From 84d43bcd0e2e1ecedb8751aa6452fdbb49c3b9ae Mon Sep 17 00:00:00 2001 From: Tony Arcieri Date: Tue, 16 Apr 2024 11:32:47 -0600 Subject: [PATCH] lms-signature v0.0.1 --- Cargo.lock | 2 +- lms/CHANGELOG.md | 5 +++++ lms/Cargo.toml | 6 ++---- lms/README.md | 44 ++++++++++++++++++++++++++++++++++---------- 4 files changed, 42 insertions(+), 15 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index c1a49c95..5bdadc8f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -649,7 +649,7 @@ checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c" [[package]] name = "lms-signature" -version = "0.0.0" +version = "0.0.1" dependencies = [ "digest 0.10.7", "generic-array", diff --git a/lms/CHANGELOG.md b/lms/CHANGELOG.md index d6637e04..ae1a73f3 100644 --- a/lms/CHANGELOG.md +++ b/lms/CHANGELOG.md @@ -1,5 +1,10 @@ # Changelog + All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## 0.0.1 (2024-04-16) + +- Initial release diff --git a/lms/Cargo.toml b/lms/Cargo.toml index c0ff68b4..33012a7d 100644 --- a/lms/Cargo.toml +++ b/lms/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "lms-signature" -version = "0.0.0" +version = "0.0.1" edition = "2021" license = "Apache-2.0 OR MIT" repository = "https://github.com/RustCrypto/signatures/tree/master/lms" @@ -9,8 +9,6 @@ rust-version = "1.73" categories = ["cryptography"] keywords = ["crypto", "signature"] -# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html - [lib] name = "lms" path = "src/lib.rs" @@ -18,7 +16,7 @@ edition = "2021" [dependencies] digest = "0.10.7" -generic-array = {version = "0.14.4", features = ["zeroize"]} +generic-array = { version = "0.14.4", features = ["zeroize"] } rand = "0.8.5" sha2 = "0.10.8" static_assertions = "1.1.0" diff --git a/lms/README.md b/lms/README.md index 721ecfb1..60ddbe5d 100644 --- a/lms/README.md +++ b/lms/README.md @@ -1,4 +1,11 @@ -# Leighton-Micali Hash-Based Signatures +# [RustCrypto]: Leighton-Micali Signatures + +[![crate][crate-image]][crate-link] +[![Docs][docs-image]][docs-link] +[![Build Status][build-image]][build-link] +![Apache2/MIT licensed][license-image] +![MSRV][rustc-image] +[![Project Chat][chat-image]][chat-link] This repository contains implementations of [Leighton-Micali Hash-Based Signatures (RFC 8554)](https://datatracker.ietf.org/doc/html/rfc8554). @@ -17,10 +24,9 @@ persistent storage after each signature is generated and before it is released to the rest of the application. Failure to adhere to this requirement is a security vulnerability in your application. -For a stateless hash-based signature algorithm, see -[SPHINCS+](https://sphincs.org). +For a stateless hash-based signature algorithm, see [SLH-DSA]. -NOTE: this project has not been externally audited, but the entire codebase +NOTE: this project has not been externally audited, but the entire codebase was internally reviewed by cryptographers at Trail of Bits. ## Installation @@ -35,10 +41,10 @@ Our implementation uses strongly typed private and public key types. ```rust let mut rng = thread_rng(); -let mut seckey = lms::lms::PrivateKey::new::>(&mut rng); +let mut seckey = lms::lms::PrivateKey::new:: > ( & mut rng); let pubkey = seckey.public(); // of type lms::lms::PublicKey -let sig = seckey.try_sign_with_rng(&mut rng, "example".as_bytes()).unwrap(); -let sig_valid = pubkey.verify("example".as_bytes(), &sig).is_ok(); +let sig = seckey.try_sign_with_rng( & mut rng, "example".as_bytes()).unwrap(); +let sig_valid = pubkey.verify("example".as_bytes(), & sig).is_ok(); ``` We can generate LMOTS signatures in the same way using `lms::ots::PrivateKey` @@ -58,8 +64,8 @@ good**. All crates licensed under either of - * [Apache License, Version 2.0](http://www.apache.org/licenses/LICENSE-2.0) - * [MIT license](http://opensource.org/licenses/MIT) +* [Apache License, Version 2.0](http://www.apache.org/licenses/LICENSE-2.0) +* [MIT license](http://opensource.org/licenses/MIT) at your option. @@ -67,4 +73,22 @@ at your option. Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be -dual licensed as above, without any additional terms or conditions. \ No newline at end of file +dual licensed as above, without any additional terms or conditions. + +[//]: # (badges) + +[crate-image]: https://buildstats.info/crate/lms-signature +[crate-link]: https://crates.io/crates/lms-signature +[docs-image]: https://docs.rs/lms-signature/badge.svg +[docs-link]: https://docs.rs/lms-signature/ +[build-image]: https://github.com/RustCrypto/signatures/actions/workflows/lms.yml/badge.svg +[build-link]: https://github.com/RustCrypto/signatures/actions/workflows/lms.yml +[license-image]: https://img.shields.io/badge/license-Apache2.0/MIT-blue.svg +[rustc-image]: https://img.shields.io/badge/rustc-1.73+-blue.svg +[chat-image]: https://img.shields.io/badge/zulip-join_chat-blue.svg +[chat-link]: https://rustcrypto.zulipchat.com/#narrow/stream/260048-signatures + +[//]: # (links) + +[RustCrypto]: https://github.com/RustCrypto +[SLH-DSA]: https://github.com/RustCrypto/signatures/tree/master/slh-dsa