eprint.iacr.orgpaperShorter Hash-Based Signatures via Guarded Sharing in a DAG Model
Proposes "guarded sharing", a technique that moves few-time signatures in SPHINCS-style stateless hash-based schemes from a tree model to a DAG model. Combined with bucket thinning, hash chains and rejection sampling, it yields BGS-CC, which improves on the prior best few-time scheme BPORS-C+BFP. For 128-bit security and a use quota of Q=2^24 it gives 2,228-byte signatures, the first SPHINCS-based stateless signature shorter than ML-DSA-44's 2,420 bytes. This matters for PQ migration because signature size is the main drawback of SLH-DSA.
TL;DR New DAG-based few-time signature (BGS-CC) makes SPHINCS-style hash-based signatures 2,228 B at 128-bit security, below ML-DSA-44's 2,420 B.
Organisations named here
- BGS-CC
- ML-DSA
Technologies named here
- BPORS-C+BFP
- SLH-DSA
- SPHINCS-based stateless signatures
- ML-DSA-44
- ML-DSA
- SPHINCS
- NIST
Techniques named here
- Guarded sharing
- Bucket thinning
- Hash chains
- Rejection sampling
- Forced pruning
- Few-time signatures
- Directed acyclic graphs signature model
Related in other
eprint.iacr.orgpaperRerandomizable Garbling for Arithmetic Circuits
aseemshrey.inarticle