Subject: [Cfrg] Comments on draft-mcgrew-hashsigs-13

From: Philip Lafrance <[email-masked]>
Date: Wed, 12 Dec 2018 16:01:12 +0000

Greetings all,

My colleagues and I had some comments on draft-mcgrew-hashsigs-13 we wanted to share with you.

1) Section 6, top of page 28

      “pub[i] is the current LMS public key of the i-th level (which

      includes the identifier I as well as the root node value K),”

The notation “K” is used in LM-OTS, not in LMS (as per Algorithm 1), and so K should be replaced with T[1]. Although, we might then want to use different notation for the i-th LMS root node: T_i[1], T^i[1], Ti[1], whatever floats your boat. Also, typecodes for LMS and LM-OTS are included in pub[i] along with I and T[1], is this worth including in the above text?

2) Section 6.1 (HSS) Key Generation

 “To generate an HSS private and public key pair, new LMS private and

   public keys are generated for prv[i] and pub[i] for i=0, ... , L-1…”

Initial HSS key gen requires only the generation of the single tree on the topmost level. I’d say that generating L LMS key-pairs at the time of initial (global) key generation is more of an optimization than a requirement. Such as if you want to cache LMS keys at the onset or something. Considering the text that follows:

“The public key of the HSS scheme consists of the number of levels L,

   followed by pub[0], the public key of the top level”

maybe we can clarify this discussion?

3) Algorithm 7: Generating an HSS keypair

This is along the same vein as my above comment. Step 2. of Algorithm 7 is the following:

      2. sign each child key pair with the private key of its parent:

        i  = 0

            while (i < L-1) {

              sig[i] = lms_signature( pub[i+1], priv[i] )

                  i = i + 1

            }

The 3rd and final step of the algorithm is just to return u32str(L)||pub[0]. The text at the top of the page says, “These key pairs, and their identifiers, MUST be generated independently.” And so pub[0] is independent of all other LMS public keys; i.e., doesn’t need them to be generated first. Further, the sig[i] are not used in the algorithm at all, nor is their purpose mentioned. The text immediately following Alg 7 clearly states that Step 2. isn’t necessary, but I think the presentation here is needlessly complicated.

Thanks to Mark Paruzel and Szilard Balla!

Warm regards, and happy holidays to all.
Philip Lafrance
--

[id:[email-masked]]

Philip Lafrance | Standards Manager
Mobile: +1.226.750.2439

www.isara.com<https://www.isara.com/> · 560 Westmount Road North, Waterloo, Ontario N2L 0A9 CANADA