# An Intrusion Resistant SCADA Framework Based on Quantum and Post-Quantum Scheme
## 4 Proposed Scheme
### Encryption and Digital Signature Algorithm
#### 4.2.3 SPHINCS-256 Tree Construction and Generating Digital Signature  
Figure 4 provides the general construction of SPHINCS tree. Figure 5 provides the mechanism of private and public key generation of both original and modified HORST algorithm. In the following paragraphs, we first explain the construction of SPHINCS tree and then dive into HORST private key generation.  
Figure 4 provides a generic construction of SPHINCS tree, with \(h=9\) and \(d=3\). The tree provides a hyper tree construction which includes layers of [PERSON]'s tree with OTS nodes as WOTS (+) scheme. At the bottom of the tree lies the FTS nodes denoted as. The Few Time Signature (FTS) scheme used in SPHINCS is HORST algorithm [43]. The HORST algorithm has two keys, namely, the internal secret key or the private key, and the public key. We have made modification in HORST.  
Generally, the HORST algorithm takes as input the seed and the bitmask Q. As shown in Figure 5, the initial secret key SK\({}_{H}\) is obtained by feeding seed into a PRNG denoted as G\({}_{t}\). The G\({}_{t}\)(seed) generates SK\({}_{H}=\) SK\({}_{1}\), SK\({}_{2}\),..., SK\({}_{t}\)[13]. However, in our proposed SPHINCS algorithm, the HORST replaces G\({}_{t}\) with QRNG\({}_{t}\).  
QRNG is a type of TRNG deployed in quantum hardware and it does not rely on seeding and a deterministic algorithm since it generates random numbers from measuring or observing quantum processes. A practical QRNG includes a source of randomness and, a measuring or detection system. The source of randomness is the entropy source for generating qubits. For example, an optical QRNG inherits randomness from quantum states of light with the help of a photon source, a polarizing beam splitter and detection systems [44; 45; 46].  
The QRNG\({}_{t}\) generates the truly random secret key SK\({}_{H}=\) SK\({}_{1}\), SK\({}_{2}\),..., SK\({}_{t}\). It does not need the seed value. The HORST tree is a binary tree constructed using bitmask \(Q\) and, the leaves, \(Li\), of the tree is computed using cryptographic hash function F on the elements of the secret key, SKi. Thus, we can denote it as \(Li=F(SK_{i})\) for \(i\in[t\)-1]. And the root node of the constructed binary tree on the \(L_{i}\) is the public key of HORST.  
SPHINCS-256 tree is a combination of four types of trees: Hyper-tree that includes [PERSON]'s, WOTS, and HORST. The hyper-tree comprises of [PERSON]'s tree connected by WOTS key pairs. Furthermore, the leaves of the SPHINCS-256 are HORS trees. Using the above-mentioned security parameters, the height of each Merkle tree is \(h/d=60/12=5\). The HORST tree follows a Merkle's construction with height \(\tau=\log_{2}t\)[13].  
The SPHINCS-256 follows a stateless Goldreich Signature scheme. Each node of the tree has an OTS pair. The key pair at the root, at the outermost layer (\(d-1\)), has SPHINCS-256 public key, PK\({}_{H}\) and private key, SK\({}_{d-1}\) as shown in Figure 6. However, the message is first signed with the FTS scheme, named HORST, situated is at the bottom of the tree. We used the following steps to generate the signature.  
Figure 4: General Construction of SPHINCS tree with \(h=9\) and \(d=3\).  
Figure 5: Key Generation: (**a**) Original HORST algorithm and (**b**) Proposed HORST algorithm.  
* We obtain the HORST secret key using QRNG, and using the HORS tree algorithm, we obtain its root key, which is the public key. The obtained HORST instances are used to sign the message.
* The obtained HORST signature comprises of k keys, and their respective authentication paths are a part of the SPHINCS-256 signature.
* We then sign the public key of each tree, obtained from the lower layer trees, with WOTS instances as we climb the SPHINCS-256 tree. The signatures obtained in each layer along with its corresponding authentication path to a public key, the root of SPHINCS-256 tree.  
After obtaining the signature, the RTU sends the concatenation of SPHINCS-256 public key \(PK\), cipher obtained, and the signature generated by SPHINCS-256 algorithm.