XMSS Post-Quantum Cryptography IP

XMSS is a Post-Quantum Cryptographic (PQC) algorithm, meaning it is mathematically designed to be robust against a cryptanalytic attack using a quantum computer. XMSS is a stateful Hash-Based Signature Scheme that has been recommended by NIST in 2020.

The XMSS IP is a software IP that may run on the Host CPU. It uses HASH IP resources, which may be implemented either in software (for a full software XMSS implementation) or in Hardware, to a mixed Hardware/Software implementation. The figure below shows the IP block diagram in its system environment, in case of an implementation using a Hardware HASH IP: the hardware SHA-2 IP, and a portable software library.

Secure-IC TRNG IP for XMSS keys generation and SDMAC IP are also used. The interconnection is ensured by an AMBA bus.

Standards

• XMSS is standardized by IRTF in RFC8391: XMSS: eXtended Merkle Signature Scheme
• It has been recommended as ‘Stateful Hash-Based Signature Scheme’ in SP 800-208
• The XMSS function has been implemented using only RFC8391
• The variants XMSS-SHA2_10_256 and XMSS-SHA2_16_256 have been implemented, for hybrid hardware/ software implementation based on Secure-IC HASH IP
• Key generation, Signature and Verification operations are supported. Performance depends on the system resources, in particular for Key generation and Signature

ML-KEM and ML-DSA have been selected by the NIST post-quantum cryptography project.
The US National Security Agency also recommends to implement those algorithms in its Commercial National Security Algorithm Suite 2.0 (CNSA 2.0).
The present product is based on the version of ML-KEM and ML-DSA selected by the NIST at the end of round 3 and is aligned with NIST reference implementation.

Security features

• ML-KEM-512, ML-KEM-768, ML-KEM-1024.
• ML-DSA-II, ML-DSA-III, ML-DSA-V.
• Implementation protected against Side-Channel Attack (Key Generation and Key Decapsulation operations are sensitive):
• Simple Power Analysis (SPA)
• Differential Power Analysis (DPA)
• Differential Electromagnetic Analysis (DEMA)
• Correlation Power Analysis (CPA)
• Correlation Electromagnetic Analysis (CEMA)
• Optional: health tests for integrity verification.

Other features

• Hybrid hardware-software solution.
• Optimized in performance or power/area.
• Performs Key Generation, Key Encapsulation and Key Decapsulation functions
• Performs Key generation, Signature and Verification.
• Memory can be shared or dedicated.
• Easy to integrate into the system thanks to AMBA AXI wrapper.
• The control interface of the hardware accelerator is the AMBA AXI interface

• XMSS is designed to resist cryptanalysis using either classical or quantum computers, in applications such as:
  • Secure communications systems
  • Secure Boot
• For Signature, XMSS IP ensures:
  • Key Generation
  • Signature
  • Signature verification
• XMSS is recommended for Post-Quantum Firmware signature in the US National Security Agency’s Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) document.

• Specifications
• User guide
• Test report documentation
• XMSS software library