Tracking hash-based signatures in LMS and XMSS using a distributed ledger
Tracking hash-based signatures using a distributed ledger includes, subsequent to generating a plurality of one-time signatures (OTSs) organized in a Merkle tree for use in a stateful hash-based digital signature scheme, receiving a request for a digital signature based therein; obtaining an OTS from the plurality of OTSs based on checking the distributed ledger; and creating a transaction on the distributed ledger based on the request to mark the OTS as used. The stateful hash-based digital signature scheme can be Leighton-Micali Signature (LMS) or extended Merkle Signature Scheme (XMSS).
1 . A method for tracking hash-based signatures using a distributed ledger, the method comprising steps of:
subsequent to generating a plurality of one-time signatures (OTSs) organized in a Merkle tree for use in a stateful hash-based digital signature scheme, receiving a request for a digital signature based therein;
obtaining an OTS from the plurality of OTSs based on checking the distributed ledger; and
creating a transaction on the distributed ledger based on the request to mark the OTS as used, wherein the creating the transaction causes a lock on the OTS to prevent a race condition where there are other attempts to use the OTS prior to the transaction being added to the distributed ledger.
2 . The method of claim 1 , wherein the checking the distributed ledger includes:
determining there are no transactions with the OTS.
3 . The method of claim 1 , wherein the checking the distributed ledger includes:
determining there is a transaction with a second OTS of the plurality of OTSs and selecting the OTS based on there being no transactions associated therewith.
4 . The method of claim 1 , wherein the transaction includes an identifier associated with the request.
5 . The method of claim 4 , wherein the identifier notes a specific Hardware Security Module (HSM) of a plurality of HSMs and the Merkle tree of a plurality of Merkle trees.
6 . The method of claim 1 , wherein the stateful hash-based digital signature scheme is Leighton-Micali Signature (LMS).
7 . The method of claim 1 , wherein the stateful hash-based digital signature scheme is extended Merkle Signature Scheme (XMSS).
8 . The method of claim 1 , wherein the checking the distributed ledger includes:
determining there are no transactions with the OTS.
9 . The method of claim 1 , wherein the checking the distributed ledger includes:
determining there is a transaction with a second OTS of the plurality of OTSs and selecting the OTS based on there being no transactions associated therewith.
10 . The method of claim 1 , wherein the creating the transaction causes a lock on the OTS to prevent a race condition where another attempts to use the OTS prior to the transaction being added to the distributed ledger.
11 . The method of claim 1 , wherein the stateful hash-based digital signature scheme is Leighton-Micali Signature (LMS).
12 . The method of claim 1 , wherein the stateful hash-based digital signature scheme is eXtended Merkle Signature Scheme (XMSS).
13 . A system for tracking hash-based signatures using a distributed ledger, the system comprising:
one or more processors and memory storing instructions that, when executed, cause the one or more processors to
subsequent to generation of a plurality of one-time signatures (OTSs) organized in a Merkle tree for use in a stateful hash-based digital signature scheme, receive a request for a digital signature based therein;
obtain an OTS from the plurality of OTSs based on checking the distributed ledger; and
create a transaction on the distributed ledger based on the request to mark the OTS as used, wherein, once the transaction is created, there is a lock on the OTS to prevent a race condition there are other attempts to use the OTS prior to the transaction being added to the distributed ledger.
14 . The system of claim 13 , wherein the checking the distributed ledger includes:
a determination that there are no transactions with the OTS.
15 . The system of claim 13 , wherein the checking the distributed ledger includes:
a determination there is a transaction with a second OTS of the plurality of OTSs and the OTS is selected based on there being no transactions associated therewith.
16 . The system of claim 13 , wherein the transaction includes an identifier associated with the request.
17 . The system of claim 16 , wherein the identifier notes a specific Hardware Security Module (HSM) of a plurality of HSMs and the Merkle tree of a plurality of Merkle trees.
18 . The system of claim 13 , wherein the stateful hash-based digital signature scheme is Leighton-Micali Signature (LMS).
19 . The system of claim 13 , wherein the stateful hash-based digital signature scheme is extended Merkle Signature Scheme (XMSS).
20 . A method for tracking hash-based signatures using a distributed ledger, the method comprising steps of:
subsequent to generating a plurality of one-time signatures (OTSs) organized in a Merkle tree for use in a stateful hash-based digital signature scheme, receiving a request for a digital signature based therein;
obtaining an OTS from the plurality of OTSs based on checking the distributed ledger; and
creating a transaction on the distributed ledger based on the request to mark the OTS as used, wherein the transaction includes an identifier associated with the request, and wherein the identifier notes a specific Hardware Security Module (HSM) of a plurality of HSMs and the Merkle tree of a plurality of Merkle trees.