Hashbased Signatures and SPHINCS Andreas Hlsing PostQuantum Signatures

Hash-based Signatures and SPHINCS Andreas Hülsing

Post-Quantum Signatures Lattice, MQ, Coding Signature and/or key sizes Runtimes Secure parameters 17 -6 -2021 PAGE 1

Hash-based Signature Schemes [Mer 89] Post quantum Only secure hash function Security well understood Fast Stateful 17 -6 -2021 PAGE 2

Basic Construction 17 -6 -2021 PAGE 3

Lamport-Diffie OTS [Lam 79] Message M = b 1, …, bm, OWF H SK sk 1, 0 sk 1, 1 H PK Sig skm, 0 H pk 1, 0 b 1 = n bit * H H pk 1, 1 Mux skm, 1 H H pkm, 0 b 2 sk 1, b 1 Mux bm pkm, 1 Mux skm, bm 17 -6 -2021 PAGE 4

Merkle’s Hash-based Signatures Digital PK Signature Encryption H H H OTS H SIG = (i=2, , , H Cryptography OTS H H H OTS MAC OTS H H H OTS OTS Hash Function SK H H H Legality H 17 -6 -2021 PAGE 5 , OTS , )

XMSS: A practical signature scheme with minimal security assumptions Johannes Buchmann, Carlos Coronado, Erik Dahmen, Andreas Hülsing

XMSS Security parameter n Requires family of functions Theorem: XMSS is existentially unforgeable under adaptive chosen message attacks if F is a 2 nd-preimageresistant family of undetectable one-way functions, G is a pseudorandom function family, and H is a 2 ndpreimage-resistant function family.

XMSS Tree bi • Hashing one-time PK‘s using tree • Requirements: CRHF -> SPRHF • PK includes ~h additional values

XMSS uses Winternitz OTS Security level b SIG = (i, | 1. |=| =f( |=m*| , , | = m*b ) 2. Trade-off between runtime and signature size | | ~ m/log w * | | )

Winternitz OTS (WOTS) First idea: Full scheme: Security Proofs: Winternitz (Mer 89) Even et al. (EGM 96) Hevia & Micciancio (HM 02) Dods et al. (DSS 05) Requires collision-resistant undetectable one-way function family. WOTS$: Buchmann et al. (BDEH+11) Requires pseudorandom function family. WOTS+: Hülsing (Hül 13) Requires second preimage resistant undetectable one-way function family.

Recap LD-OTS [Lam 79] Message M = b 1, …, bm, OWF H SK sk 1, 0 * = n bit sk 1, 1 H skm, 0 H H H skm, 1 H H PK pk 1, 0 Sig b 1 pk 1, 1 Mux sk 1, b 1 pkm, 0 b 2 Mux bn pkm, 1 Mux skm, bm

Trivial Optimization Message M = b 1, …, bm, OWF H SK sk 1, 0 H * = n bit sk 1, 1 H skm, 0 H H skm, 1 H H PK pk 1, 0 pk 1, 1 Mux sig 1, 0 sig 1, 1 pkm, 0 pkm, 1 Mux sigm, 0 sigm, 1 Sig b 1 bm

Non-trivial Optimization Checksum with bad performance!

Non-trivial Optimization, cont‘d

WOTS Function Chain Function family: Formerly: WOTS+ For w ≥ 2 select R = (r 1, …, rw-1) ci-1 (x) ri ci (x) c 0(x) = x c 1(x) = cw-1 (x)

WOTS+ Winternitz parameter w, security parameter n, message length m, function family Key Generation: Compute l , sample K, sample R c 0(sk 1) = sk 1 pk 1 = cw-1(sk 1) c 1(skl ) c 0(skl ) = skl pkl = cw-1(skl )

WOTS+ Signature generation M b 1 b 2 b 3 b 4 … … … … c 0(sk 1) = sk 1 bm‘+1 bm‘+2 … C … bl pk 1 = cw-1(sk 1) σ1=cb 1(sk 1) Signature: σ = (σ1, …, σl ) c 0(skl ) = skl pkl = cw-1(skl ) σl =cbl (skl )

WOTS+ Signature Verification Verifier knows: M, w b 1 b 2 b 3 b 4 … … c 1 (σ1) σ1 Signature: σ = (σ1, …, σl ) … … … bm‘+1 bl 1+2 … … bl pk 1 c 3(σ1) =? c 2(σ1) cw-1 -b 1(σ1) pkl =? σl cw-1 -bl (σl )

WOTS Function Chains For • WOTS: • WOTS$: • WOTS+: define and

WOTS Security Theorem (informally): W-OTS is strongly unforgeable under chosen message attacks if F is a collision resistant family of undetectable one-way functions. W-OTS$ is existentially unforgeable under chosen message attacks if F is a pseudorandom function family. W-OTS+ is strongly unforgeable under chosen message attacks if F is a 2 nd-preimage resistant family of undetectable oneway functions.

WOTS Sizes and Runtimes Lamport. Diffie Public Key Size 2 bm Secret Key Size 2 bm Signature Size bm Key Generation Time ~ 2 m WOTS$ WOTS+ l 2 b l b (+b) l b ( +(w-1)b ) ~ 2 bm/log w ~ bm/log w l 2 b lb lb ~ 2 bm/log w ~ bm/log w WOTS$: l w Securitly lossl w linear in w ~ wm/log w ~wm/log -> Only small w w Security level b, Winternitz parameter w, Message Length m, l = l (w, m) ~ m / log w lw ~ wm/log w

Secret Key Generation 17 -6 -2021 PAGE 22

G Secret Key Size: 2 hl b → b G G G XMSS – Secret key

PRG FSPRG FSPRG G G XMSS forward secure

Tree Chaining 17 -6 -2021 PAGE 25

XMSS Public Key Generation = Requires computation of 2 h nodes in Merkle tree h

Two Layer Key generation Requires computation of 2*2 h/2 nodes in Merkle trees

Two Layer Signing = j j i Signature = (i, , , j, , , ) i

Two Layer Verifying ? = Public Key = , ? j i Signature = (i, , , j, , , ) , ?

XMSS Public Key Generation Security level b, tree height h MSS • Generate tree of size 2 h • Cost ~ 2 h XMSS • Tree chaining • Use d layers of trees of height h/t • Generate d trees of height 2 h/d • Cost ~ d*2 h/d • Example: h = 40, d = 2, costs ~ 2*220 = 221 • Slightly increased signature size (+d-1 one-time sigs)

XMSS Authentication Path Generation Straight forward: 2 h-1 leaf + 2 h-h node computations BDS Algorithm: Runtime (h−k)/2+1 leaf and 3(h−k− 1)/2+1 node computations. +(h−k) calls to FSPRG forward secure XMSS in the worst case. Storage n bit nodes n bit seeds forward secure XMSS. 17 -6 -2021 PAGE 31

XMSS Implementations C Implementation, using Open. SSL [BDH 2011] Sign (ms) Verify (ms) Signature (bit) Public Key (bit) Secret Key (byte) Bit Security Comment XMSS-SHA-2 35. 60 1. 98 16, 672 13, 600 3, 364 157 h = 20, w = 64, XMSS-AES-NI 0. 52 0. 07 19, 616 7, 328 1, 684 84 h = 20, w=4 XMSS-AES 1. 06 0. 11 19, 616 7, 328 1, 684 84 h = 20, w=4 RSA 2048 3. 08 0. 09 ≤ 2, 048 ≤ 4, 096 ≤ 512 87 Intel(R) Core(TM) i 5 -2520 M CPU @ 2. 50 GHz with Intel AES-NI

XMSS Implementations Smartcard Implementation Sign (ms) Verify (ms) Keygen (ms) Signature (byte) Public Key (byte) Secret Key (byte) Bit Sec. Comment XMSS 134 23 925, 400 2, 388 800 2, 448 92 H = 16, w=4 XMSS+ 106 25 5, 600 3, 476 544 3, 760 94 H = 16, w=4 RSA 2048 190 7 11, 000 ≤ 256 ≤ 512 87 Infineon SLE 78 16 Bit-CPU@33 MHz, 8 KB RAM, TRNG, sym. & asym. co-processor NVM: Card 16. 5 million write cycles/ sector, XMSS+ < 5 million write cycles (h=20) [HBB 12]

SPHINCS: Stateless Practical Hash-based Incredibly Nice Cryptographic Signatures Joint work with Daniel J. Bernstein, Daira Hopwood, Tanja Lange, Ruben Niederhagen, Louiza Papachristodoulou, Michael Schneider, Peter Schwabe, Zooko Wilcox O’Hearn 17 -6 -2021 PAGE 34

Long-Standing Problem: Statefulness • No problem in many cases. • Qualified signatures, • Keys on smartcard, . . . • Necessary forward-security! But: • Key back-ups undermine security • Parallel use of key problematic • Multi-threading, • Load balancing. . . • Do not fit standard API 17 -6 -2021 PAGE 35

SPHINCS Properties Stateless 128 bit Quantum Security Practical Speed Practical Signature Size 17 -6 -2021 PAGE 36

How to Eliminate the State 17 -6 -2021 PAGE 37

Protest? 17 -6 -2021 PAGE 38

Straight Forward • Run MSS without State Digital PK Signature Encryption H SIG = (i=2, H H H OTS , , , H Cryptography H H Legality H H OTS OTS Hash Function 17 -6 -2021 PAGE 39 SK OTS MAC OTS H H OTS , )

Approach 1: Message Hash i = Hash(Message); § 128 bit Quantum Sec. → n = 256 bit Hash [Ber 09] → #Indices = 2256 → h = n = 256 § h depends on n! § Best we can do: t. Sign ≈ n 3 / log n t. Hash= 2 M t. Hash ≈ 15 min* |Sig| ≈ n 3 / log n > 256 kb * (Open. SSL SHA 2) 17 -6 -2021 PAGE 40

Approach 2: Random Index § 128 bit Quantum Sec. → Sampled by Signer → #Indices ← collision prob. → #Indices = 2256 → h = 256 § Impossible to make this efficient, again… § BUT: § h independent of n § Statistical collision probability NOT collision resistance 17 -6 -2021 PAGE 41

Few-Time Signature Schemes 17 -6 -2021 PAGE 42

Recap LD-OTS Message M = b 1, …, bn, OWF H SK sk 1, 0 Sig skn, 0 H pk 1, 0 b 1 = n bit sk 1, 1 H PK * H H H pk 1, 1 Mux skn, 1 H pkn, 0 b 2 Mux sk 1, b 1 bn pkn, 1 Mux skn, bn 17 -6 -2021 PAGE 43

HORS [RR 02] * Message M, OWF H, CRHF H’ = n bit Parameters t=2 a, k, with m = ka (typical a=16, k=32) SK sk 1 H PK pk 1 sk 2 H skt-1 H pk 1 H H pkt-1 17 -6 -2021 PAGE 44 skt H pkt

HORS mapping function * Message M, OWF H, CRHF H’ = n bit Parameters t=2 a, k, with m = ka (typical a=16, k=32) M H’ b 1 b 2 ba bar ik i 1 17 -6 -2021 PAGE 45

HORS * Message M, OWF H, CRHF H’ = n bit Parameters t=2 a, k, with m = ka (typical a=16, k=32) SK sk 1 sk 2 H PK H’(M) H pk 1 b 1 H H b 2 skt H pk 1 H pkt-1 ba i 1 Sig skt-1 ba+1 bka-2 bka-1 bka Mux ski 1 skik 17 -6 -2021 PAGE 46 pkt ik

HORS Security • M mapped to k element index set Mi є {1, . . , t}k • Each signature publishes k out of t secrets • Either break one-wayness or… • r-Subset-Resilience: After seeing index sets Mij for r messages msgj, 1 <= j <= r, hard to find msgr+1 ≠ msgj such that Mir+1 є U 1<=j<=r Mij. • Best generic attack: Succr-SSR(A, q) = q(rk / t)k → Security shrinks with each signature! 17 -6 -2021 PAGE 47

HORST Using HORS with MSS requires adding PK (tn) to MSS signature. HORST: Merkle Tree on top of HORS-PK • New PK = Root • Publish Authentication Paths for HORS signature values • PK can be computed from Sig • With optimizations: tn → (k(log t − x + 1) + 2 x)n • E. g. SPHINCS-256: 2 MB → 16 KB • Use randomized message hash 17 -6 -2021 PAGE 48

Assembling SPHINCS 17 -6 -2021 PAGE 49

SPHINCS Signature 17 -6 -2021 PAGE 50

SPHINCS Key Ideas Use HORST key pairs to sign messages Authenticate HORST key pairs using hypertree (of XMSS trees) Use random index Select Parameters such that sumr є [0, ∞)(Pr[r-times index collision] * Succr-SSR(A)) = negl(n) 17 -6 -2021 PAGE 51

SPHINCS Sign 1. 2. 3. 4. 5. 6. Select (pseudo-)random HORST sk Sign message using this HORST sk Build parent tree Use tree to sign HORST pk If tree != top, goto 3. Output Sig: 1. Index 2. HORST signature 3. XMSS signature chain 17 -6 -2021 PAGE 52

SPHINCS-256 17 -6 -2021 PAGE 53

SPHINCS-256 Speed • Key generation: • Verification: • Signature: 3, 051, 562 cycles 1, 369, 060 cycles 47, 466, 005 cycles • Still hundreds of messages per second on a modern 4 -core 3. 5 GHz Intel CPU (13. 56 ms / Sig on 1 Core) • Remember: Optimized Folklore t. Sign ≈ 15 min* |Sig| > 256 kb 17 -6 -2021 PAGE 54

In Paper (http: //eprint. iacr. org/2014/795) + Standard model security reduction without collision resistance + Complexity of generic quantum attacks + Efficient fixed-input length hashing + Optimized implementation 17 -6 -2021 PAGE 55

Advantages of Hash-based Signatures 17 -6 -2021 PAGE 56

RSA – DSA – EC-DSA. . . Intractability Assumption Collision resistant hash function RSA, DH, SVP, MQ, … Digital signature scheme 17 -6 -2021 PAGE 57

Early Warning System (only XMSS & SPHINCS) Hash-function properties Assumption / Attacks stronger / easier to break Collision-Resistance 2 nd-Preimage. Resistance One-way weaker / harder to break 17 -6 -2021 PAGE 58 Pseudorandom

Early Warning System (only XMSS & SPHINCS) Attacks on Hash Functions MD 5 Collisions (theo. ) Collisions (practical!) SHA-1 MD 5 & SHA-1 Collisions (theo. ) 2004 2005 17 -6 -2021 PAGE 59 No (Second-) Preimage Attacks! 2008 2015

Easy Redundancy Hash-Combiner - Collision-Resistance / 2 nd-Preimage-Resistance: - PRF: • • No sudden break Replaces double signature Signature size only grows by h*n Runtime ~ doubled 17 -6 -2021 PAGE 60

Forward Security (only XMSS) 17 -6 -2021 PAGE 61

Forward Security - cont‘d pk classical sk pk forward sec sk Key gen. sk 1 sk 2 ski t 1 t 2 ti 17 -6 -2021 PAGE 62 sk. T time

Conclusion • Hash-based signatures currently most confidence inspiring pq-signature scheme • If you can live with a state: Go for XMSS. • Otherwise: • Go for Sphincs-256! • First stateless signature scheme with post-quantum secure parameters • Practical speed and sizes 17 -6 -2021 PAGE 63

Thank you! Questions? For references & further literature see https: //huelsing. wordpress. com/hash-based-signature-schemes/literature/ 17 -6 -2021 PAGE 64