Subject: [Cfrg] XMSS and https://ia.cr/2017/938

From: Dan Brown <[email-masked]>
Date: Fri, 27 Apr 2018 15:23:39 +0000

Hi XMSS team,

Lafrance and Menezes https://ia.cr/2017/938 describe a flaw in a security analysis and correction to the security estimates for WOTS-PRF and to XMSS.  I am rather new to this area, so I naively ask:

Are the Lafrance—Menezes results applicable to (and addressed by) the current draft of XMSS?

Best regards,

Dan Brown
Standards Manager
Office: +1 (289) 261-4157
Mobile: +1 (416) 276-1736
[email-masked]

 <http://www.blackberry.com/>

---

From: Philip Lafrance <[email-masked]>
Date: Fri, 27 Apr 2018 15:29:07 +0000

Hello Dan,

(I'm not a member of the XMSS team, but felt qualified to answer.)

The answer to your question is not at all. Our paper only discussed the
security of WOTS-PRF and this has no bearing on the security of other
Winternitz constructions. In particular I should say that the WOTS+ scheme
remains secure.

Good question though! And thanks for asking :)

Warm regards,
Philip Lafrance

On Fri, Apr 27, 2018, 11:24 AM Dan Brown, <[email-masked]> wrote:

> Hi XMSS team,
>
>
>
> Lafrance and Menezes https://ia.cr/2017/938 describe a flaw in a security
> analysis and correction to the security estimates for WOTS-PRF and to
> XMSS.  I am rather new to this area, so I naively ask:
>
>
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>

---

From: Dan Brown <[email-masked]>
Date: Fri, 27 Apr 2018 15:43:33 +0000

Hi Philip,

Thanks …

You’re too kind about my question being good: I see now that the concluding remarks of your paper already said that the XMSS Internet draft was not affected. Earlier parts of your talked about XMSS when instantiated with WOTS-PRF – I had focused on these without catching the ID version of XMSS does not use WOTS-PRF …  

It was my mistake to miss both details – so the question was not so good after all.

Still, I wonder if a reference to your paper in the Internet Draft would be helpful, to at least that it repeat that it does not apply.

Dan

From: Philip Lafrance [mailto:[email-masked]] 
Sent: Friday, April 27, 2018 11:29 AM
To: Dan Brown <[email-masked]>
Cc: [email-masked]
Subject: Re: [Cfrg] XMSS and https://ia.cr/2017/938

Hello Dan,

The answer to your question is not at all. Our paper only discussed the security of WOTS-PRF and this has no bearing on the security of other Winternitz constructions. In particular I should say that the WOTS+ scheme remains secure. 

Warm regards, 

Philip Lafrance 

On Fri, Apr 27, 2018, 11:24 AM Dan Brown, <[email-masked] <mailto:[email-masked]> > wrote:

Hi XMSS team,

Best regards,

Dan Brown
Standards Manager
Office: +1 (289) 261-4157
Mobile: +1 (416) 276-1736
[email-masked] <mailto:[email-masked]> 

_______________________________________________
Cfrg mailing list
[email-masked] <mailto:[email-masked]> 
https://www.irtf.org/mailman/listinfo/cfrg

---

From: "A. Huelsing" <[email-masked]>
Date: Fri, 27 Apr 2018 22:06:31 +0200

Dear Dan,

thanks that you found the time to eventually look at our draft that was
discussed on list several times. It is currently at the RFC editor and we are
sorry but we will not touch it anymore to add references, that time has past.

Thanks,

Andreas

Am 27-04-18 um 17:43 schrieb Dan Brown:
>
> Hi Philip,
>
> Thanks …
>
> You’re too kind about my question being good: I see now that the concluding
> remarks of your paper already said that the XMSS Internet draft was not
> affected. Earlier parts of your talked about XMSS when instantiated with
> WOTS-PRF – I had focused on these without catching the ID version of XMSS does
> not use WOTS-PRF … 
>
> Still, I wonder if a reference to your paper in the Internet Draft would be
> helpful, to at least that it repeat that it does not apply.
>
> Dan
>
>  
>
> *From:* Philip Lafrance [mailto:[email-masked]]
> *Sent:* Friday, April 27, 2018 11:29 AM
> *To:* Dan Brown <[email-masked]>
> *Cc:* [email-masked]
> *Subject:* Re: [Cfrg] XMSS and https://ia.cr/2017/938
>
>  
>
> Hello Dan,
>
>  
>
> On Fri, Apr 27, 2018, 11:24 AM Dan Brown, <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>     Hi XMSS team,
>
>      
>
>     BlackBerry <http://www.blackberry.com/>
>
>      
>