0
$\begingroup$

The XMSS RFC supports only tree heights of 60, which makes the chosen keypair to sign up to 2^60 messages, which is not practical for the use of SSL and so on. The paper https://eprint.iacr.org/2017/966.pdf mentions that it is possible to increase the 60 number to 80, which would be sufficient for SSL use. Why is this treeheight not supported in the RFC?

$\endgroup$
1
$\begingroup$

Why is this treeheight not supported in the RFC?

I'm not Andreas, and he did not mention this to me specifically. He has mentioned that the CFRG did ask him to limit the number of parameter sets he defined. My speculation is that he couldn't imagine any situation that would need more than $2^{60}$ signatures generated from a single private key.

Do you have such a situation? Even if you were able to generate a signature in a nanosecond (which is far faster than what is achievable today), it would take over 36 years to use up all $2^{60}$ signatures - do you have a use case that would go beyond that?

he XMSS RFC supports only tree heights of 60, which makes the chosen keypair to sign up to 2^60 messages, which is not practical for the use of SSL and so on

Why would $2^{60}$ signatures not be sufficient for TLS?

$\endgroup$
7
  • $\begingroup$ What happens after 36 years? How can one manage the key swap? Arent the long signature sizes for the case of h=60 a big disadvantage for TLS? These would be around 9kB $\endgroup$ – user90372 May 16 at 20:27
  • $\begingroup$ @user90372: after 36 years? Well, maybe you shouldn't be using the same private signature key for 36 years. And don't forget, that's 36 years at one billion signatures per second - if you're thinking of TLS, can you negotiate one billion TLS connections per second? $\endgroup$ – poncho May 16 at 20:32
  • $\begingroup$ @user90372: if you absolutely need H=80, then you could either propose such an XMSS parameter set in the CFRG (and have IANA assign it a codepoint), or alternatively you could consider LMS (which supports hypertrees that height already) $\endgroup$ – poncho May 16 at 20:37
  • $\begingroup$ doesnt HSS only support max height of 25/15 which lasts for 34 years? After 36 years we would have to generate new keypair but what happens to the old one, since these old signatures still have to be proven? Can we generate two sets of keys, like PK1 for old signatures and PK2 for the new ones? $\endgroup$ – user90372 May 16 at 20:41
  • $\begingroup$ Do you know how much time does it take to generate a signature for the tree height of 60 and message length of 32B? $\endgroup$ – user90372 May 16 at 23:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.