Skip to content

Commit f81f847

Browse files
douzzerdouzzer
committed
fixes for SLH-DSA verifyonly:
wolfssl/wolfcrypt/wc_slhdsa.h: implement WOLFSSL_SLHDSA_NO_SHAKE and WOLFSSL_SLHDSA_NO_SHA2, and fix WC_SLHDSA_MAX_SIG_LEN setup to reflect SHA2 variants; wolfssl/wolfcrypt/settings.h: if WOLFSSL_KERNEL_MODE, set WOLFSSL_SLHDSA_VERIFY_ONLY unless WOLFSSL_SLHDSA_NO_VERIFY_ONLY; wolfcrypt/src/wc_slhdsa.c: fix WOLFSSL_SLHDSA_VERIFY_ONLY to work with --enable-slhdsa=sha2,verifyonly; fix -Wunused-variables in slhdsakey_wots_pk_from_sig_x4(); wolfcrypt/test/test.c: in slhdsa_test(), fix gating for compatibility with --enable-slhdsa=sha2,verifyonly; tests/api/test_slhdsa.c: fix gating in test_wc_slhdsa() and test_wc_slhdsa_sizes().
1 parent 6074a2d commit f81f847

6 files changed

Lines changed: 113 additions & 34 deletions

File tree

‎.wolfssl_known_macro_extras‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -909,6 +909,7 @@ WOLFSSL_SHA512_HASHTYPE
909909
WOLFSSL_SHUTDOWNONCE
910910
WOLFSSL_SILABS_TRNG
911911
WOLFSSL_SLHDSA_FULL_HASH
912+
WOLFSSL_SLHDSA_NO_VERIFY_ONLY
912913
WOLFSSL_SNIFFER_NO_RECOVERY
913914
WOLFSSL_SP_ARM32_UDIV
914915
WOLFSSL_SP_FAST_NCT_EXPTMOD

‎tests/api/test_slhdsa.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242
int test_wc_slhdsa(void)
4343
{
4444
EXPECT_DECLS;
45-
#ifdef WOLFSSL_HAVE_SLHDSA
45+
#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_NO_SHAKE)
4646
SlhDsaKey key;
4747

4848
/* Test NULL parameter handling for init. */
@@ -84,7 +84,7 @@ int test_wc_slhdsa(void)
8484
wc_SlhDsaKey_Free(&key);
8585
#endif
8686

87-
#endif /* WOLFSSL_HAVE_SLHDSA */
87+
#endif /* WOLFSSL_HAVE_SLHDSA && !WOLFSSL_SLHDSA_NO_SHAKE */
8888
return EXPECT_RESULT();
8989
}
9090

@@ -94,7 +94,7 @@ int test_wc_slhdsa(void)
9494
int test_wc_slhdsa_sizes(void)
9595
{
9696
EXPECT_DECLS;
97-
#ifdef WOLFSSL_HAVE_SLHDSA
97+
#if defined(WOLFSSL_HAVE_SLHDSA) && !defined(WOLFSSL_SLHDSA_NO_SHAKE)
9898
SlhDsaKey key;
9999

100100
/* Test NULL parameter handling for size functions. */
@@ -226,7 +226,7 @@ int test_wc_slhdsa_sizes(void)
226226
WC_SLHDSA_SHAKE256F_SIG_LEN);
227227
#endif
228228

229-
#endif /* WOLFSSL_HAVE_SLHDSA */
229+
#endif /* WOLFSSL_HAVE_SLHDSA && !WOLFSSL_SLHDSA_NO_SHAKE */
230230
return EXPECT_RESULT();
231231
}
232232

‎wolfcrypt/src/wc_slhdsa.c‎

Lines changed: 42 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -752,6 +752,7 @@ static int slhdsakey_hash_f_sha2(SlhDsaKey* key, const byte* pk_seed,
752752
return ret;
753753
}
754754

755+
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
755756
/* SHA2 H function.
756757
*
757758
* FIPS 205. Section 11.2.
@@ -820,6 +821,7 @@ static int slhdsakey_hash_h_sha2(SlhDsaKey* key, const byte* pk_seed,
820821

821822
return ret;
822823
}
824+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
823825

824826
/* SHA2 H function with two separate n-byte halves.
825827
*
@@ -895,6 +897,7 @@ static int slhdsakey_hash_h_2_sha2(SlhDsaKey* key, const byte* pk_seed,
895897
return ret;
896898
}
897899

900+
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
898901
/* SHA2 PRF function.
899902
*
900903
* FIPS 205. Section 11.2.
@@ -938,6 +941,7 @@ static int slhdsakey_hash_prf_sha2(SlhDsaKey* key, const byte* pk_seed,
938941

939942
return ret;
940943
}
944+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
941945

942946
/* SHA2 T_l streaming: start with address.
943947
*
@@ -1106,6 +1110,7 @@ static int slhdsakey_mgf1_sha2(SlhDsaKey* key, const byte* seed,
11061110
return ret;
11071111
}
11081112

1113+
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
11091114
/* SHA2 PRF_msg function.
11101115
*
11111116
* FIPS 205. Section 11.2.
@@ -1167,6 +1172,7 @@ static int slhdsakey_prf_msg_sha2(SlhDsaKey* key, const byte* sk_prf,
11671172

11681173
return ret;
11691174
}
1175+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
11701176

11711177
/* SHA2 H_msg function.
11721178
*
@@ -1301,6 +1307,7 @@ static int slhdsakey_hash_f_shake(SlhDsaKey* key, const byte* pk_seed,
13011307
#endif
13021308
}
13031309

1310+
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
13041311
static int slhdsakey_hash_h_shake(SlhDsaKey* key, const byte* pk_seed,
13051312
const word32* adrs, const byte* node, byte n, byte* hash)
13061313
{
@@ -1312,6 +1319,7 @@ static int slhdsakey_hash_h_shake(SlhDsaKey* key, const byte* pk_seed,
13121319
2 * n, NULL, 0, hash, n);
13131320
#endif
13141321
}
1322+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
13151323

13161324
static int slhdsakey_hash_h_2_shake(SlhDsaKey* key, const byte* pk_seed,
13171325
const word32* adrs, const byte* m1, const byte* m2, byte n, byte* hash)
@@ -1320,6 +1328,7 @@ static int slhdsakey_hash_h_2_shake(SlhDsaKey* key, const byte* pk_seed,
13201328
n, m2, n, hash, n);
13211329
}
13221330

1331+
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
13231332
static int slhdsakey_hash_prf_shake(SlhDsaKey* key, const byte* pk_seed,
13241333
const byte* sk_seed, const word32* adrs, byte n, byte* hash)
13251334
{
@@ -1331,6 +1340,7 @@ static int slhdsakey_hash_prf_shake(SlhDsaKey* key, const byte* pk_seed,
13311340
sk_seed, n, NULL, 0, hash, n);
13321341
#endif
13331342
}
1343+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
13341344

13351345
#define HASH_PRF(k, pk_seed, sk_seed, adrs, n, o) \
13361346
(SLHDSA_IS_SHA2((k)->params->param) ? \
@@ -1928,7 +1938,7 @@ static int slhdsakey_shake256_set_seed_ha_hash_x4(word64* state,
19281938

19291939
return ret;
19301940
}
1931-
#endif
1941+
#endif /* WOLFSSL_SLHDSA_VERIFY_ONLY */
19321942

19331943
/* Get the four SHAKE-256 n-byte hash results.
19341944
*
@@ -1963,7 +1973,7 @@ do { \
19631973
((word8*)((state) + (o) - 2))[3] = (a) + 2; \
19641974
((word8*)((state) + (o) - 1))[3] = (a) + 3; \
19651975
} while (0)
1966-
#endif
1976+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
19671977

19681978
/* Set the chain address indices into the SHAKE-256 x4 state.
19691979
*
@@ -2007,7 +2017,7 @@ do { \
20072017
c32toa((ti) + 2, (byte*)&((word32*)((state) + (o) - 2))[1]); \
20082018
c32toa((ti) + 3, (byte*)&((word32*)((state) + (o) - 1))[1]); \
20092019
} while (0)
2010-
#endif
2020+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
20112021

20122022
/* Set the tree indices into the SHAKE-256 x4 state.
20132023
*
@@ -2349,7 +2359,7 @@ static int slhdsakey_chain_x4_16(byte* sk, const byte* pk_seed, byte* addr,
23492359
WC_FREE_VAR_EX(fixed, heap, DYNAMIC_TYPE_SLHDSA);
23502360
return ret;
23512361
}
2352-
#endif
2362+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
23532363

23542364
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_192)
23552365
/* Iterate the hash function 15 times with 4 hashes when n=24.
@@ -3886,10 +3896,6 @@ static int slhdsakey_wots_pk_from_sig_x4(SlhDsaKey* key, const byte* sig,
38863896
const byte* msg, const byte* pk_seed, word32* adrs, byte* pk_sig)
38873897
{
38883898
int ret = 0;
3889-
byte idx[4] = {0};
3890-
int i;
3891-
byte ii;
3892-
sword8 j;
38933899
HashAddress wotspk_adrs;
38943900
byte n = key->params->n;
38953901
byte len = key->params->len;
@@ -3899,7 +3905,10 @@ static int slhdsakey_wots_pk_from_sig_x4(SlhDsaKey* key, const byte* sig,
38993905
DYNAMIC_TYPE_SLHDSA, ret = MEMORY_E);
39003906
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_128)
39013907
if ((ret == 0) && (n == WC_SLHDSA_N_128)) {
3902-
ii = 0;
3908+
int i;
3909+
sword8 j;
3910+
byte ii = 0;
3911+
byte idx[4] = {0};
39033912
for (j = 0; j <= SLHDSA_WM1; j++) {
39043913
for (i = 0; i < len; i++) {
39053914
if ((sword8)msg[i] == j) {
@@ -3926,7 +3935,10 @@ static int slhdsakey_wots_pk_from_sig_x4(SlhDsaKey* key, const byte* sig,
39263935
#endif
39273936
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_192)
39283937
if ((ret == 0) && (n == 24)) {
3929-
ii = 0;
3938+
int i;
3939+
sword8 j;
3940+
byte ii = 0;
3941+
byte idx[4] = {0};
39303942
for (j = 0; j <= SLHDSA_WM1; j++) {
39313943
for (i = 0; i < len; i++) {
39323944
if ((sword8)msg[i] == j) {
@@ -3953,7 +3965,10 @@ static int slhdsakey_wots_pk_from_sig_x4(SlhDsaKey* key, const byte* sig,
39533965
#endif
39543966
#if !defined(WOLFSSL_SLHDSA_PARAM_NO_256)
39553967
if ((ret == 0) && (n == 32)) {
3956-
ii = 0;
3968+
int i;
3969+
sword8 j;
3970+
byte ii = 0;
3971+
byte idx[4] = {0};
39573972
for (j = 0; j <= SLHDSA_WM1; j++) {
39583973
for (i = 0; i < len; i++) {
39593974
if ((sword8)msg[i] == j) {
@@ -3978,9 +3993,14 @@ static int slhdsakey_wots_pk_from_sig_x4(SlhDsaKey* key, const byte* sig,
39783993
}
39793994
else
39803995
#endif
3981-
if (ret == 0) {
3982-
ret = NOT_COMPILED_IN;
3996+
{
3997+
(void)msg;
3998+
(void)key;
3999+
if (ret == 0) {
4000+
ret = NOT_COMPILED_IN;
4001+
}
39834002
}
4003+
39844004
if (ret == 0) {
39854005
HA_Copy(wotspk_adrs, adrs);
39864006
HA_SetTypeAndClearNotKPA(wotspk_adrs, HA_WOTS_PK);
@@ -4457,7 +4477,7 @@ static int slhdsakey_xmss_sign(SlhDsaKey* key, const byte* m,
44574477

44584478
return ret;
44594479
}
4460-
#endif
4480+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
44614481

44624482
/* Compute XMSS public key from XMSS signature.
44634483
*
@@ -4651,7 +4671,7 @@ static int slhdsakey_ht_sign(SlhDsaKey* key, const byte* pk_fors,
46514671

46524672
return ret;
46534673
}
4654-
#endif
4674+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
46554675

46564676
/* Verify hypertree signature.
46574677
*
@@ -5680,7 +5700,7 @@ static int slhdsakey_fors_sign(SlhDsaKey* key, const byte* md,
56805700

56815701
return ret;
56825702
}
5683-
#endif
5703+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
56845704

56855705
#if defined(USE_INTEL_SPEEDUP) && !defined(WOLFSSL_WC_SLHDSA_SMALL)
56865706
/* F hash 4 simultaneously.
@@ -7112,7 +7132,7 @@ int wc_SlhDsaKey_SignMsgWithRandom(SlhDsaKey* key, const byte* mprime,
71127132
addRnd);
71137133
}
71147134

7115-
#endif
7135+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
71167136

71177137
/* Verify SLH-DSA signature.
71187138
*
@@ -7857,7 +7877,7 @@ int wc_SlhDsaKey_SignHash(SlhDsaKey* key, const byte* ctx, byte ctxSz,
78577877

78587878
return ret;
78597879
}
7860-
#endif
7880+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
78617881

78627882
/* Verify SLH-DSA signature.
78637883
*
@@ -8044,7 +8064,7 @@ int wc_SlhDsaKey_ImportPrivate(SlhDsaKey* key, const byte* priv, word32 privLen)
80448064

80458065
return ret;
80468066
}
8047-
#endif
8067+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
80488068

80498069
/* Import public key from data.
80508070
*
@@ -8157,7 +8177,7 @@ int wc_SlhDsaKey_ExportPrivate(SlhDsaKey* key, byte* priv, word32* privLen)
81578177

81588178
return ret;
81598179
}
8160-
#endif
8180+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
81618181

81628182
/* Export the public key.
81638183
*
@@ -8215,7 +8235,7 @@ int wc_SlhDsaKey_PrivateSize(SlhDsaKey* key)
82158235

82168236
return ret;
82178237
}
8218-
#endif
8238+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
82198239

82208240
/* Return the size of the public key for the parameters.
82218241
*
@@ -8318,7 +8338,7 @@ int wc_SlhDsaKey_PrivateSizeFromParam(enum SlhDsaParam param)
83188338

83198339
return ret;
83208340
}
8321-
#endif
8341+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
83228342

83238343
/* Return the size of the public key for the parameters.
83248344
*

‎wolfcrypt/test/test.c‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -54233,9 +54233,7 @@ static wc_test_ret_t slhdsa_test_param(enum SlhDsaParam param)
5423354233

5423454234
wc_test_ret_t slhdsa_test(void)
5423554235
{
54236-
#if !defined(WOLFSSL_SLHDSA_VERIFY_ONLY) || defined(WOLFSSL_SLHDSA_PARAM_128S)
54237-
int ret;
54238-
#endif
54236+
int ret = 0;
5423954237
#ifdef WOLFSSL_SLHDSA_PARAM_128S
5424054238
WC_DECLARE_VAR(key_vfy, SlhDsaKey, 1, HEAP_HINT);
5424154239
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
@@ -55954,9 +55952,7 @@ wc_test_ret_t slhdsa_test(void)
5595455952
}
5595555953
}
5595655954
#endif
55957-
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
5595855955

55959-
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
5596055956
#ifdef WOLFSSL_SLHDSA_PARAM_128S
5596155957
ret = slhdsa_test_param(SLHDSA_SHAKE128S);
5596255958
if (ret != 0) {
@@ -56041,17 +56037,25 @@ wc_test_ret_t slhdsa_test(void)
5604156037
goto out;
5604256038
}
5604356039
#endif
56044-
#endif
56040+
56041+
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
56042+
56043+
#if defined(WOLFSSL_SLHDSA_VERIFY_ONLY) || \
56044+
defined(WOLFSSL_SLHDSA_PARAM_128S)
5604556045

5604656046
out:
5604756047

56048+
#endif
56049+
56050+
#ifdef WOLFSSL_SLHDSA_PARAM_128S
5604856051
#ifdef WC_DECLARE_VAR_IS_HEAP_ALLOC
5604956052
if (key_vfy)
5605056053
#endif
5605156054
{
5605256055
wc_SlhDsaKey_Free(key_vfy);
5605356056
}
5605456057
WC_FREE_VAR_EX(key_vfy, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
56058+
#endif
5605556059
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
5605656060
#ifdef WC_DECLARE_VAR_IS_HEAP_ALLOC
5605756061
if (key)

‎wolfssl/wolfcrypt/settings.h‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4042,6 +4042,14 @@ extern void uITRON4_free(void *p) ;
40424042
#undef WOLFSSL_GENERAL_ALIGNMENT
40434043
#define WOLFSSL_GENERAL_ALIGNMENT SIZEOF_LONG
40444044
#endif
4045+
4046+
/* SLH-DSA signature generation is too computationally intensive to be
4047+
* appropriate in typical kernel deployments.
4048+
*/
4049+
#if !defined(WOLFSSL_SLHDSA_VERIFY_ONLY) && \
4050+
!defined(WOLFSSL_SLHDSA_NO_VERIFY_ONLY)
4051+
#define WOLFSSL_SLHDSA_VERIFY_ONLY
4052+
#endif
40454053
#endif /* WOLFSSL_KERNEL_MODE */
40464054

40474055
#if defined(WC_SYM_RELOC_TABLES) && defined(HAVE_FIPS) && \

0 commit comments

Comments
 (0)