1. Hash-Based Signatures Update and Batch Message SigningF R G
Hash-Based Signatures Update and Batch Message Signing
David McGrew, Scott Fluhrer, Michael Curcio, Panos Kampanakis

2. HBS Quick Recap Good Bad Standards development
Relies on only one security conjecture
Given Y=SHA256(X), attacker cannot find X
Can be postquantum secure
Bad
Big signatures, big key generation time
Stateful signing
Standards development
CFRG, ETSI, NIST
11/13/16
IETF97

3. One-Time Signatures Merkle Hierarchical Merkle 1 Signature 2144 Bytes
11/13/16
IETF97

4. One-Time Signatures Merkle Hierarchical Merkle 1 Signature 2144 Bytes
11/13/16
IETF97

5. One-Time Signatures Merkle Hierarchical Merkle 1 Signature 2144 Bytes
11/13/16
IETF97

6. One-Time Signatures Merkle Hierarchical Merkle LMOTS LMS HSS
2144 Bytes
220 Signatures
2828 Bytes
240 Signatures
5727 Bytes
LMOTS
LMS
HSS
11/13/16
IETF97

7. Issues and Solutions for Private State Management
State Management for Hash Based Signatures,
McGrew, Kampanakis, Fluhrer, Gazdag, Butin, Buchmann,
to appear at Security Standardization Research (SSR) 2016.
11/13/16
IETF97

8. Managing Private Key State
Disk
Cache
File
System
Cache KN KN M
write KN+1
KN+1 ok
sign M with KN
KN+1
11/13/16
IETF97

9. N-time Signatures with ReservationKN MN
write KN+R
KN+R ok
sign MN with KN
MN+1
sign MN+1 with KN+1
MN+2
sign MN+2 with KN+2
11/13/16
IETF97

10. Hierarchical Signatures and Reservation
Nonvolatile
Volatile
11/13/16
IETF97

11. Hierarchical Signatures and Reservation
Synchronization delay
Synchronization failure
Unintended cloning
Nonvolatile
Volatile
11/13/16
IETF97

12. Vulnerability: Unintended Cloning
1011
0110
1011
0110
1011
0110
Clone
or Restore
Snapshot
or Backup
1011
0110
11/13/16
IETF97

13. Stateless Hash Based Signatures
Idea: avoid security issues with state management
Bernstein et. al. SPHINCS: Practical Stateless Hash-Based Signatures, EUROCRYPT 2015
Huge signatures (45KB)
Huge key generation time
11/13/16
IETF97

14. Hybrid Signatures Stateless N1-time signature method
Stateful N2-time signature method
N1 x N2 time signature method with no backup vulnerability
Hierarchical Signatures with Stateless Root, McGrew and Fluhrer, preprint, 2016.
11/13/16
IETF97

15. Draft-mcgrew-hash-sigs-05 History
00 - Originally based on Merkle’s original work 03 - Used as basis of XMSS draft 04 - Evolved to use Leighton and Micali’s 1995 patent 05 - Added volatile level requirement - Made it possible to use hybrid (stateless root) - Identifiers are now independent at each hierarchical level - Postquantum secure parameters only - Github implementation
11/13/16
IETF97

16. Comparison XMSS HSS/LMS Moving to RFC Provably secure Cathedral
Concrete security model, asymptotic analysis
Cathedral
HSS/LMS
Evolving to meet emerging requirements
Provably secure (though proof incomplete)
Random oracle model
(Optional) PRF generation of OTS private keys
Bazaar
draft-huelsing-cfrg-hash-sig-xmss
draft-mcgrew-hash-sigs
11/13/16
IETF97

17. Criteria and Comparison
HLMS
XMSS
Number of signatures
Signature size B B (98%)
Signature generation time (300%)
Allows hybrid Yes No
11/13/16
IETF97

18. Parameter Choices Values Effect LMOTS LMOTS_SHA256_N32_W1
Signature size versus time
LMS
LMS_SHA256_M32_H5
LMS_SHA256_M32_H10
LMS_SHA256_M32_H15
LMS_SHA256_M32_H20
Number of signatures versus key generation time
HSS
2, 3, 4, 5, 6, 7, 8
Number of signatures versus signature sizes
11/13/16
IETF97

19. Anti-Copying Token in Private Key Files
def check_string(path): return H(os.path.abspath(path)) def verify_check_string(path, buffer): if buffer[0:32] != check_string(path): print "error: file \"" + path + "\" has been copied” sys.exit(1) else: return buffer[32:]
11/13/16
IETF97

20. https://github.com/davidmcgrew/hash-sigs
11/13/16
IETF97

21. 11/13/16
IETF97

22.  HSS public key levels LMS public key LMS type # LMS_SHA256_M32_H5 LMOTS_type # LMOTS_SHA256_N32_W8 I c0b0d7e fd7c82025b21467ad 2619effdcc0f5ba240fd9c6efaefe593 6bd8e63c33c310b2df90560f55e31e12 86ecc b31f8facdf K 1f834958e43c b083617ebb86 c04699e91ef7c2474de48768ce2ea21c
11/13/16
IETF97

23. Batch Signing Goal: make lower N livable
Idea for signing a batch of messages:
Compute Merkle tree over message hashes
Include the path-siblings in the messages
Christopher J. Pavlovski , Colin Boyd, Efficient Batch Signature Generation Using Tree Structures, 1999.
11/13/16
IETF97

24. 11/13/16 CFRG @ IETF97 Msg 1 Msg 2 Msg 3 Msg 4 OTS 1 OTS 2 OTS 3 OTS 4

25. 11/13/16 CFRG @ IETF97 Msg 1 Msg 2 Msg 3 Msg 4 OTS 1 OTS 2 OTS 3 OTS 4

26. EOF
11/13/16
IETF97