EVP_PKEY-LMS(7SSL)

📦
version 4.0.3 · 3 versions
, in ubuntu stonking

💖 EVP_PKEY-LMS — the LMS keytype, but make it make sense 💖

okay so bestie, this is the EVP_PKEY-LMS(7SSL) page from the OpenSSL fam — it's all about EVP_PKEY-LMS, EVP_KEYMGMT-LMS, and LMS, aka the EVP_PKEY Leighton-Micali Signature (LMS) keytype and algorithm support. yes the name is a mouthful. we love that for her though. ✨

🦋 DESCRIPTION 🦋

the LMS keytype lives in OpenSSL's default and FIPS providers. and here's the tea: the OpenSSL providers only support LMS signature verification — no signing, just verifying. why? because that's literally a requirement for FIPS software modules, per [SP 800-208](https://csrc.nist.gov/pubs/sp/800/208/final). it's giving "rules are rules." 💅

🌸 Common LMS parameters 🌸

LMS public keys are encoded in XDR format (i.e. not ASN1 format — she's different like that). the following parameters get used by EVP_PKEY_fromdata() and by the LMS keymanager for import and export:

  • "pub" (OSSL_PKEY_PARAM_PUB_KEY) <octet string> — used for getting and setting the encoding of an LMS public key. the public key is expected to be in XDR format. 🫶

and this next one is gettable using EVP_PKEY_get_utf8_string_param():

  • "mandatory-digest" (OSSL_PKEY_PARAM_MANDATORY_DIGEST) <UTF8 string> — the empty string, signifying that no digest may be specified. she said "no digest, periodt." 💀

👑 CONFORMING TO 👑

  • RFC 8554 — Leighton-Micali Hash-Based Signatures
  • NIST SP800-208 — Recommendation for Stateful Hash-Based Signature Schemes
  • CNSA 2.0 — Commercial National Security Algorithm Suite

iconic lineup honestly. the credentials? immaculate. 🌈

💜 NOTES 💜

LMS support is disabled by default at compile-time. 😭

to enable it, you gotta specify the enable-lms build configuration option. that's the whole vibe check right there.

✨ EXAMPLES ✨

NOTE: error checking has been omitted in these examples. (bestie we're keeping it cute and simple, but like, in real life, check your errors fr fr. 🙈)

an EVP_PKEY context can be obtained by calling:

EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_name(libctx, "LMS", propq);

and an LMS public key can be loaded simply like this:

EVP_PKEY *pkey = NULL;
OSSL_DECODER_CTX *dctx = NULL;
int selection = OSSL_KEYMGMT_SELECT_PUBLIC_KEY;

dctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "XDR", NULL,
                                     "LMS", selection, libctx, propq);
ret = OSSL_DECODER_from_bio(dctx, bio);
OSSL_DECODER_CTX_free(dctx);

to load a LMS key from XDR encoded data of size datalen:

EVP_PKEY *key = NULL;
OSSL_PARAM params[2];

params[0] =
    OSSL_PARAM_construct_octet_string(OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY,
                                      (unsigned char *)data, datalen);
params[1] = OSSL_PARAM_construct_end();
ret = EVP_PKEY_fromdata_init(ctx)
ret = EVP_PKEY_fromdata(ctx, &key, EVP_PKEY_PUBLIC_KEY, params);

slay. copy, paste, adapt, thrive. 🎀

🧚 SEE ALSO 🧚

EVP_KEYMGMT(3), EVP_PKEY(3), EVP_SIGNATURE-LMS(7), provider-keymgmt(7)

go read those too, they're all part of the same friend group. 💖

⭐ HISTORY ⭐

this functionality was added in OpenSSL 3.6. the gettable "mandatory-digest" and support for loading LMS public keys in SubjectPublicKeyInfo format was added in OpenSSL 4.0. glow-up era. 👑

Copyright 2025-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page bestie, you're officially well-read on LMS 💅 this masterpiece is from 4.0.3, dated 2026-09-29, straight out of the OpenSSL fam — now go forth and verify those signatures (but not sign them, remember, we don't do that here 😭). mwah. 🫶🌸

📦 where this page comes from