Re: [Cfrg] RGLC on draft-irtf-cfrg-xmss-hash-based-signatures-03.txt

I agree with both of you. If the scheme is correctly implemented and
especially the key-handling is done right, I have more trust in this
scheme than in any other signature scheme. The reason is in theory what
Watson wrote. In practice: Every other signature scheme relies on the
security of a hash function AND some hard problem (RSA problem, DL,
etc...). The security of this scheme JUST relies on the hardness of hash
function properties that are much harder to break than
collision-resistance. As we just consider parameter sets that also
achieve a reasonable level of post-quantum security, the security margin
for the classical setting is enormous. This is the big difference
between hash-based signatures and other post-quantum cryptography (for
which I would totally agree that we need a disclaimer of the kind
Stephen proposed).

On the other hand, I agree that it is important to note that there is
not much experience yet with using stateful signature schemes in
practice. So, getting the key handling right requires awareness that
things are different from the setting of ECDSA, DSS, and all the other
signature schemes, people might be used to. We tried to emphasize this
in the draft. If CFRG thinks we did not emphasize it enough, I am happy
to add another statement.

Andreas   

Disclaimer: I did not discuss this with my co-authors yet, so I am just
speaking for myself.

On 06/28/16 17:08, Stephen Farrell wrote:
>
> On 28/06/16 16:02, Watson Ladd wrote:
>> We actually have significantly more confidence in XMSS security then any
>> other signature scheme. Signatures imply one way functions which are all
>> XMSS needs. There is a catch with backups I don't like, but there are
>> workarrounds.
> That was not my only concern and nor was my concern specific to
> this scheme.
>
> But sure, if someone wants to make a claim that this scheme is
> one on which large chunks of the Internet could today safely
> depend, and if that's a CFRG consensus position then saying that
> would be fine.
>
> Personally, I'd be in rough in that case, if for no other reason
> that the relatively immaturity of implementations.
>
> S.
>
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg