5
$\begingroup$

Why are Leighton-Micali Signature Scheme (LMS) and eXtended Merkle Signature Scheme (XMSS) not candidates in the NIST Post-Quantum Cryptography Standardization process? Both are mentioned in the final draft of Recommendation for Stateful Hash-Based Signature Schemes.

I was expecting that both algorithms are candidates in the standardization process as well, but it seems that they weren't even submitted. Can anyone explain why? If they are not considered as candidates for a new standard why does the Recommendation for Stateful Hash-Based Signature Schemes exist and mention exactly those two algorithms?

Is the recommendation just a temporary standard until the standardization process is finished?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
6
$\begingroup$

Can anyone explain why?

That is because NIST specifically stated that stateful schemes were not allowed in the NIST postquantum competition, because they could not be implemented using the API that NIST has defined (which does not allow any state).

That would appear to be reasonable, as stateful hash based signature methods do need extra care to implement safely; NIST 800-208 outlines what NIST believes are reasonable precautions - those precautions are not needed for other algorithms, and hence NIST kept those separate.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Thank you! Could you please mention where NIST stated this? $\endgroup$
    – AndiCover
    May 3, 2021 at 4:47
  • $\begingroup$ @AndiCover: I know it was stated as a part of the initial call for proposals; however I can't find any specific text from back then stating that... $\endgroup$
    – poncho
    May 3, 2021 at 12:42
  • 1
    $\begingroup$ @AndiCover: I did come across csrc.nist.gov/Projects/Post-Quantum-Cryptography/faqs - "As stateful hash-based signatures do not meet the API requested for signatures, this standardization effort will be a separate process from the one outlined in the call for proposals." - I'm not sure exactly when this FAQ was written; obviously it predates 800-208... $\endgroup$
    – poncho
    May 3, 2021 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.