Recommendation for Stateful Hash-Based Signature Schemes

Cooper, David; Apon, Daniel; Dang, Quynh; Davidson, Michael; Dworkin, Morris; Miller, Carl

doi:https://doi.org/10.6028/NIST.SP.800-208-draft

July 19, 2023: URLs for CSRC publication details pages have changed. Legacy URLs should automatically redirect to the new URLs. However, links to the actual publications have NOT changed (e.g., DOIs and PDFs on nvlpubs.nist.gov). Please send inquiries to csrc-inquiry@nist.gov.

NIST SP 800-208 (Initial Public Draft)

Obsoleted on October 29, 2020 by SP 800-208

Recommendation for Stateful Hash-Based Signature Schemes

Documentation Topics

Date Published: December 2019
Comments Due: February 28, 2020 (public comment period is CLOSED)
Email Questions to: pqc-comments@nist.gov

Planning Note (10/29/2020): NIST has added its responses to the public comments received on Draft SP 800-208.

Author(s)

David Cooper (NIST), Daniel Apon (NIST), Quynh Dang (NIST), Michael Davidson (NIST), Morris Dworkin (NIST), Carl Miller (NIST)

Announcement

All of the digital signature schemes specified in Federal Information Processing Standards Publication (FIPS) 186-4 will be broken if large-scale quantum computers are ever built. NIST is in the process of developing standards for post-quantum secure digital signature schemes that can be used as replacements for the schemes that are specified in FIPS 186-4. However, this standardization process will not be complete for several years.

In this draft recommendation, NIST is proposing to supplement FIPS 186 by approving the use of two stateful hash-based signature schemes: the eXtended Merkle Signature Scheme (XMSS) and the Leighton-Micali Signature system (LMS) as specified in Requests for Comments (RFC) 8391 and 8554, respectively. Stateful hash-based signature schemes are not suitable for general use since they require careful state management in order to ensure their security. However, their use may be appropriate for applications in which use of the private key may be carefully controlled and where there is a need to transition to a post-quantum secure digital signature scheme before the post-quantum cryptography standardization process has completed.

Draft SP 800-208 profiles LMS, XMSS, and their multi-tree variants. This profile approves the use of some but not all of the parameter sets defined in RFCs 8391 and 8554. The approved parameter sets use either SHA-256 or SHAKE256 with 192- or 256-bit outputs. This profile also requires that key and signature generation be performed in hardware cryptographic modules that do not allow secret keying material to be exported.

NOTE: A call for patent claims is included on page iv of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.

Abstract

This recommendation specifies two algorithms that can be used to generate a digital signature, both of which are stateful hash-based signature schemes: the Leighton-Micali Signature (LMS) system and the eXtended Merkle Signature Scheme (XMSS), along with their multi-tree variants, the Hierarchical Signature System (HSS) and multi-tree XMSS (XMSS^MT).

Keywords

cryptography; digital signatures; hash-based signatures; public-key cryptography

Control Families

None selected

Documentation

Publication:
https://doi.org/10.6028/NIST.SP.800-208-draft
Download URL

Supplemental Material:
Comments received (pdf)

Document History:
12/11/19: SP 800-208 (Draft)
10/29/20: SP 800-208 (Final)

Topics

Security and Privacy

digital signatures, post-quantum cryptography, secure hashing