1. 04.09.2013 | TU Darmstadt | Andreas Hülsing | 1 Optimal Parameters for XMSS MT Andreas Hülsing, Lea Rausch, and Johannes Buchmann

2. Digital Signatures are Important! Software updates E-Commerce … and many others 04.09.2013 | TU Darmstadt | Andreas Hülsing | 2

3. What if… IBM 2012: „…optimism about superconducting qubits and the possibilities for a future quantum computer are rapidely growing.“ 04.09.2013 | TU Darmstadt | Andreas Hülsing | 3

4. Post-Quantum Signatures Based on Lattice, MQ, Coding Signature and/or key sizes Runtimes Secure parameters 04.09.2013 | TU Darmstadt | Andreas Hülsing | 4

5. Hash-based Signature Schemes [Merkle, Crypto‘89] Not only “post-quantum”Fast, also without HW-accelerationStrong security guaranteesForward secureRestricted number of signaturesMany parameters 04.09.2013 | TU Darmstadt | Andreas Hülsing | 5

6. Forward Secure Signatures 04.09.2013 | TU Darmstadt | Andreas Hülsing | 6

7. Forward Secure Signatures time classical pk sk Key gen. forward sec pk sk sk 1 sk 2 sk i sk T t1t1 t2t2 titi tTtT 04.09.2013 | TU Darmstadt | Andreas Hülsing | 7

8. Construction 04.09.2013 | TU Darmstadt | Andreas Hülsing | 8

9. Hash-based Signatures OTS HH H HH HH H HH HH H H H PK SK SIG = (i,,,,, ) h h H Parameter 04.09.2013 | TU Darmstadt | Andreas Hülsing | 9

10. Winternitz OTS [Merkle, Crypto‘89; Even et al., JoC‘96] 1. = f( ) 2. Trade-off between runtime and signature size, controlled by parameter w 3. Minimal security requirements [Buchmann et al.,Africacrypt’11] 4. Uses PRFF F SIG = (i,,,,, ) w F h H Parameter 04.09.2013 | TU Darmstadt | Andreas Hülsing | 10

11. Generated using forward secure pseudorandom generator (FSPRG), build using PRFF F: Secret key: Random SEED for pseudorandom generation of current signature key. XMSS – secret key PRG FSPRG w F h H Parameter 04.09.2013 | TU Darmstadt | Andreas Hülsing | 11

12. BDS-Tree Traversal [Buchmann et al., 2008]  Computes authentication paths  Left nodes are cheap h # 2 h-1 # 2 h-2 k  Store most expensive nodes  Distribute costs  (h-k)/2 updates per round k w F h H Parameter 04.09.2013 | TU Darmstadt | Andreas Hülsing | 12

13. i j Accelerate key generation Tree Chaining [Buchmann et al., 2006] Generalized distributed signature generation from [Huelsing et al., SAC’12] d k w F h H Parameter wiwi kiki hihi 04.09.2013 | TU Darmstadt | Andreas Hülsing | 13

14. Parameter Selection 04.09.2013 | TU Darmstadt | Andreas Hülsing | 14

15. Trade-Offs hHwFkd T Sig T Ver T Kg |Sig| |SK| |PK| Security # Sigs 04.09.2013 | TU Darmstadt | Andreas Hülsing | 15

16. Linear Optimization Input: h, b min, T F, T H Output: b, d, (h,w,k) i Obj. Minimize weighted sum of runtimes & sizes  Linearization: Generalized lambda method [Moritz, 2007]  Complexity reduction: Split into sub-problems 04.09.2013 | TU Darmstadt | Andreas Hülsing | 16

17. Conclusion 04.09.2013 | TU Darmstadt | Andreas Hülsing | 17

18. complex flexible XMSS MT other (pq-)schemes Optimization 04.09.2013 | TU Darmstadt | Andreas Hülsing | 18

19. Thank you!