lc_sphincs_shake_192s.h

Go to the documentation of this file.

/*
 * Copyright (C) 2024 - 2025, Stephan Mueller <smueller@chronox.de>
 *
 * License: see LICENSE file in root directory
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
 * WHICH ARE HEREBY DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
 * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
 * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
 * DAMAGE.
 */
/*
 * This code is derived in parts from the code distribution provided with
 * https://github.com/sphincs/sphincsplus
 *
 * That code is released under Public Domain
 * (https://creativecommons.org/share-your-work/public-domain/cc0/).
 */
 
#ifndef LC_SPHINCS_SHAKE_192S_H
#define LC_SPHINCS_SHAKE_192S_H
 
#include "ext_headers.h"
#include "lc_ascon_hash.h"
#include "lc_hash.h"
#include "lc_rng.h"
#include "lc_sha3.h"
 
#ifdef __cplusplus
extern "C" {
#endif

 
/*
 * Sphincs Plus security strength definition: Due to having multiple parameter
 * sets per security strength, the "security strenght" is given in signature
 * size.
 *
 *  7856 -> Sphincs Plus SHAKE 128s
 * 17088 -> Sphincs Plus SHAKE 128f
 * 16224 -> Sphincs Plus SHAKE 192s
 * 35664 -> Sphincs Plus SHAKE 192f
 * 29792 -> Sphincs Plus SHAKE 256s
 * 49856 -> Sphincs Plus SHAKE 256f
 */
#define LC_SPHINCS_MODE 16224
#define LC_SPHINCS_HASH_TYPE lc_shake256
 
#if LC_SPHINCS_MODE == 7856
 
#define LC_SPHINCS_NIST_CATEGORY 1
 
/* Hash output length in bytes. */
#define LC_SPX_N 16
/* Height of the hypertree. */
#define LC_SPX_FULL_HEIGHT 63
/* Number of subtree layer. */
#define LC_SPX_D 7
/* FORS tree dimensions. */
#define LC_SPX_FORS_HEIGHT 12
#define LC_SPX_FORS_TREES 14
/* Winternitz parameter, */
#define LC_SPX_WOTS_W 16
 
/* The hash function is defined by linking a different hash.c file, as opposed
   to setting a #define constant. */
 
/* For clarity */
#define LC_SPX_ADDR_BYTES 32
 
/* WOTS parameters. */
#if LC_SPX_WOTS_W == 256
    #define LC_SPX_WOTS_LOGW 8
#elif LC_SPX_WOTS_W == 16
    #define LC_SPX_WOTS_LOGW 4
#else
    #error LC_SPX_WOTS_W assumed 16 or 256
#endif
 
#define LC_SPX_WOTS_LEN1 (8 * LC_SPX_N / LC_SPX_WOTS_LOGW)
 
/* LC_SPX_WOTS_LEN2 is floor(log(len_1 * (w - 1)) / log(w)) + 1; we precompute */
#if LC_SPX_WOTS_W == 256
    #if LC_SPX_N <= 1
        #define LC_SPX_WOTS_LEN2 1
    #elif LC_SPX_N <= 256
        #define LC_SPX_WOTS_LEN2 2
    #else
        #error Did not precompute LC_SPX_WOTS_LEN2 for n outside {2, .., 256}
    #endif
#elif LC_SPX_WOTS_W == 16
    #if LC_SPX_N <= 8
        #define LC_SPX_WOTS_LEN2 2
    #elif LC_SPX_N <= 136
        #define LC_SPX_WOTS_LEN2 3
    #elif LC_SPX_N <= 256
        #define LC_SPX_WOTS_LEN2 4
    #else
        #error Did not precompute LC_SPX_WOTS_LEN2 for n outside {2, .., 256}
    #endif
#endif
 
#define LC_SPX_WOTS_LEN (LC_SPX_WOTS_LEN1 + LC_SPX_WOTS_LEN2)
#define LC_SPX_WOTS_BYTES (LC_SPX_WOTS_LEN * LC_SPX_N)
#define LC_SPX_WOTS_PK_BYTES LC_SPX_WOTS_BYTES
 
/* Subtree size. */
#define LC_SPX_TREE_HEIGHT (LC_SPX_FULL_HEIGHT / LC_SPX_D)
 
#if LC_SPX_TREE_HEIGHT * LC_SPX_D != LC_SPX_FULL_HEIGHT
    #error LC_SPX_D should always divide LC_SPX_FULL_HEIGHT
#endif
 
/* FORS parameters. */
#define LC_SPX_FORS_MSG_BYTES ((LC_SPX_FORS_HEIGHT * LC_SPX_FORS_TREES + 7) / 8)
#define LC_SPX_FORS_BYTES ((LC_SPX_FORS_HEIGHT + 1) * LC_SPX_FORS_TREES * LC_SPX_N)
#define LC_SPX_FORS_PK_BYTES LC_SPX_N
 
/* Resulting LC_SPX sizes. */
#define LC_SPX_BYTES (LC_SPX_N + LC_SPX_FORS_BYTES + LC_SPX_D * LC_SPX_WOTS_BYTES +\
                   LC_SPX_FULL_HEIGHT * LC_SPX_N)
#define LC_SPX_PK_BYTES (2 * LC_SPX_N)
#define LC_SPX_SK_BYTES (2 * LC_SPX_N + LC_SPX_PK_BYTES)
 
#elif LC_SPHINCS_MODE == 17088
 
#define LC_SPHINCS_NIST_CATEGORY 1
 
/* Hash output length in bytes. */
#define LC_SPX_N 16
/* Height of the hypertree. */
#define LC_SPX_FULL_HEIGHT 66
/* Number of subtree layer. */
#define LC_SPX_D 22
/* FORS tree dimensions. */
#define LC_SPX_FORS_HEIGHT 6
#define LC_SPX_FORS_TREES 33
/* Winternitz parameter, */
#define LC_SPX_WOTS_W 16
 
/* The hash function is defined by linking a different hash.c file, as opposed
   to setting a #define constant. */
 
/* For clarity */
#define LC_SPX_ADDR_BYTES 32
 
/* WOTS parameters. */
#if LC_SPX_WOTS_W == 256
    #define LC_SPX_WOTS_LOGW 8
#elif LC_SPX_WOTS_W == 16
    #define LC_SPX_WOTS_LOGW 4
#else
    #error LC_SPX_WOTS_W assumed 16 or 256
#endif
 
#define LC_SPX_WOTS_LEN1 (8 * LC_SPX_N / LC_SPX_WOTS_LOGW)
 
/* LC_SPX_WOTS_LEN2 is floor(log(len_1 * (w - 1)) / log(w)) + 1; we precompute */
#if LC_SPX_WOTS_W == 256
    #if LC_SPX_N <= 1
        #define LC_SPX_WOTS_LEN2 1
    #elif LC_SPX_N <= 256
        #define LC_SPX_WOTS_LEN2 2
    #else
        #error Did not precompute LC_SPX_WOTS_LEN2 for n outside {2, .., 256}
    #endif
#elif LC_SPX_WOTS_W == 16
    #if LC_SPX_N <= 8
        #define LC_SPX_WOTS_LEN2 2
    #elif LC_SPX_N <= 136
        #define LC_SPX_WOTS_LEN2 3
    #elif LC_SPX_N <= 256
        #define LC_SPX_WOTS_LEN2 4
    #else
        #error Did not precompute LC_SPX_WOTS_LEN2 for n outside {2, .., 256}
    #endif
#endif
 
#define LC_SPX_WOTS_LEN (LC_SPX_WOTS_LEN1 + LC_SPX_WOTS_LEN2)
#define LC_SPX_WOTS_BYTES (LC_SPX_WOTS_LEN * LC_SPX_N)
#define LC_SPX_WOTS_PK_BYTES LC_SPX_WOTS_BYTES
 
/* Subtree size. */
#define LC_SPX_TREE_HEIGHT (LC_SPX_FULL_HEIGHT / LC_SPX_D)
 
#if LC_SPX_TREE_HEIGHT * LC_SPX_D != LC_SPX_FULL_HEIGHT
    #error LC_SPX_D should always divide LC_SPX_FULL_HEIGHT
#endif
 
/* FORS parameters. */
#define LC_SPX_FORS_MSG_BYTES ((LC_SPX_FORS_HEIGHT * LC_SPX_FORS_TREES + 7) / 8)
#define LC_SPX_FORS_BYTES ((LC_SPX_FORS_HEIGHT + 1) * LC_SPX_FORS_TREES * LC_SPX_N)
#define LC_SPX_FORS_PK_BYTES LC_SPX_N
 
/* Resulting LC_SPX sizes. */
#define LC_SPX_BYTES (LC_SPX_N + LC_SPX_FORS_BYTES + LC_SPX_D * LC_SPX_WOTS_BYTES +\
                   LC_SPX_FULL_HEIGHT * LC_SPX_N)
#define LC_SPX_PK_BYTES (2 * LC_SPX_N)
#define LC_SPX_SK_BYTES (2 * LC_SPX_N + LC_SPX_PK_BYTES)
 
#elif LC_SPHINCS_MODE == 16224
 
#define LC_SPHINCS_NIST_CATEGORY 3
 
/* Hash output length in bytes. */
#define LC_SPX_N 24
/* Height of the hypertree. */
#define LC_SPX_FULL_HEIGHT 63
/* Number of subtree layer. */
#define LC_SPX_D 7
/* FORS tree dimensions. */
#define LC_SPX_FORS_HEIGHT 14
#define LC_SPX_FORS_TREES 17
/* Winternitz parameter, */
#define LC_SPX_WOTS_W 16
 
/* The hash function is defined by linking a different hash.c file, as opposed
   to setting a #define constant. */
 
/* For clarity */
#define LC_SPX_ADDR_BYTES 32
 
/* WOTS parameters. */
#if LC_SPX_WOTS_W == 256
    #define LC_SPX_WOTS_LOGW 8
#elif LC_SPX_WOTS_W == 16
    #define LC_SPX_WOTS_LOGW 4
#else
    #error LC_SPX_WOTS_W assumed 16 or 256
#endif
 
#define LC_SPX_WOTS_LEN1 (8 * LC_SPX_N / LC_SPX_WOTS_LOGW)
 
/* LC_SPX_WOTS_LEN2 is floor(log(len_1 * (w - 1)) / log(w)) + 1; we precompute */
#if LC_SPX_WOTS_W == 256
    #if LC_SPX_N <= 1
        #define LC_SPX_WOTS_LEN2 1
    #elif LC_SPX_N <= 256
        #define LC_SPX_WOTS_LEN2 2
    #else
        #error Did not precompute LC_SPX_WOTS_LEN2 for n outside {2, .., 256}
    #endif
#elif LC_SPX_WOTS_W == 16
    #if LC_SPX_N <= 8
        #define LC_SPX_WOTS_LEN2 2
    #elif LC_SPX_N <= 136
        #define LC_SPX_WOTS_LEN2 3
    #elif LC_SPX_N <= 256
        #define LC_SPX_WOTS_LEN2 4
    #else
        #error Did not precompute LC_SPX_WOTS_LEN2 for n outside {2, .., 256}
    #endif
#endif
 
#define LC_SPX_WOTS_LEN (LC_SPX_WOTS_LEN1 + LC_SPX_WOTS_LEN2)
#define LC_SPX_WOTS_BYTES (LC_SPX_WOTS_LEN * LC_SPX_N)
#define LC_SPX_WOTS_PK_BYTES LC_SPX_WOTS_BYTES
 
/* Subtree size. */
#define LC_SPX_TREE_HEIGHT (LC_SPX_FULL_HEIGHT / LC_SPX_D)
 
#if LC_SPX_TREE_HEIGHT * LC_SPX_D != LC_SPX_FULL_HEIGHT
    #error LC_SPX_D should always divide LC_SPX_FULL_HEIGHT
#endif
 
/* FORS parameters. */
#define LC_SPX_FORS_MSG_BYTES ((LC_SPX_FORS_HEIGHT * LC_SPX_FORS_TREES + 7) / 8)
#define LC_SPX_FORS_BYTES ((LC_SPX_FORS_HEIGHT + 1) * LC_SPX_FORS_TREES * LC_SPX_N)
#define LC_SPX_FORS_PK_BYTES LC_SPX_N
 
/* Resulting LC_SPX sizes. */
#define LC_SPX_BYTES (LC_SPX_N + LC_SPX_FORS_BYTES + LC_SPX_D * LC_SPX_WOTS_BYTES +\
                   LC_SPX_FULL_HEIGHT * LC_SPX_N)
#define LC_SPX_PK_BYTES (2 * LC_SPX_N)
#define LC_SPX_SK_BYTES (2 * LC_SPX_N + LC_SPX_PK_BYTES)
 
#elif LC_SPHINCS_MODE == 35664
 
#define LC_SPHINCS_NIST_CATEGORY 3
 
/* Hash output length in bytes. */
#define LC_SPX_N 24
/* Height of the hypertree. */
#define LC_SPX_FULL_HEIGHT 66
/* Number of subtree layer. */
#define LC_SPX_D 22
/* FORS tree dimensions. */
#define LC_SPX_FORS_HEIGHT 8
#define LC_SPX_FORS_TREES 33
/* Winternitz parameter, */
#define LC_SPX_WOTS_W 16
 
/* The hash function is defined by linking a different hash.c file, as opposed
   to setting a #define constant. */
 
/* For clarity */
#define LC_SPX_ADDR_BYTES 32
 
/* WOTS parameters. */
#if LC_SPX_WOTS_W == 256
    #define LC_SPX_WOTS_LOGW 8
#elif LC_SPX_WOTS_W == 16
    #define LC_SPX_WOTS_LOGW 4
#else
    #error LC_SPX_WOTS_W assumed 16 or 256
#endif
 
#define LC_SPX_WOTS_LEN1 (8 * LC_SPX_N / LC_SPX_WOTS_LOGW)
 
/* LC_SPX_WOTS_LEN2 is floor(log(len_1 * (w - 1)) / log(w)) + 1; we precompute */
#if LC_SPX_WOTS_W == 256
    #if LC_SPX_N <= 1
        #define LC_SPX_WOTS_LEN2 1
    #elif LC_SPX_N <= 256
        #define LC_SPX_WOTS_LEN2 2
    #else
        #error Did not precompute LC_SPX_WOTS_LEN2 for n outside {2, .., 256}
    #endif
#elif LC_SPX_WOTS_W == 16
    #if LC_SPX_N <= 8
        #define LC_SPX_WOTS_LEN2 2
    #elif LC_SPX_N <= 136
        #define LC_SPX_WOTS_LEN2 3
    #elif LC_SPX_N <= 256
        #define LC_SPX_WOTS_LEN2 4
    #else
        #error Did not precompute LC_SPX_WOTS_LEN2 for n outside {2, .., 256}
    #endif
#endif
 
#define LC_SPX_WOTS_LEN (LC_SPX_WOTS_LEN1 + LC_SPX_WOTS_LEN2)
#define LC_SPX_WOTS_BYTES (LC_SPX_WOTS_LEN * LC_SPX_N)
#define LC_SPX_WOTS_PK_BYTES LC_SPX_WOTS_BYTES
 
/* Subtree size. */
#define LC_SPX_TREE_HEIGHT (LC_SPX_FULL_HEIGHT / LC_SPX_D)
 
#if LC_SPX_TREE_HEIGHT * LC_SPX_D != LC_SPX_FULL_HEIGHT
    #error LC_SPX_D should always divide LC_SPX_FULL_HEIGHT
#endif
 
/* FORS parameters. */
#define LC_SPX_FORS_MSG_BYTES ((LC_SPX_FORS_HEIGHT * LC_SPX_FORS_TREES + 7) / 8)
#define LC_SPX_FORS_BYTES ((LC_SPX_FORS_HEIGHT + 1) * LC_SPX_FORS_TREES * LC_SPX_N)
#define LC_SPX_FORS_PK_BYTES LC_SPX_N
 
/* Resulting LC_SPX sizes. */
#define LC_SPX_BYTES (LC_SPX_N + LC_SPX_FORS_BYTES + LC_SPX_D * LC_SPX_WOTS_BYTES +\
                   LC_SPX_FULL_HEIGHT * LC_SPX_N)
#define LC_SPX_PK_BYTES (2 * LC_SPX_N)
#define LC_SPX_SK_BYTES (2 * LC_SPX_N + LC_SPX_PK_BYTES)
 
#elif LC_SPHINCS_MODE == 29792
 
#define LC_SPHINCS_NIST_CATEGORY 5
 
/* Hash output length in bytes. */
#define LC_SPX_N 32
 
/* Height of the hypertree. */
#define LC_SPX_FULL_HEIGHT 64
/* Number of subtree layer. */
#define LC_SPX_D 8
/* FORS tree dimensions. */
#define LC_SPX_FORS_HEIGHT 14
#define LC_SPX_FORS_TREES 22
/* Winternitz parameter, */
#define LC_SPX_WOTS_W 16
 
/* The hash function is defined by linking a different hash.c file, as opposed
   to setting a #define constant. */
 
/* For clarity */
#define LC_SPX_ADDR_BYTES 32
 
/* WOTS parameters. */
#if LC_SPX_WOTS_W == 256
    #define LC_SPX_WOTS_LOGW 8
#elif LC_SPX_WOTS_W == 16
    #define LC_SPX_WOTS_LOGW 4
#else
    #error LC_SPX_WOTS_W assumed 16 or 256
#endif
 
#define LC_SPX_WOTS_LEN1 (8 * LC_SPX_N / LC_SPX_WOTS_LOGW)
 
/* LC_SPX_WOTS_LEN2 is floor(log(len_1 * (w - 1)) / log(w)) + 1; we precompute */
#if LC_SPX_WOTS_W == 256
    #if LC_SPX_N <= 1
        #define LC_SPX_WOTS_LEN2 1
    #elif LC_SPX_N <= 256
        #define LC_SPX_WOTS_LEN2 2
    #else
        #error Did not precompute LC_SPX_WOTS_LEN2 for n outside {2, .., 256}
    #endif
#elif LC_SPX_WOTS_W == 16
    #if LC_SPX_N <= 8
        #define LC_SPX_WOTS_LEN2 2
    #elif LC_SPX_N <= 136
        #define LC_SPX_WOTS_LEN2 3
    #elif LC_SPX_N <= 256
        #define LC_SPX_WOTS_LEN2 4
    #else
        #error Did not precompute LC_SPX_WOTS_LEN2 for n outside {2, .., 256}
    #endif
#endif
 
#define LC_SPX_WOTS_LEN (LC_SPX_WOTS_LEN1 + LC_SPX_WOTS_LEN2)
#define LC_SPX_WOTS_BYTES (LC_SPX_WOTS_LEN * LC_SPX_N)
#define LC_SPX_WOTS_PK_BYTES LC_SPX_WOTS_BYTES
 
/* Subtree size. */
#define LC_SPX_TREE_HEIGHT (LC_SPX_FULL_HEIGHT / LC_SPX_D)
 
#if LC_SPX_TREE_HEIGHT * LC_SPX_D != LC_SPX_FULL_HEIGHT
    #error LC_SPX_D should always divide LC_SPX_FULL_HEIGHT
#endif
 
/* FORS parameters. */
#define LC_SPX_FORS_MSG_BYTES ((LC_SPX_FORS_HEIGHT * LC_SPX_FORS_TREES + 7) / 8)
#define LC_SPX_FORS_BYTES                                                      \
        ((LC_SPX_FORS_HEIGHT + 1) * LC_SPX_FORS_TREES * LC_SPX_N)
#define LC_SPX_FORS_PK_BYTES LC_SPX_N
 
/* Resulting LC_SPX sizes. */
#define LC_SPX_BYTES (LC_SPX_N + LC_SPX_FORS_BYTES + LC_SPX_D * LC_SPX_WOTS_BYTES +\
                   LC_SPX_FULL_HEIGHT * LC_SPX_N)
#define LC_SPX_PK_BYTES (2 * LC_SPX_N)
#define LC_SPX_SK_BYTES (2 * LC_SPX_N + LC_SPX_PK_BYTES)
 
#elif LC_SPHINCS_MODE == 49856
 
#define LC_SPHINCS_NIST_CATEGORY 5
 
/* Hash output length in bytes. */
#define LC_SPX_N 32
/* Height of the hypertree. */
#define LC_SPX_FULL_HEIGHT 68
/* Number of subtree layer. */
#define LC_SPX_D 17
/* FORS tree dimensions. */
#define LC_SPX_FORS_HEIGHT 9
#define LC_SPX_FORS_TREES 35
/* Winternitz parameter, */
#define LC_SPX_WOTS_W 16
 
/* The hash function is defined by linking a different hash.c file, as opposed
   to setting a #define constant. */
 
/* For clarity */
#define LC_SPX_ADDR_BYTES 32
 
/* WOTS parameters. */
#if LC_SPX_WOTS_W == 256
    #define LC_SPX_WOTS_LOGW 8
#elif LC_SPX_WOTS_W == 16
    #define LC_SPX_WOTS_LOGW 4
#else
    #error LC_SPX_WOTS_W assumed 16 or 256
#endif
 
#define LC_SPX_WOTS_LEN1 (8 * LC_SPX_N / LC_SPX_WOTS_LOGW)
 
/* LC_SPX_WOTS_LEN2 is floor(log(len_1 * (w - 1)) / log(w)) + 1; we precompute */
#if LC_SPX_WOTS_W == 256
    #if LC_SPX_N <= 1
        #define LC_SPX_WOTS_LEN2 1
    #elif LC_SPX_N <= 256
        #define LC_SPX_WOTS_LEN2 2
    #else
        #error Did not precompute LC_SPX_WOTS_LEN2 for n outside {2, .., 256}
    #endif
#elif LC_SPX_WOTS_W == 16
    #if LC_SPX_N <= 8
        #define LC_SPX_WOTS_LEN2 2
    #elif LC_SPX_N <= 136
        #define LC_SPX_WOTS_LEN2 3
    #elif LC_SPX_N <= 256
        #define LC_SPX_WOTS_LEN2 4
    #else
        #error Did not precompute LC_SPX_WOTS_LEN2 for n outside {2, .., 256}
    #endif
#endif
 
#define LC_SPX_WOTS_LEN (LC_SPX_WOTS_LEN1 + LC_SPX_WOTS_LEN2)
#define LC_SPX_WOTS_BYTES (LC_SPX_WOTS_LEN * LC_SPX_N)
#define LC_SPX_WOTS_PK_BYTES LC_SPX_WOTS_BYTES
 
/* Subtree size. */
#define LC_SPX_TREE_HEIGHT (LC_SPX_FULL_HEIGHT / LC_SPX_D)
 
#if LC_SPX_TREE_HEIGHT * LC_SPX_D != LC_SPX_FULL_HEIGHT
    #error LC_SPX_D should always divide LC_SPX_FULL_HEIGHT
#endif
 
/* FORS parameters. */
#define LC_SPX_FORS_MSG_BYTES ((LC_SPX_FORS_HEIGHT * LC_SPX_FORS_TREES + 7) / 8)
#define LC_SPX_FORS_BYTES ((LC_SPX_FORS_HEIGHT + 1) * LC_SPX_FORS_TREES * LC_SPX_N)
#define LC_SPX_FORS_PK_BYTES LC_SPX_N
 
/* Resulting LC_SPX sizes. */
#define LC_SPX_BYTES (LC_SPX_N + LC_SPX_FORS_BYTES + LC_SPX_D * LC_SPX_WOTS_BYTES +\
                   LC_SPX_FULL_HEIGHT * LC_SPX_N)
#define LC_SPX_PK_BYTES (2 * LC_SPX_N)
#define LC_SPX_SK_BYTES (2 * LC_SPX_N + LC_SPX_PK_BYTES)
 
#else
#error "Undefined Sphincs Plus security strength"
#endif
 
#define LC_SPX_SEEDBYTES (3 * LC_SPX_N)


struct lc_sphincs_shake_192s_sk {
        uint8_t sk_seed[LC_SPX_N];
        uint8_t sk_prf[LC_SPX_N];
        uint8_t pk[2 * LC_SPX_N];
};

struct lc_sphincs_shake_192s_pk {
        uint8_t pk[2 * LC_SPX_N];
};

struct lc_sphincs_shake_192s_sig {
        uint8_t r[LC_SPX_N];
        uint8_t sigfors[LC_SPX_FORS_BYTES];
        uint8_t sight[LC_SPX_D * LC_SPX_WOTS_BYTES + LC_SPX_FULL_HEIGHT *      \
                      LC_SPX_N];
};
 
#ifndef LC_SPHINCS_CTX_ON_STACK
struct lc_sphincs_ctx {
        struct lc_hash_ctx sphincs_hash_ctx;

        uint8_t shake_state[LC_SHA3_STATE_SIZE_ALIGN(LC_SHA3_256_CTX_SIZE)];

        const struct lc_hash *sphincs_prehash_type;

        size_t userctxlen;

        const uint8_t *userctx;

        unsigned int slh_dsa_internal:1;
};

#define LC_SPHINCS_CTX_SIZE                                                    \
        sizeof(struct lc_sphincs_ctx)
 
#define LC_SPHINCS_SET_CTX(name)                                               \
        (name)->sphincs_hash_ctx.hash = NULL;                                  \
        (name)->sphincs_prehash_type = NULL;                                   \
        (name)->slh_dsa_internal = 0;                                          \
        (name)->userctxlen = 0;                                                \
        (name)->userctx = NULL
#endif

#ifndef LC_SPHINCS_CTX_ON_STACK
#define LC_SPHINCS_CTX_ON_STACK(name)                                          \
        _Pragma("GCC diagnostic push") _Pragma(                                \
                "GCC diagnostic ignored \"-Wdeclaration-after-statement\"")    \
                LC_ALIGNED_BUFFER(                                             \
                        name##_ctx_buf, LC_SPHINCS_CTX_SIZE,                   \
                        LC_HASH_COMMON_ALIGNMENT);                             \
        struct lc_sphincs_ctx *name =                                          \
                (struct lc_sphincs_ctx *)name##_ctx_buf;                       \
        LC_SPHINCS_SET_CTX(name);                                              \
        _Pragma("GCC diagnostic pop")
#endif

int lc_sphincs_shake_192s_ctx_alloc(struct lc_sphincs_ctx **ctx);

void lc_sphincs_shake_192s_ctx_zero_free(struct lc_sphincs_ctx *ctx);

static inline void lc_sphincs_shake_192s_ctx_zero(struct lc_sphincs_ctx *ctx)
{
        if (!ctx)
                return;
 
        /* Only zeroize if the hash state has been initialized */
        if (ctx->sphincs_hash_ctx.hash)
                lc_hash_zero(&ctx->sphincs_hash_ctx);
}

LC_PURE
static inline unsigned int lc_sphincs_shake_192s_sk_size(void)
{
        return sizeof(struct lc_sphincs_shake_192s_sk);
}

LC_PURE
static inline unsigned int lc_sphincs_shake_192s_pk_size(void)
{
        return sizeof(struct lc_sphincs_shake_192s_pk);
}

LC_PURE
static inline unsigned int lc_sphincs_shake_192s_sig_size(void)
{
        return sizeof(struct lc_sphincs_shake_192s_sig);
}

int lc_sphincs_shake_192s_keypair(struct lc_sphincs_shake_192s_pk *pk, struct lc_sphincs_shake_192s_sk *sk,
                         struct lc_rng_ctx *rng_ctx);

int lc_sphincs_shake_192s_keypair_from_seed(struct lc_sphincs_shake_192s_pk *pk,
                                       struct lc_sphincs_shake_192s_sk *sk,
                                       const uint8_t *seed, size_t seedlen);

int lc_sphincs_shake_192s_sign(struct lc_sphincs_shake_192s_sig *sig, const uint8_t *m,
                      size_t mlen, const struct lc_sphincs_shake_192s_sk *sk,
                      struct lc_rng_ctx *rng_ctx);

int lc_sphincs_shake_192s_sign_ctx(struct lc_sphincs_shake_192s_sig *sig,
                              struct lc_sphincs_ctx *ctx,
                              const uint8_t *m, size_t mlen,
                              const struct lc_sphincs_shake_192s_sk *sk,
                              struct lc_rng_ctx *rng_ctx);

int lc_sphincs_shake_192s_sign_init(struct lc_sphincs_ctx *ctx,
                           const struct lc_sphincs_shake_192s_sk *sk);

int lc_sphincs_shake_192s_sign_update(struct lc_sphincs_ctx *ctx, const uint8_t *m,
                             size_t mlen);

int lc_sphincs_shake_192s_sign_final(struct lc_sphincs_shake_192s_sig *sig,
                            struct lc_sphincs_ctx *ctx,
                            const struct lc_sphincs_shake_192s_sk *sk,
                            struct lc_rng_ctx *rng_ctx);

int lc_sphincs_shake_192s_verify(const struct lc_sphincs_shake_192s_sig *sig, const uint8_t *m,
                        size_t mlen, const struct lc_sphincs_shake_192s_pk *pk);

int lc_sphincs_shake_192s_verify_ctx(const struct lc_sphincs_shake_192s_sig *sig,
                                struct lc_sphincs_ctx *ctx,
                                const uint8_t *m, size_t mlen,
                                const struct lc_sphincs_shake_192s_pk *pk);
 

int lc_sphincs_shake_192s_verify_init(struct lc_sphincs_ctx *ctx,
                             const struct lc_sphincs_shake_192s_pk *pk);

int lc_sphincs_shake_192s_verify_update(struct lc_sphincs_ctx *ctx, const uint8_t *m,
                               size_t mlen);

int lc_sphincs_shake_192s_verify_final(const struct lc_sphincs_shake_192s_sig *sig,
                              struct lc_sphincs_ctx *ctx,
                              const struct lc_sphincs_shake_192s_pk *pk);
 
/*
 * To allow including the different lc_sphincs_*.h files, these macros need to
 * be undefined. Only during compilation of leancrypto, these macros remain
 * defined as this header file is not included multiple times.
 */
#ifndef LC_SPHINCS_INTERNAL
#undef LC_SPHINCS_NIST_CATEGORY
#undef LC_SPHINCS_HASH_TYPE
#undef LC_SPHINCS_MODE
#undef LC_SPX_N
#undef LC_SPX_FULL_HEIGHT
#undef LC_SPX_D
#undef LC_SPX_FORS_HEIGHT
#undef LC_SPX_FORS_TREES
#undef LC_SPX_WOTS_W
#undef LC_SPX_ADDR_BYTES
#undef LC_SPX_WOTS_LOGW
#undef LC_SPX_WOTS_LEN1
#undef LC_SPX_WOTS_LEN2
#undef LC_SPX_WOTS_LEN
#undef LC_SPX_WOTS_BYTES
#undef LC_SPX_WOTS_PK_BYTES
#undef LC_SPX_TREE_HEIGHT
#undef LC_SPX_FORS_MSG_BYTES
#undef LC_SPX_FORS_BYTES
#undef LC_SPX_FORS_PK_BYTES
#undef LC_SPX_BYTES
#undef LC_SPX_PK_BYTES
#undef LC_SPX_SK_BYTES
#endif /* LC_SPHINCS_INTERNAL */
 
#ifdef __cplusplus
}
#endif
 
#endif /* LC_SPHINCS_SHAKE_192S_H */