Module rainbow 

Rainbow — Jintai Ding & Dieter Schmidt’s multilayer Oil-and-Vinegar signature (ACNS 2005), the multivariate scheme our XL engine is built to attack. This is a faithful reference over GF(2^8): a two-layer central map F, invertible affine transforms S and T, public key P = S ∘ F ∘ T, and the Oil-and-Vinegar trapdoor that inverts F at signing time.

The public map is produced as xl::Poly<Gf256> per output, so forge_system hands it straight to crate::xl::xl_solve — the algebraic cryptanalysis Ding formalized through the degree of regularity — closing the build-and-break loop on one substrate. All finite-field linear algebra reuses the exhaustively-verified logicaffeine_base::gf256.

Field note: this reference works over the logicaffeine_base::gf256 field (reduction polynomial 0x11d). The NIST submission fixes its own GF(256) tower representation; matching that byte-for-byte is the separate bit-exact-vs-KAT effort.

Structs

KeygenInputs

Inputs for the LOGOS rainbowKeygen (the public-map composition P = S∘F∘T): the FORWARD affine maps T/S (recovered by inverting the stored inverses) and the central map, all row-major / packed like flatten_public.

PublicKey

RainbowParams

Rainbow layer sizes: v1 vinegars, then o1 first-layer oils, then o2 second-layer oils.

SecretFlat

The secret key flattened for the LOGOS rainbowSign: the central map in the same per-output layout as flatten_public, plus the affine inverses S⁻¹ / T⁻¹ (row-major) and their shifts.

SecretKey

Functions

flatten_keygen

flatten_public

Flatten the public key into three byte arrays for a coefficient-driven verifier: pubq holds the upper-triangular quadratic coefficients per output (order i ≤ j), publin the linear coefficients, pubc the constants. This is the exact layout the LOGOS rainbowVerify consumes.

flatten_secret

forge_system

The MQ system a forger must solve — P_k(x) − d_k = 0 for every output — handed straight to crate::xl::xl_solve. A solution is a signature forgery produced with NO secret key.

keygen

sign

Sign a message hash (m field elements). Returns the signature x ∈ GF(256)^n, or None if the Oil-and-Vinegar inversion kept hitting singular systems (astronomically unlikely).

sign_with_vinegars

Sign with the v1 vinegar values supplied explicitly (deterministic; None if they make a layer’s linear system singular). This is the exact core the LOGOS rainbowSign mirrors.

verify

Verify a signature: evaluate every public polynomial at x and compare to the message hash.