Implementation of Leighton-Micali Hash-Based Signatures

Question

I am trying to follow the RFC instructions but am not sure if I understand it. In the RFC there are also some test cases given, although my implementation yields different results.

Test Cases: https://www.rfc-editor.org/rfc/rfc8554#appendix-E

How is the SEED for private key generation used? It is stated, that LMOTS private key generation creates a 32B SEED at the start of the process, although does it create a new SEED for every new key from 0 to q=2^h-1?

The I value seems to be a constant 16B value generated only once for a given keypair.

In the test case 2, for

I=d08fabd4a2091ff0a8cb4ed834e74534

SEED=558b8966c48ae9cb898b423c83443aae 014a72f1b1ab5cc85cf1d892903b5439

the resulting public key is

K= 32a58885cd9ba0431235466bff9651c6 c92124404d45fa53cf161c28f1ad5a8e

although it is not stated for what q the LMOTS public key is generated, or does it mean, that this public key is the LMS public key, which is the root of the tree created by leaves of LMOTS public keys K? In this case this "K" is the "T[1]" value?

I have a slight problem using the reference implementation, as it is created for HSS. Do you know how can I force it to use only LMS?

Answer 1

It is stated, that LMOTS private key generation creates a 32B SEED at the start of the process, although does it create a new SEED for every new key from 0 to q=2^h-1?

If you use the suggested key generation method found in Appendix A, you use the same seed value for each Merkle tree. If you use multiple Merkle trees (in HSS with L>1), then each tree gets its own SEED value

although it is not stated for what q the LMOTS public key is generated, or does it mean, that this public key is the LMS public key, which is the root of the tree created by leaves of LMOTS public keys K?

It is the HSS public key, which is the LMS public key of the top level Merkle tree.

I have a slight problem using the reference implementation, as it is created for HSS. Do you know how can I force it to use only LMS?

Tell it to use L=1; that is, when you call hss_generate_private_key, pass it a 1 as the levels parameter (the second one).