PQC: FrodoKEM

doc/api_ref/pubkey.rst

@@ -97,7 +97,7 @@ Post-quantum secure signature scheme based on lattice problems.
 Kyber
 ~~~~~~~~~~~
 
-Post-quantum key encapsulation scheme based on lattices.
+Post-quantum key encapsulation scheme based on (structured) lattices.
 
 .. note::
 
@@ -131,6 +131,11 @@ security of a hash function. Unlike XMSS, it is a stateless signature
 scheme, meaning that the private key does not change with each signature. It
 has high security but very long signatures and high runtime.
 
+FrodoKEM
+~~~~~~~~
+
+A post-quantum secure key encapsulation scheme based on (unstructured) lattices.
+
 McEliece
 ~~~~~~~~~~
 
@@ -1121,6 +1126,7 @@ Botan implements the following KEM schemes:
 
 1. RSA
 #. Kyber
+#. FrodoKEM
 #. McEliece
 
 .. _kyber_example:

doc/dev_ref/oids.rst

@@ -15,6 +15,24 @@ Values currently assigned are::
   -- { publicKey 5 } previously used for XMSS draft 6
   gost-3410-with-sha256 OBJECT IDENTIFIER ::= { publicKey 6 1 }
 
+  frodokem-shake  OBJECT IDENTIFIER ::= { publicKey 14 }
+  efrodokem-shake OBJECT IDENTIFIER ::= { publicKey 16 }
+  frodokem-aes    OBJECT IDENTIFIER ::= { publicKey 15 }
+  efrodokem-aes   OBJECT IDENTIFIER ::= { publicKey 17 }
+
+  frodokem-640-shake   OBJECT_IDENTIFIER : { frodokem-shake  1  }
+  frodokem-976-shake   OBJECT_IDENTIFIER : { frodokem-shake  2  }
+  frodokem-1344-shake  OBJECT_IDENTIFIER : { frodokem-shake  3  }
+  frodokem-640-aes     OBJECT_IDENTIFIER : { frodokem-aes    1  }
+  frodokem-976-aes     OBJECT_IDENTIFIER : { frodokem-aes    2  }
+  frodokem-1344-aes    OBJECT_IDENTIFIER : { frodokem-aes    3  }
+  efrodokem-640-shake  OBJECT_IDENTIFIER : { efrodokem-shake 1  }
+  efrodokem-976-shake  OBJECT_IDENTIFIER : { efrodokem-shake 2  }
+  efrodokem-1344-shake OBJECT_IDENTIFIER : { efrodokem-shake 3  }
+  efrodokem-640-aes    OBJECT_IDENTIFIER : { efrodokem-aes   1  }
+  efrodokem-976-aes    OBJECT_IDENTIFIER : { efrodokem-aes   2  }
+  efrodokem-1344-aes   OBJECT_IDENTIFIER : { efrodokem-aes   3  }
+
   kyber       OBJECT IDENTIFIER ::= { publicKey 7 }
   kyber-90s   OBJECT IDENTIFIER ::= { publicKey 11 }
 

src/build-data/oids.txt

@@ -1,5 +1,5 @@
-# Regenerate with ./src/scripts/oids.py oids > src/lib/asn1/oid_maps.cpp
-# AND             ./src/scripts/oids.py dn_ub > src/lib/x509/x509_dn_ub.cpp
+# Regenerate with ./src/scripts/dev_tools/oids.py oids > src/lib/asn1/oid_maps.cpp
+# AND             ./src/scripts/dev_tools/oids.py dn_ub > src/lib/x509/x509_dn_ub.cpp
 # (if you modified something under [dn]
 
 # Public key types
@@ -13,6 +13,20 @@
 1.3.101.110 = Curve25519
 1.3.101.112 = Ed25519
 
+# FrodoKEM OIDs are currently in Botan's private arc
+1.3.6.1.4.1.25258.1.14.1 = FrodoKEM-640-SHAKE
+1.3.6.1.4.1.25258.1.14.2 = FrodoKEM-976-SHAKE
+1.3.6.1.4.1.25258.1.14.3 = FrodoKEM-1344-SHAKE
+1.3.6.1.4.1.25258.1.15.1 = FrodoKEM-640-AES
+1.3.6.1.4.1.25258.1.15.2 = FrodoKEM-976-AES
+1.3.6.1.4.1.25258.1.15.3 = FrodoKEM-1344-AES
+1.3.6.1.4.1.25258.1.16.1 = eFrodoKEM-640-SHAKE
+1.3.6.1.4.1.25258.1.16.2 = eFrodoKEM-976-SHAKE
+1.3.6.1.4.1.25258.1.16.3 = eFrodoKEM-1344-SHAKE
+1.3.6.1.4.1.25258.1.17.1 = eFrodoKEM-640-AES
+1.3.6.1.4.1.25258.1.17.2 = eFrodoKEM-976-AES
+1.3.6.1.4.1.25258.1.17.3 = eFrodoKEM-1344-AES
+
 # Kyber OIDs are currently in Botan's private arc
 1.3.6.1.4.1.25258.1.7.1 = Kyber-512-r3
 1.3.6.1.4.1.25258.1.7.2 = Kyber-768-r3

src/cli/speed.cpp

@@ -128,6 +128,10 @@
    #include <botan/sphincsplus.h>
 #endif
 
+#if defined(BOTAN_HAS_FRODOKEM)
+   #include <botan/frodokem.h>
+#endif
+
 #if defined(BOTAN_HAS_ECDSA)
    #include <botan/ecdsa.h>
 #endif
@@ -404,7 +408,8 @@ class Speed final : public Command {
             "Curve25519",
             "McEliece",
             "Kyber",
-            "SPHINCS+"
+            "SPHINCS+",
+            "FrodoKEM"
          };
          // clang-format on
       }
@@ -614,6 +619,11 @@ class Speed final : public Command {
                bench_sphincs_plus(provider, msec);
             }
 #endif
+#if defined(BOTAN_HAS_FRODOKEM)
+            else if(algo == "FrodoKEM") {
+               bench_frodokem(provider, msec);
+            }
+#endif
 #if defined(BOTAN_HAS_SCRYPT)
             else if(algo == "scrypt") {
                bench_scrypt(provider, msec);
@@ -2037,6 +2047,41 @@ class Speed final : public Command {
       }
 #endif
 
+#if defined(BOTAN_HAS_FRODOKEM)
+      void bench_frodokem(const std::string& provider, std::chrono::milliseconds msec) {
+         std::vector<Botan::FrodoKEMMode> frodo_modes{
+            Botan::FrodoKEMMode::FrodoKEM640_SHAKE,
+            Botan::FrodoKEMMode::FrodoKEM976_SHAKE,
+            Botan::FrodoKEMMode::FrodoKEM1344_SHAKE,
+            Botan::FrodoKEMMode::eFrodoKEM640_SHAKE,
+            Botan::FrodoKEMMode::eFrodoKEM976_SHAKE,
+            Botan::FrodoKEMMode::eFrodoKEM1344_SHAKE,
+            Botan::FrodoKEMMode::FrodoKEM640_AES,
+            Botan::FrodoKEMMode::FrodoKEM976_AES,
+            Botan::FrodoKEMMode::FrodoKEM1344_AES,
+            Botan::FrodoKEMMode::eFrodoKEM640_AES,
+            Botan::FrodoKEMMode::eFrodoKEM976_AES,
+            Botan::FrodoKEMMode::eFrodoKEM1344_AES,
+         };
+
+         for(auto modet : frodo_modes) {
+            if(!modet.is_available()) {
+               continue;
+            }
+
+            Botan::FrodoKEMMode mode(modet);
+
+            auto keygen_timer = make_timer(mode.to_string(), provider, "keygen");
+
+            auto key = keygen_timer->run([&] { return Botan::FrodoKEM_PrivateKey(rng(), mode); });
+
+            record_result(keygen_timer);
+
+            bench_pk_kem(key, mode.to_string(), provider, "KDF2(SHA-256)", msec);
+         }
+      }
+#endif
+
 #if defined(BOTAN_HAS_XMSS_RFC8391)
       void bench_xmss(const std::string& provider, std::chrono::milliseconds msec) {
          /*

src/lib/asn1/oid_maps.cpp

@@ -1,7 +1,7 @@
 /*
 * OID maps
 *
-* This file was automatically generated by src/scripts/dev_tools/gen_oids.py on 2023-05-30
+* This file was automatically generated by ./src/scripts/dev_tools/gen_oids.py on 2023-11-02
 *
 * All manual edits to this file will be lost. Edit the script
 * then regenerate this source file.
@@ -162,6 +162,18 @@ std::unordered_map<std::string, std::string> OID_Map::load_oid2str_map() {
       {"1.3.6.1.4.1.25258.1.12.3.4", "SphincsPlus-haraka-192f-r3.1"},
       {"1.3.6.1.4.1.25258.1.12.3.5", "SphincsPlus-haraka-256s-r3.1"},
       {"1.3.6.1.4.1.25258.1.12.3.6", "SphincsPlus-haraka-256f-r3.1"},
+      {"1.3.6.1.4.1.25258.1.14.1", "FrodoKEM-640-SHAKE"},
+      {"1.3.6.1.4.1.25258.1.14.2", "FrodoKEM-976-SHAKE"},
+      {"1.3.6.1.4.1.25258.1.14.3", "FrodoKEM-1344-SHAKE"},
+      {"1.3.6.1.4.1.25258.1.15.1", "FrodoKEM-640-AES"},
+      {"1.3.6.1.4.1.25258.1.15.2", "FrodoKEM-976-AES"},
+      {"1.3.6.1.4.1.25258.1.15.3", "FrodoKEM-1344-AES"},
+      {"1.3.6.1.4.1.25258.1.16.1", "eFrodoKEM-640-SHAKE"},
+      {"1.3.6.1.4.1.25258.1.16.2", "eFrodoKEM-976-SHAKE"},
+      {"1.3.6.1.4.1.25258.1.16.3", "eFrodoKEM-1344-SHAKE"},
+      {"1.3.6.1.4.1.25258.1.17.1", "eFrodoKEM-640-AES"},
+      {"1.3.6.1.4.1.25258.1.17.2", "eFrodoKEM-976-AES"},
+      {"1.3.6.1.4.1.25258.1.17.3", "eFrodoKEM-1344-AES"},
       {"1.3.6.1.4.1.25258.1.3", "McEliece"},
       {"1.3.6.1.4.1.25258.1.5", "XMSS-draft6"},
       {"1.3.6.1.4.1.25258.1.6.1", "GOST-34.10-2012-256/SHA-256"},
@@ -367,6 +379,12 @@ std::unordered_map<std::string, OID> OID_Map::load_str2oid_map() {
       {"ECKCDSA/SHA-256", OID({1, 2, 410, 200004, 1, 100, 4, 5})},
       {"Ed25519", OID({1, 3, 101, 112})},
       {"ElGamal", OID({1, 3, 6, 1, 4, 1, 3029, 1, 2, 1})},
+      {"FrodoKEM-1344-AES", OID({1, 3, 6, 1, 4, 1, 25258, 1, 15, 3})},
+      {"FrodoKEM-1344-SHAKE", OID({1, 3, 6, 1, 4, 1, 25258, 1, 14, 3})},
+      {"FrodoKEM-640-AES", OID({1, 3, 6, 1, 4, 1, 25258, 1, 15, 1})},
+      {"FrodoKEM-640-SHAKE", OID({1, 3, 6, 1, 4, 1, 25258, 1, 14, 1})},
+      {"FrodoKEM-976-AES", OID({1, 3, 6, 1, 4, 1, 25258, 1, 15, 2})},
+      {"FrodoKEM-976-SHAKE", OID({1, 3, 6, 1, 4, 1, 25258, 1, 14, 2})},
       {"GOST-34.10", OID({1, 2, 643, 2, 2, 19})},
       {"GOST-34.10-2012-256", OID({1, 2, 643, 7, 1, 1, 1, 1})},
       {"GOST-34.10-2012-256/SHA-256", OID({1, 3, 6, 1, 4, 1, 25258, 1, 6, 1})},
@@ -540,6 +558,12 @@ std::unordered_map<std::string, OID> OID_Map::load_str2oid_map() {
       {"brainpool320r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 9})},
       {"brainpool384r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 11})},
       {"brainpool512r1", OID({1, 3, 36, 3, 3, 2, 8, 1, 1, 13})},
+      {"eFrodoKEM-1344-AES", OID({1, 3, 6, 1, 4, 1, 25258, 1, 17, 3})},
+      {"eFrodoKEM-1344-SHAKE", OID({1, 3, 6, 1, 4, 1, 25258, 1, 16, 3})},
+      {"eFrodoKEM-640-AES", OID({1, 3, 6, 1, 4, 1, 25258, 1, 17, 1})},
+      {"eFrodoKEM-640-SHAKE", OID({1, 3, 6, 1, 4, 1, 25258, 1, 16, 1})},
+      {"eFrodoKEM-976-AES", OID({1, 3, 6, 1, 4, 1, 25258, 1, 17, 2})},
+      {"eFrodoKEM-976-SHAKE", OID({1, 3, 6, 1, 4, 1, 25258, 1, 16, 2})},
       {"frp256v1", OID({1, 2, 250, 1, 223, 101, 256, 1})},
       {"gost_256A", OID({1, 2, 643, 7, 1, 2, 1, 1, 1})},
       {"gost_256B", OID({1, 2, 643, 7, 1, 2, 1, 1, 2})},

src/lib/pubkey/frodokem/frodokem/frodo_shake_generator.h

@@ -0,0 +1,40 @@
+/*
+ * FrodoKEM matrix generator based on SHAKE
+ *
+ * The Fellowship of the FrodoKEM:
+ * (C) 2023 Jack Lloyd
+ *     2023 René Meusel, Amos Treiber - Rohde & Schwarz Cybersecurity
+ *
+ * Botan is released under the Simplified BSD License (see license.txt)
+ */
+
+#ifndef BOTAN_FRODOKEM_SHAKE_GENERATOR_H_
+#define BOTAN_FRODOKEM_SHAKE_GENERATOR_H_
+
+#include <botan/internal/frodo_constants.h>
+#include <botan/internal/frodo_types.h>
+#include <botan/internal/loadstor.h>
+#include <botan/internal/shake_xof.h>
+
+#include <span>
+
+namespace Botan {
+
+inline auto create_shake_row_generator(const FrodoKEMConstants& constants, StrongSpan<const FrodoSeedA> seed_a) {
+   BOTAN_ASSERT_NOMSG(constants.mode().is_shake());
+
+   return [xof = SHAKE_128_XOF(), a = FrodoSeedA(seed_a)](std::span<uint8_t> out, uint16_t i) mutable {
+      xof.clear();
+      // TODO: update that once #3707 is merged
+      //       potentially add a new method: std::array<uint8_t, XX> as_le(uintXX_t)
+      std::array<uint8_t, 2> le;
+      store_le(i, le.data());
+      xof.update(le);
+      xof.update(a);
+      xof.output(out);
+   };
+}
+
+}  // namespace Botan
+
+#endif

src/lib/pubkey/frodokem/frodokem/info.txt

@@ -0,0 +1,12 @@
+<defines>
+FRODOKEM_SHAKE -> 20231114
+</defines>
+
+<module_info>
+name -> "FrodoKEM"
+</module_info>
+
+<requires>
+shake_xof
+frodokem_common
+</requires>

src/lib/pubkey/frodokem/frodokem_aes/frodo_aes_generator.h

@@ -0,0 +1,56 @@
+/*
+ * FrodoKEM matrix generator based on AES
+ *
+ * The Fellowship of the FrodoKEM:
+ * (C) 2023 Jack Lloyd
+ *     2023 René Meusel, Amos Treiber - Rohde & Schwarz Cybersecurity
+ *
+ * Botan is released under the Simplified BSD License (see license.txt)
+ */
+
+#ifndef BOTAN_FRODOKEM_AES_GENERATOR_H_
+#define BOTAN_FRODOKEM_AES_GENERATOR_H_
+
+#include <botan/internal/aes.h>
+#include <botan/internal/frodo_constants.h>
+#include <botan/internal/frodo_types.h>
+#include <botan/internal/loadstor.h>
+#include <botan/internal/stl_util.h>
+
+#include <functional>
+#include <span>
+
+namespace Botan {
+
+inline auto create_aes_row_generator(const FrodoKEMConstants& constants, StrongSpan<const FrodoSeedA> seed_a) {
+   BOTAN_ASSERT_NOMSG(constants.mode().is_aes());
+
+   auto setup_aes = [](StrongSpan<const FrodoSeedA> seed) {
+      AES_128 aes;
+      aes.set_key(seed);
+      return aes;
+   };
+
+   return [n = constants.n(), aes = setup_aes(seed_a)](std::span<uint8_t> out, uint16_t i) {
+      BufferStuffer out_bs(out);
+
+      for(size_t j = 0; j < n; j += 8) {
+         // set up the to-be-encrypted 'b' value in the out variable
+         // for in-place encryption of the block cipher
+         auto out_coefs = out_bs.next(aes.block_size());
+
+         // b = i || j || 0000...
+         store_le(static_cast<uint16_t>(i), out_coefs.data());
+         store_le(static_cast<uint16_t>(j), out_coefs.data() + sizeof(uint16_t));
+         for(size_t ii = 4; ii < out_coefs.size(); ++ii) {
+            out_coefs[ii] = 0;
+         }
+
+         aes.encrypt(out_coefs);
+      }
+   };
+}
+
+}  // namespace Botan
+
+#endif

src/lib/pubkey/frodokem/frodokem_aes/info.txt

@@ -0,0 +1,12 @@
+<defines>
+FRODOKEM_AES -> 20231103
+</defines>
+
+<module_info>
+name -> "FrodoKEM (AES)"
+</module_info>
+
+<requires>
+aes
+frodokem_common
+</requires>