1
$\begingroup$

I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512.

Do PQC signatures work the same as modern algorithms in TLS 1.3?

Improve this question
$\endgroup$
1
  • 1
    $\begingroup$ BTW: in TLS 1.3, what you sign is not the "message", but instead a transcript of the TLS records exchanged up to that point. $\endgroup$
    – poncho
    Mar 7, 2021 at 3:57

1 Answer 1

Reset to default
3
$\begingroup$

Not necessarily; this varies from signature scheme to signature scheme. In some lattice signature schemes (e.g. FALCON) it is important not to produce two signatures for the same private key and hash value. In the case of FALCON it is therefore specified that the message be randomly salted before hashing and signing (see section 2.2.2 of the FALCON submission). Others require that the message be hashed to a particular mathematical structure and so require more hash data from XOF variants such as the SHA3 SHAKE functions. The wide range of PQC proposals for signature schemes make it impractical to do a comprehensive treatment, but if there is a particular scheme of interest more can be said.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.