1
$\begingroup$

I am trying to follow the RFC instructions but am not sure if I understand it. In the RFC there are also some test cases given, although my implementation yields different results.

Test Cases: https://www.rfc-editor.org/rfc/rfc8554#appendix-E

How is the SEED for private key generation used? It is stated, that LMOTS private key generation creates a 32B SEED at the start of the process, although does it create a new SEED for every new key from 0 to q=2^h-1?

The I value seems to be a constant 16B value generated only once for a given keypair.

In the test case 2, for

I=d08fabd4a2091ff0a8cb4ed834e74534

SEED=558b8966c48ae9cb898b423c83443aae 014a72f1b1ab5cc85cf1d892903b5439

the resulting public key is

K= 32a58885cd9ba0431235466bff9651c6 c92124404d45fa53cf161c28f1ad5a8e

although it is not stated for what q the LMOTS public key is generated, or does it mean, that this public key is the LMS public key, which is the root of the tree created by leaves of LMOTS public keys K? In this case this "K" is the "T[1]" value?

I have a slight problem using the reference implementation, as it is created for HSS. Do you know how can I force it to use only LMS?

$\endgroup$

1 Answer 1

1
$\begingroup$

It is stated, that LMOTS private key generation creates a 32B SEED at the start of the process, although does it create a new SEED for every new key from 0 to q=2^h-1?

If you use the suggested key generation method found in Appendix A, you use the same seed value for each Merkle tree. If you use multiple Merkle trees (in HSS with L>1), then each tree gets its own SEED value

although it is not stated for what q the LMOTS public key is generated, or does it mean, that this public key is the LMS public key, which is the root of the tree created by leaves of LMOTS public keys K?

It is the HSS public key, which is the LMS public key of the top level Merkle tree.

I have a slight problem using the reference implementation, as it is created for HSS. Do you know how can I force it to use only LMS?

Tell it to use L=1; that is, when you call hss_generate_private_key, pass it a 1 as the levels parameter (the second one).

$\endgroup$
1
  • $\begingroup$ is it possible to get the same values as in test case 2 using only algorithms from RFC? I tried to do it for the above mentioned I and SEED but I get different values for my LMOTS signature, I am trying to test my implementation and compare the results but I have trouble passing the SEED parameter in lm_ots_generate_signature() function. When I pass the 32B SEED from the test case, it doesnt compile. Do you know how can I test priv/pub key or signature generations inserting my own constant values? $\endgroup$
    – namaewa
    Mar 6, 2021 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.