Al-Kindi-0
1 year ago
28 changed files with 2263 additions and 114 deletions
Split View
Diff Options
-
+6 -0.github/workflows/ci.yml
-
+3 -0.gitmodules
-
+8 -4Cargo.toml
-
+1 -0PQClean
-
+24 -0build.rs
-
+1 -0rustfmt.toml
-
+1 -0src/dsa/mod.rs
-
+55 -0src/dsa/rpo_falcon512/error.rs
-
+66 -0src/dsa/rpo_falcon512/falcon_c/api_rpo.h
-
+387 -0src/dsa/rpo_falcon512/falcon_c/falcon_rpo.c
-
+582 -0src/dsa/rpo_falcon512/falcon_c/rpo.c
-
+83 -0src/dsa/rpo_falcon512/falcon_c/rpo.h
-
+189 -0src/dsa/rpo_falcon512/ffi.rs
-
+227 -0src/dsa/rpo_falcon512/keys.rs
-
+60 -0src/dsa/rpo_falcon512/mod.rs
-
+277 -0src/dsa/rpo_falcon512/polynomial.rs
-
+262 -0src/dsa/rpo_falcon512/signature.rs
-
+1 -0src/lib.rs
-
+3 -15src/merkle/merkle_tree.rs
-
+2 -8src/merkle/mmr/full.rs
-
+1 -5src/merkle/mmr/tests.rs
-
+1 -5src/merkle/partial_mt/mod.rs
-
+2 -9src/merkle/path.rs
-
+1 -4src/merkle/simple_smt/mod.rs
-
+3 -15src/merkle/simple_smt/tests.rs
-
+15 -41src/merkle/store/mod.rs
-
+1 -4src/merkle/tiered_smt/values.rs
-
+1 -4src/utils/mod.rs
@ -0,0 +1,3 @@ |
|||
[submodule "PQClean"] |
|||
path = PQClean |
|||
url = https://github.com/PQClean/PQClean.git |
|||
@ -0,0 +1 @@ |
|||
pub mod rpo_falcon512;
|
|||
@ -0,0 +1,55 @@ |
|||
use super::{LOG_N, MODULUS, PK_LEN};
|
|||
use core::fmt;
|
|||
|
|||
#[derive(Clone, Debug, PartialEq, Eq)]
|
|||
pub enum FalconError {
|
|||
KeyGenerationFailed,
|
|||
PubKeyDecodingExtraData,
|
|||
PubKeyDecodingInvalidCoefficient(u32),
|
|||
PubKeyDecodingInvalidLength(usize),
|
|||
PubKeyDecodingInvalidTag(u8),
|
|||
SigDecodingTooBigHighBits(u32),
|
|||
SigDecodingInvalidRemainder,
|
|||
SigDecodingNonZeroUnusedBitsLastByte,
|
|||
SigDecodingMinusZero,
|
|||
SigDecodingIncorrectEncodingAlgorithm,
|
|||
SigDecodingNotSupportedDegree(u8),
|
|||
SigGenerationFailed,
|
|||
}
|
|||
|
|||
impl fmt::Display for FalconError {
|
|||
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
|
|||
use FalconError::*;
|
|||
match self {
|
|||
KeyGenerationFailed => write!(f, "Failed to generate a private-public key pair"),
|
|||
PubKeyDecodingExtraData => {
|
|||
write!(f, "Failed to decode public key: input not fully consumed")
|
|||
}
|
|||
PubKeyDecodingInvalidCoefficient(val) => {
|
|||
write!(f, "Failed to decode public key: coefficient {val} is greater than or equal to the field modulus {MODULUS}")
|
|||
}
|
|||
PubKeyDecodingInvalidLength(len) => {
|
|||
write!(f, "Failed to decode public key: expected {PK_LEN} bytes but received {len}")
|
|||
}
|
|||
PubKeyDecodingInvalidTag(byte) => {
|
|||
write!(f, "Failed to decode public key: expected the first byte to be {LOG_N} but was {byte}")
|
|||
}
|
|||
SigDecodingTooBigHighBits(m) => {
|
|||
write!(f, "Failed to decode signature: high bits {m} exceed 2048")
|
|||
}
|
|||
SigDecodingInvalidRemainder => {
|
|||
write!(f, "Failed to decode signature: incorrect remaining data")
|
|||
}
|
|||
SigDecodingNonZeroUnusedBitsLastByte => {
|
|||
write!(f, "Failed to decode signature: Non-zero unused bits in the last byte")
|
|||
}
|
|||
SigDecodingMinusZero => write!(f, "Failed to decode signature: -0 is forbidden"),
|
|||
SigDecodingIncorrectEncodingAlgorithm => write!(f, "Failed to decode signature: not supported encoding algorithm"),
|
|||
SigDecodingNotSupportedDegree(log_n) => write!(f, "Failed to decode signature: only supported irreducible polynomial degree is 512, 2^{log_n} was provided"),
|
|||
SigGenerationFailed => write!(f, "Failed to generate a signature"),
|
|||
}
|
|||
}
|
|||
}
|
|||
|
|||
#[cfg(feature = "std")]
|
|||
impl std::error::Error for FalconError {}
|
|||
@ -0,0 +1,66 @@ |
|||
#include <stddef.h> |
|||
#include <stdint.h> |
|||
|
|||
#define PQCLEAN_FALCON512_CLEAN_CRYPTO_SECRETKEYBYTES 1281 |
|||
#define PQCLEAN_FALCON512_CLEAN_CRYPTO_PUBLICKEYBYTES 897 |
|||
#define PQCLEAN_FALCON512_CLEAN_CRYPTO_BYTES 666 |
|||
|
|||
/* |
|||
* Generate a new key pair. Public key goes into pk[], private key in sk[]. |
|||
* Key sizes are exact (in bytes): |
|||
* public (pk): PQCLEAN_FALCON512_CLEAN_CRYPTO_PUBLICKEYBYTES |
|||
* private (sk): PQCLEAN_FALCON512_CLEAN_CRYPTO_SECRETKEYBYTES |
|||
* |
|||
* Return value: 0 on success, -1 on error. |
|||
* |
|||
* Note: This implementation follows the reference implementation in PQClean |
|||
* https://github.com/PQClean/PQClean/tree/master/crypto_sign/falcon-512 |
|||
* verbatim except for the sections that are marked otherwise. |
|||
*/ |
|||
int PQCLEAN_FALCON512_CLEAN_crypto_sign_keypair_rpo( |
|||
uint8_t *pk, uint8_t *sk); |
|||
|
|||
/* |
|||
* Generate a new key pair from seed. Public key goes into pk[], private key in sk[]. |
|||
* Key sizes are exact (in bytes): |
|||
* public (pk): PQCLEAN_FALCON512_CLEAN_CRYPTO_PUBLICKEYBYTES |
|||
* private (sk): PQCLEAN_FALCON512_CLEAN_CRYPTO_SECRETKEYBYTES |
|||
* |
|||
* Return value: 0 on success, -1 on error. |
|||
*/ |
|||
int PQCLEAN_FALCON512_CLEAN_crypto_sign_keypair_from_seed_rpo( |
|||
uint8_t *pk, uint8_t *sk, unsigned char *seed); |
|||
|
|||
/* |
|||
* Compute a signature on a provided message (m, mlen), with a given |
|||
* private key (sk). Signature is written in sig[], with length written |
|||
* into *siglen. Signature length is variable; maximum signature length |
|||
* (in bytes) is PQCLEAN_FALCON512_CLEAN_CRYPTO_BYTES. |
|||
* |
|||
* sig[], m[] and sk[] may overlap each other arbitrarily. |
|||
* |
|||
* Return value: 0 on success, -1 on error. |
|||
* |
|||
* Note: This implementation follows the reference implementation in PQClean |
|||
* https://github.com/PQClean/PQClean/tree/master/crypto_sign/falcon-512 |
|||
* verbatim except for the sections that are marked otherwise. |
|||
*/ |
|||
int PQCLEAN_FALCON512_CLEAN_crypto_sign_signature_rpo( |
|||
uint8_t *sig, size_t *siglen, |
|||
const uint8_t *m, size_t mlen, const uint8_t *sk); |
|||
|
|||
/* |
|||
* Verify a signature (sig, siglen) on a message (m, mlen) with a given |
|||
* public key (pk). |
|||
* |
|||
* sig[], m[] and pk[] may overlap each other arbitrarily. |
|||
* |
|||
* Return value: 0 on success, -1 on error. |
|||
* |
|||
* Note: This implementation follows the reference implementation in PQClean |
|||
* https://github.com/PQClean/PQClean/tree/master/crypto_sign/falcon-512 |
|||
* verbatim except for the sections that are marked otherwise. |
|||
*/ |
|||
int PQCLEAN_FALCON512_CLEAN_crypto_sign_verify_rpo( |
|||
const uint8_t *sig, size_t siglen, |
|||
const uint8_t *m, size_t mlen, const uint8_t *pk); |
|||
@ -0,0 +1,387 @@ |
|||
/* |
|||
* Wrapper for implementing the PQClean API. |
|||
*/ |
|||
|
|||
#include <string.h> |
|||
#include "randombytes.h" |
|||
#include "api_rpo.h" |
|||
#include "inner.h" |
|||
#include "rpo.h" |
|||
|
|||
#define NONCELEN 40 |
|||
|
|||
/* |
|||
* Encoding formats (nnnn = log of degree, 9 for Falcon-512, 10 for Falcon-1024) |
|||
* |
|||
* private key: |
|||
* header byte: 0101nnnn |
|||
* private f (6 or 5 bits by element, depending on degree) |
|||
* private g (6 or 5 bits by element, depending on degree) |
|||
* private F (8 bits by element) |
|||
* |
|||
* public key: |
|||
* header byte: 0000nnnn |
|||
* public h (14 bits by element) |
|||
* |
|||
* signature: |
|||
* header byte: 0011nnnn |
|||
* nonce 40 bytes |
|||
* value (12 bits by element) |
|||
* |
|||
* message + signature: |
|||
* signature length (2 bytes, big-endian) |
|||
* nonce 40 bytes |
|||
* message |
|||
* header byte: 0010nnnn |
|||
* value (12 bits by element) |
|||
* (signature length is 1+len(value), not counting the nonce) |
|||
*/ |
|||
|
|||
/* see api_rpo.h */ |
|||
int PQCLEAN_FALCON512_CLEAN_crypto_sign_keypair_from_seed_rpo( |
|||
uint8_t *pk, uint8_t *sk, unsigned char *seed) |
|||
{ |
|||
union |
|||
{ |
|||
uint8_t b[FALCON_KEYGEN_TEMP_9]; |
|||
uint64_t dummy_u64; |
|||
fpr dummy_fpr; |
|||
} tmp; |
|||
int8_t f[512], g[512], F[512]; |
|||
uint16_t h[512]; |
|||
inner_shake256_context rng; |
|||
size_t u, v; |
|||
|
|||
/* |
|||
* Generate key pair. |
|||
*/ |
|||
inner_shake256_init(&rng); |
|||
inner_shake256_inject(&rng, seed, sizeof seed); |
|||
inner_shake256_flip(&rng); |
|||
PQCLEAN_FALCON512_CLEAN_keygen(&rng, f, g, F, NULL, h, 9, tmp.b); |
|||
inner_shake256_ctx_release(&rng); |
|||
|
|||
/* |
|||
* Encode private key. |
|||
*/ |
|||
sk[0] = 0x50 + 9; |
|||
u = 1; |
|||
v = PQCLEAN_FALCON512_CLEAN_trim_i8_encode( |
|||
sk + u, PQCLEAN_FALCON512_CLEAN_CRYPTO_SECRETKEYBYTES - u, |
|||
f, 9, PQCLEAN_FALCON512_CLEAN_max_fg_bits[9]); |
|||
if (v == 0) |
|||
{ |
|||
return -1; |
|||
} |
|||
u += v; |
|||
v = PQCLEAN_FALCON512_CLEAN_trim_i8_encode( |
|||
sk + u, PQCLEAN_FALCON512_CLEAN_CRYPTO_SECRETKEYBYTES - u, |
|||
g, 9, PQCLEAN_FALCON512_CLEAN_max_fg_bits[9]); |
|||
if (v == 0) |
|||
{ |
|||
return -1; |
|||
} |
|||
u += v; |
|||
v = PQCLEAN_FALCON512_CLEAN_trim_i8_encode( |
|||
sk + u, PQCLEAN_FALCON512_CLEAN_CRYPTO_SECRETKEYBYTES - u, |
|||
F, 9, PQCLEAN_FALCON512_CLEAN_max_FG_bits[9]); |
|||
if (v == 0) |
|||
{ |
|||
return -1; |
|||
} |
|||
u += v; |
|||
if (u != PQCLEAN_FALCON512_CLEAN_CRYPTO_SECRETKEYBYTES) |
|||
{ |
|||
return -1; |
|||
} |
|||
|
|||
/* |
|||
* Encode public key. |
|||
*/ |
|||
pk[0] = 0x00 + 9; |
|||
v = PQCLEAN_FALCON512_CLEAN_modq_encode( |
|||
pk + 1, PQCLEAN_FALCON512_CLEAN_CRYPTO_PUBLICKEYBYTES - 1, |
|||
h, 9); |
|||
if (v != PQCLEAN_FALCON512_CLEAN_CRYPTO_PUBLICKEYBYTES - 1) |
|||
{ |
|||
return -1; |
|||
} |
|||
|
|||
return 0; |
|||
} |
|||
|
|||
int PQCLEAN_FALCON512_CLEAN_crypto_sign_keypair_rpo( |
|||
uint8_t *pk, uint8_t *sk) |
|||
{ |
|||
unsigned char seed[48]; |
|||
|
|||
/* |
|||
* Generate a random seed. |
|||
*/ |
|||
randombytes(seed, sizeof seed); |
|||
|
|||
return PQCLEAN_FALCON512_CLEAN_crypto_sign_keypair_from_seed_rpo(pk, sk, seed); |
|||
} |
|||
|
|||
/* |
|||
* Compute the signature. nonce[] receives the nonce and must have length |
|||
* NONCELEN bytes. sigbuf[] receives the signature value (without nonce |
|||
* or header byte), with *sigbuflen providing the maximum value length and |
|||
* receiving the actual value length. |
|||
* |
|||
* If a signature could be computed but not encoded because it would |
|||
* exceed the output buffer size, then a new signature is computed. If |
|||
* the provided buffer size is too low, this could loop indefinitely, so |
|||
* the caller must provide a size that can accommodate signatures with a |
|||
* large enough probability. |
|||
* |
|||
* Return value: 0 on success, -1 on error. |
|||
*/ |
|||
static int |
|||
do_sign(uint8_t *nonce, uint8_t *sigbuf, size_t *sigbuflen, |
|||
const uint8_t *m, size_t mlen, const uint8_t *sk) |
|||
{ |
|||
union |
|||
{ |
|||
uint8_t b[72 * 512]; |
|||
uint64_t dummy_u64; |
|||
fpr dummy_fpr; |
|||
} tmp; |
|||
int8_t f[512], g[512], F[512], G[512]; |
|||
struct |
|||
{ |
|||
int16_t sig[512]; |
|||
uint16_t hm[512]; |
|||
} r; |
|||
unsigned char seed[48]; |
|||
inner_shake256_context sc; |
|||
rpo128_context rc; |
|||
size_t u, v; |
|||
|
|||
/* |
|||
* Decode the private key. |
|||
*/ |
|||
if (sk[0] != 0x50 + 9) |
|||
{ |
|||
return -1; |
|||
} |
|||
u = 1; |
|||
v = PQCLEAN_FALCON512_CLEAN_trim_i8_decode( |
|||
f, 9, PQCLEAN_FALCON512_CLEAN_max_fg_bits[9], |
|||
sk + u, PQCLEAN_FALCON512_CLEAN_CRYPTO_SECRETKEYBYTES - u); |
|||
if (v == 0) |
|||
{ |
|||
return -1; |
|||
} |
|||
u += v; |
|||
v = PQCLEAN_FALCON512_CLEAN_trim_i8_decode( |
|||
g, 9, PQCLEAN_FALCON512_CLEAN_max_fg_bits[9], |
|||
sk + u, PQCLEAN_FALCON512_CLEAN_CRYPTO_SECRETKEYBYTES - u); |
|||
if (v == 0) |
|||
{ |
|||
return -1; |
|||
} |
|||
u += v; |
|||
v = PQCLEAN_FALCON512_CLEAN_trim_i8_decode( |
|||
F, 9, PQCLEAN_FALCON512_CLEAN_max_FG_bits[9], |
|||
sk + u, PQCLEAN_FALCON512_CLEAN_CRYPTO_SECRETKEYBYTES - u); |
|||
if (v == 0) |
|||
{ |
|||
return -1; |
|||
} |
|||
u += v; |
|||
if (u != PQCLEAN_FALCON512_CLEAN_CRYPTO_SECRETKEYBYTES) |
|||
{ |
|||
return -1; |
|||
} |
|||
if (!PQCLEAN_FALCON512_CLEAN_complete_private(G, f, g, F, 9, tmp.b)) |
|||
{ |
|||
return -1; |
|||
} |
|||
|
|||
/* |
|||
* Create a random nonce (40 bytes). |
|||
*/ |
|||
randombytes(nonce, NONCELEN); |
|||
|
|||
/* ==== Start: Deviation from the reference implementation ================================= */ |
|||
|
|||
// Transform the nonce into 8 chunks each of size 5 bytes. We do this in order to be sure that |
|||
// the conversion to field elements succeeds |
|||
uint8_t buffer[64]; |
|||
memset(buffer, 0, 64); |
|||
for (size_t i = 0; i < 8; i++) |
|||
{ |
|||
buffer[8 * i] = nonce[5 * i]; |
|||
buffer[8 * i + 1] = nonce[5 * i + 1]; |
|||
buffer[8 * i + 2] = nonce[5 * i + 2]; |
|||
buffer[8 * i + 3] = nonce[5 * i + 3]; |
|||
buffer[8 * i + 4] = nonce[5 * i + 4]; |
|||
} |
|||
|
|||
/* |
|||
* Hash message nonce + message into a vector. |
|||
*/ |
|||
rpo128_init(&rc); |
|||
rpo128_absorb(&rc, buffer, NONCELEN + 24); |
|||
rpo128_absorb(&rc, m, mlen); |
|||
rpo128_finalize(&rc); |
|||
PQCLEAN_FALCON512_CLEAN_hash_to_point_rpo(&rc, r.hm, 9); |
|||
rpo128_release(&rc); |
|||
|
|||
/* ==== End: Deviation from the reference implementation =================================== */ |
|||
|
|||
/* |
|||
* Initialize a RNG. |
|||
*/ |
|||
randombytes(seed, sizeof seed); |
|||
inner_shake256_init(&sc); |
|||
inner_shake256_inject(&sc, seed, sizeof seed); |
|||
inner_shake256_flip(&sc); |
|||
|
|||
/* |
|||
* Compute and return the signature. This loops until a signature |
|||
* value is found that fits in the provided buffer. |
|||
*/ |
|||
for (;;) |
|||
{ |
|||
PQCLEAN_FALCON512_CLEAN_sign_dyn(r.sig, &sc, f, g, F, G, r.hm, 9, tmp.b); |
|||
v = PQCLEAN_FALCON512_CLEAN_comp_encode(sigbuf, *sigbuflen, r.sig, 9); |
|||
if (v != 0) |
|||
{ |
|||
inner_shake256_ctx_release(&sc); |
|||
*sigbuflen = v; |
|||
return 0; |
|||
} |
|||
} |
|||
} |
|||
|
|||
/* |
|||
* Verify a signature. The nonce has size NONCELEN bytes. sigbuf[] |
|||
* (of size sigbuflen) contains the signature value, not including the |
|||
* header byte or nonce. Return value is 0 on success, -1 on error. |
|||
*/ |
|||
static int |
|||
do_verify( |
|||
const uint8_t *nonce, const uint8_t *sigbuf, size_t sigbuflen, |
|||
const uint8_t *m, size_t mlen, const uint8_t *pk) |
|||
{ |
|||
union |
|||
{ |
|||
uint8_t b[2 * 512]; |
|||
uint64_t dummy_u64; |
|||
fpr dummy_fpr; |
|||
} tmp; |
|||
uint16_t h[512], hm[512]; |
|||
int16_t sig[512]; |
|||
rpo128_context rc; |
|||
|
|||
/* |
|||
* Decode public key. |
|||
*/ |
|||
if (pk[0] != 0x00 + 9) |
|||
{ |
|||
return -1; |
|||
} |
|||
if (PQCLEAN_FALCON512_CLEAN_modq_decode(h, 9, |
|||
pk + 1, PQCLEAN_FALCON512_CLEAN_CRYPTO_PUBLICKEYBYTES - 1) |
|||
!= PQCLEAN_FALCON512_CLEAN_CRYPTO_PUBLICKEYBYTES - 1) |
|||
{ |
|||
return -1; |
|||
} |
|||
PQCLEAN_FALCON512_CLEAN_to_ntt_monty(h, 9); |
|||
|
|||
/* |
|||
* Decode signature. |
|||
*/ |
|||
if (sigbuflen == 0) |
|||
{ |
|||
return -1; |
|||
} |
|||
if (PQCLEAN_FALCON512_CLEAN_comp_decode(sig, 9, sigbuf, sigbuflen) != sigbuflen) |
|||
{ |
|||
return -1; |
|||
} |
|||
|
|||
/* ==== Start: Deviation from the reference implementation ================================= */ |
|||
|
|||
/* |
|||
* Hash nonce + message into a vector. |
|||
*/ |
|||
|
|||
// Transform the nonce into 8 chunks each of size 5 bytes. We do this in order to be sure that |
|||
// the conversion to field elements succeeds |
|||
uint8_t buffer[64]; |
|||
memset(buffer, 0, 64); |
|||
for (size_t i = 0; i < 8; i++) |
|||
{ |
|||
buffer[8 * i] = nonce[5 * i]; |
|||
buffer[8 * i + 1] = nonce[5 * i + 1]; |
|||
buffer[8 * i + 2] = nonce[5 * i + 2]; |
|||
buffer[8 * i + 3] = nonce[5 * i + 3]; |
|||
buffer[8 * i + 4] = nonce[5 * i + 4]; |
|||
} |
|||
|
|||
rpo128_init(&rc); |
|||
rpo128_absorb(&rc, buffer, NONCELEN + 24); |
|||
rpo128_absorb(&rc, m, mlen); |
|||
rpo128_finalize(&rc); |
|||
PQCLEAN_FALCON512_CLEAN_hash_to_point_rpo(&rc, hm, 9); |
|||
rpo128_release(&rc); |
|||
|
|||
/* === End: Deviation from the reference implementation ==================================== */ |
|||
|
|||
/* |
|||
* Verify signature. |
|||
*/ |
|||
if (!PQCLEAN_FALCON512_CLEAN_verify_raw(hm, sig, h, 9, tmp.b)) |
|||
{ |
|||
return -1; |
|||
} |
|||
return 0; |
|||
} |
|||
|
|||
/* see api_rpo.h */ |
|||
int PQCLEAN_FALCON512_CLEAN_crypto_sign_signature_rpo( |
|||
uint8_t *sig, size_t *siglen, |
|||
const uint8_t *m, size_t mlen, const uint8_t *sk) |
|||
{ |
|||
/* |
|||
* The PQCLEAN_FALCON512_CLEAN_CRYPTO_BYTES constant is used for |
|||
* the signed message object (as produced by crypto_sign()) |
|||
* and includes a two-byte length value, so we take care here |
|||
* to only generate signatures that are two bytes shorter than |
|||
* the maximum. This is done to ensure that crypto_sign() |
|||
* and crypto_sign_signature() produce the exact same signature |
|||
* value, if used on the same message, with the same private key, |
|||
* and using the same output from randombytes() (this is for |
|||
* reproducibility of tests). |
|||
*/ |
|||
size_t vlen; |
|||
|
|||
vlen = PQCLEAN_FALCON512_CLEAN_CRYPTO_BYTES - NONCELEN - 3; |
|||
if (do_sign(sig + 1, sig + 1 + NONCELEN, &vlen, m, mlen, sk) < 0) |
|||
{ |
|||
return -1; |
|||
} |
|||
sig[0] = 0x30 + 9; |
|||
*siglen = 1 + NONCELEN + vlen; |
|||
return 0; |
|||
} |
|||
|
|||
/* see api_rpo.h */ |
|||
int PQCLEAN_FALCON512_CLEAN_crypto_sign_verify_rpo( |
|||
const uint8_t *sig, size_t siglen, |
|||
const uint8_t *m, size_t mlen, const uint8_t *pk) |
|||
{ |
|||
if (siglen < 1 + NONCELEN) |
|||
{ |
|||
return -1; |
|||
} |
|||
if (sig[0] != 0x30 + 9) |
|||
{ |
|||
return -1; |
|||
} |
|||
return do_verify(sig + 1, |
|||
sig + 1 + NONCELEN, siglen - 1 - NONCELEN, m, mlen, pk); |
|||
} |
|||
@ -0,0 +1,582 @@ |
|||
/* |
|||
* RPO implementation. |
|||
*/ |
|||
|
|||
#include <stdint.h> |
|||
#include <string.h> |
|||
#include <stdlib.h> |
|||
|
|||
/* ================================================================================================ |
|||
* Modular Arithmetic |
|||
*/ |
|||
|
|||
#define P 0xFFFFFFFF00000001 |
|||
#define M 12289 |
|||
|
|||
// From https://github.com/ncw/iprime/blob/master/mod_math_noasm.go |
|||
uint64_t add_mod_p(uint64_t a, uint64_t b) |
|||
{ |
|||
a = P - a; |
|||
uint64_t res = b - a; |
|||
if (b < a) |
|||
res += P; |
|||
return res; |
|||
} |
|||
|
|||
uint64_t sub_mod_p(uint64_t a, uint64_t b) |
|||
{ |
|||
uint64_t r = a - b; |
|||
if (a < b) |
|||
r += P; |
|||
return r; |
|||
} |
|||
|
|||
uint64_t reduce_mod_p(uint64_t b, uint64_t a) |
|||
{ |
|||
uint32_t d = b >> 32, |
|||
c = b; |
|||
if (a >= P) |
|||
a -= P; |
|||
a = sub_mod_p(a, c); |
|||
a = sub_mod_p(a, d); |
|||
a = add_mod_p(a, ((uint64_t)c) << 32); |
|||
return a; |
|||
} |
|||
|
|||
uint64_t mult_mod_p(uint64_t x, uint64_t y) |
|||
{ |
|||
uint32_t a = x, |
|||
b = x >> 32, |
|||
c = y, |
|||
d = y >> 32; |
|||
|
|||
/* first synthesize the product using 32*32 -> 64 bit multiplies */ |
|||
x = b * (uint64_t)c; /* b*c */ |
|||
y = a * (uint64_t)d; /* a*d */ |
|||
uint64_t e = a * (uint64_t)c, /* a*c */ |
|||
f = b * (uint64_t)d, /* b*d */ |
|||
t; |
|||
|
|||
x += y; /* b*c + a*d */ |
|||
/* carry? */ |
|||
if (x < y) |
|||
f += 1LL << 32; /* carry into upper 32 bits - can't overflow */ |
|||
|
|||
t = x << 32; |
|||
e += t; /* a*c + LSW(b*c + a*d) */ |
|||
/* carry? */ |
|||
if (e < t) |
|||
f += 1; /* carry into upper 64 bits - can't overflow*/ |
|||
t = x >> 32; |
|||
f += t; /* b*d + MSW(b*c + a*d) */ |
|||
/* can't overflow */ |
|||
|
|||
/* now reduce: (b*d + MSW(b*c + a*d), a*c + LSW(b*c + a*d)) */ |
|||
return reduce_mod_p(f, e); |
|||
} |
|||
|
|||
/* ================================================================================================ |
|||
* RPO128 Permutation |
|||
*/ |
|||
|
|||
static const uint64_t STATE_WIDTH = 12; |
|||
static const uint64_t NUM_ROUNDS = 7; |
|||
|
|||
/* |
|||
* MDS matrix |
|||
*/ |
|||
const uint64_t MDS[12][12] = { |
|||
{ 7, 23, 8, 26, 13, 10, 9, 7, 6, 22, 21, 8 }, |
|||
{ 8, 7, 23, 8, 26, 13, 10, 9, 7, 6, 22, 21 }, |
|||
{ 21, 8, 7, 23, 8, 26, 13, 10, 9, 7, 6, 22 }, |
|||
{ 22, 21, 8, 7, 23, 8, 26, 13, 10, 9, 7, 6 }, |
|||
{ 6, 22, 21, 8, 7, 23, 8, 26, 13, 10, 9, 7 }, |
|||
{ 7, 6, 22, 21, 8, 7, 23, 8, 26, 13, 10, 9 }, |
|||
{ 9, 7, 6, 22, 21, 8, 7, 23, 8, 26, 13, 10 }, |
|||
{ 10, 9, 7, 6, 22, 21, 8, 7, 23, 8, 26, 13 }, |
|||
{ 13, 10, 9, 7, 6, 22, 21, 8, 7, 23, 8, 26 }, |
|||
{ 26, 13, 10, 9, 7, 6, 22, 21, 8, 7, 23, 8 }, |
|||
{ 8, 26, 13, 10, 9, 7, 6, 22, 21, 8, 7, 23 }, |
|||
{ 23, 8, 26, 13, 10, 9, 7, 6, 22, 21, 8, 7 }, |
|||
}; |
|||
|
|||
/* |
|||
* Round constants. |
|||
*/ |
|||
const uint64_t ARK1[7][12] = { |
|||
{ |
|||
5789762306288267392ULL, |
|||
6522564764413701783ULL, |
|||
17809893479458208203ULL, |
|||
107145243989736508ULL, |
|||
6388978042437517382ULL, |
|||
15844067734406016715ULL, |
|||
9975000513555218239ULL, |
|||
3344984123768313364ULL, |
|||
9959189626657347191ULL, |
|||
12960773468763563665ULL, |
|||
9602914297752488475ULL, |
|||
16657542370200465908ULL, |
|||
}, |
|||
{ |
|||
12987190162843096997ULL, |
|||
653957632802705281ULL, |
|||
4441654670647621225ULL, |
|||
4038207883745915761ULL, |
|||
5613464648874830118ULL, |
|||
13222989726778338773ULL, |
|||
3037761201230264149ULL, |
|||
16683759727265180203ULL, |
|||
8337364536491240715ULL, |
|||
3227397518293416448ULL, |
|||
8110510111539674682ULL, |
|||
2872078294163232137ULL, |
|||
}, |
|||
{ |
|||
18072785500942327487ULL, |
|||
6200974112677013481ULL, |
|||
17682092219085884187ULL, |
|||
10599526828986756440ULL, |
|||
975003873302957338ULL, |
|||
8264241093196931281ULL, |
|||
10065763900435475170ULL, |
|||
2181131744534710197ULL, |
|||
6317303992309418647ULL, |
|||
1401440938888741532ULL, |
|||
8884468225181997494ULL, |
|||
13066900325715521532ULL, |
|||
}, |
|||
{ |
|||
5674685213610121970ULL, |
|||
5759084860419474071ULL, |
|||
13943282657648897737ULL, |
|||
1352748651966375394ULL, |
|||
17110913224029905221ULL, |
|||
1003883795902368422ULL, |
|||
4141870621881018291ULL, |
|||
8121410972417424656ULL, |
|||
14300518605864919529ULL, |
|||
13712227150607670181ULL, |
|||
17021852944633065291ULL, |
|||
6252096473787587650ULL, |
|||
}, |
|||
{ |
|||
4887609836208846458ULL, |
|||
3027115137917284492ULL, |
|||
9595098600469470675ULL, |
|||
10528569829048484079ULL, |
|||
7864689113198939815ULL, |
|||
17533723827845969040ULL, |
|||
5781638039037710951ULL, |
|||
17024078752430719006ULL, |
|||
109659393484013511ULL, |
|||
7158933660534805869ULL, |
|||
2955076958026921730ULL, |
|||
7433723648458773977ULL, |
|||
}, |
|||
{ |
|||
16308865189192447297ULL, |
|||
11977192855656444890ULL, |
|||
12532242556065780287ULL, |
|||
14594890931430968898ULL, |
|||
7291784239689209784ULL, |
|||
5514718540551361949ULL, |
|||
10025733853830934803ULL, |
|||
7293794580341021693ULL, |
|||
6728552937464861756ULL, |
|||
6332385040983343262ULL, |
|||
13277683694236792804ULL, |
|||
2600778905124452676ULL, |
|||
}, |
|||
{ |
|||
7123075680859040534ULL, |
|||
1034205548717903090ULL, |
|||
7717824418247931797ULL, |
|||
3019070937878604058ULL, |
|||
11403792746066867460ULL, |
|||
10280580802233112374ULL, |
|||
337153209462421218ULL, |
|||
13333398568519923717ULL, |
|||
3596153696935337464ULL, |
|||
8104208463525993784ULL, |
|||
14345062289456085693ULL, |
|||
17036731477169661256ULL, |
|||
}}; |
|||
|
|||
const uint64_t ARK2[7][12] = { |
|||
{ |
|||
6077062762357204287ULL, |
|||
15277620170502011191ULL, |
|||
5358738125714196705ULL, |
|||
14233283787297595718ULL, |
|||
13792579614346651365ULL, |
|||
11614812331536767105ULL, |
|||
14871063686742261166ULL, |
|||
10148237148793043499ULL, |
|||
4457428952329675767ULL, |
|||
15590786458219172475ULL, |
|||
10063319113072092615ULL, |
|||
14200078843431360086ULL, |
|||
}, |
|||
{ |
|||
6202948458916099932ULL, |
|||
17690140365333231091ULL, |
|||
3595001575307484651ULL, |
|||
373995945117666487ULL, |
|||
1235734395091296013ULL, |
|||
14172757457833931602ULL, |
|||
707573103686350224ULL, |
|||
15453217512188187135ULL, |
|||
219777875004506018ULL, |
|||
17876696346199469008ULL, |
|||
17731621626449383378ULL, |
|||
2897136237748376248ULL, |
|||
}, |
|||
{ |
|||
8023374565629191455ULL, |
|||
15013690343205953430ULL, |
|||
4485500052507912973ULL, |
|||
12489737547229155153ULL, |
|||
9500452585969030576ULL, |
|||
2054001340201038870ULL, |
|||
12420704059284934186ULL, |
|||
355990932618543755ULL, |
|||
9071225051243523860ULL, |
|||
12766199826003448536ULL, |
|||
9045979173463556963ULL, |
|||
12934431667190679898ULL, |
|||
}, |
|||
{ |
|||
18389244934624494276ULL, |
|||
16731736864863925227ULL, |
|||
4440209734760478192ULL, |
|||
17208448209698888938ULL, |
|||
8739495587021565984ULL, |
|||
17000774922218161967ULL, |
|||
13533282547195532087ULL, |
|||
525402848358706231ULL, |
|||
16987541523062161972ULL, |
|||
5466806524462797102ULL, |
|||
14512769585918244983ULL, |
|||
10973956031244051118ULL, |
|||
}, |
|||
{ |
|||
6982293561042362913ULL, |
|||
14065426295947720331ULL, |
|||
16451845770444974180ULL, |
|||
7139138592091306727ULL, |
|||
9012006439959783127ULL, |
|||
14619614108529063361ULL, |
|||
1394813199588124371ULL, |
|||
4635111139507788575ULL, |
|||
16217473952264203365ULL, |
|||
10782018226466330683ULL, |
|||
6844229992533662050ULL, |
|||
7446486531695178711ULL, |
|||
}, |
|||
{ |
|||
3736792340494631448ULL, |
|||
577852220195055341ULL, |
|||
6689998335515779805ULL, |
|||
13886063479078013492ULL, |
|||
14358505101923202168ULL, |
|||
7744142531772274164ULL, |
|||
16135070735728404443ULL, |
|||
12290902521256031137ULL, |
|||
12059913662657709804ULL, |
|||
16456018495793751911ULL, |
|||
4571485474751953524ULL, |
|||
17200392109565783176ULL, |
|||
}, |
|||
{ |
|||
17130398059294018733ULL, |
|||
519782857322261988ULL, |
|||
9625384390925085478ULL, |
|||
1664893052631119222ULL, |
|||
7629576092524553570ULL, |
|||
3485239601103661425ULL, |
|||
9755891797164033838ULL, |
|||
15218148195153269027ULL, |
|||
16460604813734957368ULL, |
|||
9643968136937729763ULL, |
|||
3611348709641382851ULL, |
|||
18256379591337759196ULL, |
|||
}, |
|||
}; |
|||
|
|||
void apply_sbox(uint64_t *const state) |
|||
{ |
|||
for (uint64_t i = 0; i < STATE_WIDTH; i++) |
|||
{ |
|||
uint64_t t2 = mult_mod_p(*(state + i), *(state + i)); |
|||
uint64_t t4 = mult_mod_p(t2, t2); |
|||
|
|||
*(state + i) = mult_mod_p(*(state + i), mult_mod_p(t2, t4)); |
|||
} |
|||
} |
|||
|
|||
void apply_mds(uint64_t *state) |
|||
{ |
|||
uint64_t res[STATE_WIDTH]; |
|||
for (uint64_t i = 0; i < STATE_WIDTH; i++) |
|||
{ |
|||
res[i] = 0; |
|||
} |
|||
for (uint64_t i = 0; i < STATE_WIDTH; i++) |
|||
{ |
|||
for (uint64_t j = 0; j < STATE_WIDTH; j++) |
|||
{ |
|||
res[i] = add_mod_p(res[i], mult_mod_p(MDS[i][j], *(state + j))); |
|||
} |
|||
} |
|||
|
|||
for (uint64_t i = 0; i < STATE_WIDTH; i++) |
|||
{ |
|||
*(state + i) = res[i]; |
|||
} |
|||
} |
|||
|
|||
void apply_constants(uint64_t *const state, const uint64_t *ark) |
|||
{ |
|||
for (uint64_t i = 0; i < STATE_WIDTH; i++) |
|||
{ |
|||
*(state + i) = add_mod_p(*(state + i), *(ark + i)); |
|||
} |
|||
} |
|||
|
|||
void exp_acc(const uint64_t m, const uint64_t *base, const uint64_t *tail, uint64_t *const res) |
|||
{ |
|||
for (uint64_t i = 0; i < m; i++) |
|||
{ |
|||
for (uint64_t j = 0; j < STATE_WIDTH; j++) |
|||
{ |
|||
if (i == 0) |
|||
{ |
|||
*(res + j) = mult_mod_p(*(base + j), *(base + j)); |
|||
} |
|||
else |
|||
{ |
|||
*(res + j) = mult_mod_p(*(res + j), *(res + j)); |
|||
} |
|||
} |
|||
} |
|||
|
|||
for (uint64_t i = 0; i < STATE_WIDTH; i++) |
|||
{ |
|||
*(res + i) = mult_mod_p(*(res + i), *(tail + i)); |
|||
} |
|||
} |
|||
|
|||
void apply_inv_sbox(uint64_t *const state) |
|||
{ |
|||
uint64_t t1[STATE_WIDTH]; |
|||
for (uint64_t i = 0; i < STATE_WIDTH; i++) |
|||
{ |
|||
t1[i] = 0; |
|||
} |
|||
for (uint64_t i = 0; i < STATE_WIDTH; i++) |
|||
{ |
|||
t1[i] = mult_mod_p(*(state + i), *(state + i)); |
|||
} |
|||
|
|||
uint64_t t2[STATE_WIDTH]; |
|||
for (uint64_t i = 0; i < STATE_WIDTH; i++) |
|||
{ |
|||
t2[i] = 0; |
|||
} |
|||
for (uint64_t i = 0; i < STATE_WIDTH; i++) |
|||
{ |
|||
t2[i] = mult_mod_p(t1[i], t1[i]); |
|||
} |
|||
|
|||
uint64_t t3[STATE_WIDTH]; |
|||
for (uint64_t i = 0; i < STATE_WIDTH; i++) |
|||
{ |
|||
t3[i] = 0; |
|||
} |
|||
exp_acc(3, t2, t2, t3); |
|||
|
|||
uint64_t t4[STATE_WIDTH]; |
|||
for (uint64_t i = 0; i < STATE_WIDTH; i++) |
|||
{ |
|||
t4[i] = 0; |
|||
} |
|||
exp_acc(6, t3, t3, t4); |
|||
|
|||
uint64_t tmp[STATE_WIDTH]; |
|||
for (uint64_t i = 0; i < STATE_WIDTH; i++) |
|||
{ |
|||
tmp[i] = 0; |
|||
} |
|||
exp_acc(12, t4, t4, tmp); |
|||
|
|||
uint64_t t5[STATE_WIDTH]; |
|||
for (uint64_t i = 0; i < STATE_WIDTH; i++) |
|||
{ |
|||
t5[i] = 0; |
|||
} |
|||
exp_acc(6, tmp, t3, t5); |
|||
|
|||
uint64_t t6[STATE_WIDTH]; |
|||
for (uint64_t i = 0; i < STATE_WIDTH; i++) |
|||
{ |
|||
t6[i] = 0; |
|||
} |
|||
exp_acc(31, t5, t5, t6); |
|||
|
|||
for (uint64_t i = 0; i < STATE_WIDTH; i++) |
|||
{ |
|||
uint64_t a = mult_mod_p(mult_mod_p(t6[i], t6[i]), t5[i]); |
|||
a = mult_mod_p(a, a); |
|||
a = mult_mod_p(a, a); |
|||
uint64_t b = mult_mod_p(mult_mod_p(t1[i], t2[i]), *(state + i)); |
|||
|
|||
*(state + i) = mult_mod_p(a, b); |
|||
} |
|||
} |
|||
|
|||
void apply_round(uint64_t *const state, const uint64_t round) |
|||
{ |
|||
apply_mds(state); |
|||
apply_constants(state, ARK1[round]); |
|||
apply_sbox(state); |
|||
|
|||
apply_mds(state); |
|||
apply_constants(state, ARK2[round]); |
|||
apply_inv_sbox(state); |
|||
} |
|||
|
|||
static void apply_permutation(uint64_t *state) |
|||
{ |
|||
for (uint64_t i = 0; i < NUM_ROUNDS; i++) |
|||
{ |
|||
apply_round(state, i); |
|||
} |
|||
} |
|||
|
|||
/* ================================================================================================ |
|||
* RPO128 implementation. This is supposed to substitute SHAKE256 in the hash-to-point algorithm. |
|||
*/ |
|||
|
|||
#include "rpo.h" |
|||
|
|||
void rpo128_init(rpo128_context *rc) |
|||
{ |
|||
rc->dptr = 32; |
|||
|
|||
memset(rc->st.A, 0, sizeof rc->st.A); |
|||
} |
|||
|
|||
void rpo128_absorb(rpo128_context *rc, const uint8_t *in, size_t len) |
|||
{ |
|||
size_t dptr; |
|||
|
|||
dptr = (size_t)rc->dptr; |
|||
while (len > 0) |
|||
{ |
|||
size_t clen, u; |
|||
|
|||
/* 136 * 8 = 1088 bit for the rate portion in the case of SHAKE256 |
|||
* For RPO, this is 64 * 8 = 512 bits |
|||
* The capacity for SHAKE256 is at the end while for RPO128 it is at the beginning |
|||
*/ |
|||
clen = 96 - dptr; |
|||
if (clen > len) |
|||
{ |
|||
clen = len; |
|||
} |
|||
|
|||
for (u = 0; u < clen; u++) |
|||
{ |
|||
rc->st.dbuf[dptr + u] = in[u]; |
|||
} |
|||
|
|||
dptr += clen; |
|||
in += clen; |
|||
len -= clen; |
|||
if (dptr == 96) |
|||
{ |
|||
apply_permutation(rc->st.A); |
|||
dptr = 32; |
|||
} |
|||
} |
|||
rc->dptr = dptr; |
|||
} |
|||
|
|||
void rpo128_finalize(rpo128_context *rc) |
|||
{ |
|||
// Set dptr to the end of the buffer, so that first call to extract will call the permutation. |
|||
rc->dptr = 96; |
|||
} |
|||
|
|||
void rpo128_squeeze(rpo128_context *rc, uint8_t *out, size_t len) |
|||
{ |
|||
size_t dptr; |
|||
|
|||
dptr = (size_t)rc->dptr; |
|||
while (len > 0) |
|||
{ |
|||
size_t clen; |
|||
|
|||
if (dptr == 96) |
|||
{ |
|||
apply_permutation(rc->st.A); |
|||
dptr = 32; |
|||
} |
|||
clen = 96 - dptr; |
|||
if (clen > len) |
|||
{ |
|||
clen = len; |
|||
} |
|||
len -= clen; |
|||
|
|||
memcpy(out, rc->st.dbuf + dptr, clen); |
|||
dptr += clen; |
|||
out += clen; |
|||
} |
|||
rc->dptr = dptr; |
|||
} |
|||
|
|||
void rpo128_release(rpo128_context *rc) |
|||
{ |
|||
memset(rc->st.A, 0, sizeof rc->st.A); |
|||
rc->dptr = 32; |
|||
} |
|||
|
|||
/* ================================================================================================ |
|||
* Hash-to-Point algorithm implementation based on RPO128 |
|||
*/ |
|||
|
|||
void PQCLEAN_FALCON512_CLEAN_hash_to_point_rpo(rpo128_context *rc, uint16_t *x, unsigned logn) |
|||
{ |
|||
/* |
|||
* This implementation avoids the rejection sampling step needed in the |
|||
* per-the-spec implementation. It uses a remark in https://falcon-sign.info/falcon.pdf |
|||
* page 31, which argues that the current variant is secure for the parameters set by NIST. |
|||
* Avoiding the rejection-sampling step leads to an implementation that is constant-time. |
|||
* TODO: Check that the current implementation is indeed constant-time. |
|||
*/ |
|||
size_t n; |
|||
|
|||
n = (size_t)1 << logn; |
|||
while (n > 0) |
|||
{ |
|||
uint8_t buf[8]; |
|||
uint64_t w; |
|||
|
|||
rpo128_squeeze(rc, (void *)buf, sizeof buf); |
|||
w = ((uint64_t)(buf[7]) << 56) | |
|||
((uint64_t)(buf[6]) << 48) | |
|||
((uint64_t)(buf[5]) << 40) | |
|||
((uint64_t)(buf[4]) << 32) | |
|||
((uint64_t)(buf[3]) << 24) | |
|||
((uint64_t)(buf[2]) << 16) | |
|||
((uint64_t)(buf[1]) << 8) | |
|||
((uint64_t)(buf[0])); |
|||
|
|||
w %= M; |
|||
|
|||
*x++ = (uint16_t)w; |
|||
n--; |
|||
} |
|||
} |
|||
@ -0,0 +1,83 @@ |
|||
#include <stdint.h> |
|||
#include <string.h> |
|||
|
|||
/* ================================================================================================ |
|||
* RPO hashing algorithm related structs and methods. |
|||
*/ |
|||
|
|||
/* |
|||
* RPO128 context. |
|||
* |
|||
* This structure is used by the hashing API. It is composed of an internal state that can be |
|||
* viewed as either: |
|||
* 1. 12 field elements in the Miden VM. |
|||
* 2. 96 bytes. |
|||
* |
|||
* The first view is used for the internal state in the context of the RPO hashing algorithm. The |
|||
* second view is used for the buffer used to absorb the data to be hashed. |
|||
* |
|||
* The pointer to the buffer is updated as the data is absorbed. |
|||
* |
|||
* 'rpo128_context' must be initialized with rpo128_init() before first use. |
|||
*/ |
|||
typedef struct |
|||
{ |
|||
union |
|||
{ |
|||
uint64_t A[12]; |
|||
uint8_t dbuf[96]; |
|||
} st; |
|||
uint64_t dptr; |
|||
} rpo128_context; |
|||
|
|||
/* |
|||
* Initializes an RPO state |
|||
*/ |
|||
void rpo128_init(rpo128_context *rc); |
|||
|
|||
/* |
|||
* Absorbs an array of bytes of length 'len' into the state. |
|||
*/ |
|||
void rpo128_absorb(rpo128_context *rc, const uint8_t *in, size_t len); |
|||
|
|||
/* |
|||
* Squeezes an array of bytes of length 'len' from the state. |
|||
*/ |
|||
void rpo128_squeeze(rpo128_context *rc, uint8_t *out, size_t len); |
|||
|
|||
/* |
|||
* Finalizes the state in preparation for squeezing. |
|||
* |
|||
* This function should be called after all the data has been absorbed. |
|||
* |
|||
* Note that the current implementation does not perform any sort of padding for domain separation |
|||
* purposes. The reason being that, for our purposes, we always perform the following sequence: |
|||
* 1. Absorb a Nonce (which is always 40 bytes packed as 8 field elements). |
|||
* 2. Absorb the message (which is always 4 field elements). |
|||
* 3. Call finalize. |
|||
* 4. Squeeze the output. |
|||
* 5. Call release. |
|||
*/ |
|||
void rpo128_finalize(rpo128_context *rc); |
|||
|
|||
/* |
|||
* Releases the state. |
|||
* |
|||
* This function should be called after the squeeze operation is finished. |
|||
*/ |
|||
void rpo128_release(rpo128_context *rc); |
|||
|
|||
/* ================================================================================================ |
|||
* Hash-to-Point algorithm for signature generation and signature verification. |
|||
*/ |
|||
|
|||
/* |
|||
* Hash-to-Point algorithm. |
|||
* |
|||
* This function generates a point in Z_q[x]/(phi) from a given message. |
|||
* |
|||
* It takes a finalized rpo128_context as input and it generates the coefficients of the polynomial |
|||
* representing the point. The coefficients are stored in the array 'x'. The number of coefficients |
|||
* is given by 'logn', which must in our case is 512. |
|||
*/ |
|||
void PQCLEAN_FALCON512_CLEAN_hash_to_point_rpo(rpo128_context *rc, uint16_t *x, unsigned logn); |
|||
@ -0,0 +1,189 @@ |
|||
use libc::c_int;
|
|||
|
|||
// C IMPLEMENTATION INTERFACE
|
|||
// ================================================================================================
|
|||
|
|||
extern "C" {
|
|||
/// Generate a new key pair. Public key goes into pk[], private key in sk[].
|
|||
/// Key sizes are exact (in bytes):
|
|||
/// - public (pk): 897
|
|||
/// - private (sk): 1281
|
|||
///
|
|||
/// Return value: 0 on success, -1 on error.
|
|||
pub fn PQCLEAN_FALCON512_CLEAN_crypto_sign_keypair_rpo(pk: *mut u8, sk: *mut u8) -> c_int;
|
|||
|
|||
/// Generate a new key pair from seed. Public key goes into pk[], private key in sk[].
|
|||
/// Key sizes are exact (in bytes):
|
|||
/// - public (pk): 897
|
|||
/// - private (sk): 1281
|
|||
///
|
|||
/// Return value: 0 on success, -1 on error.
|
|||
pub fn PQCLEAN_FALCON512_CLEAN_crypto_sign_keypair_from_seed_rpo(
|
|||
pk: *mut u8,
|
|||
sk: *mut u8,
|
|||
seed: *const u8,
|
|||
) -> c_int;
|
|||
|
|||
/// Compute a signature on a provided message (m, mlen), with a given private key (sk).
|
|||
/// Signature is written in sig[], with length written into *siglen. Signature length is
|
|||
/// variable; maximum signature length (in bytes) is 666.
|
|||
///
|
|||
/// sig[], m[] and sk[] may overlap each other arbitrarily.
|
|||
///
|
|||
/// Return value: 0 on success, -1 on error.
|
|||
pub fn PQCLEAN_FALCON512_CLEAN_crypto_sign_signature_rpo(
|
|||
sig: *mut u8,
|
|||
siglen: *mut usize,
|
|||
m: *const u8,
|
|||
mlen: usize,
|
|||
sk: *const u8,
|
|||
) -> c_int;
|
|||
|
|||
// TEST HELPERS
|
|||
// --------------------------------------------------------------------------------------------
|
|||
|
|||
/// Verify a signature (sig, siglen) on a message (m, mlen) with a given public key (pk).
|
|||
///
|
|||
/// sig[], m[] and pk[] may overlap each other arbitrarily.
|
|||
///
|
|||
/// Return value: 0 on success, -1 on error.
|
|||
#[cfg(test)]
|
|||
pub fn PQCLEAN_FALCON512_CLEAN_crypto_sign_verify_rpo(
|
|||
sig: *const u8,
|
|||
siglen: usize,
|
|||
m: *const u8,
|
|||
mlen: usize,
|
|||
pk: *const u8,
|
|||
) -> c_int;
|
|||
|
|||
/// Hash-to-Point algorithm.
|
|||
///
|
|||
/// This function generates a point in Z_q[x]/(phi) from a given message.
|
|||
///
|
|||
/// It takes a finalized rpo128_context as input and it generates the coefficients of the polynomial
|
|||
/// representing the point. The coefficients are stored in the array 'x'. The number of coefficients
|
|||
/// is given by 'logn', which must in our case is 512.
|
|||
#[cfg(test)]
|
|||
pub fn PQCLEAN_FALCON512_CLEAN_hash_to_point_rpo(
|
|||
rc: *mut Rpo128Context,
|
|||
x: *mut u16,
|
|||
logn: usize,
|
|||
);
|
|||
|
|||
#[cfg(test)]
|
|||
pub fn rpo128_init(sc: *mut Rpo128Context);
|
|||
|
|||
#[cfg(test)]
|
|||
pub fn rpo128_absorb(
|
|||
sc: *mut Rpo128Context,
|
|||
data: *const ::std::os::raw::c_void,
|
|||
len: libc::size_t,
|
|||
);
|
|||
|
|||
#[cfg(test)]
|
|||
pub fn rpo128_finalize(sc: *mut Rpo128Context);
|
|||
}
|
|||
|
|||
#[repr(C)]
|
|||
#[cfg(test)]
|
|||
pub struct Rpo128Context {
|
|||
pub content: [u64; 13usize],
|
|||
}
|
|||
|
|||
// TESTS
|
|||
// ================================================================================================
|
|||
|
|||
#[cfg(all(test, feature = "std"))]
|
|||
mod tests {
|
|||
use super::*;
|
|||
use crate::dsa::rpo_falcon512::{NONCE_LEN, PK_LEN, SIG_LEN, SK_LEN};
|
|||
use rand::Rng;
|
|||
|
|||
#[test]
|
|||
fn falcon_ffi() {
|
|||
unsafe {
|
|||
let mut rng = rand::thread_rng();
|
|||
|
|||
// --- generate a key pair from a seed ----------------------------
|
|||
|
|||
let mut pk = [0u8; PK_LEN];
|
|||
let mut sk = [0u8; SK_LEN];
|
|||
let seed: [u8; NONCE_LEN] =
|
|||
(0..NONCE_LEN).map(|_| rng.gen()).collect::<Vec<u8>>().try_into().unwrap();
|
|||
|
|||
assert_eq!(
|
|||
0,
|
|||
PQCLEAN_FALCON512_CLEAN_crypto_sign_keypair_from_seed_rpo(
|
|||
pk.as_mut_ptr(),
|
|||
sk.as_mut_ptr(),
|
|||
seed.as_ptr()
|
|||
)
|
|||
);
|
|||
|
|||
// --- sign a message and make sure it verifies -------------------
|
|||
|
|||
let mlen: usize = rng.gen::<u16>() as usize;
|
|||
let msg: Vec<u8> = (0..mlen).map(|_| rng.gen()).collect();
|
|||
let mut detached_sig = [0u8; NONCE_LEN + SIG_LEN];
|
|||
let mut siglen = 0;
|
|||
|
|||
assert_eq!(
|
|||
0,
|
|||
PQCLEAN_FALCON512_CLEAN_crypto_sign_signature_rpo(
|
|||
detached_sig.as_mut_ptr(),
|
|||
&mut siglen as *mut usize,
|
|||
msg.as_ptr(),
|
|||
msg.len(),
|
|||
sk.as_ptr()
|
|||
)
|
|||
);
|
|||
|
|||
assert_eq!(
|
|||
0,
|
|||
PQCLEAN_FALCON512_CLEAN_crypto_sign_verify_rpo(
|
|||
detached_sig.as_ptr(),
|
|||
siglen,
|
|||
msg.as_ptr(),
|
|||
msg.len(),
|
|||
pk.as_ptr()
|
|||
)
|
|||
);
|
|||
|
|||
// --- check verification of different signature ------------------
|
|||
|
|||
assert_eq!(
|
|||
-1,
|
|||
PQCLEAN_FALCON512_CLEAN_crypto_sign_verify_rpo(
|
|||
detached_sig.as_ptr(),
|
|||
siglen,
|
|||
msg.as_ptr(),
|
|||
msg.len() - 1,
|
|||
pk.as_ptr()
|
|||
)
|
|||
);
|
|||
|
|||
// --- check verification against a different pub key -------------
|
|||
|
|||
let mut pk_alt = [0u8; PK_LEN];
|
|||
let mut sk_alt = [0u8; SK_LEN];
|
|||
assert_eq!(
|
|||
0,
|
|||
PQCLEAN_FALCON512_CLEAN_crypto_sign_keypair_rpo(
|
|||
pk_alt.as_mut_ptr(),
|
|||
sk_alt.as_mut_ptr()
|
|||
)
|
|||
);
|
|||
|
|||
assert_eq!(
|
|||
-1,
|
|||
PQCLEAN_FALCON512_CLEAN_crypto_sign_verify_rpo(
|
|||
detached_sig.as_ptr(),
|
|||
siglen,
|
|||
msg.as_ptr(),
|
|||
msg.len(),
|
|||
pk_alt.as_ptr()
|
|||
)
|
|||
);
|
|||
}
|
|||
}
|
|||
}
|
|||
@ -0,0 +1,227 @@ |
|||
use super::{
|
|||
ByteReader, ByteWriter, Deserializable, DeserializationError, FalconError, Polynomial,
|
|||
PublicKeyBytes, Rpo256, SecretKeyBytes, Serializable, Signature, Word,
|
|||
};
|
|||
|
|||
#[cfg(feature = "std")]
|
|||
use super::{ffi, NonceBytes, StarkField, NONCE_LEN, PK_LEN, SIG_LEN, SK_LEN};
|
|||
|
|||
// PUBLIC KEY
|
|||
// ================================================================================================
|
|||
|
|||
/// A public key for verifying signatures.
|
|||
///
|
|||
/// The public key is a [Word] (i.e., 4 field elements) that is the hash of the coefficients of
|
|||
/// the polynomial representing the raw bytes of the expanded public key.
|
|||
///
|
|||
/// For Falcon-512, the first byte of the expanded public key is always equal to log2(512) i.e., 9.
|
|||
#[derive(Debug, Clone, Copy, PartialEq)]
|
|||
pub struct PublicKey(Word);
|
|||
|
|||
impl PublicKey {
|
|||
/// Returns a new [PublicKey] which is a commitment to the provided expanded public key.
|
|||
///
|
|||
/// # Errors
|
|||
/// Returns an error if the decoding of the public key fails.
|
|||
pub fn new(pk: PublicKeyBytes) -> Result<Self, FalconError> {
|
|||
let h = Polynomial::from_pub_key(&pk)?;
|
|||
let pk_felts = h.to_elements();
|
|||
let pk_digest = Rpo256::hash_elements(&pk_felts).into();
|
|||
Ok(Self(pk_digest))
|
|||
}
|
|||
|
|||
/// Verifies the provided signature against provided message and this public key.
|
|||
pub fn verify(&self, message: Word, signature: &Signature) -> bool {
|
|||
signature.verify(message, self.0)
|
|||
}
|
|||
}
|
|||
|
|||
impl From<PublicKey> for Word {
|
|||
fn from(key: PublicKey) -> Self {
|
|||
key.0
|
|||
}
|
|||
}
|
|||
|
|||
// KEY PAIR
|
|||
// ================================================================================================
|
|||
|
|||
/// A key pair (public and secret keys) for signing messages.
|
|||
///
|
|||
/// The secret key is a byte array of length [PK_LEN].
|
|||
/// The public key is a byte array of length [SK_LEN].
|
|||
#[derive(Debug, Clone, Copy, PartialEq)]
|
|||
pub struct KeyPair {
|
|||
public_key: PublicKeyBytes,
|
|||
secret_key: SecretKeyBytes,
|
|||
}
|
|||
|
|||
#[allow(clippy::new_without_default)]
|
|||
impl KeyPair {
|
|||
// CONSTRUCTORS
|
|||
// --------------------------------------------------------------------------------------------
|
|||
|
|||
/// Generates a (public_key, secret_key) key pair from OS-provided randomness.
|
|||
///
|
|||
/// # Errors
|
|||
/// Returns an error if key generation fails.
|
|||
#[cfg(feature = "std")]
|
|||
pub fn new() -> Result<Self, FalconError> {
|
|||
let mut public_key = [0u8; PK_LEN];
|
|||
let mut secret_key = [0u8; SK_LEN];
|
|||
|
|||
let res = unsafe {
|
|||
ffi::PQCLEAN_FALCON512_CLEAN_crypto_sign_keypair_rpo(
|
|||
public_key.as_mut_ptr(),
|
|||
secret_key.as_mut_ptr(),
|
|||
)
|
|||
};
|
|||
|
|||
if res == 0 {
|
|||
Ok(Self { public_key, secret_key })
|
|||
} else {
|
|||
Err(FalconError::KeyGenerationFailed)
|
|||
}
|
|||
}
|
|||
|
|||
/// Generates a (public_key, secret_key) key pair from the provided seed.
|
|||
///
|
|||
/// # Errors
|
|||
/// Returns an error if key generation fails.
|
|||
#[cfg(feature = "std")]
|
|||
pub fn from_seed(seed: &NonceBytes) -> Result<Self, FalconError> {
|
|||
let mut public_key = [0u8; PK_LEN];
|
|||
let mut secret_key = [0u8; SK_LEN];
|
|||
|
|||
let res = unsafe {
|
|||
ffi::PQCLEAN_FALCON512_CLEAN_crypto_sign_keypair_from_seed_rpo(
|
|||
public_key.as_mut_ptr(),
|
|||
secret_key.as_mut_ptr(),
|
|||
seed.as_ptr(),
|
|||
)
|
|||
};
|
|||
|
|||
if res == 0 {
|
|||
Ok(Self { public_key, secret_key })
|
|||
} else {
|
|||
Err(FalconError::KeyGenerationFailed)
|
|||
}
|
|||
}
|
|||
|
|||
// PUBLIC ACCESSORS
|
|||
// --------------------------------------------------------------------------------------------
|
|||
|
|||
/// Returns the public key corresponding to this key pair.
|
|||
pub fn public_key(&self) -> PublicKey {
|
|||
// TODO: memoize public key commitment as computing it requires quite a bit of hashing.
|
|||
// expect() is fine here because we assume that the key pair was constructed correctly.
|
|||
PublicKey::new(self.public_key).expect("invalid key pair")
|
|||
}
|
|||
|
|||
/// Returns the expanded public key corresponding to this key pair.
|
|||
pub fn expanded_public_key(&self) -> PublicKeyBytes {
|
|||
self.public_key
|
|||
}
|
|||
|
|||
// SIGNATURE GENERATION
|
|||
// --------------------------------------------------------------------------------------------
|
|||
|
|||
/// Signs a message with a secret key and a seed.
|
|||
///
|
|||
/// # Errors
|
|||
/// Returns an error of signature generation fails.
|
|||
#[cfg(feature = "std")]
|
|||
pub fn sign(&self, message: Word) -> Result<Signature, FalconError> {
|
|||
let msg = message.iter().flat_map(|e| e.as_int().to_le_bytes()).collect::<Vec<_>>();
|
|||
let msg_len = msg.len();
|
|||
let mut sig = [0_u8; SIG_LEN + NONCE_LEN];
|
|||
let mut sig_len: usize = 0;
|
|||
|
|||
let res = unsafe {
|
|||
ffi::PQCLEAN_FALCON512_CLEAN_crypto_sign_signature_rpo(
|
|||
sig.as_mut_ptr(),
|
|||
&mut sig_len as *mut usize,
|
|||
msg.as_ptr(),
|
|||
msg_len,
|
|||
self.secret_key.as_ptr(),
|
|||
)
|
|||
};
|
|||
|
|||
if res == 0 {
|
|||
Ok(Signature { sig, pk: self.public_key })
|
|||
} else {
|
|||
Err(FalconError::SigGenerationFailed)
|
|||
}
|
|||
}
|
|||
}
|
|||
|
|||
// SERIALIZATION / DESERIALIZATION
|
|||
// ================================================================================================
|
|||
|
|||
impl Serializable for KeyPair {
|
|||
fn write_into<W: ByteWriter>(&self, target: &mut W) {
|
|||
target.write_bytes(&self.public_key);
|
|||
target.write_bytes(&self.secret_key);
|
|||
}
|
|||
}
|
|||
|
|||
impl Deserializable for KeyPair {
|
|||
fn read_from<R: ByteReader>(source: &mut R) -> Result<Self, DeserializationError> {
|
|||
let public_key: PublicKeyBytes = source.read_array()?;
|
|||
let secret_key: SecretKeyBytes = source.read_array()?;
|
|||
Ok(Self { public_key, secret_key })
|
|||
}
|
|||
}
|
|||
|
|||
// TESTS
|
|||
// ================================================================================================
|
|||
|
|||
#[cfg(all(test, feature = "std"))]
|
|||
mod tests {
|
|||
use super::{super::Felt, KeyPair, NonceBytes, Word};
|
|||
use rand_utils::{rand_array, rand_vector};
|
|||
|
|||
#[test]
|
|||
fn test_falcon_verification() {
|
|||
// generate random keys
|
|||
let keys = KeyPair::new().unwrap();
|
|||
let pk = keys.public_key();
|
|||
|
|||
// sign a random message
|
|||
let message: Word = rand_vector::<Felt>(4).try_into().expect("Should not fail.");
|
|||
let signature = keys.sign(message);
|
|||
|
|||
// make sure the signature verifies correctly
|
|||
assert!(pk.verify(message, signature.as_ref().unwrap()));
|
|||
|
|||
// a signature should not verify against a wrong message
|
|||
let message2: Word = rand_vector::<Felt>(4).try_into().expect("Should not fail.");
|
|||
assert!(!pk.verify(message2, signature.as_ref().unwrap()));
|
|||
|
|||
// a signature should not verify against a wrong public key
|
|||
let keys2 = KeyPair::new().unwrap();
|
|||
assert!(!keys2.public_key().verify(message, signature.as_ref().unwrap()))
|
|||
}
|
|||
|
|||
#[test]
|
|||
fn test_falcon_verification_from_seed() {
|
|||
// generate keys from a random seed
|
|||
let seed: NonceBytes = rand_array();
|
|||
let keys = KeyPair::from_seed(&seed).unwrap();
|
|||
let pk = keys.public_key();
|
|||
|
|||
// sign a random message
|
|||
let message: Word = rand_vector::<Felt>(4).try_into().expect("Should not fail.");
|
|||
let signature = keys.sign(message);
|
|||
|
|||
// make sure the signature verifies correctly
|
|||
assert!(pk.verify(message, signature.as_ref().unwrap()));
|
|||
|
|||
// a signature should not verify against a wrong message
|
|||
let message2: Word = rand_vector::<Felt>(4).try_into().expect("Should not fail.");
|
|||
assert!(!pk.verify(message2, signature.as_ref().unwrap()));
|
|||
|
|||
// a signature should not verify against a wrong public key
|
|||
let keys2 = KeyPair::new().unwrap();
|
|||
assert!(!keys2.public_key().verify(message, signature.as_ref().unwrap()))
|
|||
}
|
|||
}
|
|||
@ -0,0 +1,60 @@ |
|||
use crate::{
|
|||
hash::rpo::Rpo256,
|
|||
utils::{
|
|||
collections::Vec, ByteReader, ByteWriter, Deserializable, DeserializationError,
|
|||
Serializable,
|
|||
},
|
|||
Felt, StarkField, Word, ZERO,
|
|||
};
|
|||
|
|||
#[cfg(feature = "std")]
|
|||
mod ffi;
|
|||
|
|||
mod error;
|
|||
mod keys;
|
|||
mod polynomial;
|
|||
mod signature;
|
|||
|
|||
pub use error::FalconError;
|
|||
pub use keys::{KeyPair, PublicKey};
|
|||
pub use polynomial::Polynomial;
|
|||
pub use signature::Signature;
|
|||
|
|||
// CONSTANTS
|
|||
// ================================================================================================
|
|||
|
|||
// The Falcon modulus.
|
|||
const MODULUS: u16 = 12289;
|
|||
const MODULUS_MINUS_1_OVER_TWO: u16 = 6144;
|
|||
|
|||
// The Falcon parameters for Falcon-512. This is the degree of the polynomial `phi := x^N + 1`
|
|||
// defining the ring Z_p[x]/(phi).
|
|||
const N: usize = 512;
|
|||
const LOG_N: usize = 9;
|
|||
|
|||
/// Length of nonce used for key-pair generation.
|
|||
const NONCE_LEN: usize = 40;
|
|||
|
|||
/// Number of filed elements used to encode a nonce.
|
|||
const NONCE_ELEMENTS: usize = 8;
|
|||
|
|||
/// Public key length as a u8 vector.
|
|||
const PK_LEN: usize = 897;
|
|||
|
|||
/// Secret key length as a u8 vector.
|
|||
const SK_LEN: usize = 1281;
|
|||
|
|||
/// Signature length as a u8 vector.
|
|||
const SIG_LEN: usize = 626;
|
|||
|
|||
/// Bound on the squared-norm of the signature.
|
|||
const SIG_L2_BOUND: u64 = 34034726;
|
|||
|
|||
// TYPE ALIASES
|
|||
// ================================================================================================
|
|||
|
|||
type SignatureBytes = [u8; NONCE_LEN + SIG_LEN];
|
|||
type PublicKeyBytes = [u8; PK_LEN];
|
|||
type SecretKeyBytes = [u8; SK_LEN];
|
|||
type NonceBytes = [u8; NONCE_LEN];
|
|||
type NonceElements = [Felt; NONCE_ELEMENTS];
|
|||
@ -0,0 +1,277 @@ |
|||
use super::{FalconError, Felt, Vec, LOG_N, MODULUS, MODULUS_MINUS_1_OVER_TWO, N, PK_LEN};
|
|||
use core::ops::{Add, Mul, Sub};
|
|||
|
|||
// FALCON POLYNOMIAL
|
|||
// ================================================================================================
|
|||
|
|||
/// A polynomial over Z_p[x]/(phi) where phi := x^512 + 1
|
|||
#[derive(Debug, Copy, Clone, PartialEq)]
|
|||
pub struct Polynomial([u16; N]);
|
|||
|
|||
impl Polynomial {
|
|||
// CONSTRUCTORS
|
|||
// --------------------------------------------------------------------------------------------
|
|||
|
|||
/// Constructs a new polynomial from a list of coefficients.
|
|||
///
|
|||
/// # Safety
|
|||
/// This constructor validates that the coefficients are in the valid range only in debug mode.
|
|||
pub unsafe fn new(data: [u16; N]) -> Self {
|
|||
for value in data {
|
|||
debug_assert!(value < MODULUS);
|
|||
}
|
|||
|
|||
Self(data)
|
|||
}
|
|||
|
|||
/// Decodes raw bytes representing a public key into a polynomial in Z_p[x]/(phi).
|
|||
///
|
|||
/// # Errors
|
|||
/// Returns an error if:
|
|||
/// - The provided input is not exactly 897 bytes long.
|
|||
/// - The first byte of the input is not equal to log2(512) i.e., 9.
|
|||
/// - Any of the coefficients encoded in the provided input is greater than or equal to the
|
|||
/// Falcon field modulus.
|
|||
pub fn from_pub_key(input: &[u8]) -> Result<Self, FalconError> {
|
|||
if input.len() != PK_LEN {
|
|||
return Err(FalconError::PubKeyDecodingInvalidLength(input.len()));
|
|||
}
|
|||
|
|||
if input[0] != LOG_N as u8 {
|
|||
return Err(FalconError::PubKeyDecodingInvalidTag(input[0]));
|
|||
}
|
|||
|
|||
let mut acc = 0_u32;
|
|||
let mut acc_len = 0;
|
|||
|
|||
let mut output = [0_u16; N];
|
|||
let mut output_idx = 0;
|
|||
|
|||
for &byte in input.iter().skip(1) {
|
|||
acc = (acc << 8) | (byte as u32);
|
|||
acc_len += 8;
|
|||
|
|||
if acc_len >= 14 {
|
|||
acc_len -= 14;
|
|||
let w = (acc >> acc_len) & 0x3FFF;
|
|||
if w >= MODULUS as u32 {
|
|||
return Err(FalconError::PubKeyDecodingInvalidCoefficient(w));
|
|||
}
|
|||
output[output_idx] = w as u16;
|
|||
output_idx += 1;
|
|||
}
|
|||
}
|
|||
|
|||
if (acc & ((1u32 << acc_len) - 1)) == 0 {
|
|||
Ok(Self(output))
|
|||
} else {
|
|||
Err(FalconError::PubKeyDecodingExtraData)
|
|||
}
|
|||
}
|
|||
|
|||
/// Decodes the signature into the coefficients of a polynomial in Z_p[x]/(phi). It assumes
|
|||
/// that the signature has been encoded using the uncompressed format.
|
|||
///
|
|||
/// # Errors
|
|||
/// Returns an error if:
|
|||
/// - The signature has been encoded using a different algorithm than the reference compressed
|
|||
/// encoding algorithm.
|
|||
/// - The encoded signature polynomial is in Z_p[x]/(phi') where phi' = x^N' + 1 and N' != 512.
|
|||
/// - While decoding the high bits of a coefficient, the current accumulated value of its
|
|||
/// high bits is larger than 2048.
|
|||
/// - The decoded coefficient is -0.
|
|||
/// - The remaining unused bits in the last byte of `input` are non-zero.
|
|||
pub fn from_signature(input: &[u8]) -> Result<Self, FalconError> {
|
|||
let (encoding, log_n) = (input[0] >> 4, input[0] & 0b00001111);
|
|||
|
|||
if encoding != 0b0011 {
|
|||
return Err(FalconError::SigDecodingIncorrectEncodingAlgorithm);
|
|||
}
|
|||
if log_n != 0b1001 {
|
|||
return Err(FalconError::SigDecodingNotSupportedDegree(log_n));
|
|||
}
|
|||
|
|||
let input = &input[41..];
|
|||
let mut input_idx = 0;
|
|||
let mut acc = 0u32;
|
|||
let mut acc_len = 0;
|
|||
let mut output = [0_u16; N];
|
|||
|
|||
for e in output.iter_mut() {
|
|||
acc = (acc << 8) | (input[input_idx] as u32);
|
|||
input_idx += 1;
|
|||
let b = acc >> acc_len;
|
|||
let s = b & 128;
|
|||
let mut m = b & 127;
|
|||
|
|||
loop {
|
|||
if acc_len == 0 {
|
|||
acc = (acc << 8) | (input[input_idx] as u32);
|
|||
input_idx += 1;
|
|||
acc_len = 8;
|
|||
}
|
|||
acc_len -= 1;
|
|||
if ((acc >> acc_len) & 1) != 0 {
|
|||
break;
|
|||
}
|
|||
m += 128;
|
|||
if m >= 2048 {
|
|||
return Err(FalconError::SigDecodingTooBigHighBits(m));
|
|||
}
|
|||
}
|
|||
if s != 0 && m == 0 {
|
|||
return Err(FalconError::SigDecodingMinusZero);
|
|||
}
|
|||
|
|||
*e = if s != 0 { (MODULUS as u32 - m) as u16 } else { m as u16 };
|
|||
}
|
|||
|
|||
if (acc & ((1 << acc_len) - 1)) != 0 {
|
|||
return Err(FalconError::SigDecodingNonZeroUnusedBitsLastByte);
|
|||
}
|
|||
|
|||
Ok(Self(output))
|
|||
}
|
|||
|
|||
// PUBLIC ACCESSORS
|
|||
// --------------------------------------------------------------------------------------------
|
|||
|
|||
/// Returns the coefficients of this polynomial as integers.
|
|||
pub fn inner(&self) -> [u16; N] {
|
|||
self.0
|
|||
}
|
|||
|
|||
/// Returns the coefficients of this polynomial as field elements.
|
|||
pub fn to_elements(&self) -> Vec<Felt> {
|
|||
self.0.iter().map(|&a| Felt::from(a)).collect()
|
|||
}
|
|||
|
|||
// POLYNOMIAL OPERATIONS
|
|||
// --------------------------------------------------------------------------------------------
|
|||
|
|||
/// Multiplies two polynomials over Z_p[x] without reducing modulo p. Given that the degrees
|
|||
/// of the input polynomials are less than 512 and their coefficients are less than the modulus
|
|||
/// q equal to 12289, the resulting product polynomial is guaranteed to have coefficients less
|
|||
/// than the Miden prime.
|
|||
///
|
|||
/// Note that this multiplication is not over Z_p[x]/(phi).
|
|||
pub fn mul_modulo_p(a: &Self, b: &Self) -> [u64; 1024] {
|
|||
let mut c = [0; 2 * N];
|
|||
for i in 0..N {
|
|||
for j in 0..N {
|
|||
c[i + j] += a.0[i] as u64 * b.0[j] as u64;
|
|||
}
|
|||
}
|
|||
|
|||
c
|
|||
}
|
|||
|
|||
/// Reduces a polynomial, that is the product of two polynomials over Z_p[x], modulo
|
|||
/// the irreducible polynomial phi. This results in an element in Z_p[x]/(phi).
|
|||
pub fn reduce_negacyclic(a: &[u64; 1024]) -> Self {
|
|||
let mut c = [0; N];
|
|||
for i in 0..N {
|
|||
let ai = a[N + i] % MODULUS as u64;
|
|||
let neg_ai = (MODULUS - ai as u16) % MODULUS;
|
|||
|
|||
let bi = (a[i] % MODULUS as u64) as u16;
|
|||
c[i] = (neg_ai + bi) % MODULUS;
|
|||
}
|
|||
|
|||
Self(c)
|
|||
}
|
|||
|
|||
/// Computes the norm squared of a polynomial in Z_p[x]/(phi) after normalizing its
|
|||
/// coefficients to be in the interval (-p/2, p/2].
|
|||
pub fn sq_norm(&self) -> u64 {
|
|||
let mut res = 0;
|
|||
for e in self.0 {
|
|||
if e > MODULUS_MINUS_1_OVER_TWO {
|
|||
res += (MODULUS - e) as u64 * (MODULUS - e) as u64
|
|||
} else {
|
|||
res += e as u64 * e as u64
|
|||
}
|
|||
}
|
|||
res
|
|||
}
|
|||
}
|
|||
|
|||
// Returns a polynomial representing the zero polynomial i.e. default element.
|
|||
impl Default for Polynomial {
|
|||
fn default() -> Self {
|
|||
Self([0_u16; N])
|
|||
}
|
|||
}
|
|||
|
|||
/// Multiplication over Z_p[x]/(phi)
|
|||
impl Mul for Polynomial {
|
|||
type Output = Self;
|
|||
|
|||
fn mul(self, other: Self) -> <Self as Mul<Self>>::Output {
|
|||
let mut result = [0_u16; N];
|
|||
for j in 0..N {
|
|||
for k in 0..N {
|
|||
let i = (j + k) % N;
|
|||
let a = self.0[j] as usize;
|
|||
let b = other.0[k] as usize;
|
|||
let q = MODULUS as usize;
|
|||
let mut prod = a * b % q;
|
|||
if (N - 1) < (j + k) {
|
|||
prod = (q - prod) % q;
|
|||
}
|
|||
result[i] = ((result[i] as usize + prod) % q) as u16;
|
|||
}
|
|||
}
|
|||
|
|||
Polynomial(result)
|
|||
}
|
|||
}
|
|||
|
|||
/// Addition over Z_p[x]/(phi)
|
|||
impl Add for Polynomial {
|
|||
type Output = Self;
|
|||
|
|||
fn add(self, other: Self) -> <Self as Add<Self>>::Output {
|
|||
let mut res = self;
|
|||
res.0.iter_mut().zip(other.0.iter()).for_each(|(x, y)| *x = (*x + *y) % MODULUS);
|
|||
|
|||
res
|
|||
}
|
|||
}
|
|||
|
|||
/// Subtraction over Z_p[x]/(phi)
|
|||
impl Sub for Polynomial {
|
|||
type Output = Self;
|
|||
|
|||
fn sub(self, other: Self) -> <Self as Add<Self>>::Output {
|
|||
let mut res = self;
|
|||
res.0
|
|||
.iter_mut()
|
|||
.zip(other.0.iter())
|
|||
.for_each(|(x, y)| *x = (*x + MODULUS - *y) % MODULUS);
|
|||
|
|||
res
|
|||
}
|
|||
}
|
|||
|
|||
// TESTS
|
|||
// ================================================================================================
|
|||
|
|||
#[cfg(test)]
|
|||
mod tests {
|
|||
use super::{Polynomial, N};
|
|||
|
|||
#[test]
|
|||
fn test_negacyclic_reduction() {
|
|||
let coef1: [u16; N] = rand_utils::rand_array();
|
|||
let coef2: [u16; N] = rand_utils::rand_array();
|
|||
|
|||
let poly1 = Polynomial(coef1);
|
|||
let poly2 = Polynomial(coef2);
|
|||
|
|||
assert_eq!(
|
|||
poly1 * poly2,
|
|||
Polynomial::reduce_negacyclic(&Polynomial::mul_modulo_p(&poly1, &poly2))
|
|||
);
|
|||
}
|
|||
}
|
|||
@ -0,0 +1,262 @@ |
|||
use super::{
|
|||
ByteReader, ByteWriter, Deserializable, DeserializationError, NonceBytes, NonceElements,
|
|||
Polynomial, PublicKeyBytes, Rpo256, Serializable, SignatureBytes, StarkField, Word, MODULUS, N,
|
|||
SIG_L2_BOUND, ZERO,
|
|||
};
|
|||
use crate::utils::string::ToString;
|
|||
|
|||
// FALCON SIGNATURE
|
|||
// ================================================================================================
|
|||
|
|||
/// An RPO Falcon512 signature over a message.
|
|||
///
|
|||
/// The signature is a pair of polynomials (s1, s2) in (Z_p[x]/(phi))^2, where:
|
|||
/// - p := 12289
|
|||
/// - phi := x^512 + 1
|
|||
/// - s1 = c - s2 * h
|
|||
/// - h is a polynomial representing the public key and c is a polynomial that is the hash-to-point
|
|||
/// of the message being signed.
|
|||
///
|
|||
/// The signature verifies if and only if:
|
|||
/// 1. s1 = c - s2 * h
|
|||
/// 2. |s1|^2 + |s2|^2 <= SIG_L2_BOUND
|
|||
///
|
|||
/// where |.| is the norm.
|
|||
///
|
|||
/// [Signature] also includes the extended public key which is serialized as:
|
|||
/// 1. 1 byte representing the log2(512) i.e., 9.
|
|||
/// 2. 896 bytes for the public key. This is decoded into the `h` polynomial above.
|
|||
///
|
|||
/// The actual signature is serialized as:
|
|||
/// 1. A header byte specifying the algorithm used to encode the coefficients of the `s2` polynomial
|
|||
/// together with the degree of the irreducible polynomial phi.
|
|||
/// The general format of this byte is 0b0cc1nnnn where:
|
|||
/// a. cc is either 01 when the compressed encoding algorithm is used and 10 when the
|
|||
/// uncompressed algorithm is used.
|
|||
/// b. nnnn is log2(N) where N is the degree of the irreducible polynomial phi.
|
|||
/// The current implementation works always with cc equal to 0b01 and nnnn equal to 0b1001 and
|
|||
/// thus the header byte is always equal to 0b00111001.
|
|||
/// 2. 40 bytes for the nonce.
|
|||
/// 3. 625 bytes encoding the `s2` polynomial above.
|
|||
///
|
|||
/// The total size of the signature (including the extended public key) is 1563 bytes.
|
|||
pub struct Signature {
|
|||
pub(super) pk: PublicKeyBytes,
|
|||
pub(super) sig: SignatureBytes,
|
|||
}
|
|||
|
|||
impl Signature {
|
|||
// PUBLIC ACCESSORS
|
|||
// --------------------------------------------------------------------------------------------
|
|||
|
|||
/// Returns the public key polynomial h.
|
|||
pub fn pub_key_poly(&self) -> Polynomial {
|
|||
// TODO: memoize
|
|||
// we assume that the signature was constructed with a valid public key, and thus
|
|||
// expect() is OK here.
|
|||
Polynomial::from_pub_key(&self.pk).expect("invalid public key")
|
|||
}
|
|||
|
|||
/// Returns the nonce component of the signature represented as field elements.
|
|||
///
|
|||
/// Nonce bytes are converted to field elements by taking consecutive 5 byte chunks
|
|||
/// of the nonce and interpreting them as field elements.
|
|||
pub fn nonce(&self) -> NonceElements {
|
|||
// we assume that the signature was constructed with a valid signature, and thus
|
|||
// expect() is OK here.
|
|||
let nonce = self.sig[1..41].try_into().expect("invalid signature");
|
|||
decode_nonce(nonce)
|
|||
}
|
|||
|
|||
// Returns the polynomial representation of the signature in Z_p[x]/(phi).
|
|||
pub fn sig_poly(&self) -> Polynomial {
|
|||
// TODO: memoize
|
|||
// we assume that the signature was constructed with a valid signature, and thus
|
|||
// expect() is OK here.
|
|||
Polynomial::from_signature(&self.sig).expect("invalid signature")
|
|||
}
|
|||
|
|||
// HASH-TO-POINT
|
|||
// --------------------------------------------------------------------------------------------
|
|||
|
|||
/// Returns a polynomial in Z_p[x]/(phi) representing the hash of the provided message.
|
|||
pub fn hash_to_point(&self, message: Word) -> Polynomial {
|
|||
hash_to_point(message, &self.nonce())
|
|||
}
|
|||
|
|||
// SIGNATURE VERIFICATION
|
|||
// --------------------------------------------------------------------------------------------
|
|||
/// Returns true if this signature is a valid signature for the specified message generated
|
|||
/// against key pair matching the specified public key commitment.
|
|||
pub fn verify(&self, message: Word, pubkey_com: Word) -> bool {
|
|||
// Make sure the expanded public key matches the provided public key commitment
|
|||
let h = self.pub_key_poly();
|
|||
let h_digest: Word = Rpo256::hash_elements(&h.to_elements()).into();
|
|||
if h_digest != pubkey_com {
|
|||
return false;
|
|||
}
|
|||
|
|||
// Make sure the signature is valid
|
|||
let s2 = self.sig_poly();
|
|||
let c = self.hash_to_point(message);
|
|||
|
|||
let s1 = c - s2 * h;
|
|||
|
|||
let sq_norm = s1.sq_norm() + s2.sq_norm();
|
|||
sq_norm <= SIG_L2_BOUND
|
|||
}
|
|||
}
|
|||
|
|||
// SERIALIZATION / DESERIALIZATION
|
|||
// ================================================================================================
|
|||
|
|||
impl Serializable for Signature {
|
|||
fn write_into<W: ByteWriter>(&self, target: &mut W) {
|
|||
target.write_bytes(&self.pk);
|
|||
target.write_bytes(&self.sig);
|
|||
}
|
|||
}
|
|||
|
|||
impl Deserializable for Signature {
|
|||
fn read_from<R: ByteReader>(source: &mut R) -> Result<Self, DeserializationError> {
|
|||
let pk: PublicKeyBytes = source.read_array()?;
|
|||
let sig: SignatureBytes = source.read_array()?;
|
|||
|
|||
// make sure public key and signature can be decoded correctly
|
|||
Polynomial::from_pub_key(&pk)
|
|||
.map_err(|err| DeserializationError::InvalidValue(err.to_string()))?;
|
|||
Polynomial::from_signature(&sig[41..])
|
|||
.map_err(|err| DeserializationError::InvalidValue(err.to_string()))?;
|
|||
|
|||
Ok(Self { pk, sig })
|
|||
}
|
|||
}
|
|||
|
|||
// HELPER FUNCTIONS
|
|||
// ================================================================================================
|
|||
|
|||
/// Returns a polynomial in Z_p[x]/(phi) representing the hash of the provided message and
|
|||
/// nonce.
|
|||
fn hash_to_point(message: Word, nonce: &NonceElements) -> Polynomial {
|
|||
let mut state = [ZERO; Rpo256::STATE_WIDTH];
|
|||
|
|||
// absorb the nonce into the state
|
|||
for (&n, s) in nonce.iter().zip(state[Rpo256::RATE_RANGE].iter_mut()) {
|
|||
*s = n;
|
|||
}
|
|||
Rpo256::apply_permutation(&mut state);
|
|||
|
|||
// absorb message into the state
|
|||
for (&m, s) in message.iter().zip(state[Rpo256::RATE_RANGE].iter_mut()) {
|
|||
*s = m;
|
|||
}
|
|||
|
|||
// squeeze the coefficients of the polynomial
|
|||
let mut i = 0;
|
|||
let mut res = [0_u16; N];
|
|||
for _ in 0..64 {
|
|||
Rpo256::apply_permutation(&mut state);
|
|||
for a in &state[Rpo256::RATE_RANGE] {
|
|||
res[i] = (a.as_int() % MODULUS as u64) as u16;
|
|||
i += 1;
|
|||
}
|
|||
}
|
|||
|
|||
// using the raw constructor is OK here because we reduce all coefficients by the modulus above
|
|||
unsafe { Polynomial::new(res) }
|
|||
}
|
|||
|
|||
/// Converts byte representation of the nonce into field element representation.
|
|||
fn decode_nonce(nonce: &NonceBytes) -> NonceElements {
|
|||
let mut buffer = [0_u8; 8];
|
|||
let mut result = [ZERO; 8];
|
|||
for (i, bytes) in nonce.chunks(5).enumerate() {
|
|||
buffer[..5].copy_from_slice(bytes);
|
|||
result[i] = u64::from_le_bytes(buffer).into();
|
|||
}
|
|||
|
|||
result
|
|||
}
|
|||
|
|||
// TESTS
|
|||
// ================================================================================================
|
|||
|
|||
#[cfg(all(test, feature = "std"))]
|
|||
mod tests {
|
|||
use super::{
|
|||
super::{ffi::*, Felt},
|
|||
*,
|
|||
};
|
|||
use libc::c_void;
|
|||
use rand_utils::rand_vector;
|
|||
|
|||
// Wrappers for unsafe functions
|
|||
impl Rpo128Context {
|
|||
/// Initializes the RPO state.
|
|||
pub fn init() -> Self {
|
|||
let mut ctx = Rpo128Context { content: [0u64; 13] };
|
|||
unsafe {
|
|||
rpo128_init(&mut ctx as *mut Rpo128Context);
|
|||
}
|
|||
ctx
|
|||
}
|
|||
|
|||
/// Absorbs data into the RPO state.
|
|||
pub fn absorb(&mut self, data: &[u8]) {
|
|||
unsafe {
|
|||
rpo128_absorb(
|
|||
self as *mut Rpo128Context,
|
|||
data.as_ptr() as *const c_void,
|
|||
data.len(),
|
|||
)
|
|||
}
|
|||
}
|
|||
|
|||
/// Finalizes the RPO state to prepare for squeezing.
|
|||
pub fn finalize(&mut self) {
|
|||
unsafe { rpo128_finalize(self as *mut Rpo128Context) }
|
|||
}
|
|||
}
|
|||
|
|||
#[test]
|
|||
fn test_hash_to_point() {
|
|||
// Create a random message and transform it into a u8 vector
|
|||
let msg_felts: Word = rand_vector::<Felt>(4).try_into().unwrap();
|
|||
let msg_bytes = msg_felts.iter().flat_map(|e| e.as_int().to_le_bytes()).collect::<Vec<_>>();
|
|||
|
|||
// Create a nonce i.e. a [u8; 40] array and pack into a [Felt; 8] array.
|
|||
let nonce: [u8; 40] = rand_vector::<u8>(40).try_into().unwrap();
|
|||
|
|||
let mut buffer = [0_u8; 64];
|
|||
for i in 0..8 {
|
|||
buffer[8 * i] = nonce[5 * i];
|
|||
buffer[8 * i + 1] = nonce[5 * i + 1];
|
|||
buffer[8 * i + 2] = nonce[5 * i + 2];
|
|||
buffer[8 * i + 3] = nonce[5 * i + 3];
|
|||
buffer[8 * i + 4] = nonce[5 * i + 4];
|
|||
}
|
|||
|
|||
// Initialize the RPO state
|
|||
let mut rng = Rpo128Context::init();
|
|||
|
|||
// Absorb the nonce and message into the RPO state
|
|||
rng.absorb(&buffer);
|
|||
rng.absorb(&msg_bytes);
|
|||
rng.finalize();
|
|||
|
|||
// Generate the coefficients of the hash-to-point polynomial.
|
|||
let mut res: [u16; N] = [0; N];
|
|||
|
|||
unsafe {
|
|||
PQCLEAN_FALCON512_CLEAN_hash_to_point_rpo(
|
|||
&mut rng as *mut Rpo128Context,
|
|||
res.as_mut_ptr(),
|
|||
9,
|
|||
);
|
|||
}
|
|||
|
|||
// Check that the coefficients are correct
|
|||
let nonce = decode_nonce(&nonce);
|
|||
assert_eq!(res, hash_to_point(msg_felts, &nonce).inner());
|
|||
}
|
|||
}
|
|||