I think this is an interesting idea. What does putting this in 3.5 give us, other than, perhaps, a test bed for HSS. If LMS is strategic, then ASAP. If it is a notion, not sure. If we need this to support quantum safety, it probably should be done to get to communities for testing prior to any major HSS effort. I don't have much to contribute on this subject as a technical expert.

LMS is lightweight (compared to the other PQ signature mechanisms) and it uses only old well understood cryptography (digests). ML-DSA is the priority signature scheme for 3.5; it is heavyweight and carries a higher risk of a cryptanalytic breakthrough since it's based on less mature mathematics.

I anticipate that LMS will be embraced by hardware vendors for firmware signing rather than used in certificates. No doubt, it will be used for all manner of purposes by the community nonetheless.

The effort required to include it should be limited to the review/feedback loop and the final merge effort -- all of the core development is done. The final merge is small, the review cycle is unknown but I wouldn't expect it to be huge. I.e. this should be possible without adversely impacting the other priorities for 3.5.

HSS is essentially an extension of LMS. There is a pull request for it as well but it depends on the LMS one, so they are going to be serial in nature. Let's not worry about the incremental effort for HSS at this point.

Note also, that LMS is part of FIPS 205 and would be part of the FIPS 140-3 validation of the 3.5 release. We don't know when the subsequent FIPS 140-3 validation will occur.

Another note - LMS is also approved under CNSA 2.0 (but only for signing firmware/software), see https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/1/CSI_CNSA_2.0_FAQ_.PDF

LMS is prioritized for firmware and s/w code signing as Jaroslav noted and is one of the first requirements for the transition to PQ. HSM vendors are supporting LMS signing now. If the work is done and it will not delay any other work for 3.5, I would recommend to include it. Alg testing is available now as well. Since the FIPS validation cycle is sooo long anyway, I personally don't see a down side to including LMS verify in 3.5 release and also having it as part of the next FIPS validation. From a community perspective as well it would be awesome to have a common implementation of LMS verification to test against.

Everyone has voited, so I'll close this and pass the recommendation along. The process for the latter hasn't been sorted out yet so I emailed this to the directors:

Based on an unanimous decision, the corporation BAC recommends that LMS (as per #25598) be prioritised for inclusion in the upcoming OpenSSL 3.5 release.

Although not directly part of the decision, including it as part of any future FIPS 140-3 validation also seems desirable.


Dr Paul Dale