LMS: Build the tree for the public key as the authentication path of the current one-time key, so a freshly generated key retains its first signature's path instead of rebuilding the 2^(h-5) leaves below the cached top that the build has just computed and dropped; fresh ancestors within the pinned top and the root are published to the cache as a side effect

Author: peterdettman

core/src/main/java/org/bouncycastle/crypto/params/LMSPrivateKeyParameters.java

@@ -52,7 +52,9 @@ public class LMSPrivateKeyParameters
     // (advanceRetainedPath). Consecutive signatures share most of their path, so a signature costs about
     // (h - 5) / 2 + 1 leaf derivations amortised, in place of the 2^(h - 5) it takes to rebuild the path
     // below the cached top every time. The worst case (crossing into the other half of the tree) is
-    // still that rebuild; only a scheduled traversal (BDS) would smooth it.
+    // still that rebuild; only a scheduled traversal (BDS) would smooth it. A tree built for the public
+    // key is built in path form (getPublicKey), so a freshly generated key already holds the path of
+    // its first signature; a decoded key holds none until it signs.
     //
     // The arrays of both tiers are handed out by reference to contexts and signatures and must never be
     // modified or wiped.
@@ -621,12 +623,32 @@ public LMSPublicKeyParameters getPublicKey()
         {
             if (publicKey == null)
             {
+                //
+                // With no root cached the whole tree has to be built. Built as the authentication path
+                // of the current one-time key it costs exactly the same - every leaf and interior node
+                // once - but leaves that path retained, so the first signature does not rebuild the
+                // 2^(h - 5) leaves below the cached top that the build has just computed and dropped.
+                //
+                if (retained == null && peekRootT() == null && q >= 0 && q < (1 << parameters.getH()))
+                {
+                    advanceRetainedPath(parameters.getH(), q);
+                }
+
                 publicKey = new LMSPublicKeyParameters(parameters, otsParameters, this.findT(1), I);
             }
             return publicKey;
         }
     }
 
+    /**
+     * Whether an authentication path is currently retained. Used by the regression tests that check
+     * a key built or signed with keeps the path its work produced.
+     */
+    synchronized boolean isPathRetained()
+    {
+        return retained != null;
+    }
+
     byte[] findT(int r)
     {
         if (r >= maxCacheR)
@@ -709,6 +731,33 @@ private byte[][] advanceRetainedPath(int h, int q)
                     ? LMSEngine.computeNode(tDigest, I, r >> i, child, sibling)
                     : LMSEngine.computeNode(tDigest, I, r >> i, sibling, child);
             }
+
+            //
+            // The fresh ancestors that fall within the pinned top are nodes the cache would otherwise
+            // compute again, so they are published now; the siblings already were, by findT. Built
+            // from nothing (fresh == h) this is the whole tree in path form, and the root is then one
+            // hash away - storing it is what lets getPublicKey come here in place of a plain build.
+            //
+            synchronized (tCache)
+            {
+                for (int i = 0; i < fresh; ++i)
+                {
+                    int node = r >> i;
+                    if (node < maxCacheR && tCache[node] == null)
+                    {
+                        tCache[node] = anc[i];
+                    }
+                }
+
+                if (tCache[1] == null)
+                {
+                    byte[] child = anc[h - 1], sibling = path[h - 1];
+
+                    tCache[1] = ((r >> (h - 1)) & 1) == 0
+                        ? LMSEngine.computeNode(tDigest, I, 1, child, sibling)
+                        : LMSEngine.computeNode(tDigest, I, 1, sibling, child);
+                }
+            }
         }
 
         retained = new RetainedPath(q, path, anc);

core/src/test/java/org/bouncycastle/crypto/params/LMSTests.java

@@ -702,6 +702,47 @@ public void run()
         }
     }
 
+    /**
+     * Building the tree for the public key computes every node on the current one-time key's path, so
+     * the key keeps that path rather than rebuilding it for the first signature. A decoded key has no
+     * such path until it signs, and one decoded from a legacy encoding with no tree cache gets its root
+     * from that first signature's path rather than from a second full build.
+     */
+    public void testTreeBuildRetainsFirstPath()
+        throws Exception
+    {
+        LMSigParameters sigParams = LMSigParameters.lms_sha256_n32_h5;
+        LMOtsParameters otsParams = LMOtsParameters.sha256_n32_w8;
+        byte[] I = Hex.decode("d08fabd4a2091ff0a8cb4ed834e74534");
+        byte[] seed = Hex.decode("558b8966c48ae9cb898b423c83443aae014a72f1b1ab5cc85cf1d892903b5439");
+        byte[] msg = Strings.toByteArray("first path");
+
+        LMSPrivateKeyParameters key = lmsKey(sigParams, otsParams, 0, I, seed);
+        assertFalse(key.isPathRetained());
+        LMSPublicKeyParameters pub = key.getPublicKey();
+        assertTrue("tree build should leave the first path retained", key.isPathRetained());
+        assertTrue(key.isTreeCachePrimed());
+        byte[] sig = sign(key, msg);
+        assertEquals(0, Pack.bigEndianToInt(sig, 0));
+        assertTrue(verify(pub, sig, msg));
+
+        LMSPrivateKeyParameters decoded = LMSPrivateKeyParameters.getInstance(key.getEncoded());
+        assertTrue(decoded.isTreeCachePrimed());
+        assertFalse("nothing to retain from a decode", decoded.isPathRetained());
+        sig = sign(decoded, msg);
+        assertEquals(1, Pack.bigEndianToInt(sig, 0));
+        assertTrue(verify(pub, sig, msg));
+        assertTrue(decoded.isPathRetained());
+
+        LMSPrivateKeyParameters legacy = LMSPrivateKeyParameters.getInstance(coreKey(sigParams, otsParams, I, seed, 2, 32));
+        assertFalse(legacy.isTreeCachePrimed());
+        sig = sign(legacy, msg);
+        assertEquals(2, Pack.bigEndianToInt(sig, 0));
+        assertTrue(verify(pub, sig, msg));
+        assertTrue("the first path should have supplied the root", legacy.isTreeCachePrimed());
+        assertEquals(pub, legacy.getPublicKey());
+    }
+
     private static LMSPrivateKeyParameters generateKey(LMSigParameters sigParams, LMOtsParameters otsParams)
     {
         SecureRandom random = new SecureRandom();

docs/releasenotes.md

@@ -26,7 +26,7 @@ Date: 2026, TBD
 
 ### 2.1.3 Additional Features and Functionality
 
-- The promoted LMS private key (org.bouncycastle.crypto.params.LMSPrivateKeyParameters) keeps its Merkle tree in two bounded tiers in place of the WeakHashMap that held every node it ever computed: the top 63 nodes - the same ones its encoding persists - in a fixed array for the life of the key, and the authentication path of the last one-time key signed with, together with that leaf's ancestors, advanced under the key's lock as each index is claimed. The old map keyed every node below the top on objects nothing retained, so a leaf was collectable the moment it was inserted and the map's hit rate below the top depended on when the collector next ran, while its table still grew to 2^(h+1) entries during a tree build. A run of consecutive signatures now costs about (h - 5) / 2 + 1 leaf derivations each rather than either a cache hit or a 2^(h - 5) rebuild, with the rebuild remaining as the worst case at a half-tree crossing; shards and repositioned keys inherit the parent's retained path, and the encoding is unchanged. The deprecated org.bouncycastle.pqc.crypto.lms copy is untouched.
+- The promoted LMS private key (org.bouncycastle.crypto.params.LMSPrivateKeyParameters) keeps its Merkle tree in two bounded tiers in place of the WeakHashMap that held every node it ever computed: the top 63 nodes - the same ones its encoding persists - in a fixed array for the life of the key, and the authentication path of the last one-time key signed with, together with that leaf's ancestors, advanced under the key's lock as each index is claimed. The old map keyed every node below the top on objects nothing retained, so a leaf was collectable the moment it was inserted and the map's hit rate below the top depended on when the collector next ran, while its table still grew to 2^(h+1) entries during a tree build. A run of consecutive signatures now costs about (h - 5) / 2 + 1 leaf derivations each rather than either a cache hit or a 2^(h - 5) rebuild, with the rebuild remaining as the worst case at a half-tree crossing; shards and repositioned keys inherit the parent's retained path, and the encoding is unchanged. The tree built for the public key is built in path form, so a freshly generated key already holds the path of its first signature rather than rebuilding it - that signature went from 2.6 s to about 1 ms at h=15. The deprecated org.bouncycastle.pqc.crypto.lms copy is untouched.
 
 ### 2.1.4 Additional Notes