[Suit] PQM signature algorithm ROM requirements

[Koen Zandberg <[e-mail]>]

Hi all,

During the discussion of the draft-ietf-suit-manifest document and the 
MTI part there was some discussion on PQM algorithms implementation 
sizes[1]. One question that was  raised was whether the ROM requirements 
on the algorithms in question (HSS-LMS and Falcon) is verification only, 
or includes the signing code. The short answer here is that the numbers 
in table 5 include the signing code. Based on our measurements with the 
same code base and on the same hardware, for HSS-LMS, a verification 
only build needs 2864 bytes for the HSS-LMS code. For Falcon it is 10112 
bytes for verification only. (gcc 10.3.1 with -Os)

The HSS-LMS implementation used is the hash-sigs repo [2] from Cisco. 
The Falcon implementation used is based on the reference implementation 
[3]. The code to get these numbers is of course available online [4][5].

Best regards,
Koen Zandberg

[1]: Article to appear in ACNS 2022. Preprint: 
https://eprint.iacr.org/2021/781.pdf
[2]: https://github.com/cisco/hash-sigs
[3]: https://falcon-sign.info/
[4]: 
https://github.com/future-proof-iot/RIOT/tree/postquantum_crypto/tests/bench_hash-sigs
[5]: 
https://github.com/future-proof-iot/RIOT/tree/postquantum_crypto/pkg/falcon_sig