What would you like to Propose?
I propose adding a Lamport One-Time Signature implementation to the ciphers package.
The ciphers package currently contains classical public-key algorithms such as RSA,
ECC, and Diffie-Hellman, but no post-quantum algorithms. The Lamport signature
(Lamport, 1979) is a hash-based one-time signature scheme whose security relies only
on the one-wayness of a cryptographic hash function rather than on integer
factorization or discrete logarithms, which makes it resistant to quantum computer
attacks. It is the foundational building block of modern post-quantum signature
standards such as SPHINCS+ and XMSS.
Lamport signatures are a good fit for this repository because:
- It would be the first post-quantum algorithm in the repository, filling a gap that
is increasingly relevant now that NIST has standardized post-quantum schemes and
the JDK itself has started adopting them.
- It can be implemented entirely using standard Java (
java.security.MessageDigest
and java.security.SecureRandom) without any external dependencies, matching the
educational and dependency-free style of this repository.
- The algorithm is straightforward to understand and demonstrates important
cryptographic concepts such as one-way functions, hash-based commitments, and the
trade-offs of one-time key usage.
- It complements the existing RSA, ECC, and DiffieHellman implementations by showing
a fundamentally different (hash-based) approach to digital signatures.
Issue details
Algorithm / problem statement: Generate a key pair where the private key
consists of 256 pairs of random 32-byte secrets (one pair per bit of a SHA-256
message digest) and the public key consists of the SHA-256 hashes of those secrets.
To sign a message, hash it and, for each bit of the digest, reveal the secret
corresponding to that bit value (0 or 1); the signature is the sequence of 256
revealed secrets. To verify, hash the message, hash each revealed secret, and
compare against the corresponding public key entries.
-
src/main/java/com/thealgorithms/ciphers/LamportSignature.java
-
Key pair generation using SecureRandom (256 pairs of 32-byte secrets; public key
as SHA-256 hashes of the secrets).
-
sign() method producing a signature for a given message.
-
verify() method validating a message/signature pair against a public key.
-
Constant structure with no external dependencies (java.security only).
-
Input validation for:
- null message, signature, or keys
- malformed signature length (must contain exactly 256 secrets)
- attempting to sign a second message with the same key pair (one-time property
enforced with a usage flag)
-
src/test/java/com/thealgorithms/ciphers/LamportSignatureTest.java
-
A valid signature verifies successfully.
-
A tampered message is rejected.
-
A tampered signature is rejected.
-
A signature does not verify under a different key pair.
-
Signing a second message with the same key pair throws an exception.
-
Tests for null/invalid inputs and exception handling.
-
The implementation will include Javadocs describing the algorithm, why it is
considered quantum-resistant, the one-time usage limitation (each signature
reveals half of the private key, so a key pair must never sign two different
messages), a note that the implementation is for educational purposes only, and
a reference to the Wikipedia article
(https://en.wikipedia.org/wiki/Lamport_signature).
Additional Information
I searched the repository and existing pull requests and could not find any Lamport
signature or other post-quantum algorithm implementation in the Java repository.
If this proposal is accepted, I'd be happy to implement the algorithm along with
comprehensive JUnit 5 tests and documentation following the repository's coding
standards. This could also serve as the starting point for a small series of
hash-based post-quantum algorithms (Winternitz OTS, Merkle Signature Scheme),
which I would propose in separate issues if maintainers are interested.
What would you like to Propose?
I propose adding a Lamport One-Time Signature implementation to the ciphers package.
The ciphers package currently contains classical public-key algorithms such as RSA,
ECC, and Diffie-Hellman, but no post-quantum algorithms. The Lamport signature
(Lamport, 1979) is a hash-based one-time signature scheme whose security relies only
on the one-wayness of a cryptographic hash function rather than on integer
factorization or discrete logarithms, which makes it resistant to quantum computer
attacks. It is the foundational building block of modern post-quantum signature
standards such as SPHINCS+ and XMSS.
Lamport signatures are a good fit for this repository because:
is increasingly relevant now that NIST has standardized post-quantum schemes and
the JDK itself has started adopting them.
java.security.MessageDigestand
java.security.SecureRandom) without any external dependencies, matching theeducational and dependency-free style of this repository.
cryptographic concepts such as one-way functions, hash-based commitments, and the
trade-offs of one-time key usage.
a fundamentally different (hash-based) approach to digital signatures.
Issue details
Algorithm / problem statement: Generate a key pair where the private key
consists of 256 pairs of random 32-byte secrets (one pair per bit of a SHA-256
message digest) and the public key consists of the SHA-256 hashes of those secrets.
To sign a message, hash it and, for each bit of the digest, reveal the secret
corresponding to that bit value (0 or 1); the signature is the sequence of 256
revealed secrets. To verify, hash the message, hash each revealed secret, and
compare against the corresponding public key entries.
src/main/java/com/thealgorithms/ciphers/LamportSignature.java
Key pair generation using SecureRandom (256 pairs of 32-byte secrets; public key
as SHA-256 hashes of the secrets).
sign() method producing a signature for a given message.
verify() method validating a message/signature pair against a public key.
Constant structure with no external dependencies (java.security only).
Input validation for:
enforced with a usage flag)
src/test/java/com/thealgorithms/ciphers/LamportSignatureTest.java
A valid signature verifies successfully.
A tampered message is rejected.
A tampered signature is rejected.
A signature does not verify under a different key pair.
Signing a second message with the same key pair throws an exception.
Tests for null/invalid inputs and exception handling.
The implementation will include Javadocs describing the algorithm, why it is
considered quantum-resistant, the one-time usage limitation (each signature
reveals half of the private key, so a key pair must never sign two different
messages), a note that the implementation is for educational purposes only, and
a reference to the Wikipedia article
(https://en.wikipedia.org/wiki/Lamport_signature).
Additional Information
I searched the repository and existing pull requests and could not find any Lamport
signature or other post-quantum algorithm implementation in the Java repository.
If this proposal is accepted, I'd be happy to implement the algorithm along with
comprehensive JUnit 5 tests and documentation following the repository's coding
standards. This could also serve as the starting point for a small series of
hash-based post-quantum algorithms (Winternitz OTS, Merkle Signature Scheme),
which I would propose in separate issues if maintainers are interested.