Esempio n. 1
0
def test_construct_root():
    H = lambda x, y, i: x - y
    minus_tree = list(hash_tree(H, range(16)))
    for i in range(16):
        leaf = minus_tree[0][i]
        path = auth_path(minus_tree, i)
        assert construct_root(H, path, leaf, i) == minus_tree[-1][0]
Esempio n. 2
0
 def verify(self, m, sig, masks):
     assert len(m) == self.m // 8
     assert len(masks) >= 2 * self.tau
     M = self.message_indices(m)
     H = lambda x, y, i: self.H(xor(x, masks[2*i]), xor(y, masks[2*i+1]))
     sigma_k = sig[-1]
     for (sk, path), Mi in zip(sig, M):
         leaf = self.F(sk)
         r = construct_root(H, path, leaf, Mi)
         # there is an error in the SPHINCS paper for this formula, as it
         # states that y_i = floor(M_i / 2^tau - x)
         # rather than y_i = floor(M_i / 2^{tau - x})
         yi = Mi // (1 << (self.tau - self.x))
         if r != sigma_k[yi]:
             return False
     Qtop = masks[2*(self.tau - self.x):]
     H = lambda x, y, i: self.H(xor(x, Qtop[2*i]), xor(y, Qtop[2*i+1]))
     return root(hash_tree(H, sigma_k))
Esempio n. 3
0
 def verify(self, M, sig, PK):
     i, R1, sig_horst, *sig = sig
     PK1, Q = PK
     Qtree = Q[2 * ceil(log(self.wots.l, 2)):]
     D = self.Hdigest(R1, M)
     pk = pk_horst = self.horst.verify(D, sig_horst, Q)
     if pk_horst is False:
         return False
     subh = self.h // self.d
     H = lambda x, y, i: self.H(xor(x, Q[2*i]), xor(y, Q[2*i+1]))
     Ht = lambda x, y, i: self.H(xor(x, Qtree[2*i]), xor(y, Qtree[2*i+1]))
     for _ in range(self.d):
         wots_sig, wots_path, *sig = sig
         pk_wots = self.wots.verify(pk, wots_sig, Q)
         leaf = root(l_tree(H, pk_wots))
         pk = construct_root(Ht, wots_path, leaf, i & 0x1f)
         i >>= subh
     return PK1 == pk
Esempio n. 4
0
 def verify(self, M, sig, PK):
     i, R1, sig_horst, *sig = sig
     PK1, Q = PK
     Qtree = Q[2 * ceil(log(self.wots.l, 2)):]
     D = self.Hdigest(R1, M)
     pk = pk_horst = self.horst.verify(D, sig_horst, Q)
     if pk_horst is False:
         return False
     subh = self.h // self.d
     H = lambda x, y, i: self.H(xor(x, Q[2*i]), xor(y, Q[2*i+1]))
     Ht = lambda x, y, i: self.H(xor(x, Qtree[2*i]), xor(y, Qtree[2*i+1]))
     for _ in range(self.d):
         wots_sig, wots_path, *sig = sig
         pk_wots = self.wots.verify(pk, wots_sig, Q)
         leaf = root(l_tree(H, pk_wots))
         pk = construct_root(Ht, wots_path, leaf, i & 0x1f)
         i >>= subh
     return PK1 == pk
Esempio n. 5
0
 def verify(self, m, sig, masks):
     assert len(m) == self.m // 8
     assert len(masks) >= 2 * self.tau
     M = self.message_indices(m)
     H = lambda x, y, i: self.H(xor(x, masks[2 * i]),
                                xor(y, masks[2 * i + 1]))
     sigma_k = sig[-1]
     for (sk, path), Mi in zip(sig, M):
         leaf = self.F(sk)
         r = construct_root(H, path, leaf, Mi)
         # there is an error in the SPHINCS paper for this formula, as it
         # states that y_i = floor(M_i / 2^tau - x)
         # rather than y_i = floor(M_i / 2^{tau - x})
         yi = Mi // (1 << (self.tau - self.x))
         if r != sigma_k[yi]:
             return False
     Qtop = masks[2 * (self.tau - self.x):]
     H = lambda x, y, i: self.H(xor(x, Qtop[2 * i]), xor(
         y, Qtop[2 * i + 1]))
     return root(hash_tree(H, sigma_k))