XMSS raw_private_key() does not return correct number of bytes

[ChristianC244]

Good day,
I'm using XMSS in a simple test for signature generation and I wanted to save the byte array of the secret key for testing/researching purpouses.
The PrivateKey class has a function raw_private_key() that returns a custom format different from the one in the RFC which makes sense. The problem is that by documentation of the function it says that it should return 12 + 4n bytes. I'm testing with XMSS_SHA2_10_256 and XMSS_SHAKE_10_256 and I was expecting 140B, yet I only get 137.
I'm using such function because, from PrivateKey documentation, if I want to recreate the object i need to pass such key in the constructor.

The test code is this simple script:

auto params = Botan::XMSS_Parameters::XMSS_SHA2_10_256;
auto rng = Botan::System_RNG();
Botan::XMSS_PrivateKey private_key(params, rng);
std::vector<uint8_t> sk = unlock(private_key.raw_private_key()); // here sk len is 137B

Thank you

[randombit]

I think the documentation here is just outdated/incorrect. Since we adopted the multitarget attack countermeasure recommended in NIST SP800-208, keys have been marked with an extra byte indicating which form they are in (#3413). Outside of the length being unexpected are you having any problems using the key?

Where specifically did you see something that suggested "12 + 4*n"? I can't find anything in the XMSS headers or in the documentation.

[ChristianC244]

I was able just to try with the test vector taken from the tests of this repository and it worked, but I wanted to be able to use the key as described in the specs (NIST SP 800-208 and RFC8391).
I noted that the secret key in RFC8391 is 4+4*n Bytes long while in the NIST is made of LayerAddress || TreeAddress prepended before the key as defined by the RFC (i.e., 12B longer). Therefore, I was implementing some function to convert the keys in the different formats.

From what you say the internal key used in botan is made of OID (4) || root_node (n) || SEED (n) || Idx (x) || prf_seed (n) || private_seed (n) || extra byte (1). Idx could be 4B (by rfc) or more based on the implementation of multi-tree, but in this case must be 4B to match the length of the sk of 137B (considering n=32). Is this reasoning correct?

The "12 + 4n" description of the length is specified here:

botan/src/lib/pubkey/xmss/xmss.h

Lines 241 to 249 in 2c5ea09

	/**
	* Generates a non standartized byte sequence representing the XMSS
	* private key.
	*
	* @return byte sequence consisting of the following elements in order:
	* 4-byte OID, n-byte root node, n-byte public seed,
	* 8-byte unused leaf index, n-byte prf seed, n-byte private seed.
	**/
	secure_vector<uint8_t> raw_private_key() const;

It is probably outdated as you stated.

Thank you