RFC 9021

Use of the Walnut Digital Signature Algorithm with CBOR Object Signing and Encryption (COSE)

📅 published May 2021, from ietf

RFC 9021 ✨ Use of the Walnut Digital Signature Algorithm with CBOR Object Signing and Encryption (COSE)

okay bestie, let's talk about RFC 9021 💖 It's an Independent Submission by D. Atkins from Veridify Security, filed as Informational and dated May 2021 (ISSN 2070-1721). It's about using the Walnut Digital Signature Algorithm (WalnutDSA) inside COSE, which is the CBOR-based signing and encryption syntax. The title block doesn't list anything it obsoletes or updates, so this one stands on its own 🦋

Abstract

okay so the abstract is giving "here's the deal" 💅 It says this doc lays out how to use WalnutDSA for digital signatures in COSE. WalnutDSA is a lightweight, quantum-resistant signature scheme built on Group Theoretic Cryptography, and it's designed so signature verification is efficient in constrained environments, even on 8- and 16-bit platforms 🌸

The point of the whole thing is to write down a way to use WalnutDSA in COSE so that multiple developers can build implementations that work with each other 🧚 The abstract is also very clear that the IETF hasn't evaluated WalnutDSA's security properties and hasn't endorsed its use. No vibes-based trust here, bestie 🙈

WalnutDSA and the Walnut Digital Signature Algorithm are trademarks of Veridify Security Inc. 🎀

Status of This Memo

This one is not an Internet Standards Track spec. It's published purely for information 📚

It's a contribution to the RFC Series that's independent of any other RFC stream. The RFC Editor chose to publish it at their discretion, and they make no statement about whether it's valuable to implement or deploy. Documents the RFC Editor approves aren't candidates for any level of Internet Standard, which you can read about in Section 2 of RFC 7841 🍓

For the current status, any errata, and how to give feedback, check https://www.rfc-editor.org/info/rfc9021 💜

Copyright Notice

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they were in effect on the publication date. Read those carefully, because they spell out your rights and restrictions for this document 📜

1.  Introduction
  1.1.  Motivation
  1.2.  Trademark Notice
2.  Terminology
3.  WalnutDSA Algorithm Overview
4.  WalnutDSA Algorithm Identifiers
5.  Security Considerations
  5.1.  Implementation Security Considerations
  5.2.  Method Security Considerations
6.  IANA Considerations
  6.1.  COSE Algorithms Registry Entry
  6.2.  COSE Key Types Registry Entry
  6.3.  COSE Key Type Parameters Registry Entries
    6.3.1.  WalnutDSA Parameter: N
    6.3.2.  WalnutDSA Parameter: q
    6.3.3.  WalnutDSA Parameter: t-values
    6.3.4.  WalnutDSA Parameter: matrix 1
    6.3.5.  WalnutDSA Parameter: permutation 1
    6.3.6.  WalnutDSA Parameter: matrix 2
7.  References
  7.1.  Normative References
  7.2.  Informative References
Acknowledgments
Author's Address

1. Introduction ✨

okay so this doc is all about using WalnutDSA [WALNUTDSA] for digital signatures in COSE [RFC8152] 🦋 WalnutDSA is a Group Theoretic signature scheme [GTC] where validation is both computationally and space efficient, even on very tiny processors 🌸

The big perk: there's no state required, and there's no limit on how many signatures you can make. That's a glow-up compared to many hash-based signatures 💅 WalnutDSA private and public keys are relatively small. The signatures, though, are bigger than RSA and Elliptic Curve Cryptography (ECC) signatures. They're still smaller than almost every other quantum-resistant scheme, including all the hash-based ones 🫶

COSE gives you a lightweight way to encode structured data, and WalnutDSA is a lightweight, quantum-resistant signing algorithm. So the goal here is to describe how to combine them so multiple developers can build compatible implementations 🧚

Here's the honest tea 🍵 Like every cryptosystem, the first versions of WalnutDSA got a lot of cryptanalysis, and some of it flagged potential issues. A summary of all the published cryptanalysis is in Section 5.2. Validated issues were fixed by reparameterizing in updated versions of WalnutDSA 💀 The IETF hasn't evaluated WalnutDSA's security properties or endorsed it as of this publication, but this doc still shows how to use it with IETF protocols. Anyone using a security algorithm should research its security properties and make their own call about the risks 🙈

1.1. Motivation

Recent advances in cryptanalysis [BH2013] and progress in building quantum computers [NAS2019] are a threat to widely deployed digital signature algorithms 😭 So we need to get ready for a day when cryptosystems like RSA and DSA, which depend on discrete logarithms and factoring, can't be relied on anymore.

If large-scale quantum computers ever get built, they'll be able to break many of the public key cryptosystems we use today. A post-quantum cryptosystem [PQC] is one that's secure against quantum computers with more than a trivial number of quantum bits (qubits). It's an open question when such computers will be feasible 👀 Still, RSA, DSA, the Elliptic Curve Digital Signature Algorithm (ECDSA), and the Edwards-Curve Digital Signature Algorithm (EdDSA) are all vulnerable if large-scale quantum computers show up.

WalnutDSA doesn't depend on the difficulty of discrete logarithms or factoring. So this algorithm is considered resistant to post-quantum attacks 🔥

RSA and ECDSA are often used to digitally sign software updates today. The problem is that their implementations can be relatively large, and verification can take a significant amount of time on some very small processors 🥺 That's why we want a digital signature scheme that verifies faster with less code. Plus, to prepare for a day when RSA, DSA, and ECDSA can't be relied on, we need an algorithm that stays secure even if there are big cryptanalytic advances or a large-scale quantum computer gets invented. WalnutDSA, specified in [WALNUTSPEC], is a quantum-resistant algorithm that checks those boxes ✨

1.2. Trademark Notice

WalnutDSA and the Walnut Digital Signature Algorithm are trademarks of Veridify Security Inc. 🎀

2. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here 📖

3. WalnutDSA Algorithm Overview ✨

This spec uses WalnutDSA signatures as described in [WALNUTDSA] and specified more concretely in [WALNUTSPEC] 💖 WalnutDSA is a Group Theoretic cryptographic signature scheme. It takes infinite group theory as the basis of its security, then maps that onto a one-way evaluation of a series of matrices over small finite fields, with permuted multiplicants based on the group input. It also uses the SHA2-256 and SHA2-512 one-way hash algorithms [SHA2] in a hash-then-sign process 🔐

WalnutDSA is built on a one-way function called E-multiplication, which is an action on the infinite group. A single E-multiplication step takes in a matrix, a permutation, a generator in the group, and a set of T-values (entries in the finite field). It outputs a new matrix and permutation 🦋 To process a long string of generators (like a WalnutDSA signature), you iterate E-multiplication over each generator. Because of its structure, E-multiplication is extremely easy to implement 🧁

Besides being quantum resistant, the two main perks of WalnutDSA are that its verification implementation is very small and that signature verification is extremely fast, even on very small processors (including 16- and even 8-bit microcontrollers) 🏃‍♀️ That makes it a great fit for constrained and/or time-sensitive environments.

WalnutDSA has several parameters that are required to process a signature. The main ones are N and q. The parameter N defines the size of the group by setting the number of strands in use, which implies working in an NxN matrix. The parameter q defines the number of elements in the finite field. Signature verification also needs a set of T-values, which is an ordered list of N entries in the finite field F_q 📐

A WalnutDSA signature is just a string of generators in the infinite group, packed into a byte string 🎁

4. WalnutDSA Algorithm Identifiers ✨

COSE [RFC8152] supports two signature algorithm schemes. This spec uses the signature with appendix scheme for WalnutDSA signatures 💅

The signature value is a large byte string. The byte string is designed for easy parsing, and it includes a length (number of generators) and type codes. Together they indirectly provide all the info needed to parse the byte string during signature validation 🧩

When you use a COSE key for this algorithm, these checks happen:

The "kty" field MUST be present, and it MUST be "WalnutDSA".
If the "alg" field is present, it MUST be "WalnutDSA".
If the "key_ops" field is present, it MUST include "sign" when creating a WalnutDSA signature.
If the "key_ops" field is present, it MUST include "verify" when verifying a WalnutDSA signature.
If the "kid" field is present, it MAY be used to identify the WalnutDSA Key.

5. Security Considerations 🔒

This part is serious, bestie, so pay attention 🚨

5.1. Implementation Security Considerations

Implementations MUST protect the private keys 🔑 Using a hardware security module (HSM) is one way to do that. Compromising the private keys may let someone forge signatures. So when a private key is stored on non-volatile media or in a virtual machine environment, care must be taken to preserve confidentiality and integrity 💀

Generating private keys relies on random numbers. Using inadequate pseudorandom number generators (PRNGs) to make these values can result in little or no security. An attacker may find it much easier to reproduce the PRNG environment that produced the keys and search the resulting small set of possibilities, instead of brute forcing the whole key space 😱 Generating quality random numbers is hard, and [RFC4086] offers important guidance on it 📚

Generating WalnutDSA signatures also depends on random numbers. The consequences of an inadequate PRNG for these values are much less severe than for private keys, but the guidance in [RFC4086] still matters 🫶

5.2. Method Security Considerations 💅

Okay bestie, this is the real tea on the WalnutDSA method (the actual math, not the implementation stuff we already covered) 🍵. The Walnut Digital Signature Algorithm has been through SO much cryptanalysis since it first dropped, and people found a bunch of weaknesses in the early versions. That led to several attacks whose cost blows up exponentially 📈. The full receipts are in [WalnutDSAAnalysis]. Quick version: the original suggested parameters (N=8, q=32) were way too small, so a lot of those exponential-growth attacks were actually practical 😬. The current parameters, though? Totally impractical for attackers 🛡️. Let's walk through the analysis and see how the current parameters shut down every previous attack ✨.

First up, the team of Hart et al. found a universal forgery attack built on a group-factoring problem. It runs in O(q^((N-1)/2)), with memory complexity log_2(q) N^2 q^((N-1)/2). With N=10 and q=M31 (the Mersenne prime 2^31 - 1), the runtime is 2^139 and the memory complexity is 2^151 🤯. W. Beullens found a modification of this attack, but its runtime is even longer 🙈.

Next, Beullens and Blackburn found several issues with the original method and parameters. First, they used a Pollard-Rho attack and discovered the original public key space was too small. Specifically, they require that q^(N(N-1)-1) > 2^(2*Security Level). One can clearly see that (N=10, q=M31) provides 128-bit security and (N=10, q=M61) provides 256-bit security 💖.

Beullens and Blackburn also found two issues with the original message encoder of WalnutDSA. First, the original encoder was non-injective, which reduced the available signature space. This was repaired in an update 🔧. Second, they pointed out that the dimension of the vector space generated by the encoder was too small. Specifically, they require that q^dimension > 2^(2*Security Level). With N=10, the current encoder produces a dimension of 66, which clearly provides sufficient security with q=M31 or q=M61 🫶.

The final issue Beullens and Blackburn found was a process to theoretically "reverse" E-multiplication. First, their process requires knowing the initial matrix and permutation (which are known for WalnutDSA). But more importantly, their process runs at O(q^((N-1)/2)), which for (N=10, q=M31) is greater than 2^128 🧠.

A team at Steven's Institute leveraged a length-shortening attack that enabled them to remove the cloaking elements and then solve a conjugacy search problem to derive the private keys. Their attack requires both knowledge of the permutation being cloaked and also that the cloaking elements themselves are conjugates. By adding additional concealed cloaking elements, the attack requires an N! search for each cloaking element. By inserting k concealed cloaking elements, this requires the attacker to perform (N!)^k work. This allows k to be set to meet the desired security level 🔒.

Finally, Merz and Petit discovered that using a Garside Normal Form of a WalnutDSA signature enabled them to find commonalities with the Garside Normal Form of the encoded message. Using those commonalities, they were able to splice into a signature and create forgeries. Increasing the number of cloaking elements, specifically within the encoded message, sufficiently obscures the commonalities and blocks this attack 🌸.

In summary, most of these attacks are exponential in runtime, and it can be shown that current parameters put the runtime beyond the desired security level. The final two attacks are also sufficiently blocked to the desired security level 👑.

6. IANA Considerations ✨

IANA has added entries for WalnutDSA signatures in the "COSE Algorithms" registry and WalnutDSA public keys in the "COSE Key Types" and "COSE Key Type Parameters" registries 🎀.

6.1. COSE Algorithms Registry Entry 🧾

The following new entry has been registered in the "COSE Algorithms" registry:

Name:  WalnutDSA

Value:  -260

Description:  WalnutDSA signature

Reference:  RFC 9021

Recommended:  No

6.2. COSE Key Types Registry Entry 🔑

The following new entry has been registered in the "COSE Key Types" registry:

Name:  WalnutDSA

Value:  6

Description:  WalnutDSA public key

Reference:  RFC 9021

6.3. COSE Key Type Parameters Registry Entries 🗂️

The following sections detail the additions to the "COSE Key Type Parameters" registry 💜.

6.3.1. WalnutDSA Parameter: N

The new entry, N, has been registered in the "COSE Key Type Parameters" registry as follows:

Key Type:  6

Name:  N

Label:  -1

CBOR Type:  uint

Description:  Group and Matrix (NxN) size

Reference:  RFC 9021

6.3.2. WalnutDSA Parameter: q

The new entry, q, has been registered in the "COSE Key Type Parameters" registry as follows:

Key Type:  6

Name:  q

Label:  -2

CBOR Type:  uint

Description:  Finite field F_q

Reference:  RFC 9021

6.3.3. WalnutDSA Parameter: t-values

The new entry, t-values, has been registered in the "COSE Key Type Parameters" registry as follows:

Key Type:  6

Name:  t-values

Label:  -3

CBOR Type:  array (of uint)

Description:  List of T-values, entries in F_q

Reference:  RFC 9021

6.3.4. WalnutDSA Parameter: matrix 1

The new entry, matrix 1, has been registered in the "COSE Key Type Parameters" registry as follows:

Key Type:  6

Name:  matrix 1

Label:  -4

CBOR Type:  array (of array of uint)

Description:  NxN Matrix of entries in F_q in column-major form

Reference:  RFC 9021

6.3.5. WalnutDSA Parameter: permutation 1

The new entry, permutation 1, has been registered in the "COSE Key Type Parameters" registry as follows:

Key Type:  6

Name:  permutation 1

Label:  -5

CBOR Type:  array (of uint)

Description:  Permutation associated with matrix 1

Reference:  RFC 9021

6.3.6. WalnutDSA Parameter: matrix 2

The new entry, matrix 2, has been registered in the "COSE Key Type Parameters" registry as follows:

Key Type:  6

Name:  matrix 2

Label:  -6

CBOR Type:  array (of array of uint)

Description:  NxN Matrix of entries in F_q in column-major form

Reference:  RFC 9021

7. References 📚

Here are all the receipts for everything above 🧾💅.

7.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC8152]  Schaad, J., "CBOR Object Signing and Encryption (COSE)",
           RFC 8152, DOI 10.17487/RFC8152, July 2017,
           <https://www.rfc-editor.org/info/rfc8152>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

[SHA2]     National Institute of Standards and Technology (NIST),
           "Secure Hash Standard (SHS)", DOI 10.6028/NIST.FIPS.180-4,
           August 2015, <https://doi.org/10.6028/NIST.FIPS.180-4>.

[WALNUTDSA]
           Anshel, I., Atkins, D., Goldfeld, D., and P. Gunnells,
           "WalnutDSA(TM): A group theoretic digital signature
           algorithm", DOI 10.1080/23799927.2020.1831613, November
           2020, <https://doi.org/10.1080/23799927.2020.1831613>.

7.2. Informative References

[BH2013]   Ptacek, T., Ritter, J., Samuel, J., and A. Stamos, "The
           Factoring Dead: Preparing for the Cryptopocalypse", August
           2013, <https://www.slideshare.net/astamos/bh-slides>.

[GTC]      Vasco, M. and R. Steinwandt, "Group Theoretic
           Cryptography", ISBN 9781584888369, April 2015,
           <https://www.crcpress.com/Group-Theoretic-Cryptography/
           Vasco-Steinwandt/p/book/9781584888369>.

[NAS2019]  National Academies of Sciences, Engineering, and Medicine,
           "Quantum Computing: Progress and Prospects",
           DOI 10.17226/25196, 2019,
           <https://doi.org/10.17226/25196>.

[PQC]      Bernstein, D., "Introduction to post-quantum
           cryptography", DOI 10.1007/978-3-540-88702-7, 2009,
           <https://doi.org/10.1007/978-3-540-88702-7>.

[RFC4086]  Eastlake 3rd, D., Schiller, J., and S. Crocker,
           "Randomness Requirements for Security", BCP 106, RFC 4086,
           DOI 10.17487/RFC4086, June 2005,
           <https://www.rfc-editor.org/info/rfc4086>.

[WalnutDSAAnalysis]
           Anshel, I., Atkins, D., Goldfeld, D., and P. Gunnells,
           "Defeating the Hart et al, Beullens-Blackburn, Kotov-
           Menshov-Ushakov, and Merz-Petit Attacks on WalnutDSA(TM)",
           May 2019, <https://eprint.iacr.org/2019/472>.

[WALNUTSPEC]
           Anshel, I., Atkins, D., Goldfeld, D., and P. Gunnells,
           "The Walnut Digital Signature Algorithm Specification",
           Post-Quantum Cryptography, November 2018,
           <https://csrc.nist.gov/projects/post-quantum-cryptography/
           round-1-submissions>.

Acknowledgments 🫶

A huge thank you to Russ Housley for his input on the concepts and text of this document 🌈.

Author's Address 🦋

Derek Atkins
Veridify Security
100 Beard Sawmill Rd, Suite 350
Shelton, CT 06484
United States of America

Phone: +1 617 623 3745
Email: datkins@veridify.com

📦 where this page comes from

ietf: rfc9021 2021-05
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms