325 |
\parbox{\sw}{Lamport\cite{XXX}\\$(h,b)$} |
\parbox{\sw}{Lamport\cite{XXX}\\$(h,b)$} |
326 |
& $1$ & $b$ & $bh$ & $2bh$ & $h$ & $2b$ & $0$ & $b$ \\ |
& $1$ & $b$ & $bh$ & $2bh$ & $h$ & $2b$ & $0$ & $b$ \\ |
327 |
\parbox{\sw}{Merkle I $(h,b)$} |
\parbox{\sw}{Merkle I $(h,b)$} |
328 |
& $1$ & $b$ & $h(b+\lceil \log{2} b \rceil)$ & $h$ & $h$ & |
& $1$ & $b$ & $(b+\lceil \log_2 b \rceil)h$ & $h$ & $h$ & |
329 |
$b+\lceil \log{2} b \rceil + 1$ & $0$ & |
$b+\lceil \log_2 b \rceil + 1$ & $0$ & |
330 |
$\le b$ \\ |
$\le b$ \\ |
331 |
\parbox{\sw}{Merkle-Winternitz\cite{XXX} $(h,b,n)$ } |
\parbox{\sw}{Merkle-Winternitz\cite{XXX} $(h,b,n)$ } |
332 |
& $1$ & $b$ & $\frac{b}{n}h+h$ & $h$ & $h$ & |
& $1$ & $b$ & $(\frac{b}{n}+1)h$ & $h$ & $h$ & |
333 |
$2\frac{b}{n}(2^n-1)+1$ & $\frac{b}{n}(2^n-1)$ & |
$2\frac{b}{n}(2^n-1)+1$ & $\frac{b}{n}(2^n-1)$ & |
334 |
$\frac{b}{n}(2^n-1)+1$ \\ |
$\frac{b}{n}(2^n-1)+1$ \\ |
335 |
\parbox{\sw}{BiBa $(h,b,q,n,t,w)$} |
\parbox{\sw}{BiBa $(h,b,q,n,t,k)$} |
336 |
& $q$ & $b$ & $th$ & $wh$ & $h$ & $t$ & $?+wh$ & $w$ \\ |
& $q$ & $b$ & $kh$ & $th$ & $h$ & $t$ & $1+t+k$ & $1+t+k$ \\ |
337 |
\parbox{\sw}{PowerBall $(?)$} |
\parbox{\sw}{BiBa-Merkle $(h,b,q,n,t,k)$} |
338 |
\\ |
& $q$ & $b$ & $k\lceil \log_2 t \rceil h$ |
339 |
\parbox{\sw}{Reyzin subset-resilient $(h,b,t,k)$ } |
& $h$ & $h$ & $2t$ & $1+t+k $ |
340 |
|
& $1+t+k+ k\lceil \log_2 t \rceil$ \\ |
341 |
|
\parbox{\sw}{Reyzin $(h,b,t,k)$ } |
342 |
& $1$ & $b$ & $kh$ & $th$ & $h$ & $t$ & $1$ & $1+k$ \\ |
& $1$ & $b$ & $kh$ & $th$ & $h$ & $t$ & $1$ & $1+k$ \\ |
343 |
|
\parbox{\sw}{Reyzin-Merkle$(h,b,t,k)$ } |
344 |
|
& $1$ & $b$ & $k\lceil \log_2 t \rceil h$ |
345 |
|
& $h$ & $h$ & $t$ & $1$ & $1+k+k \lceil \log_2 t \rceil$ \\ |
346 |
\parbox{\sw}{Bleichenbacher-Maurer\cite{XXX(ASIACRYPT)} |
\parbox{\sw}{Bleichenbacher-Maurer\cite{XXX(ASIACRYPT)} |
347 |
(h, n) |
(h, n) |
348 |
} |
} |
359 |
% XXX check this again |
% XXX check this again |
360 |
($n, S'$) } |
($n, S'$) } |
361 |
& ${2^n}q'$ |
& ${2^n}q'$ |
362 |
& $b$ & $s'+r'+hn+h$ |
& $b$ & $s'+r'+(n+1)h$ |
363 |
& $h$ & $h$ & |
& $h$ & $h$ & |
364 |
${2^n}c_0' + 2(2^n)-1$ & |
${2^n}c_0' + 2(2^n)-1$ & |
365 |
$c_s'$ & |
$c_s'$ & |
373 |
Characterizations of existing one-time signature schemes. |
Characterizations of existing one-time signature schemes. |
374 |
The symbols are explained in the text. $n$ is a freely chosen |
The symbols are explained in the text. $n$ is a freely chosen |
375 |
positive integer. |
positive integer. |
376 |
In BiBa, $t$ is the number of balls, $n$ the number of bins, |
The Biba and Reyzin schemes (also the Merkle variants) are |
377 |
and $w$ the number of balls needed in a single bin |
probabilistic and the parameters must be chosen to obtain |
378 |
in order to form a signature. |
sufficient security. |
379 |
In Reyzin and Reyzin's scheme, $t$ and $k$ |
Even in the non-probabilistic alternative |
380 |
must be chosen so that ${t \choose k} \ge 2^b$. |
of the Reyzin scheme, $t$ and $k$ |
381 |
|
must be chosen so that ${t \choose k} \ge 2^b$; in that alternative, |
382 |
|
the running time of signing and verifying is more complicated and |
383 |
|
not taken into account in the table. |
384 |
|
In Biba, the invocations of the random oracle that throws the balls |
385 |
|
into bins are counted as single hash function invocations. |
386 |
For Bleichenbacher-Maurer, XXX |
For Bleichenbacher-Maurer, XXX |
387 |
`$\eta=\log 51 / \log 2$`. |
`$\eta=\log 51 / \log 2$`. |
388 |
The derived schemes use |
The derived schemes use |
429 |
Merkle (?) |
Merkle (?) |
430 |
---------- |
---------- |
431 |
|
|
432 |
|
|
433 |
|
|
434 |
This scheme is an improvement over Lamport, needing |
This scheme is an improvement over Lamport, needing |
435 |
only `$k=b+\\lceil \\log{2} b \\rceil$` hashes. |
only `$k=b+\\lceil \\log{2} b \\rceil$` hashes. |
436 |
|
|
503 |
their hashes as the public key. A hash function maps each ball |
their hashes as the public key. A hash function maps each ball |
504 |
to one of `$n$` *bins*, depending on the signed message |
to one of `$n$` *bins*, depending on the signed message |
505 |
and a counter, initially zero. |
and a counter, initially zero. |
506 |
If `$w$` balls fall into the same bin, they are published |
If `$k$` balls fall into the same bin, they are published |
507 |
as the signature. If no bin contains at least `$w$` balls, |
as the signature. If no bin contains at least `$k$` balls, |
508 |
the counter is increased and the procedure is repeated |
the counter is increased and the procedure is repeated |
509 |
until a '`$w$`-time collision' is found. |
until a '`$k$`-time collision' is found. |
510 |
|
|
511 |
- private key: the `$t$` random numbers |
- private key: the `$t$` random numbers |
512 |
|
|
513 |
- public key: the hashes of the random numbers |
- public key: the hashes of the random numbers |
514 |
|
|
515 |
- sign: apply the hash function to all balls |
- sign: apply the hash function to all balls |
516 |
until a `$w$`-time collision is found |
until a `$k$`-time collision is found |
517 |
|
|
518 |
- verify: verify that the hash function maps the published balls |
- verify: verify that the hash function maps the published balls |
519 |
into the same bin; verify that the balls match the public key |
into the same bin; verify that the balls match the public key |
520 |
(i.e., that the public key contains their hashes). |
(i.e., that the public key contains their hashes). |
521 |
|
|
522 |
Octuplet: `$(q, b, th, wh, h, t, ?+wh, w)$` XXX check |
Octuplet: `$(q, b, kh, th, h, t, 1+C(t)+k, 1+C(t)+k)$` XXX check |
523 |
|
|
524 |
Probability for successful forgery at one attempt |
Probability for successful forgery at one attempt |
525 |
after `$r$` signatures: |
after `$r$` signatures: |
526 |
`$ {rk \\over k} (n-1)^{(r-1)k} / n^{rk-1} $` |
`$ {rk \\over k} (n-1)^{(r-1)k} / n^{rk-1} $` |
527 |
|
|
528 |
|
Because only a small number of the hashes in the public key need to be |
529 |
|
revealed and checked when signing, a Merkle hash tree may be used |
530 |
|
for the public key as described in the appendix of [XXX]. |
531 |
|
However, in the usual course of things this is impractical because |
532 |
|
of the increased signature size. However, here the situation is different |
533 |
|
since both public key size and signature size |
534 |
|
of the underlying algorithm add to the |
535 |
|
|
536 |
|
Never more than `$k \\lceil \\log_2 t \\rceil$` hashes need to be provided |
537 |
|
Worst-case estimate octuplet: |
538 |
|
`$(q, b, k\\lceil \\log_2 t \\rceil h, h, h, 2t, 1+C(t)+k, 1+C(t)+k+ k\\lceil \\log_2 t \\rceil)$` XXX check |
539 |
|
|
540 |
MERKLE HASH TREE VARIANT!!! REDUCE PUBLIC KEY + SIG SIZE!!! |
MERKLE HASH TREE VARIANT!!! REDUCE PUBLIC KEY + SIG SIZE!!! |
541 |
|
|
542 |
|
In BiBa, $t$ is the number of balls, $n$ the number of bins, |
543 |
|
and $w$ the number of balls needed in a single bin |
544 |
|
in order to form a signature. |
545 |
|
|
546 |
|
Powerball |
547 |
|
--------- |
548 |
|
|
549 |
|
Like BiBa, except that instead of looking for a `$k$`-way collision, |
550 |
|
the public key is used to generate patterns in which each bin must |
551 |
|
be filled. |
552 |
|
|
553 |
|
Not included in table: detailed analysis of probability of forgery |
554 |
|
not found in literature, and is beyond the scope of this article.. |
555 |
|
|
556 |
Reyzin |
Reyzin |
557 |
------ |
------ |
558 |
|
|
579 |
|
|
580 |
? |
? |
581 |
|
|
582 |
- serious vulnerabilities with chosen-message multiple signatures, |
- serious vulnerabilities with adaptive chosen-message multiple signatures, |
583 |
|
- however, not a problem in our current context, as different key will be used |
584 |
Octuplet: `$(1, b, kh, th, h, t, 1, 1+k)$` XXX check |
for each signature |
585 |
|
|
586 |
MERKLE HASH TREE VARIANT!!! REDUCE PUBLIC KEY + SIG SIZE!!! |
Octuplet: `$(1, b, kh, th, h, t, 1, 1+k)$` |
587 |
|
|
588 |
|
Additionally, a Merkle hash tree can be applied as in BiBa: |
589 |
|
Octuplet: `$(1, b, k\\lceil \\log_2 t \\rceil h, h, h, 2t, 1, 1+k+k\\lceil \\log_2 t \\rceil)$` |
590 |
|
XXX check |
591 |
|
|
592 |
Bleichenbacher-Maurer |
Bleichenbacher-Maurer |
593 |
--------------------- |
--------------------- |
611 |
public key - calculate some less than `$9n+2$` hashes |
public key - calculate some less than `$9n+2$` hashes |
612 |
|
|
613 |
Octuplet: `$(1, \\lfloor\\eta n\\rfloor, |
Octuplet: `$(1, \\lfloor\\eta n\\rfloor, |
614 |
3(n+1)h, h, h, 9n+2, 0, 9n+2)$` XXX check |
3(n+1)h, h, h, 9n+2, 0, 9n+2)$` |
615 |
|
|
616 |
|
|
617 |
Merkle hash trees |
Merkle hash trees |
665 |
Tradeoffs in deterministic key boosting |
Tradeoffs in deterministic key boosting |
666 |
--------------------------------------- |
--------------------------------------- |
667 |
|
|
668 |
|
|
669 |
- we demand security level `$2^{-160}$` for our underlying schemes |
- we demand security level `$2^{-160}$` for our underlying schemes |
670 |
|
|
671 |
- biba: |
- biba: |
690 |
`$t=175$`, `$k=62$` |
`$t=175$`, `$k=62$` |
691 |
|
|
692 |
- Bleichenbacher-Maurer. |
- Bleichenbacher-Maurer. |
693 |
To sign 160 bits, we need `$n=29$` |
To sign 160 bits, we need `$n=29$`. |
694 |
|
Signatures are 90 hashes |
695 |
|
|
696 |
|
|
697 |
Conclusion |
Conclusion |