dilithium.h (39285B)
1 /* dilithium.h 2 * 3 * Copyright (C) 2006-2025 wolfSSL Inc. 4 * 5 * This file is part of wolfSSL. 6 * 7 * wolfSSL is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License as published by 9 * the Free Software Foundation; either version 3 of the License, or 10 * (at your option) any later version. 11 * 12 * wolfSSL is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * GNU General Public License for more details. 16 * 17 * You should have received a copy of the GNU General Public License 18 * along with this program; if not, write to the Free Software 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA 20 */ 21 22 /*! 23 \file wolfssl/wolfcrypt/dilithium.h 24 */ 25 26 /* Interfaces for Dilithium NIST Level 1 (Dilithium512) and Dilithium NIST Level 5 27 * (Dilithium1024). */ 28 29 #ifndef WOLF_CRYPT_DILITHIUM_H 30 #define WOLF_CRYPT_DILITHIUM_H 31 32 #include <wolfssl/wolfcrypt/types.h> 33 34 #ifdef WOLF_CRYPTO_CB 35 #include <wolfssl/wolfcrypt/cryptocb.h> 36 #endif 37 38 #if defined(HAVE_DILITHIUM) 39 40 #ifdef HAVE_LIBOQS 41 #include <oqs/oqs.h> 42 #include <wolfssl/wolfcrypt/port/liboqs/liboqs.h> 43 #endif 44 45 #if defined(WOLFSSL_DILITHIUM_NO_MAKE_KEY) && \ 46 defined(WOLFSSL_DILITHIUM_NO_SIGN) && \ 47 !defined(WOLFSSL_DILITHIUM_NO_VERIFY) && \ 48 !defined(WOLFSSL_DILITHIUM_VERIFY_ONLY) 49 #define WOLFSSL_DILITHIUM_VERIFY_ONLY 50 #endif 51 #ifdef WOLFSSL_DILITHIUM_VERIFY_ONLY 52 #ifndef WOLFSSL_DILITHIUM_NO_MAKE_KEY 53 #define WOLFSSL_DILITHIUM_NO_MAKE_KEY 54 #endif 55 #ifndef WOLFSSL_DILITHIUM_NO_SIGN 56 #define WOLFSSL_DILITHIUM_NO_SIGN 57 #endif 58 #endif 59 60 #if !defined(WOLFSSL_DILITHIUM_NO_MAKE_KEY) || \ 61 !defined(WOLFSSL_DILITHIUM_NO_VERIFY) 62 #define WOLFSSL_DILITHIUM_PUBLIC_KEY 63 #endif 64 #if !defined(WOLFSSL_DILITHIUM_NO_MAKE_KEY) || \ 65 !defined(WOLFSSL_DILITHIUM_NO_SIGN) 66 #define WOLFSSL_DILITHIUM_PRIVATE_KEY 67 #endif 68 69 #if defined(WOLFSSL_DILITHIUM_PUBLIC_KEY) && \ 70 defined(WOLFSSL_DILITHIUM_PRIVATE_KEY) && \ 71 !defined(WOLFSSL_DILITHIUM_NO_CHECK_KEY) && \ 72 !defined(WOLFSSL_DILITHIUM_CHECK_KEY) 73 #define WOLFSSL_DILITHIUM_CHECK_KEY 74 #endif 75 76 #ifdef WOLFSSL_WC_DILITHIUM 77 #include <wolfssl/wolfcrypt/sha3.h> 78 #ifndef WOLFSSL_DILITHIUM_VERIFY_ONLY 79 #include <wolfssl/wolfcrypt/random.h> 80 #endif 81 #endif 82 83 #if defined(WC_DILITHIUM_CACHE_PRIV_VECTORS) && \ 84 !defined(WC_DILITHIUM_CACHE_MATRIX_A) 85 #define WC_DILITHIUM_CACHE_MATRIX_A 86 #endif 87 #if defined(WC_DILITHIUM_CACHE_PUB_VECTORS) && \ 88 !defined(WC_DILITHIUM_CACHE_MATRIX_A) 89 #define WC_DILITHIUM_CACHE_MATRIX_A 90 #endif 91 92 #ifdef __cplusplus 93 extern "C" { 94 #endif 95 96 /* Macros Definitions */ 97 98 #ifdef WOLFSSL_WC_DILITHIUM 99 100 #ifndef WOLFSSL_DILITHIUM_ALIGNMENT 101 #if defined(__arch64__) 102 #define WOLFSSL_DILITHIUM_ALIGNMENT 8 103 #elif defined(__arm__) 104 #define WOLFSSL_DILITHIUM_ALIGNMENT 4 105 #elif !defined(WOLFSSL_AESNI) && defined(WOLFSSL_GENERAL_ALIGNMENT) 106 #define WOLFSSL_DILITHIUM_ALIGNMENT WOLFSSL_GENERAL_ALIGNMENT 107 #else 108 #define WOLFSSL_DILITHIUM_ALIGNMENT 8 109 #endif 110 #endif /* WOLFSSL_DILITHIUM_ALIGNMENT */ 111 112 #define DILITHIUM_LEVEL2_KEY_SIZE 2560 113 #define DILITHIUM_LEVEL2_SIG_SIZE 2420 114 #define DILITHIUM_LEVEL2_PUB_KEY_SIZE 1312 115 #define DILITHIUM_LEVEL2_PRV_KEY_SIZE \ 116 (DILITHIUM_LEVEL2_PUB_KEY_SIZE + DILITHIUM_LEVEL2_KEY_SIZE) 117 /* Buffer sizes large enough to store exported DER encoded keys */ 118 #define DILITHIUM_LEVEL2_PUB_KEY_DER_SIZE 1334 119 #define DILITHIUM_LEVEL2_PRV_KEY_DER_SIZE 2588 120 #define DILITHIUM_LEVEL2_BOTH_KEY_DER_SIZE 3904 121 /* PEM size with the header "-----BEGIN PRIVATE KEY-----" and 122 * the footer "-----END PRIVATE KEY-----" */ 123 #define DILITHIUM_LEVEL2_BOTH_KEY_PEM_SIZE 5344 124 125 #define DILITHIUM_LEVEL3_KEY_SIZE 4032 126 #define DILITHIUM_LEVEL3_SIG_SIZE 3309 127 #define DILITHIUM_LEVEL3_PUB_KEY_SIZE 1952 128 #define DILITHIUM_LEVEL3_PRV_KEY_SIZE \ 129 (DILITHIUM_LEVEL3_PUB_KEY_SIZE + DILITHIUM_LEVEL3_KEY_SIZE) 130 /* Buffer sizes large enough to store exported DER encoded keys */ 131 #define DILITHIUM_LEVEL3_PUB_KEY_DER_SIZE 1974 132 #define DILITHIUM_LEVEL3_PRV_KEY_DER_SIZE 4060 133 #define DILITHIUM_LEVEL3_BOTH_KEY_DER_SIZE 6016 134 /* PEM size with the header "-----BEGIN PRIVATE KEY-----" and 135 * the footer "-----END PRIVATE KEY-----" */ 136 #define DILITHIUM_LEVEL3_BOTH_KEY_PEM_SIZE 8204 137 138 #define DILITHIUM_LEVEL5_KEY_SIZE 4896 139 #define DILITHIUM_LEVEL5_SIG_SIZE 4627 140 #define DILITHIUM_LEVEL5_PUB_KEY_SIZE 2592 141 #define DILITHIUM_LEVEL5_PRV_KEY_SIZE \ 142 (DILITHIUM_LEVEL5_PUB_KEY_SIZE + DILITHIUM_LEVEL5_KEY_SIZE) 143 /* Buffer sizes large enough to store exported DER encoded keys */ 144 #define DILITHIUM_LEVEL5_PUB_KEY_DER_SIZE 2614 145 #define DILITHIUM_LEVEL5_PRV_KEY_DER_SIZE 4924 146 #define DILITHIUM_LEVEL5_BOTH_KEY_DER_SIZE 7520 147 /* PEM size with the header "-----BEGIN ML_DSA_LEVEL5 PRIVATE KEY-----" and 148 * the footer "-----END ML_DSA_LEVEL5 PRIVATE KEY-----" */ 149 #define DILITHIUM_LEVEL5_BOTH_KEY_PEM_SIZE 10267 150 151 #define ML_DSA_LEVEL2_KEY_SIZE 2560 152 #define ML_DSA_LEVEL2_SIG_SIZE 2420 153 #define ML_DSA_LEVEL2_PUB_KEY_SIZE 1312 154 #define ML_DSA_LEVEL2_PRV_KEY_SIZE \ 155 (ML_DSA_LEVEL2_PUB_KEY_SIZE + ML_DSA_LEVEL2_KEY_SIZE) 156 /* Buffer sizes large enough to store exported DER encoded keys */ 157 #define ML_DSA_LEVEL2_PUB_KEY_DER_SIZE DILITHIUM_LEVEL2_PUB_KEY_DER_SIZE 158 #define ML_DSA_LEVEL2_PRV_KEY_DER_SIZE DILITHIUM_LEVEL2_PRV_KEY_DER_SIZE 159 #define ML_DSA_LEVEL2_BOTH_KEY_DER_SIZE DILITHIUM_LEVEL2_BOTH_KEY_DER_SIZE 160 /* PEM size with the header "-----BEGIN PRIVATE KEY-----" and 161 * the footer "-----END PRIVATE KEY-----" */ 162 #define ML_DSA_LEVEL2_BOTH_KEY_PEM_SIZE DILITHIUM_LEVEL2_BOTH_KEY_PEM_SIZE 163 164 #define ML_DSA_LEVEL3_KEY_SIZE 4032 165 #define ML_DSA_LEVEL3_SIG_SIZE 3309 166 #define ML_DSA_LEVEL3_PUB_KEY_SIZE 1952 167 #define ML_DSA_LEVEL3_PRV_KEY_SIZE \ 168 (ML_DSA_LEVEL3_PUB_KEY_SIZE + ML_DSA_LEVEL3_KEY_SIZE) 169 /* Buffer sizes large enough to store exported DER encoded keys */ 170 #define ML_DSA_LEVEL3_PUB_KEY_DER_SIZE DILITHIUM_LEVEL3_PUB_KEY_DER_SIZE 171 #define ML_DSA_LEVEL3_PRV_KEY_DER_SIZE DILITHIUM_LEVEL3_PRV_KEY_DER_SIZE 172 #define ML_DSA_LEVEL3_BOTH_KEY_DER_SIZE DILITHIUM_LEVEL3_BOTH_KEY_DER_SIZE 173 /* PEM size with the header "-----BEGIN PRIVATE KEY-----" and 174 * the footer "-----END PRIVATE KEY-----" */ 175 #define ML_DSA_LEVEL3_BOTH_KEY_PEM_SIZE DILITHIUM_LEVEL3_BOTH_KEY_PEM_SIZE 176 177 #define ML_DSA_LEVEL5_KEY_SIZE 4896 178 #define ML_DSA_LEVEL5_SIG_SIZE 4627 179 #define ML_DSA_LEVEL5_PUB_KEY_SIZE 2592 180 #define ML_DSA_LEVEL5_PRV_KEY_SIZE \ 181 (ML_DSA_LEVEL5_PUB_KEY_SIZE + ML_DSA_LEVEL5_KEY_SIZE) 182 /* Buffer sizes large enough to store exported DER encoded keys */ 183 #define ML_DSA_LEVEL5_PUB_KEY_DER_SIZE DILITHIUM_LEVEL5_PUB_KEY_DER_SIZE 184 #define ML_DSA_LEVEL5_PRV_KEY_DER_SIZE DILITHIUM_LEVEL5_PRV_KEY_DER_SIZE 185 #define ML_DSA_LEVEL5_BOTH_KEY_DER_SIZE DILITHIUM_LEVEL5_BOTH_KEY_DER_SIZE 186 /* PEM size with the header "-----BEGIN ML_DSA_LEVEL5 PRIVATE KEY-----" and 187 * the footer "-----END ML_DSA_LEVEL5 PRIVATE KEY-----" */ 188 #define ML_DSA_LEVEL5_BOTH_KEY_PEM_SIZE DILITHIUM_LEVEL5_BOTH_KEY_PEM_SIZE 189 190 191 192 /* Modulus. */ 193 #define DILITHIUM_Q 0x7fe001 194 /* Number of bits in modulus. */ 195 #define DILITHIUM_Q_BITS 23 196 /* Number of elements in polynomial. */ 197 #define DILITHIUM_N 256 198 199 /* Number of dropped bits. */ 200 #define DILITHIUM_D 13 201 /* Maximum value of dropped bits. */ 202 #define DILITHIUM_D_MAX (1 << DILITHIUM_D) 203 /* Half maximum value. */ 204 #define DILITHIUM_D_MAX_HALF (1 << (DILITHIUM_D - 1)) 205 /* Number of undropped bits. */ 206 #define DILITHIUM_U (DILITHIUM_Q_BITS - DILITHIUM_D) 207 208 /* Bits in coefficient range of y, GAMMA1, of 2^17 is 17. */ 209 #define DILITHIUM_GAMMA1_BITS_17 17 210 /* Coefficient range of y, GAMMA1, of 2^17. */ 211 #define DILITHIUM_GAMMA1_17 (1 << 17) 212 /* # encoding bits of y is GAMMA1 + 1. */ 213 #define DILITHIUM_GAMMA1_17_ENC_BITS 18 214 /* Coefficient range of y, GAMMA1, of 2^17. */ 215 /* Bits in coefficient range of y, GAMMA1, of 2^19 is 19. */ 216 #define DILITHIUM_GAMMA1_BITS_19 19 217 /* Coefficient range of y, GAMMA1, of 2^19. */ 218 #define DILITHIUM_GAMMA1_19 (1 << 19) 219 /* # encoding bits of y is GAMMA1 + 1. */ 220 #define DILITHIUM_GAMMA1_19_ENC_BITS 20 221 222 /* Low-order rounding range, GAMMA2, is Q divided by 88. */ 223 #define DILITHIUM_Q_LOW_88 ((DILITHIUM_Q - 1) / 88) 224 /* Absolute low-order rounding range, GAMMA2, is Q divided by 88. */ 225 #define DILITHIUM_Q_LOW_88_2 (((DILITHIUM_Q - 1) / 88) * 2) 226 /* # encoding bits of w1 when range is 88. */ 227 #define DILITHIUM_Q_HI_88_ENC_BITS 6 228 /* Low-order rounding range, GAMMA2, is Q divided by 32. */ 229 #define DILITHIUM_Q_LOW_32 ((DILITHIUM_Q - 1) / 32) 230 /* Absolute low-order rounding range, GAMMA2, is Q divided by 32. */ 231 #define DILITHIUM_Q_LOW_32_2 (((DILITHIUM_Q - 1) / 32) * 2) 232 /* # encoding bits of w1 when range is 32. */ 233 #define DILITHIUM_Q_HI_32_ENC_BITS 4 234 235 /* Private key range, eta, of 2. */ 236 #define DILITHIUM_ETA_2 2 237 /* Bits needed to encode values in range -2..2 as a positive number. */ 238 #define DILITHIUM_ETA_2_BITS 3 239 /* Extract count of valid values. */ 240 #define DILITHIUM_ETA_2_MOD 15 241 /* Private key range, eta, of 4. */ 242 #define DILITHIUM_ETA_4 4 243 /* Bits needed to encode values in range -4..4 as a positive number. */ 244 #define DILITHIUM_ETA_4_BITS 4 245 /* Extract count of valid values. */ 246 #define DILITHIUM_ETA_4_MOD 9 247 248 /* Number of bytes in a polynomial in memory. */ 249 #define DILITHIUM_POLY_SIZE (DILITHIUM_N * sizeof(sword32)) 250 251 #ifndef WOLFSSL_NO_ML_DSA_44 252 253 /* Fist dimension of A, k, for ML-DSA-44. */ 254 #define PARAMS_ML_DSA_44_K 4 255 /* Second dimension of A, l, for ML-DSA-44. */ 256 #define PARAMS_ML_DSA_44_L 4 257 /* Private key range, ETA, for ML-DSA-44. */ 258 #define PARAMS_ML_DSA_44_ETA DILITHIUM_ETA_2 259 /* Number of bits in private key for ML-DSA-44. */ 260 #define PARAMS_ML_DSA_44_ETA_BITS DILITHIUM_ETA_2_BITS 261 /* Collision strength of c-tilde, LAMBDA, in bits for ML-DSA-44. */ 262 #define PARAMS_ML_DSA_44_LAMBDA 128 263 /* # +/-1's in polynomial c, TAU, for ML-DSA-44. */ 264 #define PARAMS_ML_DSA_44_TAU 39 265 /* BETA = TAU * ETA for ML-DSA-44. */ 266 #define PARAMS_ML_DSA_44_BETA \ 267 (PARAMS_ML_DSA_44_TAU * PARAMS_ML_DSA_44_ETA) 268 /* Max # 1's in the hint h, OMEGA, for ML-DSA-44. */ 269 #define PARAMS_ML_DSA_44_OMEGA 80 270 /* Bits in coefficient range of y, GAMMA1, for ML-DSA-44. */ 271 #define PARAMS_ML_DSA_44_GAMMA1_BITS DILITHIUM_GAMMA1_BITS_17 272 /* Ccoefficient range of y, GAMMA1, for ML-DSA-44. */ 273 #define PARAMS_ML_DSA_44_GAMMA1 (1 << PARAMS_ML_DSA_44_GAMMA1_BITS) 274 /* Low-order rounding range, GAMMA2, for ML-DSA-44. */ 275 #define PARAMS_ML_DSA_44_GAMMA2 DILITHIUM_Q_LOW_88 276 /* Bits in high-order rounding range, GAMMA2, for ML-DSA-44. */ 277 #define PARAMS_ML_DSA_44_GAMMA2_HI_BITS 6 278 /* Encoding size of w1 in bytes for ML-DSA-44. 279 * K * N / 8 * 6 - 6 bits as max value is 43 in high bits. */ 280 #define PARAMS_ML_DSA_44_W1_ENC_SZ \ 281 (PARAMS_ML_DSA_44_K * DILITHIUM_N / 8 * PARAMS_ML_DSA_44_GAMMA2_HI_BITS) 282 /* Size of memory used for matrix a in bytes for ML-DSA-44. */ 283 #define PARAMS_ML_DSA_44_A_SIZE \ 284 (PARAMS_ML_DSA_44_K * PARAMS_ML_DSA_44_L * DILITHIUM_POLY_SIZE) 285 /* Size of memory used for vector s1 in bytes for ML-DSA-44. */ 286 #define PARAMS_ML_DSA_44_S1_SIZE \ 287 (PARAMS_ML_DSA_44_L * DILITHIUM_POLY_SIZE) 288 /* Encoding size of s1 in bytes for ML-DSA-44. */ 289 #define PARAMS_ML_DSA_44_S1_ENC_SIZE \ 290 (PARAMS_ML_DSA_44_S1_SIZE / sizeof(sword32) * PARAMS_ML_DSA_44_ETA_BITS / 8) 291 /* Size of memory used for vector s2 in bytes for ML-DSA-44. */ 292 #define PARAMS_ML_DSA_44_S2_SIZE \ 293 (PARAMS_ML_DSA_44_K * DILITHIUM_POLY_SIZE) 294 /* Encoding size of s2 in bytes for ML-DSA-44. */ 295 #define PARAMS_ML_DSA_44_S2_ENC_SIZE \ 296 (PARAMS_ML_DSA_44_S2_SIZE / sizeof(sword32) * PARAMS_ML_DSA_44_ETA_BITS / 8) 297 /* Encoding size of z in bytes for ML-DSA-44. */ 298 #define PARAMS_ML_DSA_44_Z_ENC_SIZE \ 299 (PARAMS_ML_DSA_44_S1_SIZE / sizeof(sword32) / 8 * \ 300 (PARAMS_ML_DSA_44_GAMMA1_BITS + 1)) 301 /* Encoding size of public key in bytes for ML-DSA-44. */ 302 #define PARAMS_ML_DSA_44_PK_SIZE \ 303 (DILITHIUM_PUB_SEED_SZ + PARAMS_ML_DSA_44_K * DILITHIUM_N * DILITHIUM_U / 8) 304 /* Encoding size of signature in bytes for ML-DSA-44. */ 305 #define PARAMS_ML_DSA_44_SIG_SIZE \ 306 ((PARAMS_ML_DSA_44_LAMBDA / 4) + \ 307 PARAMS_ML_DSA_44_L * DILITHIUM_N/8 * (PARAMS_ML_DSA_44_GAMMA1_BITS + 1) + \ 308 PARAMS_ML_DSA_44_OMEGA + PARAMS_ML_DSA_44_K) 309 310 #endif /* WOLFSSL_NO_ML_DSA_44 */ 311 312 #ifndef WOLFSSL_NO_ML_DSA_65 313 314 /* Fist dimension of A, k, for ML-DSA-65. */ 315 #define PARAMS_ML_DSA_65_K 6 316 /* Second dimension of A, l, for ML-DSA-65. */ 317 #define PARAMS_ML_DSA_65_L 5 318 /* Private key range, ETA, for ML-DSA-65. */ 319 #define PARAMS_ML_DSA_65_ETA DILITHIUM_ETA_4 320 /* Number of bits in private key for ML-DSA-65. */ 321 #define PARAMS_ML_DSA_65_ETA_BITS DILITHIUM_ETA_4_BITS 322 /* Collision strength of c-tilde, LAMBDA, in bits for ML-DSA-65. */ 323 #define PARAMS_ML_DSA_65_LAMBDA 192 324 /* # +/-1's in polynomial c, TAU, for ML-DSA-65. */ 325 #define PARAMS_ML_DSA_65_TAU 49 326 /* BETA = TAU * ETA for ML-DSA-65. */ 327 #define PARAMS_ML_DSA_65_BETA \ 328 (PARAMS_ML_DSA_65_TAU * PARAMS_ML_DSA_65_ETA) 329 /* Max # 1's in the hint h, OMEGA, for ML-DSA-65. */ 330 #define PARAMS_ML_DSA_65_OMEGA 55 331 /* Bits in coefficient range of y, GAMMA1, for ML-DSA-65. */ 332 #define PARAMS_ML_DSA_65_GAMMA1_BITS DILITHIUM_GAMMA1_BITS_19 333 /* Ccoefficient range of y, GAMMA1, for ML-DSA-65. */ 334 #define PARAMS_ML_DSA_65_GAMMA1 (1 << PARAMS_ML_DSA_65_GAMMA1_BITS) 335 /* Low-order rounding range, GAMMA2, for ML-DSA-65. */ 336 #define PARAMS_ML_DSA_65_GAMMA2 DILITHIUM_Q_LOW_32 337 /* Bits in high-order rounding range, GAMMA2, for ML-DSA-65. */ 338 #define PARAMS_ML_DSA_65_GAMMA2_HI_BITS 4 339 /* Encoding size of w1 in bytes for ML-DSA-65. 340 * K * N / 8 * 4 - 4 bits as max value is 15 in high bits. */ 341 #define PARAMS_ML_DSA_65_W1_ENC_SZ \ 342 (PARAMS_ML_DSA_65_K * DILITHIUM_N / 8 * PARAMS_ML_DSA_65_GAMMA2_HI_BITS) 343 /* Size of memory used for matrix a in bytes for ML-DSA-65. */ 344 #define PARAMS_ML_DSA_65_A_SIZE \ 345 (PARAMS_ML_DSA_65_K * PARAMS_ML_DSA_65_L * DILITHIUM_POLY_SIZE) 346 /* Size of memory used for vector s1 in bytes for ML-DSA-65. */ 347 #define PARAMS_ML_DSA_65_S1_SIZE \ 348 (PARAMS_ML_DSA_65_L * DILITHIUM_POLY_SIZE) 349 /* Encoding size of s1 in bytes for ML-DSA-65. */ 350 #define PARAMS_ML_DSA_65_S1_ENC_SIZE \ 351 (PARAMS_ML_DSA_65_S1_SIZE / sizeof(sword32) * PARAMS_ML_DSA_65_ETA_BITS / 8) 352 /* Size of memory used for vector s2 in bytes for ML-DSA-65. */ 353 #define PARAMS_ML_DSA_65_S2_SIZE \ 354 (PARAMS_ML_DSA_65_K * DILITHIUM_POLY_SIZE) 355 /* Encoding size of s2 in bytes for ML-DSA-65. */ 356 #define PARAMS_ML_DSA_65_S2_ENC_SIZE \ 357 (PARAMS_ML_DSA_65_S2_SIZE / sizeof(sword32) * PARAMS_ML_DSA_65_ETA_BITS / 8) 358 /* Encoding size of z in bytes for ML-DSA-65. */ 359 #define PARAMS_ML_DSA_65_Z_ENC_SIZE \ 360 (PARAMS_ML_DSA_65_S1_SIZE / sizeof(sword32) / 8 * \ 361 (PARAMS_ML_DSA_65_GAMMA1_BITS + 1)) 362 /* Encoding size of public key in bytes for ML-DSA-65. */ 363 #define PARAMS_ML_DSA_65_PK_SIZE \ 364 (DILITHIUM_PUB_SEED_SZ + PARAMS_ML_DSA_65_K * DILITHIUM_N * DILITHIUM_U / 8) 365 /* Encoding size of signature in bytes for ML-DSA-65. */ 366 #define PARAMS_ML_DSA_65_SIG_SIZE \ 367 ((PARAMS_ML_DSA_65_LAMBDA / 4) + \ 368 PARAMS_ML_DSA_65_L * DILITHIUM_N/8 * (PARAMS_ML_DSA_65_GAMMA1_BITS + 1) + \ 369 PARAMS_ML_DSA_65_OMEGA + PARAMS_ML_DSA_65_K) 370 371 #endif /* WOLFSSL_NO_ML_DSA_65 */ 372 373 #ifndef WOLFSSL_NO_ML_DSA_87 374 375 /* Fist dimension of A, k, for ML-DSA-87. */ 376 #define PARAMS_ML_DSA_87_K 8 377 /* Second dimension of A, l, for ML-DSA-87. */ 378 #define PARAMS_ML_DSA_87_L 7 379 /* Private key range, ETA, for ML-DSA-87. */ 380 #define PARAMS_ML_DSA_87_ETA DILITHIUM_ETA_2 381 /* Number of bits in private key for ML-DSA-87. */ 382 #define PARAMS_ML_DSA_87_ETA_BITS DILITHIUM_ETA_2_BITS 383 /* Collision strength of c-tilde, LAMBDA, in bits for ML-DSA-87. */ 384 #define PARAMS_ML_DSA_87_LAMBDA 256 385 /* # +/-1's in polynomial c, TAU, for ML-DSA-87. */ 386 #define PARAMS_ML_DSA_87_TAU 60 387 /* BETA = TAU * ETA for ML-DSA-87. */ 388 #define PARAMS_ML_DSA_87_BETA \ 389 (PARAMS_ML_DSA_87_TAU * PARAMS_ML_DSA_87_ETA) 390 /* Max # 1's in the hint h, OMEGA, for ML-DSA-87. */ 391 #define PARAMS_ML_DSA_87_OMEGA 75 392 /* Bits in coefficient range of y, GAMMA1, for ML-DSA-87. */ 393 #define PARAMS_ML_DSA_87_GAMMA1_BITS DILITHIUM_GAMMA1_BITS_19 394 /* Ccoefficient range of y, GAMMA1, for ML-DSA-87. */ 395 #define PARAMS_ML_DSA_87_GAMMA1 (1 << PARAMS_ML_DSA_87_GAMMA1_BITS) 396 /* Low-order rounding range, GAMMA2, for ML-DSA-87. */ 397 #define PARAMS_ML_DSA_87_GAMMA2 DILITHIUM_Q_LOW_32 398 /* Bits in high-order rounding range, GAMMA2, for ML-DSA-87. */ 399 #define PARAMS_ML_DSA_87_GAMMA2_HI_BITS 4 400 /* Encoding size of w1 in bytes for ML-DSA-87. 401 * K * N / 8 * 4 - 4 bits as max value is 15 in high bits. */ 402 #define PARAMS_ML_DSA_87_W1_ENC_SZ \ 403 (PARAMS_ML_DSA_87_K * DILITHIUM_N / 8 * PARAMS_ML_DSA_87_GAMMA2_HI_BITS) 404 /* Size of memory used for matrix A in bytes for ML-DSA-87. */ 405 #define PARAMS_ML_DSA_87_A_SIZE \ 406 (PARAMS_ML_DSA_87_K * PARAMS_ML_DSA_87_L * DILITHIUM_POLY_SIZE) 407 #define PARAMS_ML_DSA_87_S_SIZE 4 408 /* Size of memory used for vector s1 in bytes for ML-DSA-87. */ 409 #define PARAMS_ML_DSA_87_S1_SIZE \ 410 (PARAMS_ML_DSA_87_L * DILITHIUM_POLY_SIZE) 411 /* Encoding size of s1 in bytes for ML-DSA-87. */ 412 #define PARAMS_ML_DSA_87_S1_ENC_SIZE \ 413 (PARAMS_ML_DSA_87_S1_SIZE / sizeof(sword32) * PARAMS_ML_DSA_87_ETA_BITS / 8) 414 /* Size of memory used for vector s2 in bytes for ML-DSA-87. */ 415 #define PARAMS_ML_DSA_87_S2_SIZE \ 416 (PARAMS_ML_DSA_87_K * DILITHIUM_POLY_SIZE) 417 /* Encoding size of s2 in bytes for ML-DSA-87. */ 418 #define PARAMS_ML_DSA_87_S2_ENC_SIZE \ 419 (PARAMS_ML_DSA_87_S2_SIZE / sizeof(sword32) * PARAMS_ML_DSA_87_ETA_BITS / 8) 420 /* Encoding size of z in bytes for ML-DSA-87. */ 421 #define PARAMS_ML_DSA_87_Z_ENC_SIZE \ 422 (PARAMS_ML_DSA_87_S1_SIZE / sizeof(sword32) / 8 * \ 423 (PARAMS_ML_DSA_87_GAMMA1_BITS + 1)) 424 /* Encoding size of public key in bytes for ML-DSA-87. */ 425 #define PARAMS_ML_DSA_87_PK_SIZE \ 426 (DILITHIUM_PUB_SEED_SZ + PARAMS_ML_DSA_87_K * DILITHIUM_N * DILITHIUM_U / 8) 427 /* Encoding size of signature in bytes for ML-DSA-87. */ 428 #define PARAMS_ML_DSA_87_SIG_SIZE \ 429 ((PARAMS_ML_DSA_87_LAMBDA / 4) + \ 430 PARAMS_ML_DSA_87_L * DILITHIUM_N/8 * (PARAMS_ML_DSA_87_GAMMA1_BITS + 1) + \ 431 PARAMS_ML_DSA_87_OMEGA + PARAMS_ML_DSA_87_K) 432 433 #endif /* WOLFSSL_NO_ML_DSA_87 */ 434 435 436 #ifndef WOLFSSL_NO_ML_DSA_87 437 438 #define DILITHIUM_MAX_W1_ENC_SZ PARAMS_ML_DSA_87_W1_ENC_SZ 439 /* Maximum collision strength of c-tilde in bytes. */ 440 #define DILITHIUM_MAX_LAMBDA PARAMS_ML_DSA_87_LAMBDA 441 442 /* Maximum count of elements of a vector with dimension K. */ 443 #define DILITHIUM_MAX_K_VECTOR_COUNT \ 444 (PARAMS_ML_DSA_87_K * DILITHIUM_N) 445 /* Maximum count of elements of a vector with dimension L. */ 446 #define DILITHIUM_MAX_L_VECTOR_COUNT \ 447 (PARAMS_ML_DSA_87_L * DILITHIUM_N) 448 /* Maximum count of elements of a matrix with dimension KxL. */ 449 #define DILITHIUM_MAX_MATRIX_COUNT \ 450 (PARAMS_ML_DSA_87_K * PARAMS_ML_DSA_87_L * DILITHIUM_N) 451 452 #elif !defined(WOLFSSL_NO_ML_DSA_65) 453 454 /* Maximum w1 encoding size in bytes. */ 455 #define DILITHIUM_MAX_W1_ENC_SZ PARAMS_ML_DSA_65_W1_ENC_SZ 456 /* Maximum collision strength of c-tilde in bytes. */ 457 #define DILITHIUM_MAX_LAMBDA PARAMS_ML_DSA_65_LAMBDA 458 459 /* Maximum count of elements of a vector with dimension K. */ 460 #define DILITHIUM_MAX_K_VECTOR_COUNT \ 461 (PARAMS_ML_DSA_65_K * DILITHIUM_N) 462 /* Maximum count of elements of a vector with dimension L. */ 463 #define DILITHIUM_MAX_L_VECTOR_COUNT \ 464 (PARAMS_ML_DSA_65_L * DILITHIUM_N) 465 /* Maximum count of elements of a matrix with dimension KxL. */ 466 #define DILITHIUM_MAX_MATRIX_COUNT \ 467 (PARAMS_ML_DSA_65_K * PARAMS_ML_DSA_65_L * DILITHIUM_N) 468 469 #else 470 471 /* Maximum w1 encoding size in bytes. */ 472 #define DILITHIUM_MAX_W1_ENC_SZ PARAMS_ML_DSA_44_W1_ENC_SZ 473 /* Maximum collision strength of c-tilde in bytes. */ 474 #define DILITHIUM_MAX_LAMBDA PARAMS_ML_DSA_44_LAMBDA 475 476 /* Maximum count of elements of a vector with dimension K. */ 477 #define DILITHIUM_MAX_K_VECTOR_COUNT \ 478 (PARAMS_ML_DSA_44_K * DILITHIUM_N) 479 /* Maximum count of elements of a vector with dimension L. */ 480 #define DILITHIUM_MAX_L_VECTOR_COUNT \ 481 (PARAMS_ML_DSA_44_L * DILITHIUM_N) 482 /* Maximum count of elements of a matrix with dimension KxL. */ 483 #define DILITHIUM_MAX_MATRIX_COUNT \ 484 (PARAMS_ML_DSA_44_K * PARAMS_ML_DSA_44_L * DILITHIUM_N) 485 486 #endif 487 488 /* Length of K in bytes. */ 489 #define DILITHIUM_K_SZ 32 490 /* Length of TR in bytes. */ 491 #define DILITHIUM_TR_SZ 64 492 /* Length of public key seed in bytes when expanding a. */ 493 #define DILITHIUM_PUB_SEED_SZ 32 494 /* Length of private key seed in bytes when generating a key. */ 495 #define DILITHIUM_PRIV_SEED_SZ 64 496 497 /* Length of seed when creating vector c. */ 498 #define DILITHIUM_SEED_SZ 32 499 /* Length of seeds created when making a key. */ 500 #define DILITHIUM_SEEDS_SZ 128 501 502 /* Length of MU in bytes. */ 503 #define DILITHIUM_MU_SZ 64 504 /* Length of random in bytes when generating a signature. */ 505 #define DILITHIUM_RND_SZ 32 506 /* Length of private random in bytes when generating a signature. */ 507 #define DILITHIUM_PRIV_RAND_SEED_SZ 64 508 509 /* 5 blocks, each block 21 * 8 bytes = 840 bytes. 510 * Minimum required is 256 * 3 = 768. */ 511 #define DILITHIUM_GEN_A_NBLOCKS 5 512 /* Number of bytes to generate with Shake128 when generating A. */ 513 #define DILITHIUM_GEN_A_BYTES \ 514 (DILITHIUM_GEN_A_NBLOCKS * WC_SHA3_128_COUNT * 8) 515 /* Number of bytes to a block of SHAKE-128 when generating A. */ 516 #define DILITHIUM_GEN_A_BLOCK_BYTES (WC_SHA3_128_COUNT * 8) 517 518 /* Number of bytes to a block of SHAKE-256 when generating c. */ 519 #define DILITHIUM_GEN_C_BLOCK_BYTES (WC_SHA3_256_COUNT * 8) 520 521 522 #ifndef WOLFSSL_DILITHIUM_SMALL 523 #if defined(LITTLE_ENDIAN_ORDER) && (WOLFSSL_DILITHIUM_ALIGNMENT == 0) 524 /* A block SHAKE-128 output plus one for reading 4 bytes at a time. */ 525 #define DILITHIUM_REJ_NTT_POLY_H_SIZE (DILITHIUM_GEN_A_BYTES + 1) 526 #else 527 /* A block SHAKE-128 output. */ 528 #define DILITHIUM_REJ_NTT_POLY_H_SIZE DILITHIUM_GEN_A_BYTES 529 #endif /* LITTLE_ENDIAN_ORDER && WOLFSSL_DILITHIUM_ALIGNMENT == 0 */ 530 #else 531 #if defined(LITTLE_ENDIAN_ORDER) && (WOLFSSL_DILITHIUM_ALIGNMENT == 0) 532 /* A block SHAKE-128 output plus one for reading 4 bytes at a time. */ 533 #define DILITHIUM_REJ_NTT_POLY_H_SIZE (DILITHIUM_GEN_A_BLOCK_BYTES + 1) 534 #else 535 /* A block SHAKE-128 output. */ 536 #define DILITHIUM_REJ_NTT_POLY_H_SIZE DILITHIUM_GEN_A_BLOCK_BYTES 537 #endif /* LITTLE_ENDIAN_ORDER && WOLFSSL_DILITHIUM_ALIGNMENT == 0 */ 538 #endif 539 540 #elif defined(HAVE_LIBOQS) 541 542 #define DILITHIUM_LEVEL2_KEY_SIZE OQS_SIG_ml_dsa_44_ipd_length_secret_key 543 #define DILITHIUM_LEVEL2_SIG_SIZE OQS_SIG_ml_dsa_44_ipd_length_signature 544 #define DILITHIUM_LEVEL2_PUB_KEY_SIZE OQS_SIG_ml_dsa_44_ipd_length_public_key 545 #define DILITHIUM_LEVEL2_PRV_KEY_SIZE \ 546 (DILITHIUM_LEVEL2_PUB_KEY_SIZE+DILITHIUM_LEVEL2_KEY_SIZE) 547 /* Buffer sizes large enough to store exported DER encoded keys */ 548 #define DILITHIUM_LEVEL2_PUB_KEY_DER_SIZE 1334 549 #define DILITHIUM_LEVEL2_PRV_KEY_DER_SIZE 2588 550 #define DILITHIUM_LEVEL2_BOTH_KEY_DER_SIZE 3904 551 /* PEM size with the header "-----BEGIN PRIVATE KEY-----" and 552 * the footer "-----END PRIVATE KEY-----" */ 553 #define DILITHIUM_LEVEL2_BOTH_KEY_PEM_SIZE 5344 554 555 #define DILITHIUM_LEVEL3_KEY_SIZE OQS_SIG_ml_dsa_65_ipd_length_secret_key 556 #define DILITHIUM_LEVEL3_SIG_SIZE OQS_SIG_ml_dsa_65_ipd_length_signature 557 #define DILITHIUM_LEVEL3_PUB_KEY_SIZE OQS_SIG_ml_dsa_65_ipd_length_public_key 558 #define DILITHIUM_LEVEL3_PRV_KEY_SIZE \ 559 (DILITHIUM_LEVEL3_PUB_KEY_SIZE+DILITHIUM_LEVEL3_KEY_SIZE) 560 /* Buffer sizes large enough to store exported DER encoded keys */ 561 #define DILITHIUM_LEVEL3_PUB_KEY_DER_SIZE 1974 562 #define DILITHIUM_LEVEL3_PRV_KEY_DER_SIZE 4060 563 #define DILITHIUM_LEVEL3_BOTH_KEY_DER_SIZE 6016 564 /* PEM size with the header "-----BEGIN PRIVATE KEY-----" and 565 * the footer "-----END PRIVATE KEY-----" */ 566 #define DILITHIUM_LEVEL3_BOTH_KEY_PEM_SIZE 8204 567 568 #define DILITHIUM_LEVEL5_KEY_SIZE OQS_SIG_ml_dsa_87_ipd_length_secret_key 569 #define DILITHIUM_LEVEL5_SIG_SIZE OQS_SIG_ml_dsa_87_ipd_length_signature 570 #define DILITHIUM_LEVEL5_PUB_KEY_SIZE OQS_SIG_ml_dsa_87_ipd_length_public_key 571 #define DILITHIUM_LEVEL5_PRV_KEY_SIZE \ 572 (DILITHIUM_LEVEL5_PUB_KEY_SIZE+DILITHIUM_LEVEL5_KEY_SIZE) 573 /* Buffer sizes large enough to store exported DER encoded keys */ 574 #define DILITHIUM_LEVEL5_PUB_KEY_DER_SIZE 2614 575 #define DILITHIUM_LEVEL5_PRV_KEY_DER_SIZE 4924 576 #define DILITHIUM_LEVEL5_BOTH_KEY_DER_SIZE 7520 577 /* PEM size with the header "-----BEGIN ML_DSA_LEVEL5 PRIVATE KEY-----" and 578 * the footer "-----END ML_DSA_LEVEL5 PRIVATE KEY-----" */ 579 #define DILITHIUM_LEVEL5_BOTH_KEY_PEM_SIZE 10267 580 581 #define ML_DSA_LEVEL2_KEY_SIZE OQS_SIG_ml_dsa_44_ipd_length_secret_key 582 #define ML_DSA_LEVEL2_SIG_SIZE OQS_SIG_ml_dsa_44_ipd_length_signature 583 #define ML_DSA_LEVEL2_PUB_KEY_SIZE OQS_SIG_ml_dsa_44_ipd_length_public_key 584 #define ML_DSA_LEVEL2_PRV_KEY_SIZE \ 585 (ML_DSA_LEVEL2_PUB_KEY_SIZE+ML_DSA_LEVEL2_KEY_SIZE) 586 /* Buffer sizes large enough to store exported DER encoded keys */ 587 #define ML_DSA_LEVEL2_PUB_KEY_DER_SIZE DILITHIUM_LEVEL2_PUB_KEY_DER_SIZE 588 #define ML_DSA_LEVEL2_PRV_KEY_DER_SIZE DILITHIUM_LEVEL2_PRV_KEY_DER_SIZE 589 #define ML_DSA_LEVEL2_BOTH_KEY_DER_SIZE DILITHIUM_LEVEL2_BOTH_KEY_DER_SIZE 590 /* PEM size with the header "-----BEGIN PRIVATE KEY-----" and 591 * the footer "-----END PRIVATE KEY-----" */ 592 #define ML_DSA_LEVEL2_BOTH_KEY_PEM_SIZE DILITHIUM_LEVEL2_BOTH_KEY_PEM_SIZE 593 594 #define ML_DSA_LEVEL3_KEY_SIZE OQS_SIG_ml_dsa_65_ipd_length_secret_key 595 #define ML_DSA_LEVEL3_SIG_SIZE OQS_SIG_ml_dsa_65_ipd_length_signature 596 #define ML_DSA_LEVEL3_PUB_KEY_SIZE OQS_SIG_ml_dsa_65_ipd_length_public_key 597 #define ML_DSA_LEVEL3_PRV_KEY_SIZE \ 598 (ML_DSA_LEVEL3_PUB_KEY_SIZE+ML_DSA_LEVEL3_KEY_SIZE) 599 /* Buffer sizes large enough to store exported DER encoded keys */ 600 #define ML_DSA_LEVEL3_PUB_KEY_DER_SIZE DILITHIUM_LEVEL3_PUB_KEY_DER_SIZE 601 #define ML_DSA_LEVEL3_PRV_KEY_DER_SIZE DILITHIUM_LEVEL3_PRV_KEY_DER_SIZE 602 #define ML_DSA_LEVEL3_BOTH_KEY_DER_SIZE DILITHIUM_LEVEL3_BOTH_KEY_DER_SIZE 603 /* PEM size with the header "-----BEGIN PRIVATE KEY-----" and 604 * the footer "-----END PRIVATE KEY-----" */ 605 #define ML_DSA_LEVEL3_BOTH_KEY_PEM_SIZE DILITHIUM_LEVEL3_BOTH_KEY_PEM_SIZE 606 607 #define ML_DSA_LEVEL5_KEY_SIZE OQS_SIG_ml_dsa_87_ipd_length_secret_key 608 #define ML_DSA_LEVEL5_SIG_SIZE OQS_SIG_ml_dsa_87_ipd_length_signature 609 #define ML_DSA_LEVEL5_PUB_KEY_SIZE OQS_SIG_ml_dsa_87_ipd_length_public_key 610 #define ML_DSA_LEVEL5_PRV_KEY_SIZE \ 611 (ML_DSA_LEVEL5_PUB_KEY_SIZE+ML_DSA_LEVEL5_KEY_SIZE) 612 /* Buffer sizes large enough to store exported DER encoded keys */ 613 #define ML_DSA_LEVEL5_PUB_KEY_DER_SIZE DILITHIUM_LEVEL5_PUB_KEY_DER_SIZE 614 #define ML_DSA_LEVEL5_PRV_KEY_DER_SIZE DILITHIUM_LEVEL5_PRV_KEY_DER_SIZE 615 #define ML_DSA_LEVEL5_BOTH_KEY_DER_SIZE DILITHIUM_LEVEL5_BOTH_KEY_DER_SIZE 616 /* PEM size with the header "-----BEGIN ML_DSA_LEVEL5 PRIVATE KEY-----" and 617 * the footer "-----END ML_DSA_LEVEL5 PRIVATE KEY-----" */ 618 #define ML_DSA_LEVEL5_BOTH_KEY_PEM_SIZE DILITHIUM_LEVEL5_BOTH_KEY_PEM_SIZE 619 620 #endif 621 622 #define DILITHIUM_MAX_KEY_SIZE DILITHIUM_LEVEL5_KEY_SIZE 623 #define DILITHIUM_MAX_SIG_SIZE DILITHIUM_LEVEL5_SIG_SIZE 624 #define DILITHIUM_MAX_PUB_KEY_SIZE DILITHIUM_LEVEL5_PUB_KEY_SIZE 625 #define DILITHIUM_MAX_PRV_KEY_SIZE DILITHIUM_LEVEL5_PRV_KEY_SIZE 626 /* Buffer sizes large enough to store exported DER encoded keys */ 627 #define DILITHIUM_MAX_PUB_KEY_DER_SIZE DILITHIUM_LEVEL5_PUB_KEY_DER_SIZE 628 #define DILITHIUM_MAX_PRV_KEY_DER_SIZE DILITHIUM_LEVEL5_PRV_KEY_DER_SIZE 629 #define DILITHIUM_MAX_BOTH_KEY_DER_SIZE DILITHIUM_LEVEL5_BOTH_KEY_DER_SIZE 630 /* PEM size with the header "-----BEGIN ML_DSA_LEVEL5 PRIVATE KEY-----" and 631 * the footer "-----END ML_DSA_LEVEL5 PRIVATE KEY-----" */ 632 #define DILITHIUM_MAX_BOTH_KEY_PEM_SIZE DILITHIUM_LEVEL5_BOTH_KEY_PEM_SIZE 633 634 635 #ifdef WOLF_PRIVATE_KEY_ID 636 #define DILITHIUM_MAX_ID_LEN 32 637 #define DILITHIUM_MAX_LABEL_LEN 32 638 #endif 639 640 /* Structs */ 641 642 #ifdef WOLFSSL_WC_DILITHIUM 643 typedef struct wc_dilithium_params { 644 byte level; 645 byte k; 646 byte l; 647 byte eta; 648 byte eta_bits; 649 byte tau; 650 byte beta; 651 byte omega; 652 word16 lambda; 653 byte gamma1_bits; 654 sword32 gamma2; 655 word32 w1EncSz; 656 word16 aSz; 657 word16 s1Sz; 658 word16 s1EncSz; 659 word16 s2Sz; 660 word16 s2EncSz; 661 word16 zEncSz; 662 word16 pkSz; 663 word16 sigSz; 664 } wc_dilithium_params; 665 #endif 666 667 struct dilithium_key { 668 byte pubKeySet; 669 byte prvKeySet; 670 byte level; /* 2,3 or 5 */ 671 672 void* heap; /* heap hint */ 673 674 #ifdef WOLF_CRYPTO_CB 675 void* devCtx; 676 int devId; 677 #endif 678 #ifdef WOLF_PRIVATE_KEY_ID 679 byte id[DILITHIUM_MAX_ID_LEN]; 680 int idLen; 681 char label[DILITHIUM_MAX_LABEL_LEN]; 682 int labelLen; 683 #endif 684 685 #ifndef WOLFSSL_DILITHIUM_ASSIGN_KEY 686 byte p[DILITHIUM_MAX_PUB_KEY_SIZE]; 687 byte k[DILITHIUM_MAX_KEY_SIZE]; 688 #else 689 const byte* p; 690 const byte* k; 691 #endif 692 693 #ifdef WOLFSSL_WC_DILITHIUM 694 const wc_dilithium_params* params; 695 wc_Shake shake; 696 #ifndef WC_DILITHIUM_FIXED_ARRAY 697 #ifdef WC_DILITHIUM_CACHE_MATRIX_A 698 sword32* a; 699 byte aSet; 700 #endif 701 #ifdef WC_DILITHIUM_CACHE_PRIV_VECTORS 702 sword32* s1; 703 sword32* s2; 704 sword32* t0; 705 byte privVecsSet; 706 #endif 707 #ifdef WC_DILITHIUM_CACHE_PUB_VECTORS 708 sword32* t1; 709 byte pubVecSet; 710 #endif 711 #else 712 #ifdef WC_DILITHIUM_CACHE_MATRIX_A 713 sword32 a[DILITHIUM_MAX_MATRIX_COUNT]; 714 byte aSet; 715 #endif 716 #ifdef WC_DILITHIUM_CACHE_PRIV_VECTORS 717 sword32 s1[DILITHIUM_MAX_L_VECTOR_COUNT]; 718 sword32 s2[DILITHIUM_MAX_K_VECTOR_COUNT]; 719 sword32 t0[DILITHIUM_MAX_K_VECTOR_COUNT]; 720 byte privVecsSet; 721 #endif 722 #ifdef WC_DILITHIUM_CACHE_PUB_VECTORS 723 sword32 t1[DILITHIUM_MAX_K_VECTOR_COUNT]; 724 byte pubVecSet; 725 #endif 726 #endif 727 #if defined(WOLFSSL_DILITHIUM_VERIFY_NO_MALLOC) && \ 728 defined(WOLFSSL_DILITHIUM_VERIFY_SMALL_MEM) 729 sword32 z[DILITHIUM_MAX_L_VECTOR_COUNT]; 730 sword32 c[DILITHIUM_N]; 731 sword32 w[DILITHIUM_N]; 732 sword32 t1[DILITHIUM_N]; 733 byte w1e[DILITHIUM_MAX_W1_ENC_SZ]; 734 #ifdef WOLFSSL_DILITHIUM_SMALL_MEM_POLY64 735 sword64 t64[DILITHIUM_N]; 736 #endif 737 byte h[DILITHIUM_REJ_NTT_POLY_H_SIZE]; 738 byte block[DILITHIUM_GEN_C_BLOCK_BYTES]; 739 #endif /* WOLFSSL_DILITHIUM_VERIFY_NO_MALLOC && 740 * WOLFSSL_DILITHIUM_VERIFY_SMALL_MEM */ 741 #endif /* WOLFSSL_WC_DILITHIUM */ 742 }; 743 744 #ifndef WC_DILITHIUMKEY_TYPE_DEFINED 745 typedef struct dilithium_key dilithium_key; 746 #define WC_DILITHIUMKEY_TYPE_DEFINED 747 #endif 748 749 /* Functions */ 750 751 #ifndef WOLFSSL_DILITHIUM_VERIFY_ONLY 752 WOLFSSL_API 753 int wc_dilithium_make_key(dilithium_key* key, WC_RNG* rng); 754 WOLFSSL_API 755 int wc_dilithium_make_key_from_seed(dilithium_key* key, const byte* seed); 756 757 WOLFSSL_API 758 int wc_dilithium_sign_msg(const byte* msg, word32 msgLen, byte* sig, 759 word32* sigLen, dilithium_key* key, WC_RNG* rng); 760 WOLFSSL_API 761 int wc_dilithium_sign_ctx_msg(const byte* ctx, byte ctxLen, const byte* msg, 762 word32 msgLen, byte* sig, word32* sigLen, dilithium_key* key, WC_RNG* rng); 763 WOLFSSL_API 764 int wc_dilithium_sign_ctx_hash(const byte* ctx, byte ctxLen, int hashAlg, 765 const byte* hash, word32 hashLen, byte* sig, word32* sigLen, 766 dilithium_key* key, WC_RNG* rng); 767 WOLFSSL_API 768 int wc_dilithium_sign_msg_with_seed(const byte* msg, word32 msgLen, byte* sig, 769 word32 *sigLen, dilithium_key* key, const byte* seed); 770 WOLFSSL_API 771 int wc_dilithium_sign_ctx_msg_with_seed(const byte* ctx, byte ctxLen, 772 const byte* msg, word32 msgLen, byte* sig, word32 *sigLen, 773 dilithium_key* key, const byte* seed); 774 WOLFSSL_API 775 int wc_dilithium_sign_ctx_hash_with_seed(const byte* ctx, byte ctxLen, 776 int hashAlg, const byte* hash, word32 hashLen, byte* sig, word32 *sigLen, 777 dilithium_key* key, const byte* seed); 778 #endif 779 WOLFSSL_API 780 int wc_dilithium_verify_msg(const byte* sig, word32 sigLen, const byte* msg, 781 word32 msgLen, int* res, dilithium_key* key); 782 WOLFSSL_API 783 int wc_dilithium_verify_ctx_msg(const byte* sig, word32 sigLen, const byte* ctx, 784 word32 ctxLen, const byte* msg, word32 msgLen, int* res, 785 dilithium_key* key); 786 WOLFSSL_API 787 int wc_dilithium_verify_ctx_hash(const byte* sig, word32 sigLen, 788 const byte* ctx, word32 ctxLen, int hashAlg, const byte* hash, 789 word32 hashLen, int* res, dilithium_key* key); 790 791 WOLFSSL_API 792 int wc_dilithium_init(dilithium_key* key); 793 794 WOLFSSL_API 795 int wc_dilithium_init_ex(dilithium_key* key, void* heap, int devId); 796 797 #ifdef WOLF_PRIVATE_KEY_ID 798 WOLFSSL_API 799 int wc_dilithium_init_id(dilithium_key* key, const unsigned char* id, int len, 800 void* heap, int devId); 801 WOLFSSL_API 802 int wc_dilithium_init_label(dilithium_key* key, const char* label, void* heap, 803 int devId); 804 #endif 805 806 WOLFSSL_API 807 int wc_dilithium_set_level(dilithium_key* key, byte level); 808 WOLFSSL_API 809 int wc_dilithium_get_level(dilithium_key* key, byte* level); 810 WOLFSSL_API 811 void wc_dilithium_free(dilithium_key* key); 812 813 #ifdef WOLFSSL_DILITHIUM_PRIVATE_KEY 814 WOLFSSL_API 815 int wc_dilithium_size(dilithium_key* key); 816 #endif 817 #if defined(WOLFSSL_DILITHIUM_PRIVATE_KEY) && \ 818 defined(WOLFSSL_DILITHIUM_PUBLIC_KEY) 819 WOLFSSL_API 820 int wc_dilithium_priv_size(dilithium_key* key); 821 #endif 822 #ifdef WOLFSSL_DILITHIUM_PUBLIC_KEY 823 WOLFSSL_API 824 int wc_dilithium_pub_size(dilithium_key* key); 825 #endif 826 #if !defined(WOLFSSL_DILITHIUM_NO_SIGN) || !defined(WOLFSSL_DILITHIUM_NO_VERIFY) 827 WOLFSSL_API 828 int wc_dilithium_sig_size(dilithium_key* key); 829 #endif 830 831 #ifdef WOLFSSL_DILITHIUM_CHECK_KEY 832 WOLFSSL_API 833 int wc_dilithium_check_key(dilithium_key* key); 834 #endif 835 836 #ifdef WOLFSSL_DILITHIUM_PUBLIC_KEY 837 WOLFSSL_API 838 int wc_dilithium_import_public(const byte* in, word32 inLen, 839 dilithium_key* key); 840 #endif 841 #ifdef WOLFSSL_DILITHIUM_PRIVATE_KEY 842 WOLFSSL_API 843 int wc_dilithium_import_private(const byte* priv, word32 privSz, 844 dilithium_key* key); 845 #define wc_dilithium_import_private_only wc_dilithium_import_private 846 WOLFSSL_API 847 int wc_dilithium_import_key(const byte* priv, word32 privSz, 848 const byte* pub, word32 pubSz, dilithium_key* key); 849 #endif 850 851 #ifdef WOLFSSL_DILITHIUM_PUBLIC_KEY 852 WOLFSSL_API 853 int wc_dilithium_export_public(dilithium_key* key, byte* out, word32* outLen); 854 #endif 855 #ifdef WOLFSSL_DILITHIUM_PRIVATE_KEY 856 WOLFSSL_API 857 int wc_dilithium_export_private(dilithium_key* key, byte* out, word32* outLen); 858 #define wc_dilithium_export_private_only wc_dilithium_export_private 859 #endif 860 #ifdef WOLFSSL_DILITHIUM_PRIVATE_KEY 861 WOLFSSL_API 862 int wc_dilithium_export_key(dilithium_key* key, byte* priv, word32 *privSz, 863 byte* pub, word32 *pubSz); 864 #endif 865 866 #ifndef WOLFSSL_DILITHIUM_NO_ASN1 867 WOLFSSL_LOCAL int dilithium_get_oid_sum(dilithium_key* key, int* keyFormat); 868 #endif /* WOLFSSL_DILITHIUM_NO_ASN1 */ 869 870 #ifndef WOLFSSL_DILITHIUM_NO_ASN1 871 #if defined(WOLFSSL_DILITHIUM_PRIVATE_KEY) 872 WOLFSSL_API int wc_Dilithium_PrivateKeyDecode(const byte* input, 873 word32* inOutIdx, dilithium_key* key, word32 inSz); 874 #endif 875 #endif /* WOLFSSL_DILITHIUM_NO_ASN1 */ 876 #ifdef WOLFSSL_DILITHIUM_PUBLIC_KEY 877 WOLFSSL_API int wc_Dilithium_PublicKeyDecode(const byte* input, 878 word32* inOutIdx, dilithium_key* key, word32 inSz); 879 #endif 880 881 #ifndef WOLFSSL_DILITHIUM_NO_ASN1 882 #ifdef WC_ENABLE_ASYM_KEY_EXPORT 883 WOLFSSL_API int wc_Dilithium_PublicKeyToDer(dilithium_key* key, byte* output, 884 word32 inLen, int withAlg); 885 #endif 886 #if defined(WOLFSSL_DILITHIUM_PRIVATE_KEY) 887 WOLFSSL_API int wc_Dilithium_KeyToDer(dilithium_key* key, byte* output, 888 word32 inLen); 889 #endif 890 #ifdef WOLFSSL_DILITHIUM_PRIVATE_KEY 891 WOLFSSL_API int wc_Dilithium_PrivateKeyToDer(dilithium_key* key, byte* output, 892 word32 inLen); 893 #endif 894 #endif /* WOLFSSL_DILITHIUM_NO_ASN1 */ 895 896 897 #define WC_ML_DSA_DRAFT 10 898 899 #define WC_ML_DSA_44 2 900 #define WC_ML_DSA_65 3 901 #define WC_ML_DSA_87 5 902 #define WC_ML_DSA_44_DRAFT (2 + WC_ML_DSA_DRAFT) 903 #define WC_ML_DSA_65_DRAFT (3 + WC_ML_DSA_DRAFT) 904 #define WC_ML_DSA_87_DRAFT (5 + WC_ML_DSA_DRAFT) 905 906 #define DILITHIUM_ML_DSA_44_KEY_SIZE 2560 907 #define DILITHIUM_ML_DSA_44_SIG_SIZE 2420 908 #define DILITHIUM_ML_DSA_44_PUB_KEY_SIZE 1312 909 #define DILITHIUM_ML_DSA_44_PRV_KEY_SIZE \ 910 (DILITHIUM_ML_DSA_44_PUB_KEY_SIZE + DILITHIUM_ML_DSA_44_KEY_SIZE) 911 912 #define DILITHIUM_ML_DSA_65_KEY_SIZE 4032 913 #define DILITHIUM_ML_DSA_65_SIG_SIZE 3309 914 #define DILITHIUM_ML_DSA_65_PUB_KEY_SIZE 1952 915 #define DILITHIUM_ML_DSA_65_PRV_KEY_SIZE \ 916 (DILITHIUM_ML_DSA_65_PUB_KEY_SIZE + DILITHIUM_ML_DSA_65_KEY_SIZE) 917 918 #define DILITHIUM_ML_DSA_87_KEY_SIZE 4896 919 #define DILITHIUM_ML_DSA_87_SIG_SIZE 4627 920 #define DILITHIUM_ML_DSA_87_PUB_KEY_SIZE 2592 921 #define DILITHIUM_ML_DSA_87_PRV_KEY_SIZE \ 922 (DILITHIUM_ML_DSA_87_PUB_KEY_SIZE + DILITHIUM_ML_DSA_87_KEY_SIZE) 923 924 925 #define MlDsaKey dilithium_key 926 927 928 #define wc_MlDsaKey_Init(key, heap, devId) \ 929 wc_dilithium_init_ex(key, heap, devId) 930 #define wc_MlDsaKey_SetParams(key, id) \ 931 wc_dilithium_set_level(key, id) 932 #define wc_MlDsaKey_GetParams(key, id) \ 933 wc_dilithium_get_level(key, id) 934 #define wc_MlDsaKey_MakeKey(key, rng) \ 935 wc_dilithium_make_key(key, rng) 936 #define wc_MlDsaKey_ExportPrivRaw(key, out, outLen) \ 937 wc_dilithium_export_private_only(key, out, outLen) 938 #define wc_MlDsaKey_ImportPrivRaw(key, in, inLen) \ 939 wc_dilithium_import_private_only(in, inLen, key) 940 #define wc_MlDsaKey_Sign(key, sig, sigSz, msg, msgSz, rng) \ 941 wc_dilithium_sign_msg(msg, msgSz, sig, sigSz, key, rng) 942 #define wc_MlDsaKey_Free(key) \ 943 wc_dilithium_free(key) 944 #define wc_MlDsaKey_ExportPubRaw(key, out, outLen) \ 945 wc_dilithium_export_public(key, out, outLen) 946 #define wc_MlDsaKey_ImportPubRaw(key, in, inLen) \ 947 wc_dilithium_import_public(in, inLen, key) 948 #define wc_MlDsaKey_Verify(key, sig, sigSz, msg, msgSz, res) \ 949 wc_dilithium_verify_msg(sig, sigSz, msg, msgSz, res, key) 950 951 #define wc_MlDsaKey_PublicKeyToDer(key, output, len, withAlg) \ 952 wc_Dilithium_PublicKeyToDer(key, output, len, withAlg) 953 954 #define wc_MlDsaKey_PrivateKeyToDer(key, output, len) \ 955 wc_Dilithium_PrivateKeyToDer(key, output, len) 956 957 958 WOLFSSL_API int wc_MlDsaKey_GetPrivLen(MlDsaKey* key, int* len); 959 WOLFSSL_API int wc_MlDsaKey_GetPubLen(MlDsaKey* key, int* len); 960 WOLFSSL_API int wc_MlDsaKey_GetSigLen(MlDsaKey* key, int* len); 961 962 #ifdef __cplusplus 963 } /* extern "C" */ 964 #endif 965 966 #endif /* HAVE_DILITHIUM */ 967 #endif /* WOLF_CRYPT_DILITHIUM_H */