529 lines
17 KiB
Rust
529 lines
17 KiB
Rust
// Module-level allow for Zeroize macro false positives
|
|
// The variant field IS used via variant() getter, but Zeroize macro generates
|
|
// intermediate assignments that trigger "value assigned but never read" warnings.
|
|
#![allow(unused_assignments)]
|
|
|
|
//! SPHINCS+ (SLH-DSA) hash-based digital signatures.
|
|
//!
|
|
//! SPHINCS+ is a stateless hash-based signature scheme selected by NIST as
|
|
//! FIPS 205 (SLH-DSA). Unlike lattice-based schemes like Dilithium, SPHINCS+
|
|
//! relies only on the security of hash functions, making it a conservative
|
|
//! backup option.
|
|
//!
|
|
//! # Security Properties
|
|
//!
|
|
//! - **Hash-Based**: Security relies only on SHA3/SHAKE, no lattice assumptions
|
|
//! - **Stateless**: No state management required (unlike XMSS/LMS)
|
|
//! - **Conservative**: Backup algorithm if lattice schemes are compromised
|
|
//!
|
|
//! # Trade-offs
|
|
//!
|
|
//! | Variant | Security | Signature Size | Public Key | Speed |
|
|
//! |---------|----------|----------------|------------|-------|
|
|
//! | SPHINCS+-128s | 128-bit | 7,856 bytes | 32 bytes | Slow |
|
|
//! | SPHINCS+-128f | 128-bit | 17,088 bytes | 32 bytes | Fast |
|
|
//! | SPHINCS+-192s | 192-bit | 16,224 bytes | 48 bytes | Slow |
|
|
//! | SPHINCS+-192f | 192-bit | 35,664 bytes | 48 bytes | Fast |
|
|
//! | SPHINCS+-256s | 256-bit | 29,792 bytes | 64 bytes | Slow |
|
|
//! | SPHINCS+-256f | 256-bit | 49,856 bytes | 64 bytes | Fast |
|
|
//!
|
|
//! # Usage
|
|
//!
|
|
//! ```rust
|
|
//! use synor_crypto::sphincs::{SphincsKeypair, SphincsVariant};
|
|
//!
|
|
//! // Generate keypair (128-bit security, small signatures)
|
|
//! let keypair = SphincsKeypair::generate(SphincsVariant::Shake128s);
|
|
//!
|
|
//! // Sign a message
|
|
//! let message = b"Hello, post-quantum world!";
|
|
//! let signature = keypair.sign(message);
|
|
//!
|
|
//! // Verify signature
|
|
//! assert!(keypair.public_key().verify(message, &signature).is_ok());
|
|
//!
|
|
//! // Signature is ~7.8KB for 128s variant
|
|
//! println!("Signature size: {} bytes", signature.len());
|
|
//! ```
|
|
|
|
use pqcrypto_sphincsplus::sphincsshake128ssimple as sphincs128s;
|
|
use pqcrypto_sphincsplus::sphincsshake192ssimple as sphincs192s;
|
|
use pqcrypto_sphincsplus::sphincsshake256ssimple as sphincs256s;
|
|
use pqcrypto_traits::sign::{
|
|
DetachedSignature, PublicKey as PqPublicKey, SecretKey as PqSecretKey,
|
|
};
|
|
use thiserror::Error;
|
|
use zeroize::{Zeroize, ZeroizeOnDrop};
|
|
|
|
/// SPHINCS+ variant selection.
|
|
///
|
|
/// All variants use SHAKE (SHA3-based) for hashing.
|
|
/// 's' variants have smaller signatures but are slower.
|
|
/// 'f' variants are faster but have larger signatures.
|
|
#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
|
|
pub enum SphincsVariant {
|
|
/// 128-bit security, small signatures (~7.8KB)
|
|
#[default]
|
|
Shake128s,
|
|
/// 192-bit security, small signatures (~16KB)
|
|
Shake192s,
|
|
/// 256-bit security, small signatures (~30KB)
|
|
Shake256s,
|
|
}
|
|
|
|
impl SphincsVariant {
|
|
/// Returns the expected signature size in bytes.
|
|
pub const fn signature_size(&self) -> usize {
|
|
match self {
|
|
SphincsVariant::Shake128s => 7856,
|
|
SphincsVariant::Shake192s => 16224,
|
|
SphincsVariant::Shake256s => 29792,
|
|
}
|
|
}
|
|
|
|
/// Returns the expected public key size in bytes.
|
|
pub const fn public_key_size(&self) -> usize {
|
|
match self {
|
|
SphincsVariant::Shake128s => 32,
|
|
SphincsVariant::Shake192s => 48,
|
|
SphincsVariant::Shake256s => 64,
|
|
}
|
|
}
|
|
|
|
/// Returns the expected secret key size in bytes.
|
|
pub const fn secret_key_size(&self) -> usize {
|
|
match self {
|
|
SphincsVariant::Shake128s => 64,
|
|
SphincsVariant::Shake192s => 96,
|
|
SphincsVariant::Shake256s => 128,
|
|
}
|
|
}
|
|
|
|
/// Returns the security level in bits.
|
|
pub const fn security_level(&self) -> u16 {
|
|
match self {
|
|
SphincsVariant::Shake128s => 128,
|
|
SphincsVariant::Shake192s => 192,
|
|
SphincsVariant::Shake256s => 256,
|
|
}
|
|
}
|
|
|
|
/// Returns the NIST security category.
|
|
pub const fn nist_category(&self) -> u8 {
|
|
match self {
|
|
SphincsVariant::Shake128s => 1,
|
|
SphincsVariant::Shake192s => 3,
|
|
SphincsVariant::Shake256s => 5,
|
|
}
|
|
}
|
|
}
|
|
|
|
/// SPHINCS+ public key.
|
|
#[derive(Clone)]
|
|
pub struct SphincsPublicKey {
|
|
variant: SphincsVariant,
|
|
bytes: Vec<u8>,
|
|
}
|
|
|
|
impl SphincsPublicKey {
|
|
/// Creates a public key from bytes.
|
|
pub fn from_bytes(variant: SphincsVariant, bytes: &[u8]) -> Result<Self, SphincsError> {
|
|
if bytes.len() != variant.public_key_size() {
|
|
return Err(SphincsError::InvalidKeySize {
|
|
expected: variant.public_key_size(),
|
|
got: bytes.len(),
|
|
});
|
|
}
|
|
Ok(Self {
|
|
variant,
|
|
bytes: bytes.to_vec(),
|
|
})
|
|
}
|
|
|
|
/// Returns the public key bytes.
|
|
pub fn as_bytes(&self) -> &[u8] {
|
|
&self.bytes
|
|
}
|
|
|
|
/// Returns the variant used.
|
|
pub fn variant(&self) -> SphincsVariant {
|
|
self.variant
|
|
}
|
|
|
|
/// Verifies a signature against this public key.
|
|
pub fn verify(&self, message: &[u8], signature: &SphincsSignature) -> Result<(), SphincsError> {
|
|
if signature.variant != self.variant {
|
|
return Err(SphincsError::VariantMismatch);
|
|
}
|
|
|
|
match self.variant {
|
|
SphincsVariant::Shake128s => {
|
|
let pk = sphincs128s::PublicKey::from_bytes(&self.bytes)
|
|
.map_err(|_| SphincsError::InvalidPublicKey)?;
|
|
let sig = sphincs128s::DetachedSignature::from_bytes(&signature.bytes)
|
|
.map_err(|_| SphincsError::InvalidSignature)?;
|
|
sphincs128s::verify_detached_signature(&sig, message, &pk)
|
|
.map_err(|_| SphincsError::VerificationFailed)
|
|
}
|
|
SphincsVariant::Shake192s => {
|
|
let pk = sphincs192s::PublicKey::from_bytes(&self.bytes)
|
|
.map_err(|_| SphincsError::InvalidPublicKey)?;
|
|
let sig = sphincs192s::DetachedSignature::from_bytes(&signature.bytes)
|
|
.map_err(|_| SphincsError::InvalidSignature)?;
|
|
sphincs192s::verify_detached_signature(&sig, message, &pk)
|
|
.map_err(|_| SphincsError::VerificationFailed)
|
|
}
|
|
SphincsVariant::Shake256s => {
|
|
let pk = sphincs256s::PublicKey::from_bytes(&self.bytes)
|
|
.map_err(|_| SphincsError::InvalidPublicKey)?;
|
|
let sig = sphincs256s::DetachedSignature::from_bytes(&signature.bytes)
|
|
.map_err(|_| SphincsError::InvalidSignature)?;
|
|
sphincs256s::verify_detached_signature(&sig, message, &pk)
|
|
.map_err(|_| SphincsError::VerificationFailed)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
impl std::fmt::Debug for SphincsPublicKey {
|
|
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
|
f.debug_struct("SphincsPublicKey")
|
|
.field("variant", &self.variant)
|
|
.field(
|
|
"bytes",
|
|
&hex::encode(&self.bytes[..8.min(self.bytes.len())]),
|
|
)
|
|
.finish()
|
|
}
|
|
}
|
|
|
|
/// SPHINCS+ secret key (zeroized on drop).
|
|
// Allow needed: Zeroize macro generates code that triggers false positive warnings
|
|
// about variant being assigned but never read. The variant field IS used via variant() getter.
|
|
#[allow(unused_assignments)]
|
|
#[derive(Zeroize, ZeroizeOnDrop)]
|
|
pub struct SphincsSecretKey {
|
|
#[zeroize(skip)]
|
|
variant: SphincsVariant,
|
|
bytes: Vec<u8>,
|
|
}
|
|
|
|
impl SphincsSecretKey {
|
|
/// Creates a secret key from bytes.
|
|
pub fn from_bytes(variant: SphincsVariant, bytes: &[u8]) -> Result<Self, SphincsError> {
|
|
if bytes.len() != variant.secret_key_size() {
|
|
return Err(SphincsError::InvalidKeySize {
|
|
expected: variant.secret_key_size(),
|
|
got: bytes.len(),
|
|
});
|
|
}
|
|
Ok(Self {
|
|
variant,
|
|
bytes: bytes.to_vec(),
|
|
})
|
|
}
|
|
|
|
/// Returns the secret key bytes.
|
|
pub fn as_bytes(&self) -> &[u8] {
|
|
&self.bytes
|
|
}
|
|
|
|
/// Returns the variant used.
|
|
pub fn variant(&self) -> SphincsVariant {
|
|
self.variant
|
|
}
|
|
}
|
|
|
|
impl std::fmt::Debug for SphincsSecretKey {
|
|
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
|
f.debug_struct("SphincsSecretKey")
|
|
.field("variant", &self.variant)
|
|
.field("bytes", &"[REDACTED]")
|
|
.finish()
|
|
}
|
|
}
|
|
|
|
/// SPHINCS+ signature.
|
|
#[derive(Clone)]
|
|
pub struct SphincsSignature {
|
|
variant: SphincsVariant,
|
|
bytes: Vec<u8>,
|
|
}
|
|
|
|
impl SphincsSignature {
|
|
/// Creates a signature from bytes.
|
|
pub fn from_bytes(variant: SphincsVariant, bytes: &[u8]) -> Result<Self, SphincsError> {
|
|
if bytes.len() != variant.signature_size() {
|
|
return Err(SphincsError::InvalidSignatureSize {
|
|
expected: variant.signature_size(),
|
|
got: bytes.len(),
|
|
});
|
|
}
|
|
Ok(Self {
|
|
variant,
|
|
bytes: bytes.to_vec(),
|
|
})
|
|
}
|
|
|
|
/// Returns the signature bytes.
|
|
pub fn as_bytes(&self) -> &[u8] {
|
|
&self.bytes
|
|
}
|
|
|
|
/// Returns the signature length.
|
|
pub fn len(&self) -> usize {
|
|
self.bytes.len()
|
|
}
|
|
|
|
/// Returns true if the signature is empty.
|
|
pub fn is_empty(&self) -> bool {
|
|
self.bytes.is_empty()
|
|
}
|
|
|
|
/// Returns the variant used.
|
|
pub fn variant(&self) -> SphincsVariant {
|
|
self.variant
|
|
}
|
|
}
|
|
|
|
impl std::fmt::Debug for SphincsSignature {
|
|
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
|
f.debug_struct("SphincsSignature")
|
|
.field("variant", &self.variant)
|
|
.field("size", &self.bytes.len())
|
|
.finish()
|
|
}
|
|
}
|
|
|
|
/// SPHINCS+ keypair.
|
|
pub struct SphincsKeypair {
|
|
variant: SphincsVariant,
|
|
public_key: SphincsPublicKey,
|
|
secret_key: SphincsSecretKey,
|
|
}
|
|
|
|
impl SphincsKeypair {
|
|
/// Generates a new random keypair.
|
|
pub fn generate(variant: SphincsVariant) -> Self {
|
|
match variant {
|
|
SphincsVariant::Shake128s => {
|
|
let (pk, sk) = sphincs128s::keypair();
|
|
Self {
|
|
variant,
|
|
public_key: SphincsPublicKey {
|
|
variant,
|
|
bytes: pk.as_bytes().to_vec(),
|
|
},
|
|
secret_key: SphincsSecretKey {
|
|
variant,
|
|
bytes: sk.as_bytes().to_vec(),
|
|
},
|
|
}
|
|
}
|
|
SphincsVariant::Shake192s => {
|
|
let (pk, sk) = sphincs192s::keypair();
|
|
Self {
|
|
variant,
|
|
public_key: SphincsPublicKey {
|
|
variant,
|
|
bytes: pk.as_bytes().to_vec(),
|
|
},
|
|
secret_key: SphincsSecretKey {
|
|
variant,
|
|
bytes: sk.as_bytes().to_vec(),
|
|
},
|
|
}
|
|
}
|
|
SphincsVariant::Shake256s => {
|
|
let (pk, sk) = sphincs256s::keypair();
|
|
Self {
|
|
variant,
|
|
public_key: SphincsPublicKey {
|
|
variant,
|
|
bytes: pk.as_bytes().to_vec(),
|
|
},
|
|
secret_key: SphincsSecretKey {
|
|
variant,
|
|
bytes: sk.as_bytes().to_vec(),
|
|
},
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Creates a keypair from existing keys.
|
|
pub fn from_keys(
|
|
public_key: SphincsPublicKey,
|
|
secret_key: SphincsSecretKey,
|
|
) -> Result<Self, SphincsError> {
|
|
if public_key.variant != secret_key.variant {
|
|
return Err(SphincsError::VariantMismatch);
|
|
}
|
|
Ok(Self {
|
|
variant: public_key.variant,
|
|
public_key,
|
|
secret_key,
|
|
})
|
|
}
|
|
|
|
/// Signs a message.
|
|
pub fn sign(&self, message: &[u8]) -> SphincsSignature {
|
|
let bytes = match self.variant {
|
|
SphincsVariant::Shake128s => {
|
|
let sk = sphincs128s::SecretKey::from_bytes(self.secret_key.as_bytes())
|
|
.expect("valid secret key");
|
|
let sig = sphincs128s::detached_sign(message, &sk);
|
|
sig.as_bytes().to_vec()
|
|
}
|
|
SphincsVariant::Shake192s => {
|
|
let sk = sphincs192s::SecretKey::from_bytes(self.secret_key.as_bytes())
|
|
.expect("valid secret key");
|
|
let sig = sphincs192s::detached_sign(message, &sk);
|
|
sig.as_bytes().to_vec()
|
|
}
|
|
SphincsVariant::Shake256s => {
|
|
let sk = sphincs256s::SecretKey::from_bytes(self.secret_key.as_bytes())
|
|
.expect("valid secret key");
|
|
let sig = sphincs256s::detached_sign(message, &sk);
|
|
sig.as_bytes().to_vec()
|
|
}
|
|
};
|
|
|
|
SphincsSignature {
|
|
variant: self.variant,
|
|
bytes,
|
|
}
|
|
}
|
|
|
|
/// Returns the public key.
|
|
pub fn public_key(&self) -> &SphincsPublicKey {
|
|
&self.public_key
|
|
}
|
|
|
|
/// Returns the secret key.
|
|
pub fn secret_key(&self) -> &SphincsSecretKey {
|
|
&self.secret_key
|
|
}
|
|
|
|
/// Returns the variant used.
|
|
pub fn variant(&self) -> SphincsVariant {
|
|
self.variant
|
|
}
|
|
}
|
|
|
|
impl std::fmt::Debug for SphincsKeypair {
|
|
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
|
f.debug_struct("SphincsKeypair")
|
|
.field("variant", &self.variant)
|
|
.field("public_key", &self.public_key)
|
|
.finish()
|
|
}
|
|
}
|
|
|
|
/// Errors from SPHINCS+ operations.
|
|
#[derive(Debug, Error)]
|
|
pub enum SphincsError {
|
|
#[error("Invalid key size: expected {expected}, got {got}")]
|
|
InvalidKeySize { expected: usize, got: usize },
|
|
|
|
#[error("Invalid signature size: expected {expected}, got {got}")]
|
|
InvalidSignatureSize { expected: usize, got: usize },
|
|
|
|
#[error("Invalid public key")]
|
|
InvalidPublicKey,
|
|
|
|
#[error("Invalid secret key")]
|
|
InvalidSecretKey,
|
|
|
|
#[error("Invalid signature")]
|
|
InvalidSignature,
|
|
|
|
#[error("Signature verification failed")]
|
|
VerificationFailed,
|
|
|
|
#[error("Variant mismatch between key and signature")]
|
|
VariantMismatch,
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
#[test]
|
|
fn test_generate_128s() {
|
|
let keypair = SphincsKeypair::generate(SphincsVariant::Shake128s);
|
|
assert_eq!(keypair.variant(), SphincsVariant::Shake128s);
|
|
assert_eq!(keypair.public_key().as_bytes().len(), 32);
|
|
// Test component variant accessors
|
|
assert_eq!(keypair.secret_key().variant(), SphincsVariant::Shake128s);
|
|
assert_eq!(keypair.public_key().variant(), SphincsVariant::Shake128s);
|
|
}
|
|
|
|
#[test]
|
|
fn test_sign_verify_128s() {
|
|
let keypair = SphincsKeypair::generate(SphincsVariant::Shake128s);
|
|
let message = b"Test message for SPHINCS+ signing";
|
|
|
|
let signature = keypair.sign(message);
|
|
assert_eq!(signature.len(), 7856);
|
|
|
|
// Verify should succeed
|
|
assert!(keypair.public_key().verify(message, &signature).is_ok());
|
|
}
|
|
|
|
#[test]
|
|
fn test_sign_verify_192s() {
|
|
let keypair = SphincsKeypair::generate(SphincsVariant::Shake192s);
|
|
let message = b"Test message for SPHINCS+ 192";
|
|
|
|
let signature = keypair.sign(message);
|
|
assert_eq!(signature.len(), 16224);
|
|
|
|
assert!(keypair.public_key().verify(message, &signature).is_ok());
|
|
}
|
|
|
|
#[test]
|
|
fn test_sign_verify_256s() {
|
|
let keypair = SphincsKeypair::generate(SphincsVariant::Shake256s);
|
|
let message = b"Test message for SPHINCS+ 256";
|
|
|
|
let signature = keypair.sign(message);
|
|
assert_eq!(signature.len(), 29792);
|
|
|
|
assert!(keypair.public_key().verify(message, &signature).is_ok());
|
|
}
|
|
|
|
#[test]
|
|
fn test_invalid_signature_fails() {
|
|
let keypair = SphincsKeypair::generate(SphincsVariant::Shake128s);
|
|
let message = b"Original message";
|
|
let signature = keypair.sign(message);
|
|
|
|
// Verify with wrong message should fail
|
|
let wrong_message = b"Wrong message";
|
|
assert!(keypair
|
|
.public_key()
|
|
.verify(wrong_message, &signature)
|
|
.is_err());
|
|
}
|
|
|
|
#[test]
|
|
fn test_variant_sizes() {
|
|
assert_eq!(SphincsVariant::Shake128s.signature_size(), 7856);
|
|
assert_eq!(SphincsVariant::Shake128s.public_key_size(), 32);
|
|
assert_eq!(SphincsVariant::Shake128s.secret_key_size(), 64);
|
|
|
|
assert_eq!(SphincsVariant::Shake192s.signature_size(), 16224);
|
|
assert_eq!(SphincsVariant::Shake192s.public_key_size(), 48);
|
|
|
|
assert_eq!(SphincsVariant::Shake256s.signature_size(), 29792);
|
|
assert_eq!(SphincsVariant::Shake256s.public_key_size(), 64);
|
|
}
|
|
|
|
#[test]
|
|
fn test_security_levels() {
|
|
assert_eq!(SphincsVariant::Shake128s.security_level(), 128);
|
|
assert_eq!(SphincsVariant::Shake192s.security_level(), 192);
|
|
assert_eq!(SphincsVariant::Shake256s.security_level(), 256);
|
|
}
|
|
}
|