Since XMSS only requires a 2nd preimage resistant hash function, is using Blake2 in XMSS possible? It is not in standard, but Blake2 seems to be faster than SHA256
2
-
$\begingroup$ Are you asking "possible" in the sense of possible without hurting security, or in the sense of possible without hurting interoperability? $\endgroup$– DannyNiuCommented Mar 4, 2021 at 8:17
-
$\begingroup$ Obvious question: if you care about performance, why aren't you considering LMS? $\endgroup$– ponchoCommented Sep 2, 2021 at 17:59
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
It's definitely possible, but the standard needs some amendment to make it formal.
It's interesting to know that, KangarooTwelve is even faster, but nonetheless, not yet formallized.
Also that NIST intends approve SHAKE XOFs as MGF in RSA in FIPS 186-5, but not yet included in PKCS#1 (Although, it had been included in RFC-8692)
