Add and fix XMSS(^MT) Certificate Algorithm OIDs - #5690
Closed
falko-strenzke wants to merge 9 commits into
Closed
Conversation
XMSS^MT: implement pubkey and verify XMSS^MT: implement keygen and sign XMSS^MT: refactor common XMSS and XMSS^MT code adjust for leaf idx >32 bit in the index registry add test vector files to git clang tidy XMSS^MT: add some tests and documentation various small fixes Remove XMSS^MT private key shared mutable state (see randombit#5366), disabled for now (see randombit#5369)
…teKey class protected
falko-strenzke
force-pushed
the
xmss-cert-oid
branch
from
June 23, 2026 12:45
b4bbe1c to
4ec5ffe
Compare
falko-strenzke
marked this pull request as ready for review
July 9, 2026 08:01
Contributor
|
I have cherry-picked your commits to #5358 |
Collaborator
Author
So we can close this one. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a pull request on top of xmssmt-dev, which introduces XMSS^MT. It adds the missing certificate validation for XMSS^MT and adds the official XMSS OID from RFC 9802.
@TJ-91 I got the test certificates from RFC 9802 to run with
However, I had to modify the public key decoding. I assume it was previously simply arbitrary to have the OCTET STRING encoding around it. However, the existing XMSS^MT tests are now failing, probably due toncompatible public key encoding ((naturally, since I fixed only the decoding)existing test data.Please review this
and fix the tests.(Public key encoding and tests are fixed now.)
I also added the XMSS test certificate from RFC 9802 for which I had to add the official XMSS OID. Probably that should become the default one, i.e., be registered as "XMSS". But I don't know who or what is dependend on the inofficial XMSS OID that is currently registered as "XMSS", so I left it as it is.