Subject: Re: [Cfrg] New Version Notification for draft-irtf-cfrg-xmss-hash-based-signatures-03.txt

From: "A. Huelsing" <[email-masked]>
Date: Mon, 15 Feb 2016 12:55:29 +0100

Hi,

we pushed a new version of the XMSS draft for hash-based signatures. The
two main changes are
1. We incorporate the index of a signature to compute the message
representative: M' = H(idx || R || M). This allows to mitigate speed-ups
for attacks that collect many signatures and then try to forge a new
signature, finding a colliding (M,R) pair.
2. We changed the address format to be more implementation friendly,
i.e., fields do not cross byte or word boundaries anymore (one exception
is a 40 bit field that simply does not fit a single word).
Besides we did some minor remaining fixes. A complete change log can be
found at the end of the draft.

>From our side, the content of the draft is done with this update. We are
only considering to publish one more update with test vectors. However,
we are not entirely sure if this makes sense for such a scheme as it
would easily become 50 - 100 pages (we would have to add all signatures
for a key pair...). We would instead prefer to accompany the draft with
a reference implementation that can be used to validate implementations.

We currently got two independent reference implementations of the last
version of the draft that were tested against each other. We will update
them during the coming days to meet this version.

Cheers,

Stefan, Denis & Andreas

---

From: "A. Huelsing" <[email-masked]>
Date: Wed, 17 Feb 2016 14:04:34 +0100

Hi,

after publishing the new version of the draft we now also adapted our
references implementations. There are two independent reference
implementations (both C) available:
- Reference implementation by Stefan and Denis, available from
http://www.square-up.org/index/publications.html. This code implements
all algorithms following the draft as close as possible.
- Reference implementation by Joost Rijneveld and Andreas, available
from https://huelsing.wordpress.com/code/. This package contains two
implementations. One that implements the simplest but also least
efficient algorithms and one that is efficient but also more complicated
to follow as it implements advanced tree traversal algorithms.

The implementations are tested against each other, so you can choose the
one that you find most accessible.

Cheers,

Stefan, Denis & Andreas

On 02/15/16 12:55, A. Huelsing wrote:
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg