From aeda3dd5433dee9ea38281ab26ccb0e1379f9552 Mon Sep 17 00:00:00 2001 From: Alexandr Kitaev Date: Fri, 21 Nov 2025 18:04:54 +0300 Subject: [PATCH 1/5] `stb340145`: Initial implementation --- .github/workflows/stb3410145.yml | 55 +++++++ Cargo.lock | 37 +++++ Cargo.toml | 2 + stb3410145/CHANGELOG.md | 9 ++ stb3410145/Cargo.toml | 26 ++++ stb3410145/LICENSE-APACHE | 201 ++++++++++++++++++++++++ stb3410145/LICENSE-MIT | 25 +++ stb3410145/README.md | 55 +++++++ stb3410145/src/ct.rs | 82 ++++++++++ stb3410145/src/lib.rs | 256 +++++++++++++++++++++++++++++++ 10 files changed, 748 insertions(+) create mode 100644 .github/workflows/stb3410145.yml create mode 100644 stb3410145/CHANGELOG.md create mode 100644 stb3410145/Cargo.toml create mode 100644 stb3410145/LICENSE-APACHE create mode 100644 stb3410145/LICENSE-MIT create mode 100644 stb3410145/README.md create mode 100644 stb3410145/src/ct.rs create mode 100644 stb3410145/src/lib.rs diff --git a/.github/workflows/stb3410145.yml b/.github/workflows/stb3410145.yml new file mode 100644 index 00000000..805089d7 --- /dev/null +++ b/.github/workflows/stb3410145.yml @@ -0,0 +1,55 @@ +name: stb3410145 +on: + pull_request: + paths: + - "stb3410145/**" + - "Cargo.*" + push: + branches: master + +defaults: + run: + working-directory: stb3410145 + +env: + CARGO_INCREMENTAL: 0 + RUSTFLAGS: "-Dwarnings" + +# Cancels CI jobs when new commits are pushed to a PR branch +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + +jobs: + build: + runs-on: ubuntu-latest + strategy: + matrix: + target: + - thumbv7em-none-eabi + - wasm32-unknown-unknown + rust: + - 1.85.0 # MSRV + - stable + steps: + - uses: actions/checkout@v5 + - uses: dtolnay/rust-toolchain@master + with: + toolchain: ${{ matrix.rust }} + targets: ${{ matrix.target }} + - run: cargo build --no-default-features --release --target ${{ matrix.target }} + + test: + runs-on: ubuntu-latest + strategy: + matrix: + rust: + - 1.85.0 # MSRV + - stable + steps: + - uses: actions/checkout@v5 + - uses: dtolnay/rust-toolchain@master + with: + toolchain: ${{ matrix.rust }} + - run: cargo check --all-features + - run: cargo test diff --git a/Cargo.lock b/Cargo.lock index 704b3c8a..e19a0961 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -52,6 +52,31 @@ version = "1.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "55248b47b0caf0546f7988906588779981c43bb1bc9d0c44087278f80cdb44ba" +[[package]] +name = "belt-block" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d9aa1eef3994e2ccd304a78fe3fea4a73e5792007f85f09b79bb82143ca5f82b" + +[[package]] +name = "belt-block" +version = "0.2.0-rc.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e34d9cc93a6506887eed92e4e9459c13469eee4ef2b2af305a182ebf53e4d6a3" +dependencies = [ + "cipher", +] + +[[package]] +name = "belt-hash" +version = "0.2.0-rc.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c4d0d625c21e8e5ca317b31568d257c4af4e93fd5a756d0301f5d517951ea6fd" +dependencies = [ + "belt-block 0.1.2", + "digest", +] + [[package]] name = "bincode" version = "1.3.3" @@ -1134,6 +1159,18 @@ version = "1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f" +[[package]] +name = "stb3410145" +version = "0.5.0-rc.3" +dependencies = [ + "belt-block 0.2.0-rc.2", + "belt-hash", + "cipher", + "digest", + "hex-literal", + "subtle", +] + [[package]] name = "subtle" version = "2.6.1" diff --git a/Cargo.toml b/Cargo.toml index 4a211d8d..8ac6baf1 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -9,6 +9,7 @@ members = [ "ml-dsa", "rfc6979", "slh-dsa", + "stb3410145", ] [profile.dev] @@ -25,6 +26,7 @@ lms-signature = { path = "./lms" } ml-dsa = { path = "./ml-dsa" } rfc6979 = { path = "./rfc6979" } slh-dsa = { path = "./slh-dsa" } +stb3410145 = { path = "./stb3410145" } elliptic-curve = { git = "https://github.com/RustCrypto/traits" } ff = { git = "https://github.com/tarcieri/ff", branch = "rand_core/v0.10.0-rc-2" } diff --git a/stb3410145/CHANGELOG.md b/stb3410145/CHANGELOG.md new file mode 100644 index 00000000..4509a218 --- /dev/null +++ b/stb3410145/CHANGELOG.md @@ -0,0 +1,9 @@ +# Changelog +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +### 0.5.0 () +- Initial release + diff --git a/stb3410145/Cargo.toml b/stb3410145/Cargo.toml new file mode 100644 index 00000000..3793283b --- /dev/null +++ b/stb3410145/Cargo.toml @@ -0,0 +1,26 @@ +[package] +name = "stb3410145" +version = "0.5.0-rc.3" +description = """ +Pure Rust implementation of STB 34.101.45: Deterministic Usage of the +Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA) +""" +authors = ["RustCrypto Developers"] +license = "Apache-2.0 OR MIT" +homepage = "https://github.com/RustCrypto/signatures/tree/master/stb3410145" +repository = "https://github.com/RustCrypto/signatures" +readme = "README.md" +categories = ["cryptography", "no-std"] +keywords = ["dsa", "ecdsa", "signature", "bign"] +edition = "2024" +rust-version = "1.85" + +[dependencies] +cipher = { version = "0.5.0-rc.2", default-features = false } +digest = { version = "0.11.0-rc.4", default-features = false, features = ["oid"] } +subtle = { version = "2", default-features = false } + +[dev-dependencies] +hex-literal = "1" +belt-block = "0.2.0-rc.2" +belt-hash = "0.2.0-rc.2" diff --git a/stb3410145/LICENSE-APACHE b/stb3410145/LICENSE-APACHE new file mode 100644 index 00000000..7a9175be --- /dev/null +++ b/stb3410145/LICENSE-APACHE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + +TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + +1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + +2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + +3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + +4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + +5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + +6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + +7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + +8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + +9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + +END OF TERMS AND CONDITIONS + +APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + +Copyright 2018-2025 RustCrypto Developers + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/stb3410145/LICENSE-MIT b/stb3410145/LICENSE-MIT new file mode 100644 index 00000000..d767644d --- /dev/null +++ b/stb3410145/LICENSE-MIT @@ -0,0 +1,25 @@ +Copyright (c) 2018-2025 RustCrypto Developers + +Permission is hereby granted, free of charge, to any +person obtaining a copy of this software and associated +documentation files (the "Software"), to deal in the +Software without restriction, including without +limitation the rights to use, copy, modify, merge, +publish, distribute, sublicense, and/or sell copies of +the Software, and to permit persons to whom the Software +is furnished to do so, subject to the following +conditions: + +The above copyright notice and this permission notice +shall be included in all copies or substantial portions +of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF +ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED +TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A +PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT +SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR +IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +DEALINGS IN THE SOFTWARE. diff --git a/stb3410145/README.md b/stb3410145/README.md new file mode 100644 index 00000000..d061db7b --- /dev/null +++ b/stb3410145/README.md @@ -0,0 +1,55 @@ +# [RustCrypto]: STB 34.101.45 Deterministic Signatures + +[![crate][crate-image]][crate-link] +[![Docs][docs-image]][docs-link] +[![Build Status][build-image]][build-link] +![Apache2/MIT licensed][license-image] +![MSRV][rustc-image] +[![Project Chat][chat-image]][chat-link] + +Pure Rust implementation of STB 34.101.45: Deterministic Usage of the +Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA). + +Algorithm described in STB 34.101.45-2013 § 6.3: + + +[Documentation][docs-link] + +## Minimum Supported Rust Version + +This crate requires **Rust 1.85** at a minimum. + +We may change the MSRV in the future, but it will be accompanied by a minor +version bump. + +## License + +All crates licensed under either of + + * [Apache License, Version 2.0](https://www.apache.org/licenses/LICENSE-2.0) + * [MIT license](https://opensource.org/licenses/MIT) + +at your option. + +### Contribution + +Unless you explicitly state otherwise, any contribution intentionally submitted +for inclusion in the work by you, as defined in the Apache-2.0 license, shall be +dual licensed as above, without any additional terms or conditions. + +[//]: # (badges) + +[crate-image]: https://img.shields.io/crates/v/stb3410145?logo=rust +[crate-link]: https://crates.io/crates/stb3410145 +[docs-image]: https://docs.rs/stb3410145/badge.svg +[docs-link]: https://docs.rs/stb3410145/ +[build-image]: https://github.com/RustCrypto/signatures/actions/workflows/stb3410145.yml/badge.svg +[build-link]: https://github.com/RustCrypto/signatures/actions/workflows/stb3410145.yml +[license-image]: https://img.shields.io/badge/license-Apache2.0/MIT-blue.svg +[rustc-image]: https://img.shields.io/badge/rustc-1.85+-blue.svg +[chat-image]: https://img.shields.io/badge/zulip-join_chat-blue.svg +[chat-link]: https://rustcrypto.zulipchat.com/#narrow/stream/260048-signatures + +[//]: # (links) + +[RustCrypto]: https://github.com/RustCrypto diff --git a/stb3410145/src/ct.rs b/stb3410145/src/ct.rs new file mode 100644 index 00000000..b6b0d5ea --- /dev/null +++ b/stb3410145/src/ct.rs @@ -0,0 +1,82 @@ +//! Constant-time helpers. +// TODO(tarcieri): replace this with `crypto-bigint`? + +use subtle::{Choice, ConditionallySelectable, ConstantTimeEq}; + +/// Constant-time test that a given byte slice contains only zeroes. +#[inline] +pub(crate) fn is_zero(n: &[u8]) -> Choice { + let mut ret = Choice::from(1); + + for byte in n { + ret.conditional_assign(&Choice::from(0), byte.ct_ne(&0)); + } + + ret +} + +/// Constant-time less than. +/// +/// Inputs are interpreted as little endian integers. +pub(crate) fn lt(a: &[u8], b: &[u8]) -> Choice { + debug_assert_eq!(a.len(), b.len()); + + let mut borrow = 0u16; + + for (a_byte, b_byte) in a.iter().zip(b.iter()) { + let diff = (*a_byte as u16) + .wrapping_sub(*b_byte as u16) + .wrapping_sub(borrow); + + borrow = (diff >> 8) & 1; + } + + Choice::from(borrow as u8) +} + +#[cfg(test)] +mod tests { + const A: [u8; 4] = [0, 0, 0, 0]; + const B: [u8; 4] = [0, 0, 0, 1]; + const C: [u8; 4] = [0xFF, 0, 0, 0]; + const D: [u8; 4] = [0xFF, 0, 0, 1]; + const E: [u8; 4] = [0xFF, 0xFF, 0xFF, 0xFE]; + const F: [u8; 4] = [0xFF, 0xFF, 0xFF, 0xFF]; + + #[test] + fn ct_is_zero() { + use super::is_zero; + assert_eq!(is_zero(&A).unwrap_u8(), 1); + assert_eq!(is_zero(&B).unwrap_u8(), 0); + } + + #[test] + fn ct_lt() { + use super::lt; + + assert_eq!(lt(&A, &A).unwrap_u8(), 0); + assert_eq!(lt(&B, &B).unwrap_u8(), 0); + assert_eq!(lt(&C, &C).unwrap_u8(), 0); + assert_eq!(lt(&D, &D).unwrap_u8(), 0); + assert_eq!(lt(&E, &E).unwrap_u8(), 0); + assert_eq!(lt(&F, &F).unwrap_u8(), 0); + + assert_eq!(lt(&A, &B).unwrap_u8(), 1); + assert_eq!(lt(&A, &C).unwrap_u8(), 1); + assert_eq!(lt(&B, &A).unwrap_u8(), 0); + assert_eq!(lt(&C, &A).unwrap_u8(), 0); + + assert_eq!(lt(&C, &B).unwrap_u8(), 1); + assert_eq!(lt(&B, &D).unwrap_u8(), 1); + assert_eq!(lt(&B, &C).unwrap_u8(), 0); + assert_eq!(lt(&D, &B).unwrap_u8(), 0); + + assert_eq!(lt(&C, &D).unwrap_u8(), 1); + assert_eq!(lt(&C, &E).unwrap_u8(), 1); + assert_eq!(lt(&D, &C).unwrap_u8(), 0); + assert_eq!(lt(&E, &C).unwrap_u8(), 0); + + assert_eq!(lt(&E, &F).unwrap_u8(), 1); + assert_eq!(lt(&F, &E).unwrap_u8(), 0); + } +} diff --git a/stb3410145/src/lib.rs b/stb3410145/src/lib.rs new file mode 100644 index 00000000..6c82c21c --- /dev/null +++ b/stb3410145/src/lib.rs @@ -0,0 +1,256 @@ +#![no_std] +#![doc = include_str!("../README.md")] +#![forbid(unsafe_code, clippy::unwrap_used)] +#![warn(missing_docs, rust_2018_idioms, unreachable_pub)] +#![doc( + html_logo_url = "https://raw.githubusercontent.com/RustCrypto/media/8f1a9894/logo.svg", + html_favicon_url = "https://raw.githubusercontent.com/RustCrypto/media/8f1a9894/logo.svg" +)] + +//! ## Usage +//! +//! See also: the documentation for the [`generate_k`] function. +//! +//! ``` +//! use hex_literal::hex; +//! use stb3410145::consts::U32; +//! use belt_hash::{Digest, BeltHash}; +//! use belt_block::BeltBlock; +//! +//! // BIGN P-256 field modulus little endian +//! const STB3410145_BIGNP256_MODULUS: [u8; 32] = +//! hex!("07663D26 99BF5A7E FC4DFB0D D68E5CD9 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF"); +//! +//! // Public key for STB 34.101.45 Bign P256/BeltHash test case +//! const STB3410145_KEY: [u8; 32] = +//! hex!("1F66B5B8 4B733967 4533F032 9C74F218 34281FED 0732429E 0C79235F C273E269"); +//! +//! // Test message for STB 34.101.45 Bign P256/BeltHash test case +//! const STB3410145_MSG: [u8; 13] = +//! hex!("B194BAC8 0A08F53B 366D008E 58"); +//! +//! // Expected K for STB 34.101.45 Bign P256/BeltHash test case +//! const STB3410145_EXPECTED_K: [u8; 32] = +//! hex!("829614D8 411DBBC4 E1F2471A 40045864 40FD8C95 53FAB6A1 A45CE417 AE97111E"); +//! +//! let h = BeltHash::digest(STB3410145_MSG); +//! let aad = b""; +//! let k = stb3410145::generate_k::(&STB3410145_KEY.into(), &STB3410145_BIGNP256_MODULUS.into(), &h, &[]); +//! assert_eq!(k.as_slice(), &STB3410145_EXPECTED_K); +//! ``` + +pub use cipher::Array; +pub use cipher::typenum::consts; + +use cipher::{BlockCipherEncrypt, BlockSizeUser, KeyInit, array::ArraySize, typenum::Unsigned}; +use digest::Digest; +use digest::const_oid::AssociatedOid; + +mod ct; + +type BlockArray = <::BlockSize as ArraySize>::ArrayType; + +/// Deterministically generate ephemeral scalar `k`. +/// +/// Accepts the following parameters and inputs: +/// +/// - `x`: secret key +/// - `q`: field modulus +/// - `h`: hash/digest of an input message: must be reduced modulo `q` in advance +/// - `data`: additional associated data, e.g., CSRNG output used as added entropy +#[inline] +pub fn generate_k( + x: &Array, + q: &Array, + h: &Array, + data: &[u8], +) -> Array +where + D: BlockSizeUser + Clone + Digest + AssociatedOid, + C: BlockSizeUser + Clone + BlockCipherEncrypt + KeyInit, + N: ArraySize, + BlockArray: Copy, +{ + let mut k = Array::default(); + generate_k_mut::(x, q, h, data, &mut k); + k +} + +/// Deterministically generate ephemeral scalar `k` by writing it into the provided output buffer. +/// +/// This is an API that accepts dynamically sized inputs intended for use cases where the sizes +/// are determined at runtime, such as the legacy Digital Signature Algorithm (DSA). +/// +/// Accepts the following parameters and inputs: +/// +/// - `x`: secret key +/// - `q`: field modulus +/// - `h`: hash/digest of an input message: must be reduced modulo `q` in advance +/// - `data`: additional associated data, e.g., CSRNG output used as added entropy +#[inline] +pub fn generate_k_mut(x: &[u8], q: &[u8], h: &[u8], data: &[u8], k: &mut [u8]) +where + D: BlockSizeUser + Clone + Digest + AssociatedOid, + C: BlockSizeUser + Clone + BlockCipherEncrypt + KeyInit, + BlockArray: Copy, +{ + let len = k.len(); + assert_eq!(len, x.len()); + assert_eq!(len, q.len()); + assert_eq!(len, h.len()); + assert!(len == 32 || len == 48 || len == 64); + + // n = ℓ/64 (2, 3 or 4) + let n = len / C::BlockSize::USIZE; + + // 2: θ ← belt-hash(OID(h) ‖ ⟨d⟩ ‖ t) + let mut hasher: D = Digest::new(); + + hasher.update([0x06, (D::OID.len() - 1) as u8]); + hasher.update(D::OID); + hasher.update(x); + hasher.update(data); + let theta = hasher.finalize(); + + // belt-block(θ) + let cipher = C::new_from_slice(&theta).expect("Invalid key length"); + + // 3. r ← H + // r = r₁ ‖ r₂ ‖ ... ‖ r_n, where r_i ∈ {0,1}^128 + let mut r = [Array::::default(); 4]; + for (i, chunk) in h.chunks(C::BlockSize::USIZE).enumerate().take(n) { + r[i][..chunk.len()].copy_from_slice(chunk); + } + + // 4. + let mut i = 1u32; + loop { + let s = match n { + 2 => { + // 4.1) s ← r₁ + r[0] + } + 3 => { + // 4.2.a) s ← r₁ ⊕ r₂ + let s = xor_blocks::(&r[0], &r[1]); + // 4.2.b) r₁ ← r₂ + r[0] = r[1]; + s + } + 4 => { + // 4.3.a) s ← r₁ ⊕ r₂ ⊕ r₃ + let mut s = xor_blocks::(&r[0], &r[1]); + xor_assign(&mut s, &r[2]); + // 4.3.b) r₁ ← r₂ + r[0] = r[1]; + // 4.3.c) r₂ ← r₃ + r[1] = r[2]; + s + } + _ => unreachable!(), + }; + + // 4.4: r_(n-1) ← belt-block(s, θ) ⊕ r_n ⊕ ⟨i⟩_128 + let mut encrypted = s; + cipher.encrypt_block(&mut encrypted); + + // ⊕ r_n + xor_assign(&mut encrypted, &r[n - 1]); + + // ⊕ ⟨i⟩_128 + xor_assign(&mut encrypted, &i.to_le_bytes()); + + // r_(n-1) + r[n - 2] = encrypted; + + // 4.5: r_n ← s + r[n - 1] = s; + + // 4.6: Check every 2n iterations + if i % (2 * n as u32) == 0 { + for (j, chunk) in r.iter().enumerate().take(n) { + k[j * C::BlockSize::USIZE..(j + 1) * C::BlockSize::USIZE].copy_from_slice(chunk); + } + + // Assert: k ∈ {1, 2, ..., q-1} + if (!ct::is_zero(k) & ct::lt(k, q)).into() { + return; // 5-6: k ← r, return + } + } + + i = i.wrapping_add(1); + } +} + +/// XOR two blocks of arbitrary size +#[inline] +fn xor_blocks( + a: &Array, + b: &Array, +) -> Array +where + C: BlockSizeUser, + BlockArray: Copy, +{ + let mut result = *a; + xor_assign(&mut result, b); + result +} + +/// XOR-assignment +#[inline] +fn xor_assign(a: &mut [u8], b: &[u8]) { + for (a_byte, b_byte) in a.iter_mut().zip(b.iter()) { + *a_byte ^= b_byte; + } +} + +#[cfg(test)] +mod tests { + use super::*; + use belt_block::{BeltBlock, cipher::typenum::U32}; + use belt_hash::BeltHash; + use hex_literal::hex; + + /// Table 6 appendix G STB 34.101.45 + #[test] + fn stb_table_g6() { + let d = hex!("1F66B5B8 4B733967 4533F032 9C74F218 34281FED 0732429E 0C79235F C273E269"); + let q = hex!("FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF C95E2EAB 40309C49 56129C2E F129D6CC"); + let h = hex!("ABEF9725 D4C5A835 97A367D1 4494CC25 42F20F65 9DDFECC9 61A3EC55 0CBA8C75"); + + let expected_k = + hex!("829614D8 411DBBC4 E1F2471A 40045864 40FD8C95 53FAB6A1 A45CE417 AE97111E"); + + let k = generate_k::(&d.into(), &q.into(), &h.into(), &[]); + + assert_eq!(k.as_slice(), &expected_k); + } + + /// Table 7 appendix G STB 34.101.45 + #[test] + fn stb_table_g7() { + let d = hex!( + "1F66B5B8 4B733967 4533F032 9C74F218" + "34281FED 0732429E 0C79235F C273E269" + ); + let q = hex!( + "FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF" + "C95E2EAB 40309C49 56129C2E F129D6CC" + ); + let h = hex!( + "9D02EE44 6FB6A29F E5C982D4 B13AF9D3" + "E90861BC 4CEF27CF 306BFB0B 174A154A" + ); + let t = hex!("BE329713 43FC9A48 A02A885F 194B09A1 7ECDA4D0 1544AF"); + + let expected_k = hex!( + "7ADC8713 283EBFA5 47A2AD9C DFB245AE" + "0F7B968D F0F91CB7 85D1F932 A3583107" + ); + + let k = generate_k::(&d.into(), &q.into(), &h.into(), &t); + + assert_eq!(k.as_slice(), &expected_k); + } +} From e58a0ca60371e5146772d630e368c7718803016d Mon Sep 17 00:00:00 2001 From: Alexandr Kitaev Date: Fri, 21 Nov 2025 18:19:34 +0300 Subject: [PATCH 2/5] `stb340145`: Add PR to CHANGELOG.md --- stb3410145/CHANGELOG.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/stb3410145/CHANGELOG.md b/stb3410145/CHANGELOG.md index 4509a218..c0e2b5b9 100644 --- a/stb3410145/CHANGELOG.md +++ b/stb3410145/CHANGELOG.md @@ -4,6 +4,7 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). -### 0.5.0 () +### 0.5.0 (XXXX-XX-XX) - Initial release +[#1109](https://github.com/RustCrypto/signatures/pull/1109) \ No newline at end of file From 90973ea89fe01fa2414945c7bedf665cb1727ffb Mon Sep 17 00:00:00 2001 From: Alexandr Kitaev Date: Fri, 21 Nov 2025 18:26:02 +0300 Subject: [PATCH 3/5] `stb340145`: Move table 6 to doctest --- stb3410145/src/lib.rs | 41 +++++++---------------------------------- 1 file changed, 7 insertions(+), 34 deletions(-) diff --git a/stb3410145/src/lib.rs b/stb3410145/src/lib.rs index 6c82c21c..31f98a79 100644 --- a/stb3410145/src/lib.rs +++ b/stb3410145/src/lib.rs @@ -17,9 +17,9 @@ //! use belt_hash::{Digest, BeltHash}; //! use belt_block::BeltBlock; //! -//! // BIGN P-256 field modulus little endian +//! // BIGN P-256 field modulus //! const STB3410145_BIGNP256_MODULUS: [u8; 32] = -//! hex!("07663D26 99BF5A7E FC4DFB0D D68E5CD9 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF"); +//! hex!("FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF C95E2EAB 40309C49 56129C2E F129D6CC"); //! //! // Public key for STB 34.101.45 Bign P256/BeltHash test case //! const STB3410145_KEY: [u8; 32] = @@ -34,7 +34,6 @@ //! hex!("829614D8 411DBBC4 E1F2471A 40045864 40FD8C95 53FAB6A1 A45CE417 AE97111E"); //! //! let h = BeltHash::digest(STB3410145_MSG); -//! let aad = b""; //! let k = stb3410145::generate_k::(&STB3410145_KEY.into(), &STB3410145_BIGNP256_MODULUS.into(), &h, &[]); //! assert_eq!(k.as_slice(), &STB3410145_EXPECTED_K); //! ``` @@ -212,42 +211,16 @@ mod tests { use belt_hash::BeltHash; use hex_literal::hex; - /// Table 6 appendix G STB 34.101.45 - #[test] - fn stb_table_g6() { - let d = hex!("1F66B5B8 4B733967 4533F032 9C74F218 34281FED 0732429E 0C79235F C273E269"); - let q = hex!("FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF C95E2EAB 40309C49 56129C2E F129D6CC"); - let h = hex!("ABEF9725 D4C5A835 97A367D1 4494CC25 42F20F65 9DDFECC9 61A3EC55 0CBA8C75"); - - let expected_k = - hex!("829614D8 411DBBC4 E1F2471A 40045864 40FD8C95 53FAB6A1 A45CE417 AE97111E"); - - let k = generate_k::(&d.into(), &q.into(), &h.into(), &[]); - - assert_eq!(k.as_slice(), &expected_k); - } - /// Table 7 appendix G STB 34.101.45 #[test] fn stb_table_g7() { - let d = hex!( - "1F66B5B8 4B733967 4533F032 9C74F218" - "34281FED 0732429E 0C79235F C273E269" - ); - let q = hex!( - "FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF" - "C95E2EAB 40309C49 56129C2E F129D6CC" - ); - let h = hex!( - "9D02EE44 6FB6A29F E5C982D4 B13AF9D3" - "E90861BC 4CEF27CF 306BFB0B 174A154A" - ); + let d = hex!("1F66B5B8 4B733967 4533F032 9C74F218 34281FED 0732429E 0C79235F C273E269"); + let q = hex!("FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF C95E2EAB 40309C49 56129C2E F129D6CC"); + let h = hex!("9D02EE44 6FB6A29F E5C982D4 B13AF9D3 E90861BC 4CEF27CF 306BFB0B 174A154A"); let t = hex!("BE329713 43FC9A48 A02A885F 194B09A1 7ECDA4D0 1544AF"); - let expected_k = hex!( - "7ADC8713 283EBFA5 47A2AD9C DFB245AE" - "0F7B968D F0F91CB7 85D1F932 A3583107" - ); + let expected_k = + hex!("7ADC8713 283EBFA5 47A2AD9C DFB245AE 0F7B968D F0F91CB7 85D1F932 A3583107"); let k = generate_k::(&d.into(), &q.into(), &h.into(), &t); From c3d2b6472a86b0e35b4927a159b6e6adcacd9974 Mon Sep 17 00:00:00 2001 From: Alexandr Kitaev Date: Fri, 21 Nov 2025 18:27:21 +0300 Subject: [PATCH 4/5] `stb340145`: Reformat doctest --- stb3410145/src/lib.rs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/stb3410145/src/lib.rs b/stb3410145/src/lib.rs index 31f98a79..89d019f7 100644 --- a/stb3410145/src/lib.rs +++ b/stb3410145/src/lib.rs @@ -34,7 +34,12 @@ //! hex!("829614D8 411DBBC4 E1F2471A 40045864 40FD8C95 53FAB6A1 A45CE417 AE97111E"); //! //! let h = BeltHash::digest(STB3410145_MSG); -//! let k = stb3410145::generate_k::(&STB3410145_KEY.into(), &STB3410145_BIGNP256_MODULUS.into(), &h, &[]); +//! let k = stb3410145::generate_k::( +//! &STB3410145_KEY.into(), +//! &STB3410145_BIGNP256_MODULUS.into(), +//! &h, +//! &[], +//! ); //! assert_eq!(k.as_slice(), &STB3410145_EXPECTED_K); //! ``` From f3057e61edfa03caefcad33bc907af0a4b631320 Mon Sep 17 00:00:00 2001 From: Alexandr Kitaev Date: Sun, 23 Nov 2025 18:46:36 +0300 Subject: [PATCH 5/5] Rename to `bign-genk`, according to specification --- .../{stb3410145.yml => bign-genk.yml} | 6 ++--- Cargo.lock | 24 +++++++++---------- Cargo.toml | 4 ++-- {stb3410145 => bign-genk}/CHANGELOG.md | 0 {stb3410145 => bign-genk}/Cargo.toml | 6 ++--- {stb3410145 => bign-genk}/LICENSE-APACHE | 0 {stb3410145 => bign-genk}/LICENSE-MIT | 0 {stb3410145 => bign-genk}/README.md | 14 +++++------ {stb3410145 => bign-genk}/src/ct.rs | 0 {stb3410145 => bign-genk}/src/lib.rs | 20 ++++++++-------- 10 files changed, 37 insertions(+), 37 deletions(-) rename .github/workflows/{stb3410145.yml => bign-genk.yml} (93%) rename {stb3410145 => bign-genk}/CHANGELOG.md (100%) rename {stb3410145 => bign-genk}/Cargo.toml (86%) rename {stb3410145 => bign-genk}/LICENSE-APACHE (100%) rename {stb3410145 => bign-genk}/LICENSE-MIT (100%) rename {stb3410145 => bign-genk}/README.md (82%) rename {stb3410145 => bign-genk}/src/ct.rs (100%) rename {stb3410145 => bign-genk}/src/lib.rs (93%) diff --git a/.github/workflows/stb3410145.yml b/.github/workflows/bign-genk.yml similarity index 93% rename from .github/workflows/stb3410145.yml rename to .github/workflows/bign-genk.yml index 805089d7..ce0bfba7 100644 --- a/.github/workflows/stb3410145.yml +++ b/.github/workflows/bign-genk.yml @@ -1,15 +1,15 @@ -name: stb3410145 +name: bign-genk on: pull_request: paths: - - "stb3410145/**" + - "bign-genk/**" - "Cargo.*" push: branches: master defaults: run: - working-directory: stb3410145 + working-directory: bign-genk env: CARGO_INCREMENTAL: 0 diff --git a/Cargo.lock b/Cargo.lock index e19a0961..672dd9c4 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -77,6 +77,18 @@ dependencies = [ "digest", ] +[[package]] +name = "bign-genk" +version = "0.5.0-rc.3" +dependencies = [ + "belt-block 0.2.0-rc.2", + "belt-hash", + "cipher", + "digest", + "hex-literal", + "subtle", +] + [[package]] name = "bincode" version = "1.3.3" @@ -1159,18 +1171,6 @@ version = "1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f" -[[package]] -name = "stb3410145" -version = "0.5.0-rc.3" -dependencies = [ - "belt-block 0.2.0-rc.2", - "belt-hash", - "cipher", - "digest", - "hex-literal", - "subtle", -] - [[package]] name = "subtle" version = "2.6.1" diff --git a/Cargo.toml b/Cargo.toml index 8ac6baf1..2e61b727 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,7 @@ [workspace] resolver = "2" members = [ + "bign-genk", "dsa", "ecdsa", "ed448", @@ -9,7 +10,6 @@ members = [ "ml-dsa", "rfc6979", "slh-dsa", - "stb3410145", ] [profile.dev] @@ -26,7 +26,7 @@ lms-signature = { path = "./lms" } ml-dsa = { path = "./ml-dsa" } rfc6979 = { path = "./rfc6979" } slh-dsa = { path = "./slh-dsa" } -stb3410145 = { path = "./stb3410145" } +bign-genk = { path = "./bign-genk" } elliptic-curve = { git = "https://github.com/RustCrypto/traits" } ff = { git = "https://github.com/tarcieri/ff", branch = "rand_core/v0.10.0-rc-2" } diff --git a/stb3410145/CHANGELOG.md b/bign-genk/CHANGELOG.md similarity index 100% rename from stb3410145/CHANGELOG.md rename to bign-genk/CHANGELOG.md diff --git a/stb3410145/Cargo.toml b/bign-genk/Cargo.toml similarity index 86% rename from stb3410145/Cargo.toml rename to bign-genk/Cargo.toml index 3793283b..dd7caf9a 100644 --- a/stb3410145/Cargo.toml +++ b/bign-genk/Cargo.toml @@ -1,13 +1,13 @@ [package] -name = "stb3410145" +name = "bign-genk" version = "0.5.0-rc.3" description = """ -Pure Rust implementation of STB 34.101.45: Deterministic Usage of the +Pure Rust implementation of bign-genk algorithm from STB 34.101.45: Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA) """ authors = ["RustCrypto Developers"] license = "Apache-2.0 OR MIT" -homepage = "https://github.com/RustCrypto/signatures/tree/master/stb3410145" +homepage = "https://github.com/RustCrypto/signatures/tree/master/bign-genk" repository = "https://github.com/RustCrypto/signatures" readme = "README.md" categories = ["cryptography", "no-std"] diff --git a/stb3410145/LICENSE-APACHE b/bign-genk/LICENSE-APACHE similarity index 100% rename from stb3410145/LICENSE-APACHE rename to bign-genk/LICENSE-APACHE diff --git a/stb3410145/LICENSE-MIT b/bign-genk/LICENSE-MIT similarity index 100% rename from stb3410145/LICENSE-MIT rename to bign-genk/LICENSE-MIT diff --git a/stb3410145/README.md b/bign-genk/README.md similarity index 82% rename from stb3410145/README.md rename to bign-genk/README.md index d061db7b..9144d5bf 100644 --- a/stb3410145/README.md +++ b/bign-genk/README.md @@ -7,7 +7,7 @@ ![MSRV][rustc-image] [![Project Chat][chat-image]][chat-link] -Pure Rust implementation of STB 34.101.45: Deterministic Usage of the +Pure Rust implementation of `bign-genk` from STB 34.101.45: Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA). Algorithm described in STB 34.101.45-2013 § 6.3: @@ -39,12 +39,12 @@ dual licensed as above, without any additional terms or conditions. [//]: # (badges) -[crate-image]: https://img.shields.io/crates/v/stb3410145?logo=rust -[crate-link]: https://crates.io/crates/stb3410145 -[docs-image]: https://docs.rs/stb3410145/badge.svg -[docs-link]: https://docs.rs/stb3410145/ -[build-image]: https://github.com/RustCrypto/signatures/actions/workflows/stb3410145.yml/badge.svg -[build-link]: https://github.com/RustCrypto/signatures/actions/workflows/stb3410145.yml +[crate-image]: https://img.shields.io/crates/v/bign-genk?logo=rust +[crate-link]: https://crates.io/crates/bign-genk +[docs-image]: https://docs.rs/bign-genk/badge.svg +[docs-link]: https://docs.rs/bign-genk/ +[build-image]: https://github.com/RustCrypto/signatures/actions/workflows/bign-genk.yml/badge.svg +[build-link]: https://github.com/RustCrypto/signatures/actions/workflows/bign-genk.yml [license-image]: https://img.shields.io/badge/license-Apache2.0/MIT-blue.svg [rustc-image]: https://img.shields.io/badge/rustc-1.85+-blue.svg [chat-image]: https://img.shields.io/badge/zulip-join_chat-blue.svg diff --git a/stb3410145/src/ct.rs b/bign-genk/src/ct.rs similarity index 100% rename from stb3410145/src/ct.rs rename to bign-genk/src/ct.rs diff --git a/stb3410145/src/lib.rs b/bign-genk/src/lib.rs similarity index 93% rename from stb3410145/src/lib.rs rename to bign-genk/src/lib.rs index 89d019f7..25bac417 100644 --- a/stb3410145/src/lib.rs +++ b/bign-genk/src/lib.rs @@ -13,34 +13,34 @@ //! //! ``` //! use hex_literal::hex; -//! use stb3410145::consts::U32; +//! use bign_genk::consts::U32; //! use belt_hash::{Digest, BeltHash}; //! use belt_block::BeltBlock; //! //! // BIGN P-256 field modulus -//! const STB3410145_BIGNP256_MODULUS: [u8; 32] = +//! const BIGNP256_MODULUS: [u8; 32] = //! hex!("FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF C95E2EAB 40309C49 56129C2E F129D6CC"); //! //! // Public key for STB 34.101.45 Bign P256/BeltHash test case -//! const STB3410145_KEY: [u8; 32] = +//! const KEY: [u8; 32] = //! hex!("1F66B5B8 4B733967 4533F032 9C74F218 34281FED 0732429E 0C79235F C273E269"); //! //! // Test message for STB 34.101.45 Bign P256/BeltHash test case -//! const STB3410145_MSG: [u8; 13] = +//! const MSG: [u8; 13] = //! hex!("B194BAC8 0A08F53B 366D008E 58"); //! //! // Expected K for STB 34.101.45 Bign P256/BeltHash test case -//! const STB3410145_EXPECTED_K: [u8; 32] = +//! const EXPECTED_K: [u8; 32] = //! hex!("829614D8 411DBBC4 E1F2471A 40045864 40FD8C95 53FAB6A1 A45CE417 AE97111E"); //! -//! let h = BeltHash::digest(STB3410145_MSG); -//! let k = stb3410145::generate_k::( -//! &STB3410145_KEY.into(), -//! &STB3410145_BIGNP256_MODULUS.into(), +//! let h = BeltHash::digest(MSG); +//! let k = bign_genk::generate_k::( +//! &KEY.into(), +//! &BIGNP256_MODULUS.into(), //! &h, //! &[], //! ); -//! assert_eq!(k.as_slice(), &STB3410145_EXPECTED_K); +//! assert_eq!(k.as_slice(), &EXPECTED_K); //! ``` pub use cipher::Array;