Botan 3.10.0
Crypto and TLS for C&
sp_parameters.cpp
Go to the documentation of this file.
1/*
2 * SLH-DSA Parameters
3 * (C) 2023 Jack Lloyd
4 * 2023 Fabian Albert, René Meusel, Amos Treiber - Rohde & Schwarz Cybersecurity
5 *
6 * Botan is released under the Simplified BSD License (see license.txt)
7 */
8
9#include <botan/sp_parameters.h>
10
11#include <botan/assert.h>
12#include <botan/exceptn.h>
13#include <botan/internal/bit_ops.h>
14#include <botan/internal/fmt.h>
15
16namespace Botan {
17
18namespace {
19/// @returns pair: (parameter set, hash type)
20std::pair<Sphincs_Parameter_Set, Sphincs_Hash_Type> set_and_hash_from_name(std::string_view name) {
21 // SPHINCS+ Round 3.1 instances
22 if(name == "SphincsPlus-sha2-128s-r3.1") {
23 return {Sphincs_Parameter_Set::Sphincs128Small, Sphincs_Hash_Type::Sha256};
24 }
25 if(name == "SphincsPlus-sha2-128f-r3.1") {
26 return {Sphincs_Parameter_Set::Sphincs128Fast, Sphincs_Hash_Type::Sha256};
27 }
28 if(name == "SphincsPlus-sha2-192s-r3.1") {
29 return {Sphincs_Parameter_Set::Sphincs192Small, Sphincs_Hash_Type::Sha256};
30 }
31 if(name == "SphincsPlus-sha2-192f-r3.1") {
32 return {Sphincs_Parameter_Set::Sphincs192Fast, Sphincs_Hash_Type::Sha256};
33 }
34 if(name == "SphincsPlus-sha2-256s-r3.1") {
35 return {Sphincs_Parameter_Set::Sphincs256Small, Sphincs_Hash_Type::Sha256};
36 }
37 if(name == "SphincsPlus-sha2-256f-r3.1") {
38 return {Sphincs_Parameter_Set::Sphincs256Fast, Sphincs_Hash_Type::Sha256};
39 }
40
41 if(name == "SphincsPlus-shake-128s-r3.1") {
42 return {Sphincs_Parameter_Set::Sphincs128Small, Sphincs_Hash_Type::Shake256};
43 }
44 if(name == "SphincsPlus-shake-128f-r3.1") {
45 return {Sphincs_Parameter_Set::Sphincs128Fast, Sphincs_Hash_Type::Shake256};
46 }
47 if(name == "SphincsPlus-shake-192s-r3.1") {
48 return {Sphincs_Parameter_Set::Sphincs192Small, Sphincs_Hash_Type::Shake256};
49 }
50 if(name == "SphincsPlus-shake-192f-r3.1") {
51 return {Sphincs_Parameter_Set::Sphincs192Fast, Sphincs_Hash_Type::Shake256};
52 }
53 if(name == "SphincsPlus-shake-256s-r3.1") {
54 return {Sphincs_Parameter_Set::Sphincs256Small, Sphincs_Hash_Type::Shake256};
55 }
56 if(name == "SphincsPlus-shake-256f-r3.1") {
57 return {Sphincs_Parameter_Set::Sphincs256Fast, Sphincs_Hash_Type::Shake256};
58 }
59
60 if(name == "SphincsPlus-haraka-128s-r3.1") {
61 return {Sphincs_Parameter_Set::Sphincs128Small, Sphincs_Hash_Type::Haraka};
62 }
63 if(name == "SphincsPlus-haraka-128f-r3.1") {
64 return {Sphincs_Parameter_Set::Sphincs128Fast, Sphincs_Hash_Type::Haraka};
65 }
66 if(name == "SphincsPlus-haraka-192s-r3.1") {
67 return {Sphincs_Parameter_Set::Sphincs192Small, Sphincs_Hash_Type::Haraka};
68 }
69 if(name == "SphincsPlus-haraka-192f-r3.1") {
70 return {Sphincs_Parameter_Set::Sphincs192Fast, Sphincs_Hash_Type::Haraka};
71 }
72 if(name == "SphincsPlus-haraka-256s-r3.1") {
73 return {Sphincs_Parameter_Set::Sphincs256Small, Sphincs_Hash_Type::Haraka};
74 }
75 if(name == "SphincsPlus-haraka-256f-r3.1") {
76 return {Sphincs_Parameter_Set::Sphincs256Fast, Sphincs_Hash_Type::Haraka};
77 }
78
79 // SLH-DSA instances WITHOUT prehash mode
80 if(name == "SLH-DSA-SHA2-128s") {
81 return {Sphincs_Parameter_Set::SLHDSA128Small, Sphincs_Hash_Type::Sha256};
82 }
83 if(name == "SLH-DSA-SHA2-128f") {
84 return {Sphincs_Parameter_Set::SLHDSA128Fast, Sphincs_Hash_Type::Sha256};
85 }
86 if(name == "SLH-DSA-SHA2-192s") {
87 return {Sphincs_Parameter_Set::SLHDSA192Small, Sphincs_Hash_Type::Sha256};
88 }
89 if(name == "SLH-DSA-SHA2-192f") {
90 return {Sphincs_Parameter_Set::SLHDSA192Fast, Sphincs_Hash_Type::Sha256};
91 }
92 if(name == "SLH-DSA-SHA2-256s") {
93 return {Sphincs_Parameter_Set::SLHDSA256Small, Sphincs_Hash_Type::Sha256};
94 }
95 if(name == "SLH-DSA-SHA2-256f") {
96 return {Sphincs_Parameter_Set::SLHDSA256Fast, Sphincs_Hash_Type::Sha256};
97 }
98
99 if(name == "SLH-DSA-SHAKE-128s") {
100 return {Sphincs_Parameter_Set::SLHDSA128Small, Sphincs_Hash_Type::Shake256};
101 }
102 if(name == "SLH-DSA-SHAKE-128f") {
103 return {Sphincs_Parameter_Set::SLHDSA128Fast, Sphincs_Hash_Type::Shake256};
104 }
105 if(name == "SLH-DSA-SHAKE-192s") {
106 return {Sphincs_Parameter_Set::SLHDSA192Small, Sphincs_Hash_Type::Shake256};
107 }
108 if(name == "SLH-DSA-SHAKE-192f") {
109 return {Sphincs_Parameter_Set::SLHDSA192Fast, Sphincs_Hash_Type::Shake256};
110 }
111 if(name == "SLH-DSA-SHAKE-256s") {
112 return {Sphincs_Parameter_Set::SLHDSA256Small, Sphincs_Hash_Type::Shake256};
113 }
114 if(name == "SLH-DSA-SHAKE-256f") {
115 return {Sphincs_Parameter_Set::SLHDSA256Fast, Sphincs_Hash_Type::Shake256};
116 }
117
118 // SLH-DSA instances WITH prehash mode
119 if(name == "Hash-SLH-DSA-SHA2-128s-with-SHA256") {
120 return {Sphincs_Parameter_Set::SLHDSA128Small, Sphincs_Hash_Type::Sha256};
121 }
122 if(name == "Hash-SLH-DSA-SHA2-128f-with-SHA256") {
123 return {Sphincs_Parameter_Set::SLHDSA128Fast, Sphincs_Hash_Type::Sha256};
124 }
125 if(name == "Hash-SLH-DSA-SHA2-192s-with-SHA512") {
126 return {Sphincs_Parameter_Set::SLHDSA192Small, Sphincs_Hash_Type::Sha256};
127 }
128 if(name == "Hash-SLH-DSA-SHA2-192f-with-SHA512") {
129 return {Sphincs_Parameter_Set::SLHDSA192Fast, Sphincs_Hash_Type::Sha256};
130 }
131 if(name == "Hash-SLH-DSA-SHA2-256s-with-SHA512") {
132 return {Sphincs_Parameter_Set::SLHDSA256Small, Sphincs_Hash_Type::Sha256};
133 }
134 if(name == "Hash-SLH-DSA-SHA2-256f-with-SHA512") {
135 return {Sphincs_Parameter_Set::SLHDSA256Fast, Sphincs_Hash_Type::Sha256};
136 }
137
138 if(name == "Hash-SLH-DSA-SHAKE-128s-with-SHAKE128") {
139 return {Sphincs_Parameter_Set::SLHDSA128Small, Sphincs_Hash_Type::Shake256};
140 }
141 if(name == "Hash-SLH-DSA-SHAKE-128f-with-SHAKE128") {
142 return {Sphincs_Parameter_Set::SLHDSA128Fast, Sphincs_Hash_Type::Shake256};
143 }
144 if(name == "Hash-SLH-DSA-SHAKE-192s-with-SHAKE256") {
145 return {Sphincs_Parameter_Set::SLHDSA192Small, Sphincs_Hash_Type::Shake256};
146 }
147 if(name == "Hash-SLH-DSA-SHAKE-192f-with-SHAKE256") {
148 return {Sphincs_Parameter_Set::SLHDSA192Fast, Sphincs_Hash_Type::Shake256};
149 }
150 if(name == "Hash-SLH-DSA-SHAKE-256s-with-SHAKE256") {
151 return {Sphincs_Parameter_Set::SLHDSA256Small, Sphincs_Hash_Type::Shake256};
152 }
153 if(name == "Hash-SLH-DSA-SHAKE-256f-with-SHAKE256") {
154 return {Sphincs_Parameter_Set::SLHDSA256Fast, Sphincs_Hash_Type::Shake256};
155 }
156
157 throw Lookup_Error(fmt("No SLH-DSA (or SPHINCS+) parameter supported for: {}", name));
158}
159
160std::string name_from_set_and_hash(Sphincs_Parameter_Set set, Sphincs_Hash_Type hash) {
161 if(hash == Sphincs_Hash_Type::Sha256) {
162 switch(set) {
163 case Sphincs_Parameter_Set::Sphincs128Small:
164 return "SphincsPlus-sha2-128s-r3.1";
165 case Sphincs_Parameter_Set::Sphincs128Fast:
166 return "SphincsPlus-sha2-128f-r3.1";
167 case Sphincs_Parameter_Set::Sphincs192Small:
168 return "SphincsPlus-sha2-192s-r3.1";
169 case Sphincs_Parameter_Set::Sphincs192Fast:
170 return "SphincsPlus-sha2-192f-r3.1";
171 case Sphincs_Parameter_Set::Sphincs256Small:
172 return "SphincsPlus-sha2-256s-r3.1";
173 case Sphincs_Parameter_Set::Sphincs256Fast:
174 return "SphincsPlus-sha2-256f-r3.1";
175
176 case Sphincs_Parameter_Set::SLHDSA128Small:
177 return "SLH-DSA-SHA2-128s";
178 case Sphincs_Parameter_Set::SLHDSA128Fast:
179 return "SLH-DSA-SHA2-128f";
180 case Sphincs_Parameter_Set::SLHDSA192Small:
181 return "SLH-DSA-SHA2-192s";
182 case Sphincs_Parameter_Set::SLHDSA192Fast:
183 return "SLH-DSA-SHA2-192f";
184 case Sphincs_Parameter_Set::SLHDSA256Small:
185 return "SLH-DSA-SHA2-256s";
186 case Sphincs_Parameter_Set::SLHDSA256Fast:
187 return "SLH-DSA-SHA2-256f";
188 }
189 }
190
191 if(hash == Sphincs_Hash_Type::Shake256) {
192 switch(set) {
193 case Sphincs_Parameter_Set::Sphincs128Small:
194 return "SphincsPlus-shake-128s-r3.1";
195 case Sphincs_Parameter_Set::Sphincs128Fast:
196 return "SphincsPlus-shake-128f-r3.1";
197 case Sphincs_Parameter_Set::Sphincs192Small:
198 return "SphincsPlus-shake-192s-r3.1";
199 case Sphincs_Parameter_Set::Sphincs192Fast:
200 return "SphincsPlus-shake-192f-r3.1";
201 case Sphincs_Parameter_Set::Sphincs256Small:
202 return "SphincsPlus-shake-256s-r3.1";
203 case Sphincs_Parameter_Set::Sphincs256Fast:
204 return "SphincsPlus-shake-256f-r3.1";
205
206 case Sphincs_Parameter_Set::SLHDSA128Small:
207 return "SLH-DSA-SHAKE-128s";
208 case Sphincs_Parameter_Set::SLHDSA128Fast:
209 return "SLH-DSA-SHAKE-128f";
210 case Sphincs_Parameter_Set::SLHDSA192Small:
211 return "SLH-DSA-SHAKE-192s";
212 case Sphincs_Parameter_Set::SLHDSA192Fast:
213 return "SLH-DSA-SHAKE-192f";
214 case Sphincs_Parameter_Set::SLHDSA256Small:
215 return "SLH-DSA-SHAKE-256s";
216 case Sphincs_Parameter_Set::SLHDSA256Fast:
217 return "SLH-DSA-SHAKE-256f";
218 }
219 }
220
221 if(hash == Sphincs_Hash_Type::Haraka) {
222 switch(set) {
223 case Sphincs_Parameter_Set::Sphincs128Small:
224 return "SphincsPlus-haraka-128s-r3.1";
225 case Sphincs_Parameter_Set::Sphincs128Fast:
226 return "SphincsPlus-haraka-128f-r3.1";
227 case Sphincs_Parameter_Set::Sphincs192Small:
228 return "SphincsPlus-haraka-192s-r3.1";
229 case Sphincs_Parameter_Set::Sphincs192Fast:
230 return "SphincsPlus-haraka-192f-r3.1";
231 case Sphincs_Parameter_Set::Sphincs256Small:
232 return "SphincsPlus-haraka-256s-r3.1";
233 case Sphincs_Parameter_Set::Sphincs256Fast:
234 return "SphincsPlus-haraka-256f-r3.1";
235
236 case Sphincs_Parameter_Set::SLHDSA128Small:
237 case Sphincs_Parameter_Set::SLHDSA128Fast:
238 case Sphincs_Parameter_Set::SLHDSA192Small:
239 case Sphincs_Parameter_Set::SLHDSA192Fast:
240 case Sphincs_Parameter_Set::SLHDSA256Small:
241 case Sphincs_Parameter_Set::SLHDSA256Fast:
242 throw Invalid_Argument("SLH-DSA does not support Haraka");
243 }
244 }
245 throw Invalid_Argument("Cannot serialize invalid parameter combination");
246}
247
248constexpr bool is_slh_dsa_set(Sphincs_Parameter_Set set) {
249 switch(set) {
250 case Sphincs_Parameter_Set::SLHDSA128Small:
251 case Sphincs_Parameter_Set::SLHDSA128Fast:
252 case Sphincs_Parameter_Set::SLHDSA192Small:
253 case Sphincs_Parameter_Set::SLHDSA192Fast:
254 case Sphincs_Parameter_Set::SLHDSA256Small:
255 case Sphincs_Parameter_Set::SLHDSA256Fast:
256 return true;
257 case Sphincs_Parameter_Set::Sphincs128Small:
258 case Sphincs_Parameter_Set::Sphincs128Fast:
259 case Sphincs_Parameter_Set::Sphincs192Small:
260 case Sphincs_Parameter_Set::Sphincs192Fast:
261 case Sphincs_Parameter_Set::Sphincs256Small:
262 case Sphincs_Parameter_Set::Sphincs256Fast:
263 return false;
264 }
265 BOTAN_ASSERT_UNREACHABLE();
266}
267
268} // namespace
269
270Sphincs_Parameters::Sphincs_Parameters(Sphincs_Parameter_Set set,
271 Sphincs_Hash_Type hash_type,
272 uint32_t n,
273 uint32_t h,
274 uint32_t d,
275 uint32_t a,
276 uint32_t k,
277 uint32_t w,
278 uint32_t bitsec) :
279 m_set(set), m_hash_type(hash_type), m_n(n), m_h(h), m_d(d), m_a(a), m_k(k), m_w(w), m_bitsec(bitsec) {
280 BOTAN_ARG_CHECK(!(hash_type == Sphincs_Hash_Type::Haraka && is_slh_dsa_set(set)),
281 "Haraka is not available for SLH-DSA");
282 BOTAN_ARG_CHECK(w == 4 || w == 16 || w == 256, "Winternitz parameter must be one of 4, 16, 256");
283 BOTAN_ARG_CHECK(n == 16 || n == 24 || n == 32, "n must be one of 16, 24, 32");
284 BOTAN_ARG_CHECK(m_d > 0, "d must be greater than zero");
285
286 m_xmss_tree_height = m_h / m_d;
287 m_lg_w = ceil_log2(m_w);
288
289 // base_2^b algorithm (Fips 205, Algorithm 4) only works
290 // when m_log_w is a divisor of 8.
291 BOTAN_ASSERT_NOMSG(m_lg_w <= 8 && 8 % m_lg_w == 0);
292
293 // # Winternitz blocks of the message (len_1 of FIPS 205, Algorithm 1)
294 m_wots_len1 = (m_n * 8) / m_lg_w;
295
296 // # Winternitz blocks of the checksum (output of FIPS 205 Algorithm 1)
297 m_wots_len2 = ceil_log2(m_wots_len1 * (m_w - 1)) / m_lg_w + 1;
298
299 // # Winternitz blocks in the signature (len of FIPS 205, Equation 5.4)
300 m_wots_len = m_wots_len1 + m_wots_len2;
301
302 // byte length of WOTS+ signature as well as public key
303 m_wots_bytes = m_wots_len * m_n;
304
305 // # of bytes the WOTS+ checksum consists of
306 m_wots_checksum_bytes = ceil_tobytes(m_wots_len2 * m_lg_w);
307
308 m_fors_sig_bytes = (m_a + 1) * m_k * m_n;
309
310 // byte length of the FORS input message
311 m_fors_message_bytes = ceil_tobytes(m_k * m_a);
312
313 m_xmss_sig_bytes = m_wots_bytes + m_xmss_tree_height * m_n;
314 m_ht_sig_bytes = m_d * m_xmss_sig_bytes;
315 m_sp_sig_bytes = m_n /* random */ + m_fors_sig_bytes + m_ht_sig_bytes;
316
317 m_tree_digest_bytes = ceil_tobytes(m_h - m_xmss_tree_height);
318 m_leaf_digest_bytes = ceil_tobytes(m_xmss_tree_height);
319 m_h_msg_digest_bytes = m_fors_message_bytes + m_tree_digest_bytes + m_leaf_digest_bytes;
320}
321
322bool Sphincs_Parameters::is_available() const {
323 [[maybe_unused]] const bool is_slh_dsa = is_slh_dsa_set(m_set);
324#ifdef BOTAN_HAS_SLH_DSA_WITH_SHA2
325 if(is_slh_dsa && m_hash_type == Sphincs_Hash_Type::Sha256) {
326 return true;
327 }
328#endif
329#ifdef BOTAN_HAS_SLH_DSA_WITH_SHAKE
330 if(is_slh_dsa && m_hash_type == Sphincs_Hash_Type::Shake256) {
331 return true;
332 }
333#endif
334#ifdef BOTAN_HAS_SPHINCS_PLUS_WITH_SHA2
335 if(!is_slh_dsa && m_hash_type == Sphincs_Hash_Type::Sha256) {
336 return true;
337 }
338#endif
339#ifdef BOTAN_HAS_SPHINCS_PLUS_WITH_SHAKE
340 if(!is_slh_dsa && m_hash_type == Sphincs_Hash_Type::Shake256) {
341 return true;
342 }
343#endif
344 return false;
345}
346
347Sphincs_Parameters Sphincs_Parameters::create(
348 Sphincs_Parameter_Set set, Sphincs_Hash_Type hash /*, SlhDsaInputMode input_mode [TODO: prehash mode]*/) {
349 // See FIPS 205, Table 2
350 switch(set) {
351 case Sphincs_Parameter_Set::Sphincs128Small:
352 case Sphincs_Parameter_Set::SLHDSA128Small:
353 return Sphincs_Parameters(set, hash, 16, 63, 7, 12, 14, 16, 133);
354 case Sphincs_Parameter_Set::Sphincs128Fast:
355 case Sphincs_Parameter_Set::SLHDSA128Fast:
356 return Sphincs_Parameters(set, hash, 16, 66, 22, 6, 33, 16, 128);
357
358 case Sphincs_Parameter_Set::Sphincs192Small:
359 case Sphincs_Parameter_Set::SLHDSA192Small:
360 return Sphincs_Parameters(set, hash, 24, 63, 7, 14, 17, 16, 193);
361 case Sphincs_Parameter_Set::Sphincs192Fast:
362 case Sphincs_Parameter_Set::SLHDSA192Fast:
363 return Sphincs_Parameters(set, hash, 24, 66, 22, 8, 33, 16, 194);
364
365 case Sphincs_Parameter_Set::Sphincs256Small:
366 case Sphincs_Parameter_Set::SLHDSA256Small:
367 return Sphincs_Parameters(set, hash, 32, 64, 8, 14, 22, 16, 255);
368 case Sphincs_Parameter_Set::Sphincs256Fast:
369 case Sphincs_Parameter_Set::SLHDSA256Fast:
370 return Sphincs_Parameters(set, hash, 32, 68, 17, 9, 35, 16, 255);
371 }
372 BOTAN_ASSERT_UNREACHABLE();
373}
374
375Sphincs_Parameters Sphincs_Parameters::create(std::string_view name) {
376 auto [param_set, hash_type] = set_and_hash_from_name(name);
377 return Sphincs_Parameters::create(param_set, hash_type);
378}
379
380bool Sphincs_Parameters::is_slh_dsa() const {
381 return is_slh_dsa_set(m_set);
382}
383
384std::string Sphincs_Parameters::hash_name() const {
385 switch(m_hash_type) {
386 case Sphincs_Hash_Type::Sha256:
387 return "SHA-256";
388 case Sphincs_Hash_Type::Shake256:
389 return fmt("SHAKE-256({})", 8 * n());
390 case Sphincs_Hash_Type::Haraka:
391 return "Haraka";
392 }
393 BOTAN_ASSERT_UNREACHABLE();
394}
395
396std::string Sphincs_Parameters::to_string() const {
397 return name_from_set_and_hash(parameter_set(), hash_type());
398}
399
400Sphincs_Parameters Sphincs_Parameters::create(const OID& oid) {
401 return Sphincs_Parameters::create(oid.to_formatted_string());
402}
403
404OID Sphincs_Parameters::object_identifier() const {
405 return OID::from_string(to_string());
406}
407
408AlgorithmIdentifier Sphincs_Parameters::algorithm_identifier() const {
409 return AlgorithmIdentifier(object_identifier(), AlgorithmIdentifier::USE_EMPTY_PARAM);
410}
411
412} // namespace Botan
BOTAN_ASSERT_NOMSG
#define BOTAN_ASSERT_NOMSG(expr)
Definition assert.h:75
BOTAN_ARG_CHECK
#define BOTAN_ARG_CHECK(expr, msg)
Definition assert.h:33
BOTAN_ASSERT_UNREACHABLE
#define BOTAN_ASSERT_UNREACHABLE()
Definition assert.h:163
Botan::OID::to_formatted_string
std::string to_formatted_string() const
Definition asn1_oid.cpp:139
Botan::Sphincs_Parameters
Definition sp_parameters.h:45
name
std::string name
Definition commoncrypto_hash.cpp:24
Botan::fmt
std::string fmt(std::string_view format, const T &... args)
Definition fmt.h:53
Botan::Sphincs_Parameter_Set
Sphincs_Parameter_Set
Definition sp_parameters.h:24
Botan::Sphincs_Hash_Type
Sphincs_Hash_Type
Definition sp_parameters.h:18
Botan::Sphincs_Hash_Type::Haraka
@ Haraka
Haraka is currently not supported.
Botan::ceil_log2
constexpr uint8_t ceil_log2(T x)
Definition bit_ops.h:133
Botan::ceil_tobytes
BOTAN_FORCE_INLINE constexpr T ceil_tobytes(T bits)
Definition bit_ops.h:168
Generated by doxygen 1.12.0