First consistent version of the BAVC implementation

Author: sebastinas

vc.c

@@ -13,7 +13,6 @@
 #include "instances.h"
 #include "universal_hashing.h"
 
-#include <assert.h>
 #include <string.h>
 
 typedef struct tree_t {
@@ -27,7 +26,7 @@ typedef struct tree_t {
 static void expand_seeds(uint8_t* nodes, const uint8_t* iv, const faest_paramset_t* params) {
   const unsigned int lambda_bytes = params->faest_param.lambda / 8;
 
-  for (unsigned int alpha = 0; alpha <= params->faest_param.L - 2; ++alpha) {
+  for (unsigned int alpha = 0; alpha < params->faest_param.L - 1; ++alpha) {
     // the nodes are located other in memory consecutively
     prg(NODE(nodes, alpha, lambda_bytes), iv, alpha, NODE(nodes, 2 * alpha + 1, lambda_bytes),
         params->faest_param.lambda, lambda_bytes * 2);
@@ -104,6 +103,7 @@ static void vector_commitment_faest(const uint8_t* rootKey, const uint8_t* iv,
   const unsigned int lambda       = params->faest_param.lambda;
   const unsigned int L            = params->faest_param.L;
   const unsigned int lambda_bytes = lambda / 8;
+  const unsigned int com_size     = lambda_bytes * 3; // size of com_ij
 
   H0_context_t uhash_ctx;
   H0_init(&uhash_ctx, lambda);
@@ -118,7 +118,7 @@ static void vector_commitment_faest(const uint8_t* rootKey, const uint8_t* iv,
 
   // Initialzing stuff
   vecCom->h   = malloc(lambda_bytes * 2);
-  vecCom->com = malloc(L * lambda_bytes * 3);
+  vecCom->com = malloc(L * com_size);
   vecCom->sd  = malloc(L * lambda_bytes);
 
   // Step: 1..3
@@ -137,9 +137,9 @@ static void vector_commitment_faest(const uint8_t* rootKey, const uint8_t* iv,
         bavc_max_node_index(i, params->faest_param.tau1, params->faest_param.k);
     for (unsigned int j = 0; j < N_i; ++j, ++offset) {
       const unsigned int alpha = pos_in_tree(i, j, params);
-      faest_leaf_commit(vecCom->sd + offset * lambda_bytes, vecCom->com + offset * lambda_bytes * 3,
+      faest_leaf_commit(vecCom->sd + offset * lambda_bytes, vecCom->com + offset * com_size,
                         NODE(nodes, alpha, lambda_bytes), iv, i + L - 1, uhash, lambda);
-      H1_update(&h1_ctx, vecCom->com + offset * lambda_bytes * 3, lambda_bytes * 3);
+      H1_update(&h1_ctx, vecCom->com + offset * com_size, com_size);
     }
 
     uint8_t hi[MAX_LAMBDA_BYTES * 2];
@@ -160,6 +160,7 @@ static void vector_commitment_faest_em(const uint8_t* rootKey, const uint8_t* iv
   const unsigned int lambda       = params->faest_param.lambda;
   const unsigned int L            = params->faest_param.L;
   const unsigned int lambda_bytes = lambda / 8;
+  const unsigned int com_size     = lambda_bytes * 2; // size of com_ij
 
   H1_context_t h1_com_ctx;
   H1_init(&h1_com_ctx, lambda);
@@ -169,7 +170,7 @@ static void vector_commitment_faest_em(const uint8_t* rootKey, const uint8_t* iv
 
   // Initialzing stuff
   vecCom->h   = malloc(lambda_bytes * 2);
-  vecCom->com = malloc(L * lambda_bytes * 2);
+  vecCom->com = malloc(L * com_size);
   vecCom->sd  = malloc(L * lambda_bytes);
 
   // Step: 1..3
@@ -185,10 +186,9 @@ static void vector_commitment_faest_em(const uint8_t* rootKey, const uint8_t* iv
         bavc_max_node_index(i, params->faest_param.tau1, params->faest_param.k);
     for (unsigned int j = 0; j < N_i; ++j, ++offset) {
       const unsigned int alpha = pos_in_tree(i, j, params);
-      faest_em_leaf_commit(vecCom->sd + offset * lambda_bytes,
-                           vecCom->com + offset * lambda_bytes * 2,
+      faest_em_leaf_commit(vecCom->sd + offset * lambda_bytes, vecCom->com + offset * com_size,
                            NODE(nodes, alpha, lambda_bytes), iv, i + L - 1, lambda);
-      H1_update(&h1_ctx, vecCom->com + offset * lambda_bytes * 2, lambda_bytes * 2);
+      H1_update(&h1_ctx, vecCom->com + offset * com_size, com_size);
     }
 
     uint8_t hi[MAX_LAMBDA_BYTES * 2];
@@ -221,6 +221,8 @@ bool vector_open(const vec_com_t* vc, const uint16_t* i_delta, uint8_t* decom_i,
   const unsigned int tau_1        = params->faest_param.tau1;
   const unsigned int com_size     = faest_is_em(params) ? (2 * lambda_bytes) : (3 * lambda_bytes);
 
+  uint8_t* decom_i_end = decom_i + com_size * tau + params->faest_param.T_open * lambda_bytes;
+
   // Step 5
   uint8_t* s = calloc((2 * L - 1 + 7) / 8, 1);
   // Step 6
@@ -254,8 +256,7 @@ bool vector_open(const vec_com_t* vc, const uint16_t* i_delta, uint8_t* decom_i,
   }
 
   // Step 19..25
-  for (unsigned int j = L - 2 + 1; j > 0; --j) {
-    unsigned int i = j - 1;
+  for (int i = L - 2; i >= 0; --i) {
     ptr_set_bit(s, ptr_get_bit(s, 2 * i + 1) | ptr_get_bit(s, 2 * i + 2), i);
     if ((ptr_get_bit(s, 2 * i + 1) ^ ptr_get_bit(s, 2 * i + 2)) == 1) {
       const unsigned int alpha = 2 * i + 1 + ptr_get_bit(s, 2 * i + 1);
@@ -264,6 +265,8 @@ bool vector_open(const vec_com_t* vc, const uint16_t* i_delta, uint8_t* decom_i,
     }
   }
 
+  memset(decom_i, 0, decom_i_end - decom_i);
+
   free(s);
   return true;
 }
@@ -286,8 +289,7 @@ static bool reconstruct_keys(uint8_t* s, uint8_t* keys, const uint8_t* decom_i,
   }
 
   // Step 12.12
-  for (unsigned int j = L - 2 + 1; j > 0; --j) {
-    unsigned int i = j - 1;
+  for (int i = L - 2; i >= 0; --i) {
     ptr_set_bit(s, ptr_get_bit(s, 2 * i + 1) | ptr_get_bit(s, 2 * i + 2), i);
     if ((ptr_get_bit(s, 2 * i + 1) ^ ptr_get_bit(s, 2 * i + 2)) == 1) {
       if (nodes == end) {
@@ -308,7 +310,8 @@ static bool reconstruct_keys(uint8_t* s, uint8_t* keys, const uint8_t* decom_i,
 
   for (unsigned int i = 0; i != L - 1; ++i) {
     if (!ptr_get_bit(s, i)) {
-      prg(keys + i * lambda_bytes, iv, i, keys + 2 * i * lambda_bytes, lambda, 2 * lambda_bytes);
+      prg(keys + i * lambda_bytes, iv, i, keys + (2 * i + 1) * lambda_bytes, lambda,
+          2 * lambda_bytes);
     }
   }
 
@@ -325,6 +328,7 @@ static bool vector_reconstruction_faest(const uint8_t* decom_i, const uint16_t*
   const unsigned int k            = params->faest_param.k;
   const unsigned int tau          = params->faest_param.tau;
   const unsigned int tau_1        = params->faest_param.tau1;
+  const unsigned int com_size     = lambda_bytes * 3; // size of com_ij
 
   // Step 6
   uint8_t* s    = calloc((2 * L - 1 + 7) >> 3, 1);
@@ -346,22 +350,21 @@ static bool vector_reconstruction_faest(const uint8_t* decom_i, const uint16_t*
 
   for (unsigned int i = 0, offset = 0; i != tau; ++i) {
     uint8_t uhash[MAX_LAMBDA_BYTES * 3];
-    H0_squeeze(&uhash_ctx, uhash, 3 * lambda_bytes);
+    H0_squeeze(&uhash_ctx, uhash, com_size);
 
     H1_context_t h1_ctx;
     H1_init(&h1_ctx, lambda);
 
     const unsigned int N_i = bavc_max_node_index(i, tau_1, k);
     for (unsigned int j = 0; j != N_i; ++j, ++offset) {
       const unsigned int alpha = pos_in_tree(i, j, params);
-      // Fix index: alpha + L - 1 is too big
       if (ptr_get_bit(s, alpha)) {
-        H1_update(&h1_ctx, decom_i + i * lambda_bytes * 3, lambda_bytes * 3);
+        H1_update(&h1_ctx, decom_i + i * com_size, com_size);
       } else {
         uint8_t com[3 * MAX_LAMBDA_BYTES];
         faest_leaf_commit(vecComRec->s + offset * lambda_bytes, com, keys + alpha * lambda_bytes,
                           iv, i + L - 1, uhash, lambda);
-        H1_update(&h1_ctx, com, 3 * lambda_bytes);
+        H1_update(&h1_ctx, com, com_size);
       }
     }
 
@@ -388,9 +391,10 @@ static bool vector_reconstruction_faest_em(const uint8_t* decom_i, const uint16_
   const unsigned int k            = params->faest_param.k;
   const unsigned int tau          = params->faest_param.tau;
   const unsigned int tau_1        = params->faest_param.tau1;
+  const unsigned int com_size     = lambda_bytes * 2; // size of com_ij
 
   // Step 6
-  uint8_t* s    = calloc((2 * L - 1 + 7) >> 3, 1);
+  uint8_t* s    = calloc((2 * L - 1 + 7) / 8, 1);
   uint8_t* keys = calloc(2 * params->faest_param.L - 1, lambda_bytes);
 
   // Step 7..10
@@ -411,12 +415,12 @@ static bool vector_reconstruction_faest_em(const uint8_t* decom_i, const uint16_
     for (unsigned int j = 0; j != N_i; ++j, ++offset) {
       const unsigned int alpha = pos_in_tree(i, j, params);
       if (ptr_get_bit(s, alpha)) {
-        H1_update(&h1_ctx, decom_i + i * lambda_bytes * 2, lambda_bytes * 2);
+        H1_update(&h1_ctx, decom_i + i * com_size, com_size);
       } else {
         uint8_t com[2 * MAX_LAMBDA_BYTES];
         faest_em_leaf_commit(vecComRec->s + offset * lambda_bytes, com, keys + alpha * lambda_bytes,
                              iv, i + L - 1, lambda);
-        H1_update(&h1_ctx, com, 2 * lambda_bytes);
+        H1_update(&h1_ctx, com, com_size);
       }
     }