<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><span style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif;" class="">Panos Kampanakis just posted this on a mail list hosted by NIST. I thought it would be of interest to people on this list...</span><div class=""><font face="-webkit-system-font, Helvetica Neue, Helvetica, sans-serif" class=""><br class=""></font><div><blockquote type="cite" class=""><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="color: rgb(31, 73, 125); font-family: Calibri, sans-serif; font-size: 11pt;" class="">LDWM (the earlier version of the LMS draft) signatures are used in some Cisco chips for FPGA firmware signing. We also have heard interest in software package signing with stateful schemes.</span></div><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(31, 73, 125);" class="">We would like to see LMS and XMSS approved by NIST for some usecases. We tried to compare the two schemes for potential adopters in<span class="Apple-converted-space"> </span><a href="https://eprint.iacr.org/2017/349" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">https://eprint.iacr.org/2017/349</a><span class="Apple-converted-space"> </span>Personally, I would prefer for NIST to evaluate them together after they are both IETF RFCs. FWIW, there might be usecases of stateful schemes that have not been realized yet. For example in PKI, smaller size trees could be used as the Offline Root CA signing scheme given that the Root CA is offline and does not sign live. Such a usecase would assume different stateless schemes are used at the leaves of the cert chain of course.<o:p class=""></o:p></span></div></div></div></blockquote></div><br class=""></div></body></html>