221 |
- this is a nice theoretical result: it *is* possible to sign anything |
- this is a nice theoretical result: it *is* possible to sign anything |
222 |
without trapdoors - full feature set of normal (non-one-time) DSs |
without trapdoors - full feature set of normal (non-one-time) DSs |
223 |
|
|
224 |
- realistic? How much does this need? |
- feasible |
225 |
|
|
226 |
|
- not quite realistic; actual numbers below |
227 |
|
|
228 |
|
|
229 |
|
|
230 |
- Works with `$k=10$`, `$N=16$` for SHA-1; sig length |
- Works with `$k=10$`, `$N=16$` for SHA-1; sig length |
231 |
is about `$16(r'+s')$`; realistically, about |
is about `$16(r'+s')$`; realistically, about |
576 |
|
|
577 |
- maybe recommendations |
- maybe recommendations |
578 |
|
|
579 |
|
Tradeoffs in deterministic key boosting |
580 |
|
--------------------------------------- |
581 |
|
|
582 |
|
- we demand security level `$2^{-160}$` for our underlying schemes |
583 |
|
|
584 |
|
- biba: |
585 |
|
|
586 |
|
- Reyzin subset-resilient; |
587 |
|
|
588 |
|
- alternatively, the Reyzin theoretical construction may be used, |
589 |
|
where the time spent is somewhat more but security depends |
590 |
|
only on hashes |
591 |
|
|
592 |
|
|
593 |
|
|
594 |
Conclusion |
Conclusion |
595 |
========== |
========== |