Re: [Cfrg] I-D Action: draft-mcgrew-hash-sigs-03.txt

[Russ Housley <[e-mail]>]

Watson:
> > It is true that there exists a bunch of scenarios where you should stay
> > away from stateful schemes as Zooko and Watson mentioned. Usage on
> > virtual machines is probably the most important one. That was also the
> > main motivation to develop SPHINCS. However, SPHINCS has two drawbacks:
> > It's signatures are rather large with 41kB and signing becomes really
> > slow on resource constrained devices [1]. Although verification time is
> > not too bad, it is significantly slower than XMSS. That's why it might
> > be reasonable to use a stateful scheme in such scenarios. Especially on
> > smart cards and similar resource constrained devices I would clearly
> > suggest to go for one of the stateful schemes instead of SPHINCS. For
> > those it is possible to make sure that a signature is only returned
> > after the new key state was written to NVM, it is also known how to
> > protect against fault attacks that try to change the stored index: you
> > can use a forward secure version of XMSS, in that case no information
> > about previous one-time keys is left on a card. Consequently, such a
> > fault attack would simply be a DOS attack (given that this requires
> > direct access to the hardware this could also be achieved easier by an
> > attacker). There are other, similar scenarios where it is also easily
> > possible to prevent copies of the secret key. (Note: Only signing (SK)
> > is stateful, verification (PK) is stateless, I was not sure if this was
> > clear from some comments)
> 
> Let's consider this further. There is no backup: if you sit on that card, or put it in the microwave because it's wet and needs to be dried out, the key dies. So if this card is the only copy of the key needed to update every router in the world, I doubt anyone is comfortable with that.
> 
> Stateful schemes seem to have a very small range of application.
> 
I naive approach to backup could lead to a serious security problem, but there are approach to backup that ensure that tree nodes are not reused.  For example, one could assign a subtree to each of the hardware modules that have the private key.  If one of them fails, then the signature space is lost, but there is not a security failure.

Russ