visaljs 0.0.2 → 0.0.3

package/runtime/third_party/boringssl/crypto/fipsmodule/slhdsa/thash.cc.inc

@@ -0,0 +1,326 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/base.h>
+
+#include <assert.h>
+#include <string.h>
+
+#include <openssl/sha2.h>
+
+#include "../../internal.h"
+#include "../keccak/internal.h"
+#include "./thash.h"
+
+
+using namespace bssl;
+
+// Internal thash function used by F, H, and T_l for SHA-256 based parameter
+// sets (Section 11.2, pages 44-46)
+static void slhdsa_thash_sha256(const slh_dsa_config *config, uint8_t *output,
+                                const uint8_t *input, size_t input_blocks,
+                                const uint8_t *pk_seed, uint8_t addr[32]) {
+  BSSL_CHECK(config->hash_type == SLH_DSA_HASH_SHA2_256);
+  SHA256_CTX sha256;
+  SHA256_Init(&sha256);
+
+  uint8_t zeros[SLHDSA_MAX_HASH_BLOCK_BYTES] = {0};
+  BSSL_CHECK(config->hash_block_bytes <= sizeof(zeros));
+  BSSL_CHECK(config->hash_block_bytes >= config->n);
+  SHA256_Update(&sha256, pk_seed, config->n);
+  SHA256_Update(&sha256, zeros, config->hash_block_bytes - config->n);
+  SHA256_Update(&sha256, addr, SLHDSA_ADDR_COMPRESSED_BYTES);
+  SHA256_Update(&sha256, input, input_blocks * config->n);
+
+  uint8_t hash[SLHDSA_MAX_DIGEST_SIZE];
+  SHA256_Final(hash, &sha256);
+  OPENSSL_memcpy(output, hash, config->n);
+}
+
+// Internal thash function used by F, H, and T_l for SHAKE-256 based parameter
+// sets (Section 11.1, pages 43-45)
+static void slhdsa_thash_shake(const slh_dsa_config *config, uint8_t *output,
+                               const uint8_t *input, size_t input_blocks,
+                               const uint8_t *pk_seed, uint8_t addr[32]) {
+  BSSL_CHECK(config->hash_type == SLH_DSA_HASH_SHAKE_256);
+  BSSL_CHECK(!config->compressed_addresses);
+
+  struct BORINGSSL_keccak_st ctx;
+  BORINGSSL_keccak_init(&ctx, boringssl_shake256);
+  BORINGSSL_keccak_absorb(&ctx, pk_seed, config->n);
+  BORINGSSL_keccak_absorb(&ctx, addr, SLHDSA_ADDR_BYTES);
+  BORINGSSL_keccak_absorb(&ctx, input, input_blocks * config->n);
+  BORINGSSL_keccak_squeeze(&ctx, output, config->n);
+}
+
+static void slhdsa_thash_dispatch(const slh_dsa_config *config, uint8_t *output,
+                                  const uint8_t *input, size_t input_blocks,
+                                  const uint8_t *pk_seed, uint8_t addr[32]) {
+  switch (config->hash_type) {
+    case SLH_DSA_HASH_SHA2_256:
+      slhdsa_thash_sha256(config, output, input, input_blocks, pk_seed, addr);
+      return;
+    case SLH_DSA_HASH_SHAKE_256:
+      slhdsa_thash_shake(config, output, input, input_blocks, pk_seed, addr);
+      return;
+  }
+  BSSL_CHECK(false);
+}
+
+// Implements PRF_msg function (Section 4.1, page 11 and Section 11.2, pages
+// 44-46)
+static void slhdsa_thash_prfmsg_sha256(const slh_dsa_config *config,
+                                       uint8_t *output, const uint8_t *sk_prf,
+                                       const uint8_t *entropy,
+                                       const uint8_t *header,
+                                       const uint8_t *ctx, size_t ctx_len,
+                                       const uint8_t *msg, size_t msg_len) {
+  BSSL_CHECK(config->hash_type == SLH_DSA_HASH_SHA2_256);
+  // Compute HMAC-SHA256(sk_prf, entropy || header || ctx || msg). We inline
+  // HMAC to avoid an allocation.
+  uint8_t hmac_key[SHA256_CBLOCK];
+  BSSL_CHECK(config->n <= sizeof(hmac_key));
+  OPENSSL_memcpy(hmac_key, sk_prf, config->n);
+  for (size_t i = 0; i < config->n; i++) {
+    hmac_key[i] ^= 0x36;
+  }
+  OPENSSL_memset(hmac_key + config->n, 0x36, sizeof(hmac_key) - config->n);
+
+  SHA256_CTX sha_ctx;
+  SHA256_Init(&sha_ctx);
+  SHA256_Update(&sha_ctx, hmac_key, sizeof(hmac_key));
+  SHA256_Update(&sha_ctx, entropy, config->n);
+  if (header) {
+    SHA256_Update(&sha_ctx, header, BCM_SLHDSA_M_PRIME_HEADER_LEN);
+  }
+  if (ctx_len != 0) {
+    SHA256_Update(&sha_ctx, ctx, ctx_len);
+  }
+  if (msg_len != 0) {
+    SHA256_Update(&sha_ctx, msg, msg_len);
+  }
+  uint8_t hash[SHA256_DIGEST_LENGTH];
+  SHA256_Final(hash, &sha_ctx);
+
+  for (size_t i = 0; i < config->n; i++) {
+    hmac_key[i] ^= 0x36 ^ 0x5c;
+  }
+  OPENSSL_memset(hmac_key + config->n, 0x5c, sizeof(hmac_key) - config->n);
+
+  SHA256_Init(&sha_ctx);
+  SHA256_Update(&sha_ctx, hmac_key, sizeof(hmac_key));
+  SHA256_Update(&sha_ctx, hash, sizeof(hash));
+  SHA256_Final(hash, &sha_ctx);
+
+  // Truncate to n bytes
+  OPENSSL_memcpy(output, hash, config->n);
+}
+
+static void slhdsa_thash_prfmsg_shake(const slh_dsa_config *config,
+                                      uint8_t *output, const uint8_t *sk_prf,
+                                      const uint8_t *entropy,
+                                      const uint8_t *header,
+                                      const uint8_t *ctx, size_t ctx_len,
+                                      const uint8_t *msg, size_t msg_len) {
+  BSSL_CHECK(config->hash_type == SLH_DSA_HASH_SHAKE_256);
+
+  struct BORINGSSL_keccak_st keccak;
+  BORINGSSL_keccak_init(&keccak, boringssl_shake256);
+  BORINGSSL_keccak_absorb(&keccak, sk_prf, config->n);
+  BORINGSSL_keccak_absorb(&keccak, entropy, config->n);
+  if (header) {
+    BORINGSSL_keccak_absorb(&keccak, header, BCM_SLHDSA_M_PRIME_HEADER_LEN);
+  }
+  if (ctx_len != 0) {
+    BORINGSSL_keccak_absorb(&keccak, ctx, ctx_len);
+  }
+  if (msg_len != 0) {
+    BORINGSSL_keccak_absorb(&keccak, msg, msg_len);
+  }
+  BORINGSSL_keccak_squeeze(&keccak, output, config->n);
+}
+
+void bssl::slhdsa_thash_prfmsg(const slh_dsa_config *config, uint8_t *output,
+                               const uint8_t *sk_prf, const uint8_t *entropy,
+                               const uint8_t *header, const uint8_t *ctx,
+                               size_t ctx_len, const uint8_t *msg,
+                               size_t msg_len) {
+  switch (config->hash_type) {
+    case SLH_DSA_HASH_SHA2_256:
+      slhdsa_thash_prfmsg_sha256(config, output, sk_prf, entropy, header, ctx,
+                                 ctx_len, msg, msg_len);
+      return;
+    case SLH_DSA_HASH_SHAKE_256:
+      slhdsa_thash_prfmsg_shake(config, output, sk_prf, entropy, header, ctx,
+                                ctx_len, msg, msg_len);
+      return;
+  }
+  BSSL_CHECK(false);
+}
+
+// Implements H_msg function (Section 4.1, page 11 and Section 11.2, pages
+// 44-46)
+static void slhdsa_thash_hmsg_sha256(const slh_dsa_config *config,
+                                     uint8_t *output, const uint8_t *r,
+                                     const uint8_t *pk_seed,
+                                     const uint8_t *pk_root,
+                                     const uint8_t *header,
+                                     const uint8_t *ctx, size_t ctx_len,
+                                     const uint8_t *msg, size_t msg_len) {
+  BSSL_CHECK(config->hash_type == SLH_DSA_HASH_SHA2_256);
+  // MGF1-SHA-256(R || PK.seed || SHA-256(R || PK.seed || PK.root || header ||
+  // ctx || M), m) input_buffer stores R || PK_SEED || SHA256(..) || 4-byte
+  // index
+  uint8_t input_buffer[2 * SLHDSA_MAX_N + SLHDSA_MAX_DIGEST_SIZE + 4] = {0};
+  OPENSSL_memcpy(input_buffer, r, config->n);
+  OPENSSL_memcpy(input_buffer + config->n, pk_seed, config->n);
+
+  // Inner hash
+  SHA256_CTX sha_ctx;
+  SHA256_Init(&sha_ctx);
+  SHA256_Update(&sha_ctx, r, config->n);
+  SHA256_Update(&sha_ctx, pk_seed, config->n);
+  SHA256_Update(&sha_ctx, pk_root, config->n);
+  if (header) {
+    SHA256_Update(&sha_ctx, header, BCM_SLHDSA_M_PRIME_HEADER_LEN);
+  }
+  if (ctx_len != 0) {
+    SHA256_Update(&sha_ctx, ctx, ctx_len);
+  }
+  if (msg_len != 0) {
+    SHA256_Update(&sha_ctx, msg, msg_len);
+  }
+  // Write directly into the input buffer
+  SHA256_Final(input_buffer + 2 * config->n, &sha_ctx);
+
+  // MGF1-SHA-256
+  uint8_t hash[32];
+  BSSL_CHECK(config->digest_size <= sizeof(hash));
+  BSSL_CHECK(config->hash_output_bytes == sizeof(hash));
+  const size_t mgf_input_len =
+      2 * config->n + config->hash_output_bytes + 4;
+  SHA256(input_buffer, mgf_input_len, hash);
+  OPENSSL_memcpy(output, hash, config->digest_size);
+}
+
+static void slhdsa_thash_hmsg_shake(const slh_dsa_config *config,
+                                    uint8_t *output, const uint8_t *r,
+                                    const uint8_t *pk_seed,
+                                    const uint8_t *pk_root,
+                                    const uint8_t *header,
+                                    const uint8_t *ctx, size_t ctx_len,
+                                    const uint8_t *msg, size_t msg_len) {
+  BSSL_CHECK(config->hash_type == SLH_DSA_HASH_SHAKE_256);
+
+  struct BORINGSSL_keccak_st keccak;
+  BORINGSSL_keccak_init(&keccak, boringssl_shake256);
+  BORINGSSL_keccak_absorb(&keccak, r, config->n);
+  BORINGSSL_keccak_absorb(&keccak, pk_seed, config->n);
+  BORINGSSL_keccak_absorb(&keccak, pk_root, config->n);
+  if (header) {
+    BORINGSSL_keccak_absorb(&keccak, header, BCM_SLHDSA_M_PRIME_HEADER_LEN);
+  }
+  if (ctx_len != 0) {
+    BORINGSSL_keccak_absorb(&keccak, ctx, ctx_len);
+  }
+  if (msg_len != 0) {
+    BORINGSSL_keccak_absorb(&keccak, msg, msg_len);
+  }
+  BORINGSSL_keccak_squeeze(&keccak, output, config->digest_size);
+}
+
+void bssl::slhdsa_thash_hmsg(const slh_dsa_config *config, uint8_t *output,
+                             const uint8_t *r, const uint8_t *pk_seed,
+                             const uint8_t *pk_root, const uint8_t *header,
+                             const uint8_t *ctx, size_t ctx_len,
+                             const uint8_t *msg, size_t msg_len) {
+  switch (config->hash_type) {
+    case SLH_DSA_HASH_SHA2_256:
+      slhdsa_thash_hmsg_sha256(config, output, r, pk_seed, pk_root, header, ctx,
+                               ctx_len, msg, msg_len);
+      return;
+    case SLH_DSA_HASH_SHAKE_256:
+      slhdsa_thash_hmsg_shake(config, output, r, pk_seed, pk_root, header, ctx,
+                              ctx_len, msg, msg_len);
+      return;
+  }
+  BSSL_CHECK(false);
+}
+
+// Implements PRF function (Section 4.1, page 11 and Section 11.2, pages 44-46)
+static void slhdsa_thash_prf_sha256(const slh_dsa_config *config,
+                                    uint8_t *output, const uint8_t *pk_seed,
+                                    const uint8_t *sk_seed, uint8_t addr[32]) {
+  slhdsa_thash_sha256(config, output, sk_seed, 1, pk_seed, addr);
+}
+
+static void slhdsa_thash_prf_shake(const slh_dsa_config *config,
+                                   uint8_t *output, const uint8_t *pk_seed,
+                                   const uint8_t *sk_seed, uint8_t addr[32]) {
+  BSSL_CHECK(config->hash_type == SLH_DSA_HASH_SHAKE_256);
+  BSSL_CHECK(!config->compressed_addresses);
+
+  struct BORINGSSL_keccak_st keccak;
+  BORINGSSL_keccak_init(&keccak, boringssl_shake256);
+  BORINGSSL_keccak_absorb(&keccak, pk_seed, config->n);
+  BORINGSSL_keccak_absorb(&keccak, addr, SLHDSA_ADDR_BYTES);
+  BORINGSSL_keccak_absorb(&keccak, sk_seed, config->n);
+  BORINGSSL_keccak_squeeze(&keccak, output, config->n);
+}
+
+void bssl::slhdsa_thash_prf(const slh_dsa_config *config, uint8_t *output,
+                            const uint8_t *pk_seed, const uint8_t *sk_seed,
+                            uint8_t addr[32]) {
+  switch (config->hash_type) {
+    case SLH_DSA_HASH_SHA2_256:
+      slhdsa_thash_prf_sha256(config, output, pk_seed, sk_seed, addr);
+      return;
+    case SLH_DSA_HASH_SHAKE_256:
+      slhdsa_thash_prf_shake(config, output, pk_seed, sk_seed, addr);
+      return;
+  }
+  BSSL_CHECK(false);
+}
+
+// Implements T_l function for WOTS+ public key compression (Section 4.1, page
+// 11 and Section 11.2, pages 44-46)
+void bssl::slhdsa_thash_tl(const slh_dsa_config *config, uint8_t *output,
+                           const uint8_t *input, const uint8_t *pk_seed,
+                           uint8_t addr[32]) {
+  slhdsa_thash_dispatch(config, output, input, slhdsa_wots_len(config), pk_seed,
+                        addr);
+}
+
+// Implements H function (Section 4.1, page 11 and Section 11.2, pages 44-46)
+void bssl::slhdsa_thash_h(const slh_dsa_config *config, uint8_t *output,
+                          const uint8_t *input, const uint8_t *pk_seed,
+                          uint8_t addr[32]) {
+  slhdsa_thash_dispatch(config, output, input, 2, pk_seed, addr);
+}
+
+// Implements F function (Section 4.1, page 11 and Section 11.2, pages 44-46)
+void bssl::slhdsa_thash_f(const slh_dsa_config *config, uint8_t *output,
+                          const uint8_t *input, const uint8_t *pk_seed,
+                          uint8_t addr[32]) {
+  slhdsa_thash_dispatch(config, output, input, 1, pk_seed, addr);
+}
+
+// Implements T_k function for FORS public key compression (Section 4.1, page 11
+// and Section 11.2, pages 44-46)
+void bssl::slhdsa_thash_tk(const slh_dsa_config *config, uint8_t *output,
+                           const uint8_t *input, const uint8_t *pk_seed,
+                           uint8_t addr[32]) {
+  slhdsa_thash_dispatch(config, output, input, config->fors_trees, pk_seed,
+                        addr);
+}

package/runtime/third_party/boringssl/crypto/fipsmodule/slhdsa/thash.h

@@ -0,0 +1,71 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_THASH_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_THASH_H
+
+#include "./params.h"
+
+
+BSSL_NAMESPACE_BEGIN
+
+// Implements PRF_msg: a pseudo-random function that is used to generate the
+// randomizer r for the randomized hashing of the message to be signed.
+// (Section 4.1, page 11)
+void slhdsa_thash_prfmsg(const slh_dsa_config *config, uint8_t *output,
+                         const uint8_t *sk_prf, const uint8_t *opt_rand,
+                         const uint8_t *header, const uint8_t *ctx,
+                         size_t ctx_len, const uint8_t *msg, size_t msg_len);
+
+// Implements H_msg: a hash function used to generate the digest of the message
+// to be signed. (Section 4.1, page 11)
+void slhdsa_thash_hmsg(const slh_dsa_config *config, uint8_t *output,
+                       const uint8_t *r, const uint8_t *pk_seed,
+                       const uint8_t *pk_root, const uint8_t *header,
+                       const uint8_t *ctx, size_t ctx_len, const uint8_t *msg,
+                       size_t msg_len);
+
+// Implements PRF: a pseudo-random function that is used to generate the secret
+// values in WOTS+ and FORS private keys. (Section 4.1, page 11)
+void slhdsa_thash_prf(const slh_dsa_config *config, uint8_t *output,
+                      const uint8_t *pk_seed, const uint8_t *sk_seed,
+                      uint8_t addr[32]);
+
+// Implements T_l: a hash function that maps an l*n-byte message to an n-byte
+// message. Used for WOTS+ public key compression. (Section 4.1, page 11)
+void slhdsa_thash_tl(const slh_dsa_config *config, uint8_t *output,
+                     const uint8_t *input, const uint8_t *pk_seed,
+                     uint8_t addr[32]);
+
+// Implements H: a hash function that takes a 2*n-byte message as input and
+// produces an n-byte output. (Section 4.1, page 11)
+void slhdsa_thash_h(const slh_dsa_config *config, uint8_t *output,
+                    const uint8_t *input, const uint8_t *pk_seed,
+                    uint8_t addr[32]);
+
+// Implements F: a hash function that takes an n-byte message as input and
+// produces an n-byte output. (Section 4.1, page 11)
+void slhdsa_thash_f(const slh_dsa_config *config, uint8_t *output,
+                    const uint8_t *input, const uint8_t *pk_seed,
+                    uint8_t addr[32]);
+
+// Implements T_k: a hash function that maps a k*n-byte message to an n-byte
+// message. Used for FORS public key compression. (Section 4.1, page 11)
+void slhdsa_thash_tk(const slh_dsa_config *config, uint8_t *output,
+                     const uint8_t *input, const uint8_t *pk_seed,
+                     uint8_t addr[32]);
+
+BSSL_NAMESPACE_END
+
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_THASH_H

package/runtime/third_party/boringssl/crypto/fipsmodule/slhdsa/wots.cc.inc

@@ -0,0 +1,172 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/base.h>
+
+#include <assert.h>
+#include <stdint.h>
+#include <string.h>
+
+#include "../../internal.h"
+#include "./address.h"
+#include "./params.h"
+#include "./thash.h"
+#include "./wots.h"
+
+
+using namespace bssl;
+
+// Implements Algorithm 5: chain function, page 18
+static void chain(const slh_dsa_config *config, uint8_t *output,
+                  const uint8_t *input, uint32_t start, uint32_t steps,
+                  const uint8_t *pub_seed, uint8_t addr[32]) {
+  assert(start < config->wots_w);
+  assert(steps < config->wots_w);
+
+  OPENSSL_memcpy(output, input, config->n);
+
+  for (uint32_t i = start; i < (start + steps) && i < config->wots_w; ++i) {
+    slhdsa_set_hash_addr(config, addr, i);
+    slhdsa_thash_f(config, output, output, pub_seed, addr);
+  }
+}
+
+static void slhdsa_wots_do_chain(const slh_dsa_config *config, uint8_t *out,
+                                 uint8_t sk_addr[32], uint8_t addr[32],
+                                 uint8_t value, const uint8_t *sk_seed,
+                                 const uint8_t *pub_seed,
+                                 uint32_t chain_index) {
+  uint8_t tmp_sk[SLHDSA_MAX_N];
+  slhdsa_set_chain_addr(config, sk_addr, chain_index);
+  slhdsa_thash_prf(config, tmp_sk, pub_seed, sk_seed, sk_addr);
+  slhdsa_set_chain_addr(config, addr, chain_index);
+  chain(config, out, tmp_sk, 0, value, pub_seed, addr);
+}
+
+// Implements Algorithm 6: wots_pkGen function, page 18
+void bssl::slhdsa_wots_pk_gen(const slh_dsa_config *config, uint8_t *pk,
+                              const uint8_t *sk_seed, const uint8_t *pub_seed,
+                              uint8_t addr[32]) {
+  uint8_t wots_pk_addr[32], sk_addr[32];
+  OPENSSL_memcpy(wots_pk_addr, addr, sizeof(wots_pk_addr));
+  OPENSSL_memcpy(sk_addr, addr, sizeof(sk_addr));
+  slhdsa_set_type(config, sk_addr, SLHDSA_ADDR_TYPE_WOTSPRF);
+  slhdsa_copy_keypair_addr(config, sk_addr, addr);
+
+  uint8_t tmp[SLHDSA_MAX_WOTS_BYTES];
+  const uint32_t n = config->n;
+  const uint32_t wots_len = slhdsa_wots_len(config);
+  const uint32_t max_chain = config->wots_w - 1;
+  for (uint32_t i = 0; i < wots_len; ++i) {
+    slhdsa_wots_do_chain(config, tmp + i * n, sk_addr, addr, max_chain, sk_seed,
+                         pub_seed, i);
+  }
+
+  // Compress pk
+  slhdsa_set_type(config, wots_pk_addr, SLHDSA_ADDR_TYPE_WOTSPK);
+  slhdsa_copy_keypair_addr(config, wots_pk_addr, addr);
+  slhdsa_thash_tl(config, pk, tmp, pub_seed, wots_pk_addr);
+}
+
+// Implements Algorithm 7: wots_sign function, page 20
+void bssl::slhdsa_wots_sign(const slh_dsa_config *config, uint8_t *sig,
+                            const uint8_t *msg, const uint8_t *sk_seed,
+                            const uint8_t *pub_seed, uint8_t addr[32]) {
+  BSSL_CHECK(config->wots_w == 16);
+  const size_t n = config->n;
+  const uint32_t max_chain = config->wots_w - 1;
+
+  uint16_t csum = 0;
+  for (size_t i = 0; i < n; ++i) {
+    csum += max_chain - (msg[i] >> 4);
+    csum += max_chain - (msg[i] & 15);
+  }
+
+  // Compute chains
+  uint8_t sk_addr[32];
+  OPENSSL_memcpy(sk_addr, addr, sizeof(sk_addr));
+  slhdsa_set_type(config, sk_addr, SLHDSA_ADDR_TYPE_WOTSPRF);
+  slhdsa_copy_keypair_addr(config, sk_addr, addr);
+
+  uint32_t chain_index = 0;
+  for (size_t i = 0; i < n; ++i) {
+    slhdsa_wots_do_chain(config, sig, sk_addr, addr, msg[i] >> 4, sk_seed,
+                         pub_seed, chain_index++);
+    sig += n;
+
+    slhdsa_wots_do_chain(config, sig, sk_addr, addr, msg[i] & 15, sk_seed,
+                         pub_seed, chain_index++);
+    sig += n;
+  }
+
+  // Include the WOTS checksum values (len2 = 3 for the parameter sets we
+  // support).
+  slhdsa_wots_do_chain(config, sig, sk_addr, addr, (csum >> 8) & 15, sk_seed,
+                       pub_seed, chain_index++);
+  sig += n;
+  slhdsa_wots_do_chain(config, sig, sk_addr, addr, (csum >> 4) & 15, sk_seed,
+                       pub_seed, chain_index++);
+  sig += n;
+  slhdsa_wots_do_chain(config, sig, sk_addr, addr, csum & 15, sk_seed, pub_seed,
+                       chain_index++);
+}
+
+static void slhdsa_wots_pk_from_sig_do_chain(const slh_dsa_config *config,
+                                             uint8_t *out, uint8_t addr[32],
+                                             const uint8_t *in, uint8_t value,
+                                             const uint8_t *pub_seed,
+                                             uint32_t chain_index) {
+  slhdsa_set_chain_addr(config, addr, chain_index);
+  chain(config, out + chain_index * config->n, in + chain_index * config->n,
+        value, (config->wots_w - 1) - value, pub_seed, addr);
+}
+
+// Implements Algorithm 8: wots_pkFromSig function, page 21
+void bssl::slhdsa_wots_pk_from_sig(const slh_dsa_config *config, uint8_t *pk,
+                                   const uint8_t *sig, const uint8_t *msg,
+                                   const uint8_t *pub_seed, uint8_t addr[32]) {
+  BSSL_CHECK(config->wots_w == 16);
+  const size_t n = config->n;
+  const uint32_t max_chain = config->wots_w - 1;
+
+  uint16_t csum = 0;
+  for (size_t i = 0; i < n; ++i) {
+    csum += max_chain - (msg[i] >> 4);
+    csum += max_chain - (msg[i] & 15);
+  }
+
+  uint8_t tmp[SLHDSA_MAX_WOTS_BYTES];
+  uint8_t wots_pk_addr[32];
+  OPENSSL_memcpy(wots_pk_addr, addr, sizeof(wots_pk_addr));
+
+  uint32_t chain_index = 0;
+  for (size_t i = 0; i < n; ++i) {
+    slhdsa_wots_pk_from_sig_do_chain(config, tmp, addr, sig, msg[i] >> 4,
+                                     pub_seed, chain_index++);
+    slhdsa_wots_pk_from_sig_do_chain(config, tmp, addr, sig, msg[i] & 15,
+                                     pub_seed, chain_index++);
+  }
+
+  slhdsa_wots_pk_from_sig_do_chain(config, tmp, addr, sig, csum >> 8, pub_seed,
+                                   chain_index++);
+  slhdsa_wots_pk_from_sig_do_chain(config, tmp, addr, sig, (csum >> 4) & 15,
+                                   pub_seed, chain_index++);
+  slhdsa_wots_pk_from_sig_do_chain(config, tmp, addr, sig, csum & 15, pub_seed,
+                                   chain_index++);
+
+  // Compress pk
+  slhdsa_set_type(config, wots_pk_addr, SLHDSA_ADDR_TYPE_WOTSPK);
+  slhdsa_copy_keypair_addr(config, wots_pk_addr, addr);
+  slhdsa_thash_tl(config, pk, tmp, pub_seed, wots_pk_addr);
+}

package/runtime/third_party/boringssl/crypto/fipsmodule/slhdsa/wots.h

@@ -0,0 +1,40 @@
+// Copyright 2024 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_WOTS_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_WOTS_H
+
+#include "./params.h"
+
+
+BSSL_NAMESPACE_BEGIN
+
+// Implements Algorithm 6: wots_pkGen function, page 18
+void slhdsa_wots_pk_gen(const slh_dsa_config *config, uint8_t *pk,
+                        const uint8_t *sk_seed, const uint8_t *pub_seed,
+                        uint8_t addr[32]);
+
+// Implements Algorithm 7: wots_sign function, page 20
+void slhdsa_wots_sign(const slh_dsa_config *config, uint8_t *sig,
+                      const uint8_t *msg, const uint8_t *sk_seed,
+                      const uint8_t *pub_seed, uint8_t addr[32]);
+
+// Implements Algorithm 8: wots_pkFromSig function, page 21
+void slhdsa_wots_pk_from_sig(const slh_dsa_config *config, uint8_t *pk,
+                             const uint8_t *sig, const uint8_t *msg,
+                             const uint8_t *pub_seed, uint8_t addr[32]);
+
+BSSL_NAMESPACE_END
+
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_SLHDSA_WOTS_H

package/runtime/third_party/boringssl/crypto/fipsmodule/tls/internal.h

@@ -0,0 +1,33 @@
+// Copyright 2018 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_TLS_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_TLS_INTERNAL_H
+
+#include <openssl/base.h>
+
+
+BSSL_NAMESPACE_BEGIN
+
+// CRYPTO_tls13_hkdf_expand_label computes the TLS 1.3 KDF function of the same
+// name. See https://www.rfc-editor.org/rfc/rfc8446#section-7.1.
+OPENSSL_EXPORT int CRYPTO_tls13_hkdf_expand_label(
+    uint8_t *out, size_t out_len, const EVP_MD *digest,  //
+    const uint8_t *secret, size_t secret_len,            //
+    const uint8_t *label, size_t label_len,              //
+    const uint8_t *hash, size_t hash_len);
+
+BSSL_NAMESPACE_END
+
+#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_TLS_INTERNAL_H