Merge branch 'main' of gitlab.cryptoworkshop.com:root/bc-java

Author: dghgit

core/src/main/java/org/bouncycastle/crypto/generators/HSSKeyPairGenerator.java

@@ -5,7 +5,6 @@
 import org.bouncycastle.crypto.KeyGenerationParameters;
 import org.bouncycastle.crypto.params.HSSKeyGenerationParameters;
 import org.bouncycastle.crypto.params.HSSPrivateKeyParameters;
-import org.bouncycastle.crypto.signers.lms.LMSEngine;
 
 public class HSSKeyPairGenerator
     implements AsymmetricCipherKeyPairGenerator
@@ -19,7 +18,7 @@ public void init(KeyGenerationParameters param)
 
     public AsymmetricCipherKeyPair generateKeyPair()
     {
-        HSSPrivateKeyParameters privKey = LMSEngine.generateHSSKeyPair(param);
+        HSSPrivateKeyParameters privKey = HSSPrivateKeyParameters.generate(param);
 
         return new AsymmetricCipherKeyPair(privKey.getPublicKey(), privKey);
     }

core/src/main/java/org/bouncycastle/crypto/generators/LMSKeyPairGenerator.java

@@ -1,13 +1,10 @@
 package org.bouncycastle.crypto.generators;
 
-import java.security.SecureRandom;
-
 import org.bouncycastle.crypto.AsymmetricCipherKeyPair;
 import org.bouncycastle.crypto.AsymmetricCipherKeyPairGenerator;
 import org.bouncycastle.crypto.KeyGenerationParameters;
 import org.bouncycastle.crypto.params.LMSKeyGenerationParameters;
 import org.bouncycastle.crypto.params.LMSPrivateKeyParameters;
-import org.bouncycastle.crypto.params.LMSigParameters;
 
 public class LMSKeyPairGenerator
     implements AsymmetricCipherKeyPairGenerator
@@ -21,21 +18,7 @@ public void init(KeyGenerationParameters param)
 
     public AsymmetricCipherKeyPair generateKeyPair()
     {
-        SecureRandom source = param.getRandom();
-
-        byte[] I = new byte[16];
-        source.nextBytes(I);
-
-        LMSigParameters sigParameter = param.getParameters().getLMSigParam();
-        byte[] rootSecret = new byte[sigParameter.getM()];
-        source.nextBytes(rootSecret);
-
-        // TODO[lms] Use guarded style from HSSPrivateKeyParameters.generateKey (factor out); though
-        // the config above passes the guard, we want to avoid drift
-
-        // RFC 8554 sec. 5.2, Algorithm 5: a fresh tree starts at q = 0 and has 2^h one-time keys.
-        LMSPrivateKeyParameters privKey = new LMSPrivateKeyParameters(
-            sigParameter, param.getParameters().getLMOTSParam(), 0, I, 1 << sigParameter.getH(), rootSecret);
+        LMSPrivateKeyParameters privKey = LMSPrivateKeyParameters.generate(param.getParameters(), param.getRandom());
 
         return new AsymmetricCipherKeyPair(privKey.getPublicKey(), privKey);
     }

core/src/main/java/org/bouncycastle/crypto/params/HSSKeyGenerationParameters.java

@@ -7,6 +7,35 @@
 public class HSSKeyGenerationParameters
     extends KeyGenerationParameters
 {
+    private static LMSParameters[] validateParameters(LMSParameters[] lmsParameters)
+    {
+        if (lmsParameters == null)
+        {
+            throw new NullPointerException("lmsParameters cannot be null");
+        }
+        if (lmsParameters.length < 1 || lmsParameters.length > 8)  // RFC 8554, Section 6.
+        {
+            throw new IllegalArgumentException("lmsParameters length should be between 1 and 8 inclusive");
+        }
+
+        // copy before checking the elements, so what was validated is what is kept
+        LMSParameters[] copy = (LMSParameters[])lmsParameters.clone();
+
+        for (int i = 0; i < copy.length; ++i)
+        {
+            if (copy[i] == null)
+            {
+                throw new NullPointerException("HSS level " + i + " has no parameters");
+            }
+
+            // TODO Consider the SP 800-208 sec. 4 restrictions: one hash function within each level (LMS tree and
+            // LM-OTS keys) and across the hierarchy. bc-csharp enforces both here; it is unclear what BC was aiming
+            // for, since the RFC 8554 parameter sets allow mixing.
+        }
+
+        return copy;
+    }
+
     private final LMSParameters[] lmsParameters;
 
     /**
@@ -18,12 +47,13 @@ public class HSSKeyGenerationParameters
     public HSSKeyGenerationParameters(
         LMSParameters[] lmsParameters,
         SecureRandom random)
+    {
+        this(random, validateParameters(lmsParameters));
+    }
+
+    private HSSKeyGenerationParameters(SecureRandom random, LMSParameters[] lmsParameters)
     {
         super(random, LMSParameters.calculateStrength(lmsParameters[0]));
-        if (lmsParameters.length == 0 || lmsParameters.length > 8)  // RFC 8554, Section 6.
-        {
-            throw new IllegalArgumentException("lmsParameters length should be between 1 and 8 inclusive");
-        }
         this.lmsParameters = lmsParameters;
     }
 
@@ -32,8 +62,18 @@ public int getDepth()
         return lmsParameters.length;
     }
 
+    /**
+     * The parameters of one level of the hierarchy, 0 being the root; {@link #getDepth()} gives the range.
+     *
+     * @throws ArrayIndexOutOfBoundsException if index is outside 0 .. getDepth() - 1.
+     */
+    public LMSParameters getLmsParameters(int index)
+    {
+        return lmsParameters[index];
+    }
+
     public LMSParameters[] getLmsParameters()
     {
-        return lmsParameters;
+        return (LMSParameters[])lmsParameters.clone();
     }
 }