CycloneDX / CycloneDX/specification

[Defect]: LMOTS parameters and add missing HSS variant (LMS family)

Open Beginner friendly
#1,028 0 comments 0 reactions 0 assignees View on GitHub
cap: cryptography-registry defect
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

## Description:

The LMS family definition in cryptography-defs.json need to update to match RFC 8554 / NIST SP 800-208.

LMOTS pattern uses the wrong parameter

`LMOTS[_{hashfun}][_N{bytespernode}][_H{treeheight}]`

LM-OTS is a one-time signature, not a Merkle tree, so it has no tree-height parameter. RFC 8554 §4.1 defines n, w, p, ls, and the hash function H — but that H names the hash algorithm (e.g., SHA256), not a height. Height (h) is only defined in §5.1 for LMS. The parameter that actually varies across LM-OTS parameter-set names is the Winternitz width w.

Fix:

`LMOTS[_{hashAlgorithm}][_N{bytesPerNode}][_W{winternitzParameter}]`

Missing — HSS isn't defined at all

RFC 8554 §6 (and SP 800-208) define HSS as the multi-level construction built on top of LMS, parameterized only by the number of levels L (1–8). It has no hash/m/h of its own — those come from whichever LMS parameter set is used at each level, and different levels may use different sets.

Add:

`HSS[_L{levels}]`

## References:
RFC 8554 §4.1 (LM-OTS), §5.1 (LMS), §6 (HSS); NIST SP 800-208 §4.

Contributor guide

Open the contributing guide

Research direction

Open cryptography-defs.json and inspect the LMS family definitions. Compare the LM-OTS and HSS parameter patterns with RFC 8554 sections 4.1, 5.1, and 6, plus NIST SP 800-208. Done means LM-OTS uses the hash algorithm, node size, and Winternitz parameters, and HSS is represented with its levels parameter.

Written by the indexing model from the issue text.

Assessment

Tech stack
json
Domain
cryptography
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
84/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.