Merge branch 'main' of gitlab.cryptoworkshop.com:root/bc-java

# Conflicts:
#	CONTRIBUTORS.md
#	docs/releasenotes.md

Author: dghgit

CONTRIBUTORS.md

@@ -550,3 +550,4 @@ We also wish to acknowledge financial and collaborative support from [CISCO](htt
 - Rob Augustinus \<rob&#064;opensolutions.nl\> - a constant-time analysis of the elliptic-curve and AES code paths, with proof-of-concept code, which independently reached the variable-point scalar multiplication exposure addressed in 1.86.
 - Radim Dejmek \<dejmekr&#064;seznam.cz\> - initial implementation of the rebuild of the ERS hash lists around a single sort, which had been finding the insertion point for each hash by walking a LinkedList (PR #2457).
 - sfeng-c \<https://github.com/sfeng-c\> - initial implementation of the CRMF protocolEncrKey control (RFC 4211 sec. 6.6), with round-trip test coverage (PR #2443).
+- Carsten Hammer \<https://github.com/carstenartur\> - deriving the c6 and c7 constants of the generic RFC 9380 sqrt_ratio calculator from a shared z^c3, saving a modular exponentiation per instance, with tests comparing the stored constants against the direct powers (PR #2455).

core/src/main/java/org/bouncycastle/crypto/hash2curve/impl/GenericSqrtRatioCalculator.java

@@ -20,12 +20,12 @@
  * RFC 9380 defines optimized sqrt_ratio formulas for certain curves where the field prime p
  * satisfies special congruences (e.g. p ≡ 3 mod 4 or p ≡ 5 mod 8). However, those optimizations are
  * curve-specific and do not apply to all hash-to-curve suites. This implementation instead follows
- * the fully generic algorithm from Section 5.6.3 of RFC 9380, which is valid for any elliptic curve
+ * the fully generic algorithm from Appendix F.2.1.1 of RFC 9380, which is valid for any elliptic curve
  * defined over a prime field Fp.
  * </p>
  *
  * <p>
- * This generic version supports all curves used in the RFC 9830 test vectors, including the NIST
+ * This generic version supports all curves used in the RFC 9380 test vectors, including the NIST
  * P-256 / P-384 / P-521 curves, Curve25519, Edwards25519 (Ristretto255), Curve448, and Edwards448
  * (Decaf448). It provides a single uniform implementation suitable for all supported hash-to-curve
  * suites.
@@ -62,8 +62,10 @@ public GenericSqrtRatioCalculator(final ECCurve curve, final BigInteger z)
         this.c3 = this.c2.subtract(BigInteger.ONE).divide(BigInteger.valueOf(2));
         this.c4 = BigInteger.valueOf(2).pow(this.c1).subtract(BigInteger.ONE);
         this.c5 = BigInteger.valueOf(2).pow(this.c1 - 1);
-        this.c6 = z.modPow(this.c2, this.q);
-        this.c7 = z.modPow(this.c2.add(BigInteger.ONE).divide(BigInteger.valueOf(2)), q);
+        // c2 = 2*c3 + 1: share z^c3 between the two constants (RFC 9380, F.2.1.1).
+        BigInteger zToC3 = z.modPow(this.c3, this.q);
+        this.c7 = zToC3.multiply(z).mod(this.q);
+        this.c6 = zToC3.multiply(this.c7).mod(this.q);
     }
 
     private int calculateC1()

core/src/main/java/org/bouncycastle/crypto/params/HSSPrivateKeyParameters.java

@@ -86,6 +86,18 @@ List<LMSSignature> getSigList()
             return sigList;
         }
 
+        LMSParameters[] getLMSParameters()
+        {
+            LMSParameters[] parms = new LMSParameters[keys.length];
+
+            for (int i = 0; i < keys.length; i++)
+            {
+                parms[i] = keys[i].getLMSParameters();
+            }
+
+            return parms;
+        }
+
         LMSPrivateKeyParameters[] copyKeys()
         {
             return (LMSPrivateKeyParameters[])keys.clone();
@@ -439,19 +451,7 @@ public synchronized long getIndex()
 
     public LMSParameters[] getLMSParameters()
     {
-        Hierarchy hierarchy = this.hierarchy;
-        int len = hierarchy.size();
-
-        LMSParameters[] parms = new LMSParameters[len];
-
-        for (int i = 0; i < len; i++)
-        {
-            LMSPrivateKeyParameters lmsPrivateKey = hierarchy.getKey(i);
-
-            parms[i] = lmsPrivateKey.getLMSParameters();
-        }
-
-        return parms;
+        return hierarchy.getLMSParameters();
     }
 
     synchronized void incIndex()
@@ -709,30 +709,36 @@ private void rangeTestKeys()
         {
             if (index >= indexLimit)
             {
-                throw new ExhaustedPrivateKeyException(
-                    "hss private key" +
-                        ((isShard) ? " shard" : "") +
-                        " is exhausted");
+                throw new ExhaustedPrivateKeyException("hss private key" + (isShard ? " shard" : "") +
+                    " is exhausted");
             }
 
-
             int L = l;
             int d = L;
-            Hierarchy prv = hierarchy;
-            // >= rather than ==: an index above 2^h steps straight over an equality test
-            // (github #2414). Decode now rejects such a q, so this is belt and braces.
-            while (prv.getKey(d - 1).getIndex() >= 1 << (prv.getKey(d - 1).getSigParameters().getH()))
+            Hierarchy currentHierarchy = this.hierarchy;
+            while (true)
             {
-                d = d - 1;
-                if (d == 0)
+                LMSPrivateKeyParameters key = currentHierarchy.getKey(d - 1);
+
+                // The whole tree, not the key's own maxQ: a component key given a narrower usage limit is
+                // left to refuse for itself once it reaches it. Judging it by maxQ would replace the level
+                // with a fresh full tree, lifting a limit the caller set and spending a one-time key of the
+                // level above to sign it (testNarrowedComponentKeyIsNotReplaced).
+                int keyIndexLimit = 1 << key.getSigParameters().getH();
+
+                // < rather than !=: an index above 2^h steps straight over an equality test
+                // (github #2414). Decode now rejects such a q, so this is belt and braces.
+                if (key.getIndex() < keyIndexLimit)
                 {
-                    throw new ExhaustedPrivateKeyException(
-                        "hss private key" +
-                            ((isShard) ? " shard" : "") +
-                            " is exhausted the maximum limit for this HSS private key");
+                    break;
                 }
-            }
 
+                if (--d == 0)
+                {
+                    throw new ExhaustedPrivateKeyException("hss private key" + (isShard ? " shard" : "") +
+                        " has no one-time keys left at any level");
+                }
+            }
 
             if (d < L)
             {

core/src/main/java/org/bouncycastle/crypto/params/LMSKeyParameters.java

@@ -3,7 +3,6 @@
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 
-import org.bouncycastle.crypto.params.AsymmetricKeyParameter;
 import org.bouncycastle.util.Encodable;
 import org.bouncycastle.util.Pack;