SHRINCS: an efficient hash-based signature scheme for Bitcoin (first draft)

This draft is currently in the prototype phase and is available on GitHub at SHRINCS.md. It is important to note that this prototype should not be utilized in production as it still requires comprehensive peer review and the completion of formal security proofs.

SHRINCS aims to provide several benefits, such as compactness with public keys sized at only 48 bytes and signatures varying from 548 bytes to 5777 bytes, depending on their stateful or stateless nature. The scheme offers security levels comparable to NIST-I standards, using truncated SHA256 which is believed to be secure against post-quantum threats. Additionally, the verification process of SHRINCS signatures is significantly faster than BIP340 Schnorr signatures, enhancing efficiency by approximately 4x to 16x, particularly when SHA256 hardware acceleration is available.

However, there are several limitations within the SHRINCS scheme. Its stateful aspect requires robust management software to handle an incrementing state counter that tracks the number of signatures made. Mismanagement of this state counter could potentially lead to severe security vulnerabilities, including signature forgery. Furthermore, the key generation and signing processes are notably demanding computationally, although this may be alleviated through techniques such as SIMD, parallelism, or hardware acceleration.

Recent updates to the SHRINCS proposals include enhancements for better interoperability with non-Bitcoin systems through compatibility with SLH-DSA algorithms and more flexible parameter sets designed to support higher-frequency signing needs, which are crucial for applications like the Lightning Network. Despite these updates, the SHRINCS proposal still lacks critical components such as test vectors, unit tests, security proofs, and optimized implementations. Moreover, it does not adhere to Mediawiki or Markdown formats.

The SHRINCS team actively seeks community feedback to refine the design, parameters, and cryptographic aspects of the proposal. They aim to ensure the scheme's security, correctness, consistency, and clarity. An interactive tool is also provided for exploring different parameter sets, encouraging community engagement to discuss and understand the implications of various choices in the semi-stateful signing schemes. For those interested in a more detailed exploration of SHRINCS, a video interview is accessible at this link.

Regarding the operational considerations, Antoine raises concerns about the implications of opting for a stateless mode in second-stage transactions off-chain, such as those in the Lightning Network. He notes that using a stateless mode increases the signature size to 5777 bytes, potentially inflating operational costs significantly, up to 90 times for fee-bumping reserves required by various protocols. This increase might necessitate choosing more compact alternatives like Falcon or severely discounting specific fields, albeit at the risk of enlarging the Denial of Service (DoS) attack surface on validating nodes. Antoine also mentions the absence of a table of contents in the document, which might hinder navigation and usability.