<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Apr 19, 2016, at 5:27 PM, Adam Langley <<a href="mailto:agl@google.com" class="">agl@google.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="gmail_extra"><div class="gmail_quote">On Tue, Apr 19, 2016 at 10:41 AM, Phillip Hallam-Baker <span dir="ltr" class=""><<a href="mailto:philliph@comodo.com" target="_blank" class="">philliph@comodo.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div style="word-wrap:break-word" class=""><div class="">There are in fact ways that it is possible to construct a WebPKI type infrastructure using hash signatures and we may even end up having to resort to using some of them, particularly for low power devices. In particular:</div><div class=""><br class=""></div><div class="">* Distribute Merkle trees of public key values. </div><div class="">* Adopt a ‘use one, make one’ approach to distribution.</div><div class="">* Engage hash chain logs to provide reference truth.</div><div class="">* Use GPU farms and/or bitcoin mining equipment to construct large Merkle trees, the hardware using the trees can be more modest.</div></div></blockquote><div class=""><br class=""></div><div class="">There is no need to expend large amounts of computational power to generate large Merkle trees of public keys. "Forest" schemes go back to CMSS (<a href="https://eprint.iacr.org/2006/320.pdf" target="_blank" class="">https://eprint.iacr.org/2006/320.pdf</a>). A modern synthesis of all the best tricks in this space can be found in <a href="https://sphincs.cr.yp.to/" target="_blank" class="">https://sphincs.cr.yp.to/</a>. (Although note that signatures are ~40KB. The smaller signatures are from stateful schemes which are unsuitable for use in a PKI.)</div></div></div></div></div></blockquote><br class=""></div><div>At this point, I would just like the options on the table. The stateless schemes are another option, but not one I have looked into the IPR on yet. If we can get a proof of feasibility at this point, it would be something.</div><div><br class=""></div><div>Probably the thing to do would be to hold an interim meeting under some relevant SDO Note Well in the Cambridge MA area and invite folk from MIT. </div><div><br class=""></div><div><br class=""></div><br class=""></body></html>