What IETF RFC 8554 Leighton-Micali Hash-Based Signatures - LM-OTS, LMS and HSS Specification requires
RFC 8554, Leighton-Micali Hash-Based Signatures, is an Informational document published in April 2019 by D. McGrew, M. Curcio and S. Fluhrer of Cisco Systems. It is not an Internet Standards Track specification; it is published for informational purposes and represents the consensus of the Crypto Forum Research Group of the Internet Research Task Force. It describes a digital-signature system based on cryptographic hash functions, following the seminal work of Lamport, Diffie, Winternitz and Merkle as adapted by Leighton and Micali in 1995, and specifies a one-time signature scheme and a general signature scheme. The systems provide asymmetric authentication without using large integer mathematics, are suitable for compact implementations and are naturally resistant to side-channel attacks. The document notes that it is based on U.S. Patent 5,432,852, which was issued over twenty years ago and is thus expired. The specification defines three layers. LM-OTS is the one-time signature scheme, parameterised by n, the number of bytes of hash function output, and w, the width in bits of the Winternitz coefficients, which is a member of the set {1, 2, 4, 8}; the four defined parameter sets are LMOTS_SHA256_N32_W1, W2, W4 and W8, with signature lengths of 8516, 4292, 2180 and 1124 bytes respectively. LMS is the tree scheme, parameterised by tree height h and node size m, with the defined sets LMS_SHA256_M32_H5 through H25, giving 2^h leaves. HSS, the Hierarchical Signature System described in Section 6, uses a sequence of L LMS trees where each LMS private key signs the next LMS public key and the last signs the actual message, and exists for scenarios where the time taken by public key generation must be minimised. The binding operational constraint is statefulness. The LMS signing algorithm modifies and updates the private key as a side effect of generating a signature, and once a particular value of the private key is used to sign one message it MUST NOT be used to sign another. The API MUST be able to handle a dynamic secret key state, that is the API MUST allow the signature-generation algorithm to update the secret key state, and developers should not use the schemes except in systems that prevent the reuse of secret key states. Section 9.2 makes the persistence requirement concrete: after a signature is generated the updated private key must actually be written to nonvolatile storage past any intervening memory caches, and where hierarchical signatures are used implementations SHOULD keep the second-level private key resident in RAM only and generate a new second-level key pair whenever the application restarts. This node covers the specification itself; the United States federal recommendation on approved deployment of stateful hash-based signatures is held separately in the registry.
Pillar: Aviation, Defense & Quantum · Authority: Internet Research Task Force (IRTF) Crypto Forum Research Group, published in the RFC series · Version: 1.0.0 · Last updated:
Primary source: https://www.rfc-editor.org/rfc/rfc8554.html
SHA-256 integrity: 9f9cd49ed6770313029a4e205392f41299720c52d69758dfb7253204208f5974
Primary Citations — 10 traced to source
+ 8 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/ietf-rfc-8554-lms-hash-based-signatures.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/ietf-rfc-8554-lms-hash-based-signatures.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/ietf-rfc-8554-lms-hash-based-signatures
- Back to registry: Browse all 10,099 compliance nodes