diff --git a/.github/workflows/bign-genk.yml b/.github/workflows/bign-genk.yml new file mode 100644 index 00000000..ce0bfba7 --- /dev/null +++ b/.github/workflows/bign-genk.yml @@ -0,0 +1,55 @@ +name: bign-genk +on: + pull_request: + paths: + - "bign-genk/**" + - "Cargo.*" + push: + branches: master + +defaults: + run: + working-directory: bign-genk + +env: + CARGO_INCREMENTAL: 0 + RUSTFLAGS: "-Dwarnings" + +# Cancels CI jobs when new commits are pushed to a PR branch +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + +jobs: + build: + runs-on: ubuntu-latest + strategy: + matrix: + target: + - thumbv7em-none-eabi + - wasm32-unknown-unknown + rust: + - 1.85.0 # MSRV + - stable + steps: + - uses: actions/checkout@v5 + - uses: dtolnay/rust-toolchain@master + with: + toolchain: ${{ matrix.rust }} + targets: ${{ matrix.target }} + - run: cargo build --no-default-features --release --target ${{ matrix.target }} + + test: + runs-on: ubuntu-latest + strategy: + matrix: + rust: + - 1.85.0 # MSRV + - stable + steps: + - uses: actions/checkout@v5 + - uses: dtolnay/rust-toolchain@master + with: + toolchain: ${{ matrix.rust }} + - run: cargo check --all-features + - run: cargo test diff --git a/Cargo.lock b/Cargo.lock index 20f5c7ed..1dbe747b 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -52,6 +52,43 @@ version = "1.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "55248b47b0caf0546f7988906588779981c43bb1bc9d0c44087278f80cdb44ba" +[[package]] +name = "belt-block" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d9aa1eef3994e2ccd304a78fe3fea4a73e5792007f85f09b79bb82143ca5f82b" + +[[package]] +name = "belt-block" +version = "0.2.0-rc.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e34d9cc93a6506887eed92e4e9459c13469eee4ef2b2af305a182ebf53e4d6a3" +dependencies = [ + "cipher", +] + +[[package]] +name = "belt-hash" +version = "0.2.0-rc.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c4d0d625c21e8e5ca317b31568d257c4af4e93fd5a756d0301f5d517951ea6fd" +dependencies = [ + "belt-block 0.1.2", + "digest", +] + +[[package]] +name = "bign-genk" +version = "0.5.0-rc.3" +dependencies = [ + "belt-block 0.2.0-rc.2", + "belt-hash", + "cipher", + "digest", + "hex-literal", + "subtle", +] + [[package]] name = "bincode" version = "1.3.3" diff --git a/Cargo.toml b/Cargo.toml index 79c5444c..c70307d5 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,7 @@ [workspace] resolver = "2" members = [ + "bign-genk", "dsa", "ecdsa", "ed448", @@ -25,3 +26,4 @@ lms-signature = { path = "./lms" } ml-dsa = { path = "./ml-dsa" } rfc6979 = { path = "./rfc6979" } slh-dsa = { path = "./slh-dsa" } +bign-genk = { path = "./bign-genk" } diff --git a/bign-genk/CHANGELOG.md b/bign-genk/CHANGELOG.md new file mode 100644 index 00000000..c0e2b5b9 --- /dev/null +++ b/bign-genk/CHANGELOG.md @@ -0,0 +1,10 @@ +# Changelog +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +### 0.5.0 (XXXX-XX-XX) +- Initial release + +[#1109](https://github.com/RustCrypto/signatures/pull/1109) \ No newline at end of file diff --git a/bign-genk/Cargo.toml b/bign-genk/Cargo.toml new file mode 100644 index 00000000..dd7caf9a --- /dev/null +++ b/bign-genk/Cargo.toml @@ -0,0 +1,26 @@ +[package] +name = "bign-genk" +version = "0.5.0-rc.3" +description = """ +Pure Rust implementation of bign-genk algorithm from STB 34.101.45: Deterministic Usage of the +Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA) +""" +authors = ["RustCrypto Developers"] +license = "Apache-2.0 OR MIT" +homepage = "https://github.com/RustCrypto/signatures/tree/master/bign-genk" +repository = "https://github.com/RustCrypto/signatures" +readme = "README.md" +categories = ["cryptography", "no-std"] +keywords = ["dsa", "ecdsa", "signature", "bign"] +edition = "2024" +rust-version = "1.85" + +[dependencies] +cipher = { version = "0.5.0-rc.2", default-features = false } +digest = { version = "0.11.0-rc.4", default-features = false, features = ["oid"] } +subtle = { version = "2", default-features = false } + +[dev-dependencies] +hex-literal = "1" +belt-block = "0.2.0-rc.2" +belt-hash = "0.2.0-rc.2" diff --git a/bign-genk/LICENSE-APACHE b/bign-genk/LICENSE-APACHE new file mode 100644 index 00000000..7a9175be --- /dev/null +++ b/bign-genk/LICENSE-APACHE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + +TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + +1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + +2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + +3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + +4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + +5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + +6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + +7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + +8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + +9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + +END OF TERMS AND CONDITIONS + +APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + +Copyright 2018-2025 RustCrypto Developers + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/bign-genk/LICENSE-MIT b/bign-genk/LICENSE-MIT new file mode 100644 index 00000000..d767644d --- /dev/null +++ b/bign-genk/LICENSE-MIT @@ -0,0 +1,25 @@ +Copyright (c) 2018-2025 RustCrypto Developers + +Permission is hereby granted, free of charge, to any +person obtaining a copy of this software and associated +documentation files (the "Software"), to deal in the +Software without restriction, including without +limitation the rights to use, copy, modify, merge, +publish, distribute, sublicense, and/or sell copies of +the Software, and to permit persons to whom the Software +is furnished to do so, subject to the following +conditions: + +The above copyright notice and this permission notice +shall be included in all copies or substantial portions +of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF +ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED +TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A +PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT +SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR +IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +DEALINGS IN THE SOFTWARE. diff --git a/bign-genk/README.md b/bign-genk/README.md new file mode 100644 index 00000000..9144d5bf --- /dev/null +++ b/bign-genk/README.md @@ -0,0 +1,55 @@ +# [RustCrypto]: STB 34.101.45 Deterministic Signatures + +[![crate][crate-image]][crate-link] +[![Docs][docs-image]][docs-link] +[![Build Status][build-image]][build-link] +![Apache2/MIT licensed][license-image] +![MSRV][rustc-image] +[![Project Chat][chat-image]][chat-link] + +Pure Rust implementation of `bign-genk` from STB 34.101.45: Deterministic Usage of the +Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA). + +Algorithm described in STB 34.101.45-2013 § 6.3: + + +[Documentation][docs-link] + +## Minimum Supported Rust Version + +This crate requires **Rust 1.85** at a minimum. + +We may change the MSRV in the future, but it will be accompanied by a minor +version bump. + +## License + +All crates licensed under either of + + * [Apache License, Version 2.0](https://www.apache.org/licenses/LICENSE-2.0) + * [MIT license](https://opensource.org/licenses/MIT) + +at your option. + +### Contribution + +Unless you explicitly state otherwise, any contribution intentionally submitted +for inclusion in the work by you, as defined in the Apache-2.0 license, shall be +dual licensed as above, without any additional terms or conditions. + +[//]: # (badges) + +[crate-image]: https://img.shields.io/crates/v/bign-genk?logo=rust +[crate-link]: https://crates.io/crates/bign-genk +[docs-image]: https://docs.rs/bign-genk/badge.svg +[docs-link]: https://docs.rs/bign-genk/ +[build-image]: https://github.com/RustCrypto/signatures/actions/workflows/bign-genk.yml/badge.svg +[build-link]: https://github.com/RustCrypto/signatures/actions/workflows/bign-genk.yml +[license-image]: https://img.shields.io/badge/license-Apache2.0/MIT-blue.svg +[rustc-image]: https://img.shields.io/badge/rustc-1.85+-blue.svg +[chat-image]: https://img.shields.io/badge/zulip-join_chat-blue.svg +[chat-link]: https://rustcrypto.zulipchat.com/#narrow/stream/260048-signatures + +[//]: # (links) + +[RustCrypto]: https://github.com/RustCrypto diff --git a/bign-genk/src/ct.rs b/bign-genk/src/ct.rs new file mode 100644 index 00000000..b6b0d5ea --- /dev/null +++ b/bign-genk/src/ct.rs @@ -0,0 +1,82 @@ +//! Constant-time helpers. +// TODO(tarcieri): replace this with `crypto-bigint`? + +use subtle::{Choice, ConditionallySelectable, ConstantTimeEq}; + +/// Constant-time test that a given byte slice contains only zeroes. +#[inline] +pub(crate) fn is_zero(n: &[u8]) -> Choice { + let mut ret = Choice::from(1); + + for byte in n { + ret.conditional_assign(&Choice::from(0), byte.ct_ne(&0)); + } + + ret +} + +/// Constant-time less than. +/// +/// Inputs are interpreted as little endian integers. +pub(crate) fn lt(a: &[u8], b: &[u8]) -> Choice { + debug_assert_eq!(a.len(), b.len()); + + let mut borrow = 0u16; + + for (a_byte, b_byte) in a.iter().zip(b.iter()) { + let diff = (*a_byte as u16) + .wrapping_sub(*b_byte as u16) + .wrapping_sub(borrow); + + borrow = (diff >> 8) & 1; + } + + Choice::from(borrow as u8) +} + +#[cfg(test)] +mod tests { + const A: [u8; 4] = [0, 0, 0, 0]; + const B: [u8; 4] = [0, 0, 0, 1]; + const C: [u8; 4] = [0xFF, 0, 0, 0]; + const D: [u8; 4] = [0xFF, 0, 0, 1]; + const E: [u8; 4] = [0xFF, 0xFF, 0xFF, 0xFE]; + const F: [u8; 4] = [0xFF, 0xFF, 0xFF, 0xFF]; + + #[test] + fn ct_is_zero() { + use super::is_zero; + assert_eq!(is_zero(&A).unwrap_u8(), 1); + assert_eq!(is_zero(&B).unwrap_u8(), 0); + } + + #[test] + fn ct_lt() { + use super::lt; + + assert_eq!(lt(&A, &A).unwrap_u8(), 0); + assert_eq!(lt(&B, &B).unwrap_u8(), 0); + assert_eq!(lt(&C, &C).unwrap_u8(), 0); + assert_eq!(lt(&D, &D).unwrap_u8(), 0); + assert_eq!(lt(&E, &E).unwrap_u8(), 0); + assert_eq!(lt(&F, &F).unwrap_u8(), 0); + + assert_eq!(lt(&A, &B).unwrap_u8(), 1); + assert_eq!(lt(&A, &C).unwrap_u8(), 1); + assert_eq!(lt(&B, &A).unwrap_u8(), 0); + assert_eq!(lt(&C, &A).unwrap_u8(), 0); + + assert_eq!(lt(&C, &B).unwrap_u8(), 1); + assert_eq!(lt(&B, &D).unwrap_u8(), 1); + assert_eq!(lt(&B, &C).unwrap_u8(), 0); + assert_eq!(lt(&D, &B).unwrap_u8(), 0); + + assert_eq!(lt(&C, &D).unwrap_u8(), 1); + assert_eq!(lt(&C, &E).unwrap_u8(), 1); + assert_eq!(lt(&D, &C).unwrap_u8(), 0); + assert_eq!(lt(&E, &C).unwrap_u8(), 0); + + assert_eq!(lt(&E, &F).unwrap_u8(), 1); + assert_eq!(lt(&F, &E).unwrap_u8(), 0); + } +} diff --git a/bign-genk/src/lib.rs b/bign-genk/src/lib.rs new file mode 100644 index 00000000..25bac417 --- /dev/null +++ b/bign-genk/src/lib.rs @@ -0,0 +1,234 @@ +#![no_std] +#![doc = include_str!("../README.md")] +#![forbid(unsafe_code, clippy::unwrap_used)] +#![warn(missing_docs, rust_2018_idioms, unreachable_pub)] +#![doc( + html_logo_url = "https://raw.githubusercontent.com/RustCrypto/media/8f1a9894/logo.svg", + html_favicon_url = "https://raw.githubusercontent.com/RustCrypto/media/8f1a9894/logo.svg" +)] + +//! ## Usage +//! +//! See also: the documentation for the [`generate_k`] function. +//! +//! ``` +//! use hex_literal::hex; +//! use bign_genk::consts::U32; +//! use belt_hash::{Digest, BeltHash}; +//! use belt_block::BeltBlock; +//! +//! // BIGN P-256 field modulus +//! const BIGNP256_MODULUS: [u8; 32] = +//! hex!("FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF C95E2EAB 40309C49 56129C2E F129D6CC"); +//! +//! // Public key for STB 34.101.45 Bign P256/BeltHash test case +//! const KEY: [u8; 32] = +//! hex!("1F66B5B8 4B733967 4533F032 9C74F218 34281FED 0732429E 0C79235F C273E269"); +//! +//! // Test message for STB 34.101.45 Bign P256/BeltHash test case +//! const MSG: [u8; 13] = +//! hex!("B194BAC8 0A08F53B 366D008E 58"); +//! +//! // Expected K for STB 34.101.45 Bign P256/BeltHash test case +//! const EXPECTED_K: [u8; 32] = +//! hex!("829614D8 411DBBC4 E1F2471A 40045864 40FD8C95 53FAB6A1 A45CE417 AE97111E"); +//! +//! let h = BeltHash::digest(MSG); +//! let k = bign_genk::generate_k::( +//! &KEY.into(), +//! &BIGNP256_MODULUS.into(), +//! &h, +//! &[], +//! ); +//! assert_eq!(k.as_slice(), &EXPECTED_K); +//! ``` + +pub use cipher::Array; +pub use cipher::typenum::consts; + +use cipher::{BlockCipherEncrypt, BlockSizeUser, KeyInit, array::ArraySize, typenum::Unsigned}; +use digest::Digest; +use digest::const_oid::AssociatedOid; + +mod ct; + +type BlockArray = <::BlockSize as ArraySize>::ArrayType; + +/// Deterministically generate ephemeral scalar `k`. +/// +/// Accepts the following parameters and inputs: +/// +/// - `x`: secret key +/// - `q`: field modulus +/// - `h`: hash/digest of an input message: must be reduced modulo `q` in advance +/// - `data`: additional associated data, e.g., CSRNG output used as added entropy +#[inline] +pub fn generate_k( + x: &Array, + q: &Array, + h: &Array, + data: &[u8], +) -> Array +where + D: BlockSizeUser + Clone + Digest + AssociatedOid, + C: BlockSizeUser + Clone + BlockCipherEncrypt + KeyInit, + N: ArraySize, + BlockArray: Copy, +{ + let mut k = Array::default(); + generate_k_mut::(x, q, h, data, &mut k); + k +} + +/// Deterministically generate ephemeral scalar `k` by writing it into the provided output buffer. +/// +/// This is an API that accepts dynamically sized inputs intended for use cases where the sizes +/// are determined at runtime, such as the legacy Digital Signature Algorithm (DSA). +/// +/// Accepts the following parameters and inputs: +/// +/// - `x`: secret key +/// - `q`: field modulus +/// - `h`: hash/digest of an input message: must be reduced modulo `q` in advance +/// - `data`: additional associated data, e.g., CSRNG output used as added entropy +#[inline] +pub fn generate_k_mut(x: &[u8], q: &[u8], h: &[u8], data: &[u8], k: &mut [u8]) +where + D: BlockSizeUser + Clone + Digest + AssociatedOid, + C: BlockSizeUser + Clone + BlockCipherEncrypt + KeyInit, + BlockArray: Copy, +{ + let len = k.len(); + assert_eq!(len, x.len()); + assert_eq!(len, q.len()); + assert_eq!(len, h.len()); + assert!(len == 32 || len == 48 || len == 64); + + // n = ℓ/64 (2, 3 or 4) + let n = len / C::BlockSize::USIZE; + + // 2: θ ← belt-hash(OID(h) ‖ ⟨d⟩ ‖ t) + let mut hasher: D = Digest::new(); + + hasher.update([0x06, (D::OID.len() - 1) as u8]); + hasher.update(D::OID); + hasher.update(x); + hasher.update(data); + let theta = hasher.finalize(); + + // belt-block(θ) + let cipher = C::new_from_slice(&theta).expect("Invalid key length"); + + // 3. r ← H + // r = r₁ ‖ r₂ ‖ ... ‖ r_n, where r_i ∈ {0,1}^128 + let mut r = [Array::::default(); 4]; + for (i, chunk) in h.chunks(C::BlockSize::USIZE).enumerate().take(n) { + r[i][..chunk.len()].copy_from_slice(chunk); + } + + // 4. + let mut i = 1u32; + loop { + let s = match n { + 2 => { + // 4.1) s ← r₁ + r[0] + } + 3 => { + // 4.2.a) s ← r₁ ⊕ r₂ + let s = xor_blocks::(&r[0], &r[1]); + // 4.2.b) r₁ ← r₂ + r[0] = r[1]; + s + } + 4 => { + // 4.3.a) s ← r₁ ⊕ r₂ ⊕ r₃ + let mut s = xor_blocks::(&r[0], &r[1]); + xor_assign(&mut s, &r[2]); + // 4.3.b) r₁ ← r₂ + r[0] = r[1]; + // 4.3.c) r₂ ← r₃ + r[1] = r[2]; + s + } + _ => unreachable!(), + }; + + // 4.4: r_(n-1) ← belt-block(s, θ) ⊕ r_n ⊕ ⟨i⟩_128 + let mut encrypted = s; + cipher.encrypt_block(&mut encrypted); + + // ⊕ r_n + xor_assign(&mut encrypted, &r[n - 1]); + + // ⊕ ⟨i⟩_128 + xor_assign(&mut encrypted, &i.to_le_bytes()); + + // r_(n-1) + r[n - 2] = encrypted; + + // 4.5: r_n ← s + r[n - 1] = s; + + // 4.6: Check every 2n iterations + if i % (2 * n as u32) == 0 { + for (j, chunk) in r.iter().enumerate().take(n) { + k[j * C::BlockSize::USIZE..(j + 1) * C::BlockSize::USIZE].copy_from_slice(chunk); + } + + // Assert: k ∈ {1, 2, ..., q-1} + if (!ct::is_zero(k) & ct::lt(k, q)).into() { + return; // 5-6: k ← r, return + } + } + + i = i.wrapping_add(1); + } +} + +/// XOR two blocks of arbitrary size +#[inline] +fn xor_blocks( + a: &Array, + b: &Array, +) -> Array +where + C: BlockSizeUser, + BlockArray: Copy, +{ + let mut result = *a; + xor_assign(&mut result, b); + result +} + +/// XOR-assignment +#[inline] +fn xor_assign(a: &mut [u8], b: &[u8]) { + for (a_byte, b_byte) in a.iter_mut().zip(b.iter()) { + *a_byte ^= b_byte; + } +} + +#[cfg(test)] +mod tests { + use super::*; + use belt_block::{BeltBlock, cipher::typenum::U32}; + use belt_hash::BeltHash; + use hex_literal::hex; + + /// Table 7 appendix G STB 34.101.45 + #[test] + fn stb_table_g7() { + let d = hex!("1F66B5B8 4B733967 4533F032 9C74F218 34281FED 0732429E 0C79235F C273E269"); + let q = hex!("FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF C95E2EAB 40309C49 56129C2E F129D6CC"); + let h = hex!("9D02EE44 6FB6A29F E5C982D4 B13AF9D3 E90861BC 4CEF27CF 306BFB0B 174A154A"); + let t = hex!("BE329713 43FC9A48 A02A885F 194B09A1 7ECDA4D0 1544AF"); + + let expected_k = + hex!("7ADC8713 283EBFA5 47A2AD9C DFB245AE 0F7B968D F0F91CB7 85D1F932 A3583107"); + + let k = generate_k::(&d.into(), &q.into(), &h.into(), &t); + + assert_eq!(k.as_slice(), &expected_k); + } +}