Recommendation for Stateful Hash-Based Signature Schemes

Abstract

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

Post-Quantum TLS Without Handshake Signatures

“…All primitives we chose are NIST PQC round-3 finalists or alternate candidates, except for an instantiation of the stateful signature algorithm XMSS at NIST level 1 for signatures generated by CAs. XMSS is already defined in an RFC [55] and is being considered by NIST for a fast track to standardization [30]. The XMSS RFC only describes parameters matching NIST level 5 and higher, but the adaptation to a level-1 parameter set is rather straight-forward.…”

“…We define XMSS MT s as an instantiation of XMSS MT using two trees of height 12 each, i.e., a total tree height of 24, which limits the maximum number of signatures per public key to 2 24 ≈ 16.7 M. Increasing this maximum number of signatures to, for example, 2 30 ≈ 1 billion increases signature size by only 96 bytes and has negligible impact on verification speed. It does have an impact on key-generation speed and signing latency, but as mentioned in Section 6.3, latency of signing is not very relevant when used by certificate authorities as in our paper.…”

Hash-based signature revisited

“…Furthermore, the GMSS key generation approach fits the construction to generate the forward-secure signature proposed in Cooper et al (2019). In consequence, we can extend the security of GMSS as follows: if GMSS is an unforgeable signature scheme and the function F used to generate the one-time keys is a secure PRF, then the GMSS is an unforgeable forward-secure signature scheme.…”

Security analysis of the W-OTS$^+$ signature scheme: Updating security bounds

“…In order to use such one-time signature in practice several its modifications have been discussed. In particular, the W-OTS + scheme has received a sig-nificant attention in the view of standardization processes, in which one of the candidates is the XMSS signature that uses the W-OTS + [5].…”

“…Moreover, the overall performance of hashbased digital signatures makes them suitable for the practical use. Several many-time hash-based digital signatures schemes are under consideration for standardization by NIST [5] and IETF [6,7].…”