sign: Adding SLH-DSA signature #512
Conversation
|
there is a timeout happening on the ARM build because tests are running in parallel, but it doesn't seems to be related to a failure in the code. |
| } | ||
|
|
||
| // See FIPS 205 -- Section 6.1 -- Algorithm 9 -- Iterative version. | ||
| func (s *statePriv) xmssNodeIter( |
There was a problem hiding this comment.
Similar thing. I had trouble following along with this algorithm, since it differs so much from the paper. Also why is i a parameter at all if it's not a recursive algorithm?
There was a problem hiding this comment.
Internally, the index of each node is used as part of the hash parameters. So, i denotes the first index of a sub-tree.
sign/slhdsa/internal.go
Outdated
| defer s.Clear() | ||
|
|
||
| s.forsSign(sig.forsSig, md, addr) | ||
| pkFors := s.forsPkFromSig(md, sig.forsSig, addr) |
There was a problem hiding this comment.
Would it be possible to compute pkFors as a side effect of forsSign? Can save a few hashes if so. Similarly might be able to do this in the htSign function
There was a problem hiding this comment.
I've tried to coalesce these functions, but didn't found any savings on the number of hashes.
armfazh
force-pushed
the
adding_slhdsa
branch
3 times, most recently
from
12020e3 to
32046e4
Compare
Passes Test vectors from ACVP for internal functions.
armfazh
force-pushed
the
adding_slhdsa
branch
from
32046e4 to
c74a2d3
Compare
|
ACVP test vectors updated to v1.1.0.37 |
| @@ -36,6 +39,18 @@ var allSchemes = [...]sign.Scheme{ | |||
| mldsa44.Scheme(), | |||
| mldsa65.Scheme(), | |||
| mldsa87.Scheme(), | |||
| slhdsa.ParamIDSHA2Small128, | |||
There was a problem hiding this comment.
Better to just use s and f instead of small and fast.
|
|
||
| err = json.Unmarshal(input, &vector) | ||
| test.CheckNoErr(t, err, "error unmarshalling JSON file") | ||
| } |
There was a problem hiding this comment.
Let's open an issue to unify the ACVP code.
| addressSizeNonCompressed = 32 | ||
| ) | ||
|
|
||
| type address struct { |
There was a problem hiding this comment.
Might be more efficient with respect to allocations to use [32]byte as address type.
| s.xmssPkFromSig(node, node, sig[j], idxLeaf, addr) | ||
| } | ||
|
|
||
| return subtle.ConstantTimeCompare(node, root) == 1 |
There was a problem hiding this comment.
No need for constant time compare here
| // Calling [NewMessageWithPreHash] with [NoPreHash] is equivalent. | ||
| // The calls to [Message.Write] copy the message into a internal buffer. | ||
| // To avoid copies of the message, use [NewMessage] instead. | ||
| type Message struct { |
There was a problem hiding this comment.
Why not use the regular Signer interface?
This implementation supports the twelve parameter sets approved at FIPS 205
Test vectors match the ones at ACVP-Server version 1.1.0.37. These test vectors only target the internal functions.
Pure and Prehash-based signatures are supported, but no known test vectors are available.
The last commit adds the twelve instances to the generic signing
Schemeinterface.Implementation makes a good effort to avoid heap allocations that usually add a significant overhead.