visaljs 0.0.1 → 0.0.3

package/runtime/third_party/boringssl/crypto/fipsmodule/slhdsa/fors.cc.inc

@@ -0,0 +1,179 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/base.h>
+
+#include <assert.h>
+#include <string.h>
+
+#include "../../internal.h"
+#include "./address.h"
+#include "./fors.h"
+#include "./params.h"
+#include "./thash.h"
+
+
+using namespace bssl;
+
+// Compute the base 2ᵃ representation of `message` (algorithm 4, page 16).
+static void fors_base_b(const slh_dsa_config *config, uint32_t *indices,
+                        const uint8_t *message) {
+  const size_t bits_per_index = config->fors_height;
+  BSSL_CHECK(bits_per_index <= SLHDSA_MAX_FORS_HEIGHT);
+  const size_t total_bits = bits_per_index * config->fors_trees;
+  const size_t msg_bytes = slhdsa_fors_msg_bytes(config);
+  BSSL_CHECK(total_bits <= msg_bytes * 8);
+
+  size_t bit_offset = 0;
+  for (size_t i = 0; i < config->fors_trees; ++i) {
+    uint32_t value = 0;
+    for (size_t j = 0; j < bits_per_index; ++j) {
+      const size_t bit_index = bit_offset + j;
+      const size_t byte_index = bit_index >> 3;
+      const size_t bit_in_byte = 7 - (bit_index & 7);
+      const uint8_t bit = (message[byte_index] >> bit_in_byte) & 0x01;
+      value = (value << 1) | bit;
+    }
+    indices[i] = value;
+    bit_offset += bits_per_index;
+  }
+}
+
+// Implements Algorithm 14: fors_skGen function (page 29)
+void bssl::slhdsa_fors_sk_gen(const slh_dsa_config *config, uint8_t *fors_sk,
+                              uint32_t idx, const uint8_t *sk_seed,
+                              const uint8_t *pk_seed, uint8_t addr[32]) {
+  uint8_t sk_addr[32];
+  OPENSSL_memcpy(sk_addr, addr, sizeof(sk_addr));
+
+  slhdsa_set_type(config, sk_addr, SLHDSA_ADDR_TYPE_FORSPRF);
+  slhdsa_copy_keypair_addr(config, sk_addr, addr);
+  slhdsa_set_tree_index(config, sk_addr, idx);
+  slhdsa_thash_prf(config, fors_sk, pk_seed, sk_seed, sk_addr);
+}
+
+// Implements Algorithm 15: fors_node function (page 30)
+void bssl::slhdsa_fors_treehash(const slh_dsa_config *config,
+                                uint8_t *root_node, const uint8_t *sk_seed,
+                                uint32_t i /*target node index*/,
+                                uint32_t z /*target node height*/,
+                                const uint8_t *pk_seed, uint8_t addr[32]) {
+  BSSL_CHECK(z <= config->fors_height);
+  const uint32_t nodes_in_tree = 1u << (config->fors_height - z);
+  BSSL_CHECK(i < (uint32_t)(config->fors_trees * nodes_in_tree));
+
+  if (z == 0) {
+    uint8_t sk[SLHDSA_MAX_N];
+    slhdsa_set_tree_height(config, addr, 0);
+    slhdsa_set_tree_index(config, addr, i);
+    slhdsa_fors_sk_gen(config, sk, i, sk_seed, pk_seed, addr);
+    slhdsa_thash_f(config, root_node, sk, pk_seed, addr);
+  } else {
+    // Stores left node and right node.
+    uint8_t nodes[2 * SLHDSA_MAX_N];
+    slhdsa_fors_treehash(config, nodes, sk_seed, 2 * i, z - 1, pk_seed, addr);
+    slhdsa_fors_treehash(config, nodes + config->n, sk_seed, 2 * i + 1, z - 1,
+                         pk_seed, addr);
+    slhdsa_set_tree_height(config, addr, z);
+    slhdsa_set_tree_index(config, addr, i);
+    slhdsa_thash_h(config, root_node, nodes, pk_seed, addr);
+  }
+}
+
+// Implements Algorithm 16: fors_sign function (page 31)
+void bssl::slhdsa_fors_sign(const slh_dsa_config *config, uint8_t *fors_sig,
+                            const uint8_t *message, const uint8_t *sk_seed,
+                            const uint8_t *pk_seed, uint8_t addr[32]) {
+  uint32_t indices[SLHDSA_MAX_FORS_TREES];
+  BSSL_CHECK(config->fors_trees <= SLHDSA_MAX_FORS_TREES);
+  BSSL_CHECK(config->fors_height <= SLHDSA_MAX_FORS_HEIGHT);
+
+  // Derive FORS indices compatible with the NIST changes.
+  fors_base_b(config, indices, message);
+
+  const size_t n = config->n;
+  const size_t node_stride = n * (config->fors_height + 1);
+
+  for (uint32_t i = 0; i < config->fors_trees; ++i) {
+    slhdsa_set_tree_height(config, addr, 0);
+    // Write the FORS secret key element to the correct position.
+    uint8_t *tree_sig = fors_sig + i * node_stride;
+    slhdsa_fors_sk_gen(config, tree_sig,
+                       i * (1u << config->fors_height) + indices[i], sk_seed,
+                       pk_seed, addr);
+    for (uint32_t j = 0; j < config->fors_height; ++j) {
+      const size_t sibling = (indices[i] >> j) ^ 1u;
+      // Write the FORS auth path element to the correct position.
+      slhdsa_fors_treehash(config, tree_sig + (j + 1) * n, sk_seed,
+                           i * (1u << (config->fors_height - j)) + sibling, j,
+                           pk_seed, addr);
+    }
+  }
+}
+
+// Implements Algorithm 17: fors_pkFromSig function (page 32)
+void bssl::slhdsa_fors_pk_from_sig(const slh_dsa_config *config,
+                                   uint8_t *fors_pk, const uint8_t *fors_sig,
+                                   const uint8_t *message,
+                                   const uint8_t *pk_seed, uint8_t addr[32]) {
+  uint32_t indices[SLHDSA_MAX_FORS_TREES];
+  uint8_t tmp[2 * SLHDSA_MAX_N];
+  uint8_t roots[SLHDSA_MAX_FORS_TREES * SLHDSA_MAX_N];
+  BSSL_CHECK(config->fors_trees <= SLHDSA_MAX_FORS_TREES);
+  BSSL_CHECK(config->fors_height <= SLHDSA_MAX_FORS_HEIGHT);
+
+  // Derive FORS indices compatible with the NIST changes.
+  fors_base_b(config, indices, message);
+
+  const size_t n = config->n;
+  const size_t node_stride = n * (config->fors_height + 1);
+
+  for (size_t i = 0; i < config->fors_trees; ++i) {
+    // Pointer to current sk and authentication path
+    const uint8_t *tree_sig = fors_sig + i * node_stride;
+    const uint8_t *auth = tree_sig + n;
+    uint8_t nodes[2 * SLHDSA_MAX_N];
+
+    slhdsa_set_tree_height(config, addr, 0);
+    uint32_t index = i * (1ULL << config->fors_height) + indices[i];
+    slhdsa_set_tree_index(config, addr, index);
+
+    slhdsa_thash_f(config, nodes, tree_sig, pk_seed, addr);
+
+    for (uint32_t j = 0; j < config->fors_height; ++j) {
+      slhdsa_set_tree_height(config, addr, j + 1);
+      index >>= 1;
+      slhdsa_set_tree_index(config, addr, index);
+
+      // Even node
+      if (((indices[i] >> j) & 1) == 0) {
+        OPENSSL_memcpy(tmp, nodes, n);
+        OPENSSL_memcpy(tmp + n, auth + j * n, n);
+        slhdsa_thash_h(config, nodes + n, tmp, pk_seed, addr);
+      } else {
+        OPENSSL_memcpy(tmp, auth + j * n, n);
+        OPENSSL_memcpy(tmp + n, nodes, n);
+        slhdsa_thash_h(config, nodes + n, tmp, pk_seed, addr);
+      }
+      OPENSSL_memcpy(nodes, nodes + n, n);
+    }
+    OPENSSL_memcpy(roots + i * n, nodes, n);
+  }
+
+  uint8_t forspk_addr[32];
+  OPENSSL_memcpy(forspk_addr, addr, sizeof(forspk_addr));
+  slhdsa_set_type(config, forspk_addr, SLHDSA_ADDR_TYPE_FORSPK);
+  slhdsa_copy_keypair_addr(config, forspk_addr, addr);
+  slhdsa_thash_tk(config, fors_pk, roots, pk_seed, forspk_addr);
+}

package/runtime/third_party/boringssl/crypto/fipsmodule/slhdsa/fors.h

@@ -0,0 +1,48 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_FORS_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_FORS_H
+
+#include "./params.h"
+
+
+BSSL_NAMESPACE_BEGIN
+
+// Implements Algorithm 14: fors_skGen function (page 29)
+void slhdsa_fors_sk_gen(const slh_dsa_config *config, uint8_t *fors_sk,
+                        uint32_t idx, const uint8_t *sk_seed,
+                        const uint8_t *pk_seed, uint8_t addr[32]);
+
+// Implements Algorithm 15: fors_node function (page 30)
+void slhdsa_fors_treehash(const slh_dsa_config *config, uint8_t *root_node,
+                          const uint8_t *sk_seed,
+                          uint32_t i /*target node index*/,
+                          uint32_t z /*target node height*/,
+                          const uint8_t *pk_seed,
+                          uint8_t addr[32]);
+
+// Implements Algorithm 16: fors_sign function (page 31)
+void slhdsa_fors_sign(const slh_dsa_config *config, uint8_t *fors_sig,
+                      const uint8_t *message, const uint8_t *sk_seed,
+                      const uint8_t *pk_seed, uint8_t addr[32]);
+
+// Implements Algorithm 17: fors_pkFromSig function (page 32)
+void slhdsa_fors_pk_from_sig(const slh_dsa_config *config, uint8_t *fors_pk,
+                             const uint8_t *fors_sig, const uint8_t *message,
+                             const uint8_t *pk_seed, uint8_t addr[32]);
+
+BSSL_NAMESPACE_END
+
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_FORS_H

package/runtime/third_party/boringssl/crypto/fipsmodule/slhdsa/merkle.cc.inc

@@ -0,0 +1,164 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/base.h>
+
+#include <string.h>
+
+#include "../../internal.h"
+#include "./address.h"
+#include "./merkle.h"
+#include "./params.h"
+#include "./thash.h"
+#include "./wots.h"
+
+
+using namespace bssl;
+
+// Implements Algorithm 9: xmss_node function (page 23)
+void bssl::slhdsa_treehash(const slh_dsa_config *config, uint8_t *out_pk,
+                           const uint8_t *sk_seed, uint32_t i, uint32_t z,
+                           const uint8_t *pk_seed, uint8_t addr[32]) {
+  BSSL_CHECK(z <= config->tree_height);
+  BSSL_CHECK(i < (uint32_t)(1u << (config->tree_height - z)));
+
+  if (z == 0) {
+    slhdsa_set_type(config, addr, SLHDSA_ADDR_TYPE_WOTS);
+    slhdsa_set_keypair_addr(config, addr, i);
+    slhdsa_wots_pk_gen(config, out_pk, sk_seed, pk_seed, addr);
+  } else {
+    // Stores left node and right node.
+    uint8_t nodes[2 * SLHDSA_MAX_N];
+    slhdsa_treehash(config, nodes, sk_seed, 2 * i, z - 1, pk_seed, addr);
+    slhdsa_treehash(config, nodes + config->n, sk_seed, 2 * i + 1, z - 1,
+                    pk_seed, addr);
+    slhdsa_set_type(config, addr, SLHDSA_ADDR_TYPE_HASHTREE);
+    slhdsa_set_tree_height(config, addr, z);
+    slhdsa_set_tree_index(config, addr, i);
+    slhdsa_thash_h(config, out_pk, nodes, pk_seed, addr);
+  }
+}
+
+// Implements Algorithm 10: xmss_sign function (page 24)
+void bssl::slhdsa_xmss_sign(const slh_dsa_config *config, uint8_t *sig,
+                            const uint8_t *msg, unsigned int idx,
+                            const uint8_t *sk_seed, const uint8_t *pk_seed,
+                            uint8_t addr[32]) {
+  // Build authentication path
+  const size_t wots_bytes = slhdsa_wots_bytes(config);
+  const size_t n = config->n;
+  for (size_t j = 0; j < config->tree_height; ++j) {
+    unsigned int k = (idx >> j) ^ 1;
+    slhdsa_treehash(config, sig + wots_bytes + j * n, sk_seed, k, j, pk_seed,
+                    addr);
+  }
+
+  // Compute WOTS+ signature
+  slhdsa_set_type(config, addr, SLHDSA_ADDR_TYPE_WOTS);
+  slhdsa_set_keypair_addr(config, addr, idx);
+  slhdsa_wots_sign(config, sig, msg, sk_seed, pk_seed, addr);
+}
+
+// Implements Algorithm 11: xmss_pkFromSig function (page 25)
+void bssl::slhdsa_xmss_pk_from_sig(const slh_dsa_config *config, uint8_t *root,
+                                   const uint8_t *xmss_sig, unsigned int idx,
+                                   const uint8_t *msg, const uint8_t *pk_seed,
+                                   uint8_t addr[32]) {
+  // Stores node[0] and node[1] from Algorithm 11
+  slhdsa_set_type(config, addr, SLHDSA_ADDR_TYPE_WOTS);
+  slhdsa_set_keypair_addr(config, addr, idx);
+  uint8_t node[2 * SLHDSA_MAX_N];
+  const size_t n = config->n;
+  slhdsa_wots_pk_from_sig(config, node, xmss_sig, msg, pk_seed, addr);
+
+  slhdsa_set_type(config, addr, SLHDSA_ADDR_TYPE_HASHTREE);
+  slhdsa_set_tree_index(config, addr, idx);
+
+  uint8_t tmp[2 * SLHDSA_MAX_N];
+  const uint8_t *const auth = xmss_sig + slhdsa_wots_bytes(config);
+  for (uint32_t k = 0; k < config->tree_height; ++k) {
+    slhdsa_set_tree_height(config, addr, k + 1);
+    if (((idx >> k) & 1) == 0) {
+      slhdsa_set_tree_index(config, addr,
+                            slhdsa_get_tree_index(config, addr) >> 1);
+      OPENSSL_memcpy(tmp, node, n);
+      OPENSSL_memcpy(tmp + n, auth + k * n, n);
+      slhdsa_thash_h(config, node + n, tmp, pk_seed, addr);
+    } else {
+      slhdsa_set_tree_index(config, addr,
+                            (slhdsa_get_tree_index(config, addr) - 1) >> 1);
+      OPENSSL_memcpy(tmp, auth + k * n, n);
+      OPENSSL_memcpy(tmp + n, node, n);
+      slhdsa_thash_h(config, node + n, tmp, pk_seed, addr);
+    }
+    OPENSSL_memcpy(node, node + n, n);
+  }
+  OPENSSL_memcpy(root, node, n);
+}
+
+// Implements Algorithm 12: ht_sign function (page 27)
+void bssl::slhdsa_ht_sign(const slh_dsa_config *config, uint8_t *sig,
+                          const uint8_t *message, uint64_t idx_tree,
+                          uint32_t idx_leaf, const uint8_t *sk_seed,
+                          const uint8_t *pk_seed) {
+  uint8_t addr[32] = {0};
+  slhdsa_set_tree_addr(config, addr, idx_tree);
+
+  // Layer 0
+  slhdsa_xmss_sign(config, sig, message, idx_leaf, sk_seed, pk_seed, addr);
+  uint8_t root[SLHDSA_MAX_N];
+  slhdsa_xmss_pk_from_sig(config, root, sig, idx_leaf, message, pk_seed, addr);
+  sig += slhdsa_xmss_bytes(config);
+
+  // All other layers
+  BSSL_CHECK(config->tree_height <= SLHDSA_MAX_TREE_HEIGHT);
+  const uint32_t leaf_mask = (1u << config->tree_height) - 1;
+  for (uint32_t j = 1; j < config->d; ++j) {
+    idx_leaf = idx_tree & leaf_mask;
+    idx_tree = idx_tree >> config->tree_height;
+    slhdsa_set_layer_addr(config, addr, j);
+    slhdsa_set_tree_addr(config, addr, idx_tree);
+    slhdsa_xmss_sign(config, sig, root, idx_leaf, sk_seed, pk_seed, addr);
+    if (j < (config->d - 1)) {
+      slhdsa_xmss_pk_from_sig(config, root, sig, idx_leaf, root, pk_seed, addr);
+    }
+
+    sig += slhdsa_xmss_bytes(config);
+  }
+}
+
+// Implements Algorithm 13: ht_verify function (page 28)
+int bssl::slhdsa_ht_verify(const slh_dsa_config *config, const uint8_t *sig,
+                           const uint8_t *message, uint64_t idx_tree,
+                           uint32_t idx_leaf, const uint8_t *pk_root,
+                           const uint8_t *pk_seed) {
+  uint8_t addr[32] = {0};
+  slhdsa_set_tree_addr(config, addr, idx_tree);
+
+  uint8_t node[SLHDSA_MAX_N];
+  slhdsa_xmss_pk_from_sig(config, node, sig, idx_leaf, message, pk_seed, addr);
+
+  BSSL_CHECK(config->tree_height <= SLHDSA_MAX_TREE_HEIGHT);
+  const uint32_t leaf_mask = (1u << config->tree_height) - 1;
+  for (uint32_t j = 1; j < config->d; ++j) {
+    idx_leaf = idx_tree & leaf_mask;
+    idx_tree = idx_tree >> config->tree_height;
+    slhdsa_set_layer_addr(config, addr, j);
+    slhdsa_set_tree_addr(config, addr, idx_tree);
+
+    slhdsa_xmss_pk_from_sig(config, node, sig + j * slhdsa_xmss_bytes(config),
+                            idx_leaf, node, pk_seed, addr);
+  }
+  return memcmp(node, pk_root, config->n) == 0;
+}

package/runtime/third_party/boringssl/crypto/fipsmodule/slhdsa/merkle.h

@@ -0,0 +1,58 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_MERKLE_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_MERKLE_H
+
+#include <openssl/base.h>
+
+#include <sys/types.h>
+
+#include "./params.h"
+
+
+BSSL_NAMESPACE_BEGIN
+
+// Implements Algorithm 9: xmss_node function (page 23)
+void slhdsa_treehash(const slh_dsa_config *config, uint8_t *out_pk,
+                     const uint8_t *sk_seed, uint32_t i /*target node index*/,
+                     uint32_t z /*target node height*/, const uint8_t *pk_seed,
+                     uint8_t addr[32]);
+
+// Implements Algorithm 10: xmss_sign function (page 24)
+void slhdsa_xmss_sign(const slh_dsa_config *config, uint8_t *sig,
+                      const uint8_t *msg, unsigned int idx,
+                      const uint8_t *sk_seed, const uint8_t *pk_seed,
+                      uint8_t addr[32]);
+
+// Implements Algorithm 11: xmss_pkFromSig function (page 25)
+void slhdsa_xmss_pk_from_sig(const slh_dsa_config *config, uint8_t *root,
+                             const uint8_t *xmss_sig, unsigned int idx,
+                             const uint8_t *msg, const uint8_t *pk_seed,
+                             uint8_t addr[32]);
+
+// Implements Algorithm 12: ht_sign function (page 27)
+void slhdsa_ht_sign(const slh_dsa_config *config, uint8_t *sig,
+                    const uint8_t *message, uint64_t idx_tree, uint32_t idx_leaf,
+                    const uint8_t *sk_seed, const uint8_t *pk_seed);
+
+// Implements Algorithm 13: ht_verify function (page 28)
+int slhdsa_ht_verify(const slh_dsa_config *config, const uint8_t *sig,
+                     const uint8_t *message, uint64_t idx_tree,
+                     uint32_t idx_leaf, const uint8_t *pk_root,
+                     const uint8_t *pk_seed);
+
+BSSL_NAMESPACE_END
+
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_MERKLE_H

package/runtime/third_party/boringssl/crypto/fipsmodule/slhdsa/params.h

@@ -0,0 +1,178 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_PARAMS_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_PARAMS_H
+
+#include <openssl/base.h>
+
+#include <stdbool.h>
+
+#include "../bcm_interface.h"
+
+
+BSSL_NAMESPACE_BEGIN
+
+enum slh_dsa_hash_type {
+  SLH_DSA_HASH_SHA2_256,
+  SLH_DSA_HASH_SHAKE_256,
+};
+
+// Upper bounds for stack allocations across all SLH-DSA parameter sets in
+// FIPS 205. These keep the code simple and avoid dynamic allocation while
+// still covering larger future parameter sets such as SLH-DSA-SHAKE-256f.
+#define SLHDSA_MAX_N 32
+#define SLHDSA_MAX_WOTS_LEN 67
+#define SLHDSA_MAX_WOTS_BYTES (SLHDSA_MAX_N * SLHDSA_MAX_WOTS_LEN)
+#define SLHDSA_MAX_FORS_HEIGHT 17
+#define SLHDSA_MAX_FORS_TREES 35
+#define SLHDSA_MAX_FORS_BYTES \
+  ((SLHDSA_MAX_FORS_HEIGHT + 1) * SLHDSA_MAX_FORS_TREES * SLHDSA_MAX_N)
+#define SLHDSA_MAX_FORS_MSG_BYTES \
+  ((SLHDSA_MAX_FORS_HEIGHT * SLHDSA_MAX_FORS_TREES + 7) / 8)
+#define SLHDSA_MAX_TREE_HEIGHT 18
+#define SLHDSA_MAX_D 18
+#define SLHDSA_MAX_DIGEST_SIZE 64
+#define SLHDSA_MAX_HASH_BLOCK_BYTES 168
+
+// Values bound by these limits are assumed to be valid shifts within a
+// uint32_t.
+static_assert(SLHDSA_MAX_TREE_HEIGHT < 32);
+static_assert(SLHDSA_MAX_FORS_HEIGHT < 32);
+
+#define SLHDSA_ADDR_BYTES 32
+#define SLHDSA_ADDR_COMPRESSED_BYTES 22
+#define SLHDSA_ADDR_COMP_OFFSET_LAYER 0
+#define SLHDSA_ADDR_COMP_OFFSET_TREE 1
+#define SLHDSA_ADDR_COMP_OFFSET_TYPE 9
+#define SLHDSA_ADDR_COMP_OFFSET_KEYPAIR 10
+#define SLHDSA_ADDR_COMP_OFFSET_CHAIN 14
+#define SLHDSA_ADDR_COMP_OFFSET_TREE_HEIGHT 14
+#define SLHDSA_ADDR_COMP_OFFSET_HASH 18
+#define SLHDSA_ADDR_COMP_OFFSET_TREE_INDEX 18
+#define SLHDSA_ADDR_COMP_ZERO_START 10
+#define SLHDSA_ADDR_COMP_ZERO_LEN 12
+#define SLHDSA_ADDR_FULL_OFFSET_LAYER 0
+#define SLHDSA_ADDR_FULL_OFFSET_TREE 4
+#define SLHDSA_ADDR_FULL_OFFSET_TYPE 16
+#define SLHDSA_ADDR_FULL_OFFSET_KEYPAIR 20
+#define SLHDSA_ADDR_FULL_OFFSET_CHAIN 24
+#define SLHDSA_ADDR_FULL_OFFSET_TREE_HEIGHT 24
+#define SLHDSA_ADDR_FULL_OFFSET_HASH 28
+#define SLHDSA_ADDR_FULL_OFFSET_TREE_INDEX 28
+#define SLHDSA_ADDR_FULL_ZERO_START 20
+#define SLHDSA_ADDR_FULL_ZERO_LEN 12
+
+typedef struct slh_dsa_config {
+  uint32_t n;
+  uint32_t full_height;
+  uint32_t d;
+  uint32_t tree_height;
+  uint32_t fors_height;
+  uint32_t fors_trees;
+  uint32_t wots_w;
+  uint32_t wots_log_w;
+  uint32_t wots_len1;
+  uint32_t wots_len2;
+  uint32_t digest_size;
+  uint32_t hash_block_bytes;
+  uint32_t hash_output_bytes;
+  uint32_t public_key_bytes;
+  uint32_t private_key_bytes;
+  uint32_t signature_bytes;
+  enum slh_dsa_hash_type hash_type;
+  bool compressed_addresses;
+} slh_dsa_config;
+
+inline uint32_t slhdsa_wots_len(const slh_dsa_config *config) {
+  return config->wots_len1 + config->wots_len2;
+}
+
+inline uint32_t slhdsa_wots_bytes(const slh_dsa_config *config) {
+  return config->n * slhdsa_wots_len(config);
+}
+
+inline uint32_t slhdsa_xmss_bytes(const slh_dsa_config *config) {
+  return slhdsa_wots_bytes(config) + config->n * config->tree_height;
+}
+
+inline uint32_t slhdsa_fors_msg_bytes(const slh_dsa_config *config) {
+  return (config->fors_height * config->fors_trees + 7) / 8;
+}
+
+inline uint32_t slhdsa_fors_bytes(const slh_dsa_config *config) {
+  return (config->fors_height + 1) * config->fors_trees * config->n;
+}
+
+inline uint32_t slhdsa_tree_bits(const slh_dsa_config *config) {
+  return config->tree_height * (config->d - 1);
+}
+
+inline uint32_t slhdsa_tree_bytes(const slh_dsa_config *config) {
+  return (slhdsa_tree_bits(config) + 7) / 8;
+}
+
+inline uint32_t slhdsa_leaf_bits(const slh_dsa_config *config) {
+  return config->tree_height;
+}
+
+inline uint32_t slhdsa_leaf_bytes(const slh_dsa_config *config) {
+  return (slhdsa_leaf_bits(config) + 7) / 8;
+}
+
+static const slh_dsa_config kSLHDSAConfigSHA2_128s = {
+    /*n=*/BCM_SLHDSA_SHA2_128S_N,
+    /*full_height=*/63,
+    /*d=*/7,
+    /*tree_height=*/9,
+    /*fors_height=*/12,
+    /*fors_trees=*/14,
+    /*wots_w=*/16,
+    /*wots_log_w=*/4,
+    /*wots_len1=*/32,
+    /*wots_len2=*/3,
+    /*digest_size=*/30,
+    /*hash_block_bytes=*/64,
+    /*hash_output_bytes=*/32,
+    /*public_key_bytes=*/BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES,
+    /*private_key_bytes=*/BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES,
+    /*signature_bytes=*/BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES,
+    /*hash_type=*/SLH_DSA_HASH_SHA2_256,
+    /*compressed_addresses=*/true,
+};
+
+static const slh_dsa_config kSLHDSAConfigSHAKE_256f = {
+    /*n=*/BCM_SLHDSA_SHAKE_256F_N,
+    /*full_height=*/68,
+    /*d=*/17,
+    /*tree_height=*/4,
+    /*fors_height=*/9,
+    /*fors_trees=*/35,
+    /*wots_w=*/16,
+    /*wots_log_w=*/4,
+    /*wots_len1=*/64,
+    /*wots_len2=*/3,
+    /*digest_size=*/49,
+    /*hash_block_bytes=*/136,
+    /*hash_output_bytes=*/32,
+    /*public_key_bytes=*/BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES,
+    /*private_key_bytes=*/BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES,
+    /*signature_bytes=*/BCM_SLHDSA_SHAKE_256F_SIGNATURE_BYTES,
+    /*hash_type=*/SLH_DSA_HASH_SHAKE_256,
+    /*compressed_addresses=*/false,
+};
+
+BSSL_NAMESPACE_END
+
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_PARAMS_H