search

mesur-io / post-quantum-signatures

JOSE/COSE support for Post Quantum Cryptography
https://datatracker.ietf.org/doc/draft-ietf-cose-post-quantum-signatures
Other
1 stars 4 forks source link

Should we cover stateful hash based signatures #49

Closed mprorock closed 1 year ago

mprorock commented 2 years ago

See NIST SP 800-208

specifically HSS/LMS, XMSS and XMSS^mt

OR13 commented 2 years ago

I am tracking possible implementations that might be used to generate test vectors here: https://github.com/transmute-industries/verifiable-data/issues/180

mprorock commented 2 years ago

good reference from Panos

OR13 commented 2 years ago

LMS

XMSS

OR13 commented 2 years ago

We should just translate the test vectors to JWK.

OR13 commented 2 years ago

I tried with LMS again, and again, no luck... I suggest we not consider registrations for LMS at this time.

OR13 commented 2 years ago

I was able to get XMSS to sorta work, and build as an npm package... https://github.com/transmute-industries/xmss

The GoLang side of this is very rough, and I am not sure how correct it is since the original source only covers a single sign and verify cycle.

I suggest we close this issue out unless we can get 2 implementations and test vectors for both XMSS and LMS.

OR13 commented 2 years ago

I have put out a plea for help to COSE and CCG mailing lists: https://lists.w3.org/Archives/Public/public-credentials/2022Apr/0007.html

If we don't hear back in 2 weeks, I suggest we move LMS / XMSS out of scope, and refocus on the other schemes.

I don't think we should attempt any further work until multiple implementations and interoperable test vectors can be confirmed

OR13 commented 1 year ago

answer to issue title is no.