Create LMS Keys

You can create LMS keys in two formats:

  • Singular

  • Sectorized

Singular LMS Keys

pipsqueak can generate LMS keys using the generate command. The command defaults to ML-DSA, so you must specify that you want to create an LMS key. You do this using the following additional parameters:

  • lmscode and lmotscode: These determine the specific kind of LMS key that will be generated and correspond to the values defined in RFC 8554.

  • expchunk: This determines how the LMS key Merkle tree will be partitioned. This is especially useful for trees with a large height, which can take a long time to generate.

  • expcache: This determines how much of the Merkle tree to store for future use when loading the key. This avoids expensive recalculation of parts of the Merkle tree that might not be in use.

  • expcards and explease: These determine whether LMS keys will be Sectorized LMS Keys. When both are zero, which is the default, all signatures associated with the LMS key will be assigned to the nShield HSM where the key was generated. This is more secure, but if the nShield HSM fails then all remaining signatures will be lost.

You can only use module protection for LMS keys. Softcard and OCS card protection is not currently supported.

  1. Generate a singular LMS key:

    ./pipsqueak generate alias=test-lms algorithm=lms lmscode=sha256_m32_h5 lmotscode=sha256_n32_w8
    Example output 
    PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
Generate LMS key started: test-lms (0.002 seconds)
  chunk: test-lms (0.316 seconds) 4 remaining
  chunk: test-lms (0.245 seconds) 3 remaining
  chunk: test-lms (0.250 seconds) 2 remaining
  chunk: test-lms (0.250 seconds) 1 remaining
  chunk: test-lms (0.010 seconds) 0 remaining
Public key (alias: test-lms):
  00000005 00000004 32345290 ee7b23cd 95f535ac 59cc8f34 6b4004d1 94236988
  b3439180 b273eeb9 5813bc40 25d21588 0c6a09b3 cdbd1fbd

  2. List available keys:

    ./pipsqueak list

```
PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
Available Keys:
  test-lms LMS

  3. Create an LMS signature:

    ./pipsqueak alias=test-lms message=test
    Example output 
    PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
Public key (alias: test-lms):
  00000005 00000004 32345290 ee7b23cd 95f535ac 59cc8f34 6b4004d1 94236988
  b3439180 b273eeb9 5813bc40 25d21588 0c6a09b3 cdbd1fbd
Message (test):
  74657374
Signature (alias: test-lms, size: 1292, time: 0.018):
  00000003 00000004 cde06ca3 fe784329 22f6d3ef 3d34a20a b4fbe886 5b5e8413
  ba1851b1 54c09d11 b41ddeef c3a30966 350a23c1 be609294 5baa5489 55364b17
  7a29b75c e61175e6 ebb195db 9cab2d3e 0ac11f78 a9ef6d65 5364071c 37879bcd
  ca5c50c7 8061b93a 4d7869c2 f3946553 8d2e8330 8a35e778 016bf187 cc2b3faa
  a3c4d178 4e1e08df 3e784958 d613571a 5604bdc6 cd5dd11a d3767c62 9f675abf
  135b37fe 56bc351a 598e5b72 fc3e0b88 2ad78af5 b1e4bf6f 0f274aa5 31d4ff54
  9eaee715 28a7f59b b437f42e 0fb88b11 e414fb84 5c5b4fe4 f4553499 ffcf80bd
  a2f640bc 01b3e9a9 3e46a0c4 392b3b7c 23a676c5 3b63014e 2377e8e1 49d0dd10
  1a689f4f ffc44389 da34469f ab9ded46 09a2a92b eb0fb093 6a552d74 9ab91780
  ff69fce4 757bc52a 4a0a84ba 8abc4704 c75cd4b6 54cfaea6 9175230a 46dcfcd2
  28cc99a8 55c7b837 7580f435 4e6b448b 8bcbee94 5f50fd0a d5fdd0bb 7d813bc0
  0d4f702f dd0dda22 17ee771a 5de0e19d 73a037fb 8f2e6ac1 cb334f3c 7af39aa6
  eb62c6ad dd3df983 68f47d1d f3fac585 9198b508 1f8267a9 a87f8282 1c27b800
  2e8134ff e87c72c6 2633e135 d09013fd 81c777fa ff65953b 30346cbb 6f1e09d0
  d460308d aa835c07 39268e67 d169bcfc 6f83ba52 05c78aa3 26d54f94 53b8681e
  ba144ce0 db191db1 1c88f77d 4899ae13 3dd2b2c7 d18dd5d4 35fc9f54 d817b4d4
  b68613ea c7e8eb40 4f2930ed f2f6fea9 669c4e91 b05c3758 33f242c7 e4cd11b7
  df0e1cda 3e600e93 c5c08e11 96cee473 648cbb31 975c6b23 a4d6a51d aec1341d
  4f7dda8e 1814e7cb 71f0f82d d64c1e86 2686d8e1 4f2e9c04 f6c259c6 d9454b34
  04e87b11 383b5aa0 8d8ec976 06e5993c 41afa0ef 60d51e5c 2e4c65a3 a56b7118
  93e0a657 91c2602f bd231e6c e4c3ec3a 3af16461 4af9afc0 c19bcea9 4a5d9ee7
  8b57433c 724b6eb5 c4996f3c cf975407 38ea4c65 76570e12 aca86caa f2766fdd
  7bf164f9 618afa62 78e798d7 0a72d8b3 84657fdf 5925c9d4 128e6a89 957202fa
  0bf32def 4439b704 a8d9f004 fcf5f628 be4e833f d3d7f646 e773278f c99d9d14
  4e711a8f c967bb94 fe435691 45537c80 68fb5b1c abd24177 d57dc473 c8fdf8c1
  f67b9394 6d57905f f619608f ac7f1ec5 70b3d400 3fde29a5 498bf007 cbf6bcc2
  93aee25f 7338b4aa 52922c47 fc68b5d9 fff1c165 a90bb320 7e4d0523 6ed7ba94
  d03e5627 fa1fdf09 75d93724 c5f5ee3d a112456e cd41968b da0eb254 e5103787
  3e918f8b 64feeda7 9fc80fb7 923347bd 3e742578 cf5039e9 ffd8d596 c16a0ead
  dd0888fd e1adeb31 b744200a 3fb368b0 9021cc7a 44b3de85 d1395ace 261b845a
  a900756b a129f3fa a885f40a 453c7783 482ef060 c743fa94 0104175a ccbc4849
  cc75d233 9305b241 04b30f3b be7ae48a b12ea5b4 ed466f67 b96af4d0 c754f020
  d2ea73cf ec5fe52a ae2ca1fb eba6d9aa 2db47944 458fcafd 4bc5fd94 5e1ad494
  a919e4ec 6f723793 ac0dd16d 93c07fe7 b3a34bb3 9a5dc336 885bfd33 ef72fea5
  6e1399af bf9091c5 3d72bf03 458f9716 d61300b4 9ac98c7a 9f174c01 2b24ae68
  f56786a9 e27898f3 00000005 0d83249a 5f25e276 cc03e074 314f5194 8b4e6c47
  a75cbdeb 1fc87c9f 8c6776b9 69299a8a 47ecadd9 a6617052 edf4722d f0faef11
  ad8ddd84 1afa5ca9 c0d8d20a fa020143 9b6140cb 84a83989 32c8ac71 15aef0df
  8a9a73a6 a6b420ae a7894abf 50f686f0 0e3f7b3d de77b80c 59e7b5a1 fc90b250
  f2b96fde 637f5095 03889250 74f40760 2cb68947 f2f7f618 6093e36c ccd0092d
  0aa2a005 9a60eea8 6300875b
Verify (alias: test-lms, time: 0.013): true

  4. Create an LMS signature for a message stored in a file.

    In this example, the message to be signed is stored in a file. The signature is written to a file.

    • Linux

      echo "hello world" > /tmp/message.txt
./pipsqueak alias=test-lms msgfile=/tmp/message.txt sigfile=/tmp/message.sig

    • Windows

      mkdir c:\tmp
echo "hello world" > c:\tmp\message.txt
./pipsqueak alias=test-lms msgfile=c:\tmp\message.txt sigfile=c:\tmp\message.sig
    Example output 
    PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
Public key (alias: test-lms):
  00000005 00000004 32345290 ee7b23cd 95f535ac 59cc8f34 6b4004d1 94236988
  b3439180 b273eeb9 5813bc40 25d21588 0c6a09b3 cdbd1fbd
Message (/tmp/message.txt):
  68656c6c 6f20776f 726c640a
Signature (alias test-lms, size: 1292, time: 0.019)
  written to /tmp/message.sig
Verify (alias: test-lms, time: 0.012): true
    Verification does not consume a signature or decrease the remaining signature count.

  5. Test that verification fails if the file contents change:

    1. Change the contents of the message.txt file:

      • Linux

        echo "Fail Signature" >> /tmp/message.txt

      • Windows

        echo "Fail Signature" >> c:\tmp\message.txt

    2. Attempt to verify the file.

      It should fail.

      ./pipsqueak alias=test-lms msgfile=/tmp/message.txt verify=/tmp/message.sig

PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
Public key (alias: test-lms):
  00000005 00000004 32345290 ee7b23cd 95f535ac 59cc8f34 6b4004d1 94236988
  b3439180 b273eeb9 5813bc40 25d21588 0c6a09b3 cdbd1fbd
2026-02-11T15:43:43 lms_public_verify[hsslms.c:2463] VerifyFailed(11): expected 6b4004d1:94236988:b3439180:b273eeb9:5813bc40:25d21588:0c6a09b3:cdbd1fbd but computed 6995fff9:f101e5d0:1cadd5dd:8b67be4c:e5a65fb3:2e8d1a0e:63814c29:039b1ccc
ERROR: verify failed

  6. Check how many signatures remain:

    ./pipsqueak showinfo alias=test-lms

PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
  5F08-02E0-D947
Alias: test-lms
Algorithm: LMS
 sha256_m32_h5 sha256_n32_w8
  Remaining: 28 signatures
Public key (alias: test-lms):
  00000005 00000004 32345290 ee7b23cd 95f535ac 59cc8f34 6b4004d1 94236988
  b3439180 b273eeb9 5813bc40 25d21588 0c6a09b3 cdbd1fbd

Sectorized LMS Keys

Setting expcards, explease, or both to a nonzero value creates a sectorized LMS key. The sum of these values must be less than or equal to the height (h value) of the key.

The sum of explease and expcards cannot be greater than h.

The user is prompted to insert two raised to the power of expcards blank cards.

For example:

  • If expcards is one the user must supply two blank cards.

  • If expcards is two the user must supply four blank cards.

  • If expcards is three the user must supply eight blank cards.

Each of these cards can be used for provisioning two raised to the power of explease times in total. As before, if explease is one, each card can be used twice. If explease is two, each card can be used four times. If explease is three, each card can be used eight times, and so on.

explease can be zero if expcards is greater than zero, in which case each card will be exhausted after the first use.

The remaining height (h minus expcards minus explease) determines how many signatures are provided with each lease provision operation. For example, an h10 key with expcards set to 1 and explease set to 3 uses two smart cards. Each card can be used eight times, and each provisioning operation provides 64 signatures: 2 raised to the power of ten minus one minus three, or 210-1-3.

Immediately after a sectorized key generation, no nShield HSMs can create signatures with the new key.

To create a sectorized LMS Key, use pipsqueak generate.

For example, assuming h = 5:

  • 2 smart cards: (expcards=1 means 2¹)

    • Each card can be used 8 times: (explease=3 means 2³)

    • Each provision will provide 2 signatures: 25-1-3 = 2² = 2 signatures

      ./pipsqueak generate alias=test-lms algorithm=lms lmscode=sha256_m32_h5 lmotscode=sha256_n32_w8 expcards=1 explease=3

  • 4 smart cards: (expcards=2 means 2²)

    • Each card can be used 2 times: (explease=1 means 2¹)

    • Each provision will provide 2 signatures: 2 ^ (5 - 2 - 1 ) = 4 signatures

      ./pipsqueak generate alias=test-lms algorithm=lms lmscode=sha256_m32_h5 lmotscode=sha256_n32_w8 expcards=2 explease=1

  • 1 smart card: (expcards=0)

    • The card can be used 4 times: (explease=2 means 2²)

    • Each provision will provide 8 signatures: 2 ^ (5 - 0 - 2 ) = 8 signatures

      ./pipsqueak generate alias=test-lms algorithm=lms lmscode=sha256_m32_h5 lmotscode=sha256_n32_w8 expcards=0 explease=2

See the following reference table for more information:

h expcards Total cards explease Leases per card Total leases Signatures per lease Total signatures

5

0

1

3

8

8

4

32

10

0

1

3

8

8

128

1024

15

0

1

3

8

8

4096

32768

20

0

1

3

8

8

131072

1048576

5

1

2

2

4

8

4

32

10

1

2

3

8

16

64

1024

15

1

2

3

8

16

2048

32768

20

1

2

3

8

16

65536

1048576

10

3

8

3

8

64

16

1024

15

3

8

3

8

64

512

32768

20

3

8

3

8

64

16384

1048576

  • Total cards = 2expcards

  • Leases per card = 2explease

  • Total leases = Leases per card * Total cards

  • Signatures per lease = 2(h-expcards-explease)

  • Total signatures = Signatures per lease * Total leases

If the combined explease and expcards values exceed the height (h), the pipsqueak generate command fails. In the following example, the height is 5, expcards is 4, and explease is 3:

./pipsqueak generate alias=test-lms algorithm=lms lmscode=sha256_m32_h5 lmotscode=sha256_n32_w8 expcards=4 explease=3

PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
Generate LMS key started: test-slms (0.002 seconds)
2026-02-11T20:58:01 continueLMS_cache_next[see-commands.c:532] InvalidParameter(24): private key tree height is less than the sum of card and lease exponents (5 < 4 + 3) in continueLMS_cache_next
ERROR: continueLMS failed on chunk
LMS key requires 16 cards

Sectorized Key Lifecycle

The lifecycle of a sectorized key is as follows:

  1. Key creation

  2. Generate a key with some number of cards and leases.

  3. Load a lease into the HSM with pipsqueak provesn.

  4. Use the signatures by calling the HSM or using pipsqueak.

  5. Signing with the HSM will stop working when it runs out of signatures.

  6. The key cannot be used until another lease is provisioned.

  7. When the HSM can no longer sign, use the card to provision another lease and load more signatures for the LMS key into the HSM.

  8. The card runs out leases.
    If there are eight leases per card, the card becomes blank after eight uses.

To create and use a sectorized key:

  1. Format a blank card so that it can be used:

    slotinfo --format --ignoreauth -m1 -s2

  2. Ensure the card is inserted.

  3. Create a sectorized LMS key using pipsqueak generate.

    For example, to configure the LMS key as one card, two uses, and 16 signatures:

    ./pipsqueak generate alias=sec-lms algorithm=lms lmscode=sha256_m32_h5 lmotscode=sha256_n32_w8 expcards=0 explease=1
    Example output 
    PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
Generate LMS key started: sec-lms (0.004 seconds)
  chunk: sec-lms (0.247 seconds) 4 remaining
  chunk: sec-lms (0.245 seconds) 3 remaining
  chunk: sec-lms (0.247 seconds) 2 remaining
  chunk: sec-lms (0.273 seconds) 1 remaining
  chunk: sec-lms (0.002 seconds) 0 remaining
LMS key requires 1 card
Attempting to write to card in slot 2...
Card processed (0 remaining)
Public key (alias: sec-lms):
  00000005 00000004 81908b48 36be539b fc553a0e 720c695c 7d62e3b1 957663b4
  aa46dfd3 de008a62 ddf4a720 f8eb89cd fbadc6ca db93e2e2

    In this example, the key is named sec-lms to indicate that it is sectorized.

    If you attempt to create a signature now, it will fail because you need to provision the key from the card to the HSM first.

    ./pipsqueak alias=sec-lms message=test

PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
Public key (alias: sec-lms):
  00000005 00000004 81908b48 36be539b fc553a0e 720c695c 7d62e3b1 957663b4
  aa46dfd3 de008a62 ddf4a720 f8eb89cd fbadc6ca db93e2e2
2026-02-11T16:35:18 dispatch_see_nvmemfile[dispatch.c:837] NotAvailable(73): no HSMs with NVRAM 6c6d737d:62e3b195:7663b4 file
ERROR: sign failed

  4. Provision the key from the card to the HSM by inserting one of the associated smartcards and using pipsqueak with the provesn and slot options:

    ./pipsqueak provesn=5F08-02E0-D947 slot=2

PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
Attempting to provision 5F08-02E0-D947 from slot 2...
Provision successful.

  5. Check how many signatures remain:

    ./pipsqueak showinfo alias=sec-lms

PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
  5F08-02E0-D947
  - Slot 2: ic=3 lms
Alias: sec-lms
Algorithm: LMS
 sha256_m32_h5 sha256_n32_w8
  Remaining: 16 signatures
Public key (alias: sec-lms):
  00000005 00000004 81908b48 36be539b fc553a0e 720c695c 7d62e3b1 957663b4
  aa46dfd3 de008a62 ddf4a720 f8eb89cd fbadc6ca db93e2e2

  6. Create an LMS signature:

    You can do this 16 times before needing to provision again.

    ./pipsqueak alias=sec-lms message=test
    Example output 
    PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
Public key (alias: sec-lms):
  00000005 00000004 81908b48 36be539b fc553a0e 720c695c 7d62e3b1 957663b4
  aa46dfd3 de008a62 ddf4a720 f8eb89cd fbadc6ca db93e2e2
Message (test):
  74657374
Signature (alias: sec-lms, size: 1292, time: 0.021):
  00000000 00000004 33e4b7e7 d7682df7 a7b9a31a 7bc774c0 15f80cec 9c21af35
  4c33d720 7e6d9140 8148c6bd bb74b160 6d696187 0e6d82ff 0e48143a c5ddde5e
  32c34d08 98e011d9 fe2fa2b1 68d0fe27 801dd029 76958b0d 97af07fd fcce6500
  e2376760 00509a62 71f0251a ff0f31b0 e5051e66 ff4d0079 138ca99c 34d3f7d2
  087d1881 47bfa5e2 e8f73c02 18e01e75 f63f5c73 852db8e6 9153f976 084a9718
  4b6ff4c0 745395ca 893b4b58 d1a74c7c 155688bc c11dda1a 232e0a86 5965bae6
  e5cd7d5d e716a446 6eb1c9a1 d5e1472b 0eb59941 ec466e12 3864fd25 5c520537
  61379195 afb67717 313803f0 eaa976d5 10caef40 07b1b013 5f182cbc d9916589
  1cfd60c6 6a2a3a5e a9c6c2ca 5d4c3a25 d8660354 cf8c7775 1e4a5880 7951967e
  02fd55e7 b04f7a2d 573464de c4a7a958 3eb55d03 d887c1b3 94761145 5f1bb42c
  04b4e582 4590ddd8 57fbcf77 91ce5e1b 2bdc979b 83568b2d 1fd3daae c3b95891
  90f37e90 c2c5cc60 3b924cb0 befc7abd ea08ac5b e1235559 4af27a4d 3fb30c43
  865481f0 6cbd72f1 b3ebf0d6 d879ce81 a0add27a 82fdf392 1f15d58f d05bf6ef
  2a162271 d18c7825 f79ec3c3 9ef124a3 2d929206 1df35759 c5de4432 a03c1974
  a46e0bba b63e91a1 9ca9ff21 9b7d07c6 dc394fdb 1aa66cb6 37db4ede d1f0fe61
  e67d2026 ef2adbbb 754e24f4 1a175ecf 7a1225f4 6424d21b 8084dd63 60d9b184
  22d7d3bd ae255cb5 be68df28 bc63475b a3cb2dac 1e353e46 d5814d0a e45fb197
  82f68e34 082663a2 40f1a2a5 1f875047 3c7d0b26 b7875765 7f8eabe0 0ef21d12
  0b4efae2 7fc0441c d3ac09c8 ad3a85ff eef81f30 da1d193f e7b50e52 00de854f
  3b30468a 85f459f4 338cc1a1 094fc765 121e8b92 48e10ab4 c366dd69 771dccd6
  22317de7 c0b4abba 3f9e2435 9fadaa4d 95d8be8f d12d2087 d146255c 26d87839
  6cb44665 29413820 bfc76423 0a6b2634 591d719e 50354c8c c46cf667 3dd7990e
  f76dd8ef f37bcc96 72d374e8 01c3cbca c3c903d0 a1afe2f0 b0b8ece6 3a22f905
  42749315 4110892f 510146eb 284e38d0 87d22838 66334ac5 e02db1ed 9be976ee
  0b31abf6 1a3ff113 5ddc733c 2e103edb 285da6ce 043bb4e5 adc664ae a4e3d40d
  f00891b8 6253d95a 6e855ec7 aa0657fe 733959f5 700cda16 76eb2fe7 e4dd51f0
  a5e21d3d fb5624f6 b1d816ba 48db98b1 f0dc0566 be88a357 107613ba 34de598f
  3f72fdee fe8484cb d9096361 1caede2a c6a67838 c999ae8c 3841a2c3 6f96cb99
  0125af73 2aaf26b5 6a44d1b6 aaac48cf 5b6cdf1f 33353076 a137044e 78087658
  da3c4230 83850c1a 6a1934bc d8658bc1 7ab7597f 5e3bde9c 677101cb 064e5e6b
  42aec66c 6871d26e 149bb1b6 b38f1e8f 7d3e6cde b3bc2c4c 4d8a193e 01fdbe9f
  3cc8985f 139546d4 edc376aa 28184f43 03e0ad86 edb41d85 76b86768 c7f7ed3f
  4874be58 45d50bb1 03868e8f bf8d39e0 41db4124 9a15030b 1d11c39d 8b430152
  9b0da619 531cd368 96065b3a 83120bbc bead562b cc8cec61 99c895c2 568843ac
  5c8e4e92 b85aaed8 b108c844 2961574f 247c50b8 bafc25e4 22352cc1 02788b95
  c8c699b7 4598c017 00000005 3bdf8a8c 949c3493 0079f1f4 2b5dd0e2 af9cfd48
  b10b8c80 79c888a4 750d9e6f 5a6fea41 10ee8371 1e589752 c59d657c 9bc1284a
  b99a1f6d d30a0cae 5f7ed61f db075210 acf8f858 69121eab 04787132 c9ef1dfa
  b515d302 19bb1c78 2edad85e 3e4665f5 a2391be5 11fd5d5c c9ea6dd9 7a1d21e8
  8a46f4a7 77ddaa84 0abfc339 dd9e1495 a7264087 9558d4ba adbda82d 5c68d697
  9ee47fd0 ef256ec3 f89a1c7c
Verify (alias: sec-lms, time: 0.012): true

    When you use the last available signature, subsequent signing attempts display the following message:

    2026-02-11T16:47:20 dispatch_see_nvmemfile[dispatch.c:837] NotAvailable(73): no HSMs with NVRAM 6c6d737d:62e3b195:7663b4 file
Verify (alias: sec-lms, time: 0.001): false

    If you run showinfo again, it will show that there are no remaining signatures:

    ./pipsqueak showinfo alias=sec-lms

PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
  5F08-02E0-D947
  - Slot 2: ic=3 lms
Alias: sec-lms
Algorithm: LMS
 sha256_m32_h5 sha256_n32_w8
  Remaining: 0 signatures
Public key (alias: sec-lms):
  00000005 00000004 81908b48 36be539b fc553a0e 720c695c 7d62e3b1 957663b4
  aa46dfd3 de008a62 ddf4a720 f8eb89cd fbadc6ca db93e2e2

    If you try to sign again, you get an error:

    ./pipsqueak alias=sec-lms message=test

PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
Public key (alias: sec-lms):
  00000005 00000004 81908b48 36be539b fc553a0e 720c695c 7d62e3b1 957663b4
  aa46dfd3 de008a62 ddf4a720 f8eb89cd fbadc6ca db93e2e2
2026-02-11T16:50:18 dispatch_see_nvmemfile[dispatch.c:837] NotAvailable(73): no HSMs with NVRAM 6c6d737d:62e3b195:7663b4 file
ERROR: sign failed

  7. Provision an nShield HSM again by inserting one of the associated smart cards and using pipsqueak with the provesn and slot options:

    ./pipsqueak provesn=5F08-02E0-D947 slot=2

PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
Attempting to provision 5F08-02E0-D947 from slot 2...
Provision successful.

    If you run showinfo again, it indicates that signatures are now available. This is now the second of the two uses.

    ./pipsqueak showinfo alias=sec-lms

PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
Attempting to provision 5F08-02E0-D947 from slot 2...
Provision successful.user@dev-ubuntu:~/pqsdk/pqsdk-1.4.1-win64$ ./pipsqueak showinfo alias=sec-lms
PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
  5F08-02E0-D947
  - Slot 2: ic=3 lms
Alias: sec-lms
Algorithm: LMS
 sha256_m32_h5 sha256_n32_w8
  Remaining: 16 signatures
Public key (alias: sec-lms):
  00000005 00000004 81908b48 36be539b fc553a0e 720c695c 7d62e3b1 957663b4
  aa46dfd3 de008a62 ddf4a720 f8eb89cd fbadc6ca db93e2e2

  8. Sign 16 more times until all signatures are used.

    ./pipsqueak alias=sec-lms message=test

    This exhausts the second use of the card.

  9. Attempt to provision an nShield HSM again.

    This time, you should get an error because the card has run out of leases. You can no longer use the key.

    ./pipsqueak provesn=5F08-02E0-D947 slot=2

PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)
Attempting to provision 5F08-02E0-D947 from slot 2...
2026-02-11T21:48:37 command_see_provisionLMS[see-commands.c:785] UseLimitExceeded(7): no leases remaining on card in command_see_provisionLMS
ERROR: provisionLMS command failed

This concludes the lifecycle of the sectorized key: one card, two provisioning operations, and 16 signatures per operation. The example demonstrated how the card’s available leases are consumed. The card could only be used twice to provision signatures for the key. Each provisioning operation provided 16 signatures.