4 |
|
|
5 |
We propose an unlimited-time digital signature scheme based |
We propose an unlimited-time digital signature scheme based |
6 |
on a one-time signature scheme and a random oracle. |
on a one-time signature scheme and a random oracle. |
7 |
The random oracle maps a private key p0 to a pair |
The random oracle is used to map a private key to a |
8 |
of new private keys (p1,p2); the one-time signature scheme |
set of new private keys. |
9 |
is used with p0 to sign the public keys corresponding to |
The original private key is used to sign the new |
10 |
(p1,p2). We apply this method recursively for each bit |
private keys. |
11 |
in a message, with p0'=p1 if the bit is zero and p0'=p2 |
For each message, one of the new keys is chosen, |
12 |
if the bit is one. The resultant chain of one-time signatures |
and this process is repeated recursively for a number |
13 |
forms our scheme's the signature of the message. |
of times to obtain the final private key used to sign |
14 |
|
the actual message. The signature consists of |
15 |
|
the chain of signatures from the original public key |
16 |
|
to the final signature. |
17 |
|
|
18 |
|
The detailed characteristics of the algorithm are determined |
19 |
|
by the one-time signature scheme used, |
20 |
|
the number of recursion levels, |
21 |
|
and the algorithm for choosing which private key to use. |
22 |
|
|
23 |
|
A one-time signature algorithm can be used as the primitive |
24 |
|
because |
25 |
|
each private key is only used to sign the public keys |
26 |
|
corresponding to a constant number of |
27 |
|
new private keys that only depend on the private key, |
28 |
|
not the message. |
29 |
|
|
30 |
|
Additionally, rejecting invalid signatures can be |
31 |
|
significantly faster than in RSA-like systems. |
32 |
|
On the other hand, signing is comparatively slow |
33 |
|
and signatures can be large. |
34 |
|
|
35 |
Our scheme has applications in long-term digital publishing. |
Our scheme has applications in long-term digital publishing. |
36 |
Unlike signature schemes like RSA and DSA, it does not |
Unlike signature schemes like RSA and DSA, it does not |
37 |
rely on number-theoretic assumptions like the hardness |
rely on number-theoretic assumptions like the hardness |
38 |
of factoring or discrete logs, areas in which substantial |
of factoring or discrete logs, areas in which substantial |
39 |
cryptoanalytical improvements continue to be made. |
cryptoanalytical improvements continue to be made. |
40 |
As long as the random oracle isn't broken, an exhaustive |
As long as the random oracle, used to generate the new private keys |
41 |
|
and to implement the one-time signatures, |
42 |
|
isn't broken, an exhaustive |
43 |
key search is the only way to break the scheme. |
key search is the only way to break the scheme. |
44 |
|
|
|
Additionally, rejecting invalid signatures can be |
|
|
significantly faster than in RSA-like systems. |
|
|
On the other hand, signing is comparatively slow |
|
|
and signatures are very large. |
|
|
|
|
45 |
|
|
46 |
Introduction |
Introduction |
47 |
============ |
============ |