The RFC suggests root||pubseed (in algorithm 10); note that
this choice does not influence interoperability.
Thanks go to Rafael Misoczki for bringing this up.
Previous code allocated an array on the stack of mlen bytes, but
it should be possible to also sign heap-space messages. By relying
on the fact that sm and m fit the message + signature, we move
the message so that 4*n bytes of prefix can be added.
This allows different backends to store additional state information
in the secret key while the rest of the codebase remains agnostic.
In particular, this prepares for a common xmss_core.h API for both
the standard and the BDS-traversal-based implementations.
This produced repeated indices when reaching 2^32 signatures.
This was introduced in 9b35b00d98
with the re-introduction of runtime parameters. Compile-time parameters
did not contain this error.
This greatly reduces the memory comsumption of the auth path
computation, since it now also uses treehash. It prevents
duplicate code by re-using the treehash function.
A downside is that it does also pick out the authentication path
during key generation (while it is not used), but this cost is
negligible.
