README (4894B)
1 # gestumblinde 2 3 Gestumblinde, Sphincs+ or SLH-DSA 4 5 **Warning!** Experimental stuff here. 6 7 This repository contains implementations (one in Python and one in C) of 8 stateless hash-based signatures per 9 [[FIPS.205]](https://csrc.nist.gov/pubs/fips/205/ipd). The 10 implementations are based on the mentioned FIPS draft and, partly, on 11 the SPHINCS+ submission 12 [[SPHINCSpv3.1]](https://sphincs.org/resources.html). 13 14 ## References 15 16 [[FIPS.205]](https://csrc.nist.gov/pubs/fips/205/ipd) 17 NIST - "FIPS 205 (Draft) - Stateless Hash-Based Digital Signature 18 Standard", 2023. 19 20 [[SPHINCSpv3.1]](https://sphincs.org/resources.html) 21 Aumasson et al. - "SPHINCS+: Submission to the NIST post-quantum 22 project, v.3.1", 2022. 23 24 ## Test Vectors 25 26 There are a number of JSON files with test vectors. 27 28 The files that have a name on the form 29 30 [parameter-choice]-test-vectors.json 31 32 contains test vectors for the individual algorithms that are in FIPS 33 205 and are generated using the Python implementation in the `python` 34 folder in this repository. The Python script `make_test_vectors.py` can 35 be used for the purpose of generating test vectors. 36 37 Since it seems meaningless to compare with test vectors that have been 38 generated with the same implementation as the one being tested I also 39 wanted to use the reference implementation of SPHINCS+. The main issues 40 with this are: 41 42 * There is no obvious way to extract the results of each individual 43 "algorithm" from the specification (because the reference 44 implementation is not separated in this way). This means that there 45 are no test vectors for these. 46 * The reference implementation of SPHINCS+ does _not_ conform to the 47 draft FIPS 205. I have therefore "hacked" the reference 48 implementation of SPHINCS+ to make it (as I understand it) work as it 49 would if it was written according to FIPS 205. For more details see 50 `tvectors/sphincs/README.md`. 51 52 The test vectors for these are put into files named 53 54 [parameter-choice]-ref-vectors.json 55 56 Finally, the easiest way to understand the internal naming and structure 57 in the JSON representation of the test vectors is to look at the code in 58 the unit tests written for the Python implementation, eg. 59 `python/test-sha2-128f.py`. 60 61 ## Build instruction for the C impl 62 63 To build the pre-selected command line tools `keygen`, `sign` and 64 `verif` you can do the following: 65 66 ```console 67 $ cd src 68 $ make 69 ``` 70 71 This assumes BSD make, you might need to run `bmake` instead if your 72 default make program is, for example, GNU Make. 73 74 ### Example usage 75 76 This example assumes that you have build the command line tools for the 77 parameter set `SLH-DSA-SHAKE-128s`. 78 79 First we generate a keypair, putting the public key in `/tmp/pk.bin` 80 and the secret key in `/tmp/sk.bin`: 81 82 ```console 83 $ ./build/keygen_shake_128s /tmp/pk.bin /tmp/sk.bin 84 ``` 85 86 Let us now sign the message "gestumblinde is cool" with the secret key 87 as follows, and put the signature in `/tmp/cool.sig`: 88 89 ```console 90 $ echo -n "gestumblinde is cool" | ./build/sign_shake_128s /tmp/sk.bin > /tmp/cool.sig 91 ``` 92 93 We can now try to verify the message, using the signature and the 94 public key with: 95 96 ```console 97 $ echo -n "gestumblinde is cool" | ./build/verif_shake_128s /tmp/pk.bin /tmp/cool.sig 98 TRUE 99 ``` 100 101 whereas changing up message or signature should give false 102 103 ```console 104 $ echo -n "gestumblinde is not cool" | ./build/verif_shake_128s /tmp/pk.bin /tmp/cool.sig 105 FALSE 106 ``` 107 108 ## Timing results on an old, bad computador 109 110 Computed using `python/bench.py`. 111 112 +--------------------+-------+-------+ 113 | PARAMETER SET | sign | veri | 114 +--------------------+-------+-------+ 115 | SLH-DSA-SHAKE-128s | 32.28 | 0.03 | 116 | SLH-DSA-SHAKE-128f | 1.57 | 0.09 | 117 | SLH-DSA-SHAKE-192s | 68.41 | 0.05 | 118 | SLH-DSA-SHAKE-192f | 2.86 | 0.14 | 119 | SLH-DSA-SHAKE-256s | 66.24 | 0.08 | 120 | SLH-DSA-SHAKE-256f | 5.90 | 0.14 | 121 | SLH-DSA-SHA2-128s | 50.25 | 0.05 | 122 | SLH-DSA-SHA2-128f | 2.41 | 0.15 | 123 | SLH-DSA-SHA2-192s | 97.00 | 0.07 | 124 | SLH-DSA-SHA2-192f | 4.26 | 0.20 | 125 | SLH-DSA-SHA2-256s | 91.17 | 0.11 | 126 | SLH-DSA-SHA2-256f | 8.79 | 0.21 | 127 +--------------------+-------+-------+ 128 129 Computed using `./benchmark.sh` (the C implementation): 130 131 +--------------------+-------+------+ 132 | PARAMETER SET | sign | veri | 133 +--------------------+-------+------+ 134 | SLH-DSA-SHAKE-128s | 1.90 | 0.00 | 135 | SLH-DSA-SHAKE-128f | 0.08 | 0.00 | 136 | SLH-DSA-SHAKE-192s | 3.27 | 0.00 | 137 | SLH-DSA-SHAKE-192f | 0.15 | 0.01 | 138 | SLH-DSA-SHAKE-256s | 3.00 | 0.00 | 139 | SLH-DSA-SHAKE-256f | 0.31 | 0.01 | 140 | SLH-DSA-SHA2-128s | 1.90 | 0.00 | 141 | SLH-DSA-SHA2-128f | 0.10 | 0.00 | 142 | SLH-DSA-SHA2-192s | 3.18 | 0.00 | 143 | SLH-DSA-SHA2-192f | 0.15 | 0.01 | 144 | SLH-DSA-SHA2-256s | 2.78 | 0.00 | 145 | SLH-DSA-SHA2-256f | 0.27 | 0.01 | 146 +--------------------+-------+------+