Re: [Suit] PQM signature algorithm ROM requirements

[Russ Housley <[e-mail]>]

Koen:

Thanks for doing the work.  For HSS-LMS I expected the vast bull of the size to come from the SHA-256 part of the implementation, and this small code size aligns with that expectation.

Russ


> On Mar 24, 2022, at 9:01 AM, Koen Zandberg <[e-mail]> wrote:
> 
> Hi all,
> 
> During the discussion of the draft-ietf-suit-manifest document and the MTI part there was some discussion on PQM algorithms implementation sizes[1]. One question that was  raised was whether the ROM requirements on the algorithms in question (HSS-LMS and Falcon) is verification only, or includes the signing code. The short answer here is that the numbers in table 5 include the signing code. Based on our measurements with the same code base and on the same hardware, for HSS-LMS, a verification only build needs 2864 bytes for the HSS-LMS code. For Falcon it is 10112 bytes for verification only. (gcc 10.3.1 with -Os)
> 
> The HSS-LMS implementation used is the hash-sigs repo [2] from Cisco. The Falcon implementation used is based on the reference implementation [3]. The code to get these numbers is of course available online [4][5].
> 
> Best regards,
> Koen Zandberg
> 
> [1]: Article to appear in ACNS 2022. Preprint: https://eprint.iacr.org/2021/781.pdf
> [2]: https://github.com/cisco/hash-sigs
> [3]: https://falcon-sign.info/
> [4]: https://github.com/future-proof-iot/RIOT/tree/postquantum_crypto/tests/bench_hash-sigs
> [5]: https://github.com/future-proof-iot/RIOT/tree/postquantum_crypto/pkg/falcon_sig