Download presentation
Presentation is loading. Please wait.
1
Long-term secure signatures for the IoT
Andreas Hülsing
2
Hash-based Signature Schemes [Mer89]
Long-term secure Only needs secure hash function Post-quantum Possibility of hash combiners IoT compatible? Only needs secure hash function
![Hash-based Signature Schemes [Mer89]](http://slideplayer.com./slide/14415050/90/images/2/Hash-based+Signature+Schemes+%5BMer89%5D.jpg "Long-term secure. Only needs secure hash function. Post-quantum. Possibility of hash combiners. IoT compatible Only needs secure hash function.")
3
Lamport-Diffie OTS [Lam79]
Message M = b1,…,bm, OWF H = n bit SK PK Sig * sk1,0 sk1,1 skm,0 skm,1 Mux b1 Mux b2 Mux bm H H H H H H pk1,0 pk1,1 pkm,0 pkm,1 sk1,b1 skm,bm
![Lamport-Diffie OTS [Lam79]](http://slideplayer.com./slide/14415050/90/images/3/Lamport-Diffie+OTS+%5BLam79%5D.jpg "Message M = b1,…,bm, OWF H = n bit SK PK Sig * sk1,0. sk1,1. skm,0. skm,1. Mux. b1. Mux. b2. Mux. bm. H. H. H. H. H. H. pk1,0. pk1,1. pkm,0. pkm,1. sk1,b1. skm,bm")
4
One-time signatures Can only be used once Basic building block
Secret keys can be generated pseudorandomly WOTS+ [Hue13] Shorter signatures Size-speed trade-off
5
Chain-based OTS PK H H H H H H H OTS OTS OTS OTS OTS OTS OTS SK
6
Chain-based OTS [NY89] Extremely fast signing via „pebbeling“
Extremely fast verification of sequential signatures Small keys Small sigs (for sequential signatures) Extremely useful in combination with aggregator Stateful See e.g. Dahmen, Krauss. Short Hash-Based Signatures for Wireless Sensor Networks. CANS 2009.
![Chain-based OTS [NY89] Extremely fast signing via „pebbeling](http://slideplayer.com./slide/14415050/90/images/6/Chain-based+OTS+%5BNY89%5D+Extremely+fast+signing+via+%E2%80%9Epebbeling.jpg "Extremely fast verification of sequential signatures. Small keys. Small sigs (for sequential signatures) Extremely useful in combination with aggregator. Stateful. See e.g. Dahmen, Krauss. Short Hash-Based Signatures for Wireless Sensor Networks. CANS")
7
Merkle’s signature scheme
PK SIG = (i=2, , , , , ) H OTS H H H H H H H H H H H H H H OTS OTS OTS OTS OTS OTS OTS OTS SK
8
Merkle‘s signature scheme
Fast signing via „tree traversal algorithms“ Extremely fast verification Small keys Medium size sigs Stateful Latest: XMSS-T (Hülsing, Rijneveld, Song. Mitigating Multi-Target Attacks in Hash-based Signatures. PKC ‘16)
9
Multi-Tree XMSS [MMM02] Uses multiple layers of trees -> Key generation (= Building first tree on each layer) Θ(2h) → Θ(d*2h/d) -> Allows to reduce worst-case signing times Θ(h/2) → Θ(h/2d)
![Multi-Tree XMSS [MMM02]](http://slideplayer.com./slide/14415050/90/images/9/Multi-Tree+XMSS+%5BMMM02%5D.jpg "Uses multiple layers of trees -> Key generation (= Building first tree on each layer) Θ(2h) → Θ(d*2h/d) -> Allows to reduce worst-case signing times Θ(h/2) → Θ(h/2d)")
10
SPHINCS [BHH+15] Stateless Scheme
XMSSMT + HORST + (pseudo-)random index Collision-resilient Deterministic signing SPHINCS-256: 128-bit post-quantum secure Hundrest of signatures / sec 41 kb signature 1 kb keys
![SPHINCS [BHH+15] Stateless Scheme](http://slideplayer.com./slide/14415050/90/images/10/SPHINCS+%5BBHH%2B15%5D+Stateless+Scheme.jpg "XMSSMT + HORST + (pseudo-)random index. Collision-resilient. Deterministic signing. SPHINCS-256: 128-bit post-quantum secure. Hundrest of signatures / sec. 41 kb signature. 1 kb keys.")
11
Performance on small devices
STM32L100C development board: Cortex M3, 32MHz, 32-bit architecture, 256KB Flash, 16KB RAM Issue: SPHINCS sigs (41KB) don‘t fit single APDU KeyGen Sign Verify XMSSMT 278.80s 0.61s 0.16s SPHINCS 0.88s 18.41s 0.51s
12
Future XMSS Internet Draft in IRSG poll
At least two SPHINCS submissions for NIST Faster / smaller signatures Several works on dedicated hash functions (Haraka, Siempira)
13
Thank you! Questions?
Similar presentations
