Stateful hash-based signature schemes are a family of post-quantum signature schemes. XMSS and LMS, two digital signature schemes standardized by NIST, belong to this family. Both are structured as a collection of one-time signature key pairs, which are combined using Merkle binary tree. They rely on tree traversal algorithms to optimize time versus memory efficiency, reducing the signing time of the schemes at the cost of managing a larger amount of auxiliary data (i.e., state). In this paper, we focus on XMSS with the BDS algorithm when used in a practical setting on an embedded device. One challenge on such devices is that they can experience a loss of power unexpectedly. For instance, an NFC chip might be torn away from its power source In the case of such a tearing event, the validity of the state can be impacted: the algorithm does not update the state correctly if such an event occurs. We propose an algorithm based on BDS that we call BDSFix. This algorithm recovers the BDS state following a tearing event. Our algorithm either equals (for a single tearing event) or outperforms recovering the state through BDS for any number of tearings larger than 1. This ranges from a 9% speed-up for six subsequent tearing events to improvements by factors of up to 8 for a large number of tearing events.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Tearing Solutions for Tree Traversal in Stateful Hash-Based Cryptography

  • Solane El Hirch,
  • Frank Custers,
  • Christine van Vredendaal

摘要

Stateful hash-based signature schemes are a family of post-quantum signature schemes. XMSS and LMS, two digital signature schemes standardized by NIST, belong to this family. Both are structured as a collection of one-time signature key pairs, which are combined using Merkle binary tree. They rely on tree traversal algorithms to optimize time versus memory efficiency, reducing the signing time of the schemes at the cost of managing a larger amount of auxiliary data (i.e., state). In this paper, we focus on XMSS with the BDS algorithm when used in a practical setting on an embedded device. One challenge on such devices is that they can experience a loss of power unexpectedly. For instance, an NFC chip might be torn away from its power source In the case of such a tearing event, the validity of the state can be impacted: the algorithm does not update the state correctly if such an event occurs. We propose an algorithm based on BDS that we call BDSFix. This algorithm recovers the BDS state following a tearing event. Our algorithm either equals (for a single tearing event) or outperforms recovering the state through BDS for any number of tearings larger than 1. This ranges from a 9% speed-up for six subsequent tearing events to improvements by factors of up to 8 for a large number of tearing events.