Embed Size (px)
Citation preview
Let Live and Let Die Handling the State of Hash-based Signatures
Stefan-Lukas Gazdag Denis Butin amp Johannes Buchmann
04022014 - PQ Workshop - NIST 2015
1 18
Presentation
Introduction Statefulness Handling the state Protocol Integration and other considerations
2 18
Introduction Merkle XMSS tree
3 18
Statefulness
Whatrsquos so bad about the state Security leaks possible Software does not consider keys being stateful Missing infrastructure
4 18
Statefulness
Why bother coping with the state Hash-based signatures well understood and post-quantum Current stateful methods faster than stateless ones Currently smaller signatures Forward secure constructions
5 18
Considerations
What we want
Secure usage of secret key
What we need
Practicability
6 18
The secret key
Considerations for the key Any copies may reveal secrets Interrupts may threaten consistency Key is critical resource
7 18
Handling the state
How to cope with the state Index handling Error consistency checking Storing
8 18
Index handling
Single state Several two state solutions Delegation of subtrees
9 18
Errors and Consistency
Does the index fit the actual state Is the state consistent itself
10 18
Storing the secret key
Whorsquos able to access the storage Has the key actually been written to storage
rArr Doesnrsquot fit current libraries that well
11 18
Runtimes
Lots of use cases without tight restrictions
Update signing Email signing
But even with stricter timing 200 ms maximum for SSH signature procedure
12 18
Key Management Key provider concept rArr external management of key
Offers API to receive and write SK PK authentication path information Delegation of subsets of SK
13 18
Protocol integration
Keys still fit most communication protocols Need a PQ key exchange Need PQ signatures (hash-based) for that
14 18
Standardization
As seen in Andreas Hulsingrsquos talk before
Internet-Draft available draft-huelsing-cfrg-hash-sig-xmss-00
15 18
Statelessness
SPHINCS
See Daniel J Bernsteinrsquos talk and SPHINCS paper httpsphincscrypto
16 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
Presentation
Introduction Statefulness Handling the state Protocol Integration and other considerations
2 18
Introduction Merkle XMSS tree
3 18
Statefulness
Whatrsquos so bad about the state Security leaks possible Software does not consider keys being stateful Missing infrastructure
4 18
Statefulness
Why bother coping with the state Hash-based signatures well understood and post-quantum Current stateful methods faster than stateless ones Currently smaller signatures Forward secure constructions
5 18
Considerations
What we want
Secure usage of secret key
What we need
Practicability
6 18
The secret key
Considerations for the key Any copies may reveal secrets Interrupts may threaten consistency Key is critical resource
7 18
Handling the state
How to cope with the state Index handling Error consistency checking Storing
8 18
Index handling
Single state Several two state solutions Delegation of subtrees
9 18
Errors and Consistency
Does the index fit the actual state Is the state consistent itself
10 18
Storing the secret key
Whorsquos able to access the storage Has the key actually been written to storage
rArr Doesnrsquot fit current libraries that well
11 18
Runtimes
Lots of use cases without tight restrictions
Update signing Email signing
But even with stricter timing 200 ms maximum for SSH signature procedure
12 18
Key Management Key provider concept rArr external management of key
Offers API to receive and write SK PK authentication path information Delegation of subsets of SK
13 18
Protocol integration
Keys still fit most communication protocols Need a PQ key exchange Need PQ signatures (hash-based) for that
14 18
Standardization
As seen in Andreas Hulsingrsquos talk before
Internet-Draft available draft-huelsing-cfrg-hash-sig-xmss-00
15 18
Statelessness
SPHINCS
See Daniel J Bernsteinrsquos talk and SPHINCS paper httpsphincscrypto
16 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
Introduction Merkle XMSS tree
3 18
Statefulness
Whatrsquos so bad about the state Security leaks possible Software does not consider keys being stateful Missing infrastructure
4 18
Statefulness
Why bother coping with the state Hash-based signatures well understood and post-quantum Current stateful methods faster than stateless ones Currently smaller signatures Forward secure constructions
5 18
Considerations
What we want
Secure usage of secret key
What we need
Practicability
6 18
The secret key
Considerations for the key Any copies may reveal secrets Interrupts may threaten consistency Key is critical resource
7 18
Handling the state
How to cope with the state Index handling Error consistency checking Storing
8 18
Index handling
Single state Several two state solutions Delegation of subtrees
9 18
Errors and Consistency
Does the index fit the actual state Is the state consistent itself
10 18
Storing the secret key
Whorsquos able to access the storage Has the key actually been written to storage
rArr Doesnrsquot fit current libraries that well
11 18
Runtimes
Lots of use cases without tight restrictions
Update signing Email signing
But even with stricter timing 200 ms maximum for SSH signature procedure
12 18
Key Management Key provider concept rArr external management of key
Offers API to receive and write SK PK authentication path information Delegation of subsets of SK
13 18
Protocol integration
Keys still fit most communication protocols Need a PQ key exchange Need PQ signatures (hash-based) for that
14 18
Standardization
As seen in Andreas Hulsingrsquos talk before
Internet-Draft available draft-huelsing-cfrg-hash-sig-xmss-00
15 18
Statelessness
SPHINCS
See Daniel J Bernsteinrsquos talk and SPHINCS paper httpsphincscrypto
16 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
Statefulness
Whatrsquos so bad about the state Security leaks possible Software does not consider keys being stateful Missing infrastructure
4 18
Statefulness
Why bother coping with the state Hash-based signatures well understood and post-quantum Current stateful methods faster than stateless ones Currently smaller signatures Forward secure constructions
5 18
Considerations
What we want
Secure usage of secret key
What we need
Practicability
6 18
The secret key
Considerations for the key Any copies may reveal secrets Interrupts may threaten consistency Key is critical resource
7 18
Handling the state
How to cope with the state Index handling Error consistency checking Storing
8 18
Index handling
Single state Several two state solutions Delegation of subtrees
9 18
Errors and Consistency
Does the index fit the actual state Is the state consistent itself
10 18
Storing the secret key
Whorsquos able to access the storage Has the key actually been written to storage
rArr Doesnrsquot fit current libraries that well
11 18
Runtimes
Lots of use cases without tight restrictions
Update signing Email signing
But even with stricter timing 200 ms maximum for SSH signature procedure
12 18
Key Management Key provider concept rArr external management of key
Offers API to receive and write SK PK authentication path information Delegation of subsets of SK
13 18
Protocol integration
Keys still fit most communication protocols Need a PQ key exchange Need PQ signatures (hash-based) for that
14 18
Standardization
As seen in Andreas Hulsingrsquos talk before
Internet-Draft available draft-huelsing-cfrg-hash-sig-xmss-00
15 18
Statelessness
SPHINCS
See Daniel J Bernsteinrsquos talk and SPHINCS paper httpsphincscrypto
16 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
Statefulness
Why bother coping with the state Hash-based signatures well understood and post-quantum Current stateful methods faster than stateless ones Currently smaller signatures Forward secure constructions
5 18
Considerations
What we want
Secure usage of secret key
What we need
Practicability
6 18
The secret key
Considerations for the key Any copies may reveal secrets Interrupts may threaten consistency Key is critical resource
7 18
Handling the state
How to cope with the state Index handling Error consistency checking Storing
8 18
Index handling
Single state Several two state solutions Delegation of subtrees
9 18
Errors and Consistency
Does the index fit the actual state Is the state consistent itself
10 18
Storing the secret key
Whorsquos able to access the storage Has the key actually been written to storage
rArr Doesnrsquot fit current libraries that well
11 18
Runtimes
Lots of use cases without tight restrictions
Update signing Email signing
But even with stricter timing 200 ms maximum for SSH signature procedure
12 18
Key Management Key provider concept rArr external management of key
Offers API to receive and write SK PK authentication path information Delegation of subsets of SK
13 18
Protocol integration
Keys still fit most communication protocols Need a PQ key exchange Need PQ signatures (hash-based) for that
14 18
Standardization
As seen in Andreas Hulsingrsquos talk before
Internet-Draft available draft-huelsing-cfrg-hash-sig-xmss-00
15 18
Statelessness
SPHINCS
See Daniel J Bernsteinrsquos talk and SPHINCS paper httpsphincscrypto
16 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
Considerations
What we want
Secure usage of secret key
What we need
Practicability
6 18
The secret key
Considerations for the key Any copies may reveal secrets Interrupts may threaten consistency Key is critical resource
7 18
Handling the state
How to cope with the state Index handling Error consistency checking Storing
8 18
Index handling
Single state Several two state solutions Delegation of subtrees
9 18
Errors and Consistency
Does the index fit the actual state Is the state consistent itself
10 18
Storing the secret key
Whorsquos able to access the storage Has the key actually been written to storage
rArr Doesnrsquot fit current libraries that well
11 18
Runtimes
Lots of use cases without tight restrictions
Update signing Email signing
But even with stricter timing 200 ms maximum for SSH signature procedure
12 18
Key Management Key provider concept rArr external management of key
Offers API to receive and write SK PK authentication path information Delegation of subsets of SK
13 18
Protocol integration
Keys still fit most communication protocols Need a PQ key exchange Need PQ signatures (hash-based) for that
14 18
Standardization
As seen in Andreas Hulsingrsquos talk before
Internet-Draft available draft-huelsing-cfrg-hash-sig-xmss-00
15 18
Statelessness
SPHINCS
See Daniel J Bernsteinrsquos talk and SPHINCS paper httpsphincscrypto
16 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
The secret key
Considerations for the key Any copies may reveal secrets Interrupts may threaten consistency Key is critical resource
7 18
Handling the state
How to cope with the state Index handling Error consistency checking Storing
8 18
Index handling
Single state Several two state solutions Delegation of subtrees
9 18
Errors and Consistency
Does the index fit the actual state Is the state consistent itself
10 18
Storing the secret key
Whorsquos able to access the storage Has the key actually been written to storage
rArr Doesnrsquot fit current libraries that well
11 18
Runtimes
Lots of use cases without tight restrictions
Update signing Email signing
But even with stricter timing 200 ms maximum for SSH signature procedure
12 18
Key Management Key provider concept rArr external management of key
Offers API to receive and write SK PK authentication path information Delegation of subsets of SK
13 18
Protocol integration
Keys still fit most communication protocols Need a PQ key exchange Need PQ signatures (hash-based) for that
14 18
Standardization
As seen in Andreas Hulsingrsquos talk before
Internet-Draft available draft-huelsing-cfrg-hash-sig-xmss-00
15 18
Statelessness
SPHINCS
See Daniel J Bernsteinrsquos talk and SPHINCS paper httpsphincscrypto
16 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
Handling the state
How to cope with the state Index handling Error consistency checking Storing
8 18
Index handling
Single state Several two state solutions Delegation of subtrees
9 18
Errors and Consistency
Does the index fit the actual state Is the state consistent itself
10 18
Storing the secret key
Whorsquos able to access the storage Has the key actually been written to storage
rArr Doesnrsquot fit current libraries that well
11 18
Runtimes
Lots of use cases without tight restrictions
Update signing Email signing
But even with stricter timing 200 ms maximum for SSH signature procedure
12 18
Key Management Key provider concept rArr external management of key
Offers API to receive and write SK PK authentication path information Delegation of subsets of SK
13 18
Protocol integration
Keys still fit most communication protocols Need a PQ key exchange Need PQ signatures (hash-based) for that
14 18
Standardization
As seen in Andreas Hulsingrsquos talk before
Internet-Draft available draft-huelsing-cfrg-hash-sig-xmss-00
15 18
Statelessness
SPHINCS
See Daniel J Bernsteinrsquos talk and SPHINCS paper httpsphincscrypto
16 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
Index handling
Single state Several two state solutions Delegation of subtrees
9 18
Errors and Consistency
Does the index fit the actual state Is the state consistent itself
10 18
Storing the secret key
Whorsquos able to access the storage Has the key actually been written to storage
rArr Doesnrsquot fit current libraries that well
11 18
Runtimes
Lots of use cases without tight restrictions
Update signing Email signing
But even with stricter timing 200 ms maximum for SSH signature procedure
12 18
Key Management Key provider concept rArr external management of key
Offers API to receive and write SK PK authentication path information Delegation of subsets of SK
13 18
Protocol integration
Keys still fit most communication protocols Need a PQ key exchange Need PQ signatures (hash-based) for that
14 18
Standardization
As seen in Andreas Hulsingrsquos talk before
Internet-Draft available draft-huelsing-cfrg-hash-sig-xmss-00
15 18
Statelessness
SPHINCS
See Daniel J Bernsteinrsquos talk and SPHINCS paper httpsphincscrypto
16 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
Errors and Consistency
Does the index fit the actual state Is the state consistent itself
10 18
Storing the secret key
Whorsquos able to access the storage Has the key actually been written to storage
rArr Doesnrsquot fit current libraries that well
11 18
Runtimes
Lots of use cases without tight restrictions
Update signing Email signing
But even with stricter timing 200 ms maximum for SSH signature procedure
12 18
Key Management Key provider concept rArr external management of key
Offers API to receive and write SK PK authentication path information Delegation of subsets of SK
13 18
Protocol integration
Keys still fit most communication protocols Need a PQ key exchange Need PQ signatures (hash-based) for that
14 18
Standardization
As seen in Andreas Hulsingrsquos talk before
Internet-Draft available draft-huelsing-cfrg-hash-sig-xmss-00
15 18
Statelessness
SPHINCS
See Daniel J Bernsteinrsquos talk and SPHINCS paper httpsphincscrypto
16 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
Storing the secret key
Whorsquos able to access the storage Has the key actually been written to storage
rArr Doesnrsquot fit current libraries that well
11 18
Runtimes
Lots of use cases without tight restrictions
Update signing Email signing
But even with stricter timing 200 ms maximum for SSH signature procedure
12 18
Key Management Key provider concept rArr external management of key
Offers API to receive and write SK PK authentication path information Delegation of subsets of SK
13 18
Protocol integration
Keys still fit most communication protocols Need a PQ key exchange Need PQ signatures (hash-based) for that
14 18
Standardization
As seen in Andreas Hulsingrsquos talk before
Internet-Draft available draft-huelsing-cfrg-hash-sig-xmss-00
15 18
Statelessness
SPHINCS
See Daniel J Bernsteinrsquos talk and SPHINCS paper httpsphincscrypto
16 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
Runtimes
Lots of use cases without tight restrictions
Update signing Email signing
But even with stricter timing 200 ms maximum for SSH signature procedure
12 18
Key Management Key provider concept rArr external management of key
Offers API to receive and write SK PK authentication path information Delegation of subsets of SK
13 18
Protocol integration
Keys still fit most communication protocols Need a PQ key exchange Need PQ signatures (hash-based) for that
14 18
Standardization
As seen in Andreas Hulsingrsquos talk before
Internet-Draft available draft-huelsing-cfrg-hash-sig-xmss-00
15 18
Statelessness
SPHINCS
See Daniel J Bernsteinrsquos talk and SPHINCS paper httpsphincscrypto
16 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
Key Management Key provider concept rArr external management of key
Offers API to receive and write SK PK authentication path information Delegation of subsets of SK
13 18
Protocol integration
Keys still fit most communication protocols Need a PQ key exchange Need PQ signatures (hash-based) for that
14 18
Standardization
As seen in Andreas Hulsingrsquos talk before
Internet-Draft available draft-huelsing-cfrg-hash-sig-xmss-00
15 18
Statelessness
SPHINCS
See Daniel J Bernsteinrsquos talk and SPHINCS paper httpsphincscrypto
16 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
Protocol integration
Keys still fit most communication protocols Need a PQ key exchange Need PQ signatures (hash-based) for that
14 18
Standardization
As seen in Andreas Hulsingrsquos talk before
Internet-Draft available draft-huelsing-cfrg-hash-sig-xmss-00
15 18
Statelessness
SPHINCS
See Daniel J Bernsteinrsquos talk and SPHINCS paper httpsphincscrypto
16 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
Standardization
As seen in Andreas Hulsingrsquos talk before
Internet-Draft available draft-huelsing-cfrg-hash-sig-xmss-00
15 18
Statelessness
SPHINCS
See Daniel J Bernsteinrsquos talk and SPHINCS paper httpsphincscrypto
16 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
Statelessness
SPHINCS
See Daniel J Bernsteinrsquos talk and SPHINCS paper httpsphincscrypto
16 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
Conclusion
State can be managed a feasible way
But Trade-off security ltgt performance
TBD Exact comparison of those trade-offs
17 18
Thank you
Questions
wwwpqsignaturesorg
18 18
Thank you
Questions
wwwpqsignaturesorg
18 18
![CHAPTER 10 MAPS, HASH TABLES, AND SKIP LISTSjdenny/Courses/Prior/16-17...•Assume you have a hash table 𝐻with =9slots ( [0−8]) and let the hash function be ℎ G= Gmod •Demonstrate](https://img.dokumen.tips/doc/110x75/60b3c0359c3ac71069607624/chapter-10-maps-hash-tables-and-skip-jdennycoursesprior16-17-aassume-you.jpg)
![Evolving Hash Functions using Genetic Algorithmsajiips.com.au/papers/V4.1/V4N1.4 - Evolving Hash Functions using... · hash function called "PKP Hash" by Peter.K.Pearson [5] that](https://img.dokumen.tips/doc/110x75/5e3486a76e7276290f0add90/evolving-hash-functions-using-genetic-evolving-hash-functions-using-hash.jpg)
