One-time signature crate?

[carloskiki]

I have a crate that implements the various winternitz one-time signature schemes used by hash-based constructions. This groups the very similar instances of wots in xmss, lms, and slh-dsa all under one crate. I'm wondering if this would be of use here, for instance to ease future implementations (such as shrincs). The primitives obviously don't implement the signature traits because they are not meant to be used as is.

[tarcieri]

I could potentially see XMSS and SLH-DSA sharing a WOTS+ implementation. Have you concretely implemented this already? Does sharing code with LMS which uses a different WOTS variant (LM-OTS) actually make sense?

[carloskiki]

Even though LM-OTS is named differently, it is a WOTS+ signature scheme with a simpler prf. All three implementations share the same code for message encoding into the "digits" with checksum generation. They also share the nested loop for chained hashing to sign, verify, and generate the verifying key.

Basically every implementation only needs to provide its chain hash function, its private key prf, and the way it compresses the verifying key into a single hash.

Here is the crate: https://github.com/carloskiki/wots

[tarcieri]

Interesting. If you can modify the other three crates to work with it and upstream it to us, it seems like it would potentially be a good idea.