Reduced combinations

.gitignore

@@ -77,6 +77,7 @@ providers/common/der/der_rsa_gen.c
 providers/common/der/der_wrap_gen.c
 providers/common/der/der_sm2_gen.c
 providers/common/der/der_ml_dsa_gen.c
+providers/common/der/der_composite_gen.c
 providers/common/der/der_hkdf_gen.c
 providers/common/include/prov/der_slh_dsa.h
 providers/common/include/prov/der_dsa.h
@@ -137,7 +138,9 @@ providers/implementations/keymgmt/ml_dsa_kmgmt.inc
 providers/implementations/keymgmt/ml_kem_kmgmt.inc
 providers/implementations/keymgmt/mlx_kmgmt.inc
 providers/implementations/keymgmt/slh_dsa_kmgmt.inc
+providers/implementations/keymgmt/composite_kmgmt.inc
 providers/implementations/keymgmt/template_kmgmt.inc
+providers/implementations/signature/composite_sig.inc
 providers/implementations/signature/eddsa_sig.inc
 providers/implementations/signature/mac_legacy_sig.inc
 providers/implementations/signature/ml_dsa_sig.inc

CHANGES.md

@@ -31,6 +31,13 @@ OpenSSL Releases
 
 ### Changes between 4.0 and 4.1 [xx XXX xxxx]
 
+ * Added 2 composite post-quantum signature algorithms combining ML-DSA 65 with
+   RSA3072-PKCS15 and ECDSA-P256 as defined in
+   [draft-ietf-lamps-pq-composite-sigs](https://datatracker.ietf.org/doc/draft-ietf-lamps-pq-composite-sigs):
+   id-MLDSA44-ECDSA-P256-SHA256,id-MLDSA65-RSA3072-PKCS15-SHA512.
+   These algorithms are available in the default provider only.
+
+   *Felipe Ventura*
  * Added AVX512 optimized SHAKE x4 operations for ML-DSA on x86_64.
 
    *Marcel Cornu and Tomasz Kantecki*

Configure

@@ -477,6 +477,7 @@ my @disablables_algorithms = (
     "mdc2",
     "ml-dsa",
     "ml-kem",
+    "composite",
     "lms",
     "ocb",
     "poly1305",
@@ -674,7 +675,7 @@ my @disable_cascades = (
                              "ec", "ech",
                              "filenames", "hmac-drbg-kdf",
                              "idea", "ikev2kdf", "kbkdf", "krb5kdf", "ktls", "lms",
-                             "md4", "ml-dsa", "ml-kem", "multiblock",
+                             "md4", "ml-dsa", "ml-kem", "composite", "multiblock",
                              "nextprotoneg", "ocsp", "ocb", "poly1305", "psk",
                              "pvkkdf", "rc2", "rc4", "rmd160",
                              "scrypt", "seed", "siphash", "siv",
@@ -691,6 +692,7 @@ my @disable_cascades = (
     "brotli"            => [ "brotli-dynamic" ],
     "zstd"              => [ "zstd-dynamic" ],
     "des"               => [ "mdc2" ],
+    "ml-dsa"            => [ "composite" ],
     "deprecated"        => [ "tls-deprecated-ec" ],
     "ec"                => [ qw(ec2m ec_explicit_curves sm2 gost ecx tls-deprecated-ec) ],
     "dgram"             => [ "dtls", "quic", "sctp" ],

build.info

@@ -84,6 +84,7 @@ DEPEND[]=include/openssl/asn1.h \
          providers/implementations/keymgmt/ecx_kmgmt.inc \
          providers/implementations/keymgmt/lms_kmgmt.inc \
          providers/implementations/keymgmt/mac_legacy_kmgmt.inc \
+         providers/implementations/keymgmt/composite_kmgmt.inc \
          providers/implementations/keymgmt/ml_dsa_kmgmt.inc \
          providers/implementations/keymgmt/ml_kem_kmgmt.inc \
          providers/implementations/keymgmt/mlx_kmgmt.inc \
@@ -94,6 +95,7 @@ DEPEND[]=include/openssl/asn1.h \
          providers/implementations/signature/eddsa_sig.inc \
          providers/implementations/signature/mac_legacy_sig.inc \
          providers/implementations/signature/ml_dsa_sig.inc \
+         providers/implementations/signature/composite_sig.inc \
          providers/implementations/signature/rsa_sig.inc \
          providers/implementations/signature/slh_dsa_sig.inc \
          providers/implementations/signature/sm2_sig.inc \
@@ -209,6 +211,7 @@ DEPEND[providers/implementations/asymciphers/rsa_enc.inc \
        providers/implementations/keymgmt/ecx_kmgmt.inc \
        providers/implementations/keymgmt/lms_kmgmt.inc \
        providers/implementations/keymgmt/mac_legacy_kmgmt.inc \
+       providers/implementations/keymgmt/composite_kmgmt.inc \
        providers/implementations/keymgmt/ml_dsa_kmgmt.inc \
        providers/implementations/keymgmt/ml_kem_kmgmt.inc \
        providers/implementations/keymgmt/mlx_kmgmt.inc \
@@ -219,6 +222,7 @@ DEPEND[providers/implementations/asymciphers/rsa_enc.inc \
        providers/implementations/signature/eddsa_sig.inc \
        providers/implementations/signature/mac_legacy_sig.inc \
        providers/implementations/signature/ml_dsa_sig.inc \
+       providers/implementations/signature/composite_sig.inc \
        providers/implementations/signature/rsa_sig.inc \
        providers/implementations/signature/slh_dsa_sig.inc \
        providers/implementations/signature/sm2_sig.inc \
@@ -342,6 +346,8 @@ GENERATE[providers/implementations/keymgmt/lms_kmgmt.inc]=\
     providers/implementations/keymgmt/lms_kmgmt.inc.in
 GENERATE[providers/implementations/keymgmt/mac_legacy_kmgmt.inc]=\
     providers/implementations/keymgmt/mac_legacy_kmgmt.inc.in
+GENERATE[providers/implementations/keymgmt/composite_kmgmt.inc]=\
+    providers/implementations/keymgmt/composite_kmgmt.inc.in
 GENERATE[providers/implementations/keymgmt/ml_dsa_kmgmt.inc]=\
     providers/implementations/keymgmt/ml_dsa_kmgmt.inc.in
 GENERATE[providers/implementations/keymgmt/ml_kem_kmgmt.inc]=\
@@ -362,6 +368,8 @@ GENERATE[providers/implementations/signature/mac_legacy_sig.inc]=\
     providers/implementations/signature/mac_legacy_sig.inc.in
 GENERATE[providers/implementations/signature/ml_dsa_sig.inc]=\
     providers/implementations/signature/ml_dsa_sig.inc.in
+GENERATE[providers/implementations/signature/composite_sig.inc]=\
+    providers/implementations/signature/composite_sig.inc.in
 GENERATE[providers/implementations/signature/rsa_sig.inc]=\
     providers/implementations/signature/rsa_sig.inc.in
 GENERATE[providers/implementations/signature/slh_dsa_sig.inc]=\

crypto/objects/obj_dat.h

@@ -20,7 +20,7 @@
 #include <crypto/asn1.h>
 
 /* Serialized OID's */
-static const unsigned char so[9582] = {
+static const unsigned char so[9598] = {
     0x2A,0x86,0x48,0x86,0xF7,0x0D,                 /* [    0] OBJ_rsadsi */
     0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,            /* [    6] OBJ_pkcs */
     0x2A,0x86,0x48,0x86,0xF7,0x0D,0x02,0x02,       /* [   13] OBJ_md2 */
@@ -1364,9 +1364,11 @@ static const unsigned char so[9582] = {
     0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x09,0x10,0x0D,  /* [ 9549] OBJ_id_smime_ori */
     0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x09,0x10,0x0D,0x03,  /* [ 9559] OBJ_id_smime_ori_kem */
     0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x09,0x10,0x03,0x11,  /* [ 9570] OBJ_id_alg_hss_lms_hashsig */
+    0x2B,0x06,0x01,0x05,0x05,0x07,0x06,0x2A,       /* [ 9581] OBJ_ML_DSA_65_RSA3072_PKCS15_SHA512 */
+    0x2B,0x06,0x01,0x05,0x05,0x07,0x06,0x2D,       /* [ 9589] OBJ_ML_DSA_65_ECDSA_P256_SHA512 */
 };
 
-#define NUM_NID 1502
+#define NUM_NID 1504
 static const ASN1_OBJECT nid_objs[NUM_NID] = {
     {"UNDEF", "undefined", NID_undef},
     {"rsadsi", "RSA Data Security, Inc.", NID_rsadsi, 6, &so[0]},
@@ -2870,9 +2872,11 @@ static const ASN1_OBJECT nid_objs[NUM_NID] = {
     {"id-smime-ori", "id-smime-ori", NID_id_smime_ori, 10, &so[9549]},
     {"id-smime-ori-kem", "id-smime-ori-kem", NID_id_smime_ori_kem, 11, &so[9559]},
     {"id-alg-hss-lms-hashsig", "id-alg-hss-lms-hashsig", NID_id_alg_hss_lms_hashsig, 11, &so[9570]},
+    {"id-mldsa65-rsa3072-pkcs15-sha512", "ML-DSA-65-RSA3072-PKCS15-SHA512", NID_ML_DSA_65_RSA3072_PKCS15_SHA512, 8, &so[9581]},
+    {"id-mldsa65-ecdsa-p256-sha512", "ML-DSA-65-ECDSA-P256-SHA512", NID_ML_DSA_65_ECDSA_P256_SHA512, 8, &so[9589]},
 };
 
-#define NUM_SN 1493
+#define NUM_SN 1495
 static const unsigned int sn_objs[NUM_SN] = {
      364,    /* "AD_DVCS" */
      419,    /* "AES-128-CBC" */
@@ -3615,6 +3619,8 @@ static const unsigned int sn_objs[NUM_SN] = {
     1457,    /* "id-ml-dsa-44" */
     1458,    /* "id-ml-dsa-65" */
     1459,    /* "id-ml-dsa-87" */
+    1503,    /* "id-mldsa65-ecdsa-p256-sha512" */
+    1502,    /* "id-mldsa65-rsa3072-pkcs15-sha512" */
      280,    /* "id-mod-attribute-cert" */
      274,    /* "id-mod-cmc" */
      277,    /* "id-mod-cmp" */
@@ -4369,7 +4375,7 @@ static const unsigned int sn_objs[NUM_SN] = {
     1289,    /* "zstd" */
 };
 
-#define NUM_LN 1493
+#define NUM_LN 1495
 static const unsigned int ln_objs[NUM_LN] = {
      363,    /* "AD Time Stamping" */
      405,    /* "ANSI X9.62" */
@@ -4531,6 +4537,8 @@ static const unsigned int ln_objs[NUM_LN] = {
      504,    /* "MIME MHS" */
     1457,    /* "ML-DSA-44" */
     1458,    /* "ML-DSA-65" */
+    1503,    /* "ML-DSA-65-ECDSA-P256-SHA512" */
+    1502,    /* "ML-DSA-65-RSA3072-PKCS15-SHA512" */
     1459,    /* "ML-DSA-87" */
     1456,    /* "ML-KEM-1024" */
     1454,    /* "ML-KEM-512" */
@@ -5866,7 +5874,7 @@ static const unsigned int ln_objs[NUM_LN] = {
      125,    /* "zlib compression" */
 };
 
-#define NUM_OBJ 1350
+#define NUM_OBJ 1352
 static const unsigned int obj_objs[NUM_OBJ] = {
        0,    /* OBJ_undef                        0 */
      181,    /* OBJ_iso                          1 */
@@ -6695,6 +6703,8 @@ static const unsigned int obj_objs[NUM_OBJ] = {
      324,    /* OBJ_id_alg_noSignature           1 3 6 1 5 5 7 6 2 */
      325,    /* OBJ_id_alg_dh_sig_hmac_sha1      1 3 6 1 5 5 7 6 3 */
      326,    /* OBJ_id_alg_dh_pop                1 3 6 1 5 5 7 6 4 */
+    1502,    /* OBJ_ML_DSA_65_RSA3072_PKCS15_SHA512 1 3 6 1 5 5 7 6 42 */
+    1503,    /* OBJ_ML_DSA_65_ECDSA_P256_SHA512  1 3 6 1 5 5 7 6 45 */
      327,    /* OBJ_id_cmc_statusInfo            1 3 6 1 5 5 7 7 1 */
      328,    /* OBJ_id_cmc_identification        1 3 6 1 5 5 7 7 2 */
      329,    /* OBJ_id_cmc_identityProof         1 3 6 1 5 5 7 7 3 */

crypto/objects/obj_mac.num

@@ -1499,3 +1499,5 @@ HKDF_SHA512		1498
 id_smime_ori		1499
 id_smime_ori_kem		1500
 id_alg_hss_lms_hashsig		1501
+ML_DSA_65_RSA3072_PKCS15_SHA512		1502
+ML_DSA_65_ECDSA_P256_SHA512		1503

crypto/objects/obj_xref.h

@@ -105,6 +105,10 @@ static const nid_triple sigoid_srt[] = {
     {NID_SLH_DSA_SHAKE_192f, NID_undef, NID_SLH_DSA_SHAKE_192f},
     {NID_SLH_DSA_SHAKE_256s, NID_undef, NID_SLH_DSA_SHAKE_256s},
     {NID_SLH_DSA_SHAKE_256f, NID_undef, NID_SLH_DSA_SHAKE_256f},
+    {NID_ML_DSA_65_RSA3072_PKCS15_SHA512, NID_undef,
+     NID_ML_DSA_65_RSA3072_PKCS15_SHA512},
+    {NID_ML_DSA_65_ECDSA_P256_SHA512, NID_undef,
+     NID_ML_DSA_65_ECDSA_P256_SHA512},
 };
 
 static const nid_triple *const sigoid_srt_xref[] = {

crypto/objects/obj_xref.txt

@@ -38,6 +38,8 @@ SLH_DSA_SHAKE_192s undef SLH_DSA_SHAKE_192s
 SLH_DSA_SHAKE_192f undef SLH_DSA_SHAKE_192f
 SLH_DSA_SHAKE_256s undef SLH_DSA_SHAKE_256s
 SLH_DSA_SHAKE_256f undef SLH_DSA_SHAKE_256f
+ML_DSA_65_RSA3072_PKCS15_SHA512		undef	ML_DSA_65_RSA3072_PKCS15_SHA512
+ML_DSA_65_ECDSA_P256_SHA512		undef	ML_DSA_65_ECDSA_P256_SHA512
 
 # Alternative deprecated OIDs. By using the older "rsa" OID this
 # type will be recognized by not normally used.

crypto/objects/objects.txt

@@ -641,6 +641,10 @@ id-alg 2		: id-alg-noSignature
 id-alg 3		: id-alg-dh-sig-hmac-sha1
 id-alg 4		: id-alg-dh-pop
 
+# Composite signature algorithms (draft-ietf-lamps-pq-composite-sigs)
+id-alg 42	: id-mldsa65-rsa3072-pkcs15-sha512		: ML-DSA-65-RSA3072-PKCS15-SHA512
+id-alg 45	: id-mldsa65-ecdsa-p256-sha512			: ML-DSA-65-ECDSA-P256-SHA512
+
 # CMC controls
 id-cmc 1		: id-cmc-statusInfo
 id-cmc 2		: id-cmc-identification

fuzz/oids.txt

@@ -1350,3 +1350,5 @@ OBJ_HKDF_SHA512="\x2A\x86\x48\x86\xF7\x0D\x01\x09\x10\x03\x1E"
 OBJ_id_smime_ori="\x2A\x86\x48\x86\xF7\x0D\x01\x09\x10\x0D"
 OBJ_id_smime_ori_kem="\x2A\x86\x48\x86\xF7\x0D\x01\x09\x10\x0D\x03"
 OBJ_id_alg_hss_lms_hashsig="\x2A\x86\x48\x86\xF7\x0D\x01\x09\x10\x03\x11"
+OBJ_ML_DSA_65_RSA3072_PKCS15_SHA512="\x2B\x06\x01\x05\x05\x07\x06\x2A"
+OBJ_ML_DSA_65_ECDSA_P256_SHA512="\x2B\x06\x01\x05\x05\x07\x06\x2D"

include/openssl/obj_mac.h

@@ -1965,6 +1965,16 @@
 #define NID_id_alg_dh_pop               326
 #define OBJ_id_alg_dh_pop               OBJ_id_alg,4L
 
+#define SN_ML_DSA_65_RSA3072_PKCS15_SHA512              "id-mldsa65-rsa3072-pkcs15-sha512"
+#define LN_ML_DSA_65_RSA3072_PKCS15_SHA512              "ML-DSA-65-RSA3072-PKCS15-SHA512"
+#define NID_ML_DSA_65_RSA3072_PKCS15_SHA512             1502
+#define OBJ_ML_DSA_65_RSA3072_PKCS15_SHA512             OBJ_id_alg,42L
+
+#define SN_ML_DSA_65_ECDSA_P256_SHA512          "id-mldsa65-ecdsa-p256-sha512"
+#define LN_ML_DSA_65_ECDSA_P256_SHA512          "ML-DSA-65-ECDSA-P256-SHA512"
+#define NID_ML_DSA_65_ECDSA_P256_SHA512         1503
+#define OBJ_ML_DSA_65_ECDSA_P256_SHA512         OBJ_id_alg,45L
+
 #define SN_id_cmc_statusInfo            "id-cmc-statusInfo"
 #define NID_id_cmc_statusInfo           327
 #define OBJ_id_cmc_statusInfo           OBJ_id_cmc,1L

providers/common/der/build.info

@@ -86,6 +86,19 @@ IF[{- !$disabled{'ml-dsa'} -}]
   DEPEND[$DER_ML_DSA_H]=oids_to_c.pm ML_DSA.asn1
 ENDIF
 
+#----- composite
+IF[{- !$disabled{'ml-dsa'} -}]
+  $COMPOSITE_H=$INCDIR/composite.h
+  $DER_COMPOSITE_GEN=der_composite_gen.c
+
+  GENERATE[$COMPOSITE_H]=$INCDIR/composite.h.in
+  DEPEND[$COMPOSITE_H]=oids_to_c.pm composite.asn1
+
+  GENERATE[$DER_COMPOSITE_GEN]=der_composite_gen.c.in
+  DEPEND[$DER_COMPOSITE_GEN]=oids_to_c.pm composite.asn1
+  DEPEND[${DER_COMPOSITE_GEN/.c/.o}]=$COMPOSITE_H
+ENDIF
+
 #----- KEY WRAP
 $DER_WRAP_H=$INCDIR/der_wrap.h
 $DER_WRAP_GEN=der_wrap_gen.c
@@ -165,6 +178,10 @@ IF[{- !$disabled{'slh-dsa'} -}]
   $COMMON = $COMMON $DER_SLH_DSA_GEN $DER_SLH_DSA_AUX
 ENDIF
 
+IF[{- !$disabled{'ml-dsa'} -}]
+  $COMMON = $COMMON $DER_COMPOSITE_GEN
+ENDIF
+
 SOURCE[../../libcommon.a]= $COMMON
 SOURCE[../../libfips.a]= $DER_RSA_FIPSABLE
 SOURCE[../../libdefault.a]= $DER_RSA_FIPSABLE $NONFIPS

providers/common/der/composite.asn1

@@ -0,0 +1,15 @@
+-- Copyright 2026 The OpenSSL Project Authors. All Rights Reserved.
+--
+-- Licensed under the Apache License 2.0 (the "License").  You may not use
+-- this file except in compliance with the License.  You can obtain a copy
+-- in the file LICENSE in the source distribution or at
+-- https://www.openssl.org/source/license.html
+
+-- -------------------------------------------------------------------
+
+-- Taken from https://datatracker.ietf.org/doc/draft-ietf-lamps-pq-composite-sigs/
+
+sigAlgs OBJECT IDENTIFIER ::= { 1 3 6 1 5 5 7 6 }
+
+id-mldsa65-rsa3072-pkcs15-sha512 OBJECT IDENTIFIER ::= { sigAlgs 42 } 
+id-mldsa65-ecdsa-p256-sha512 OBJECT IDENTIFIER ::= { sigAlgs 45 } 

providers/common/der/der_composite_gen.c.in

@@ -0,0 +1,21 @@
+/*
+ * {- join("\n * ", @autowarntext) -}
+ *
+ * Copyright 2026 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include "prov/composite.h"
+
+/* Well known OIDs precompiled */
+/* clang-format off */
+{-
+    $OUT = oids_to_c::process_leaves('providers/common/der/composite.asn1',
+                                     { dir => $config{sourcedir},
+                                       filter => \&oids_to_c::filter_to_C });
+-}
+/* clang-format on */

providers/common/include/prov/composite.h.in

@@ -0,0 +1,55 @@
+/*
+ * {- join("\n * ", @autowarntext) -}
+ *
+ * Copyright 2026 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#ifndef PROV_COMPOSITE_H
+#define PROV_COMPOSITE_H
+
+#include "internal/der.h"
+#include "crypto/ml_dsa.h"
+#include "prov/provider_ctx.h"
+
+#define COMPOSITE_PREFIX "436F6D706F73697465416C676F726974686D5369676E61747572657332303235"
+
+/* Well known OIDs precompiled */
+/* clang-format off */
+{-
+    $OUT = oids_to_c::process_leaves('providers/common/der/composite.asn1',
+                                     { dir => $config{sourcedir},
+                                       filter => \&oids_to_c::filter_to_H });
+-}
+/* clang-format on */
+
+typedef struct {
+    ML_DSA_KEY *ml_dsa_key;
+    EVP_PKEY *classic_key;
+} COMPOSITE_KEY;
+
+typedef struct {
+    OSSL_LIB_CTX *libctx;
+    const char *alg;
+    const unsigned char *oid;
+    size_t oid_sz;
+    uint8_t context_string[255]; /* ML_DSA_MAX_CONTEXT_STRING_LEN */
+    size_t context_string_len;
+    const char *prehash_alg;
+    size_t prehash_len;
+
+    /* CLASSIC */
+    EVP_PKEY_CTX *classic_ctx;
+
+    COMPOSITE_KEY *key;
+} PROV_COMPOSITE_CTX;
+
+COMPOSITE_KEY *ossl_prov_composite_new(PROV_CTX *ctx, const char *propq,
+    int ml_dsa_evp_type);
+void ossl_composite_key_free(COMPOSITE_KEY *key);
+
+#endif /* PROV_COMPOSITE_H */

providers/decoders.inc

@@ -126,6 +126,13 @@ DECODER_w_structure("ML-DSA-65", der, SubjectPublicKeyInfo, ml_dsa_65, yes, "SPK
 DECODER_w_structure("ML-DSA-87", der, SubjectPublicKeyInfo, ml_dsa_87, yes, "SPKItoML-DSA-87-DER"),
 #endif /* OPENSSL_NO_ML_DSA */
 
+#ifndef OPENSSL_NO_COMPOSITE
+DECODER_w_structure("ML-DSA-65-RSA3072-PKCS15-SHA512",        der, PrivateKeyInfo,       mldsa65_rsa3072_pkcs15_sha512,      no, "PKItoMLDSA65-RSA3072-PKCS15-SHA512-DER"),
+DECODER_w_structure("ML-DSA-65-RSA3072-PKCS15-SHA512",        der, SubjectPublicKeyInfo, mldsa65_rsa3072_pkcs15_sha512,      no, "SPKItoMLDSA65-RSA3072-PKCS15-SHA512-DER"),
+DECODER_w_structure("ML-DSA-65-ECDSA-P256-SHA512",            der, PrivateKeyInfo,       mldsa65_ecdsa_p256_sha512,          no, "PKItoMLDSA65-ECDSA-P256-SHA512-DER"),
+DECODER_w_structure("ML-DSA-65-ECDSA-P256-SHA512",            der, SubjectPublicKeyInfo, mldsa65_ecdsa_p256_sha512,          no, "SPKItoMLDSA65-ECDSA-P256-SHA512-DER"),
+#endif /* OPENSSL_NO_COMPOSITE */
+
 #ifndef OPENSSL_NO_LMS
 DECODER("LMS", xdr, lms, yes, "XDRtoLMS"),
 DECODER_w_structure("LMS", der, SubjectPublicKeyInfo, lms, yes, "SPKItoLMS-DER"),