[Curdle] On SSH-XMSS

[Marian Sigler <[e-mail]>]

Hi everyone.


I've stumbled upon the SSH-XMSS draft [1], and, after being very
astonished about it not mentioning the problems arising from XMSS's
statefulness, I found your discussion and I am glad that you decided not
to proceed on it.
I was wondering if it was possible to add a note to the draft that it
has been rejected?


Also, NIST has now published the Recommendations about stateful schemes
you've been talking about as a draft (already in December, actually) :

https://doi.org/10.6028/NIST.SP.800-208-draft

Since it hasn't been mentioned here, I thought some of you might
appreciate the hint.

To summarize: The recommendation explicitly forbids any use of XMSS
outside of hardware security modules. Further, it demands that the keys
be generated inside the hardware module, and that it never exports
private keying material.


Marian

[1] https://tools.ietf.org/id/draft-mu-curdle-ssh-xmss-00.html