[frontend] Add Winternitz OTS verifier (#811)

This PR implements verification of a Winternitz OTS signature.

It combines:

1. Message hashing
2. Codeword generation
3. Chain verification

A signature is verified by:

1. Computing the codeword coordinates, one for each signature_hash, from the hash of the input message. (NB: The codeword circuit also checks the codeword target sum)
2. Iteratively hash each signature_hash (the number of times given by the coordinate in 1.)
3. Checking each hash resulting from 2. is equal to the corresponding public_key_hash.

This blog post describes how this works: https://hackmd.io/@tcoratger/S1t-qhPFJx#One-Time-Signatures-via-Hash-Chains

Author: paulcadman

crates/frontend/Cargo.toml

@@ -13,6 +13,7 @@ cranelift-entity = { workspace = true }
 hex-literal.workspace = true
 num-bigint = { workspace = true }
 num-integer = { workspace = true }
+rand = { workspace = true, features = ["std_rng", "thread_rng"] }
 serde.workspace = true
 serde_json.workspace = true
 sha2.workspace = true

crates/frontend/src/circuits/hash_based_sig/codeword.rs

@@ -99,6 +99,23 @@ pub fn codeword(
 	coordinates
 }
 
+/// A function to extract the coordinates from a hash according to the rules
+/// specified in the `codeword` circuit
+pub fn extract_coordinates(hash: &[u8], dimension: usize, resolution_bits: usize) -> Vec<u8> {
+	let mut coords = Vec::new();
+	let coords_per_byte = 8 / resolution_bits;
+	let mask = (1u8 << resolution_bits) - 1;
+
+	for i in 0..dimension {
+		let byte_idx = i / coords_per_byte;
+		let coord_idx = i % coords_per_byte;
+		let shift = coord_idx * resolution_bits;
+		let coord = (hash[byte_idx] >> shift) & mask;
+		coords.push(coord);
+	}
+	coords
+}
+
 #[cfg(test)]
 mod tests {
 	use binius_core::Word;

crates/frontend/src/circuits/hash_based_sig/hashing/message.rs

@@ -1,3 +1,5 @@
+use sha3::{Digest, Keccak256};
+
 use super::base::circuit_tweaked_keccak;
 use crate::{
 	circuits::{concat::Term, keccak::Keccak},
@@ -96,6 +98,25 @@ pub fn build_message_hash(
 	message
 }
 
+/// Compute the tweaked hash of a message from components.
+///
+/// Constructs the complete message for Keccak-256 hashing by concatenating:
+/// `param || 0x02 || nonce || message`
+///
+/// # Arguments
+///
+/// * `param_bytes` - The cryptographic parameter bytes
+/// * `nonce_bytes` - The random nonce bytes
+/// * `message_bytes` - The message content bytes
+///
+/// # Returns
+///
+/// The tweaked message hash
+pub fn hash_message(param: &[u8], nonce: &[u8], message: &[u8]) -> [u8; 32] {
+	let tweaked_message = build_message_hash(param, nonce, message);
+	Keccak256::digest(tweaked_message).into()
+}
+
 #[cfg(test)]
 mod tests {
 	use proptest::prelude::*;

crates/frontend/src/circuits/hash_based_sig/hashing/mod.rs

@@ -4,4 +4,4 @@ mod chain;
 mod message;
 
 pub use chain::{CHAIN_TWEAK, FIXED_MESSAGE_OVERHEAD, build_chain_hash, circuit_chain_hash};
-pub use message::{MESSAGE_TWEAK, build_message_hash, circuit_message_hash};
+pub use message::{MESSAGE_TWEAK, build_message_hash, circuit_message_hash, hash_message};

crates/frontend/src/circuits/hash_based_sig/mod.rs

@@ -1,3 +1,4 @@
 pub mod chain_verification;
 pub mod codeword;
 pub mod hashing;
+pub mod winternitz_ots;