Class LmsAlgorithm

java.lang.Object
zeroecho.core.CryptoAlgorithm
zeroecho.core.alg.AbstractCryptoAlgorithm
zeroecho.core.alg.lms.LmsAlgorithm
public final class LmsAlgorithm extends AbstractCryptoAlgorithm
Concrete CryptoAlgorithm for LMS (Leighton–Micali Signatures).

Overview

LMS is a stateful hash-based one-time signature scheme standardized in RFC 8554. It is considered quantum-safe. Security depends on the security of the underlying hash function (SHA-256 in the default parameter set) rather than on computational hardness assumptions.

CRITICAL: Statefulness

LMS private keys are stateful with a finite signing capacity. Each signing operation consumes one Winternitz OTS leaf, and the updated key state must be persisted to non-volatile storage before and after each signing. Reusing a key state (e.g., after a crash) breaks security. An LMS key with the default parameter set lms_sha256_n32_h5 has exactly 25 = 32 uses. Durable signing requires an explicit StatefulSigner; generic signing is unavailable.

Capabilities

Default parameters

The default key generation specification uses lms_sha256_n32_h5 (height 5, 32 leaves) with sha256_n32_w8 (Winternitz parameter w=8). Applications requiring more signing capacity should use a larger tree height.

Thread-safety

LmsAlgorithm instances are immutable and safe to share. Created SignatureContext objects are not thread-safe.

Since:
1.0

  • Constructor Details

    • LmsAlgorithm

      public LmsAlgorithm()
      Creates the LMS algorithm instance and registers its capabilities and the default key-pair generator.

  • Method Details

    • parameterSets

      public List<ParameterSetDescriptor<? extends AlgorithmKeySpec>> parameterSets()
      Description copied from class: CryptoAlgorithm
      Returns the discoverable parameter sets (or parameterized templates) supported by this algorithm.

      Callers (UIs, provisioning tools, policy engines) use this list to present users with valid, named key-generation options without prior knowledge of the concrete algorithm. Each entry is either a pre-built ParameterSetDescriptor.Concrete (ready spec) or a ParameterSetDescriptor.Template (user-supplied arguments produce the spec).

      The default implementation returns an empty list. Algorithms with finite, enumerable parameter sets should override this method. Overrides must return immutable lists in stable order, with unique nonblank descriptor identifiers. Registry loading validates a snapshot; external providers remain responsible for maintaining the contract on subsequent calls. Implementations may use ParameterSetDescriptor.snapshot(List) to validate and copy their list.

      Overrides:
      parameterSets in class CryptoAlgorithm
      Returns:
      immutable list of parameter set descriptors; never null

    • requiresStatefulSigning

      public boolean requiresStatefulSigning()
      Description copied from class: CryptoAlgorithm
      Indicates that signing consumes durable private-key state. This declaration does not enable the ordinary SIGN role: callers need a keyring-owned StatefulSigner capability.
      Overrides:
      requiresStatefulSigning in class CryptoAlgorithm
      Returns:
      whether durable state ownership is required for signing