Re: [Cfrg] New Version Notification for draft-irtf-cfrg-xmss-hash-based-signatures-03.txt

Hi,

after publishing the new version of the draft we now also adapted our
references implementations. There are two independent reference
implementations (both C) available:
- Reference implementation by Stefan and Denis, available from
http://www.square-up.org/index/publications.html. This code implements
all algorithms following the draft as close as possible.
- Reference implementation by Joost Rijneveld and Andreas, available
from https://huelsing.wordpress.com/code/. This package contains two
implementations. One that implements the simplest but also least
efficient algorithms and one that is efficient but also more complicated
to follow as it implements advanced tree traversal algorithms.

The implementations are tested against each other, so you can choose the
one that you find most accessible.

Cheers,

Stefan, Denis & Andreas

On 02/15/16 12:55, A. Huelsing wrote:
> Hi,
>
> we pushed a new version of the XMSS draft for hash-based signatures. The
> two main changes are
> 1. We incorporate the index of a signature to compute the message
> representative: M' = H(idx || R || M). This allows to mitigate speed-ups
> for attacks that collect many signatures and then try to forge a new
> signature, finding a colliding (M,R) pair.
> 2. We changed the address format to be more implementation friendly,
> i.e., fields do not cross byte or word boundaries anymore (one exception
> is a 40 bit field that simply does not fit a single word).
> Besides we did some minor remaining fixes. A complete change log can be
> found at the end of the draft.
>
> >From our side, the content of the draft is done with this update. We are
> only considering to publish one more update with test vectors. However,
> we are not entirely sure if this makes sense for such a scheme as it
> would easily become 50 - 100 pages (we would have to add all signatures
> for a key pair...). We would instead prefer to accompany the draft with
> a reference implementation that can be used to validate implementations.
>
> We currently got two independent reference implementations of the last
> version of the draft that were tested against each other. We will update
> them during the coming days to meet this version.
>
> Cheers,
>
> Stefan, Denis & Andreas
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg