grpc 1.69.0 → 1.70.1

data/third_party/boringssl-with-bazel/src/crypto/slhdsa/merkle.h

@@ -0,0 +1,70 @@
+/* Copyright 2024 The BoringSSL Authors
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_CRYPTO_SLHDSA_MERKLE_H
+#define OPENSSL_HEADER_CRYPTO_SLHDSA_MERKLE_H
+
+#include <openssl/base.h>
+
+#include <sys/types.h>
+
+#include "./params.h"
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// Implements Algorithm 9: xmss_node function (page 23)
+void slhdsa_treehash(uint8_t out_pk[SLHDSA_SHA2_128S_N],
+                     const uint8_t sk_seed[SLHDSA_SHA2_128S_N],
+                     uint32_t i /*target node index*/,
+                     uint32_t z /*target node height*/,
+                     const uint8_t pk_seed[SLHDSA_SHA2_128S_N],
+                     uint8_t addr[32]);
+
+// Implements Algorithm 10: xmss_sign function (page 24)
+void slhdsa_xmss_sign(uint8_t sig[SLHDSA_SHA2_128S_XMSS_BYTES],
+                      const uint8_t msg[SLHDSA_SHA2_128S_N], unsigned int idx,
+                      const uint8_t sk_seed[SLHDSA_SHA2_128S_N],
+                      const uint8_t pk_seed[SLHDSA_SHA2_128S_N],
+                      uint8_t addr[32]);
+
+// Implements Algorithm 11: xmss_pkFromSig function (page 25)
+void slhdsa_xmss_pk_from_sig(
+    uint8_t root[SLHDSA_SHA2_128S_N],
+    const uint8_t xmss_sig[SLHDSA_SHA2_128S_XMSS_BYTES], unsigned int idx,
+    const uint8_t msg[SLHDSA_SHA2_128S_N],
+    const uint8_t pk_seed[SLHDSA_SHA2_128S_N], uint8_t addr[32]);
+
+// Implements Algorithm 12: ht_sign function (page 27)
+void slhdsa_ht_sign(
+    uint8_t sig[SLHDSA_SHA2_128S_D * SLHDSA_SHA2_128S_XMSS_BYTES],
+    const uint8_t message[SLHDSA_SHA2_128S_N], uint64_t idx_tree,
+    uint32_t idx_leaf, const uint8_t sk_seed[SLHDSA_SHA2_128S_N],
+    const uint8_t pk_seed[SLHDSA_SHA2_128S_N]);
+
+// Implements Algorithm 13: ht_verify function (page 28)
+int slhdsa_ht_verify(
+    const uint8_t sig[SLHDSA_SHA2_128S_D * SLHDSA_SHA2_128S_XMSS_BYTES],
+    const uint8_t message[SLHDSA_SHA2_128S_N], uint64_t idx_tree,
+    uint32_t idx_leaf, const uint8_t pk_root[SLHDSA_SHA2_128S_N],
+    const uint8_t pk_seed[SLHDSA_SHA2_128S_N]);
+
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_CRYPTO_SLHDSA_MERKLE_H

data/third_party/boringssl-with-bazel/src/crypto/slhdsa/params.h

@@ -0,0 +1,83 @@
+/* Copyright 2024 The BoringSSL Authors
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_CRYPTO_SLHDSA_PARAMS_H
+#define OPENSSL_HEADER_CRYPTO_SLHDSA_PARAMS_H
+
+#include <openssl/base.h>
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// Output length of the hash function.
+#define SLHDSA_SHA2_128S_N 16
+// Total height of the tree structure.
+#define SLHDSA_SHA2_128S_FULL_HEIGHT 63
+// Number of subtree layers.
+#define SLHDSA_SHA2_128S_D 7
+// Height of the trees on each layer
+#define SLHDSA_SHA2_128S_TREE_HEIGHT 9
+// Height of each individual FORS tree.
+#define SLHDSA_SHA2_128S_FORS_HEIGHT 12
+// Total number of FORS tree used.
+#define SLHDSA_SHA2_128S_FORS_TREES 14
+// Size of a FORS signature
+#define SLHDSA_SHA2_128S_FORS_BYTES                                   \
+  ((SLHDSA_SHA2_128S_FORS_HEIGHT + 1) * SLHDSA_SHA2_128S_FORS_TREES * \
+   SLHDSA_SHA2_128S_N)
+// The number of bytes at the beginning of M', the augmented message, before the
+// context.
+#define SLHDSA_M_PRIME_HEADER_LEN 2
+
+// Winternitz parameter and derived values
+#define SLHDSA_SHA2_128S_WOTS_W 16
+#define SLHDSA_SHA2_128S_WOTS_LOG_W 4
+#define SLHDSA_SHA2_128S_WOTS_LEN1 32
+#define SLHDSA_SHA2_128S_WOTS_LEN2 3
+#define SLHDSA_SHA2_128S_WOTS_LEN 35
+#define SLHDSA_SHA2_128S_WOTS_BYTES \
+  (SLHDSA_SHA2_128S_N * SLHDSA_SHA2_128S_WOTS_LEN)
+
+// XMSS sizes
+#define SLHDSA_SHA2_128S_XMSS_BYTES \
+  (SLHDSA_SHA2_128S_WOTS_BYTES +    \
+   (SLHDSA_SHA2_128S_N * SLHDSA_SHA2_128S_TREE_HEIGHT))
+
+// Size of the message digest (NOTE: This is only correct for the SHA-256 params
+// here)
+#define SLHDSA_SHA2_128S_DIGEST_SIZE                                           \
+  (((SLHDSA_SHA2_128S_FORS_TREES * SLHDSA_SHA2_128S_FORS_HEIGHT) / 8) +        \
+   (((SLHDSA_SHA2_128S_FULL_HEIGHT - SLHDSA_SHA2_128S_TREE_HEIGHT) / 8) + 1) + \
+   (SLHDSA_SHA2_128S_TREE_HEIGHT / 8) + 1)
+
+// Compressed address size when using SHA-256
+#define SLHDSA_SHA2_128S_SHA256_ADDR_BYTES 22
+
+// Size of the FORS message hash
+#define SLHDSA_SHA2_128S_FORS_MSG_BYTES \
+  ((SLHDSA_SHA2_128S_FORS_HEIGHT * SLHDSA_SHA2_128S_FORS_TREES + 7) / 8)
+#define SLHDSA_SHA2_128S_TREE_BITS \
+  (SLHDSA_SHA2_128S_TREE_HEIGHT * (SLHDSA_SHA2_128S_D - 1))
+#define SLHDSA_SHA2_128S_TREE_BYTES ((SLHDSA_SHA2_128S_TREE_BITS + 7) / 8)
+#define SLHDSA_SHA2_128S_LEAF_BITS SLHDSA_SHA2_128S_TREE_HEIGHT
+#define SLHDSA_SHA2_128S_LEAF_BYTES ((SLHDSA_SHA2_128S_LEAF_BITS + 7) / 8)
+
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_CRYPTO_SLHDSA_PARAMS_H

data/third_party/boringssl-with-bazel/src/crypto/slhdsa/slhdsa.cc

@@ -0,0 +1,307 @@
+/* Copyright 2024 The BoringSSL Authors
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#include <openssl/slhdsa.h>
+
+#include <string.h>
+
+#include <openssl/bytestring.h>
+#include <openssl/obj.h>
+#include <openssl/rand.h>
+
+#include "../internal.h"
+#include "address.h"
+#include "fors.h"
+#include "internal.h"
+#include "merkle.h"
+#include "params.h"
+#include "thash.h"
+
+
+// The OBJECT IDENTIFIER header is also included in these values, per the spec.
+static const uint8_t kSHA384OID[] = {0x06, 0x09, 0x60, 0x86, 0x48, 0x01,
+                                     0x65, 0x03, 0x04, 0x02, 0x02};
+#define MAX_OID_LENGTH 11
+#define MAX_CONTEXT_LENGTH 255
+
+void SLHDSA_SHA2_128S_generate_key_from_seed(
+    uint8_t out_public_key[SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    uint8_t out_secret_key[SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t seed[3 * SLHDSA_SHA2_128S_N]) {
+  // Initialize SK.seed || SK.prf || PK.seed from seed.
+  OPENSSL_memcpy(out_secret_key, seed, 3 * SLHDSA_SHA2_128S_N);
+
+  // Initialize PK.seed from seed.
+  OPENSSL_memcpy(out_public_key, seed + 2 * SLHDSA_SHA2_128S_N,
+                 SLHDSA_SHA2_128S_N);
+
+  uint8_t addr[32] = {0};
+  slhdsa_set_layer_addr(addr, SLHDSA_SHA2_128S_D - 1);
+
+  // Set PK.root
+  slhdsa_treehash(out_public_key + SLHDSA_SHA2_128S_N, out_secret_key, 0,
+                  SLHDSA_SHA2_128S_TREE_HEIGHT, out_public_key, addr);
+  OPENSSL_memcpy(out_secret_key + 3 * SLHDSA_SHA2_128S_N,
+                 out_public_key + SLHDSA_SHA2_128S_N, SLHDSA_SHA2_128S_N);
+}
+
+void SLHDSA_SHA2_128S_generate_key(
+    uint8_t out_public_key[SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    uint8_t out_private_key[SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]) {
+  uint8_t seed[3 * SLHDSA_SHA2_128S_N];
+  RAND_bytes(seed, 3 * SLHDSA_SHA2_128S_N);
+  SLHDSA_SHA2_128S_generate_key_from_seed(out_public_key, out_private_key,
+                                          seed);
+}
+
+OPENSSL_EXPORT void SLHDSA_SHA2_128S_public_from_private(
+    uint8_t out_public_key[SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t private_key[SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]) {
+  OPENSSL_memcpy(out_public_key, private_key + 2 * SLHDSA_SHA2_128S_N,
+                 SLHDSA_SHA2_128S_N * 2);
+}
+
+// Note that this overreads by a byte. This is fine in the context that it's
+// used.
+static uint64_t load_tree_index(const uint8_t in[8]) {
+  static_assert(SLHDSA_SHA2_128S_TREE_BYTES == 7,
+                "This code needs to be updated");
+  uint64_t index = CRYPTO_load_u64_be(in);
+  index >>= 8;
+  index &= (~(uint64_t)0) >> (64 - SLHDSA_SHA2_128S_TREE_BITS);
+  return index;
+}
+
+// Implements Algorithm 22: slh_sign function (Section 10.2.1, page 39)
+void SLHDSA_SHA2_128S_sign_internal(
+    uint8_t out_signature[SLHDSA_SHA2_128S_SIGNATURE_BYTES],
+    const uint8_t secret_key[SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t header[SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
+    size_t context_len, const uint8_t *msg, size_t msg_len,
+    const uint8_t entropy[SLHDSA_SHA2_128S_N]) {
+  const uint8_t *sk_seed = secret_key;
+  const uint8_t *sk_prf = secret_key + SLHDSA_SHA2_128S_N;
+  const uint8_t *pk_seed = secret_key + 2 * SLHDSA_SHA2_128S_N;
+  const uint8_t *pk_root = secret_key + 3 * SLHDSA_SHA2_128S_N;
+
+  // Derive randomizer R and copy it to signature
+  uint8_t R[SLHDSA_SHA2_128S_N];
+  slhdsa_thash_prfmsg(R, sk_prf, entropy, header, context, context_len, msg,
+                      msg_len);
+  OPENSSL_memcpy(out_signature, R, SLHDSA_SHA2_128S_N);
+
+  // Compute message digest
+  uint8_t digest[SLHDSA_SHA2_128S_DIGEST_SIZE];
+  slhdsa_thash_hmsg(digest, R, pk_seed, pk_root, header, context, context_len,
+                    msg, msg_len);
+
+  uint8_t fors_digest[SLHDSA_SHA2_128S_FORS_MSG_BYTES];
+  OPENSSL_memcpy(fors_digest, digest, SLHDSA_SHA2_128S_FORS_MSG_BYTES);
+
+  const uint64_t idx_tree =
+      load_tree_index(digest + SLHDSA_SHA2_128S_FORS_MSG_BYTES);
+  uint32_t idx_leaf = CRYPTO_load_u16_be(
+      digest + SLHDSA_SHA2_128S_FORS_MSG_BYTES + SLHDSA_SHA2_128S_TREE_BYTES);
+  idx_leaf &= (~(uint32_t)0) >> (32 - SLHDSA_SHA2_128S_LEAF_BITS);
+
+  uint8_t addr[32] = {0};
+  slhdsa_set_tree_addr(addr, idx_tree);
+  slhdsa_set_type(addr, SLHDSA_SHA2_128S_ADDR_TYPE_FORSTREE);
+  slhdsa_set_keypair_addr(addr, idx_leaf);
+
+  slhdsa_fors_sign(out_signature + SLHDSA_SHA2_128S_N, fors_digest, sk_seed,
+                   pk_seed, addr);
+
+  uint8_t pk_fors[SLHDSA_SHA2_128S_N];
+  slhdsa_fors_pk_from_sig(pk_fors, out_signature + SLHDSA_SHA2_128S_N,
+                          fors_digest, pk_seed, addr);
+
+  slhdsa_ht_sign(
+      out_signature + SLHDSA_SHA2_128S_N + SLHDSA_SHA2_128S_FORS_BYTES, pk_fors,
+      idx_tree, idx_leaf, sk_seed, pk_seed);
+}
+
+int SLHDSA_SHA2_128S_sign(
+    uint8_t out_signature[SLHDSA_SHA2_128S_SIGNATURE_BYTES],
+    const uint8_t private_key[SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context,
+    size_t context_len) {
+  if (context_len > MAX_CONTEXT_LENGTH) {
+    return 0;
+  }
+
+  // Construct header for M' as specified in Algorithm 22
+  uint8_t M_prime_header[2];
+  M_prime_header[0] = 0;  // domain separator for pure signing
+  M_prime_header[1] = (uint8_t)context_len;
+
+  uint8_t entropy[SLHDSA_SHA2_128S_N];
+  RAND_bytes(entropy, sizeof(entropy));
+  SLHDSA_SHA2_128S_sign_internal(out_signature, private_key, M_prime_header,
+                                 context, context_len, msg, msg_len, entropy);
+  return 1;
+}
+
+static int slhdsa_get_nonstandard_context_and_oid(
+    uint8_t *out_context_and_oid, size_t *out_context_and_oid_len,
+    size_t max_out_context_and_oid, const uint8_t *context, size_t context_len,
+    int hash_nid, size_t hashed_msg_len) {
+  const uint8_t *oid;
+  size_t oid_len;
+  size_t expected_hash_len;
+  switch (hash_nid) {
+    // The SLH-DSA spec only lists SHA-256 and SHA-512. This function supports
+    // SHA-384, which is non-standard.
+    case NID_sha384:
+      oid = kSHA384OID;
+      oid_len = sizeof(kSHA384OID);
+      static_assert(sizeof(kSHA384OID) <= MAX_OID_LENGTH, "");
+      expected_hash_len = 48;
+      break;
+    // If adding a hash function with a larger `oid_len`, update the size of
+    // `context_and_oid` in the callers.
+    default:
+      return 0;
+  }
+
+  if (hashed_msg_len != expected_hash_len) {
+    return 0;
+  }
+
+  *out_context_and_oid_len = context_len + oid_len;
+  if (*out_context_and_oid_len > max_out_context_and_oid) {
+    return 0;
+  }
+
+  OPENSSL_memcpy(out_context_and_oid, context, context_len);
+  OPENSSL_memcpy(out_context_and_oid + context_len, oid, oid_len);
+
+  return 1;
+}
+
+
+int SLHDSA_SHA2_128S_prehash_warning_nonstandard_sign(
+    uint8_t out_signature[SLHDSA_SHA2_128S_SIGNATURE_BYTES],
+    const uint8_t private_key[SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
+    const uint8_t *context, size_t context_len) {
+  if (context_len > MAX_CONTEXT_LENGTH) {
+    return 0;
+  }
+
+  uint8_t M_prime_header[2];
+  M_prime_header[0] = 1;  // domain separator for prehashed signing
+  M_prime_header[1] = (uint8_t)context_len;
+
+  uint8_t context_and_oid[MAX_CONTEXT_LENGTH + MAX_OID_LENGTH];
+  size_t context_and_oid_len;
+  if (!slhdsa_get_nonstandard_context_and_oid(
+          context_and_oid, &context_and_oid_len, sizeof(context_and_oid),
+          context, context_len, hash_nid, hashed_msg_len)) {
+    return 0;
+  }
+
+  uint8_t entropy[SLHDSA_SHA2_128S_N];
+  RAND_bytes(entropy, sizeof(entropy));
+  SLHDSA_SHA2_128S_sign_internal(out_signature, private_key, M_prime_header,
+                                 context_and_oid, context_and_oid_len,
+                                 hashed_msg, hashed_msg_len, entropy);
+  return 1;
+}
+
+// Implements Algorithm 24: slh_verify function (Section 10.3, page 41)
+int SLHDSA_SHA2_128S_verify(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context,
+    size_t context_len) {
+  if (context_len > MAX_CONTEXT_LENGTH) {
+    return 0;
+  }
+
+  // Construct header for M' as specified in Algorithm 24
+  uint8_t M_prime_header[2];
+  M_prime_header[0] = 0;  // domain separator for pure verification
+  M_prime_header[1] = (uint8_t)context_len;
+
+  return SLHDSA_SHA2_128S_verify_internal(signature, signature_len, public_key,
+                                          M_prime_header, context, context_len,
+                                          msg, msg_len);
+}
+
+int SLHDSA_SHA2_128S_prehash_warning_nonstandard_verify(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
+    const uint8_t *context, size_t context_len) {
+  if (context_len > MAX_CONTEXT_LENGTH) {
+    return 0;
+  }
+
+  uint8_t M_prime_header[2];
+  M_prime_header[0] = 1;  // domain separator for prehashed verification
+  M_prime_header[1] = (uint8_t)context_len;
+
+  uint8_t context_and_oid[MAX_CONTEXT_LENGTH + MAX_OID_LENGTH];
+  size_t context_and_oid_len;
+  if (!slhdsa_get_nonstandard_context_and_oid(
+          context_and_oid, &context_and_oid_len, sizeof(context_and_oid),
+          context, context_len, hash_nid, hashed_msg_len)) {
+    return 0;
+  }
+
+  return SLHDSA_SHA2_128S_verify_internal(
+      signature, signature_len, public_key, M_prime_header, context_and_oid,
+      context_and_oid_len, hashed_msg, hashed_msg_len);
+}
+
+int SLHDSA_SHA2_128S_verify_internal(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t header[SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
+    size_t context_len, const uint8_t *msg, size_t msg_len) {
+  if (signature_len != SLHDSA_SHA2_128S_SIGNATURE_BYTES) {
+    return 0;
+  }
+  const uint8_t *pk_seed = public_key;
+  const uint8_t *pk_root = public_key + SLHDSA_SHA2_128S_N;
+
+  const uint8_t *r = signature;
+  const uint8_t *sig_fors = signature + SLHDSA_SHA2_128S_N;
+  const uint8_t *sig_ht = sig_fors + SLHDSA_SHA2_128S_FORS_BYTES;
+
+  uint8_t digest[SLHDSA_SHA2_128S_DIGEST_SIZE];
+  slhdsa_thash_hmsg(digest, r, pk_seed, pk_root, header, context, context_len,
+                    msg, msg_len);
+
+  uint8_t fors_digest[SLHDSA_SHA2_128S_FORS_MSG_BYTES];
+  OPENSSL_memcpy(fors_digest, digest, SLHDSA_SHA2_128S_FORS_MSG_BYTES);
+
+  const uint64_t idx_tree =
+      load_tree_index(digest + SLHDSA_SHA2_128S_FORS_MSG_BYTES);
+  uint32_t idx_leaf = CRYPTO_load_u16_be(
+      digest + SLHDSA_SHA2_128S_FORS_MSG_BYTES + SLHDSA_SHA2_128S_TREE_BYTES);
+  idx_leaf &= (~(uint32_t)0) >> (32 - SLHDSA_SHA2_128S_LEAF_BITS);
+
+  uint8_t addr[32] = {0};
+  slhdsa_set_tree_addr(addr, idx_tree);
+  slhdsa_set_type(addr, SLHDSA_SHA2_128S_ADDR_TYPE_FORSTREE);
+  slhdsa_set_keypair_addr(addr, idx_leaf);
+
+  uint8_t pk_fors[SLHDSA_SHA2_128S_N];
+  slhdsa_fors_pk_from_sig(pk_fors, sig_fors, fors_digest, pk_seed, addr);
+
+  return slhdsa_ht_verify(sig_ht, pk_fors, idx_tree, idx_leaf, pk_root,
+                          pk_seed);
+}

data/third_party/boringssl-with-bazel/src/crypto/slhdsa/thash.cc

@@ -0,0 +1,173 @@
+/* Copyright 2024 The BoringSSL Authors
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#include <openssl/base.h>
+
+#include <assert.h>
+#include <string.h>
+
+#include <openssl/sha.h>
+
+#include "../internal.h"
+#include "./params.h"
+#include "./thash.h"
+
+
+// Internal thash function used by F, H, and T_l (Section 11.2, pages 44-46)
+static void slhdsa_thash(uint8_t output[SLHDSA_SHA2_128S_N],
+                         const uint8_t *input, size_t input_blocks,
+                         const uint8_t pk_seed[SLHDSA_SHA2_128S_N],
+                         uint8_t addr[32]) {
+  SHA256_CTX sha256;
+  SHA256_Init(&sha256);
+
+  // Process pubseed with padding to full block.
+  static const uint8_t kZeros[64 - SLHDSA_SHA2_128S_N] = {0};
+  SHA256_Update(&sha256, pk_seed, SLHDSA_SHA2_128S_N);
+  SHA256_Update(&sha256, kZeros, sizeof(kZeros));
+  SHA256_Update(&sha256, addr, SLHDSA_SHA2_128S_SHA256_ADDR_BYTES);
+  SHA256_Update(&sha256, input, input_blocks * SLHDSA_SHA2_128S_N);
+
+  uint8_t hash[32];
+  SHA256_Final(hash, &sha256);
+  OPENSSL_memcpy(output, hash, SLHDSA_SHA2_128S_N);
+}
+
+// Implements PRF_msg function (Section 4.1, page 11 and Section 11.2, pages
+// 44-46)
+void slhdsa_thash_prfmsg(uint8_t output[SLHDSA_SHA2_128S_N],
+                         const uint8_t sk_prf[SLHDSA_SHA2_128S_N],
+                         const uint8_t entropy[SLHDSA_SHA2_128S_N],
+                         const uint8_t header[SLHDSA_M_PRIME_HEADER_LEN],
+                         const uint8_t *ctx, size_t ctx_len, const uint8_t *msg,
+                         size_t msg_len) {
+  // Compute HMAC-SHA256(sk_prf, entropy || header || ctx || msg). We inline
+  // HMAC to avoid an allocation.
+  uint8_t hmac_key[SHA256_CBLOCK];
+  static_assert(SLHDSA_SHA2_128S_N <= SHA256_CBLOCK,
+                "HMAC key is larger than block size");
+  OPENSSL_memcpy(hmac_key, sk_prf, SLHDSA_SHA2_128S_N);
+  for (size_t i = 0; i < SLHDSA_SHA2_128S_N; i++) {
+    hmac_key[i] ^= 0x36;
+  }
+  OPENSSL_memset(hmac_key + SLHDSA_SHA2_128S_N, 0x36,
+                 sizeof(hmac_key) - SLHDSA_SHA2_128S_N);
+
+  SHA256_CTX sha_ctx;
+  SHA256_Init(&sha_ctx);
+  SHA256_Update(&sha_ctx, hmac_key, sizeof(hmac_key));
+  SHA256_Update(&sha_ctx, entropy, SLHDSA_SHA2_128S_N);
+  if (header) {
+    SHA256_Update(&sha_ctx, header, SLHDSA_M_PRIME_HEADER_LEN);
+  }
+  SHA256_Update(&sha_ctx, ctx, ctx_len);
+  SHA256_Update(&sha_ctx, msg, msg_len);
+  uint8_t hash[SHA256_DIGEST_LENGTH];
+  SHA256_Final(hash, &sha_ctx);
+
+  for (size_t i = 0; i < SLHDSA_SHA2_128S_N; i++) {
+    hmac_key[i] ^= 0x36 ^ 0x5c;
+  }
+  OPENSSL_memset(hmac_key + SLHDSA_SHA2_128S_N, 0x5c,
+                 sizeof(hmac_key) - SLHDSA_SHA2_128S_N);
+
+  SHA256_Init(&sha_ctx);
+  SHA256_Update(&sha_ctx, hmac_key, sizeof(hmac_key));
+  SHA256_Update(&sha_ctx, hash, sizeof(hash));
+  SHA256_Final(hash, &sha_ctx);
+
+  // Truncate to SLHDSA_SHA2_128S_N bytes
+  OPENSSL_memcpy(output, hash, SLHDSA_SHA2_128S_N);
+}
+
+// Implements H_msg function (Section 4.1, page 11 and Section 11.2, pages
+// 44-46)
+void slhdsa_thash_hmsg(uint8_t output[SLHDSA_SHA2_128S_DIGEST_SIZE],
+                       const uint8_t r[SLHDSA_SHA2_128S_N],
+                       const uint8_t pk_seed[SLHDSA_SHA2_128S_N],
+                       const uint8_t pk_root[SLHDSA_SHA2_128S_N],
+                       const uint8_t header[SLHDSA_M_PRIME_HEADER_LEN],
+                       const uint8_t *ctx, size_t ctx_len, const uint8_t *msg,
+                       size_t msg_len) {
+  // MGF1-SHA-256(R || PK.seed || SHA-256(R || PK.seed || PK.root || header ||
+  // ctx || M), m) input_buffer stores R || PK_SEED || SHA256(..) || 4-byte
+  // index
+  uint8_t input_buffer[2 * SLHDSA_SHA2_128S_N + 32 + 4] = {0};
+  OPENSSL_memcpy(input_buffer, r, SLHDSA_SHA2_128S_N);
+  OPENSSL_memcpy(input_buffer + SLHDSA_SHA2_128S_N, pk_seed,
+                 SLHDSA_SHA2_128S_N);
+
+  // Inner hash
+  SHA256_CTX sha_ctx;
+  SHA256_Init(&sha_ctx);
+  SHA256_Update(&sha_ctx, r, SLHDSA_SHA2_128S_N);
+  SHA256_Update(&sha_ctx, pk_seed, SLHDSA_SHA2_128S_N);
+  SHA256_Update(&sha_ctx, pk_root, SLHDSA_SHA2_128S_N);
+  if (header) {
+    SHA256_Update(&sha_ctx, header, SLHDSA_M_PRIME_HEADER_LEN);
+  }
+  SHA256_Update(&sha_ctx, ctx, ctx_len);
+  SHA256_Update(&sha_ctx, msg, msg_len);
+  // Write directly into the input buffer
+  SHA256_Final(input_buffer + 2 * SLHDSA_SHA2_128S_N, &sha_ctx);
+
+  // MGF1-SHA-256
+  uint8_t hash[32];
+  static_assert(SLHDSA_SHA2_128S_DIGEST_SIZE < sizeof(hash),
+                "More MGF1 iterations required");
+  SHA256(input_buffer, sizeof(input_buffer), hash);
+  OPENSSL_memcpy(output, hash, SLHDSA_SHA2_128S_DIGEST_SIZE);
+}
+
+// Implements PRF function (Section 4.1, page 11 and Section 11.2, pages 44-46)
+void slhdsa_thash_prf(uint8_t output[SLHDSA_SHA2_128S_N],
+                      const uint8_t pk_seed[SLHDSA_SHA2_128S_N],
+                      const uint8_t sk_seed[SLHDSA_SHA2_128S_N],
+                      uint8_t addr[32]) {
+  slhdsa_thash(output, sk_seed, 1, pk_seed, addr);
+}
+
+// Implements T_l function for WOTS+ public key compression (Section 4.1, page
+// 11 and Section 11.2, pages 44-46)
+void slhdsa_thash_tl(uint8_t output[SLHDSA_SHA2_128S_N],
+                     const uint8_t input[SLHDSA_SHA2_128S_WOTS_BYTES],
+                     const uint8_t pk_seed[SLHDSA_SHA2_128S_N],
+                     uint8_t addr[32]) {
+  slhdsa_thash(output, input, SLHDSA_SHA2_128S_WOTS_LEN, pk_seed, addr);
+}
+
+// Implements H function (Section 4.1, page 11 and Section 11.2, pages 44-46)
+void slhdsa_thash_h(uint8_t output[SLHDSA_SHA2_128S_N],
+                    const uint8_t input[2 * SLHDSA_SHA2_128S_N],
+                    const uint8_t pk_seed[SLHDSA_SHA2_128S_N],
+                    uint8_t addr[32]) {
+  slhdsa_thash(output, input, 2, pk_seed, addr);
+}
+
+// Implements F function (Section 4.1, page 11 and Section 11.2, pages 44-46)
+void slhdsa_thash_f(uint8_t output[SLHDSA_SHA2_128S_N],
+                    const uint8_t input[SLHDSA_SHA2_128S_N],
+                    const uint8_t pk_seed[SLHDSA_SHA2_128S_N],
+                    uint8_t addr[32]) {
+  slhdsa_thash(output, input, 1, pk_seed, addr);
+}
+
+// Implements T_k function for FORS public key compression (Section 4.1, page 11
+// and Section 11.2, pages 44-46)
+void slhdsa_thash_tk(
+    uint8_t output[SLHDSA_SHA2_128S_N],
+    const uint8_t input[SLHDSA_SHA2_128S_FORS_TREES * SLHDSA_SHA2_128S_N],
+    const uint8_t pk_seed[SLHDSA_SHA2_128S_N], uint8_t addr[32]) {
+  slhdsa_thash(output, input, SLHDSA_SHA2_128S_FORS_TREES, pk_seed, addr);
+}