bc-java icon indicating copy to clipboard operation
bc-java copied to clipboard

XMSS BDS State reconstruction excludes last 2 indices

Open rosualinpetru opened this issue 1 month ago • 0 comments

Is it possible that the check here unintentionally excludes last two indices for BDS reconstruction?

Consider a case when an application does not store the BDS state. Upon specifying an index value of 1022 and 1023 for a tree of height 10, BDS is not reconstructed, and the resulting XMSSPrivateKeyParameters if used for signature by the XMSSSigner will yield an error that the BDS state has not been initialised. In short, last two indices can only be used if one stores the BDS state.

Is this intended?

https://github.com/bcgit/bc-java/blob/65c3dc40c22c5dce2dc9c05de4da29705ea869b5/core/src/main/java/org/bouncycastle/pqc/crypto/xmss/XMSSPrivateKeyParameters.java#L165

rosualinpetru avatar Nov 14 '25 20:11 rosualinpetru