/[gzz]/manuscripts/Sigs/article.rst
ViewVC logotype

Diff of /manuscripts/Sigs/article.rst

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.1 by benja, Sat May 17 11:03:13 2003 UTC revision 1.2 by tjl, Sat May 17 11:39:00 2003 UTC
# Line 4  Abstract Line 4  Abstract
4    
5  We propose an unlimited-time digital signature scheme based  We propose an unlimited-time digital signature scheme based
6  on a one-time signature scheme and a random oracle.  on a one-time signature scheme and a random oracle.
7  The random oracle maps a private key p0 to a pair  The random oracle is used to map a private key to a
8  of new private keys (p1,p2); the one-time signature scheme  set of new private keys.
9  is used with p0 to sign the public keys corresponding to  The original private key is used to sign the new
10  (p1,p2). We apply this method recursively for each bit  private keys.
11  in a message, with p0'=p1 if the bit is zero and p0'=p2  For each message, one of the new keys is chosen,
12  if the bit is one. The resultant chain of one-time signatures  and this process is repeated recursively for a number
13  forms our scheme's the signature of the message.  of times to obtain the final private key used to sign
14    the actual message. The signature consists of
15    the chain of signatures from the original public key
16    to the final signature.
17    
18    The detailed characteristics of the algorithm are determined
19    by the one-time signature scheme used,
20    the number of recursion levels,
21    and the algorithm for choosing which private key to use.
22    
23    A one-time signature algorithm can be used as the primitive
24    because
25    each private key is only used to sign the public keys
26    corresponding to a constant number of
27    new private keys that only depend on the private key,
28    not the message.
29    
30    Additionally, rejecting invalid signatures can be
31    significantly faster than in RSA-like systems.
32    On the other hand, signing is comparatively slow
33    and signatures can be large.
34    
35  Our scheme has applications in long-term digital publishing.  Our scheme has applications in long-term digital publishing.
36  Unlike signature schemes like RSA and DSA, it does not  Unlike signature schemes like RSA and DSA, it does not
37  rely on number-theoretic assumptions like the hardness  rely on number-theoretic assumptions like the hardness
38  of factoring or discrete logs, areas in which substantial  of factoring or discrete logs, areas in which substantial
39  cryptoanalytical improvements continue to be made.  cryptoanalytical improvements continue to be made.
40  As long as the random oracle isn't broken, an exhaustive  As long as the random oracle, used to generate the new private keys
41    and to implement the one-time signatures,
42    isn't broken, an exhaustive
43  key search is the only way to break the scheme.  key search is the only way to break the scheme.
44    
 Additionally, rejecting invalid signatures can be  
 significantly faster than in RSA-like systems.  
 On the other hand, signing is comparatively slow  
 and signatures are very large.  
   
45    
46  Introduction  Introduction
47  ============  ============

Legend:
Removed from v.1.1  
changed lines
  Added in v.1.2

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26