playing around with hash-based signatures

hash-signatures.js

const bitwise = require('bitwise')
const bignum  = require('bignum')
const crypto  = require('crypto')


function hash(buf) {
  var hash = crypto.createHash('sha256')
  hash.update(buf)
  return hash.digest()
}

function sign(sk0, sk1, msg) {
  var bits = bitwise.buffer.read(msg)
  var sig = new Array(bits.length)

  for (var i = 0; i < bits.length; i++) {
    if (bits[i] === 0) {
      sig[i] = sk0[i]
    } else {
      sig[i] = sk1[i]
    }
  }

  return sig.reduce((acc, buf) => Buffer.concat([acc, buf]), Buffer.alloc(0))
}

function verify(pk0, pk1, sig, msg) {
  var bits = bitwise.buffer.read(msg)

  for (var i = 0; i < bits.length; i++) {
    var sk_i = sig.slice(i * 32, (i * 32) + 32)
    var pk_i = hash(sk_i)

    if (bits[i] === 0 && pk_i.compare(pk0[i]) !== 0) {
      return false
    } else if (bits[i] === 1 && pk_i.compare(pk1[i]) !== 0) {
      return false
    }
  }

  return true
}

var sk0 = new Array(256).fill(0).map(() => crypto.randomBytes(32))
var sk1 = new Array(256).fill(0).map(() => crypto.randomBytes(32))

var pk0 = sk0.map(sk0i => hash(sk0i))
var pk1 = sk1.map(sk1i => hash(sk1i))

var msg = crypto.randomBytes(32)
var sig = sign(sk0, sk1, msg)

console.log('verified ->', verify(pk0, pk1, sig, msg)) // verified -> true
sig[0] ^= sig[0]
console.log('verified ->', verify(pk0, pk1, sig, msg)) // verified -> false