grpc 1.60.0 → 1.62.0

data/third_party/boringssl-with-bazel/src/crypto/spx/fors.h

@@ -0,0 +1,54 @@
+/* Copyright (c) 2023, Google LLC
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_CRYPTO_SPX_FORS_H
+#define OPENSSL_HEADER_CRYPTO_SPX_FORS_H
+
+#include <openssl/base.h>
+
+#include "./params.h"
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// Algorithm 13: Generate a FORS private key value.
+void spx_fors_sk_gen(uint8_t *fors_sk, uint32_t idx,
+                     const uint8_t sk_seed[SPX_N], const uint8_t pk_seed[SPX_N],
+                     uint8_t addr[32]);
+
+// Algorithm 14: Compute the root of a Merkle subtree of FORS public values.
+void spx_fors_treehash(uint8_t root_node[SPX_N], const uint8_t sk_seed[SPX_N],
+                       uint32_t i /*target node index*/,
+                       uint32_t z /*target node height*/,
+                       const uint8_t pk_seed[SPX_N], uint8_t addr[32]);
+
+// Algorithm 15: Generate a FORS signature.
+void spx_fors_sign(uint8_t *fors_sig, const uint8_t message[SPX_FORS_MSG_BYTES],
+                   const uint8_t sk_seed[SPX_N], const uint8_t pk_seed[SPX_N],
+                   uint8_t addr[32]);
+
+// Algorithm 16: Compute a FORS public key from a FORS signature.
+void spx_fors_pk_from_sig(uint8_t *fors_pk,
+                          const uint8_t fors_sig[SPX_FORS_BYTES],
+                          const uint8_t message[SPX_FORS_MSG_BYTES],
+                          const uint8_t pk_seed[SPX_N], uint8_t addr[32]);
+
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_CRYPTO_SPX_FORS_H

data/third_party/boringssl-with-bazel/src/crypto/spx/internal.h

@@ -0,0 +1,79 @@
+/* Copyright (c) 2023, Google LLC
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_SPX_H
+#define OPENSSL_HEADER_SPX_H
+
+#include <openssl/base.h>
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// SPX_N is the number of bytes in the hash output
+#define SPX_N 16
+
+// SPX_PUBLIC_KEY_BYTES is the nNumber of bytes in the public key of
+// SPHINCS+-SHA2-128s
+#define SPX_PUBLIC_KEY_BYTES 32
+
+// SPX_SECRET_KEY_BYTES is the number of bytes in the private key of
+// SPHINCS+-SHA2-128s
+#define SPX_SECRET_KEY_BYTES 64
+
+// SPX_SIGNATURE_BYTES is the number of bytes in a signature of
+// SPHINCS+-SHA2-128s
+#define SPX_SIGNATURE_BYTES 7856
+
+// spx_generate_key generates a SPHINCS+-SHA2-128s key pair and writes the
+// result to |out_public_key| and |out_secret_key|.
+// Private key: SK.seed || SK.prf || PK.seed || PK.root
+// Public key: PK.seed || PK.root
+OPENSSL_EXPORT void spx_generate_key(
+    uint8_t out_public_key[SPX_PUBLIC_KEY_BYTES],
+    uint8_t out_secret_key[SPX_SECRET_KEY_BYTES]);
+
+// spx_generate_key_from_seed generates a SPHINCS+-SHA2-128s key pair from a
+// 48-byte seed and writes the result to |out_public_key| and |out_secret_key|.
+// Secret key: SK.seed || SK.prf || PK.seed || PK.root
+// Public key: PK.seed || PK.root
+OPENSSL_EXPORT void spx_generate_key_from_seed(
+    uint8_t out_public_key[SPX_PUBLIC_KEY_BYTES],
+    uint8_t out_secret_key[SPX_SECRET_KEY_BYTES],
+    const uint8_t seed[3 * SPX_N]);
+
+// spx_sign generates a SPHINCS+-SHA2-128s signature over |msg| or length
+// |msg_len| using |secret_key| and writes the output to |out_signature|.
+//
+// if |randomized| is 0, deterministic signing is performed, otherwise,
+// non-deterministic signing is performed.
+OPENSSL_EXPORT void spx_sign(uint8_t out_snignature[SPX_SIGNATURE_BYTES],
+                             const uint8_t secret_key[SPX_SECRET_KEY_BYTES],
+                             const uint8_t *msg, size_t msg_len,
+                             int randomized);
+
+// spx_verify verifies a SPHINCS+-SHA2-128s signature in |signature| over |msg|
+// or length |msg_len| using |public_key|. 1 is returned if the signature
+// matches, 0 otherwise.
+OPENSSL_EXPORT int spx_verify(const uint8_t signature[SPX_SIGNATURE_BYTES],
+                              const uint8_t public_key[SPX_SECRET_KEY_BYTES],
+                              const uint8_t *msg, size_t msg_len);
+
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_SPX_H

data/third_party/boringssl-with-bazel/src/crypto/spx/merkle.c

@@ -0,0 +1,150 @@
+/* Copyright (c) 2023, Google LLC
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#include <openssl/base.h>
+
+#include <string.h>
+
+#include "./address.h"
+#include "./merkle.h"
+#include "./params.h"
+#include "./thash.h"
+#include "./wots.h"
+
+void spx_treehash(uint8_t out_pk[SPX_N], const uint8_t sk_seed[SPX_N],
+                  uint32_t i /*target node index*/,
+                  uint32_t z /*target node height*/,
+                  const uint8_t pk_seed[SPX_N], uint8_t addr[32]) {
+  BSSL_CHECK(z <= SPX_TREE_HEIGHT);
+  BSSL_CHECK(i < (uint32_t)(1 << (SPX_TREE_HEIGHT - z)));
+
+  if (z == 0) {
+    spx_set_type(addr, SPX_ADDR_TYPE_WOTS);
+    spx_set_keypair_addr(addr, i);
+    spx_wots_pk_gen(out_pk, sk_seed, pk_seed, addr);
+  } else {
+    // Stores left node and right node.
+    uint8_t nodes[2 * SPX_N];
+    spx_treehash(nodes, sk_seed, 2 * i, z - 1, pk_seed, addr);
+    spx_treehash(nodes + SPX_N, sk_seed, 2 * i + 1, z - 1, pk_seed, addr);
+    spx_set_type(addr, SPX_ADDR_TYPE_HASHTREE);
+    spx_set_tree_height(addr, z);
+    spx_set_tree_index(addr, i);
+    spx_thash_h(out_pk, nodes, pk_seed, addr);
+  }
+}
+
+void spx_xmss_sign(uint8_t *sig, const uint8_t msg[SPX_N], unsigned int idx,
+                   const uint8_t sk_seed[SPX_N], const uint8_t pk_seed[SPX_N],
+                   uint8_t addr[32]) {
+  // Build authentication path
+  for (size_t j = 0; j < SPX_TREE_HEIGHT; ++j) {
+    unsigned int k = (idx >> j) ^ 1;
+    spx_treehash(sig + SPX_WOTS_BYTES + j * SPX_N, sk_seed, k, j, pk_seed,
+                 addr);
+  }
+
+  // Compute WOTS+ signature
+  spx_set_type(addr, SPX_ADDR_TYPE_WOTS);
+  spx_set_keypair_addr(addr, idx);
+  spx_wots_sign(sig, msg, sk_seed, pk_seed, addr);
+}
+
+void spx_xmss_pk_from_sig(uint8_t *root, const uint8_t *xmss_sig,
+                          unsigned int idx, const uint8_t msg[SPX_N],
+                          const uint8_t pk_seed[SPX_N], uint8_t addr[32]) {
+  // Stores node[0] and node[1] from Algorithm 10
+  uint8_t node[2 * SPX_N];
+  uint8_t tmp[2 * SPX_N];
+  spx_set_type(addr, SPX_ADDR_TYPE_WOTS);
+  spx_set_keypair_addr(addr, idx);
+  spx_wots_pk_from_sig(node, xmss_sig, msg, pk_seed, addr);
+
+  const uint8_t *auth = xmss_sig + SPX_WOTS_BYTES;
+
+  spx_set_type(addr, SPX_ADDR_TYPE_HASHTREE);
+  spx_set_tree_index(addr, idx);
+  for (size_t k = 0; k < SPX_TREE_HEIGHT; ++k) {
+    spx_set_tree_height(addr, k + 1);
+    // Is even
+    if (((idx >> k) & 1) == 0) {
+      spx_set_tree_index(addr, spx_get_tree_index(addr) >> 1);
+      memcpy(tmp, node, SPX_N);
+      memcpy(tmp + SPX_N, auth + k * SPX_N, SPX_N);
+      spx_thash_h(node + SPX_N, tmp, pk_seed, addr);
+    } else {
+      spx_set_tree_index(addr, (spx_get_tree_index(addr) - 1) >> 1);
+      memcpy(tmp, auth + k * SPX_N, SPX_N);
+      memcpy(tmp + SPX_N, node, SPX_N);
+      spx_thash_h(node + SPX_N, tmp, pk_seed, addr);
+    }
+    memcpy(node, node + SPX_N, SPX_N);
+  }
+  memcpy(root, node, SPX_N);
+}
+
+void spx_ht_sign(uint8_t *sig, const uint8_t message[SPX_N], uint64_t idx_tree,
+                 uint32_t idx_leaf, const uint8_t sk_seed[SPX_N],
+                 const uint8_t pk_seed[SPX_N]) {
+  uint8_t addr[32] = {0};
+  spx_set_tree_addr(addr, idx_tree);
+
+  // Layer 0
+  uint8_t sig_tmp[SPX_XMSS_BYTES];
+  spx_xmss_sign(sig_tmp, message, idx_leaf, sk_seed, pk_seed, addr);
+  memcpy(sig, sig_tmp, sizeof(sig_tmp));
+
+  uint8_t root[SPX_N];
+  spx_xmss_pk_from_sig(root, sig_tmp, idx_leaf, message, pk_seed, addr);
+
+  // All other layers
+  for (size_t j = 1; j < SPX_D; ++j) {
+    idx_leaf = idx_tree % (1 << SPX_TREE_HEIGHT);
+    idx_tree = idx_tree >> SPX_TREE_HEIGHT;
+    spx_set_layer_addr(addr, j);
+    spx_set_tree_addr(addr, idx_tree);
+    spx_xmss_sign(sig_tmp, root, idx_leaf, sk_seed, pk_seed, addr);
+    memcpy(sig + j * SPX_XMSS_BYTES, sig_tmp, sizeof(sig_tmp));
+
+    if (j < (SPX_D - 1)) {
+      spx_xmss_pk_from_sig(root, sig_tmp, idx_leaf, root, pk_seed, addr);
+    }
+  }
+}
+
+int spx_ht_verify(const uint8_t sig[SPX_D * SPX_XMSS_BYTES],
+                  const uint8_t message[SPX_N], uint64_t idx_tree,
+                  uint32_t idx_leaf, const uint8_t pk_root[SPX_N],
+                  const uint8_t pk_seed[SPX_N]) {
+  uint8_t addr[32] = {0};
+  spx_set_tree_addr(addr, idx_tree);
+
+  uint8_t sig_tmp[SPX_XMSS_BYTES];
+  memcpy(sig_tmp, sig, sizeof(sig_tmp));
+
+  uint8_t node[SPX_N];
+  spx_xmss_pk_from_sig(node, sig_tmp, idx_leaf, message, pk_seed, addr);
+
+  for (size_t j = 1; j < SPX_D; ++j) {
+    idx_leaf = idx_tree % (1 << SPX_TREE_HEIGHT);
+    idx_tree = idx_tree >> SPX_TREE_HEIGHT;
+    spx_set_layer_addr(addr, j);
+    spx_set_tree_addr(addr, idx_tree);
+    // Get jth XMSS signature
+    memcpy(sig_tmp, sig + j * SPX_XMSS_BYTES, sizeof(sig_tmp));
+
+    spx_xmss_pk_from_sig(node, sig_tmp, idx_leaf, node, pk_seed, addr);
+  }
+  return memcmp(node, pk_root, SPX_N) == 0;
+}

data/third_party/boringssl-with-bazel/src/crypto/spx/merkle.h

@@ -0,0 +1,61 @@
+/* Copyright (c) 2023, Google LLC
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_CRYPTO_SPX_MERKLE_H
+#define OPENSSL_HEADER_CRYPTO_SPX_MERKLE_H
+
+#include <openssl/base.h>
+
+#include <sys/types.h>
+
+#include "./params.h"
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// Algorithm 8: Compute the root of a Merkle subtree of WOTS+ public keys.
+void spx_treehash(uint8_t out_pk[SPX_N], const uint8_t sk_seed[SPX_N],
+                  uint32_t i /*target node index*/,
+                  uint32_t z /*target node height*/,
+                  const uint8_t pk_seed[SPX_N], uint8_t addr[32]);
+
+// Algorithm 9: Generate an XMSS signature.
+void spx_xmss_sign(uint8_t *sig, const uint8_t msg[SPX_N], unsigned int idx,
+                   const uint8_t sk_seed[SPX_N], const uint8_t pk_seed[SPX_N],
+                   uint8_t addr[32]);
+
+// Algorithm 10: Compute an XMSS public key from an XMSS signature.
+void spx_xmss_pk_from_sig(uint8_t *root, const uint8_t *xmss_sig,
+                          unsigned int idx, const uint8_t msg[SPX_N],
+                          const uint8_t pk_seed[SPX_N], uint8_t addr[32]);
+
+// Algorithm 11: Generate a hypertree signature.
+void spx_ht_sign(uint8_t *sig, const uint8_t message[SPX_N], uint64_t idx_tree,
+                 uint32_t idx_leaf, const uint8_t sk_seed[SPX_N],
+                 const uint8_t pk_seed[SPX_N]);
+
+// Algorithm 12: Verify a hypertree signature.
+int spx_ht_verify(const uint8_t sig[SPX_D * SPX_XMSS_BYTES],
+                  const uint8_t message[SPX_N], uint64_t idx_tree,
+                  uint32_t idx_leaf, const uint8_t pk_root[SPX_N],
+                  const uint8_t pk_seed[SPX_N]);
+
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_CRYPTO_SPX_MERKLE_H

data/third_party/boringssl-with-bazel/src/crypto/spx/params.h

@@ -0,0 +1,71 @@
+/* Copyright (c) 2023, Google LLC
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_CRYPTO_SPX_PARAMS_H
+#define OPENSSL_HEADER_CRYPTO_SPX_PARAMS_H
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// Output length of the hash function.
+#define SPX_N 16
+// Total height of the tree structure.
+#define SPX_FULL_HEIGHT 63
+// Number of subtree layers.
+#define SPX_D 7
+// Height of the trees on each layer
+#define SPX_TREE_HEIGHT 9
+// Height of each individual FORS tree.
+#define SPX_FORS_HEIGHT 12
+// Total number of FORS tree used.
+#define SPX_FORS_TREES 14
+// Size of a FORS signature
+#define SPX_FORS_BYTES ((SPX_FORS_HEIGHT + 1) * SPX_FORS_TREES * SPX_N)
+
+// Winternitz parameter and derived values
+#define SPX_WOTS_W 16
+#define SPX_WOTS_LOG_W 4
+#define SPX_WOTS_LEN1 32
+#define SPX_WOTS_LEN2 3
+#define SPX_WOTS_LEN 35
+#define SPX_WOTS_BYTES (SPX_N * SPX_WOTS_LEN)
+
+// XMSS sizes
+#define SPX_XMSS_BYTES (SPX_WOTS_BYTES + (SPX_N * SPX_TREE_HEIGHT))
+
+// Size of the message digest (NOTE: This is only correct for the SHA256 params
+// here)
+#define SPX_DIGEST_SIZE                                                      \
+  (((SPX_FORS_TREES * SPX_FORS_HEIGHT) / 8) +                                \
+   (((SPX_FULL_HEIGHT - SPX_TREE_HEIGHT) / 8) + 1) + (SPX_TREE_HEIGHT / 8) + \
+   1)
+
+// Compressed address size when using SHA256
+#define SPX_SHA256_ADDR_BYTES 22
+
+// Size of the FORS message hash
+#define SPX_FORS_MSG_BYTES ((SPX_FORS_HEIGHT * SPX_FORS_TREES + 7) / 8)
+#define SPX_TREE_BITS (SPX_TREE_HEIGHT * (SPX_D - 1))
+#define SPX_TREE_BYTES ((SPX_TREE_BITS + 7) / 8)
+#define SPX_LEAF_BITS SPX_TREE_HEIGHT
+#define SPX_LEAF_BYTES ((SPX_LEAF_BITS + 7) / 8)
+
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_CRYPTO_SPX_PARAMS_H

data/third_party/boringssl-with-bazel/src/crypto/spx/spx.c

@@ -0,0 +1,139 @@
+/* Copyright (c) 2023, Google LLC
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#include <openssl/base.h>
+
+#include <string.h>
+
+#include <openssl/rand.h>
+
+#include "./address.h"
+#include "./fors.h"
+#include "./internal.h"
+#include "./merkle.h"
+#include "./params.h"
+#include "./spx_util.h"
+#include "./thash.h"
+
+void spx_generate_key(uint8_t out_public_key[SPX_PUBLIC_KEY_BYTES],
+                      uint8_t out_secret_key[SPX_SECRET_KEY_BYTES]) {
+  uint8_t seed[3 * SPX_N];
+  RAND_bytes(seed, 3 * SPX_N);
+  spx_generate_key_from_seed(out_public_key, out_secret_key, seed);
+}
+
+void spx_generate_key_from_seed(uint8_t out_public_key[SPX_PUBLIC_KEY_BYTES],
+                                uint8_t out_secret_key[SPX_SECRET_KEY_BYTES],
+                                const uint8_t seed[3 * SPX_N]) {
+  // Initialize SK.seed || SK.prf || PK.seed from seed.
+  memcpy(out_secret_key, seed, 3 * SPX_N);
+
+  // Initialize PK.seed from seed.
+  memcpy(out_public_key, seed + 2 * SPX_N, SPX_N);
+
+  uint8_t addr[32] = {0};
+  spx_set_layer_addr(addr, SPX_D - 1);
+
+  // Set PK.root
+  spx_treehash(out_public_key + SPX_N, out_secret_key, 0, SPX_TREE_HEIGHT,
+               out_public_key, addr);
+  memcpy(out_secret_key + 3 * SPX_N, out_public_key + SPX_N, SPX_N);
+}
+
+void spx_sign(uint8_t out_signature[SPX_SIGNATURE_BYTES],
+              const uint8_t secret_key[SPX_SECRET_KEY_BYTES],
+              const uint8_t *msg, size_t msg_len, int randomized) {
+  uint8_t addr[32] = {0};
+  const uint8_t *sk_seed = secret_key;
+  const uint8_t *sk_prf = secret_key + SPX_N;
+  const uint8_t *pk_seed = secret_key + 2 * SPX_N;
+  const uint8_t *pk_root = secret_key + 3 * SPX_N;
+
+  uint8_t opt_rand[SPX_N] = {0};
+
+  if (randomized) {
+    RAND_bytes(opt_rand, SPX_N);
+  } else {
+    memcpy(opt_rand, pk_seed, SPX_N);
+  }
+
+  // Derive randomizer r and copy it to signature.
+  uint8_t r[SPX_N];
+  spx_thash_prfmsg(r, sk_prf, opt_rand, msg, msg_len);
+  memcpy(out_signature, r, SPX_N);
+
+  uint8_t digest[SPX_DIGEST_SIZE];
+  spx_thash_hmsg(digest, r, pk_seed, pk_root, msg, msg_len);
+
+  uint8_t fors_digest[SPX_FORS_MSG_BYTES];
+  memcpy(fors_digest, digest, SPX_FORS_MSG_BYTES);
+
+  uint8_t *tmp_idx_tree = digest + SPX_FORS_MSG_BYTES;
+  uint8_t *tmp_idx_leaf = tmp_idx_tree + SPX_TREE_BYTES;
+
+  uint64_t idx_tree = spx_to_uint64(tmp_idx_tree, SPX_TREE_BYTES);
+  idx_tree &= (~(uint64_t)0) >> (64 - SPX_TREE_BITS);
+
+  uint32_t idx_leaf = (uint32_t)spx_to_uint64(tmp_idx_leaf, SPX_LEAF_BYTES);
+  idx_leaf &= (~(uint32_t)0) >> (32 - SPX_LEAF_BITS);
+
+  spx_set_tree_addr(addr, idx_tree);
+  spx_set_type(addr, SPX_ADDR_TYPE_FORSTREE);
+  spx_set_keypair_addr(addr, idx_leaf);
+
+  spx_fors_sign(out_signature + SPX_N, fors_digest, sk_seed, pk_seed, addr);
+
+  uint8_t pk_fors[SPX_N];
+  spx_fors_pk_from_sig(pk_fors, out_signature + SPX_N, fors_digest, pk_seed,
+                       addr);
+
+  spx_ht_sign(out_signature + SPX_N + SPX_FORS_BYTES, pk_fors, idx_tree,
+              idx_leaf, sk_seed, pk_seed);
+}
+
+int spx_verify(const uint8_t signature[SPX_SIGNATURE_BYTES],
+               const uint8_t public_key[SPX_SECRET_KEY_BYTES],
+               const uint8_t *msg, size_t msg_len) {
+  uint8_t addr[32] = {0};
+  const uint8_t *pk_seed = public_key;
+  const uint8_t *pk_root = public_key + SPX_N;
+
+  const uint8_t *r = signature;
+  const uint8_t *sig_fors = signature + SPX_N;
+  const uint8_t *sig_ht = sig_fors + SPX_FORS_BYTES;
+
+  uint8_t digest[SPX_DIGEST_SIZE];
+  spx_thash_hmsg(digest, r, pk_seed, pk_root, msg, msg_len);
+
+  uint8_t fors_digest[SPX_FORS_MSG_BYTES];
+  memcpy(fors_digest, digest, SPX_FORS_MSG_BYTES);
+
+  uint8_t *tmp_idx_tree = digest + SPX_FORS_MSG_BYTES;
+  uint8_t *tmp_idx_leaf = tmp_idx_tree + SPX_TREE_BYTES;
+
+  uint64_t idx_tree = spx_to_uint64(tmp_idx_tree, SPX_TREE_BYTES);
+  idx_tree &= (~(uint64_t)0) >> (64 - SPX_TREE_BITS);
+
+  uint32_t idx_leaf = (uint32_t)spx_to_uint64(tmp_idx_leaf, SPX_LEAF_BYTES);
+  idx_leaf &= (~(uint32_t)0) >> (32 - SPX_LEAF_BITS);
+
+  spx_set_tree_addr(addr, idx_tree);
+  spx_set_type(addr, SPX_ADDR_TYPE_FORSTREE);
+  spx_set_keypair_addr(addr, idx_leaf);
+
+  uint8_t pk_fors[SPX_N];
+  spx_fors_pk_from_sig(pk_fors, sig_fors, fors_digest, pk_seed, addr);
+
+  return spx_ht_verify(sig_ht, pk_fors, idx_tree, idx_leaf, pk_root, pk_seed);
+}

data/third_party/boringssl-with-bazel/src/crypto/spx/spx_util.c

@@ -0,0 +1,53 @@
+/* Copyright (c) 2023, Google LLC
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#include <openssl/base.h>
+
+#include <assert.h>
+
+#include "./spx_util.h"
+
+void spx_uint64_to_len_bytes(uint8_t *output, size_t out_len, uint64_t input) {
+  for (size_t i = out_len; i > 0; --i) {
+    output[i - 1] = input & 0xff;
+    input = input >> 8;
+  }
+}
+
+uint64_t spx_to_uint64(const uint8_t *input, size_t input_len) {
+  uint64_t tmp = 0;
+  for (size_t i = 0; i < input_len; ++i) {
+    tmp = 256 * tmp + input[i];
+  }
+  return tmp;
+}
+
+void spx_base_b(uint32_t *output, size_t out_len, const uint8_t *input,
+                unsigned int log2_b) {
+  int in = 0;
+  uint32_t out = 0;
+  uint32_t bits = 0;
+  uint32_t total = 0;
+  uint32_t base = UINT32_C(1) << log2_b;
+
+  for (out = 0; out < out_len; ++out) {
+    while (bits < log2_b) {
+      total = (total << 8) + input[in];
+      in++;
+      bits = bits + 8;
+    }
+    bits -= log2_b;
+    output[out] = (total >> bits) % base;
+  }
+}

data/third_party/boringssl-with-bazel/src/crypto/spx/spx_util.h

@@ -0,0 +1,44 @@
+/* Copyright (c) 2023, Google LLC
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_CRYPTO_SPX_UTIL_H
+#define OPENSSL_HEADER_CRYPTO_SPX_UTIL_H
+
+#include <openssl/base.h>
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// Encodes the integer value of input to out_len bytes in big-endian order.
+// Note that input < 2^(8*out_len), as otherwise this function will truncate
+// the least significant bytes of the integer representation.
+void spx_uint64_to_len_bytes(uint8_t *output, size_t out_len, uint64_t input);
+
+uint64_t spx_to_uint64(const uint8_t *input, size_t input_len);
+
+// Compute the base 2^log2_b representation of X.
+//
+// As some of the parameter sets in https://eprint.iacr.org/2022/1725.pdf use
+// a FORS height > 16 we use a uint32_t to store the output.
+void spx_base_b(uint32_t *output, size_t out_len, const uint8_t *input,
+                unsigned int log2_b);
+
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_CRYPTO_SPX_UTIL_H