slh-dsa: implement changes from FIP 205 Initial Public Draft -> FIPS 205 Final

[tjade273]

Addresses #843

• Implement new context string handling for "pure" algorithms
• Change existing KAT to use deterministic *_internal functions specified in the new standard
• Known-answer tests for top-level signatures with context (not sure these exist yet)
• End-to-end tests for signatures with non-empty context
• Implement new pre-hash variants (using DigestSigner)
• Integrate NIST CVP KATs

[tjade273]

AFAICT there are no published KATs for the full end-to-end signature (with a context string). I'm not too worried about that, it's a very simple spec change.

I'm going to hold off on the pre-hash DigestSigner implementation for a separate feature. The requirement to include the hash OID in the context makes integrating arbitrary digests a pain. I don't expect pre-hash to have much demand right now anyway.

[tjade273]

@tarcieri This is ready for review. I'll open a new issue for supporting the pre-hash variant, but now at least the normal variant that 99% of users need matches the final spec.

[tarcieri]

The requirement to include the hash OID in the context makes integrating arbitrary digests a pain.

You can use the AssociatedOid trait, namely AssociatedOid + Digest.

See this for an example: https://docs.rs/rsa/latest/rsa/pkcs1v15/struct.SigningKey.html

[tarcieri]

Updated test vectors are available here:

• https://github.com/usnistgov/ACVP-Server/tree/master/gen-val/json-files/SLH-DSA-keyGen-FIPS205
• https://github.com/usnistgov/ACVP-Server/tree/master/gen-val/json-files/SLH-DSA-sigGen-FIPS205
• https://github.com/usnistgov/ACVP-Server/tree/master/gen-val/json-files/SLH-DSA-sigVer-FIPS205

[tjade273]

You can use the AssociatedOid trait, namely AssociatedOid + Digest.

Thanks! Saves me from having to implement the consts myself...

I started working on the Oid/DigestSigner feature but have to go through and update various things to the newest pre-release versions to match the pre-release digest crate used by signature.

[tjade273]

Updated test vectors are available here:

Yep, already incorporated!

https://github.com/RustCrypto/signatures/pull/844/files#diff-bcecd5d27d356a81e18400b7905fdc36196cc3e0de024579b21b5dea7aa808fd