Re: [Cfrg] Alternatives to McGrew's hash based signatures

[Zooko Wilcox-OHearn <[e-mail]>]

Hi, thanks for the mention of SPHINCS! I'm one of the authors of
SPHINCS. (Disclaimer: the other authors are the smart ones.)

The reason why I care about SPHINCS is that I would never want to rely
on durable update of mutable state. I come primarily from a
practical/engineering background. I've been doing security audits for
a living (with my company https://LeastAuthority.com). I've also
worked quite a lot in the storage world—databases, filesystems, cloud
storage, etc.

To me, the idea that you have to guarantee that a state update (i.e. a
previously unused sequence number or nonce) is durably written, or
else you leak your private signing key to an attacker… that's a
show-stopper. I disbelieve that any commodity hardware and software in
use today can do that safely.

Regards,

Zooko