Re: [CFRG] XDR in RFC8391

[Carsten Bormann <[e-mail]>]

Indeed, the below expansion addresses the thinly documented fall-through, but not what actually should be in that signature.

> The meaning of the following snippet:
> 
>      union xmss_ots_signature switch (xmss_algorithm_type type) {
>        case xmss-sha2_10_256:
>        case xmss-sha2_16_256:
>        case xmss-sha2_20_256:
>          wotsp-sha2_256;
>      }
> Has the same meaning as
> 
>      union xmss_ots_signature switch (xmss_algorithm_type type) {
>        case xmss-sha2_10_256:
>          wotsp-sha2_256;
>        case xmss-sha2_16_256:
>          wotsp-sha2_256;
>        case xmss-sha2_20_256:
>          wotsp-sha2_256;
>      }

Note that wotsp-sha2_256 is defined here:

      enum ots_algorithm_type {
        wotsp_reserved  = 0x00000000,
        wotsp-sha2_256  = 0x00000001,
        wotsp-sha2_512  = 0x00000002,
        wotsp-shake_256 = 0x00000003,
        wotsp-shake_512 = 0x00000004,
      };

So wotsp-sha2_256 is an identifier for a value, not for a type.
(Even if it were a type, an identifier would need to follow it.)

xmss_ots_signature is then used here:

      /* XMSS signature structure */

      struct xmss_signature {
        /* WOTS+ key pair index */
        bytestring4 idx_sig;
        /* Random string for randomized hashing */
        random_string_xmss rand_string;
        /* WOTS+ signature */
        xmss_ots_signature sig_ots;
        /* authentication path */
        xmss_path nodes;
      };

Grüße, Carsten