Update LMS/HSS

Set SHA-256/SM3 independently.
2026-05-17 22:06:26 +08:00 · 2026-01-15 18:27:20 +08:00
parent 02d3d0224e
commit a212b17099
3 changed files with 202 additions and 178 deletions
--- a/src/lms.c
+++ b/src/lms.c
@@ -14,6 +14,8 @@
 #include <gmssl/lms.h>
 #include <gmssl/x509_alg.h>

+
+
 /*
 * TODO:
 *  1. add key_update callback
@@ -94,9 +96,9 @@ int lms_type_to_height(int type, size_t *height)
 	return 1;
 }

-void lmots_derive_secrets(const hash256_t seed, const uint8_t I[16], int q, hash256_t x[34])
+void lmots_derive_secrets(const lms_hash256_t seed, const uint8_t I[16], int q, lms_hash256_t x[34])
 {
-	HASH256_CTX ctx;
+	LMS_HASH256_CTX ctx;
 	uint8_t qbytes[4];
 	uint8_t ibytes[2];
 	const uint8_t jbytes[1] = { 0xff };
@@ -108,25 +110,25 @@ void lmots_derive_secrets(const hash256_t seed, const uint8_t I[16], int q, hash
 	for (i = 0; i < 34; i++) {
 		PUTU16(ibytes, i);

-		hash256_init(&ctx);
-		hash256_update(&ctx, I, 16);
-		hash256_update(&ctx, qbytes, 4);
-		hash256_update(&ctx, ibytes, 2);
-		hash256_update(&ctx, jbytes, 1);
-		hash256_update(&ctx, seed, 32);
-		hash256_finish(&ctx, x[i]);
+		lms_hash256_init(&ctx);
+		lms_hash256_update(&ctx, I, 16);
+		lms_hash256_update(&ctx, qbytes, 4);
+		lms_hash256_update(&ctx, ibytes, 2);
+		lms_hash256_update(&ctx, jbytes, 1);
+		lms_hash256_update(&ctx, seed, 32);
+		lms_hash256_finish(&ctx, x[i]);
 	}

 	gmssl_secure_clear(&ctx, sizeof(ctx));
 }

-void lmots_secrets_to_public_hash(const uint8_t I[16], int q, const hash256_t x[34], hash256_t pub)
+void lmots_secrets_to_public_hash(const uint8_t I[16], int q, const lms_hash256_t x[34], lms_hash256_t pub)
 {
-	HASH256_CTX ctx;
+	LMS_HASH256_CTX ctx;
 	uint8_t qbytes[4];
 	uint8_t ibytes[2];
 	uint8_t jbytes[1];
-	hash256_t z[34];
+	lms_hash256_t z[34];
 	int i, j;

 	PUTU32(qbytes, q);
@@ -138,28 +140,28 @@ void lmots_secrets_to_public_hash(const uint8_t I[16], int q, const hash256_t x[
 		for (j = 0; j < 255; j++) {
 			jbytes[0] = (uint8_t)j;

-			hash256_init(&ctx);
-			hash256_update(&ctx, I, 16);
-			hash256_update(&ctx, qbytes, 4);
-			hash256_update(&ctx, ibytes, 2);
-			hash256_update(&ctx, jbytes, 1);
-			hash256_update(&ctx, z[i], 32);
-			hash256_finish(&ctx, z[i]);
+			lms_hash256_init(&ctx);
+			lms_hash256_update(&ctx, I, 16);
+			lms_hash256_update(&ctx, qbytes, 4);
+			lms_hash256_update(&ctx, ibytes, 2);
+			lms_hash256_update(&ctx, jbytes, 1);
+			lms_hash256_update(&ctx, z[i], 32);
+			lms_hash256_finish(&ctx, z[i]);
 		}
 	}

 	// K = H(I || u32str(q) || u16str(D_PBLC) || y[0] || ... || y[p-1])
-	hash256_init(&ctx);
-	hash256_update(&ctx, I, 16);
-	hash256_update(&ctx, qbytes, 4);
-	hash256_update(&ctx, D_PBLC, 2);
+	lms_hash256_init(&ctx);
+	lms_hash256_update(&ctx, I, 16);
+	lms_hash256_update(&ctx, qbytes, 4);
+	lms_hash256_update(&ctx, D_PBLC, 2);
 	for (i = 0; i < 34; i++) {
-		hash256_update(&ctx, z[i], 32);
+		lms_hash256_update(&ctx, z[i], 32);
 	}
-	hash256_finish(&ctx, pub);
+	lms_hash256_finish(&ctx, pub);
 }

-static void winternitz_checksum(const hash256_t dgst, uint8_t checksum[2])
+static void winternitz_checksum(const lms_hash256_t dgst, uint8_t checksum[2])
 {
 	uint16_t sum = 0;
 	int i;
@@ -172,9 +174,9 @@ static void winternitz_checksum(const hash256_t dgst, uint8_t checksum[2])
 }

 // signed digest Q = H(I || u32str(q) || u16str(D_MESG) || C || message)
-void lmots_compute_signature(const uint8_t I[16], int q, const hash256_t dgst, const hash256_t x[34], hash256_t y[34])
+void lmots_compute_signature(const uint8_t I[16], int q, const lms_hash256_t dgst, const lms_hash256_t x[34], lms_hash256_t y[34])
 {
-	HASH256_CTX ctx;
+	LMS_HASH256_CTX ctx;
 	uint8_t checksum[2];
 	uint8_t qbytes[4];
 	uint8_t ibytes[2];
@@ -194,22 +196,22 @@ void lmots_compute_signature(const uint8_t I[16], int q, const hash256_t dgst, c
 		for (j = 0; j < a; j++) {
 			jbytes[0] = j;

-			hash256_init(&ctx);
-			hash256_update(&ctx, I, 16);
-			hash256_update(&ctx, qbytes, 4);
-			hash256_update(&ctx, ibytes, 2);
-			hash256_update(&ctx, jbytes, 1);
-			hash256_update(&ctx, y[i], 32);
-			hash256_finish(&ctx, y[i]);
+			lms_hash256_init(&ctx);
+			lms_hash256_update(&ctx, I, 16);
+			lms_hash256_update(&ctx, qbytes, 4);
+			lms_hash256_update(&ctx, ibytes, 2);
+			lms_hash256_update(&ctx, jbytes, 1);
+			lms_hash256_update(&ctx, y[i], 32);
+			lms_hash256_finish(&ctx, y[i]);
 		}
 	}
 }

-void lmots_signature_to_public_hash(const uint8_t I[16], int q, const hash256_t y[34], const hash256_t dgst, hash256_t pub)
+void lmots_signature_to_public_hash(const uint8_t I[16], int q, const lms_hash256_t y[34], const lms_hash256_t dgst, lms_hash256_t pub)
 {
 	uint8_t checksum[2];
-	HASH256_CTX ctx;
-	hash256_t z[34];
+	LMS_HASH256_CTX ctx;
+	lms_hash256_t z[34];
 	uint8_t qbytes[4];
 	uint8_t ibytes[2];
 	uint8_t jbytes[1];
@@ -228,36 +230,36 @@ void lmots_signature_to_public_hash(const uint8_t I[16], int q, const hash256_t
 		for (j = a; j < 255; j++) {
 			jbytes[0] = (uint8_t)j;

-			hash256_init(&ctx);
-			hash256_update(&ctx, I, 16);
-			hash256_update(&ctx, qbytes, 4);
-			hash256_update(&ctx, ibytes, 2);
-			hash256_update(&ctx, jbytes, 1);
-			hash256_update(&ctx, z[i], 32);
-			hash256_finish(&ctx, z[i]);
+			lms_hash256_init(&ctx);
+			lms_hash256_update(&ctx, I, 16);
+			lms_hash256_update(&ctx, qbytes, 4);
+			lms_hash256_update(&ctx, ibytes, 2);
+			lms_hash256_update(&ctx, jbytes, 1);
+			lms_hash256_update(&ctx, z[i], 32);
+			lms_hash256_finish(&ctx, z[i]);
 		}
 	}

 	// Kc = H(I || u32str(q) || u16str(D_PBLC) || z[0] || z[1] || ... || z[p-1])
-	hash256_init(&ctx);
-	hash256_update(&ctx, I, 16);
-	hash256_update(&ctx, qbytes, 4);
-	hash256_update(&ctx, D_PBLC, 2);
+	lms_hash256_init(&ctx);
+	lms_hash256_update(&ctx, I, 16);
+	lms_hash256_update(&ctx, qbytes, 4);
+	lms_hash256_update(&ctx, D_PBLC, 2);
 	for (i = 0; i < 34; i++) {
-		hash256_update(&ctx, z[i], 32);
+		lms_hash256_update(&ctx, z[i], 32);
 	}
-	hash256_finish(&ctx, pub);
+	lms_hash256_finish(&ctx, pub);
 }

 // derive full merkle tree[2^h * 2 - 1] from seed, tree[0] is the root
-void lms_derive_merkle_tree(const hash256_t seed, const uint8_t I[16], int h, hash256_t *tree)
+void lms_derive_merkle_tree(const lms_hash256_t seed, const uint8_t I[16], int h, lms_hash256_t *tree)
 {
 	int r, n = (1 << h);
 	uint8_t rbytes[4];
-	HASH256_CTX ctx;
-	hash256_t x[34];
-	hash256_t pub;
-	hash256_t *T = tree - 1;
+	LMS_HASH256_CTX ctx;
+	lms_hash256_t x[34];
+	lms_hash256_t pub;
+	lms_hash256_t *T = tree - 1;

 	for (r = 2*n - 1; r >= 1; r--) {

@@ -269,34 +271,34 @@ void lms_derive_merkle_tree(const hash256_t seed, const uint8_t I[16], int h, ha
 			lmots_secrets_to_public_hash(I, q, x, pub);

 			// H(I||u32str(r)||u16str(D_LEAF)||OTS_PUB_HASH[r-2^h])
-			hash256_init(&ctx);
-			hash256_update(&ctx, I, 16);
-			hash256_update(&ctx, rbytes, 4);
-			hash256_update(&ctx, D_LEAF, 2);
-			hash256_update(&ctx, pub, 32);
-			hash256_finish(&ctx, T[r]);
+			lms_hash256_init(&ctx);
+			lms_hash256_update(&ctx, I, 16);
+			lms_hash256_update(&ctx, rbytes, 4);
+			lms_hash256_update(&ctx, D_LEAF, 2);
+			lms_hash256_update(&ctx, pub, 32);
+			lms_hash256_finish(&ctx, T[r]);

 		} else {
 			// H(I||u32str(r)||u16str(D_INTR)||T[2*r]||T[2*r+1])
-			hash256_init(&ctx);
-			hash256_update(&ctx, I, 16);
-			hash256_update(&ctx, rbytes, 4);
-			hash256_update(&ctx, D_INTR, 2);
-			hash256_update(&ctx, T[2*r], 32);
-			hash256_update(&ctx, T[2*r + 1], 32);
-			hash256_finish(&ctx, T[r]);
+			lms_hash256_init(&ctx);
+			lms_hash256_update(&ctx, I, 16);
+			lms_hash256_update(&ctx, rbytes, 4);
+			lms_hash256_update(&ctx, D_INTR, 2);
+			lms_hash256_update(&ctx, T[2*r], 32);
+			lms_hash256_update(&ctx, T[2*r + 1], 32);
+			lms_hash256_finish(&ctx, T[r]);
 		}
 	}
 }

-void lms_derive_merkle_root(const hash256_t seed, const uint8_t I[16], int h, hash256_t root)
+void lms_derive_merkle_root(const lms_hash256_t seed, const uint8_t I[16], int h, lms_hash256_t root)
 {
 	int q, r, n = 1 << h;
 	int qbits;
-	HASH256_CTX ctx;
-	hash256_t stack[25];
+	LMS_HASH256_CTX ctx;
+	lms_hash256_t stack[25];
 	int num = 0;
-	hash256_t x[34];
+	lms_hash256_t x[34];
 	uint8_t rbytes[4];

 	for (q = 0; q < n; q++) {
@@ -308,12 +310,12 @@ void lms_derive_merkle_root(const hash256_t seed, const uint8_t I[16], int h, ha
 		PUTU32(rbytes, r);

 		// H(I||u32str(r)||u16str(D_LEAF)||OTS_PUB_HASH[r-2^h])
-		hash256_init(&ctx);
-		hash256_update(&ctx, I, 16);
-		hash256_update(&ctx, rbytes, 4);
-		hash256_update(&ctx, D_LEAF, 2);
-		hash256_update(&ctx, stack[num], 32);
-		hash256_finish(&ctx, stack[num]);
+		lms_hash256_init(&ctx);
+		lms_hash256_update(&ctx, I, 16);
+		lms_hash256_update(&ctx, rbytes, 4);
+		lms_hash256_update(&ctx, D_LEAF, 2);
+		lms_hash256_update(&ctx, stack[num], 32);
+		lms_hash256_finish(&ctx, stack[num]);

 		num++;
 		qbits = q;
@@ -323,13 +325,13 @@ void lms_derive_merkle_root(const hash256_t seed, const uint8_t I[16], int h, ha
 			r = r/2;
 			PUTU32(rbytes, r);

-			hash256_init(&ctx);
-			hash256_update(&ctx, I, 16);
-			hash256_update(&ctx, rbytes, 4);
-			hash256_update(&ctx, D_INTR, 2);
-			hash256_update(&ctx, stack[num - 2], 32);
-			hash256_update(&ctx, stack[num - 1], 32);
-			hash256_finish(&ctx, stack[num - 2]);
+			lms_hash256_init(&ctx);
+			lms_hash256_update(&ctx, I, 16);
+			lms_hash256_update(&ctx, rbytes, 4);
+			lms_hash256_update(&ctx, D_INTR, 2);
+			lms_hash256_update(&ctx, stack[num - 2], 32);
+			lms_hash256_update(&ctx, stack[num - 1], 32);
+			lms_hash256_finish(&ctx, stack[num - 2]);

 			num--;
 			qbits >>= 1;
@@ -481,7 +483,7 @@ int lms_private_key_from_bytes(LMS_KEY *key, const uint8_t **in, size_t *inlen)

 	if (cache_tree) {
 		size_t n = 1 << height;
-		if (!(key->tree = (hash256_t *)malloc(sizeof(hash256_t) * (2*n - 1)))) {
+		if (!(key->tree = (lms_hash256_t *)malloc(sizeof(lms_hash256_t) * (2*n - 1)))) {
 			error_print();
 			return -1;
 		}
@@ -533,7 +535,7 @@ void lms_key_cleanup(LMS_KEY *key)
 	}
 }

-int lms_key_generate_ex(LMS_KEY *key, int lms_type, const hash256_t seed, const uint8_t I[16], int cache_tree)
+int lms_key_generate_ex(LMS_KEY *key, int lms_type, const lms_hash256_t seed, const uint8_t I[16], int cache_tree)
 {
 	size_t h, n;

@@ -555,7 +557,7 @@ int lms_key_generate_ex(LMS_KEY *key, int lms_type, const hash256_t seed, const
 	memcpy(key->seed, seed, 32);

 	if (cache_tree) {
-		if (!(key->tree = (hash256_t *)malloc(sizeof(hash256_t) * (2*n - 1)))) {
+		if (!(key->tree = (lms_hash256_t *)malloc(sizeof(lms_hash256_t) * (2*n - 1)))) {
 			error_print();
 			return -1;
 		}
@@ -572,7 +574,7 @@ int lms_key_generate_ex(LMS_KEY *key, int lms_type, const hash256_t seed, const

 int lms_key_generate(LMS_KEY *key, int lms_type)
 {
-	hash256_t seed;
+	lms_hash256_t seed;
 	uint8_t I[16];
 	int cache_tree = 1;

@@ -605,10 +607,10 @@ int lms_signature_size(int lms_type, size_t *len)
 	}
 	*len = sizeof(uint32_t) // q
 		+ sizeof(uint32_t) // lmots_type
-		+ sizeof(hash256_t) // C
-		+ sizeof(hash256_t) * 34 // y[34]
+		+ sizeof(lms_hash256_t) // C
+		+ sizeof(lms_hash256_t) * 34 // y[34]
 		+ sizeof(uint32_t) // lms_type
-		+ sizeof(hash256_t) * height; // path[hegith]
+		+ sizeof(lms_hash256_t) * height; // path[hegith]
 	return 1;
 }

@@ -818,12 +820,12 @@ int lms_signature_from_bytes(LMS_SIGNATURE *sig, const uint8_t **in, size_t *inl
 }

 int lms_signature_to_merkle_root(const uint8_t I[16], size_t h, int q,
-	const hash256_t y[34], const hash256_t *path,
-	const hash256_t dgst, hash256_t root)
+	const lms_hash256_t y[34], const lms_hash256_t *path,
+	const lms_hash256_t dgst, lms_hash256_t root)
 {
 	size_t n, r;
 	uint8_t rbytes[4];
-	HASH256_CTX ctx;
+	LMS_HASH256_CTX ctx;
 	size_t i;

 	n = 1 << h;
@@ -837,28 +839,28 @@ int lms_signature_to_merkle_root(const uint8_t I[16], size_t h, int q,
 	lmots_signature_to_public_hash(I, q, y, dgst, root);

 	// leaf[q] = H(I||u32str(r)||u16str(D_LEAF)||OTS_PUB_HASH[r-2^h])
-	hash256_init(&ctx);
-	hash256_update(&ctx, I, 16);
-	hash256_update(&ctx, rbytes, 4);
-	hash256_update(&ctx, D_LEAF, 2);
-	hash256_update(&ctx, root, 32);
-	hash256_finish(&ctx, root);
+	lms_hash256_init(&ctx);
+	lms_hash256_update(&ctx, I, 16);
+	lms_hash256_update(&ctx, rbytes, 4);
+	lms_hash256_update(&ctx, D_LEAF, 2);
+	lms_hash256_update(&ctx, root, 32);
+	lms_hash256_finish(&ctx, root);

 	for (i = 0; i < h; i++) {
 		PUTU32(rbytes, r/2);

-		hash256_init(&ctx);
-		hash256_update(&ctx, I, 16);
-		hash256_update(&ctx, rbytes, 4);
-		hash256_update(&ctx, D_INTR, 2);
+		lms_hash256_init(&ctx);
+		lms_hash256_update(&ctx, I, 16);
+		lms_hash256_update(&ctx, rbytes, 4);
+		lms_hash256_update(&ctx, D_INTR, 2);
 		if (r & 0x01) {
-			hash256_update(&ctx, path[i], 32);
-			hash256_update(&ctx, root, 32);
+			lms_hash256_update(&ctx, path[i], 32);
+			lms_hash256_update(&ctx, root, 32);
 		} else {
-			hash256_update(&ctx, root, 32);
-			hash256_update(&ctx, path[i], 32);
+			lms_hash256_update(&ctx, root, 32);
+			lms_hash256_update(&ctx, path[i], 32);
 		}
-		hash256_finish(&ctx, root);
+		lms_hash256_finish(&ctx, root);
 		r = r/2;
 	}

@@ -868,7 +870,7 @@ int lms_signature_to_merkle_root(const uint8_t I[16], size_t h, int q,
 void lms_sign_ctx_cleanup(LMS_SIGN_CTX *ctx)
 {
 	if (ctx) {
-		gmssl_secure_clear(ctx->lms_sig.lmots_sig.y, sizeof(hash256_t)*34);
+		gmssl_secure_clear(ctx->lms_sig.lmots_sig.y, sizeof(lms_hash256_t)*34);
 	}
 }

@@ -876,7 +878,7 @@ int lms_sign_init(LMS_SIGN_CTX *ctx, LMS_KEY *key)
 {
 	LMS_SIGNATURE *lms_sig;
 	uint8_t qbytes[4];
-	const hash256_t *T;
+	const lms_hash256_t *T;
 	size_t height, r, i;

 	if (!ctx || !key) {
@@ -929,11 +931,11 @@ int lms_sign_init(LMS_SIGN_CTX *ctx, LMS_KEY *key)
 		r /= 2;
 	}

-	hash256_init(&ctx->hash256_ctx);
-	hash256_update(&ctx->hash256_ctx, key->public_key.I, 16);
-	hash256_update(&ctx->hash256_ctx, qbytes, 4);
-	hash256_update(&ctx->hash256_ctx, D_MESG, 2);
-	hash256_update(&ctx->hash256_ctx, lms_sig->lmots_sig.C, 32);
+	lms_hash256_init(&ctx->lms_hash256_ctx);
+	lms_hash256_update(&ctx->lms_hash256_ctx, key->public_key.I, 16);
+	lms_hash256_update(&ctx->lms_hash256_ctx, qbytes, 4);
+	lms_hash256_update(&ctx->lms_hash256_ctx, D_MESG, 2);
+	lms_hash256_update(&ctx->lms_hash256_ctx, lms_sig->lmots_sig.C, 32);

 	return 1;
 }
@@ -945,7 +947,7 @@ int lms_sign_update(LMS_SIGN_CTX *ctx, const uint8_t *data, size_t datalen)
 		return -1;
 	}
 	if (data && datalen > 0) {
-		hash256_update(&ctx->hash256_ctx, data, datalen);
+		lms_hash256_update(&ctx->lms_hash256_ctx, data, datalen);
 	}
 	return 1;
 }
@@ -960,7 +962,7 @@ int lms_sign_finish_ex(LMS_SIGN_CTX *ctx, LMS_SIGNATURE *sig)
 		return -1;
 	}

-	hash256_finish(&ctx->hash256_ctx, dgst);
+	lms_hash256_finish(&ctx->lms_hash256_ctx, dgst);

 	lms_sig = &ctx->lms_sig;
 	lmots_compute_signature(ctx->lms_public_key.I, lms_sig->q, dgst, lms_sig->lmots_sig.y, lms_sig->lmots_sig.y);
@@ -979,7 +981,7 @@ int lms_sign_finish(LMS_SIGN_CTX *ctx, uint8_t *sig, size_t *siglen)
 		return -1;
 	}

-	hash256_finish(&ctx->hash256_ctx, dgst);
+	lms_hash256_finish(&ctx->lms_hash256_ctx, dgst);

 	lms_sig = &ctx->lms_sig;
 	lmots_compute_signature(ctx->lms_public_key.I, lms_sig->q, dgst, lms_sig->lmots_sig.y, lms_sig->lmots_sig.y);
@@ -1020,11 +1022,11 @@ int lms_verify_init_ex(LMS_SIGN_CTX *ctx, const LMS_KEY *key, const LMS_SIGNATUR

 	PUTU32(qbytes, lms_sig->q);

-	hash256_init(&ctx->hash256_ctx);
-	hash256_update(&ctx->hash256_ctx, key->public_key.I, 16);
-	hash256_update(&ctx->hash256_ctx, qbytes, 4);
-	hash256_update(&ctx->hash256_ctx, D_MESG, 2);
-	hash256_update(&ctx->hash256_ctx, lms_sig->lmots_sig.C, 32);
+	lms_hash256_init(&ctx->lms_hash256_ctx);
+	lms_hash256_update(&ctx->lms_hash256_ctx, key->public_key.I, 16);
+	lms_hash256_update(&ctx->lms_hash256_ctx, qbytes, 4);
+	lms_hash256_update(&ctx->lms_hash256_ctx, D_MESG, 2);
+	lms_hash256_update(&ctx->lms_hash256_ctx, lms_sig->lmots_sig.C, 32);

 	return 1;
 }
@@ -1064,11 +1066,11 @@ int lms_verify_init(LMS_SIGN_CTX *ctx, const LMS_KEY *key, const uint8_t *sig, s

 	PUTU32(qbytes, lms_sig->q);

-	hash256_init(&ctx->hash256_ctx);
-	hash256_update(&ctx->hash256_ctx, key->public_key.I, 16);
-	hash256_update(&ctx->hash256_ctx, qbytes, 4);
-	hash256_update(&ctx->hash256_ctx, D_MESG, 2);
-	hash256_update(&ctx->hash256_ctx, lms_sig->lmots_sig.C, 32);
+	lms_hash256_init(&ctx->lms_hash256_ctx);
+	lms_hash256_update(&ctx->lms_hash256_ctx, key->public_key.I, 16);
+	lms_hash256_update(&ctx->lms_hash256_ctx, qbytes, 4);
+	lms_hash256_update(&ctx->lms_hash256_ctx, D_MESG, 2);
+	lms_hash256_update(&ctx->lms_hash256_ctx, lms_sig->lmots_sig.C, 32);

 	return 1;
 }
@@ -1080,7 +1082,7 @@ int lms_verify_update(LMS_SIGN_CTX *ctx, const uint8_t *data, size_t datalen)
 		return -1;
 	}
 	if (data && datalen > 0) {
-		hash256_update(&ctx->hash256_ctx, data, datalen);
+		lms_hash256_update(&ctx->lms_hash256_ctx, data, datalen);
 	}
 	return 1;
 }
@@ -1088,9 +1090,9 @@ int lms_verify_update(LMS_SIGN_CTX *ctx, const uint8_t *data, size_t datalen)
 int lms_verify_finish(LMS_SIGN_CTX *ctx)
 {
 	LMS_SIGNATURE *lms_sig;
-	hash256_t dgst;
+	lms_hash256_t dgst;
 	size_t height;
-	hash256_t root;
+	lms_hash256_t root;

 	if (!ctx) {
 		error_print();
@@ -1103,7 +1105,7 @@ int lms_verify_finish(LMS_SIGN_CTX *ctx)
 		return -1;
 	}

-	hash256_finish(&ctx->hash256_ctx, dgst);
+	lms_hash256_finish(&ctx->lms_hash256_ctx, dgst);

 	if (lms_signature_to_merkle_root(ctx->lms_public_key.I, height,
 		lms_sig->q, lms_sig->lmots_sig.y, lms_sig->path, dgst, root) != 1) {
@@ -1330,7 +1332,7 @@ void hss_key_cleanup(HSS_KEY *key)
 int hss_key_generate(HSS_KEY *key, const int *lms_types, size_t levels)
 {
 	int ret = -1;
-	hash256_t seed;
+	lms_hash256_t seed;
 	uint8_t I[16];
 	LMS_SIGN_CTX ctx;
 	uint8_t buf[LMS_SIGNATURE_MAX_SIZE]; // LMS_SIGNATURE_MAX_SIZE > SM3_PUBLIC_KEY_SIZE
@@ -1955,6 +1957,21 @@ int hss_private_key_size(const int *lms_types, size_t levels, size_t *len)
 }

 // X.509 related
+
+/*
+    SubjectPublicKeyInfo ::= SEQUENCE {
+        algorithm            AlgorithmIdentifier,
+        subjectPublicKey     BIT STRING
+    }
+
+    in RFC 8708 (HSS/LMS in CMS)
+        only HSS has OID id-alg-hss-lms-hashsig (1.2.840.113549.1.9.16.3.17)
+        so only HSS public key is supported in x509_ functions
+
+    hss_public_key_to_bytes encode HSS_PUBLIC_KEY to SubjectPublicKeyInfo.subjectPublicKey
+    the public_key raw data (not OCTET STRING TLV) is encoded into a BIT STRING TLV
+        same as EC_POINT
+*/
 int hss_public_key_to_der(const HSS_KEY *key, uint8_t **out, size_t *outlen)
 {
 	uint8_t octets[HSS_PUBLIC_KEY_SIZE];