XMSS SHAKE256 not aligned with NIST

[rosualinpetru]

Dear maintainers,

NIST has selected the following set of parameters for SHAKE256. The digest size is set to 32 (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-208.pdf).

At the moment, I expect the implementation follows RFC8391 (https://datatracker.ietf.org/doc/html/rfc8391#section-5.3) which precedes the NIST SP.

Can the code be updated to return 32 instead of 64 also for SHAKE256?

bc-java/core/src/main/java/org/bouncycastle/pqc/crypto/xmss/XMSSUtil.java

Line 287 in 126ac9e

public static int getDigestSize(Digest digest)

[roy-basmacier]

@rosualinpetru
Changing it to return 32 instead of 64 would break backward compatibility with the RFC. I've added the SP 800-208 parameter sets (SHA-256/192, SHAKE256/256, SHAKE256/192) for both XMSS and XMSS^MT. The existing RFC 8391 parameter sets are unchanged for backward compatibility.