This caused secret key files to become close to MAXINT bytes, as
the unsigned int that is the private key size would be subtracted
from MAXINT when its negative was used as offset.

The current code results in the same output regardless of endianness.
Verified using a QEMU VM to emulate MIPS.

The variable sm should contain the signature and the message,
not the message and the signature (i.e. the order is crucial).

By prefixing with XMSS_, we hopefully prevent conflicts

This makes it easier to mix and match with other implementations
for compatibility testing.

Previously this was generated and thus gitignored

Using global defines for parameters (as seems to be typical in
academic crypto code) does not play nice with multithreading at all.

The defined-parameters branch should be the new leading branch,
as it supersedes master. This merge is performed using --strategy ours
as there are numerous conflicting changes regarding the different ways
in which SHA3 was added. The master branch is considered to not contain
anything of value that is not contained in the defined-parameters branch.

Prior to merging, the defined-parameters branch was rebased to prevent
the cherry-picked commits from showing up twice.

This also performs numerous consistency fixes

A large number of functions was repeated in xmss_fast; these are now
shared between the two implementations via the xmss_commons file.
Notably, we ensure compatability by sharing the verification functions.

This starts a cleanup / refactor, but there is still some low-hanging fruit.

Versions are incompatible due to different address formats and differing message compression!

Merge branch 'master' of bitbucket.org:ahuelsing/xmss_ref

The bug occured for cases where d=3 and indicated
a lack of updates. Re-implementing the higher-level
structure of BDS resolved this.