Pass a scratch hashing context to _fors_sign and _fors_verify.

diff --git a/slh-dsa-internal.h b/slh-dsa-internal.h
index c4af8a58b08e8e41d0554e5cd55e216dce8be911..1fe297befd61927f25e98767b4f45bf5796ca80a 100644 (file)
--- a/slh-dsa-internal.h
+++ b/slh-dsa-internal.h
@@ -242,13 +242,17 @@ _fors_gen (const struct slh_merkle_ctx_secret *ctx, unsigned index, uint8_t *sk,
 void
 _fors_sign (const struct slh_merkle_ctx_secret *ctx,
            const struct slh_fors_params *fors,
-           const uint8_t *msg, uint8_t *signature, uint8_t *pub);
+           const uint8_t *msg, uint8_t *signature, uint8_t *pub,
+           /* Allocated by caller, initialized and clobbered by callee. */
+           void *pub_ctx);
 
 /* Computes candidate public key from signature. */
 void
 _fors_verify (const struct slh_merkle_ctx_public *ctx,
              const struct slh_fors_params *fors,
-             const uint8_t *msg, const uint8_t *signature, uint8_t *pub);
+             const uint8_t *msg, const uint8_t *signature, uint8_t *pub,
+             /* Allocated by caller, initialized and clobbered by callee. */
+             void *pub_ctx);
 
 /* Just the auth path, excluding the wots signature, 144 bytes. */
 #define XMSS_AUTH_SIZE(h) ((h) * _SLH_DSA_128_SIZE)

diff --git a/slh-dsa.c b/slh-dsa.c
index edc239fefcff51c6b5a59b07848a68ed298f086c..b35a28ed256f769f6706ae92038474c5848d51d6 100644 (file)
--- a/slh-dsa.c
+++ b/slh-dsa.c
@@ -86,7 +86,8 @@ _slh_dsa_sign (const struct slh_dsa_params *params,
 
   uint8_t root[_SLH_DSA_128_SIZE];
 
-  _fors_sign (&merkle_ctx, &params->fors, digest, signature, root);
+  union slh_hash_ctx scratch_ctx;
+  _fors_sign (&merkle_ctx, &params->fors, digest, signature, root, &scratch_ctx);
   signature += params->fors.signature_size;
 
   _xmss_sign (&merkle_ctx, params->xmss.h, leaf_idx, root, signature, root);
@@ -124,7 +125,8 @@ _slh_dsa_verify (const struct slh_dsa_params *params,
 
   uint8_t root[_SLH_DSA_128_SIZE];
 
-  _fors_verify (&merkle_ctx, &params->fors, digest, signature, root);
+  union slh_hash_ctx scratch_ctx;
+  _fors_verify (&merkle_ctx, &params->fors, digest, signature, root, &scratch_ctx);
   signature += params->fors.signature_size;
 
   _xmss_verify (&merkle_ctx, params->xmss.h, leaf_idx, root, signature, root);

diff --git a/slh-fors.c b/slh-fors.c
index 2818487d38b60db44505409f5da79ee5130e521a..98dd1ee9c25d8eabe10356b8e5d0b0eba2beb2de 100644 (file)
--- a/slh-fors.c
+++ b/slh-fors.c
@@ -78,7 +78,7 @@ fors_node (const struct slh_merkle_ctx_public *ctx, unsigned height, unsigned in
 
 static void
 fors_sign_one (const struct slh_merkle_ctx_secret *ctx, unsigned a,
-              unsigned idx, uint8_t *signature, void *pub)
+              unsigned idx, uint8_t *signature, void *pub_ctx)
 {
   uint8_t hash[_SLH_DSA_128_SIZE];
 
@@ -88,13 +88,14 @@ fors_sign_one (const struct slh_merkle_ctx_secret *ctx, unsigned a,
   _merkle_sign (ctx, fors_leaf, fors_node, a, idx, signature);
   _merkle_verify (&ctx->pub, fors_node, a, idx, signature, hash);
 
-  ctx->pub.hash->update (pub, _SLH_DSA_128_SIZE, hash);
+  ctx->pub.hash->update (pub_ctx, _SLH_DSA_128_SIZE, hash);
 }
 
 void
 _fors_sign (const struct slh_merkle_ctx_secret *ctx,
            const struct slh_fors_params *fors,
-           const uint8_t *msg, uint8_t *signature, uint8_t *pub)
+           const uint8_t *msg, uint8_t *signature, uint8_t *pub,
+           void *pub_ctx)
 {
   struct slh_address_hash ah =
     {
@@ -102,11 +103,10 @@ _fors_sign (const struct slh_merkle_ctx_secret *ctx,
       bswap32_if_le (ctx->pub.keypair),
       0, 0,
     };
-  union slh_hash_ctx pub_ctx;
   unsigned i, w, bits;
   unsigned mask = (1 << fors->a) - 1;
 
-  ctx->pub.hash->init_hash (ctx->pub.tree_ctx, &pub_ctx, &ah);
+  ctx->pub.hash->init_hash (ctx->pub.tree_ctx, pub_ctx, &ah);
 
   for (i = w = bits = 0; i < fors->k; i++, signature += (fors->a + 1) * _SLH_DSA_128_SIZE)
     {
@@ -114,10 +114,10 @@ _fors_sign (const struct slh_merkle_ctx_secret *ctx,
        w = (w << 8) | *msg++;
       bits -= fors->a;
 
-      fors_sign_one (ctx, fors->a, (i << fors->a) + ((w >> bits) & mask), signature, &pub_ctx);
+      fors_sign_one (ctx, fors->a, (i << fors->a) + ((w >> bits) & mask), signature, pub_ctx);
      }
 
-  ctx->pub.hash->digest (&pub_ctx, pub);
+  ctx->pub.hash->digest (pub_ctx, pub);
 }
 
 static void
@@ -142,7 +142,8 @@ fors_verify_one (const struct slh_merkle_ctx_public *ctx, unsigned a,
 void
 _fors_verify (const struct slh_merkle_ctx_public *ctx,
              const struct slh_fors_params *fors,
-             const uint8_t *msg, const uint8_t *signature, uint8_t *pub)
+             const uint8_t *msg, const uint8_t *signature, uint8_t *pub,
+             void *pub_ctx)
 {
   struct slh_address_hash ah =
     {
@@ -150,11 +151,10 @@ _fors_verify (const struct slh_merkle_ctx_public *ctx,
       bswap32_if_le (ctx->keypair),
       0, 0,
     };
-  union slh_hash_ctx pub_ctx;
   unsigned i, w, bits;
   unsigned mask = (1 << fors->a) - 1;
 
-  ctx->hash->init_hash (ctx->tree_ctx, &pub_ctx, &ah);
+  ctx->hash->init_hash (ctx->tree_ctx, pub_ctx, &ah);
 
   for (i = w = bits = 0; i < fors->k; i++, signature += (fors->a + 1) * _SLH_DSA_128_SIZE)
     {
@@ -162,7 +162,7 @@ _fors_verify (const struct slh_merkle_ctx_public *ctx,
        w = (w << 8) | *msg++;
       bits -= fors->a;
 
-      fors_verify_one (ctx, fors->a, (i << fors->a) + ((w >> bits) & mask), signature, &pub_ctx);
+      fors_verify_one (ctx, fors->a, (i << fors->a) + ((w >> bits) & mask), signature, pub_ctx);
     }
-  ctx->hash->digest (&pub_ctx, pub);
+  ctx->hash->digest (pub_ctx, pub);
 }

diff --git a/testsuite/slh-dsa-test.c b/testsuite/slh-dsa-test.c
index 2367dfdd035de34302f91c2552e4add6b0d1d787..da552e8c80ce418a7af076039b4c9d795b299851 100644 (file)
--- a/testsuite/slh-dsa-test.c
+++ b/testsuite/slh-dsa-test.c
@@ -232,7 +232,7 @@ test_fors_sign (const struct tstring *public_seed, const struct tstring *secret_
                unsigned layer, uint64_t tree_idx, unsigned keypair, const struct tstring *msg,
                const struct tstring *exp_pub, const struct tstring *exp_sig)
 {
-  union slh_hash_ctx tree_ctx;
+  struct sha3_ctx tree_ctx, scratch_ctx;
   const struct slh_merkle_ctx_secret ctx =
     {
       { &_slh_hash_shake, &tree_ctx, keypair },
@@ -248,14 +248,14 @@ test_fors_sign (const struct tstring *public_seed, const struct tstring *secret_
 
   _slh_hash_shake.init_tree (&tree_ctx, public_seed->data, layer, tree_idx);
 
-  _fors_sign (&ctx, fors, msg->data, sig, pub);
+  _fors_sign (&ctx, fors, msg->data, sig, pub, &scratch_ctx);
   mark_bytes_defined (exp_sig->length, sig);
   mark_bytes_defined (sizeof (pub), pub);
   ASSERT (MEMEQ (exp_sig->length, sig, exp_sig->data));
   ASSERT (MEMEQ (sizeof (pub), pub, exp_pub->data));
 
   memset (pub, 0, sizeof (pub));
-  _fors_verify (&ctx.pub, fors, msg->data, sig, pub);
+  _fors_verify (&ctx.pub, fors, msg->data, sig, pub, &scratch_ctx);
   ASSERT (MEMEQ (sizeof (pub), pub, exp_pub->data));
   free (sig);
 }