Add crypto callbacks for LMS and XMSS by padelsbach · Pull Request #10380 · wolfSSL/wolfssl

padelsbach · 2026-05-01T21:40:27Z

Description

Add struct fields and callbacks (MakeKey, Sign, Verify and SigsLeft) into existing LMS and XMSS code. Add wc_LmsKey_InitId and _InitLabel for PKCS11 compat. Added unit tests.

Testing

New unit tests

Checklist

added tests
updated/added doxygen
updated appropriate READMEs
Updated manual and documentation

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #10380

Scan targets checked: wolfcrypt-bugs, wolfcrypt-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot · 2026-05-01T21:51:25Z

+    switch (key->params->hash) {
+    #ifdef WC_XMSS_SHA256
+        case WC_HASH_TYPE_SHA256:
+            ret = wc_Hash(WC_HASH_TYPE_SHA256, msg, msgSz, hash, needSz);


🟠 [Medium] wc_XmssKey_HashMsg breaks for XMSS-SHA2_*_192 (SHA-256 truncated) · Logic errors

For XMSS-SHA2_*_192 variants params->n is 24 while params->hash is WC_HASH_TYPE_SHA256. wc_Hash rejects hash_len < 32 with BUFFER_E, so the helper always fails for the 192-bit profiles. The LMS counterpart hashes into a 32-byte stack buffer and copies needSz bytes; the XMSS path skips that step.

Fix: Hash into a WC_SHA256_DIGEST_SIZE stack buffer and XMEMCPY(hash, full, needSz), mirroring the LMS_SHA256_192 path.

github-actions · 2026-05-04T18:58:59Z

MemBrowse Memory Report

No memory changes detected for:

padelsbach · 2026-05-05T15:52:52Z

jenkins retest this please

Frauschi

A lot of minor things, mainly as the WiP patch I sent you was in a very rough state tbh (sorry for that).

Frauschi · 2026-05-05T13:24:49Z

I think we can remove this file. I only added it to the patch I originally sent you as a reference and easy starting point.

Frauschi · 2026-05-05T13:26:37Z

+            struct {
+                /* Raw message. Backends following the PKCS#11 v3.2
+                 * CKM_HSS / CKM_XMSS convention of operating on a
+                 * pre-computed digest can call wc_LmsKey_HashMsg /


Nit, but I'm unsure if we want to have a specific PKCS#11 reference here.

Frauschi · 2026-05-05T13:27:16Z

+WOLFSSL_LOCAL int wc_CryptoCb_PqcStatefulSigKeyGen(int type, void* key,
+    WC_RNG* rng);
+/* The raw message is forwarded to the callback. Backends that follow the
+ * PKCS#11 v3.2 CKM_HSS / CKM_XMSS convention (digest input) can call


Same as above regarding the mention of PKCS#11 V3.2

Frauschi · 2026-05-05T13:32:18Z

+ *          small for the digest.
+ * @return  NOT_COMPILED_IN when the param set's hash family is disabled.
+ */
+int wc_LmsKey_HashMsg(const LmsKey* key, const byte* msg, word32 msgSz,


Should we move this method further down in the file to where the other public API methods are located? At the top of the file, only static internal functions are placed otherwise.

Frauschi · 2026-05-05T13:36:41Z

+    if (*hashSz < needSz)
+        return BAD_FUNC_ARG;
+
+    switch (key->params->lmsType & 0xF000) {


Use LMS_HASH_MASK instead of the magic 0xF000 literal.

Frauschi · 2026-05-05T16:00:28Z

-        WOLFSSL_MSG("error: XmssKey context is not set");
-        ret = BAD_FUNC_ARG;
-    }
+    /* Callback context is opaque; NULL is allowed. */


Unnecessary comment.

Frauschi · 2026-05-05T16:02:22Z

+            WC_PQC_STATEFUL_SIG_TYPE_XMSS, key, &sigsLeft);
+        if (cbRet == 0) {
+            /* Clamp to int range; callers treat 0 as "exhausted". */
+            return (sigsLeft > (word32)0x7FFFFFFF)


Similar to LMS, we only return 1 or 0 here, not the actual amount of signatures left.

Frauschi · 2026-05-05T16:03:13Z

    if ((key == NULL) || (sig == NULL) || (m == NULL)) {
        ret = BAD_FUNC_ARG;
    }
+    if ((ret == 0) && (mLen <= 0)) {


Similar to LMS, should we allow mLen == 0 for verify? Not prohibited by the spec.

allowed len of 0

Frauschi · 2026-05-05T16:05:35Z

-        WOLFSSL_MSG("error: LmsKey context is not set");
-        ret = BAD_FUNC_ARG;
-    }
+    /* Callback context is opaque to wolfCrypt and may legitimately be NULL


Comment is unnecessary I think.

Frauschi · 2026-05-05T16:07:07Z

    const byte* msg, int msgSz);
+/* Compute the digest of a message with the hash function dictated by the
+ * XMSS parameter set. Useful for crypto-callback / HSM backends that follow
+ * the PKCS#11 v3.2 CKM_XMSS / CKM_XMSSMT convention of taking a


Again, I would remove/weaken the PKCS#11 reference here and be more general.

padelsbach · 2026-05-05T21:41:09Z

jenkins retest this please

padelsbach requested a review from wolfSSL-Fenrir-bot May 1, 2026 21:40

wolfSSL-Fenrir-bot reviewed May 1, 2026

View reviewed changes

padelsbach force-pushed the lms-xmss branch 3 times, most recently from 49f1cc2 to 6673edd Compare May 4, 2026 17:47

padelsbach mentioned this pull request May 4, 2026

Add support for LMS and XMSS wolfSSL/wolfHSM#352

Draft

padelsbach force-pushed the lms-xmss branch from 6673edd to 428e6f5 Compare May 4, 2026 21:43

dgarske assigned padelsbach May 4, 2026

padelsbach marked this pull request as ready for review May 4, 2026 21:49

padelsbach assigned wolfSSL-Bot and unassigned padelsbach May 4, 2026

Frauschi requested changes May 5, 2026

View reviewed changes

Frauschi assigned padelsbach and unassigned wolfSSL-Bot May 5, 2026

padelsbach added 2 commits May 5, 2026 13:46

Add crypto callbacks for LMS and XMSS

b9eb7c1

Address PR comments

7906e67

padelsbach force-pushed the lms-xmss branch from a0407a6 to 7906e67 Compare May 5, 2026 20:47

Conversation

padelsbach commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Testing

Checklist

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #10380

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report

Uh oh!

padelsbach commented May 5, 2026

Uh oh!

Frauschi left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

padelsbach commented May 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

padelsbach commented May 1, 2026 •

edited

Loading

github-actions Bot commented May 4, 2026 •

edited

Loading