XMSS^MT: tie the carried-over traversal state to the previous subtree in the index check - #2560

Summary

The XMSS^MT index check added for github #2414 (BDSStateMap.validateIndex) makes one allowance. Where a layer's expected leaf is 0, it also accepts a traversal state on the layer's last leaf, because the state carried over from the previous subtree legitimately stays there until the signer rebuilds it.

The allowance only checks that the state is on a last leaf. It doesn't check that this is the previous subtree's last leaf. As a result, a key saved on the last leaf of a subtree, whose index was then moved back to the first leaf of that same subtree, still passes. That key signs a second message under a one-time key it has already used, and both signatures verify.

Reproduced with bcprov-jdk18on 1.86 (through PrivateKeyFactory, in both the legacy and the RFC 9802 PKCS#8 forms) and with main:

Change

• New check in BDS: isLastLeafOfTree(publicSeed, secretKeySeed, layer, tree) decides whether a state on the last leaf belongs to a given subtree.
  • The last leaf is a right node, so the first node of its authentication path is the leaf before it.
  • That leaf is recomputed from the seeds, at that subtree's address, and compared in constant time.
  • The cost is one WOTS+ public key and one L-tree, and it is paid only when the allowance applies.
• New overloads: BDSStateMap.validate(XMSSMTParameters, long, byte[], byte[]) and validateIndex(XMSSMTParameters, long, byte[], byte[]) take the key's seeds. With the seeds, they accept the carried-over state only when it belongs to subtree tree - 1, and refuse it at tree 0.
• Old overloads kept: the two-argument forms were already public in 1.86, so they stay, with the old behaviour, and are @deprecated.
• Callers moved to the seeded forms:
  • the XMSSMTPrivateKeyParameters constructor (both the decode and the builder paths);
  • toByteArray() and rollKey();
  • XMSSEngine before signing;
  • XmssKeyUtil before writing PKCS#8 (its copy of the secret seed is cleared afterwards).
• Docs: a release-notes entry, plus a note on the allowance in docs/claude/conventions.md.

Tests

• New regression test: XMSSMTPrivateKeyTests.testIndexRollbackToStartOfSubtreeRejected.
  • It moves h=4/d=2 keys back from 3 to 0 and from 7 to 4. Both the raw encoding and PKCS#8 must refuse the result.
  • The keys as saved must still decode both ways and sign verifiably.
  • It fails on main without this change ("no exception on index 3 moved back to 0").
• Existing tests: all 224 tests in org.bouncycastle.crypto.signers.xmss.AllTests pass. They include testEveryIndexRoundTrips and the index enumeration tests, which decode at every index of a key and so exercise the allowance at each legitimate boundary.