Re: [Suit] NIST selected PQM algorithms

[Brendan Moran <[e-mail]>]

What about the other parameters of SPHINCS+? Do you know if it is suitable for constrained networks and constrained nodes? For example, it would be good to understand the signature, public, RAM, and code sizes, and how expensive is verification in cycles.

Brendan

> On 11 Jul 2022, at 21:48, Russ Housley <[e-mail]> wrote:
>
> I like the lack of state needed for the SPHINCS+ hash-based signature.  This is preferable over the stageful HSS/LMS hash-based signature that we have been discussing.
>
> Russ
>
>> On Jul 11, 2022, at 2:36 PM, Brendan Moran <[e-mail]> wrote:
>>
>> Hi Russ,
>>
>> Thank you for clarifying. I thought you were expressing a specific preference for SPHINCS+ above other Round 3 winners and I was hoping to get some insight as to why that was.
>>
>> Best Regards,
>> Brendan
>>
>>
>>> On 11 Jul 2022, at 15:23, Russ Housley <[e-mail]> wrote:
>>>
>>> I am not opposed to any of the NIST Round 3 Signature winners, but I gather it will be another year before there will be NIST standards.
>>>
>>> Russ
>>>
>>>
>>>> On Jul 10, 2022, at 4:37 PM, Brendan Moran <[e-mail]> wrote:
>>>>
>>>> Hi Russ,
>>>>
>>>> Are you opposed to Falcon for SUIT? If so, is it just the maturity of the algorithm? It seems to have an excellent set of tradeoffs. Bearing in mind that we are only looking at the verify operation, there shouldn’t be any concern about constant time implementations or side channels.
>>>>
>>>> Best regards,
>>>> Brendan
>>>>
>>>>> On 8 Jul 2022, at 16:51, Russ Housley <[e-mail]> wrote:
>>>>>
>>>>> I think SUIT needs to look at SPHINCS+ as an alternative to HSS/LMS for the hash-based signature algorithm, but the NIST standard for SPHINCS+ will probably not be available for a year.
>>>>>
>>>>> Russ
>>>>>
>>>>>
>>>>>> On Jul 8, 2022, at 7:25 AM, Koen Zandberg <[e-mail]> wrote:
>>>>>>
>>>>>> Hi all,
>>>>>>
>>>>>> NIST announced the first four quantum resistant cryptographic algorithms a few days back. Matching the earlier discussions on this list, NIST also selected FALCON for the case where smaller signatures are required.
>>>>>>> From what I understand of the process there is still a document that
>>>>>> should be released soon(tm) with the exact parameters that should be used for the algorithms. In any case I think this is good news for us as one of the selected algorithms matches what was preferred from the SUIT side.
>>>>>>
>>>>>> To be complete, the other algorithms selected are Dilithium and SPHINCS+, where Dilithium has large signatures (2.5 KB) and SPHINCS+ has even larger signatures (17 KB).
>>>>>>
>>>>>> Best Regards,
>>>>>> Koen Zandberg
>>>>>>
>>>>>> [1]: https://www.nist.gov/news-events/news/2022/07/nist-announces-first-four-quantum-resistant-cryptographic-algorithms
>>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> Suit mailing list
>>>>> [e-mail]
>>>>> https://www.ietf.org/mailman/listinfo/suit
>>>>
>>>> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
>>>> _______________________________________________
>>>> Suit mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/suit
>>>
>>> _______________________________________________
>>> Suit mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/suit
>>
>> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
>> _______________________________________________
>> Suit mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/suit
>

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.