Hashbased Signatures Andreas Hlsing CAST Workshop 03052018 Darmstadt

Hash-based Signatures Andreas Hülsing CAST Workshop 03/05/2018 Darmstadt

Post-Quantum Signatures Lattice, MQ, Coding Signature and/or key sizes Runtimes Secure parameters 24 -11 -2020 PAGE 2

Hash-based Signature Schemes [Mer 89] Post quantum Only secure hash function Security well understood Fast 24 -11 -2020 PAGE 3

RSA – DSA – EC-DSA. . . Intractability Assumption Cryptographic hash function RSA, DH, SVP, MQ, … Digital signature scheme 24 -11 -2020 PAGE 4

Hash function families

(Hash) function families •

One-wayness •

Collision resistance

Second-preimage resistance •

Undetectability •

Pseudorandomness • g

Generic security • „Black Box“ security (best we can do without looking at internals) • For hash functions: Security of random function family • (Often) expressed in #queries (query complexity) • Hash functions not meeting generic security considered insecure

Generic Security - OWF •

Generic Security - OWF •

Generic Security OW Classical Quantum * conjectured, no proof SPR CR UD* PRF*

Hash-function properties Assumption / Attacks stronger / easier to break Collision-Resistance 2 nd-Preimage. Resistance One-way Pseudorandom weaker / harder to break 24 -11 -2020 PAGE 16

Attacks on Hash Functions MD 5 Collisions (practical!) Collisions (theo. ) SHA 1 24 -11 -2020 2005 Collisions (practical!) MD 5 & SHA-1 Collisions (theo. ) 2004 SHA 1 No (Second-) Preimage Attacks! 2008 2017 PAGE 17

Basic Construction 24 -11 -2020 PAGE 18

Lamport-Diffie OTS [Lam 79] * Message M = b 1, …, bm, OWF H = n bit SK sk 1, 0 sk 1, 1 H PK H pk 1, 0 b 1 Sig 24 -11 -2020 skm, 0 H H pk 1, 1 Mux sk 1, b 1 skm, 1 H H pkm, 0 b 2 Mux bm pkm, 1 Mux skm, bm PAGE 19

Security Theorem: If H is one-way then LD-OTS is one-time eu-cmasecure.

Merkle’s Hash-based Signatures PK H H SIG = (i=2, , H OTS H , H H H OTS OTS 24 -11 -2020 SK PAGE 21 )

Security Theorem: MSS is eu-cma-secure if OTS is a one-time eu-cma secure signature scheme and H is a random element from a family of collision resistant hash functions.

Winternitz-OTS

Recap LD-OTS [Lam 79] * Message M = b 1, …, bm, OWF H = n bit SK sk 1, 0 sk 1, 1 H PK Sig H pk 1, 0 b 1 skm, 0 H H H pk 1, 1 Mux sk 1, b 1 skm, 1 H pkm, 0 b 2 Mux bn pkm, 1 Mux skm, bm

LD-OTS in MSS SIG = (i=2, , , ) Verification: 1. Verify 2. Verify authenticity of We can do better!

Trivial Optimization * Message M = b 1, …, bm, OWF H = n bit SK sk 1, 0 H PK b 1 Sig sk 1, 1 skm, 0 H pk 1, 0 pk 1, 1 Mux sig 1, 0 sig 1, 1 H H bm skm, 1 H H pkm, 0 pkm, 1 Mux sigm, 0 sigm, 1

Optimized LD-OTS in MSS X SIG = (i=2, , , , Verification: 1. Compute from 2. Verify authenticity of Steps 1 + 2 together verify , )

Let‘s sort this Checksum with bad performance!

Optimized LD-OTS

Function chains • i-times c 0(x) = x

WOTS • c 0(sk 1) = sk 1 pk 1 = cw-1(sk 1) c 1(skl ) c 0(skl ) = skl pkl = cw-1(skl )

WOTS Signature generation M b 1 b 2 b 3 b 4 … … … … c 0(sk 1) = sk 1 bm‘+1 bm‘+2 … C … bl pk 1 = cw-1(sk 1) σ1=cb 1(sk 1) Signature: σ = (σ1, …, σl ) c 0(skl ) = skl pkl = cw-1(skl ) σl =cbl (skl )

WOTS Signature Verification Verifier knows: M, w b 1 b 2 b 3 b 4 … … σ1 Signature: σ = (σ1, …, σl ) … … … bm‘+1 bl 1+2 … … bl pk 1 =? pkl =? σl

WOTS Function Chains •

WOTS Security •

XMSS

XMSS Applies several tricks to achieve collision-resilience -> signature size halved Tree: Uses bitmasks Leafs: Use binary tree with bitmasks OTS: WOTS+ Mesage digest: Randomized hashing bi

Multi-Tree XMSS •

XMSS in practice

XMSS Internet-Draft (draft-irtf-cfrg-xmss-hash-based-signatures) • Protecting against multi-target attacks / tight security • n-bit hash => n bit security • Small public key (2 n bit) • At the cost of ROM for proving PK compression secure • Function families based on SHA 2 • Equal to XMSS-T [HRS 16] up-to message digest

XMSS / XMSS-T Implementation C Implementation, using Open. SSL [HRS 16] Sign (ms) Signature (k. B) Public Key (k. B) Secret Key (k. B) Bit Security classical/ quantum Comment XMSS 3. 24 2. 8 1. 3 2. 2 236 / 118 h = 20, d = 1, XMSS-T 9. 48 2. 8 0. 064 2. 2 256 / 128 h = 20, d = 1 XMSS 3. 59 8. 3 14. 6 196 / 98 h = 60, d = 3 XMSS-T 10. 54 8. 3 0. 064 14. 6 256 / 128 h = 60, d = 3 Intel(R) Core(TM) i 7 CPU @ 3. 50 GHz XMSS-T uses message digest from Internet-Draft All using SHA 2 -256, w = 16 and k = 2

SPHINCS

About the statefulness • Works great for some settings • However. . . . back-up. . . multi-threading. . . load-balancing

How to Eliminate the State

SPHINCS • Stateless Scheme • XMSSMT + HORST + (pseudo-)random index • Collision-resilient • Deterministic signing • SPHINCS-256: • • 128 -bit post-quantum secure Hundrest of signatures / sec 41 kb signature 1 kb keys

SPHINCS+ (our NIST submission) • Strengthened security gives smaller signatures • Collision- and multi-target attack resilient • Small keys, medium size signatures (lv 3: 17 k. B) • THE conservative choice • No citable speeds yet https: //sphincs. org 46

Instantiations • SPHINCS+-SHAKE 256 • SPHINCS+-SHA-256 • SPHINCS+-Haraka https: //sphincs. org 47

Instantiations (small vs fast) https: //sphincs. org 48

Thank you! Questions? For references, literature & longer lectures see https: //huelsing. net 24 -11 -2020 PAGE 49