Add RFC 8778 HSS/LMS signature and COSE_Key support

[aidangarske]

• Adds RFC 8778 HSS/LMS post-quantum signing to COSE (algorithm HSS-LMS -46, COSE_Key type kty 5)
• Sign and verify in both COSE_Sign1 and multi-signer COSE_Sign, plus delegated signing; public-key COSE_Key encode/decode
• New wc_CoseKey_SetLms() API, WOLFCOSE_LEAN_LMS / WOLFCOSE_LEAN_VERIFY_LMS build profiles, two examples, and unit tests
• Requires wolfSSL --enable-lms; verify-only builds pair with WOLFSSL_LMS_VERIFY_ONLY. XMSS is out of scope (no COSE codepoints yet)

#8

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Adds RFC 8778 HSS/LMS signature support to wolfCOSE, including COSE_Sign1 and COSE_Sign signing/verification paths plus COSE_Key (kty=5) encode/decode, along with lean build profiles, examples, CI enablement, and test coverage.

Changes:

• Introduce wc_CoseKey_SetLms() and wire HSS/LMS into Sign1/Sign sign+verify and COSE_Key encode/decode.
• Add lean build profiles for LMS (WOLFCOSE_LEAN_LMS, WOLFCOSE_LEAN_VERIFY_LMS) and ship two new examples.
• Expand unit tests, force-failure hooks, docs/README, and CI workflow to include LMS.

Reviewed changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/test_cose.c	Adds LMS Sign1, COSE_Key encode/decode, and multi-signer Sign tests.
tests/force_failure.h	Adds force-failure IDs for LMS operations.
src/wolfcose.c	Implements LMS key attach, COSE_Key encoding/decoding, and Sign1/Sign LMS sign+verify logic.
include/wolfcose/wolfcose.h	Adds LMS algorithm/kty constants, union member, and wc_CoseKey_SetLms() API.
include/wolfcose/settings.h	Adds LMS extension gating and lean LMS build profiles; updates sizing limits.
examples/sign1_verify_lms.c	Adds verify-only LMS Sign1 example with embedded test vectors.
examples/sign1_lms.c	Adds LMS Sign1 sign+verify example with state persistence callbacks.
docs/Macros.md	Documents LMS extension name, opt-out macro, sizing floors, and new profiles/targets.
docs/Home.md	Updates supported algorithm count to include LMS.
docs/Algorithms.md	Adds HSS-LMS to supported signatures; updates “future” list to remove LMS.
README.md	Updates overview/features and supported algorithms list to include HSS-LMS.
Makefile	Adds lms-demo and lms-verify targets for the new examples.
.gitignore	Ignores new LMS example binaries.
.github/workflows/build-test.yml	Enables wolfSSL LMS support in CI builds.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #72

Scan targets checked: wolfcose-bugs, wolfcose-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

stale review