Re: [Suit] SUIT Manifest MTI Algorithms

[Emmanuel Baccelli <[e-mail]>]

Hi Michael,

    > [...] for small-sized software updates using SUIT with LMS, we
>     > measured impact on network transfer costs (~45% more data over the
>     > wire) and on memory footprint on-device (~35% more Flash memory
>     > required), but only little impact on RAM or execution time, compared
> to
>     > using SUIT with ed25519. If the baseline is something else (i.e. not
>     > SUIT, or not ed25519), the overhead might be more.
>
> I looked into your paper trying to understand where this 35% more flash
> memory required.  Is it table 6 and 7?   I think it's a 35% increase of
> the verification code from ECDSA to HSS-LSS.  I don't think it's a 35%
> increase in total flash required, right?
>

It's table 8 in https://eprint.iacr.org/2021/781.pdf
and it's a ~35% increase in total Flash, for the basic image we used RIOT
(simple application with network stack CoAP + SUIT).


>     > What will be considered bearable overhead to upgrade to
> SUIT-compliant
>     > security, on microcontroller-based IoT devices? That is a question.
>
> Your paper seems to suggest it's acceptable.
>

Our experimental study confirms quantum-resistant SUIT is doable in
practice,
and LMS signatures seems the best choice for that, at this point.
We did not conclude on the wide acceptability of using "large footprint"
crypto.

--Emmanuel