[Pqc] Guidance for runnning Stateful Hash-Based Signatures

[Thom Wiggers <[e-mail]>]

Hi all,

As I just presented at the IETF 119 PQUIP meeting, we got together with a bunch of people to write down as much as we could think of on how you can build reliably and safely on top of stateful hash-based signature schemes (if you can’t just avoid them, which you likely SHOULD).

We set out to document stuff ranging from operational considerations like staff training, discuss things mentioned in SP800-208 such as how you can have split trees in multiple signers, discuss what one should consider in certain alternative approaches to state management for specific scenarios, and also include some approaches to backup management that go a little bit beyond what SP800-208 allows (as it currently bans all forms of key export).

The initial version of our draft can be found at https://datatracker.ietf.org/doc/draft-wiggers-hbs-state/  and it lives on Github at https://github.com/hbs-guidance/draft-hbs-state.

We are looking forward to having productive discussions with everyone to make this document as complete as possible. We already have a good discussion point for some new content in the issue tracker: should we include a paragraph on “when are S-HBS schemes appropriate in the first place?”.

On behalf of my co-authors,

Cheers,

Thom