SLH-DSA: add self-tests executed during first invocation

smuellerDD · smuellerDD · commit d4f008a63bad · 2024-10-20T21:11:22.000+02:00
Signed-off-by: Stephan Mueller &lt;smueller@chronox.de&gt;
diff --git a/TODO b/TODO
@@ -11,6 +11,6 @@
 
 - BIKE: add self tests
 
-- SLH-DSA: add self test
-
 - BIKE: add timecop
+
+- ARMv8: enable ARMv8 intrinsics in the kernel (SHAKE2x and by extension SLH-DSA)
diff --git a/linux_kernel/Kbuild.slh-dsa b/linux_kernel/Kbuild.slh-dsa
@@ -20,6 +20,7 @@ leancrypto-$(CONFIG_LEANCRYPTO_SPHINCS_256s)				       \
 				+= ../slh-dsa/src/sphincs_fors.o	       \
 				   ../slh-dsa/src/sphincs_hash_shake.o	       \
 				   ../slh-dsa/src/sphincs_merkle.o	       \
+				   ../slh-dsa/src/sphincs_selftest.o	       \
 				   ../slh-dsa/src/sphincs_sign.o	       \
 				   ../slh-dsa/src/sphincs_signature_helper.o   \
 				   ../slh-dsa/src/sphincs_thash_shake_simple.o \
@@ -33,6 +34,7 @@ leancrypto-$(CONFIG_LEANCRYPTO_SPHINCS_256f)				       \
 				+= sphincs_shake_256f/sphincs_fors.o	       \
 				   sphincs_shake_256f/sphincs_hash_shake.o     \
 				   sphincs_shake_256f/sphincs_merkle.o	       \
+				   sphincs_shake_256f/sphincs_selftest.o       \
 				   sphincs_shake_256f/sphincs_sign.o	       \
 				   sphincs_shake_256f/sphincs_signature_helper.o\
 				   sphincs_shake_256f/sphincs_thash_shake_simple.o\
@@ -44,6 +46,7 @@ leancrypto-$(CONFIG_LEANCRYPTO_SPHINCS_256f)				       \
 CFLAGS_sphincs_shake_256f/sphincs_fors.o		:= -DLC_SPHINCS_TYPE_256F
 CFLAGS_sphincs_shake_256f/sphincs_hash_shake.o		:= -DLC_SPHINCS_TYPE_256F
 CFLAGS_sphincs_shake_256f/sphincs_merkle.o		:= -DLC_SPHINCS_TYPE_256F
+CFLAGS_sphincs_shake_256f/sphincs_selftest.o		:= -DLC_SPHINCS_TYPE_256F
 CFLAGS_sphincs_shake_256f/sphincs_sign.o		:= -DLC_SPHINCS_TYPE_256F
 CFLAGS_sphincs_shake_256f/sphincs_signature_helper.o	:= -DLC_SPHINCS_TYPE_256F
 CFLAGS_sphincs_shake_256f/sphincs_thash_shake_simple.o	:= -DLC_SPHINCS_TYPE_256F
@@ -57,6 +60,7 @@ leancrypto-$(CONFIG_LEANCRYPTO_SPHINCS_192s)				       \
 				+= sphincs_shake_192s/sphincs_fors.o	       \
 				   sphincs_shake_192s/sphincs_hash_shake.o     \
 				   sphincs_shake_192s/sphincs_merkle.o	       \
+				   sphincs_shake_192s/sphincs_selftest.o       \
 				   sphincs_shake_192s/sphincs_sign.o	       \
 				   sphincs_shake_192s/sphincs_signature_helper.o\
 				   sphincs_shake_192s/sphincs_thash_shake_simple.o\
@@ -68,6 +72,7 @@ leancrypto-$(CONFIG_LEANCRYPTO_SPHINCS_192s)				       \
 CFLAGS_sphincs_shake_192s/sphincs_fors.o		:= -DLC_SPHINCS_TYPE_192S
 CFLAGS_sphincs_shake_192s/sphincs_hash_shake.o		:= -DLC_SPHINCS_TYPE_192S
 CFLAGS_sphincs_shake_192s/sphincs_merkle.o		:= -DLC_SPHINCS_TYPE_192S
+CFLAGS_sphincs_shake_192s/sphincs_selftest.o		:= -DLC_SPHINCS_TYPE_192S
 CFLAGS_sphincs_shake_192s/sphincs_sign.o		:= -DLC_SPHINCS_TYPE_192S
 CFLAGS_sphincs_shake_192s/sphincs_signature_helper.o	:= -DLC_SPHINCS_TYPE_192S
 CFLAGS_sphincs_shake_192s/sphincs_thash_shake_simple.o	:= -DLC_SPHINCS_TYPE_192S
@@ -82,6 +87,7 @@ leancrypto-$(CONFIG_LEANCRYPTO_SPHINCS_192f)				       \
 				   sphincs_shake_192f/sphincs_hash_shake.o     \
 				   sphincs_shake_192f/sphincs_merkle.o	       \
 				   sphincs_shake_192f/sphincs_sign.o	       \
+				   sphincs_shake_192f/sphincs_selftest.o       \
 				   sphincs_shake_192f/sphincs_signature_helper.o\
 				   sphincs_shake_192f/sphincs_thash_shake_simple.o\
 				   sphincs_shake_192f/sphincs_utils.o	       \
@@ -92,6 +98,7 @@ leancrypto-$(CONFIG_LEANCRYPTO_SPHINCS_192f)				       \
 CFLAGS_sphincs_shake_192f/sphincs_fors.o		:= -DLC_SPHINCS_TYPE_192F
 CFLAGS_sphincs_shake_192f/sphincs_hash_shake.o		:= -DLC_SPHINCS_TYPE_192F
 CFLAGS_sphincs_shake_192f/sphincs_merkle.o		:= -DLC_SPHINCS_TYPE_192F
+CFLAGS_sphincs_shake_192f/sphincs_selftest.o		:= -DLC_SPHINCS_TYPE_192F
 CFLAGS_sphincs_shake_192f/sphincs_sign.o		:= -DLC_SPHINCS_TYPE_192F
 CFLAGS_sphincs_shake_192f/sphincs_signature_helper.o	:= -DLC_SPHINCS_TYPE_192F
 CFLAGS_sphincs_shake_192f/sphincs_thash_shake_simple.o	:= -DLC_SPHINCS_TYPE_192F
@@ -105,6 +112,7 @@ leancrypto-$(CONFIG_LEANCRYPTO_SPHINCS_128s)				       \
 				+= sphincs_shake_128s/sphincs_fors.o	       \
 				   sphincs_shake_128s/sphincs_hash_shake.o     \
 				   sphincs_shake_128s/sphincs_merkle.o	       \
+				   sphincs_shake_128s/sphincs_selftest.o       \
 				   sphincs_shake_128s/sphincs_sign.o	       \
 				   sphincs_shake_128s/sphincs_signature_helper.o\
 				   sphincs_shake_128s/sphincs_thash_shake_simple.o\
@@ -116,6 +124,7 @@ leancrypto-$(CONFIG_LEANCRYPTO_SPHINCS_128s)				       \
 CFLAGS_sphincs_shake_128s/sphincs_fors.o		:= -DLC_SPHINCS_TYPE_128S
 CFLAGS_sphincs_shake_128s/sphincs_hash_shake.o		:= -DLC_SPHINCS_TYPE_128S
 CFLAGS_sphincs_shake_128s/sphincs_merkle.o		:= -DLC_SPHINCS_TYPE_128S
+CFLAGS_sphincs_shake_128s/sphincs_selftest.o		:= -DLC_SPHINCS_TYPE_128S
 CFLAGS_sphincs_shake_128s/sphincs_sign.o		:= -DLC_SPHINCS_TYPE_128S
 CFLAGS_sphincs_shake_128s/sphincs_signature_helper.o	:= -DLC_SPHINCS_TYPE_128S
 CFLAGS_sphincs_shake_128s/sphincs_thash_shake_simple.o	:= -DLC_SPHINCS_TYPE_128S
@@ -129,6 +138,7 @@ leancrypto-$(CONFIG_LEANCRYPTO_SPHINCS_128f)				       \
 				+= sphincs_shake_128f/sphincs_fors.o	       \
 				   sphincs_shake_128f/sphincs_hash_shake.o     \
 				   sphincs_shake_128f/sphincs_merkle.o	       \
+				   sphincs_shake_128f/sphincs_selftest.o       \
 				   sphincs_shake_128f/sphincs_sign.o	       \
 				   sphincs_shake_128f/sphincs_signature_helper.o\
 				   sphincs_shake_128f/sphincs_thash_shake_simple.o\
@@ -140,6 +150,7 @@ leancrypto-$(CONFIG_LEANCRYPTO_SPHINCS_128f)				       \
 CFLAGS_sphincs_shake_128f/sphincs_fors.o		:= -DLC_SPHINCS_TYPE_128F
 CFLAGS_sphincs_shake_128f/sphincs_hash_shake.o		:= -DLC_SPHINCS_TYPE_128F
 CFLAGS_sphincs_shake_128f/sphincs_merkle.o		:= -DLC_SPHINCS_TYPE_128F
+CFLAGS_sphincs_shake_128f/sphincs_selftest.o		:= -DLC_SPHINCS_TYPE_128F
 CFLAGS_sphincs_shake_128f/sphincs_sign.o		:= -DLC_SPHINCS_TYPE_128F
 CFLAGS_sphincs_shake_128f/sphincs_signature_helper.o	:= -DLC_SPHINCS_TYPE_128F
 CFLAGS_sphincs_shake_128f/sphincs_thash_shake_simple.o	:= -DLC_SPHINCS_TYPE_128F
diff --git a/linux_kernel/sphincs_shake_128f/sphincs_selftest.c b/linux_kernel/sphincs_shake_128f/sphincs_selftest.c
@@ -0,0 +1 @@
+../../slh-dsa/src/sphincs_selftest.c
diff --git a/linux_kernel/sphincs_shake_128f/sphincs_selftest.h b/linux_kernel/sphincs_shake_128f/sphincs_selftest.h
@@ -0,0 +1 @@
+../../slh-dsa/src/sphincs_selftest.h
diff --git a/linux_kernel/sphincs_shake_128s/sphincs_selftest.c b/linux_kernel/sphincs_shake_128s/sphincs_selftest.c
@@ -0,0 +1 @@
+../../slh-dsa/src/sphincs_selftest.c
diff --git a/linux_kernel/sphincs_shake_128s/sphincs_selftest.h b/linux_kernel/sphincs_shake_128s/sphincs_selftest.h
@@ -0,0 +1 @@
+../../slh-dsa/src/sphincs_selftest.h
diff --git a/linux_kernel/sphincs_shake_192f/sphincs_selftest.c b/linux_kernel/sphincs_shake_192f/sphincs_selftest.c
@@ -0,0 +1 @@
+../../slh-dsa/src/sphincs_selftest.c
diff --git a/linux_kernel/sphincs_shake_192f/sphincs_selftest.h b/linux_kernel/sphincs_shake_192f/sphincs_selftest.h
@@ -0,0 +1 @@
+../../slh-dsa/src/sphincs_selftest.h
diff --git a/linux_kernel/sphincs_shake_192s/sphincs_selftest.c b/linux_kernel/sphincs_shake_192s/sphincs_selftest.c
@@ -0,0 +1 @@
+../../slh-dsa/src/sphincs_selftest.c
diff --git a/linux_kernel/sphincs_shake_192s/sphincs_selftest.h b/linux_kernel/sphincs_shake_192s/sphincs_selftest.h
@@ -0,0 +1 @@
+../../slh-dsa/src/sphincs_selftest.h
diff --git a/linux_kernel/sphincs_shake_256f/sphincs_selftest.c b/linux_kernel/sphincs_shake_256f/sphincs_selftest.c
@@ -0,0 +1 @@
+../../slh-dsa/src/sphincs_selftest.c
diff --git a/linux_kernel/sphincs_shake_256f/sphincs_selftest.h b/linux_kernel/sphincs_shake_256f/sphincs_selftest.h
@@ -0,0 +1 @@
+../../slh-dsa/src/sphincs_selftest.h
diff --git a/slh-dsa/api/sphincs_type.h b/slh-dsa/api/sphincs_type.h
@@ -112,6 +112,10 @@ extern "C" {
 #define lc_sphincs_ctx_zero SPHINCS_F(ctx_zero)
 #define lc_sphincs_ctx_zero_free SPHINCS_F(ctx_zero_free)
 
+#define sphincs_selftest_keygen SPHINCS_F(selftest_keygen)
+#define sphincs_selftest_siggen SPHINCS_F(selftest_siggen)
+#define sphincs_selftest_sigver SPHINCS_F(selftest_sigver)
+
 #define fors_sign_c SPHINCS_F(fors_sign_c)
 #define fors_pk_from_sig_c SPHINCS_F(fors_pk_from_sig_c)
 #define gen_message_random SPHINCS_F(gen_message_random)
diff --git a/slh-dsa/src/meson.build b/slh-dsa/src/meson.build
@@ -17,6 +17,7 @@ sphincs_src = files([
 	'sphincs_fors.c',
 	'sphincs_hash_shake.c',
 	'sphincs_merkle.c',
+	'sphincs_selftest.c',
 	'sphincs_sign.c',
 	'sphincs_signature_helper.c',
 	# FIPS 205 mandates the "simple" thash operation
diff --git a/slh-dsa/src/sphincs_selftest.c b/slh-dsa/src/sphincs_selftest.c
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2024, Stephan Mueller <smueller@chronox.de>
+ *
+ * License: see LICENSE file in root directory
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
+ * WHICH ARE HEREBY DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#include "compare.h"
+#include "ret_checkers.h"
+#include "small_stack_support.h"
+#include "sphincs_selftest.h"
+#include "static_rng.h"
+
+/*
+ * Define the tests symbol rename at this location only to limit the renaming
+ * to the library internal code. The reason is that the test code uses this
+ * symbol too which would cause symbol duplication if the rename is applied
+ * in the test as well.
+ */
+#define tests SPHINCS_F(tests)
+
+#ifdef LC_SPHINCS_TYPE_128F
+#include "lc_sphincs_shake_128f.h"
+#include "../tests/sphincs_tester_vectors_shake_128f.h"
+#elif defined(LC_SPHINCS_TYPE_128S)
+#include "lc_sphincs_shake_128s.h"
+#include "../tests/sphincs_tester_vectors_shake_128s.h"
+#elif defined(LC_SPHINCS_TYPE_192F)
+#include "lc_sphincs_shake_192f.h"
+#include "../tests/sphincs_tester_vectors_shake_192f.h"
+#elif defined(LC_SPHINCS_TYPE_192S)
+#include "lc_sphincs_shake_192s.h"
+#include "../tests/sphincs_tester_vectors_shake_192s.h"
+#elif defined(LC_SPHINCS_TYPE_256F)
+#include "lc_sphincs_shake_256f.h"
+#include "../tests/sphincs_tester_vectors_shake_256f.h"
+#else
+#include "lc_sphincs_shake_256s.h"
+#include "../tests/sphincs_tester_vectors_shake_256s.h"
+#endif
+
+static inline int _sphincs_selftest_keygen(void)
+{
+	struct workspace {
+		struct lc_sphincs_pk pk;
+		struct lc_sphincs_sk sk;
+	};
+	const struct lc_sphincs_test *tc = &tests[0];
+	int ret;
+	struct lc_static_rng_data s_rng_state;
+	LC_STATIC_DRNG_ON_STACK(s_drng, &s_rng_state);
+	LC_DECLARE_MEM(ws, struct workspace, sizeof(uint64_t));
+
+	s_rng_state.seed = tc->seed;
+	s_rng_state.seedlen = sizeof(tc->seed);
+	CKINT(lc_sphincs_keypair(&ws->pk, &ws->sk, &s_drng));
+
+	lc_compare_selftest((uint8_t *)&ws->pk, tc->pk, sizeof(tc->pk), "PK");
+	lc_compare_selftest((uint8_t *)&ws->sk, tc->sk, sizeof(tc->sk), "SK");
+
+out:
+	LC_RELEASE_MEM(ws);
+	return ret;
+}
+
+void sphincs_selftest_keygen(int *tested)
+{
+	LC_SELFTEST_RUN(tested);
+
+	if (_sphincs_selftest_keygen())
+		lc_compare_selftest((uint8_t *)"test", (uint8_t *)"fail", 4,
+				    "Return code");
+}
+
+static inline int _sphincs_selftest_siggen(void)
+{
+	struct workspace {
+		struct lc_sphincs_sig sig;
+	};
+	const struct lc_sphincs_test *tc = &tests[0];
+	int ret;
+	LC_SPHINCS_CTX_ON_STACK(ctx);
+	LC_DECLARE_MEM(ws, struct workspace, sizeof(uint64_t));
+
+	/*
+	 * The entire test data derived from the upstream reference
+	 * implementation covers the internal testing only.
+	 */
+	ctx->slh_dsa_internal = 1;
+
+	CKINT(lc_sphincs_sign_ctx(&ws->sig, ctx, tc->msg, sizeof(tc->msg),
+				  (struct lc_sphincs_sk *)tc->sk, NULL));
+	lc_compare((uint8_t *)&ws->sig, tc->sig, sizeof(tc->sig), "SIG");
+
+
+out:
+	lc_sphincs_ctx_zero(ctx);
+	LC_RELEASE_MEM(ws);
+	return ret;
+}
+
+void sphincs_selftest_siggen(int *tested)
+{
+	LC_SELFTEST_RUN(tested);
+
+	if (_sphincs_selftest_siggen())
+		lc_compare_selftest((uint8_t *)"test", (uint8_t *)"fail", 4,
+				    "Return code");
+}
+
+static inline int _sphincs_selftest_sigver(void)
+{
+	struct workspace {
+		struct lc_sphincs_pk pk;
+		struct lc_sphincs_sk sk;
+		struct lc_sphincs_sig sig;
+	};
+	const struct lc_sphincs_test *tc = &tests[0];
+	int ret;
+	LC_SPHINCS_CTX_ON_STACK(ctx);
+
+	/*
+	 * The entire test data derived from the upstream reference
+	 * implementation covers the internal testing only.
+	 */
+	ctx->slh_dsa_internal = 1;
+
+	CKINT(lc_sphincs_verify_ctx((struct lc_sphincs_sig *)tc->sig, ctx,
+				    tc->msg, sizeof(tc->msg),
+				    (struct lc_sphincs_pk *)tc->pk));
+
+out:
+	lc_sphincs_ctx_zero(ctx);
+	return ret;
+}
+
+void sphincs_selftest_sigver(int *tested)
+{
+	LC_SELFTEST_RUN(tested);
+
+	if (_sphincs_selftest_sigver())
+		lc_compare_selftest((uint8_t *)"test", (uint8_t *)"fail", 4,
+				    "Return code");
+}
diff --git a/slh-dsa/src/sphincs_selftest.h b/slh-dsa/src/sphincs_selftest.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2024, Stephan Mueller <smueller@chronox.de>
+ *
+ * License: see LICENSE file in root directory
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
+ * WHICH ARE HEREBY DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#ifndef SPHINCS_SELFTEST_H
+#define SPHINCS_SELFTEST_H
+
+#include "sphincs_type.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void sphincs_selftest_keygen(int *tested);
+void sphincs_selftest_siggen(int *tested);
+void sphincs_selftest_sigver(int *tested);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* SPHINCS_SELFTEST_H */
diff --git a/slh-dsa/src/sphincs_sign.c b/slh-dsa/src/sphincs_sign.c
@@ -36,6 +36,7 @@
 #include "sphincs_hash.h"
 #include "sphincs_internal.h"
 #include "sphincs_merkle.h"
+#include "sphincs_selftest.h"
 #include "sphincs_thash.h"
 #include "sphincs_utils.h"
 #include "sphincs_wots.h"
@@ -110,8 +111,11 @@ static int lc_sphincs_keypair_from_seed_internal(struct lc_sphincs_pk *pk,
 {
 	const struct lc_sphincs_func_ctx *f_ctx = lc_sphincs_get_ctx();
 	spx_ctx ctx;
+	static int tested = 0;
 	int ret;
 
+	sphincs_selftest_keygen(&tested);
+
 	/*
 	 * Timecop: The SLH-DSA seed is sensitive.
 	 */
@@ -223,12 +227,15 @@ LC_INTERFACE_FUNCTION(int, lc_sphincs_sign_ctx, struct lc_sphincs_sig *sig,
 	const uint8_t *sk_prf = sk->sk_prf;
 	const uint8_t *pk = sk->pk;
 	uint8_t *wots_sig = sig->sight;
+	static int tested = 0;
 	int ret = 0;
 	LC_DECLARE_MEM(ws, struct workspace, sizeof(uint64_t));
 
 	CKNULL(sig, -EINVAL);
 	CKNULL(sk, -EINVAL);
 
+	sphincs_selftest_siggen(&tested);
+
 	/*
 	 * Timecop: secret key is sensitive
 	 */
@@ -425,12 +432,15 @@ LC_INTERFACE_FUNCTION(int, lc_sphincs_verify_ctx,
 	spx_ctx ctx_int;
 	const uint8_t *pub_root = pk->pk + LC_SPX_N;
 	const uint8_t *wots_sig = sig->sight;
+	static int tested = 0;
 	int ret = 0;
 	LC_DECLARE_MEM(ws, struct workspace, sizeof(uint64_t));
 
 	CKNULL(sig, -EINVAL);
 	CKNULL(pk, -EINVAL);
 
+	sphincs_selftest_sigver(&tested);
+
 	ctx_int.pub_seed = pk->pk;
 
 	set_type(ws->wots_addr, LC_SPX_ADDR_TYPE_WOTS);
