Longterm secure authenticity using hashbased signatures Andreas Hlsing

Long-term secure authenticity using hash-based signatures Andreas Hülsing PLLS 2018 17/09/2018

Requirements for long-term authenticity • Example: Land registry • Lifetime? 100+ years • Known solution: • Digital Archiving with signature renewal • Requirements: • Security of signature scheme must„fade out“ rather than „vanish suddenly“ • Can be achieved using double signature • What about quantum computers? • How many different sigs do we need? 3/11/2021 https: //huelsing. net 2

Post-quantum signature schemes Proposals from all areas of post-quantum cryptography: Lattice-based: SVP / CVP Hash-based: CR / SPR /. . . New Code-based: SD 3/11/2021 Multivariate: MQ https: //huelsing. net Isogenies 3

Hash-based Signature Schemes [Mer 89] The conservative approach: Instead of introducing new hardness assumptions. . . reduce the amount of assumptions 3/11/2021 https: //huelsing. net 4

RSA – DSA – EC-DSA. . . Intractability Assumption Cryptographic hash function RSA, DH, SVP, MQ, … Digital signature scheme 3/11/2021 https: //huelsing. net 5

Hash function families

(Hash) function families • 3/11/2021 https: //huelsing. net 7

One-wayness • 3/11/2021 https: //huelsing. net 8

Collision resistance 3/11/2021 https: //huelsing. net 9

Second-preimage resistance • 3/11/2021 https: //huelsing. net 10

Generic Security OW SPR CR UD* PRF* Classical Quantum * conjectured, no proof 3/11/2021 https: //huelsing. net 11

Basic Construction 3/11/2021 https: //huelsing. net 12

Lamport-Diffie OTS [Lam 79] * Message M = b 1, …, bm, OWF H = n bit SK sk 1, 0 sk 1, 1 H PK H pk 1, 0 b 1 Sig 3/11/2021 skm, 0 H H pk 1, 1 Mux skm, 1 H H pkm, 0 b 2 Mux sk 1, b 1 bm pkm, 1 Mux skm, bm https: //huelsing. net 13

Security Theorem: If H is one-way then LD-OTS is one-time eu-cmasecure. 3/11/2021 https: //huelsing. net 14

Merkle’s Hash-based Signatures PK H H SIG = (i=2, , H OTS H , H H H OTS OTS 3/11/2021 SK https: //huelsing. net 15 )

Security Theorem: MSS is eu-cma-secure if OTS is a one-time eu-cma secure signature scheme and H is a random element from a family of collision resistant hash functions. 3/11/2021 https: //huelsing. net 16

Winternitz-OTS 3/11/2021 https: //huelsing. net 17

Function chains • i-times c 0(x) = x 3/11/2021 https: //huelsing. net 18

WOTS • pk 1 = cw-1(sk 1) c 0(sk 1) = sk 1 c 1(sk 1) c 1(skl ) pkl = cw-1(skl ) c 0(skl ) = skl 3/11/2021 https: //huelsing. net 19

WOTS Signature generation M b 1 b 2 b 3 b 4 … … … … c 0(sk 1) = sk 1 bm‘+1 bm‘+2 … C … bl pk 1 = cw-1(sk 1) σ1=cb 1(sk 1) Signature: σ = (σ1, …, σl ) c 0(skl ) = skl 3/11/2021 pkl = cw-1(skl ) σl =cbl (skl ) https: //huelsing. net 20

WOTS Signature Verification Verifier knows: M, w b 1 b 2 b 3 b 4 … … σ1 Signature: σ = (σ1, …, σl ) … … … bm‘+1 bl 1+2 … … bl pk 1 =? pkl =? σl 3/11/2021 https: //huelsing. net 21

WOTS Function Chains • 3/11/2021 https: //huelsing. net 22

WOTS Security • 3/11/2021 https: //huelsing. net 23

WOTS in MSS 3/11/2021 X SIG = (i=2, , , https: //huelsing. net ) 24

XMSS 3/11/2021 https: //huelsing. net 25

XMSS Applies several tricks to achieve collision-resilience -> signature size halved Tree: Uses bitmasks Leafs: Use binary tree with bitmasks OTS: WOTS+ Mesage digest: Randomized hashing 3/11/2021 bi https: //huelsing. net 26

Multi-Tree XMSS • 3/11/2021 https: //huelsing. net 27

Multi-target attack mitigation • Problem: An attack that succeeds when it solves one out of many instances (targets) • Typical case: Security level drops by log t for t instances • XMSS-T / LMS / SPHINCS+ apply mitigation techniques: • Attack complexity for t targets becomes same as for 1 target • Solution: Tweakable hash function • Idea: Make hash calls independent • XMSS-T / SPHINCS+ in standard model with an additional assumption (that holds in QROM) • LMS in (Q)ROM 3/11/2021 https: //huelsing. net 28

What if long-term security is needed? 3/11/2021 https: //huelsing. net 29

Hash-function properties Assumption / Attacks stronger / easier to break Collision-Resistance 2 nd-Preimage. Resistance One-way Pseudorandom weaker / harder to break 3/11/2021 https: //huelsing. net 30

This hardness gap can be used as early warning system! 3/11/2021 https: //huelsing. net 31

Attacks on Hash Functions MD 5 Collisions (practical!) Collisions (theo. ) SHA 1 3/11/2021 2005 Collisions (practical!) MD 5 & SHA-1 Collisions (theo. ) 2004 SHA 1 No (Second-) Preimage Attacks! 2008 https: //huelsing. net 2017 32

Cheap Redundancy Hash-Combiner - Collision-Resistance / 2 nd-Preimage-Resistance: - PRF: • • No sudden break Changes only in hash function Replaces double signature Signature size and runtime doubled 3/11/2021 https: //huelsing. net 33

Forward Security 3/11/2021 https: //huelsing. net 34

Forward Security - cont‘d pk classical sk pk forward sec sk Key gen. 3/11/2021 sk 2 ski t 1 t 2 ti https: //huelsing. net sk. T time 35

XMSS in practice

RFC 8391: XMSS • RFC since May 2018 • NIST promised to adopt • Equal to XMSS-T [HRS 16] up-to message digest • Function families based on SHA 2 or SHAKE • Mandatory: Support for verification with all SHA 2256 parameter sets • Suggested parameters for different szenarios 3/11/2021 https: //huelsing. net 37

XMSS / XMSS-T Implementation C Implementation, using Open. SSL [HRS 16] Sign (ms) Signature (k. B) Public Key (k. B) Secret Key (k. B) Bit Security classical/ quantum Comment XMSS 3. 24 2. 8 1. 3 2. 2 236 / 118 h = 20, d = 1, XMSS-T 9. 48 2. 8 0. 064 2. 2 256 / 128 h = 20, d = 1 XMSS 3. 59 8. 3 14. 6 196 / 98 h = 60, d = 3 XMSS-T 10. 54 8. 3 0. 064 14. 6 256 / 128 h = 60, d = 3 Intel(R) Core(TM) i 7 CPU @ 3. 50 GHz All using SHA 2 -256, w = 16 and k = 2 3/11/2021 https: //huelsing. net 38

SPHINCS

About the statefulness • Works great for some settings • However. . . . back-up. . . multi-threading. . . load-balancing 3/11/2021 https: //huelsing. net 40

How to Eliminate the State

SPHINCS • Stateless Scheme • XMSSMT + HORST + (pseudo-)random index • Collision-resilient • Deterministic signing • SPHINCS-256: • • • 3/11/2021 128 -bit post-quantum secure (at least we thought so) Hundreds of signatures / sec 41 kb signature 1 kb keys https: //huelsing. net 42

SPHINCS+ (our NIST submission) • Strengthened security gives smaller signatures • Collision- and multi-target attack resilient • Small keys, medium size signatures (lv 3: 17 k. B) • THE conservative choice • No citable speeds yet 3/11/2021 https: //huelsing. net 43

Instantiations • SPHINCS+-SHAKE 256 • SPHINCS+-SHA-256 • SPHINCS+-Haraka 3/11/2021 https: //huelsing. net 44

Instantiations (small vs fast) 3/11/2021 https: //huelsing. net 45

Conclusion • Practical stateful and stateless solutions • Forward-security only possible for stateful schemes! • Stateful only if you are 100% sure you can handle state • My suggestion: Stateful on dedicated HW (Smartcard, HSM, . . . ) • Everywhere else: In case of doubt use stateless 3/11/2021 https: //huelsing. net 46

Thank you! Questions? For references, literature & longer lectures see https: //huelsing. net 3/11/2021 https: //huelsing. net 47