Leighton-Micali Hash-Based Signatures

Fluhrer, Scott R.; McGrew, David; Curcio, Michael

doi:10.17487/rfc8554

Cited by 70 publications

(99 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Both [1] and [2] define single tree as well as multi-tree variants of their signature schemes. In an instance that involves two levels of trees, as shown in Figure 4, the OTS keys that form the leaves of the top-level tree sign the roots of the trees at the bottom level, and the OTS keys that form the leaves of the bottom-level trees are used to sign the messages.…”

Section: Two-level Treesmentioning

confidence: 99%

“…The root of the top-level tree is the public key for the signature scheme. 2 As described in Section 7, the use of two levels of trees can make it easier to distribute OTS keys across multiple cryptographic modules in order to protect against private key loss. A set of OTS keys can be created in one cryptographic module, and the root of the Merkle tree formed from these keys can be published as the public key for the signature scheme.…”

Section: Two-level Treesmentioning

confidence: 99%

“…This publication supplements FIPS 186-4 [4] by specifying two additional digital signature 255 schemes, both of which are stateful hash-based signature (HBS) schemes: the Leighton-Micali 256 Signature (LMS) system [2] and the eXtended Merkle Signature Scheme (XMSS) [1], along with 257 their multi-tree variants, the Hierarchical Signature System (HSS) and multi-tree XMSS 258 (XMSS MT ). All of the digital signature schemes specified in FIPS 186-4 will be broken if largescale quantum computers are ever built.…”

Section: Introduction 254mentioning

confidence: 99%

“…This recommendation specifies profiles of LMS, HSS, XMSS, and XMSS MT that are appropriate for use by the U.S. Federal Government. This profile approves the use of some but not all of the parameter sets defined in [1] and [2] and also defines some new parameter sets. The approved parameter sets use either SHA-256 or SHAKE256 with 192-or 256-bit outputs.…”

Section: Introduction 254mentioning

confidence: 99%

See 3 more Smart Citations

Recommendation for Stateful Hash-Based Signature Schemes

Cooper¹

2019

Preprint

View full text Add to dashboard Cite

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

show abstract

Section: Two-level Treesmentioning

confidence: 99%

Section: Two-level Treesmentioning

confidence: 99%

Section: Introduction 254mentioning

confidence: 99%

Section: Introduction 254mentioning

confidence: 99%

See 2 more Smart Citations

Recommendation for Stateful Hash-Based Signature Schemes

Cooper¹

2019

Preprint

View full text Add to dashboard Cite

show abstract

“…Our lower bound on inverting hash chains is well suited for these settings and can be used to derive time-space tradeoff proofs of security for these constructions. This is especially relevant as these schemes are being standardized [32,36,43].…”

Section: Figure 1: Sketch Of T/keymentioning

confidence: 99%

T/Key

Kogan

Manohar

Boneh

2017

Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

Time-based one-time password (TOTP) systems in use today require storing secrets on both the client and the server. As a result, an attack on the server can expose all second factors for all users in the system. We present T/Key, a time-based one-time password system that requires no secrets on the server. Our work modernizes the classic S/Key system and addresses the challenges in making such a system secure and practical. At the heart of our construction is a new lower bound analyzing the hardness of inverting hash chains composed of independent random functions, which formalizes the security of this widely used primitive. Additionally, we develop a near-optimal algorithm for quickly generating the required elements in a hash chain with little memory on the client. We report on our implementation of T/Key as an Android application. T/Key can be used as a replacement for current TOTP systems, and it remains secure in the event of a server-side compromise. The cost, as with S/Key, is that one-time passwords are longer than the standard six characters used in TOTP.

show abstract