1 Introduction

In 1976 [¹] Whitfield Diffie and Martin Hellman (2015 Turing award winners) were the first to publicly expose the basic concepts of Public-Key Cryptography (PKC) and a key-exchange protocol.

In PKC, each user has two keys, one secret or private and the other publicly known by all the users in the system. Both keys are mathematically related in such a way that knowing both, the public key and the encryption algorithm, it is computationally infeasible to obtain the private key; but it is computationally easy to encrypt/decrypt the plaintext using the keys, either of the two keys can be used for encryption while the other is used for decryption. PKC is based on computational problems that are difficult to solve, i.e., the algorithm solving the problem runs in a non-polynomial time.

Two illustrious examples that have resisted the test of time are the integer factorization problem (IFP) and the discrete logarithm problem (DLP).

In 1977 [²] Ron Rivest, Adi Shamir and Len Adleman (2002 Turing award winners) proposed to use the exponentiation in a mathematical finite (Galois) field over integers modulo a large prime number; where the exponentiation is easy to compute but the integer factorization is very difficult to compute. Such proposal is known as the RSA Algorithm and it has been the de facto standard of the PKC during the last four decades.

PKC together with Hash functions allow to implement digital signatures, which is the electronic analogous of the traditional handwritten signature, where the signer agrees to respect a contract and his/her signature is valid for legal purposes.

Roughly speaking, a Hash function is a function that for any input text of arbitrary length produces an output of fixed length in bits, known as the hash code or digest.

In 1994, Peter Shor [³] published two polynomial-time algorithms for solving both the IFP and the DLP on a quantum computer. Therefore, once that such large quantum computers become available, the security of all applications based on these problems will be vulnerable, e.g., the RSA digital signature, Digital Signature Algorithm (DSA), and Elliptic Curve DSA (ECDSA), such as it has been shown in [⁴].

In 1996, Lov Grover [⁵] published a quantum algorithm to speed up the search in a database, and this algorithm can be used to attack the symmetric cryptographic algorithms, i.e., where two users share a secret key to encrypt/decrypt messages.

In Mexico, the RSA digital signature is the core of the digital invoices by Internet (CFDI) specified by the Secretary of Finance and Public Credit (SHCP) in the Annex 20 of the fiscal miscellany resolution published in the official journal of the federation in the years 2006, 2010, 2012, 2014, and 2017 [⁶].

The Annex 20 is a computing standard that specifies the structure, form, syntax, format, and cryptographic algorithms of the digital invoices issued electronically. The security requirements of the digital invoices by Internet (CFDI) are as follows: unforgeability, uniqueness, protection against modifications, protection against non-repudiation, and long-term storage. These requirements are met by means of two cryptographic digital signatures: one generated by the signer taxpayer, named digital stamp, and the other generated by the Tax Administration System (SAT), named SAT’s stamp.

SAT has deployed one of the largest Public Key Infrastructure (PKI) in the world, where SAT is a Certification Authority that creates and signs two kinds of digital certificates for all the taxpayers in the country. One certificate for fiscal management purposes, named e-firma, and the other certificate for invoicing purposes, named digital stamp certificate. Both digital certificates comply with the X.509 [⁷] standard, and allow the widespread distribution of the taxpayers’ public keys. A taxpayer is responsible for both keeping secret his/her private key and for the long-term storage of his/her issued digital invoices. SAT provides the software named Certifica, which permits to generate the taxpayer’s private key and a requirements file that is verified at the SAT’s office at the time of generation the digital certificate, which will be valid during a time interval, usually four years long.

Annex 20 [⁶] specifies the usage of the following cryptographic functions for signing and verifying the CFDI:

Section III.A of the Annex 20 specifies the usage of RSA-2048 bits with the Hash function SHA2-256.

From 2004 to 2020, SAT has generated 29 million 458 thousand 798 digital stamp certificates, and 16 million 405 thousand 29 taxpayers have completed the registration process for the e-firma. In 2020, 7.798 billion CFDI were issued in Mexico, i.e., an average of 247 invoices were processed per second [⁸]. From these, the Authorized Certification Providers (PAC) signed 96%. Notice that a PAC is a private service provider who receives from SAT both a SAT’s private key and a SAT’s certificate in order to generate the SAT’s stamp.

In [⁹, ¹⁰, ¹¹], the authors have identified some security vulnerabilities of the CFDI. Besides these vulnerabilities, now the digital signature based on RSA algorithm is vulnerable to attacks launched from potential large quantum computers.

On the other hand, in 2016 the National Institute of Standards and Technology (NIST) of the U.S. Department of Commerce published a request for nominations for Public-Key Post-Quantum Cryptographic (PQC) Algorithms [¹²] i.e., quantum-resistant and classical-resistant algorithms, that will be standardized and augmented to Digital Signature Standard (NIST 186-4) as well as recommendations for Pair-Wise Key Establishment Schemes using both DLP (NIST 800-56A) and IFP (NIST 800-56B).

In 2017, 82 candidate algorithms were submitted to the NIST Post-Quantum Cryptography Competition. Among those, 69 were accepted as the first-round candidates. In 2019 [¹³] 26 algorithms were accepted as the second-round candidates, where 17 candidates for public-key encryption and key-establishment algorithms, and 9 candidates for digital signatures were considered.

On July 22, 2020, NIST published the status report on the second-round candidates [¹⁴] and it announced three third-round finalists as well as three alternate candidate algorithms for standardization at the end of the third round in the spring or summer of 2021.

The PQC digital signatures accepted in the third-round candidates are as follows: Crystals-Dilithium, Falcon (Fast-Fourier Lattice-based Compact Signature over NTRU), and Rainbow. In addition, GeMSS (Great Multivariate Short Signature), Picnic, and SPHINCS⁺ are considered as alternate candidates.

This paper analyses the PQC proposals accepted in the third-round candidates as digital signatures to generate the CFDI and points out their advantages and disadvantages. The rest of the paper is organized as follows: section 2 identifies the CFDI requirements. Section 3 briefly describes the hard computational problems that are at the core of the three PQC digital signature finalists. Section 4 presents the performance of the PQC digital signatures proposals reported by their respective authors. Section 5 presents the performance reported by the project eBATS. Finally, the conclusions and the future research work are drawn.

2 CFDI Requirements

This section presents an analysis of the functional, temporal, and security requirements of the CFDI based on public key cryptography. The analysis is developed according to the processes involved in the classical digital signature algorithms, i.e., key generation, signing, transfer, verifying, and storage.

2.2 CFDI Signing

Figure 1 shows the basic scheme of the digital signature. During the signing process the signer ciphers (E), using both his/her private key (SK) and the asymmetric encryption algorithm, the hash value (h) of a message (M) produced by a Hash function (H). The signature (S) is concatenated (||) to the message and both are sent to the receiver or verifier.

Fig. 1 Digital signature scheme 

In the CFDI case, all the accounting information of the tax receipt, i.e., M, is first transformed in an original chain (OC) and is represented in the encoding format UTF-8 before its hash value is calculated. Also, the signature is represented in Base 64 and is concatenated with both the OC and M.

It can be noted that the security strength of the digital signature algorithm depends on both the security level of the asymmetric cipher/decipher algorithm and the security level of the hash function, and both security levels must be equals, otherwise the security strength of the digital signature algorithm will be the lower of the two.

As it is the case of the CFDI where SHA-256 provides a security level of 128 bits and RSA-2048 provides a security level of 112 bits, according to the NIST SP 800-57 standard.

The future usage of a PQC digital signature in the CFDI requires a fast signing process able to sign at least 250 times per second and providing a security level of at least 128 bits.

3 PQC

Even if the IFP and the DLP are vulnerable to large quantum computers, there are other computing problems difficult to solve using quantum and classical computers, such as [¹⁵]: Secret-key cryptography, Hash-based, Lattice-based, Multivariate-polynomial, and Code-based.

From the PQC digital signatures accepted in the third-round candidates both Crystals-Dilithium and Falcon are lattice-based cryptographic schemes, whereas Rainbow is Multivariate based. From the NIST point of view, these schemes appear to be the most promising general-purpose algorithms for digital signature algorithms. Nevertheless, NIST believes it is advisable to continue to study other schemes against progress in cryptanalysis. Lattice and Multivariate problems are briefly described below.

Lattice-based cryptographic schemes are based on the difficulty of solving several related problems such as the shortest vector problem, and the closest vector problem. Given n linearly independent vectors b_i defined over Rⁿ, a lattice is defined as any linear combination with integer coefficients of such basis as in eq. (1):

The shortest vector problem consists of finding the shortest vector in the lattice considering its Euclidean norm. The fastest known solution takes 2^O(n) time and space. There also exist polynomial-space algorithm that takes 2^O(nlog(n)) time. The lattice-based NIST candidate algorithms, such as Crystals-Dilithium and Falcon, exploit what is called structured lattice schemes, which allows them to achieve considerably efficiency for signing and verifying at the price of potential losses in security that must still be explored.

Multivariate-polynomial cryptographic, such as HFE^v-, Rainbow, and GeMSS, are based on multivariate polynomial problem over finite fields. The public key is the polynomial sequence P₁, P₂, …, P_2b ∈ F₂[w₁,..w_4b], where b is the desired security level in bits, and where the 4b variables w₁,…,w_4b have coefficients in F₂.

Each polynomial is square-free of degree two and it’s represented as a sequence of 1 + 4b + 4b(4b-1)/2 bits. The public key is large, it has 16b³ + 4b² +2 bits. However, the signature of a message is short, it has only 6b bits, namely, the 4b bits of the variables w₁,..w_4b ∈ F₂, and an 2b-bit string r, satisfying eq. (2):

where H is a standard hash function. The verification process is simple as it requires b³ bit operations to evaluate the polynomials P₁, …, P_2b. The main advantage of this crypto scheme is that the signature is small with respect to all the other NIST post-quantum candidates. The security of this scheme lies on the difficulty of finding the sequence w₁,..w_4b ∈ F₂ such that the polynomials P₁, …, P_2b can be produced. Using a brute-force approach, the probability of finding such sequence is 2^-2b. On the contrary, the signee takes advantage of a predefined structure for generating the polynomials. This problem is known as the Hidden Field Equation (HFE). It is possible that an attacker can also take advantage of this structure, although so far nobody has been able to find such line of attack.

4 PQC Digital Signatures Performance

NIST defined a collection of security strength categories [¹¹] as follows, listed in order of increasing strength:

Table 2 summarizes the performance metrics of the three candidates accepted in the third-round of the NIST competition in terms of both the security strength and the length in Bytes (or kilo Bytes (kB) or bits) of the Public key (PK), Private key (SK), and Signature (S) reported by the Authors in their proposals.

5 eBATS PQC Digital Signatures Performance

Two approaches to develop a fair evaluation of the PQC digital signatures proposals have been published: Implemented in hardware and hardware/software co-design [¹⁶] and software executing on multiple platforms [¹⁷]. This work reports the second approach.

ECRYT Benchmarking of Asymmetric Systems (eBATS) [¹⁷] is a project to measure the performance of the public-key systems. It is based on the SUPERCOP’s work, which is a toolkit for measuring the performance of cryptographic software. With regard to the public-key signature algorithms it measures the cryptographic primitives according to different criteria, amongst they the following: Time (cycles) to generate a key pair (a secret key and the public key); time to sign a short message (59 bytes length); time to open a signed short message, i.e., to verify a (larger) signed message and recover the original short message.

eBATS has measured the PQC digital signature performance in both multiple CPU architectures and in multiple computers ranking from 1 up to 64 CPU cores at different frequencies. This work presents the PQC digital signature performance as reported by eBATS in two platforms, as follows: a slow computer using the Intel Core i3-2310M (2x2100 MHz), because most of the individual taxpayers in Mexico do not have a high performance computer, and a fast computer using AMD EPYC 7742 (64x2250 MHz) because the SAT and the most of the PACs have a higher computational infrastructure.

Tables 3 and 4 present the computational efficiency of the first level of security (AES128) in terms of cycles (median) of the following processes: key generation, signing of 59 bytes, and signature verification of 59 bytes reported by eBATS on an Intel Core i3-2310M (2x2100 MHz) and on an AMD EPYC 7742 (64x2250 MHz), respectively. It can be noted in Table 2 that the rows list the median of many speed measurements. But measurements with large variance are indicated with question mark (?). The computational efficiency for the security levels 3 and 5 can be consulted in [¹⁷] as well as for others CPU.

6 Conclusions

In the near future, the security of all applications based on either the integer factorization problem or the discrete logarithm problem, such as Mexican’s digital invoices by Internet (CFDI), will be vulnerable to large quantum computers.

This paper has presented a security analysis of the post-quantum digital signature algorithms of NIST third-round candidates based on both the performance reported by the authors and a fair evaluation reported by the project eBATS.

The taxonomy reported by the authors based on publicly known information takes into account the security strength and the length of the public key, secret key, and signature. The data reported by eBATS takes into account the computational efficiency in cycles of the key generation, signing, and verification processes.

With regard to both Table 1 it can be noted the following:

With regard to both Table 3 and Table 4 it can be noted the following:

As it can be noted, no PQC digital signature meets all the CFDI requirements identifies in Table 1. Therefore, new studies and analysis will be required once the NIST announces the new standard. Meanwhile, the computational efficiency of the finalist will be evaluated with regard to the original chain of the CFDI, as our future research work.