CMSS – An Improved Merkle Signature Scheme

Abstract

Abstract. The Merkle signature scheme (MSS) is an interesting alternative for well established signature schemes such as RSA, DSA, and ECDSA. The security of MSS only relies on the existence of cryptographically secure hash functions. MSS has a good chance of being quantum computer resistant. In this paper, we propose CMSS, a variant of MSS, with reduced private key size, key pair generation time, and signature generation time. We demonstrate that CMSS is competitive in practice by presenting a highly efficient implementation within the Java Cryptographic Service Provider FlexiProvider. We present extensive experimental results and show that our implementation can for example be used to sign messages in Microsoft Outlook.

Some Aspects of Post-Quantum Cryptosystems

“…Merkle proposed the cryptosystem where a public key can be used for the multiple messages. In the given cryptosystem, the public key K is used to sign the concrete number of messages (Buchmann et al 2006;Buchmann et al 2007). The number of messages must be a power of two, i.e.…”

Verifiably Encrypted Signatures from RSA without NIZKs

“…Setting = 20, however, has proven to be a reasonable trade-off between signature capability and efficiency in the Merkle signature scheme [10] but there generalized constructions that allow for 2 40 or even 2 80 signatures without having to compute 2 40 respectively 2 80 hash values during the set-up phase [8].…”

Fast Hash-Based Signatures on Constrained Devices

“…In summary we use the Winternitz one-time signature scheme (W-OTS) [9] to sign the data, the ideas for efficient one-time signature key generation of [4] and the algorithm from [6] for the computation of the authentication paths. We use two different hash functions based on the AES block cipher, both with 128-bit block length.…”

“…The next step is to generate 2 H W-OTS key pairs. For the W-OTS key generation, we apply the approach of [4] and use the following forward secure pseudo random number generator.…”

“…The values for H = 10 were included to clarify the impact of the tree height on the signature generation time. For the Winternitz parameter w and the parameter K for the BDS algorithm, we tested three combinations (w, K) = (2, 2), (2, 4), (4,4). The value t, that denotes the number of 128-bit strings in the W-OTS signature key and the one-time signature, is t = 133 for w = 2 and t = 67 for w = 4.…”