMS_M_NODE_BYTES(ctx->params.type));
266 
267     ctx->have_public_key = 1;
268 
269     return 0;
270 }
271 
mbedtls_lms_export_public_key(const mbedtls_lms_public_t * ctx,unsigned char * key,size_t key_size,size_t * key_len)272 int mbedtls_lms_export_public_key(const mbedtls_lms_public_t *ctx,
273                                   unsigned char *key,
274                                   size_t key_size, size_t *key_len)
275 {
276     if (key_size < MBEDTLS_LMS_PUBLIC_KEY_LEN(ctx->params.type)) {
277         return MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL;
278     }
279 
280     if (!ctx->have_public_key) {
281         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
282     }
283 
284     MBEDTLS_PUT_UINT32_BE(ctx->params.type, key, PUBLIC_KEY_TYPE_OFFSET);
285     MBEDTLS_PUT_UINT32_BE(ctx->params.otstype, key, PUBLIC_KEY_OTSTYPE_OFFSET);
286     memcpy(key + PUBLIC_KEY_I_KEY_ID_OFFSET,
287            ctx->params.I_key_identifier,
288            MBEDTLS_LMOTS_I_KEY_ID_LEN);
289     memcpy(key +PUBLIC_KEY_ROOT_NODE_OFFSET,
290            ctx->T_1_pub_key,
291            MBEDTLS_LMS_M_NODE_BYTES(ctx->params.type));
292 
293     if (key_len != NULL) {
294         *key_len = MBEDTLS_LMS_PUBLIC_KEY_LEN(ctx->params.type);
295     }
296 
297     return 0;
298 }
299 
mbedtls_lms_verify(const mbedtls_lms_public_t * ctx,const unsigned char * msg,size_t msg_size,const unsigned char * sig,size_t sig_size)300 int mbedtls_lms_verify(const mbedtls_lms_public_t *ctx,
301                        const unsigned char *msg, size_t msg_size,
302                        const unsigned char *sig, size_t sig_size)
303 {
304     unsigned int q_leaf_identifier;
305     unsigned char Kc_candidate_ots_pub_key[MBEDTLS_LMOTS_N_HASH_LEN_MAX];
306     unsigned char Tc_candidate_root_node[MBEDTLS_LMS_M_NODE_BYTES_MAX];
307     unsigned int height;
308     unsigned int curr_node_id;
309     unsigned int parent_node_id;
310     const unsigned char *left_node;
311     const unsigned char *right_node;
312     mbedtls_lmots_parameters_t ots_params;
313     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
314 
315     if (!ctx->have_public_key) {
316         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
317     }
318 
319     if (ctx->params.type
320         != MBEDTLS_LMS_SHA256_M32_H10) {
321         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
322     }
323 
324     if (ctx->params.otstype
325         != MBEDTLS_LMOTS_SHA256_N32_W8) {
326         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
327     }
328 
329     if (sig_size != MBEDTLS_LMS_SIG_LEN(ctx->params.type, ctx->params.otstype)) {
330         return MBEDTLS_ERR_LMS_VERIFY_FAILED;
331     }
332 
333     if (sig_size < SIG_OTS_SIG_OFFSET + MBEDTLS_LMOTS_TYPE_LEN) {
334         return MBEDTLS_ERR_LMS_VERIFY_FAILED;
335     }
336 
337     if (MBEDTLS_GET_UINT32_BE(sig, SIG_OTS_SIG_OFFSET + MBEDTLS_LMOTS_SIG_TYPE_OFFSET)
338         != MBEDTLS_LMOTS_SHA256_N32_W8) {
339         return MBEDTLS_ERR_LMS_VERIFY_FAILED;
340     }
341 
342     if (sig_size < SIG_TYPE_OFFSET(ctx->params.otstype) + MBEDTLS_LMS_TYPE_LEN) {
343         return MBEDTLS_ERR_LMS_VERIFY_FAILED;
344     }
345 
346     if (MBEDTLS_GET_UINT32_BE(sig, SIG_TYPE_OFFSET(ctx->params.otstype))
347         != MBEDTLS_LMS_SHA256_M32_H10) {
348         return MBEDTLS_ERR_LMS_VERIFY_FAILED;
349     }
350 
351 
352     q_leaf_identifier = MBEDTLS_GET_UINT32_BE(sig, SIG_Q_LEAF_ID_OFFSET);
353 
354     if (q_leaf_identifier >= MERKLE_TREE_LEAF_NODE_AM(ctx->params.type)) {
355         return MBEDTLS_ERR_LMS_VERIFY_FAILED;
356     }
357 
358     memcpy(ots_params.I_key_identifier,
359            ctx->params.I_key_identifier,
360            MBEDTLS_LMOTS_I_KEY_ID_LEN);
361     MBEDTLS_PUT_UINT32_BE(q_leaf_identifier, ots_params.q_leaf_identifier, 0);
362     ots_params.type = ctx->params.otstype;
363 
364     ret = mbedtls_lmots_calculate_public_key_candidate(&ots_params,
365                                                        msg,
366                                                        msg_size,
367                                                        sig + SIG_OTS_SIG_OFFSET,
368                                                        MBEDTLS_LMOTS_SIG_LEN(ctx->params.otstype),
369                                                        Kc_candidate_ots_pub_key,
370                                                        sizeof(Kc_candidate_ots_pub_key),
371                                                        NULL);
372     if (ret != 0) {
373         return MBEDTLS_ERR_LMS_VERIFY_FAILED;
374     }
375 
376     ret = create_merkle_leaf_value(
377         &ctx->params,
378         Kc_candidate_ots_pub_key,
379         MERKLE_TREE_INTERNAL_NODE_AM(ctx->params.type) + q_leaf_identifier,
380         Tc_candidate_root_node);
381 
382     if (ret != 0) {
383         return MBEDTLS_ERR_LMS_VERIFY_FAILED;
384     }
385 
386     curr_node_id = MERKLE_TREE_INTERNAL_NODE_AM(ctx->params.type) +
387                    q_leaf_identifier;
388 
389     for (height = 0; height < MBEDTLS_LMS_H_TREE_HEIGHT(ctx->params.type);
390          height++) {
391         parent_node_id = curr_node_id / 2;
392 
393         /* Left/right node ordering matters for the hash */
394         if (curr_node_id & 1) {
395             left_node = sig + SIG_PATH_OFFSET(ctx->params.otstype) +
396                         height * MBEDTLS_LMS_M_NODE_BYTES(ctx->params.type);
397             right_node = Tc_candidate_root_node;
398         } else {
399             left_node = Tc_candidate_root_node;
400             right_node = sig + SIG_PATH_OFFSET(ctx->params.otstype) +
401                          height * MBEDTLS_LMS_M_NODE_BYTES(ctx->params.type);
402         }
403 
404         ret = create_merkle_internal_value(&ctx->params, left_node, right_node,
405                                            parent_node_id, Tc_candidate_root_node);
406         if (ret != 0) {
407             return MBEDTLS_ERR_LMS_VERIFY_FAILED;
408         }
409         curr_node_id /= 2;
410     }
411 
412     if (memcmp(Tc_candidate_root_node, ctx->T_1_pub_key,
413                MBEDTLS_LMS_M_NODE_BYTES(ctx->params.type))) {
414         return MBEDTLS_ERR_LMS_VERIFY_FAILED;
415     }
416 
417     return 0;
418 }
419 
420 #if defined(MBEDTLS_LMS_PRIVATE)
421 
422 /* Calculate a full Merkle tree based on a private key. This function
423  * implements RFC8554 section 5.3, and is used to generate a public key (as the
424  * public key is the root node of the Merkle tree).
425  *
426  *  ctx                 The LMS private context, containing a parameter
427  *                      set and private key material consisting of both
428  *                      public and private OTS.
429  *
430  *  tree                The output tree, which is 2^(H + 1) hash outputs.
431  *                      In the case of H=10 we have 2048 tree nodes (of
432  *                      which 1024 of them are leaf nodes). Note that
433  *                      because the Merkle tree root is 1-indexed, the 0
434  *                      index tree node is never used.
435  */
calculate_merkle_tree(const mbedtls_lms_private_t * ctx,unsigned char * tree)436 static int calculate_merkle_tree(const mbedtls_lms_private_t *ctx,
437                                  unsigned char *tree)
438 {
439     unsigned int priv_key_idx;
440     unsigned int r_node_idx;
441     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
442 
443     /* First create the leaf nodes, in ascending order */
444     for (priv_key_idx = 0;
445          priv_key_idx < MERKLE_TREE_INTERNAL_NODE_AM(ctx->params.type);
446          priv_key_idx++) {
447         r_node_idx = MERKLE_TREE_INTERNAL_NODE_AM(ctx->params.type) + priv_key_idx;
448 
449         ret = create_merkle_leaf_value(&ctx->params,
450                                        ctx->ots_public_keys[priv_key_idx].public_key,
451                                        r_node_idx,
452                                        &tree[r_node_idx * MBEDTLS_LMS_M_NODE_BYTES(
453                                                  ctx->params.type)]);
454         if (ret != 0) {
455             return ret;
456         }
457     }
458 
459     /* Then the internal nodes, in reverse order so that we can guarantee the
460      * parent has been created */
461     for (r_node_idx = MERKLE_TREE_INTERNAL_NODE_AM(ctx->params.type) - 1;
462          r_node_idx > 0;
463          r_node_idx--) {
464         ret = create_merkle_internal_value(&ctx->params,
465                                            &tree[(r_node_idx * 2) *
466                                                  MBEDTLS_LMS_M_NODE_BYTES(ctx->params.type)],
467                                            &tree[(r_node_idx * 2 + 1) *
468                                                  MBEDTLS_LMS_M_NODE_BYTES(ctx->params.type)],
469                                            r_node_idx,
470                                            &tree[r_node_idx *
471                                                  MBEDTLS_LMS_M_NODE_BYTES(ctx->params.type)]);
472         if (ret != 0) {
473             return ret;
474         }
475     }
476 
477     return 0;
478 }
479 
480 /* Calculate a path from a leaf node of the Merkle tree to the root of the tree,
481  * and return the full path. This function implements RFC8554 section 5.4.1, as
482  * the Merkle path is the main component of an LMS signature.
483  *
484  *  ctx                 The LMS private context, containing a parameter
485  *                      set and private key material consisting of both
486  *                      public and private OTS.
487  *
488  *  leaf_node_id        Which leaf node to calculate the path from.
489  *
490  *  path                The output path, which is H hash outputs.
491  */
get_merkle_path(mbedtls_lms_private_t * ctx,unsigned int leaf_node_id,unsigned char * path)492 static int get_merkle_path(mbedtls_lms_private_t *ctx,
493                            unsigned int leaf_node_id,
494                            unsigned char *path)
495 {
496     const size_t node_bytes = MBEDTLS_LMS_M_NODE_BYTES(ctx->params.type);
497     unsigned int curr_node_id = leaf_node_id;
498     unsigned int adjacent_node_id;
499     unsigned char *tree = NULL;
500     unsigned int height;
501     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
502 
503     tree = mbedtls_calloc((size_t) MERKLE_TREE_NODE_AM(ctx->params.type),
504                           node_bytes);
505     if (tree == NULL) {
506         return MBEDTLS_ERR_LMS_ALLOC_FAILED;
507     }
508 
509     ret = calculate_merkle_tree(ctx, tree);
510     if (ret != 0) {
511         goto exit;
512     }
513 
514     for (height = 0; height < MBEDTLS_LMS_H_TREE_HEIGHT(ctx->params.type);
515          height++) {
516         adjacent_node_id = curr_node_id ^ 1;
517 
518         memcpy(&path[height * node_bytes],
519                &tree[adjacent_node_id * node_bytes], node_bytes);
520 
521         curr_node_id >>= 1;
522     }
523 
524     ret = 0;
525 
526 exit:
527     mbedtls_zeroize_and_free(tree, node_bytes *
528                              (size_t) MERKLE_TREE_NODE_AM(ctx->params.type));
529 
530     return ret;
531 }
532 
mbedtls_lms_private_init(mbedtls_lms_private_t * ctx)533 void mbedtls_lms_private_init(mbedtls_lms_private_t *ctx)
534 {
535     memset(ctx, 0, sizeof(*ctx));
536 }
537 
mbedtls_lms_private_free(mbedtls_lms_private_t * ctx)538 void mbedtls_lms_private_free(mbedtls_lms_private_t *ctx)
539 {
540     unsigned int idx;
541 
542     if (ctx->have_private_key) {
543         if (ctx->ots_private_keys != NULL) {
544             for (idx = 0; idx < MERKLE_TREE_LEAF_NODE_AM(ctx->params.type); idx++) {
545                 mbedtls_lmots_private_free(&ctx->ots_private_keys[idx]);
546             }
547         }
548 
549         if (ctx->ots_public_keys != NULL) {
550             for (idx = 0; idx < MERKLE_TREE_LEAF_NODE_AM(ctx->params.type); idx++) {
551                 mbedtls_lmots_public_free(&ctx->ots_public_keys[idx]);
552             }
553         }
554 
555         mbedtls_free(ctx->ots_private_keys);
556         mbedtls_free(ctx->ots_public_keys);
557     }
558 
559     mbedtls_platform_zeroize(ctx, sizeof(*ctx));
560 }
561 
562 
mbedtls_lms_generate_private_key(mbedtls_lms_private_t * ctx,mbedtls_lms_algorithm_type_t type,mbedtls_lmots_algorithm_type_t otstype,int (* f_rng)(void *,unsigned char *,size_t),void * p_rng,const unsigned char * seed,size_t seed_size)563 int mbedtls_lms_generate_private_key(mbedtls_lms_private_t *ctx,
564                                      mbedtls_lms_algorithm_type_t type,
565                                      mbedtls_lmots_algorithm_type_t otstype,
566                                      int (*f_rng)(void *, unsigned char *, size_t),
567                                      void *p_rng, const unsigned char *seed,
568                                      size_t seed_size)
569 {
570     unsigned int idx = 0;
571     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
572 
573     if (type != MBEDTLS_LMS_SHA256_M32_H10) {
574         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
575     }
576 
577     if (otstype != MBEDTLS_LMOTS_SHA256_N32_W8) {
578         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
579     }
580 
581     if (ctx->have_private_key) {
582         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
583     }
584 
585     ctx->params.type = type;
586     ctx->params.otstype = otstype;
587     ctx->have_private_key = 1;
588 
589     ret = f_rng(p_rng,
590                 ctx->params.I_key_identifier,
591                 MBEDTLS_LMOTS_I_KEY_ID_LEN);
592     if (ret != 0) {
593         goto exit;
594     }
595 
596     /* Requires a cast to size_t to avoid an implicit cast warning on certain
597      * platforms (particularly Windows) */
598     ctx->ots_private_keys = mbedtls_calloc((size_t) MERKLE_TREE_LEAF_NODE_AM(ctx->params.type),
599                                            sizeof(*ctx->ots_private_keys));
600     if (ctx->ots_private_keys == NULL) {
601         ret = MBEDTLS_ERR_LMS_ALLOC_FAILED;
602         goto exit;
603     }
604 
605     /* Requires a cast to size_t to avoid an implicit cast warning on certain
606      * platforms (particularly Windows) */
607     ctx->ots_public_keys = mbedtls_calloc((size_t) MERKLE_TREE_LEAF_NODE_AM(ctx->params.type),
608                                           sizeof(*ctx->ots_public_keys));
609     if (ctx->ots_public_keys == NULL) {
610         ret = MBEDTLS_ERR_LMS_ALLOC_FAILED;
611         goto exit;
612     }
613 
614     for (idx = 0; idx < MERKLE_TREE_LEAF_NODE_AM(ctx->params.type); idx++) {
615         mbedtls_lmots_private_init(&ctx->ots_private_keys[idx]);
616         mbedtls_lmots_public_init(&ctx->ots_public_keys[idx]);
617     }
618 
619 
620     for (idx = 0; idx < MERKLE_TREE_LEAF_NODE_AM(ctx->params.type); idx++) {
621         ret = mbedtls_lmots_generate_private_key(&ctx->ots_private_keys[idx],
622                                                  otstype,
623                                                  ctx->params.I_key_identifier,
624                                                  idx, seed, seed_size);
625         if (ret != 0) {
626             goto exit;
627         }
628 
629         ret = mbedtls_lmots_calculate_public_key(&ctx->ots_public_keys[idx],
630                                                  &ctx->ots_private_keys[idx]);
631         if (ret != 0) {
632             goto exit;
633         }
634     }
635 
636     ctx->q_next_usable_key = 0;
637 
638 exit:
639     if (ret != 0) {
640         mbedtls_lms_private_free(ctx);
641     }
642 
643     return ret;
644 }
645 
mbedtls_lms_calculate_public_key(mbedtls_lms_public_t * ctx,const mbedtls_lms_private_t * priv_ctx)646 int mbedtls_lms_calculate_public_key(mbedtls_lms_public_t *ctx,
647                                      const mbedtls_lms_private_t *priv_ctx)
648 {
649     const size_t node_bytes = MBEDTLS_LMS_M_NODE_BYTES(priv_ctx->params.type);
650     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
651     unsigned char *tree = NULL;
652 
653     if (!priv_ctx->have_private_key) {
654         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
655     }
656 
657     if (priv_ctx->params.type
658         != MBEDTLS_LMS_SHA256_M32_H10) {
659         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
660     }
661 
662     if (priv_ctx->params.otstype
663         != MBEDTLS_LMOTS_SHA256_N32_W8) {
664         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
665     }
666 
667     tree = mbedtls_calloc((size_t) MERKLE_TREE_NODE_AM(priv_ctx->params.type),
668                           node_bytes);
669     if (tree == NULL) {
670         return MBEDTLS_ERR_LMS_ALLOC_FAILED;
671     }
672 
673     memcpy(&ctx->params, &priv_ctx->params,
674            sizeof(mbedtls_lmots_parameters_t));
675 
676     ret = calculate_merkle_tree(priv_ctx, tree);
677     if (ret != 0) {
678         goto exit;
679     }
680 
681     /* Root node is always at position 1, due to 1-based indexing */
682     memcpy(ctx->T_1_pub_key, &tree[node_bytes], node_bytes);
683 
684     ctx->have_public_key = 1;
685 
686     ret = 0;
687 
688 exit:
689     mbedtls_zeroize_and_free(tree, node_bytes *
690                              (size_t) MERKLE_TREE_NODE_AM(priv_ctx->params.type));
691 
692     return ret;
693 }
694 
695 
mbedtls_lms_sign(mbedtls_lms_private_t * ctx,int (* f_rng)(void *,unsigned char *,size_t),void * p_rng,const unsigned char * msg,unsigned int msg_size,unsigned char * sig,size_t sig_size,size_t * sig_len)696 int mbedtls_lms_sign(mbedtls_lms_private_t *ctx,
697                      int (*f_rng)(void *, unsigned char *, size_t),
698                      void *p_rng, const unsigned char *msg,
699                      unsigned int msg_size, unsigned char *sig, size_t sig_size,
700                      size_t *sig_len)
701 {
702     uint32_t q_leaf_identifier;
703     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
704 
705     if (!ctx->have_private_key) {
706         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
707     }
708 
709     if (sig_size < MBEDTLS_LMS_SIG_LEN(ctx->params.type, ctx->params.otstype)) {
710         return MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL;
711     }
712 
713     if (ctx->params.type != MBEDTLS_LMS_SHA256_M32_H10) {
714         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
715     }
716 
717     if (ctx->params.otstype
718         != MBEDTLS_LMOTS_SHA256_N32_W8) {
719         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
720     }
721 
722     if (ctx->q_next_usable_key >= MERKLE_TREE_LEAF_NODE_AM(ctx->params.type)) {
723         return MBEDTLS_ERR_LMS_OUT_OF_PRIVATE_KEYS;
724     }
725 
726 
727     q_leaf_identifier = ctx->q_next_usable_key;
728     /* This new value must _always_ be written back to the disk before the
729      * signature is returned.
730      */
731     ctx->q_next_usable_key += 1;
732 
733     if (MBEDTLS_LMS_SIG_LEN(ctx->params.type, ctx->params.otstype)
734         < SIG_OTS_SIG_OFFSET) {
735         return MBEDTLS_ERR_LMS_BAD_INPUT_DATA;
736     }
737 
738     ret = mbedtls_lmots_sign(&ctx->ots_private_keys[q_leaf_identifier],
739                              f_rng,
740                              p_rng,
741                              msg,
742                              msg_size,
743                              sig + SIG_OTS_SIG_OFFSET,
744                              MBEDTLS_LMS_SIG_LEN(ctx->params.type,
745                                                  ctx->params.otstype) - SIG_OTS_SIG_OFFSET,
746                              NULL);
747     if (ret != 0) {
748         return ret;
749     }
750 
751     MBEDTLS_PUT_UINT32_BE(ctx->params.type, sig, SIG_TYPE_OFFSET(ctx->params.otstype));
752     MBEDTLS_PUT_UINT32_BE(q_leaf_identifier, sig, SIG_Q_LEAF_ID_OFFSET);
753 
754     ret = get_merkle_path(ctx,
755                           MERKLE_TREE_INTERNAL_NODE_AM(ctx->params.type) + q_leaf_identifier,
756                           sig + SIG_PATH_OFFSET(ctx->params.otstype));
757     if (ret != 0) {
758         return ret;
759     }
760 
761     if (sig_len != NULL) {
762         *sig_len = MBEDTLS_LMS_SIG_LEN(ctx->params.type, ctx->params.otstype);
763     }
764 
765 
766     return 0;
767 }
768 
769 #endif /* defined(MBEDTLS_LMS_PRIVATE) */
770 #endif /* defined(MBEDTLS_LMS_C) */
771