XMSS (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.pqc.crypto.xmss

## Class XMSS

- java.lang.Object
- - org.bouncycastle.pqc.crypto.xmss.XMSS

-     public class XMSS
      extends java.lang.Object

  XMSS.

- - ### Constructor Summary

    Constructors
    Constructor and Description
    `XMSS(XMSSParameters params, java.security.SecureRandom prng)` XMSS constructor...

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `XMSSPrivateKeyParameters` | `exportPrivateKey()` Export XMSS private key.
    `XMSSPublicKeyParameters` | `exportPublicKey()` Export XMSS public key.
    `void` | `generateKeys()` Generate a new XMSS private key / public key pair.
    `int` | `getIndex()` Getter XMSS index.
    `XMSSParameters` | `getParams()` Getter XMSS params.
    `XMSSPrivateKeyParameters` | `getPrivateKey()`
    `byte[]` | `getPublicSeed()` Getter XMSS public seed.
    `byte[]` | `getRoot()` Getter XMSS root.
    `protected org.bouncycastle.pqc.crypto.xmss.WOTSPlus` | `getWOTSPlus()` Getter WOTS+.
    `void` | `importState(byte[] privateKey, byte[] publicKey)` Import XMSS private key / public key pair.
    `void` | `importState(XMSSPrivateKeyParameters privateKey, XMSSPublicKeyParameters publicKey)`
    `protected void` | `setIndex(int index)`
    `protected void` | `setPublicSeed(byte[] publicSeed)`
    `protected void` | `setRoot(byte[] root)`
    `byte[]` | `sign(byte[] message)` Sign message.
    `boolean` | `verifySignature(byte[] message, byte[] signature, byte[] publicKey)` Verify an XMSS signature.
    `protected org.bouncycastle.pqc.crypto.xmss.WOTSPlusSignature` | `wotsSign(byte[] messageDigest, org.bouncycastle.pqc.crypto.xmss.OTSHashAddress otsHashAddress)` Generate a WOTS+ signature on a message without the corresponding authentication path

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### XMSS

          public XMSS(XMSSParameters params,
                      java.security.SecureRandom prng)

      XMSS constructor...
      Parameters:
        `params` - XMSSParameters.

  - ### Method Detail

    - #### generateKeys

          public void generateKeys()

      Generate a new XMSS private key / public key pair.

    - #### importState

          public void importState(XMSSPrivateKeyParameters privateKey,
                                  XMSSPublicKeyParameters publicKey)

    - #### importState

          public void importState(byte[] privateKey,
                                  byte[] publicKey)

      Import XMSS private key / public key pair.
      Parameters:
        `privateKey` - XMSS private key.
        `publicKey` - XMSS public key.

    - #### sign

          public byte[] sign(byte[] message)

      Sign message.
      Parameters:
        `message` - Message to sign.
      Returns:
        XMSS signature on digest of message.

    - #### verifySignature

          public boolean verifySignature(byte[] message,
                                         byte[] signature,
                                         byte[] publicKey)
                                  throws java.text.ParseException

      Verify an XMSS signature.
      Parameters:
        `message` - Message.
        `signature` - XMSS signature.
        `publicKey` - XMSS public key.
      Returns:
        true if signature is valid false else.
      Throws:
        `java.text.ParseException`

    - #### exportPrivateKey

          public XMSSPrivateKeyParameters exportPrivateKey()

      Export XMSS private key.
      Returns:
        XMSS private key.

    - #### exportPublicKey

          public XMSSPublicKeyParameters exportPublicKey()

      Export XMSS public key.
      Returns:
        XMSS public key.

    - #### wotsSign

          protected org.bouncycastle.pqc.crypto.xmss.WOTSPlusSignature wotsSign(byte[] messageDigest,
                                                                                org.bouncycastle.pqc.crypto.xmss.OTSHashAddress otsHashAddress)

      Generate a WOTS+ signature on a message without the corresponding authentication path
      Parameters:
        `messageDigest` - Message digest of length n.
        `otsHashAddress` - OTS hash address.
      Returns:
        XMSS signature.

    - #### getParams

          public XMSSParameters getParams()

      Getter XMSS params.
      Returns:
        XMSS params.

    - #### getWOTSPlus

          protected org.bouncycastle.pqc.crypto.xmss.WOTSPlus getWOTSPlus()

      Getter WOTS+.
      Returns:
        WOTS+ instance.

    - #### getRoot

          public byte[] getRoot()

      Getter XMSS root.
      Returns:
        Root of binary tree.

    - #### setRoot

          protected void setRoot(byte[] root)

    - #### getIndex

          public int getIndex()

      Getter XMSS index.
      Returns:
        Index.

    - #### setIndex

          protected void setIndex(int index)

    - #### getPublicSeed

          public byte[] getPublicSeed()

      Getter XMSS public seed.
      Returns:
        Public seed.

    - #### setPublicSeed

          protected void setPublicSeed(byte[] publicSeed)

    - #### getPrivateKey

          public XMSSPrivateKeyParameters getPrivateKey()