Signer-optimal multiple-time post-quantum hash-based signature for heterogeneous IoT Systems

Heterogeneous Internet of Things (IoTs) harboring resource-limited devices like wearable sensors are essential for next-generation networks. Ensuring the authentication and integrity of security-sensitive telemetry in these applications is vital. Digital signatures provide scalable authentication with non-repudiation and public verifiability, making them essential tools for IoTs. However, current NIST-PQC standards are significantly resource-intensive for practical use on constrained IoT devices. This highlights a critical need for lightweight PQ-secure digital signatures that align with the limitations of low-end IoTs.

We propose a new multiple-time hash-based signature called Maximum Utilization Multiple HORS ($MUM-HORS$) that offers PQ security, short signatures, fast signing, and high key utilization for an extended lifespan. $MUM-HORS$ addresses the inefficiency and key loss issues of HORS in offline/online settings by introducing compact key management data structures and optimized resistance to weak-message attacks. We tested $MUM-HORS$ on two embedded platforms (ARM Cortex A-72 and 8-bit AVR ATmega2560) and commodity hardware. Results show $40\times$ lower resource usage at the same signing capacity ($2^{20}$ messages, 128-bit security) than multiple-time HORS. Furthermore, $MUM-HORS$ achieves $2\times$ and up to 4000$\times$ faster signing than conventional secure schemes on the ARM Cortex and state-of-the-art PQ-secure schemes for IoTs, respectively.