Signature sizes: RSA signatures are big. a call to action D. J. - - PowerPoint PPT Presentation

Signature sizes: a call to action

• D. J. Bernstein

University of Illinois at Chicago & Technische Universiteit Eindhoven RSA signatures are big.

Signature sizes: a call to action

• D. J. Bernstein

University of Illinois at Chicago & Technische Universiteit Eindhoven RSA signatures are big. 1990 Schnorr signatures are much smaller: 3♥ bits for security 2♥. Often misquoted as 4♥ bits; e.g., 2009 Neven–Smart– Warinschi claims to improve Schnorr from 4♥ to 3♥ (“saving twenty-five percent in signature size”).

Signature sizes: a call to action

• D. J. Bernstein

University of Illinois at Chicago & Technische Universiteit Eindhoven RSA signatures are big. 1990 Schnorr signatures are much smaller: 3♥ bits for security 2♥. Often misquoted as 4♥ bits; e.g., 2009 Neven–Smart– Warinschi claims to improve Schnorr from 4♥ to 3♥ (“saving twenty-five percent in signature size”). 2001 Boneh–Lynn–Shacham pairing-based “short signatures”: 2♥ bits.

Signature sizes: to action Bernstein University of Illinois at Chicago & echnische Universiteit Eindhoven RSA signatures are big. 1990 Schnorr signatures are much smaller: 3♥ bits for security 2♥. Often misquoted as 4♥ bits; e.g., 2009 Neven–Smart– Warinschi claims to improve Schnorr from 4♥ to 3♥ (“saving twenty-five percent in signature size”). 2001 Boneh–Lynn–Shacham pairing-based “short signatures”: 2♥ bits. 1996 Pata 2001 Pata “Quartz”: ♥ “Very sho asymmetric Also achieved MQ signature

• ften with

but HFEv- and inspires Further save, at expense verification ✔

Illinois at Chicago & Universiteit Eindhoven RSA signatures are big. 1990 Schnorr signatures are much smaller: 3♥ bits for security 2♥. Often misquoted as 4♥ bits; e.g., 2009 Neven–Smart– Warinschi claims to improve Schnorr from 4♥ to 3♥ (“saving twenty-five percent in signature size”). 2001 Boneh–Lynn–Shacham pairing-based “short signatures”: 2♥ bits. 1996 Patarin “HFEv-”, 2001 Patarin–Courtois–Goubin “Quartz”: ♥ bits. “Very short asymmetric signatures”. Also achieved by many MQ signature schemes,

• ften with smaller

but HFEv- has a long and inspires confidence. Further save, e.g., at expense of multiplying verification cost by ✔

Chicago & Eindhoven RSA signatures are big. 1990 Schnorr signatures are much smaller: 3♥ bits for security 2♥. Often misquoted as 4♥ bits; e.g., 2009 Neven–Smart– Warinschi claims to improve Schnorr from 4♥ to 3♥ (“saving twenty-five percent in signature size”). 2001 Boneh–Lynn–Shacham pairing-based “short signatures”: 2♥ bits. 1996 Patarin “HFEv-”, 2001 Patarin–Courtois–Goubin “Quartz”: ♥ bits. “Very short asymmetric signatures”. Also achieved by many other MQ signature schemes,

• ften with smaller keys;

but HFEv- has a long history and inspires confidence. Further save, e.g., 10 bits at expense of multiplying verification cost by ✔210.

RSA signatures are big. 1990 Schnorr signatures are much smaller: 3♥ bits for security 2♥. Often misquoted as 4♥ bits; e.g., 2009 Neven–Smart– Warinschi claims to improve Schnorr from 4♥ to 3♥ (“saving twenty-five percent in signature size”). 2001 Boneh–Lynn–Shacham pairing-based “short signatures”: 2♥ bits. 1996 Patarin “HFEv-”, 2001 Patarin–Courtois–Goubin “Quartz”: ♥ bits. “Very short asymmetric signatures”. Also achieved by many other MQ signature schemes,

• ften with smaller keys;

but HFEv- has a long history and inspires confidence. Further save, e.g., 10 bits at expense of multiplying verification cost by ✔210.

signatures are big. Schnorr signatures much smaller: ♥ bits for security 2♥. misquoted as 4♥ bits; 2009 Neven–Smart– rinschi claims to improve rr from 4♥ to 3♥ (“saving twenty-five percent signature size”). Boneh–Lynn–Shacham pairing-based “short signatures”: ♥ bits. 1996 Patarin “HFEv-”, 2001 Patarin–Courtois–Goubin “Quartz”: ♥ bits. “Very short asymmetric signatures”. Also achieved by many other MQ signature schemes,

• ften with smaller keys;

but HFEv- has a long history and inspires confidence. Further save, e.g., 10 bits at expense of multiplying verification cost by ✔210. “Message signature Measure signature

• Often 4♥

♥ ♥ Many pap message 1993 Nyb 2000 Pintsov–V 2001 Naccache–Stern: message Deployment

are big. signatures smaller: ♥ security 2♥. as 4♥ bits; Neven–Smart– claims to improve ♥ to 3♥ y-five percent size”). Boneh–Lynn–Shacham “short signatures”: ♥ 1996 Patarin “HFEv-”, 2001 Patarin–Courtois–Goubin “Quartz”: ♥ bits. “Very short asymmetric signatures”. Also achieved by many other MQ signature schemes,

• ften with smaller keys;

but HFEv- has a long history and inspires confidence. Further save, e.g., 10 bits at expense of multiplying verification cost by ✔210. “Message recovery”: signature conveys Measure “signature signature size message Often 4♥ or 3♥, sometime ♥ Many papers/standa message recovery fo 1993 Nyberg–Ruepp 2000 Pintsov–Vans 2001 Naccache–Stern: message recovery fo Deployment stopped

♥

♥

♥ bits; rove ♥ ♥ ercent Boneh–Lynn–Shacham signatures”: ♥ 1996 Patarin “HFEv-”, 2001 Patarin–Courtois–Goubin “Quartz”: ♥ bits. “Very short asymmetric signatures”. Also achieved by many other MQ signature schemes,

• ften with smaller keys;

but HFEv- has a long history and inspires confidence. Further save, e.g., 10 bits at expense of multiplying verification cost by ✔210. “Message recovery”: signature conveys message. Measure “signature overhead”: signature size message size Often 4♥ or 3♥, sometimes 2♥ Many papers/standards: message recovery for RSA. 1993 Nyberg–Rueppel, 2000 Pintsov–Vanstone, 2001 Naccache–Stern: message recovery for ECDSA. Deployment stopped by patents.

1996 Patarin “HFEv-”, 2001 Patarin–Courtois–Goubin “Quartz”: ♥ bits. “Very short asymmetric signatures”. Also achieved by many other MQ signature schemes,

• ften with smaller keys;

but HFEv- has a long history and inspires confidence. Further save, e.g., 10 bits at expense of multiplying verification cost by ✔210. “Message recovery”: signature conveys message. Measure “signature overhead”: signature size message size. Often 4♥ or 3♥, sometimes 2♥. Many papers/standards: message recovery for RSA. 1993 Nyberg–Rueppel, 2000 Pintsov–Vanstone, 2001 Naccache–Stern: message recovery for ECDSA. Deployment stopped by patents.

atarin “HFEv-”, atarin–Courtois–Goubin rtz”: ♥ bits. short asymmetric signatures”. achieved by many other signature schemes, with smaller keys; HFEv- has a long history inspires confidence. urther save, e.g., 10 bits ense of multiplying verification cost by ✔210. “Message recovery”: signature conveys message. Measure “signature overhead”: signature size message size. Often 4♥ or 3♥, sometimes 2♥. Many papers/standards: message recovery for RSA. 1993 Nyberg–Rueppel, 2000 Pintsov–Vanstone, 2001 Naccache–Stern: message recovery for ECDSA. Deployment stopped by patents. Latest mess 2012 Kiltz–Pietrzak–Szegedy “Digital minimal will appea “Our main revisit the exists a digital scheme with that has ✙ ♥

• verhead. ✿ ✿ ✿

previous required ♥

“HFEv-”, rin–Courtois–Goubin ♥ bits. atures”. many other schemes, smaller keys; long history confidence. e.g., 10 bits multiplying by ✔210. “Message recovery”: signature conveys message. Measure “signature overhead”: signature size message size. Often 4♥ or 3♥, sometimes 2♥. Many papers/standards: message recovery for RSA. 1993 Nyberg–Rueppel, 2000 Pintsov–Vanstone, 2001 Naccache–Stern: message recovery for ECDSA. Deployment stopped by patents. Latest message-recovery 2012 Kiltz–Pietrzak–Szegedy “Digital signatures minimal overhead”. will appear at Crypto “Our main contribu revisit the question exists a digital signature scheme with message that has minimal (✙ ♥

• verhead. ✿ ✿ ✿ The

previous constructions required an overhe ♥

rin–Courtois–Goubin ♥

• ther

tory ✔ “Message recovery”: signature conveys message. Measure “signature overhead”: signature size message size. Often 4♥ or 3♥, sometimes 2♥. Many papers/standards: message recovery for RSA. 1993 Nyberg–Rueppel, 2000 Pintsov–Vanstone, 2001 Naccache–Stern: message recovery for ECDSA. Deployment stopped by patents. Latest message-recovery pap 2012 Kiltz–Pietrzak–Szegedy “Digital signatures with minimal overhead”. Rumor: will appear at Crypto 2013. “Our main contribution is to revisit the question if there exists a digital signature scheme with message recovery that has minimal (✙ ♥ bits)

• verhead. ✿ ✿ ✿ The best

previous constructions required an overhead of 2♥.”

“Message recovery”: signature conveys message. Measure “signature overhead”: signature size message size. Often 4♥ or 3♥, sometimes 2♥. Many papers/standards: message recovery for RSA. 1993 Nyberg–Rueppel, 2000 Pintsov–Vanstone, 2001 Naccache–Stern: message recovery for ECDSA. Deployment stopped by patents. Latest message-recovery paper: 2012 Kiltz–Pietrzak–Szegedy “Digital signatures with minimal overhead”. Rumor: will appear at Crypto 2013. “Our main contribution is to revisit the question if there exists a digital signature scheme with message recovery that has minimal (✙ ♥ bits)

• verhead. ✿ ✿ ✿ The best

previous constructions required an overhead of 2♥.”

“Message recovery”: signature conveys message. Measure “signature overhead”: signature size message size. 4♥ or 3♥, sometimes 2♥. papers/standards: message recovery for RSA. Nyberg–Rueppel, Pintsov–Vanstone, Naccache–Stern: message recovery for ECDSA. yment stopped by patents. Latest message-recovery paper: 2012 Kiltz–Pietrzak–Szegedy “Digital signatures with minimal overhead”. Rumor: will appear at Crypto 2013. “Our main contribution is to revisit the question if there exists a digital signature scheme with message recovery that has minimal (✙ ♥ bits)

• verhead. ✿ ✿ ✿ The best

previous constructions required an overhead of 2♥.” Conclusions:

• 1. Many

signature

• very”:

conveys message. “signature overhead”: message size. ♥ ♥ sometimes 2♥. ers/standards: covery for RSA. erg–Rueppel, anstone, Naccache–Stern: covery for ECDSA. stopped by patents. Latest message-recovery paper: 2012 Kiltz–Pietrzak–Szegedy “Digital signatures with minimal overhead”. Rumor: will appear at Crypto 2013. “Our main contribution is to revisit the question if there exists a digital signature scheme with message recovery that has minimal (✙ ♥ bits)

• verhead. ✿ ✿ ✿ The best

previous constructions required an overhead of 2♥.” Conclusions:

• 1. Many people ca

signature size.

message.

• verhead”:
• size.

♥ ♥ s 2♥. RSA. ECDSA. patents. Latest message-recovery paper: 2012 Kiltz–Pietrzak–Szegedy “Digital signatures with minimal overhead”. Rumor: will appear at Crypto 2013. “Our main contribution is to revisit the question if there exists a digital signature scheme with message recovery that has minimal (✙ ♥ bits)

• verhead. ✿ ✿ ✿ The best

previous constructions required an overhead of 2♥.” Conclusions:

• 1. Many people care about

signature size.

Latest message-recovery paper: 2012 Kiltz–Pietrzak–Szegedy “Digital signatures with minimal overhead”. Rumor: will appear at Crypto 2013. “Our main contribution is to revisit the question if there exists a digital signature scheme with message recovery that has minimal (✙ ♥ bits)

• verhead. ✿ ✿ ✿ The best

previous constructions required an overhead of 2♥.” Conclusions:

• 1. Many people care about

signature size.

Latest message-recovery paper: 2012 Kiltz–Pietrzak–Szegedy “Digital signatures with minimal overhead”. Rumor: will appear at Crypto 2013. “Our main contribution is to revisit the question if there exists a digital signature scheme with message recovery that has minimal (✙ ♥ bits)

• verhead. ✿ ✿ ✿ The best

previous constructions required an overhead of 2♥.” Conclusions:

• 1. Many people care about

signature size.

• 2. Many people are shockingly

ignorant of short MQ signatures.

Latest message-recovery paper: 2012 Kiltz–Pietrzak–Szegedy “Digital signatures with minimal overhead”. Rumor: will appear at Crypto 2013. “Our main contribution is to revisit the question if there exists a digital signature scheme with message recovery that has minimal (✙ ♥ bits)

• verhead. ✿ ✿ ✿ The best

previous constructions required an overhead of 2♥.” Conclusions:

• 1. Many people care about

signature size.

• 2. Many people are shockingly

ignorant of short MQ signatures.

• 3. Need to raise awareness
• f MQ capabilities.

e.g. add Quartz to eBATS. http://bench.cr.yp.to