EC-Conference2024: Overcoming PQC Migration Challenges with Stateful Hash-Based Signatures and Secure Deployment in HSMs

The migration of existing use cases to PQC is challenging the whole industry. There are general recommendations from industry committees and governmental institutions. For example, the CNSA 2.0 constitutes concrete requirements for dedicated use cases starting in 2025. The preferred PQC algorithms for long-term use cases like firmware signing are the so-called “stateful hash-based signatures. These algorithms, i.e. LMS/HSS and XMSS/XMSS-MT, were standardized by NIST in 2020. Utimaco will present “OTS-preserving framework” for secure deployment and operating of these algorithms in Hardware Security Modules (HSM) in distributed systems and offline scenarios. Utimaco will outline the design criteria of this framework in real-world distributed environments, describe the proposed OTS-preserving framework, its implementation status, and its discussion within the PQC community, including with NIST, and conclude by presenting a customer implementation. This will highlight the state handling challenge and how an ideal solution should look like to allow a smooth transition into the PQC era.