wolfSSL is adding verification-only LMS support to wolfProvider for OpenSSL applications. LMS is a stateful hash-based signature system standardized in RFC 8554 and NIST SP 800-208, making it useful for long-lived signing hierarchies and post-quantum verification. The integration accepts OpenSSL-compatible raw XDR public keys and uses wolfCrypt’s LMS verification APIs underneath the provider interface.
What is Included
- LMS public-key import and signature verification through OpenSSL EVP APIs.
- Support for the SHA-256/192 and SHAKE256 parameter families used by the OpenSSL vectors.
- OpenSSL-compatible handling of LMS public-key and signature encodings.
- Verification coverage for valid, corrupted, empty-message, and duplicated-context cases.
- OpenSSL KAT coverage with hundreds of LMS verification cases.
LMS support is intentionally verification-only. wolfProvider does not generate, import, or sign with LMS private keys. It requires OpenSSL 3.6 or later.
The implementation is under review in wolfProvider PR #455.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
download wolfSSL Now