Use 256f SPHINCS+ variant

It is a tradeoff between one-third more space usage for signature and
much more faster actions. Additional 10KB of space is cheap.

diff --git a/go/cm/cmd/cmkeytool/certification.t b/go/cm/cmd/cmkeytool/certification.t
index 7c03dc66cea3941973a9fa8aee04979730d5d09b0b74a3cb577a1705fbe75cbd..fd1e4c8ec2de25542b401f92b9936474607b782fa4f20fec93f905cd1f3d8709 100755 (executable)
--- a/go/cm/cmd/cmkeytool/certification.t
+++ b/go/cm/cmd/cmkeytool/certification.t
@@ -7,7 +7,7 @@ TMPDIR=${TMPDIR:-/tmp}
 
 echo "gost3410-512C gost3410-256A
 ed25519-blake2b ed25519-blake2b
-sphincs+-shake-256s sphincs+-shake-256s" | while read caAlgo eeAlgo ; do
+sphincs+-shake-256f sphincs+-shake-256f" | while read caAlgo eeAlgo ; do
 
 sub="-sub CN=CA -sub C=RU"
 test_expect_success "$caAlgo: CA load generation" "cmkeytool \

diff --git a/go/cm/cmd/cmkeytool/main.go b/go/cm/cmd/cmkeytool/main.go
index db9520fc49c56d0aa56c46990e9698de176fd07f7d229fbb2d31ef9fbdf00a47..948e5467385ebd4a8c3c706e4fab8c0860692681e3d83072b1cdd7bbb5f5f30f 100644 (file)
--- a/go/cm/cmd/cmkeytool/main.go
+++ b/go/cm/cmd/cmkeytool/main.go
@@ -98,7 +98,7 @@ func main() {
                        gost.GOST3410512C,
                        sntrup4591761x25519.SNTRUP4591761X25519,
                        mceliece6960119x25519.ClassicMcEliece6960119X25519,
-                       spx.SPHINCSPlusSHAKE256s,
+                       spx.SPHINCSPlusSHAKE256f,
                }
                sort.Strings(algos)
                for _, s := range algos {
@@ -180,7 +180,7 @@ func main() {
                        prvRaw, pub, err = sntrup4591761x25519.NewKeypair()
                case mceliece6960119x25519.ClassicMcEliece6960119X25519:
                        prvRaw, pub, err = mceliece6960119x25519.NewKeypair()
-               case spx.SPHINCSPlusSHAKE256s:
+               case spx.SPHINCSPlusSHAKE256f:
                        prvRaw, pub, err = spx.NewKeypair(*algo)
                default:
                        err = errors.New("unknown -algo specified")
@@ -211,7 +211,7 @@ func main() {
                                hasher = cmhash.ByName(cmhash.BLAKE2b256)
                        case gost.GOST3410256A, gost.GOST3410512C:
                                hasher = cmhash.ByName(cmhash.Streebog256)
-                       case mceliece6960119x25519.ClassicMcEliece6960119X25519, spx.SPHINCSPlusSHAKE256s:
+                       case mceliece6960119x25519.ClassicMcEliece6960119X25519, spx.SPHINCSPlusSHAKE256f:
                                hasher = cmhash.ByName(cmhash.SHAKE128)
                        default:
                                log.Fatal("unsupported algorithm")

diff --git a/go/cm/cmd/cmsigtool/basic.t b/go/cm/cmd/cmsigtool/basic.t
index 87bd2841e5704807233f3fc3086bf6b67691b6633349e9ef87725f4dee832456..9fa402e846fab4167ef52fe6ecc46d2cc878161e6b16d92520e7e65f2a02c686 100755 (executable)
--- a/go/cm/cmd/cmsigtool/basic.t
+++ b/go/cm/cmd/cmsigtool/basic.t
@@ -8,7 +8,7 @@ TMPDIR=${TMPDIR:-/tmp}
 echo "gost3410-512C
 gost3410-256A
 ed25519-blake2b
-sphincs+-shake-256s" | while read keyalgo ; do
+sphincs+-shake-256f" | while read keyalgo ; do
 
 sub="-sub what=ever"
 typ="some-different-type"

diff --git a/go/cm/hash/algo.go b/go/cm/hash/algo.go
index 703e7d1b71e75e93506f2a77d2cd8e4717096f08f83663e16b4fc7539e2822a4..133ea027753cdd9f7e63de7c6f00aadced9808175c35526751b9695e446aaf8b 100644 (file)
--- a/go/cm/hash/algo.go
+++ b/go/cm/hash/algo.go
@@ -73,12 +73,12 @@ func ByName(name string) hash.Hash {
                return h
        case SHAKE128:
                return NewSHAKE128()
-       case SHAKE256, SPHINCSPlusSHAKE256s, SPHINCSPlusSHAKE256sPh:
+       case SHAKE256, SPHINCSPlusSHAKE256f, SPHINCSPlusSHAKE256fPh:
                return NewSHAKE256()
        case SHAKE128Merkle:
                return NewSHAKE128MerkleHasher(
                        merkle.DefaultChunkLen, DefaultNumCPU)
-       case SHAKE256Merkle, SPHINCSPlusSHAKE256sMerkle:
+       case SHAKE256Merkle, SPHINCSPlusSHAKE256fMerkle:
                return NewSHAKE256MerkleHasher(
                        merkle.DefaultChunkLen, DefaultNumCPU)
        }

diff --git a/go/cm/hash/shake.go b/go/cm/hash/shake.go
index 5051d760045dee7a856724bc0e6a4661164d81ae9d738a8dfcb1f62695f4a673..a92a4e9098d8a98a993f8d9f6fafd9ca09b37cdcadebd1467e4c81796c59b4e3 100644 (file)
--- a/go/cm/hash/shake.go
+++ b/go/cm/hash/shake.go
@@ -27,9 +27,9 @@ const (
        SHAKE128Merkle = "shake128-merkle"
        SHAKE256Merkle = "shake256-merkle"
 
-       SPHINCSPlusSHAKE256s       = "sphincs+-shake-256s"
-       SPHINCSPlusSHAKE256sPh     = "sphincs+-shake-256s-ph"
-       SPHINCSPlusSHAKE256sMerkle = "sphincs+-shake-256s-merkle"
+       SPHINCSPlusSHAKE256f       = "sphincs+-shake-256f"
+       SPHINCSPlusSHAKE256fPh     = "sphincs+-shake-256f-ph"
+       SPHINCSPlusSHAKE256fMerkle = "sphincs+-shake-256f-merkle"
 )
 
 type SHAKE struct {

diff --git a/go/cm/sign/prv.go b/go/cm/sign/prv.go
index 7c7cdbd142005ddbfcf6f49b8ec68bef20debfc06a966ffcf4f3c6ce6eb8fb39..08ca9aebdacbcb86075679988b45594caa318427a2cc50a81a40dc158f18069f 100644 (file)
--- a/go/cm/sign/prv.go
+++ b/go/cm/sign/prv.go
@@ -60,7 +60,7 @@ func PrvParse(data []byte) (prv Iface, pub []byte, err error) {
                prv, pub, err = ed25519blake2b.NewSigner(av.V)
        case gost.GOST3410256A, gost.GOST3410512C:
                prv, pub, err = gost.NewSigner(av.V)
-       case spx.SPHINCSPlusSHAKE256s:
+       case spx.SPHINCSPlusSHAKE256f:
                prv, pub, err = spx.NewSigner(av.V)
        default:
                err = fmt.Errorf("unknown private key algo: %s", av.A)

diff --git a/go/cm/sign/pub.go b/go/cm/sign/pub.go
index c71076e51942cf81a54ca766d9fdd374403d7950e51c7891566ed7936d82a64f..b7b61f5ccdc3ef35340ca5985ce95ea02e55a7955edfecbfb596701e56a1bb71 100644 (file)
--- a/go/cm/sign/pub.go
+++ b/go/cm/sign/pub.go
@@ -140,8 +140,8 @@ func (pub *PubLoad) CheckSignature(algo string, signed, signature []byte) (err e
                if !valid {
                        err = ErrSigInvalid
                }
-       case spx.SPHINCSPlusSHAKE256s:
-               if algo != spx.SPHINCSPlusSHAKE256s {
+       case spx.SPHINCSPlusSHAKE256f:
+               if algo != spx.SPHINCSPlusSHAKE256f {
                        return ErrBadSigAlgo
                }
                valid, err = spx.Verify(key.A, key.V, signed, signature)
@@ -191,10 +191,10 @@ func (pub *PubLoad) CheckSignaturePrehash(
                if !valid {
                        err = ErrSigInvalid
                }
-       case spx.SPHINCSPlusSHAKE256s:
+       case spx.SPHINCSPlusSHAKE256f:
                switch algo {
-               case spx.SPHINCSPlusSHAKE256sPh:
-               case spx.SPHINCSPlusSHAKE256sMerkle:
+               case spx.SPHINCSPlusSHAKE256fPh:
+               case spx.SPHINCSPlusSHAKE256fMerkle:
                default:
                        return ErrBadSigAlgo
                }

diff --git a/go/cm/sign/spx/kp.go b/go/cm/sign/spx/kp.go
index 5359c61da8f0a78f28c736a2a712e9058470b75b401cc45f2d047fa432cd8972..67818afec1ead4f1c9e083a514fe62e4701bea47560481f3a8948a2c78b60651 100644 (file)
--- a/go/cm/sign/spx/kp.go
+++ b/go/cm/sign/spx/kp.go
@@ -21,12 +21,12 @@ import (
 )
 
 const (
-       SPHINCSPlusSHAKE256s       = "sphincs+-shake-256s"
-       SPHINCSPlusSHAKE256sPh     = "sphincs+-shake-256s-ph"
-       SPHINCSPlusSHAKE256sMerkle = "sphincs+-shake-256s-merkle"
+       SPHINCSPlusSHAKE256f       = "sphincs+-shake-256f"
+       SPHINCSPlusSHAKE256fPh     = "sphincs+-shake-256f-ph"
+       SPHINCSPlusSHAKE256fMerkle = "sphincs+-shake-256f-merkle"
 )
 
-var Params = spxParams.MakeSphincsPlusSHAKE256256sSimple(true)
+var Params = spxParams.MakeSphincsPlusSHAKE256256fSimple(true)
 
 func NewKeypair(algo string) (prv, pub []byte, err error) {
        sk, pk := spx.Spx_keygen(Params)

diff --git a/go/cm/sign/spx/signer.go b/go/cm/sign/spx/signer.go
index 57ddcb4988f39a6c2ce1490e3499d5a4115c3f1eb676ad2294acc74f0aee9428..b7ea55088af67d7faa2288cc639b0f9e081efa210118979b8d935e1abf561797 100644 (file)
--- a/go/cm/sign/spx/signer.go
+++ b/go/cm/sign/spx/signer.go
@@ -67,11 +67,11 @@ func (s *Signer) Prehasher() *hash.Hash {
 func (s *Signer) Algo() string {
        switch s.mode {
        case mode.Pure:
-               return SPHINCSPlusSHAKE256s
+               return SPHINCSPlusSHAKE256f
        case mode.Prehash:
-               return SPHINCSPlusSHAKE256sPh
+               return SPHINCSPlusSHAKE256fPh
        case mode.Merkle:
-               return SPHINCSPlusSHAKE256sMerkle
+               return SPHINCSPlusSHAKE256fMerkle
        }
        return ""
 }

diff --git a/spec/cm/prv.texi b/spec/cm/prv.texi
index cc191a4e6bc3ce84062a24e1dc3c272861a78548cf2515e96489f13c8666fd74..4b25e173087a8853458db8aeb2a6e84fb0b4d4dc71c37508d6f973993b55601f 100644 (file)
--- a/spec/cm/prv.texi
+++ b/spec/cm/prv.texi
@@ -51,14 +51,14 @@ Stored in a file, it should begin with "cm/prv" @ref{MAGIC, magic}.
 
     @code{mceliece6960119-x25519} algorithm identifier is used.
 
-@node cm-prv-sphincs+-shake-256s
-@cindex cm-prv-sphincs+-shake-256s
-@nodedescription cm/prv with SPHINCS+-SHAKE256-256s
-@subsection cm/prv with SPHINCS+-SHAKE256-256s
+@node cm-prv-sphincs+-shake-256f
+@cindex cm-prv-sphincs+-shake-256f
+@nodedescription cm/prv with SPHINCS+-SHAKE256-256f
+@subsection cm/prv with SPHINCS+-SHAKE256-256f
 
     @url{https://sphincs.org/, SPHINCS+} with
     @url{https://keccak.team/, SHAKE256} hash,
-    255-bit security level, small signatures and simple parameters.
+    255-bit security level, fast variant and simple parameters.
     Value is concatenation of private and public keys (128+64 bytes).
 
-    Algorithm identifier for the public key: @code{sphincs+-shake-256s}.
+    Algorithm identifier for the public key: @code{sphincs+-shake-256f}.

diff --git a/spec/cm/pub.texi b/spec/cm/pub.texi
index 7a4819b706d4afd21fc4b7ae6927829853eb29a0a3bfaba07d0eced8e85ada76..deefcad76550cb1b7ebdf02ac61612696d9e28bc9386f19ba303d3dce780c78a 100644 (file)
--- a/spec/cm/pub.texi
+++ b/spec/cm/pub.texi
@@ -191,15 +191,15 @@ MAP {
     save resources during @ref{kem-mceliece6960119-x25519-hkdf-shake256}
     KDF calculations.
 
-@node cm-pub-sphincs+-shake-256s
-@cindex cm-pub-sphincs+-shake-256s
-@nodedescription cm/pub with SPHINCS+-SHAKE256-256s
-@subsection cm/pub with SPHINCS+-SHAKE256-256s
+@node cm-pub-sphincs+-shake-256f
+@cindex cm-pub-sphincs+-shake-256f
+@nodedescription cm/pub with SPHINCS+-SHAKE256-256f
+@subsection cm/pub with SPHINCS+-SHAKE256-256f
 
     @url{https://sphincs.org/, SPHINCS+} with
     @url{https://keccak.team/, SHAKE256} hash,
-    255-bit security level, small signatures and simple parameters.
+    255-bit security level, fast variant and simple parameters.
 
-    @code{sphincs+-shake-256s} algorithm identifier is used.
+    @code{sphincs+-shake-256f} algorithm identifier is used.
 
     Public key's fingerprint should be calculated using SHAKE128.

diff --git a/spec/cm/signed.texi b/spec/cm/signed.texi
index 10153320c6d9c3f43d028119905343437b529d9ad6f0dde881cf4aa8fc499b14..315467e5cc12e3b103814de72824e62a3eab35c6f76b608e558208fd6e1d2b08 100644 (file)
--- a/spec/cm/signed.texi
+++ b/spec/cm/signed.texi
@@ -116,27 +116,27 @@ recipient's public key fingerprint(s).
     HashEdDSA mode is used with @code{ed25519ph-blake2b-merkle}
     algorithm identifier for signature.
 
-@node cm-signed-sphincs+-shake-256s
-@cindex cm-signed-sphincs+-shake-256s
-@cindex cm-signed-sphincs+-shake-256s-ph
-@nodedescription cm/signed with SPHINCS+-SHAKE256-256s
-@subsection cm/signed with SPHINCS+-SHAKE256-256s
+@node cm-signed-sphincs+-shake-256f
+@cindex cm-signed-sphincs+-shake-256f
+@cindex cm-signed-sphincs+-shake-256f-ph
+@nodedescription cm/signed with SPHINCS+-SHAKE256-256f
+@subsection cm/signed with SPHINCS+-SHAKE256-256f
 
     @url{https://sphincs.org/, SPHINCS+} with
     @url{https://keccak.team/, SHAKE256} hash,
-    255-bit security level, small signatures,
+    255-bit security level, fast variant,
     simple parameters and deterministic signatures.
 
-    @code{sphincs+-shake-256s} algorithm identifier
+    @code{sphincs+-shake-256f} algorithm identifier
     must be used for the signature in pure signing mode.
-    @code{sphincs+-shake-256s-ph} is used in prehash mode.
+    @code{sphincs+-shake-256f-ph} is used in prehash mode.
 
-@node cm-signed-sphincs+-shake-256s-merkle
-@cindex cm-signed-sphincs+-shake-256s-merkle
-@nodedescription cm-signed-sphincs+-shake-256s with Merkle-tree hashing
-@subsection cm-signed-sphincs+-shake-256s with Merkle-tree hashing
+@node cm-signed-sphincs+-shake-256f-merkle
+@cindex cm-signed-sphincs+-shake-256f-merkle
+@nodedescription cm-signed-sphincs+-shake-256f with Merkle-tree hashing
+@subsection cm-signed-sphincs+-shake-256f with Merkle-tree hashing
 
     @ref{cm-hashed-shake-merkle, shake256-merkle} Merkle-tree hashing is used.
 
-    @code{sphincs+-shake-256s-merkle} algorithm
+    @code{sphincs+-shake-256f-merkle} algorithm
     identifier must be used for the signature.