Decode FORS indices similarly to WOTS

[bwesterb]

As proposed by NIST's David Cooper:

https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/88tuvtb7nN4/m/DA1QCoJWBAAJ

[sfluhrer]

Looks good to me

[sfluhrer]

Oops, David Cooper is right; this does flip the bit order for each leaf. What we want is:

indices[i] ^= ((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j);

[bwesterb]

Indeed, whoops. Generating new test vectors now ...

[bwesterb]

Done.

[sfluhrer]

Now it looks good

[mberry]

Is there a timeline for this getting merged? It's a breaking change so perhaps should come with some forewarning?

[bwesterb]

Is there a timeline for this getting merged? It's a breaking change so perhaps should come with some forewarning?

SPHINCS+ (or SLH-DSA as it will be called by NIST) is not finalised, and could very well see even more changes. If you want to adopt early, you should fix on a specific commit (and keep track for bug fixes.) I'm sorry, this is annoying for early adopters, but that's the risk of adopting early.

[mberry]

It's all good, was simply wondering about how the rollout would happen.

Codewise the change is trivial, it is more the versioning and nomenclature around this change.

[bwesterb]

Rebased on master.

[bwesterb]

Rebased to include fix of #59. /cc @kste