Add NIST LMS Signature verify KATs (#2435)

* Add utilities to ease processing public key buffer.

Signed-off-by: ashman-p <nashley@cisco.com>

* Process public key to process LMS public key buffers without explicit levels.

Signed-off-by: ashman-p <nashley@cisco.com>

* Update hash results for NIST based KATs.

Signed-off-by: ashman-p <nashley@cisco.com>

* Use NIST based KATs.

Signed-off-by: ashman-p <nashley@cisco.com>

* Update test to read NIST HSS and LMS public keys.

Signed-off-by: ashman-p <nashley@cisco.com>

* Fix formatting errors.

Signed-off-by: Norman Ashley <nashley@cisco.com>

* Correct hash results.

Signed-off-by: Norman Ashley <nashley@cisco.com>

* Update HSS/LMS Public key detection type.

Signed-off-by: ashman-p <nashley@cisco.com>

* Update public key and sig OTS field matching.

Signed-off-by: ashman-p <nashley@cisco.com>

---------

Signed-off-by: ashman-p <nashley@cisco.com>
Signed-off-by: Norman Ashley <nashley@cisco.com>

Author: ashman-p

src/sig_stfl/lms/external/common_defs.h

@@ -9,6 +9,7 @@
 
 #include <stdint.h>
 #include <stdbool.h>
+#include <stddef.h>
 #include <oqs/oqs.h>
 #define MAX_HASH   32 /* Length of the largest hash we support */
 
@@ -68,6 +69,45 @@ typedef uint_fast64_t sequence_t;
 #define LMOTS_SHA256_N32_W4 0x00000003
 #define LMOTS_SHA256_N32_W8 0x00000004
 
+/* Supported LMS / LM-OTS parameter-set identifiers (must stay in sync with #defines above) */
+#define OQS_LMS_TYPE_LIST_LEN 5u
+#define OQS_LMOTS_TYPE_LIST_LEN 4u
+
+static const param_set_t OQS_LMS_TYPE_LIST[OQS_LMS_TYPE_LIST_LEN] = {
+	LMS_SHA256_N32_H5,
+	LMS_SHA256_N32_H10,
+	LMS_SHA256_N32_H15,
+	LMS_SHA256_N32_H20,
+	LMS_SHA256_N32_H25,
+};
+
+static const param_set_t OQS_LMOTS_TYPE_LIST[OQS_LMOTS_TYPE_LIST_LEN] = {
+	LMOTS_SHA256_N32_W1,
+	LMOTS_SHA256_N32_W2,
+	LMOTS_SHA256_N32_W4,
+	LMOTS_SHA256_N32_W8,
+};
+
+static inline bool oqs_lms_type_list_contains(param_set_t v) {
+	size_t i;
+	for (i = 0; i < OQS_LMS_TYPE_LIST_LEN; i++) {
+		if (OQS_LMS_TYPE_LIST[i] == v) {
+			return true;
+		}
+	}
+	return false;
+}
+
+static inline bool oqs_lmots_type_list_contains(param_set_t v) {
+	size_t i;
+	for (i = 0; i < OQS_LMOTS_TYPE_LIST_LEN; i++) {
+		if (OQS_LMOTS_TYPE_LIST[i] == v) {
+			return true;
+		}
+	}
+	return false;
+}
+
 /*
  * Internal formats of various hashes
  *

src/sig_stfl/lms/external/hss_verify_inc.c

@@ -16,6 +16,75 @@
 #include "lm_ots_common.h"
 #include "hss.h"
 
+/*
+ * Classify a serialized public key buffer as HSS or LMS by correlating its
+ * leading fields with the incremental-signature header.
+ *
+ * Public-key layouts (RFC 8554, sec. 5.3 and 6.1):
+ *   - HSS pk: u32(L) || u32(lm_type) || u32(lm_ots) || I || T[1]
+ *   - LMS pk:           u32(lm_type) || u32(lm_ots) || I || T[1]
+ *
+ * signature header :
+ *   sig[]   = u32(L-1) || u32(q) || u32(lm_ots) ...
+ *                     L = (the HSS level count minus one)
+ * Therefore, for an HSS public key, sig[0..3] + 1 must equal pk[0..3] and the
+ * resulting level count must be a valid HSS level (1..MAX_HSS_LEVELS). As a
+ * cross-check, pk[4..7] is required to be a valid LMS type for HSS 
+ * and pk[8..11] is required to be a valid LM-OTS type for LMS;
+ * Further, the signature LM-OTS types must those present in the public key.
+ */
+static bool is_hss_public_key(const unsigned char *public_key,
+                              const unsigned char *signature) {
+	uint_fast32_t sig_levels =
+	    (uint_fast32_t)get_bigendian(signature, 4) + 1;
+    uint_fast32_t sig_lm_ots  = (uint_fast32_t)get_bigendian(signature + 8, 4);
+	uint_fast32_t pk_levels   = (uint_fast32_t)get_bigendian(public_key, 4);
+	uint_fast32_t pk_lm_type  = (uint_fast32_t)get_bigendian(public_key + 4, 4);
+    uint_fast32_t pk_lm_ots   = (uint_fast32_t)get_bigendian(public_key + 8, 4);
+
+	if (sig_levels < MIN_HSS_LEVELS || sig_levels > MAX_HSS_LEVELS) {
+		return false;
+	}
+	if (pk_levels != sig_levels) {
+		return false;
+	}
+    if (pk_lm_ots != sig_lm_ots) {
+        return false;
+    }
+	return oqs_lms_type_list_contains(pk_lm_type) && oqs_lmots_type_list_contains(pk_lm_ots);
+}
+
+/*
+ * Parse a public key buffer as a serialized LMS or HSS public key.
+ * Returns 0 on failure; 1 for a single-tree LMS public key; or the HSS level
+ * count (from the first four bytes) when the buffer matches the HSS layout.
+ * Validate by matching the fields in the signature buffer.
+ */
+static uint_fast32_t public_key_levels(const unsigned char *public_key,
+                                       const unsigned char *signature) {
+	param_set_t w0 = (param_set_t)get_bigendian(public_key, 4);
+	param_set_t w1 = (param_set_t)get_bigendian(public_key + 4, 4);
+	param_set_t w2 = (param_set_t)get_bigendian(public_key + 8, 4);
+
+	if (is_hss_public_key(public_key, signature)) {
+		uint_fast32_t levels = (uint_fast32_t)w0;
+		if (levels < MIN_HSS_LEVELS || levels > MAX_HSS_LEVELS) {
+			return 0;
+		}
+		if (!oqs_lms_type_list_contains(w1) || !oqs_lmots_type_list_contains(w2)) {
+			return 0;
+		}
+
+		return levels;
+	}
+
+	if (oqs_lms_type_list_contains(w0) && oqs_lmots_type_list_contains(w1)) {
+		return 1;
+	}
+
+	return 0;
+}
+
 /*
  * Start the process of validating an HSS signature incrementally. Parameters:
  * ctx - The state we'll use to track the incremental validation
@@ -39,31 +108,25 @@ bool hss_validate_signature_init(
                                        /* we got a failure */
 
     const unsigned char *orig_signature = signature;
-;
+
     /* Get the number of levels the signature claims */
     if (signature_len < 4) {
         ctx->status = info->error_code = hss_error_bad_signature;
         return false;
     }
     uint_fast32_t levels = (uint_fast32_t)get_bigendian( signature, 4 ) + 1;
         /* +1 because what's in the signature is levels-1 */
+    uint_fast32_t pub_levels = public_key_levels(public_key, orig_signature);
+    if (is_hss_public_key(public_key, orig_signature)) {
+        public_key += 4;
+    }
     signature += 4; signature_len -= 4;
-    uint_fast32_t pub_levels = (uint_fast32_t)get_bigendian( public_key, 4 );
-    public_key += 4;
 
     if (levels < MIN_HSS_LEVELS || levels > MAX_HSS_LEVELS ) {
         ctx->status = info->error_code = hss_error_bad_signature;
         return false;
     }
 
-    /*
-    * The level for public keys for single level trees sometimes have a value of zero.
-    * in this case, bump  public key level to 1.
-    */
-    if ((levels == 1) && (pub_levels == 0)) {
-       pub_levels = 1;
-    }
-
     if (levels != pub_levels) {
         /* Signature and public key don't agree */
         ctx->status = info->error_code = hss_error_bad_signature;

tests/KATs/sig_stfl/kats.json

@@ -36,11 +36,11 @@
     "XMSSMT-SHAKE_60/3_256": "7ca90f7c64b21d844975ef39c48405dc61922f6fd0be8cbb88b2a18a54bc754d",
     "XMSSMT-SHAKE_60/6_256": "c11ca5be510f88c9c8188cb98da65e7d4b2be1cd7efc5a9769348c4fa2b33b24",
     "XMSSMT-SHAKE_60/12_256": "79b6690809f1317fbc2466590e4fccc8a7f706b05abcb277ad1018565096ad88",
-    "LMS_SHA256_H5_W1": "26273b16351d40b7a7bf73db200c4494cba890624235d214bca9368e60cd1c02",
+    "LMS_SHA256_H5_W1": "071e5fedf41bfcf43c2f10ed238fbe18da0a5773095064bb0a62ce79f2ba58c9",
     "LMS_SHA256_H5_W2": "a4877dbf9f06a08469afaee13cf25ef98e20064d2be0009888c68698995aca7d",
     "LMS_SHA256_H5_W4": "e13ceda1f66c90cad1a15087f26bb025378f7fbb69ecfc138ac365a9bf3fb6a5",
     "LMS_SHA256_H5_W8": "175f2b5b8a6e8a5faa82bdeb2779a88cc977ad7cca46d815b0d02c6dd672396d",
-    "LMS_SHA256_H10_W1": "b52bb3ff8fab21d69eb0933f5eeffac1380f87c1c8154983cfe4f3f27fcfb1e9",
+    "LMS_SHA256_H10_W1": "86d6c14478ff270b89e8cb158dacfe7c667466e93e9f226ca1bfe38f5b3a2aaa",
     "LMS_SHA256_H10_W2": "a1a2709362ac8aeb956d0d88cd4a42ce2fc8df9a69979270299b9471f61c3dbd",
     "LMS_SHA256_H10_W4": "707e4ff1adb835f6e79453caca0c787c156a2ee270b1657a42ebbe6eb7424494",
     "LMS_SHA256_H10_W8": "799e7bdf00fc0839519e6847b7df40763b89949e1d1b99bd5b9f669387bf0fbc",