hardyhash:

Misuse-resistant hash-based signatures using deep Merkle trees

READ THIS!

This code is not yet safe for use in a production environment, as it has not undergone a thorough audit and is surely riddled with security flaws.

Background & Motivation

TODO

Setup

If you have Docker and just want to experiment with the software, simply run

./build_image.sh to build a Docker image with the necessary dependencies then

./start_container.sh to interact with the image.

Run make release to make the hardyhash executable, or make test to make the test executable.

Non-interactive Docker images are coming soon.

---

To build outside the Docker image, you will need

• A C++14 compliant compiler
• openssl (libssl-dev)
• cereal (https://github.com/USCiLab/cereal)
• Catch2 (https://github.com/catchorg/Catch2) for unit tests

See the Dockerfile for the expected install locations.

Usage

Intended use:

1. Central authority calls initialize to generate all keys.
2. Authority distributes keys to trusted third parties, or "signers," who need to be able to sign a limited number of messages.
3. Signer calls sign to sign each message.
4. Message recipient calls verify to confirm that the message is trusted by the central authority.

---

hardyhash initialize

Usage:
     ./hardyhash initialize lg_n_signers lg_messages_per_signer randomness output_dir

     lg_n_signers must be an even integer between 2 and 16, inclusive.
     lg_messages_per_signer must be an even integer between 2 and 16, inclusive
     randomness should be a source of entropy, at most 1024 characters long
     output_dir must be a path to an empty directory.

initialize generates keys for 2^(lg_n_signers). Each key is valid to sign 2^(lg_messages_per_signer) messages. The global public key, along with each of the signer keys, are put into output_dir.

Example: ./hardyhash initialize 16 16 ab96bb4c37f332611e930ccf1b41ae11f9394ca95bc5f8b6591eebe494ccfcb3 out

NB: ./hardyhash initialize may take a while. To generate 2^16 keys, each of which can sign 2^16 messages, it may take 24-48 hours. For testing, lg_n_signers=lg_messages_per_signer=8 is a good choice of parameters, and will only take a few seconds.

hardyhash sign

Usage:
     ./hardyhash sign <path to state file> <path to message file> <path to outfile>

sign signs a message given with one of the keys generated by initialize. The state file is updated after each signature, and will become invalid after signing 2^(lg_messages_per_signer) messages. sign writes its signature to outfile. Signatures are under 5KB.

Example: ./hardyhash sign out/signer_0 message_file signature_file

hardyhash verify

Usage:
     ./hardyhash verify <path to public key> <path to message file> <path to signature file>

verify verifies a (public key, message, signature) triple.

Example: ./hardyhash verify out/public_key message_file signature_file