Add LMS/HSS signatures to documentation. #101

philljj · 2023-07-09T20:33:28Z

Added new subsection Post-Quantum Stateful Hash-Based Signatures to appendix07.

New subsection covers stateful Hash-based Signature (HBS) schemes. Includes:

Motivation for stateful HBS schemes (including NIST and NSA), and introduction to LMS/HSS.
Supported parameter sets.
Tables showing sig size and num of signatures vs parameter sets.
Benchmarking data from my linux i7 (specs included in docs), for both multi-threaded and single-threaded hss lib builds.

Note: I wasn't sure whether this should go in a separate appendix, or in appendix07. I can update the rest of appendix07 or move this as needed.

anhu · 2023-07-10T18:50:06Z

wolfSSL/src/appendix07.md

+
+### Motivation
+
+HBS schemes are of growing interest for a number of reasons.


anhu · 2023-07-10T18:51:09Z

wolfSSL/src/appendix07.md

+HBS schemes are of growing interest for a number of reasons.
+The primary motivation for HBS schemes is post-quantum security. As discussed previously in this appendix, Shor's algorithm would allow a quantum computer to efficiently factorize large integers and compute discrete logarithms, thus completely breaking public-key cryptography schemes such as RSA and ECC.
+
+In contrast, HBS schemes are founded on the security of their underlying hash functions and Merkle trees (typically implemented with SHA256), which are not expected to be broken by the advent of large quantum computers. For these reasons they have been recommended by NIST SP 800-208 and the NSA's CNSA 2.0 suite. See these two links for more info:


large ->cryptographically relevant

anhu · 2023-07-10T18:53:14Z

wolfSSL/src/appendix07.md

+
+Furthermore, the CNSA 2.0 timeline has specified that post-quantum HBS schemes should be used exclusively by 2030, and adoption should begin _immediately_. In fact, adoption of LMS is the earliest requirement in the CNSA 2.0 suite timeline.
+
+However, the stateful nature of HBS schemes requires that significant care is given to their use and tracking their state. In an HBS system, the private key is actually a finite set of one-time signature (OTS) keys, which may never be reused. If the same OTS key were used to sign two different messages, it would be possible for an attacker to fabricate signatures, and the security of the entire scheme would unravel. Therefore, HBS schemes are not suitable for general use such as the public internet.


In an HBS system ---> In a stateful HBS system

There are multiple instances where you need to write stateful HBS in this document. The reason you have to do this is that SPHINCS+ is a stateless HBS.

anhu · 2023-07-10T18:56:47Z

wolfSSL/src/appendix07.md

+
+However, the stateful nature of HBS schemes requires that significant care is given to their use and tracking their state. In an HBS system, the private key is actually a finite set of one-time signature (OTS) keys, which may never be reused. If the same OTS key were used to sign two different messages, it would be possible for an attacker to fabricate signatures, and the security of the entire scheme would unravel. Therefore, HBS schemes are not suitable for general use such as the public internet.
+
+Instead, because of these unique strengths and characteristics, and NIST and NSA backing, HBS schemes such as LMS/HSS are of particular interest for offline firmware authentication and signature verification, especially on embedded or constrained systems that are expected to have a long operational lifetime and thus need to be resilient against a post-quantum future.


post-quantum future ---> cryptographically relevant quantum computer

anhu · 2023-07-10T18:58:31Z

wolfSSL/src/appendix07.md

+### LMS and HSS signatures
+
+wolfSSL is adding support for the LMS and HSS hash-based signature schemes to our wolfCrypt embedded crypto engine. This will be achieved by experimental integration with the hash-sigs LMS/HSS library (<https://github.com/cisco/hash-sigs>), similar to our previous libOQS integration.
+
+Leighton-Micali Signatures (LMS), and its multi-tree variant, the Hierarchical Signature System (HSS), are both post-quantum, stateful hash-based signature schemes. They are noted for having small public and private keys, and fast signing and verifying. Their signature sizes are larger, but are tunable via their Winternitz parameter. See these two links from RFC8554 for more details:
+
+- LMS: <https://datatracker.ietf.org/doc/html/rfc8554>
+- HSS: <https://datatracker.ietf.org/doc/html/rfc8554#section-6>


I don't think they are 2 separate schemes. I think they are combined to make a single sig scheme.

I don't think you can do HSS without LMS. I could be wrong on that one though.

Correct, HSS is just a multi-tree generalization of LMS that contains LMS as a component. That's what I meant to convey.

But you say " LMS and HSS hash-based signature schemes " which makes it sound like 2 separate schemes.

anhu · 2023-07-10T19:00:16Z

wolfSSL/src/appendix07.md

+
+#### Benchmark Data
+
+The following benchmark data was taken on an 8-core Intel i7-8700 CPU @ 3.20GHz, on Fedora 38 (`6.2.9-300.fc38.x86_64`).


State how many threads were used.

You didn't mention how many threads were spawned in this line.

I described it in the multi-threaded and single-threaded test results below.

When using hss_lib_thread.a the hash-sigs lib will spawn up to 16 worker threads, depending on the parameters used and what it's calculating. This is outside our control, unless we use their API to set the maximum for number of worker threads. In practice I only saw 6 cores utilized during key gen.

anhu · 2023-07-11T14:39:41Z

wolfSSL/src/appendix07.md

+### LMS and HSS signatures
+
+wolfSSL is adding support for the LMS and HSS hash-based signature schemes to our wolfCrypt embedded crypto engine. This will be achieved by experimental integration with the hash-sigs LMS/HSS library (<https://github.com/cisco/hash-sigs>), similar to our previous libOQS integration.
+
+Leighton-Micali Signatures (LMS), and its multi-tree variant, the Hierarchical Signature System (HSS), are both post-quantum, stateful hash-based signature schemes. They are noted for having small public and private keys, and fast signing and verifying. Their signature sizes are larger, but are tunable via their Winternitz parameter. See these two links from RFC8554 for more details:
+
+- LMS: <https://datatracker.ietf.org/doc/html/rfc8554>
+- HSS: <https://datatracker.ietf.org/doc/html/rfc8554#section-6>


But you say " LMS and HSS hash-based signature schemes " which makes it sound like 2 separate schemes.

anhu · 2023-07-11T14:40:32Z

wolfSSL/src/appendix07.md

+
+#### Benchmark Data
+
+The following benchmark data was taken on an 8-core Intel i7-8700 CPU @ 3.20GHz, on Fedora 38 (`6.2.9-300.fc38.x86_64`).


You didn't mention how many threads were spawned in this line.

anhu · 2023-07-11T15:19:40Z

Ok. Write that you saw 6 threads spawned.

philljj · 2023-07-11T21:36:53Z

Ok. Write that you saw 6 threads spawned.

I capped the number of threads at 4, so could clearly state it used 4 cores in the multi-threaded benchmark.

anhu

Excellent!

philljj requested a review from anhu July 9, 2023 20:33

philljj self-assigned this Jul 9, 2023

Add LMS/HSS signatures to documentation.

70c9a81

philljj force-pushed the add_lmshss_docs branch from 5364906 to 70c9a81 Compare July 10, 2023 04:22

philljj changed the title ~~Add LMS/HSS signatures to documenation.~~ Add LMS/HSS signatures to documentation. Jul 10, 2023

philljj mentioned this pull request Jul 10, 2023

Add LMS/HSS wolfCrypt hooks. wolfSSL/wolfssl#6564

Merged

anhu requested changes Jul 10, 2023

View reviewed changes

Cleanup, and add threading comments.

f46bd4c

philljj requested a review from anhu July 11, 2023 04:56

anhu requested changes Jul 11, 2023

View reviewed changes

LMS: cleanup wording, state threads clearly

1c17064

philljj requested a review from anhu July 11, 2023 21:18

anhu approved these changes Jul 13, 2023

View reviewed changes

philljj requested a review from JacobBarthelmeh July 13, 2023 21:17

philljj assigned JacobBarthelmeh Jul 13, 2023

JacobBarthelmeh approved these changes Jul 13, 2023

View reviewed changes

JacobBarthelmeh merged commit 2cbe256 into wolfSSL:master Jul 13, 2023
2 checks passed

philljj deleted the add_lmshss_docs branch July 18, 2023 14:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add LMS/HSS signatures to documentation. #101

Add LMS/HSS signatures to documentation. #101

philljj commented Jul 9, 2023 •

edited

anhu Jul 10, 2023

anhu Jul 10, 2023

anhu Jul 10, 2023

anhu Jul 10, 2023

anhu Jul 10, 2023

philljj Jul 10, 2023

anhu Jul 11, 2023

anhu Jul 10, 2023

anhu Jul 11, 2023

philljj Jul 11, 2023

anhu Jul 11, 2023

anhu Jul 11, 2023

anhu commented Jul 11, 2023

philljj commented Jul 11, 2023

anhu left a comment


		### Motivation

		HBS schemes are of growing interest for a number of reasons.


		Furthermore, the CNSA 2.0 timeline has specified that post-quantum HBS schemes should be used exclusively by 2030, and adoption should begin _immediately_. In fact, adoption of LMS is the earliest requirement in the CNSA 2.0 suite timeline.

		However, the stateful nature of HBS schemes requires that significant care is given to their use and tracking their state. In an HBS system, the private key is actually a finite set of one-time signature (OTS) keys, which may never be reused. If the same OTS key were used to sign two different messages, it would be possible for an attacker to fabricate signatures, and the security of the entire scheme would unravel. Therefore, HBS schemes are not suitable for general use such as the public internet.


		However, the stateful nature of HBS schemes requires that significant care is given to their use and tracking their state. In an HBS system, the private key is actually a finite set of one-time signature (OTS) keys, which may never be reused. If the same OTS key were used to sign two different messages, it would be possible for an attacker to fabricate signatures, and the security of the entire scheme would unravel. Therefore, HBS schemes are not suitable for general use such as the public internet.

		Instead, because of these unique strengths and characteristics, and NIST and NSA backing, HBS schemes such as LMS/HSS are of particular interest for offline firmware authentication and signature verification, especially on embedded or constrained systems that are expected to have a long operational lifetime and thus need to be resilient against a post-quantum future.


		#### Benchmark Data

		The following benchmark data was taken on an 8-core Intel i7-8700 CPU @ 3.20GHz, on Fedora 38 (`6.2.9-300.fc38.x86_64`).

Add LMS/HSS signatures to documentation. #101

Add LMS/HSS signatures to documentation. #101

Conversation

philljj commented Jul 9, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

anhu commented Jul 11, 2023

philljj commented Jul 11, 2023

anhu left a comment

Choose a reason for hiding this comment

philljj commented Jul 9, 2023 •

edited