slh-dsa 0.0.1

package/dist/index.d.ts

@@ -0,0 +1,62 @@
+import { type CHash } from '@noble/hashes/utils.js';
+import { type Signer } from './utils.js';
+/**
+ * * N: Security parameter (in bytes). W: Winternitz parameter
+ * * H: Hypertree height. D: Hypertree layers
+ * * K: FORS trees numbers. A: FORS trees height
+ */
+export type SphincsOpts = {
+    N: number;
+    W: number;
+    H: number;
+    D: number;
+    K: number;
+    A: number;
+    securityLevel: number;
+};
+export type SphincsHashOpts = {
+    isCompressed?: boolean;
+    getContext: GetContext;
+};
+/** Winternitz signature params. */
+export declare const PARAMS: Record<string, SphincsOpts>;
+/** Address, byte array of size ADDR_BYTES */
+export type ADRS = Uint8Array;
+export type Context = {
+    PRFaddr: (addr: ADRS) => Uint8Array;
+    PRFmsg: (skPRF: Uint8Array, random: Uint8Array, msg: Uint8Array) => Uint8Array;
+    Hmsg: (R: Uint8Array, pk: Uint8Array, m: Uint8Array, outLen: number) => Uint8Array;
+    thash1: (input: Uint8Array, addr: ADRS) => Uint8Array;
+    thashN: (blocks: number, input: Uint8Array, addr: ADRS) => Uint8Array;
+    clean: () => void;
+};
+export type GetContext = (opts: SphincsOpts) => (pub_seed: Uint8Array, sk_seed?: Uint8Array) => Context;
+export type SphincsSigner = Signer & {
+    internal: Signer;
+    securityLevel: number;
+    prehash: (hash: CHash) => Signer;
+};
+/** SLH-DSA: 128-bit fast SHAKE version. */
+export declare const slh_dsa_shake_128f: SphincsSigner;
+/** SLH-DSA: 128-bit short SHAKE version. */
+export declare const slh_dsa_shake_128s: SphincsSigner;
+/** SLH-DSA: 192-bit fast SHAKE version. */
+export declare const slh_dsa_shake_192f: SphincsSigner;
+/** SLH-DSA: 192-bit short SHAKE version. */
+export declare const slh_dsa_shake_192s: SphincsSigner;
+/** SLH-DSA: 256-bit fast SHAKE version. */
+export declare const slh_dsa_shake_256f: SphincsSigner;
+/** SLH-DSA: 256-bit short SHAKE version. */
+export declare const slh_dsa_shake_256s: SphincsSigner;
+/** SLH-DSA: 128-bit fast SHA2 version. */
+export declare const slh_dsa_sha2_128f: SphincsSigner;
+/** SLH-DSA: 128-bit small SHA2 version. */
+export declare const slh_dsa_sha2_128s: SphincsSigner;
+/** SLH-DSA: 192-bit fast SHA2 version. */
+export declare const slh_dsa_sha2_192f: SphincsSigner;
+/** SLH-DSA: 192-bit small SHA2 version. */
+export declare const slh_dsa_sha2_192s: SphincsSigner;
+/** SLH-DSA: 256-bit fast SHA2 version. */
+export declare const slh_dsa_sha2_256f: SphincsSigner;
+/** SLH-DSA: 256-bit small SHA2 version. */
+export declare const slh_dsa_sha2_256s: SphincsSigner;

package/dist/index.js

@@ -0,0 +1,625 @@
+/**
+ * SLH-DSA: StateLess Hash-based Digital Signature Standard from
+ * [FIPS-205](https://csrc.nist.gov/pubs/fips/205/ipd). A.k.a. Sphincs+ v3.1.
+ *
+ * There are many different kinds of SLH, but basically `sha2` / `shake` indicate internal hash,
+ * `128` / `192` / `256` indicate security level, and `s` /`f` indicate trade-off (Small / Fast).
+ *
+ * Hashes function similarly to signatures. You hash a private key to get a public key,
+ * which can be used to verify the private key. However, this only works once since
+ * disclosing the pre-image invalidates the key.
+ *
+ * To address the "one-time" limitation, we can use a Merkle tree root hash:
+ * h(h(h(0) || h(1)) || h(h(2) || h(3))))
+ *
+ * This allows us to have the same public key output from the hash, but disclosing one
+ * path in the tree doesn't invalidate the others. By choosing a path related to the
+ * message, we can "sign" it.
+ *
+ * Limitation: Only a fixed number of signatures can be made. For instance, a Merkle tree
+ * with depth 8 allows 256 distinct messages. Using different trees for each node can
+ * prevent forgeries, but the key will still degrade over time.
+ *
+ * WOTS: One-time signatures (can be forged if same key used twice).
+ * FORS: Forest of Random Subsets
+ *
+ * Check out [official site](https://sphincs.org) & [repo](https://github.com/sphincs/sphincsplus).
+ * @module
+ */
+/*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
+import { hmac } from '@noble/hashes/hmac.js';
+import { sha256, sha512 } from '@noble/hashes/sha2.js';
+import { shake256 } from '@noble/hashes/sha3.js';
+import { bytesToHex, concatBytes, createView, hexToBytes, } from '@noble/hashes/utils.js';
+import { abytes, checkHash, cleanBytes, copyBytes, equalBytes, getMask, getMessage, getMessagePrehash, randomBytes, splitCoder, validateSigOpts, validateVerOpts, vecCoder, } from './utils.js';
+/** Winternitz signature params. */
+export const PARAMS = {
+    '128f': { W: 16, N: 16, H: 66, D: 22, K: 33, A: 6, securityLevel: 128 },
+    '128s': { W: 16, N: 16, H: 63, D: 7, K: 14, A: 12, securityLevel: 128 },
+    '192f': { W: 16, N: 24, H: 66, D: 22, K: 33, A: 8, securityLevel: 192 },
+    '192s': { W: 16, N: 24, H: 63, D: 7, K: 17, A: 14, securityLevel: 192 },
+    '256f': { W: 16, N: 32, H: 68, D: 17, K: 35, A: 9, securityLevel: 256 },
+    '256s': { W: 16, N: 32, H: 64, D: 8, K: 22, A: 14, securityLevel: 256 },
+};
+const AddressType = {
+    WOTS: 0,
+    WOTSPK: 1,
+    HASHTREE: 2,
+    FORSTREE: 3,
+    FORSPK: 4,
+    WOTSPRF: 5,
+    FORSPRF: 6,
+};
+function hexToNumber(hex) {
+    if (typeof hex !== 'string')
+        throw new Error('hex string expected, got ' + typeof hex);
+    return BigInt(hex === '' ? '0' : '0x' + hex); // Big Endian
+}
+// BE: Big Endian, LE: Little Endian
+function bytesToNumberBE(bytes) {
+    return hexToNumber(bytesToHex(bytes));
+}
+function numberToBytesBE(n, len) {
+    return hexToBytes(n.toString(16).padStart(len * 2, '0'));
+}
+// Same as bitsCoder.decode, but maybe spec will change and unify with base2bBE.
+const base2b = (outLen, b) => {
+    const mask = getMask(b);
+    return (bytes) => {
+        const baseB = new Uint32Array(outLen);
+        for (let out = 0, pos = 0, bits = 0, total = 0; out < outLen; out++) {
+            while (bits < b) {
+                total = (total << 8) | bytes[pos++];
+                bits += 8;
+            }
+            bits -= b;
+            baseB[out] = (total >>> bits) & mask;
+        }
+        return baseB;
+    };
+};
+function getMaskBig(bits) {
+    return (1n << BigInt(bits)) - 1n; // 4 -> 0b1111
+}
+function gen(opts, hashOpts) {
+    const { N, W, H, D, K, A, securityLevel: securityLevel } = opts;
+    const getContext = hashOpts.getContext(opts);
+    if (W !== 16)
+        throw new Error('Unsupported Winternitz parameter');
+    const WOTS_LOGW = 4;
+    const WOTS_LEN1 = Math.floor((8 * N) / WOTS_LOGW);
+    const WOTS_LEN2 = N <= 8 ? 2 : N <= 136 ? 3 : 4;
+    const TREE_HEIGHT = Math.floor(H / D);
+    const WOTS_LEN = WOTS_LEN1 + WOTS_LEN2;
+    let ADDR_BYTES = 22;
+    let OFFSET_LAYER = 0;
+    let OFFSET_TREE = 1;
+    let OFFSET_TYPE = 9;
+    let OFFSET_KP_ADDR2 = 12;
+    let OFFSET_KP_ADDR1 = 13;
+    let OFFSET_CHAIN_ADDR = 17;
+    let OFFSET_TREE_INDEX = 18;
+    let OFFSET_HASH_ADDR = 21;
+    if (!hashOpts.isCompressed) {
+        ADDR_BYTES = 32;
+        OFFSET_LAYER += 3;
+        OFFSET_TREE += 7;
+        OFFSET_TYPE += 10;
+        OFFSET_KP_ADDR2 += 10;
+        OFFSET_KP_ADDR1 += 10;
+        OFFSET_CHAIN_ADDR += 10;
+        OFFSET_TREE_INDEX += 10;
+        OFFSET_HASH_ADDR += 10;
+    }
+    const setAddr = (opts, addr = new Uint8Array(ADDR_BYTES)) => {
+        const { type, height, tree, layer, index, chain, hash, keypair } = opts;
+        const { subtreeAddr, keypairAddr } = opts;
+        const v = createView(addr);
+        if (height !== undefined)
+            addr[OFFSET_CHAIN_ADDR] = height;
+        if (layer !== undefined)
+            addr[OFFSET_LAYER] = layer;
+        if (type !== undefined)
+            addr[OFFSET_TYPE] = type;
+        if (chain !== undefined)
+            addr[OFFSET_CHAIN_ADDR] = chain;
+        if (hash !== undefined)
+            addr[OFFSET_HASH_ADDR] = hash;
+        if (index !== undefined)
+            v.setUint32(OFFSET_TREE_INDEX, index, false);
+        if (subtreeAddr)
+            addr.set(subtreeAddr.subarray(0, OFFSET_TREE + 8));
+        if (tree !== undefined)
+            v.setBigUint64(OFFSET_TREE, tree, false);
+        if (keypair !== undefined) {
+            addr[OFFSET_KP_ADDR1] = keypair;
+            if (TREE_HEIGHT > 8)
+                addr[OFFSET_KP_ADDR2] = keypair >>> 8;
+        }
+        if (keypairAddr) {
+            addr.set(keypairAddr.subarray(0, OFFSET_TREE + 8));
+            addr[OFFSET_KP_ADDR1] = keypairAddr[OFFSET_KP_ADDR1];
+            if (TREE_HEIGHT > 8)
+                addr[OFFSET_KP_ADDR2] = keypairAddr[OFFSET_KP_ADDR2];
+        }
+        return addr;
+    };
+    const chainCoder = base2b(WOTS_LEN2, WOTS_LOGW);
+    const chainLengths = (msg) => {
+        const W1 = base2b(WOTS_LEN1, WOTS_LOGW)(msg);
+        let csum = 0;
+        for (let i = 0; i < W1.length; i++)
+            csum += W - 1 - W1[i]; // ▷ Compute checksum
+        csum <<= (8 - ((WOTS_LEN2 * WOTS_LOGW) % 8)) % 8; // csum ← csum ≪ ((8 − ((len2 · lg(w)) mod 8)) mod 8
+        // Checksum to base(LOG_W)
+        const W2 = chainCoder(numberToBytesBE(csum, Math.ceil((WOTS_LEN2 * WOTS_LOGW) / 8)));
+        // W1 || W2 (concatBytes cannot concat TypedArrays)
+        const lengths = new Uint32Array(WOTS_LEN);
+        lengths.set(W1);
+        lengths.set(W2, W1.length);
+        return lengths;
+    };
+    const messageToIndices = base2b(K, A);
+    const TREE_BITS = TREE_HEIGHT * (D - 1);
+    const LEAF_BITS = TREE_HEIGHT;
+    const hashMsgCoder = splitCoder('hashedMessage', Math.ceil((A * K) / 8), Math.ceil(TREE_BITS / 8), Math.ceil(TREE_HEIGHT / 8));
+    const hashMessage = (R, pkSeed, msg, context) => {
+        const digest = context.Hmsg(R, pkSeed, msg, hashMsgCoder.bytesLen); // digest ← Hmsg(R, PK.seed, PK.root, M)
+        const [md, tmpIdxTree, tmpIdxLeaf] = hashMsgCoder.decode(digest);
+        const tree = bytesToNumberBE(tmpIdxTree) & getMaskBig(TREE_BITS);
+        const leafIdx = Number(bytesToNumberBE(tmpIdxLeaf)) & getMask(LEAF_BITS);
+        return { tree, leafIdx, md };
+    };
+    const treehash = (height, fn) => function treehash_i(context, leafIdx, idxOffset, treeAddr, info) {
+        const maxIdx = (1 << height) - 1;
+        const stack = new Uint8Array(height * N);
+        const authPath = new Uint8Array(height * N);
+        for (let idx = 0;; idx++) {
+            const current = new Uint8Array(2 * N);
+            const cur0 = current.subarray(0, N);
+            const cur1 = current.subarray(N);
+            const addrOffset = idx + idxOffset;
+            cur1.set(fn(leafIdx, addrOffset, context, info));
+            let h = 0;
+            for (let i = idx, o = idxOffset, l = leafIdx;; h++, i >>>= 1, l >>>= 1, o >>>= 1) {
+                if (h === height)
+                    return { root: cur1, authPath }; // Returns from here
+                if ((i ^ l) === 1)
+                    authPath.subarray(h * N).set(cur1); // authPath.push(cur1)
+                if ((i & 1) === 0 && idx < maxIdx)
+                    break;
+                setAddr({ height: h + 1, index: (i >> 1) + (o >> 1) }, treeAddr);
+                cur0.set(stack.subarray(h * N).subarray(0, N));
+                cur1.set(context.thashN(2, current, treeAddr));
+            }
+            stack.subarray(h * N).set(cur1); // stack.push(cur1)
+        }
+        // @ts-ignore
+        throw new Error('Unreachable code path reached, report this error');
+    };
+    const wotsTreehash = treehash(TREE_HEIGHT, (leafIdx, addrOffset, context, info) => {
+        const wotsPk = new Uint8Array(WOTS_LEN * N);
+        const wotsKmask = addrOffset === leafIdx ? 0 : ~0 >>> 0;
+        setAddr({ keypair: addrOffset }, info.leafAddr);
+        setAddr({ keypair: addrOffset }, info.pkAddr);
+        for (let i = 0; i < WOTS_LEN; i++) {
+            const wotsK = info.wotsSteps[i] | wotsKmask;
+            const pk = wotsPk.subarray(i * N, (i + 1) * N);
+            setAddr({ chain: i, hash: 0, type: AddressType.WOTSPRF }, info.leafAddr);
+            pk.set(context.PRFaddr(info.leafAddr));
+            setAddr({ type: AddressType.WOTS }, info.leafAddr);
+            for (let k = 0;; k++) {
+                if (k === wotsK)
+                    info.wotsSig.subarray(i * N).set(pk); //wotsSig.push()
+                if (k === W - 1)
+                    break;
+                setAddr({ hash: k }, info.leafAddr);
+                pk.set(context.thash1(pk, info.leafAddr));
+            }
+        }
+        return context.thashN(WOTS_LEN, wotsPk, info.pkAddr);
+    });
+    const forsTreehash = treehash(A, (_, addrOffset, context, forsLeafAddr) => {
+        setAddr({ type: AddressType.FORSPRF, index: addrOffset }, forsLeafAddr);
+        const prf = context.PRFaddr(forsLeafAddr);
+        setAddr({ type: AddressType.FORSTREE }, forsLeafAddr);
+        return context.thash1(prf, forsLeafAddr);
+    });
+    const merkleSign = (context, wotsAddr, treeAddr, leafIdx, prevRoot = new Uint8Array(N)) => {
+        setAddr({ type: AddressType.HASHTREE }, treeAddr);
+        // State variables
+        const info = {
+            wotsSig: new Uint8Array(wotsCoder.bytesLen),
+            wotsSteps: chainLengths(prevRoot),
+            leafAddr: setAddr({ subtreeAddr: wotsAddr }),
+            pkAddr: setAddr({ type: AddressType.WOTSPK, subtreeAddr: wotsAddr }),
+        };
+        const { root, authPath } = wotsTreehash(context, leafIdx, 0, treeAddr, info);
+        return {
+            root,
+            sigWots: info.wotsSig.subarray(0, WOTS_LEN * N),
+            sigAuth: authPath,
+        };
+    };
+    const computeRoot = (leaf, leafIdx, idxOffset, authPath, treeHeight, context, addr) => {
+        const buffer = new Uint8Array(2 * N);
+        const b0 = buffer.subarray(0, N);
+        const b1 = buffer.subarray(N, 2 * N);
+        // First iter
+        if ((leafIdx & 1) !== 0) {
+            b1.set(leaf.subarray(0, N));
+            b0.set(authPath.subarray(0, N));
+        }
+        else {
+            b0.set(leaf.subarray(0, N));
+            b1.set(authPath.subarray(0, N));
+        }
+        leafIdx >>>= 1;
+        idxOffset >>>= 1;
+        // Rest
+        for (let i = 0; i < treeHeight - 1; i++, leafIdx >>= 1, idxOffset >>= 1) {
+            setAddr({ height: i + 1, index: leafIdx + idxOffset }, addr);
+            const a = authPath.subarray((i + 1) * N, (i + 2) * N);
+            if ((leafIdx & 1) !== 0) {
+                b1.set(context.thashN(2, buffer, addr));
+                b0.set(a);
+            }
+            else {
+                buffer.set(context.thashN(2, buffer, addr));
+                b1.set(a);
+            }
+        }
+        // Root
+        setAddr({ height: treeHeight, index: leafIdx + idxOffset }, addr);
+        return context.thashN(2, buffer, addr);
+    };
+    const seedCoder = splitCoder('seed', N, N, N);
+    const publicCoder = splitCoder('publicKey', N, N);
+    const secretCoder = splitCoder('secretKey', N, N, publicCoder.bytesLen);
+    const forsCoder = vecCoder(splitCoder('fors', N, N * A), K);
+    const wotsCoder = vecCoder(splitCoder('wots', WOTS_LEN * N, TREE_HEIGHT * N), D);
+    const sigCoder = splitCoder('signature', N, forsCoder, wotsCoder); // random || fors || wots
+    const internal = {
+        info: { type: 'internal-slh-dsa' },
+        lengths: {
+            publicKey: publicCoder.bytesLen,
+            secretKey: secretCoder.bytesLen,
+            signature: sigCoder.bytesLen,
+            seed: seedCoder.bytesLen,
+            signRand: N,
+        },
+        keygen(seed) {
+            if (seed !== undefined)
+                abytes(seed, seedCoder.bytesLen, 'seed');
+            seed = seed === undefined ? randomBytes(seedCoder.bytesLen) : copyBytes(seed);
+            // Set SK.seed, SK.prf, and PK.seed to random n-byte
+            const [secretSeed, secretPRF, publicSeed] = seedCoder.decode(seed);
+            const context = getContext(publicSeed, secretSeed);
+            // ADRS.setLayerAddress(d − 1)
+            const topTreeAddr = setAddr({ layer: D - 1 });
+            const wotsAddr = setAddr({ layer: D - 1 });
+            //PK.root ←_xmss node(SK.seed, 0, h′, PK.seed, ADRS)
+            const { root } = merkleSign(context, wotsAddr, topTreeAddr, ~0 >>> 0);
+            const publicKey = publicCoder.encode([publicSeed, root]);
+            const secretKey = secretCoder.encode([secretSeed, secretPRF, publicKey]);
+            context.clean();
+            cleanBytes(secretSeed, secretPRF, root, wotsAddr, topTreeAddr);
+            return { publicKey, secretKey };
+        },
+        getPublicKey: (secretKey) => {
+            const [_skSeed, _skPRF, pk] = secretCoder.decode(secretKey);
+            return Uint8Array.from(pk);
+        },
+        sign: (msg, sk, opts = {}) => {
+            validateSigOpts(opts);
+            let { extraEntropy: random } = opts;
+            const [skSeed, skPRF, pk] = secretCoder.decode(sk); // todo: fix
+            const [pkSeed, _] = publicCoder.decode(pk);
+            // Set opt_rand to either PK.seed or to a random n-byte string
+            if (random === false)
+                random = copyBytes(pkSeed);
+            else if (random === undefined)
+                random = randomBytes(N);
+            else
+                random = copyBytes(random);
+            abytes(random, N);
+            const context = getContext(pkSeed, skSeed);
+            // Generate randomizer
+            const R = context.PRFmsg(skPRF, random, msg); // R ← PRFmsg(SK.prf, opt_rand, M)
+            let { tree, leafIdx, md } = hashMessage(R, pk, msg, context);
+            // Create FORS signatures
+            const wotsAddr = setAddr({
+                type: AddressType.WOTS,
+                tree,
+                keypair: leafIdx,
+            });
+            const roots = [];
+            const forsLeaf = setAddr({ keypairAddr: wotsAddr });
+            const forsTreeAddr = setAddr({ keypairAddr: wotsAddr });
+            const indices = messageToIndices(md);
+            const fors = [];
+            for (let i = 0; i < indices.length; i++) {
+                const idxOffset = i << A;
+                setAddr({
+                    type: AddressType.FORSPRF,
+                    height: 0,
+                    index: indices[i] + idxOffset,
+                }, forsTreeAddr);
+                const prf = context.PRFaddr(forsTreeAddr);
+                setAddr({ type: AddressType.FORSTREE }, forsTreeAddr);
+                const { root, authPath } = forsTreehash(context, indices[i], idxOffset, forsTreeAddr, forsLeaf);
+                roots.push(root);
+                fors.push([prf, authPath]);
+            }
+            const forsPkAddr = setAddr({
+                type: AddressType.FORSPK,
+                keypairAddr: wotsAddr,
+            });
+            const root = context.thashN(K, concatBytes(...roots), forsPkAddr);
+            // WOTS signatures
+            const treeAddr = setAddr({ type: AddressType.HASHTREE });
+            const wots = [];
+            for (let i = 0; i < D; i++, tree >>= BigInt(TREE_HEIGHT)) {
+                setAddr({ tree, layer: i }, treeAddr);
+                setAddr({ subtreeAddr: treeAddr, keypair: leafIdx }, wotsAddr);
+                const { sigWots, sigAuth, root: r, } = merkleSign(context, wotsAddr, treeAddr, leafIdx, root);
+                root.set(r);
+                cleanBytes(r);
+                wots.push([sigWots, sigAuth]);
+                leafIdx = Number(tree & getMaskBig(TREE_HEIGHT));
+            }
+            context.clean();
+            const SIG = sigCoder.encode([R, fors, wots]);
+            cleanBytes(R, random, treeAddr, wotsAddr, forsLeaf, forsTreeAddr, indices, roots);
+            return SIG;
+        },
+        verify: (sig, msg, publicKey) => {
+            const [pkSeed, pubRoot] = publicCoder.decode(publicKey);
+            const [random, forsVec, wotsVec] = sigCoder.decode(sig);
+            const pk = publicKey;
+            if (sig.length !== sigCoder.bytesLen)
+                return false;
+            const context = getContext(pkSeed);
+            let { tree, leafIdx, md } = hashMessage(random, pk, msg, context);
+            const wotsAddr = setAddr({
+                type: AddressType.WOTS,
+                tree,
+                keypair: leafIdx,
+            });
+            // FORS signature
+            const roots = [];
+            const forsTreeAddr = setAddr({
+                type: AddressType.FORSTREE,
+                keypairAddr: wotsAddr,
+            });
+            const indices = messageToIndices(md);
+            for (let i = 0; i < forsVec.length; i++) {
+                const [prf, authPath] = forsVec[i];
+                const idxOffset = i << A;
+                setAddr({ height: 0, index: indices[i] + idxOffset }, forsTreeAddr);
+                const leaf = context.thash1(prf, forsTreeAddr);
+                // Compute inplace, because we need all roots in same byte array
+                roots.push(computeRoot(leaf, indices[i], idxOffset, authPath, A, context, forsTreeAddr));
+            }
+            const forsPkAddr = setAddr({
+                type: AddressType.FORSPK,
+                keypairAddr: wotsAddr,
+            });
+            let root = context.thashN(K, concatBytes(...roots), forsPkAddr); // root = thash()
+            // WOTS signature
+            const treeAddr = setAddr({ type: AddressType.HASHTREE });
+            const wotsPkAddr = setAddr({ type: AddressType.WOTSPK });
+            const wotsPk = new Uint8Array(WOTS_LEN * N);
+            for (let i = 0; i < wotsVec.length; i++, tree >>= BigInt(TREE_HEIGHT)) {
+                const [wots, sigAuth] = wotsVec[i];
+                setAddr({ tree, layer: i }, treeAddr);
+                setAddr({ subtreeAddr: treeAddr, keypair: leafIdx }, wotsAddr);
+                setAddr({ keypairAddr: wotsAddr }, wotsPkAddr);
+                const lengths = chainLengths(root);
+                for (let i = 0; i < WOTS_LEN; i++) {
+                    setAddr({ chain: i }, wotsAddr);
+                    const steps = W - 1 - lengths[i];
+                    const start = lengths[i];
+                    const out = wotsPk.subarray(i * N);
+                    out.set(wots.subarray(i * N, (i + 1) * N));
+                    for (let j = start; j < start + steps && j < W; j++) {
+                        setAddr({ hash: j }, wotsAddr);
+                        out.set(context.thash1(out, wotsAddr));
+                    }
+                }
+                const leaf = context.thashN(WOTS_LEN, wotsPk, wotsPkAddr);
+                root = computeRoot(leaf, leafIdx, 0, sigAuth, TREE_HEIGHT, context, treeAddr);
+                leafIdx = Number(tree & getMaskBig(TREE_HEIGHT));
+            }
+            return equalBytes(root, pubRoot);
+        },
+    };
+    return {
+        info: { type: 'slh-dsa' },
+        internal,
+        securityLevel: securityLevel,
+        lengths: internal.lengths,
+        keygen: internal.keygen,
+        getPublicKey: internal.getPublicKey,
+        sign: (msg, secretKey, opts = {}) => {
+            validateSigOpts(opts);
+            const M = getMessage(msg, opts.context);
+            const res = internal.sign(M, secretKey, opts);
+            cleanBytes(M);
+            return res;
+        },
+        verify: (sig, msg, publicKey, opts = {}) => {
+            validateVerOpts(opts);
+            return internal.verify(sig, getMessage(msg, opts.context), publicKey);
+        },
+        prehash: (hash) => {
+            checkHash(hash, securityLevel);
+            return {
+                info: { type: 'hashslh-dsa' },
+                lengths: internal.lengths,
+                keygen: internal.keygen,
+                getPublicKey: internal.getPublicKey,
+                sign: (msg, secretKey, opts = {}) => {
+                    validateSigOpts(opts);
+                    const M = getMessagePrehash(hash, msg, opts.context);
+                    const res = internal.sign(M, secretKey, opts);
+                    cleanBytes(M);
+                    return res;
+                },
+                verify: (sig, msg, publicKey, opts = {}) => {
+                    validateVerOpts(opts);
+                    return internal.verify(sig, getMessagePrehash(hash, msg, opts.context), publicKey);
+                },
+            };
+        },
+    };
+}
+const genShake = () => (opts) => (pubSeed, skSeed) => {
+    const { N } = opts;
+    const stats = { prf: 0, thash: 0, hmsg: 0, gen_message_random: 0 };
+    const h0 = shake256.create({}).update(pubSeed);
+    const h0tmp = h0.clone();
+    const thash = (blocks, input, addr) => {
+        stats.thash++;
+        return h0
+            ._cloneInto(h0tmp)
+            .update(addr)
+            .update(input.subarray(0, blocks * N))
+            .xof(N);
+    };
+    return {
+        PRFaddr: (addr) => {
+            if (!skSeed)
+                throw new Error('no sk seed');
+            stats.prf++;
+            const res = h0._cloneInto(h0tmp).update(addr).update(skSeed).xof(N);
+            return res;
+        },
+        PRFmsg: (skPRF, random, msg) => {
+            stats.gen_message_random++;
+            return shake256.create({}).update(skPRF).update(random).update(msg).digest().subarray(0, N);
+        },
+        Hmsg: (R, pk, m, outLen) => {
+            stats.hmsg++;
+            return shake256.create({}).update(R.subarray(0, N)).update(pk).update(m).xof(outLen);
+        },
+        thash1: thash.bind(null, 1),
+        thashN: thash,
+        clean: () => {
+            h0.destroy();
+            h0tmp.destroy();
+            //console.log(stats);
+        },
+    };
+};
+const SHAKE_SIMPLE = { getContext: genShake() };
+/** SLH-DSA: 128-bit fast SHAKE version. */
+export const slh_dsa_shake_128f = /* @__PURE__ */ gen(PARAMS['128f'], SHAKE_SIMPLE);
+/** SLH-DSA: 128-bit short SHAKE version. */
+export const slh_dsa_shake_128s = /* @__PURE__ */ gen(PARAMS['128s'], SHAKE_SIMPLE);
+/** SLH-DSA: 192-bit fast SHAKE version. */
+export const slh_dsa_shake_192f = /* @__PURE__ */ gen(PARAMS['192f'], SHAKE_SIMPLE);
+/** SLH-DSA: 192-bit short SHAKE version. */
+export const slh_dsa_shake_192s = /* @__PURE__ */ gen(PARAMS['192s'], SHAKE_SIMPLE);
+/** SLH-DSA: 256-bit fast SHAKE version. */
+export const slh_dsa_shake_256f = /* @__PURE__ */ gen(PARAMS['256f'], SHAKE_SIMPLE);
+/** SLH-DSA: 256-bit short SHAKE version. */
+export const slh_dsa_shake_256s = /* @__PURE__ */ gen(PARAMS['256s'], SHAKE_SIMPLE);
+const genSha = (h0, h1) => (opts) => (pub_seed, sk_seed) => {
+    const { N } = opts;
+    /*
+    Perf debug stats, how much hashes we call?
+    128f_simple: { prf: 8305, thash: 96_922, hmsg: 1, gen_message_random: 1, mgf1: 2 }
+    256s_robust: { prf: 497_686, thash: 2_783_203, hmsg: 1, gen_message_random: 1, mgf1: 2_783_205}
+    256f_simple: { prf: 36_179, thash: 309_693, hmsg: 1, gen_message_random: 1, mgf1: 2 }
+    */
+    const stats = { prf: 0, thash: 0, hmsg: 0, gen_message_random: 0, mgf1: 0 };
+    const counterB = new Uint8Array(4);
+    const counterV = createView(counterB);
+    const h0ps = h0
+        .create()
+        .update(pub_seed)
+        .update(new Uint8Array(h0.blockLen - N));
+    const h1ps = h1
+        .create()
+        .update(pub_seed)
+        .update(new Uint8Array(h1.blockLen - N));
+    const h0tmp = h0ps.clone();
+    const h1tmp = h1ps.clone();
+    // https://www.rfc-editor.org/rfc/rfc8017.html#appendix-B.2.1
+    function mgf1(seed, length, hash) {
+        stats.mgf1++;
+        const out = new Uint8Array(Math.ceil(length / hash.outputLen) * hash.outputLen);
+        // NOT 2^32-1
+        if (length > 2 ** 32)
+            throw new Error('mask too long');
+        for (let counter = 0, o = out; o.length; counter++) {
+            counterV.setUint32(0, counter, false);
+            hash.create().update(seed).update(counterB).digestInto(o);
+            o = o.subarray(hash.outputLen);
+        }
+        cleanBytes(out.subarray(length));
+        return out.subarray(0, length);
+    }
+    const thash = (_, h, hTmp) => (blocks, input, addr) => {
+        stats.thash++;
+        const d = h
+            ._cloneInto(hTmp)
+            .update(addr)
+            .update(input.subarray(0, blocks * N))
+            .digest();
+        return d.subarray(0, N);
+    };
+    return {
+        PRFaddr: (addr) => {
+            if (!sk_seed)
+                throw new Error('No sk seed');
+            stats.prf++;
+            const res = h0ps
+                ._cloneInto(h0tmp)
+                .update(addr)
+                .update(sk_seed)
+                .digest()
+                .subarray(0, N);
+            return res;
+        },
+        PRFmsg: (skPRF, random, msg) => {
+            stats.gen_message_random++;
+            return hmac.create(h1, skPRF).update(random).update(msg).digest().subarray(0, N);
+        },
+        Hmsg: (R, pk, m, outLen) => {
+            stats.hmsg++;
+            const seed = concatBytes(R.subarray(0, N), pk.subarray(0, N), h1.create().update(R.subarray(0, N)).update(pk).update(m).digest());
+            return mgf1(seed, outLen, h1);
+        },
+        thash1: thash(h0, h0ps, h0tmp).bind(null, 1),
+        thashN: thash(h1, h1ps, h1tmp),
+        clean: () => {
+            h0ps.destroy();
+            h1ps.destroy();
+            h0tmp.destroy();
+            h1tmp.destroy();
+            //console.log(stats);
+        },
+    };
+};
+const SHA256_SIMPLE = {
+    isCompressed: true,
+    getContext: genSha(sha256, sha256),
+};
+const SHA512_SIMPLE = {
+    isCompressed: true,
+    getContext: genSha(sha256, sha512),
+};
+/** SLH-DSA: 128-bit fast SHA2 version. */
+export const slh_dsa_sha2_128f = /* @__PURE__ */ gen(PARAMS['128f'], SHA256_SIMPLE);
+/** SLH-DSA: 128-bit small SHA2 version. */
+export const slh_dsa_sha2_128s = /* @__PURE__ */ gen(PARAMS['128s'], SHA256_SIMPLE);
+/** SLH-DSA: 192-bit fast SHA2 version. */
+export const slh_dsa_sha2_192f = /* @__PURE__ */ gen(PARAMS['192f'], SHA512_SIMPLE);
+/** SLH-DSA: 192-bit small SHA2 version. */
+export const slh_dsa_sha2_192s = /* @__PURE__ */ gen(PARAMS['192s'], SHA512_SIMPLE);
+/** SLH-DSA: 256-bit fast SHA2 version. */
+export const slh_dsa_sha2_256f = /* @__PURE__ */ gen(PARAMS['256f'], SHA512_SIMPLE);
+/** SLH-DSA: 256-bit small SHA2 version. */
+export const slh_dsa_sha2_256s = /* @__PURE__ */ gen(PARAMS['256s'], SHA512_SIMPLE);

package/dist/utils.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Utilities for hex, bytearray and number handling.
+ * @module
+ */
+/*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
+import { type CHash, type TypedArray, concatBytes, randomBytes as randb } from '@noble/hashes/utils.js';
+export { abytes } from '@noble/hashes/utils.js';
+export { concatBytes };
+export declare const randomBytes: typeof randb;
+export declare function equalBytes(a: Uint8Array, b: Uint8Array): boolean;
+export declare function copyBytes(bytes: Uint8Array): Uint8Array;
+export type CryptoKeys = {
+    info?: {
+        type?: string;
+    };
+    lengths: {
+        seed?: number;
+        publicKey?: number;
+        secretKey?: number;
+    };
+    keygen: (seed?: Uint8Array) => {
+        secretKey: Uint8Array;
+        publicKey: Uint8Array;
+    };
+    getPublicKey: (secretKey: Uint8Array) => Uint8Array;
+};
+export type VerOpts = {
+    context?: Uint8Array;
+};
+export type SigOpts = VerOpts & {
+    extraEntropy?: Uint8Array | false;
+};
+export declare function validateOpts(opts: object): void;
+export declare function validateVerOpts(opts: VerOpts): void;
+export declare function validateSigOpts(opts: SigOpts): void;
+/** Generic interface for signatures. Has keygen, sign and verify. */
+export type Signer = CryptoKeys & {
+    lengths: {
+        signRand?: number;
+        signature?: number;
+    };
+    sign: (msg: Uint8Array, secretKey: Uint8Array, opts?: SigOpts) => Uint8Array;
+    verify: (sig: Uint8Array, msg: Uint8Array, publicKey: Uint8Array, opts?: VerOpts) => boolean;
+};
+export type KEM = CryptoKeys & {
+    lengths: {
+        cipherText?: number;
+        msg?: number;
+        msgRand?: number;
+    };
+    encapsulate: (publicKey: Uint8Array, msg?: Uint8Array) => {
+        cipherText: Uint8Array;
+        sharedSecret: Uint8Array;
+    };
+    decapsulate: (cipherText: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+};
+export interface Coder<F, T> {
+    encode(from: F): T;
+    decode(to: T): F;
+}
+export interface BytesCoder<T> extends Coder<T, Uint8Array> {
+    encode: (data: T) => Uint8Array;
+    decode: (bytes: Uint8Array) => T;
+}
+export type BytesCoderLen<T> = BytesCoder<T> & {
+    bytesLen: number;
+};
+type UnCoder<T> = T extends BytesCoder<infer U> ? U : never;
+type SplitOut<T extends (number | BytesCoderLen<any>)[]> = {
+    [K in keyof T]: T[K] extends number ? Uint8Array : UnCoder<T[K]>;
+};
+export declare function splitCoder<T extends (number | BytesCoderLen<any>)[]>(label: string, ...lengths: T): BytesCoder<SplitOut<T>> & {
+    bytesLen: number;
+};
+export declare function vecCoder<T>(c: BytesCoderLen<T>, vecLen: number): BytesCoderLen<T[]>;
+export declare function cleanBytes(...list: (TypedArray | TypedArray[])[]): void;
+export declare function getMask(bits: number): number;
+export declare const EMPTY: Uint8Array;
+export declare function getMessage(msg: Uint8Array, ctx?: Uint8Array): Uint8Array;
+export declare function checkHash(hash: CHash, requiredStrength?: number): void;
+export declare function getMessagePrehash(hash: CHash, msg: Uint8Array, ctx?: Uint8Array): Uint8Array;

package/dist/utils.js

@@ -0,0 +1,137 @@
+/**
+ * Utilities for hex, bytearray and number handling.
+ * @module
+ */
+/*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
+import { abytes, abytes as abytes_, concatBytes, isBytes, randomBytes as randb, } from '@noble/hashes/utils.js';
+export { abytes } from '@noble/hashes/utils.js';
+export { concatBytes };
+export const randomBytes = randb;
+// Compares 2 u8a-s in kinda constant time
+export function equalBytes(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+// copy bytes to new u8a (aligned). Because Buffer.slice is broken.
+export function copyBytes(bytes) {
+    return Uint8Array.from(bytes);
+}
+export function validateOpts(opts) {
+    // We try to catch u8a, since it was previously valid argument at this position
+    if (typeof opts !== 'object' || opts === null || isBytes(opts))
+        throw new Error('expected opts to be an object');
+}
+export function validateVerOpts(opts) {
+    validateOpts(opts);
+    if (opts.context !== undefined)
+        abytes(opts.context, undefined, 'opts.context');
+}
+export function validateSigOpts(opts) {
+    validateVerOpts(opts);
+    if (opts.extraEntropy !== false && opts.extraEntropy !== undefined)
+        abytes(opts.extraEntropy, undefined, 'opts.extraEntropy');
+}
+export function splitCoder(label, ...lengths) {
+    const getLength = (c) => (typeof c === 'number' ? c : c.bytesLen);
+    const bytesLen = lengths.reduce((sum, a) => sum + getLength(a), 0);
+    return {
+        bytesLen,
+        encode: (bufs) => {
+            const res = new Uint8Array(bytesLen);
+            for (let i = 0, pos = 0; i < lengths.length; i++) {
+                const c = lengths[i];
+                const l = getLength(c);
+                const b = typeof c === 'number' ? bufs[i] : c.encode(bufs[i]);
+                abytes_(b, l, label);
+                res.set(b, pos);
+                if (typeof c !== 'number')
+                    b.fill(0); // clean
+                pos += l;
+            }
+            return res;
+        },
+        decode: (buf) => {
+            abytes_(buf, bytesLen, label);
+            const res = [];
+            for (const c of lengths) {
+                const l = getLength(c);
+                const b = buf.subarray(0, l);
+                res.push(typeof c === 'number' ? b : c.decode(b));
+                buf = buf.subarray(l);
+            }
+            return res;
+        },
+    };
+}
+// nano-packed.array (fixed size)
+export function vecCoder(c, vecLen) {
+    const bytesLen = vecLen * c.bytesLen;
+    return {
+        bytesLen,
+        encode: (u) => {
+            if (u.length !== vecLen)
+                throw new Error(`vecCoder.encode: wrong length=${u.length}. Expected: ${vecLen}`);
+            const res = new Uint8Array(bytesLen);
+            for (let i = 0, pos = 0; i < u.length; i++) {
+                const b = c.encode(u[i]);
+                res.set(b, pos);
+                b.fill(0); // clean
+                pos += b.length;
+            }
+            return res;
+        },
+        decode: (a) => {
+            abytes_(a, bytesLen);
+            const r = [];
+            for (let i = 0; i < a.length; i += c.bytesLen)
+                r.push(c.decode(a.subarray(i, i + c.bytesLen)));
+            return r;
+        },
+    };
+}
+// cleanBytes(Uint8Array.of(), [Uint16Array.of(), Uint32Array.of()])
+export function cleanBytes(...list) {
+    for (const t of list) {
+        if (Array.isArray(t))
+            for (const b of t)
+                b.fill(0);
+        else
+            t.fill(0);
+    }
+}
+export function getMask(bits) {
+    return (1 << bits) - 1; // 4 -> 0b1111
+}
+export const EMPTY = Uint8Array.of();
+export function getMessage(msg, ctx = EMPTY) {
+    abytes_(msg);
+    abytes_(ctx);
+    if (ctx.length > 255)
+        throw new Error('context should be less than 255 bytes');
+    return concatBytes(new Uint8Array([0, ctx.length]), ctx, msg);
+}
+// 06 09 60 86 48 01 65 03 04 02
+const oidNistP = /* @__PURE__ */ Uint8Array.from([6, 9, 0x60, 0x86, 0x48, 1, 0x65, 3, 4, 2]);
+export function checkHash(hash, requiredStrength = 0) {
+    if (!hash.oid || !equalBytes(hash.oid.subarray(0, 10), oidNistP))
+        throw new Error('hash.oid is invalid: expected NIST hash');
+    const collisionResistance = (hash.outputLen * 8) / 2;
+    if (requiredStrength > collisionResistance) {
+        throw new Error('Pre-hash security strength too low: ' +
+            collisionResistance +
+            ', required: ' +
+            requiredStrength);
+    }
+}
+export function getMessagePrehash(hash, msg, ctx = EMPTY) {
+    abytes_(msg);
+    abytes_(ctx);
+    if (ctx.length > 255)
+        throw new Error('context should be less than 255 bytes');
+    const hashed = hash(msg);
+    return concatBytes(new Uint8Array([1, ctx.length]), ctx, hash.oid, hashed);
+}

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "slh-dsa",
+  "version": "0.0.1",
+  "type": "module",
+  "description": "Lightweight wrapper for SLH-DSA or SPHINCS+",
+  "author": "Nbrthx",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsc",
+    "test": "node test/test.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "@noble/hashes": "~2.0.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.3"
+  },
+  "keywords": [
+    "post-quantum",
+    "cryptography",
+    "slh-dsa",
+    "sphincs",
+    "signature",
+    "pqcrypto",
+    "nist"
+  ],
+  "license": "MIT"
+}