Re: [Suit] SUIT Manifest MTI Algorithms

[Russ Housley <[e-mail]>]

Emmanuel:

The signature verification for HSS/LMS should be much smaller and faster too.

I notices that you used the Cisco SHA-256 for HSS/LMS.  When I was using the Cisco code to ensure that pyhsslms.py was interoperable, I discovered that the SHA-256 in OpenSSL was a lot faster.  I wonder if the SHA-256 from mbedtls would give you different results.

Russ


> On Nov 10, 2021, at 2:32 PM, Michael Richardson <[e-mail]> wrote:
> 
> Emmanuel Baccelli <[e-mail]> wrote:
>> We have recently conducted an experimental study on this topic,
>> evaluating SUIT on common microcontrollers (Cortex-M, ESP-32 and
>> RISC-V) In particular, we evaluate the cost of upgrading from ed25519
>> to HSS/LMS with SUIT used to secure actual RIOT firmware updates: see
>> preprint at https://eprint.iacr.org/2021/781.pdf
> 
> Awesome!
> 
>> In a nutshell: for small-sized software updates using SUIT with LMS, we
>> measured impact on network transfer costs (~45% more data over the
>> wire) and on memory footprint on-device (~35% more Flash memory
>> required), but only little impact on RAM or execution time, compared to
>> using SUIT with ed25519. If the baseline is something else (i.e. not
>> SUIT, or not ed25519), the overhead might be more.
> 
> I looked into your paper trying to understand where this 35% more flash
> memory required.  Is it table 6 and 7?   I think it's a 35% increase of
> the verification code from ECDSA to HSS-LSS.  I don't think it's a 35%
> increase in total flash required, right?
> 
>> What will be considered bearable overhead to upgrade to SUIT-compliant
>> security, on microcontroller-based IoT devices? That is a question.
> 
> Your paper seems to suggest it's acceptable.
> 
> --
> ]               Never tell me the odds!                 | ipv6 mesh networks [
> ]   Michael Richardson, Sandelman Software Works        | network architect  [
> ]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [
> 
> 
>