MTS Mutual-Authenticated Remote Attestation for Quantum Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing public-key digital signature algorithms such as RSA and ECDSA are vulnerable to brute-force attacks by quantum computers, necessitating the development of post-quantum secure signature schemes.
Innovation Solution
The implementation of multi-time signature (MTS)-based mutual authenticated remote attestation using hash-based signature schemes like XMSS and LMS, which employ secure hash algorithms and Merkle trees to generate and verify signatures, providing resistance against quantum attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing public-key digital signature algorithms (RSA, ECDSA) are used for remote attestation, then current security standards are met, but vulnerability to quantum computer brute-force attacks occurs
Solution Approach 1:
The patent transitions from traditional public-key cryptography parameters (RSA, ECDSA) to post-quantum cryptographic parameters (hash-based signatures, lattice-based cryptography, code-based cryptography). This parameter change in the cryptographic algorithm fundamentally alters the mathematical problem space, making it resistant to quantum computer attacks while maintaining security requirements.
2Reliability
If post-quantum signature schemes are implemented, then resistance to quantum attacks is achieved, but computational complexity and processing time increase
Solution Approach 1:
The patent implements key pair generation and signature verification in advance or in parallel processing stages. By preparing cryptographic keys beforehand and pre-computing verification parameters, the system reduces the computational burden during actual attestation operations, thereby minimizing latency while maintaining quantum-resistant security.
Solution Approach 2:
The patent divides the attestation process into multiple independent stages: key generation, signature creation, verification, and result interpretation. This segmentation allows parallel execution of computational tasks and optimization of each stage independently, reducing overall computational latency while maintaining security.
3Reliability
If hash-based signature schemes (XMSS, LMS) are used, then quantum security is achieved, but device complexity increases for resource-constrained IoT devices
Solution Approach 1:
The patent replaces complex cryptographic operations with simplified hash-based signature mechanisms. By substituting traditional public-key operations (which require large number theory computations) with hash function iterations and Merkle tree constructions, the system achieves quantum-resistant security with operations more suitable for resource-constrained IoT device architectures.
Solution Approach 2:
The patent implements a universal hash-based signature framework that can be configured for different security levels and performance requirements. The same core algorithm (XMSS or LMS) serves multiple purposes: providing quantum resistance, enabling mutual authentication, and supporting various key sizes and security parameters, thereby reducing the need for multiple specialized implementations on IoT devices.
Data Source
AI summary
In one example a prover device comprises one or more processors, a computer-readable memory, and signature logic to store a first cryptographic representation of a first trust relationship between the prover device and a verifier device, the first cryptographic representation based on a pair of asymmetric hash-based multi-time signature keys, receive an attestation request message from the verifier device, the attestation request message comprising attestation data for the verifier device and a hash-based signature generated by the verifier device, and in response to the attestation request message, to verify the attestation data, verify the hash-based signature generated by the verifier device using a public key associated with the verifier device, generate an attestation reply message using a hash-based multi-time private signature key and send the attestation reply message to the verifier device. Other examples may be described.