/[gzz]/manuscripts/Sigs/article.rst
ViewVC logotype

Diff of /manuscripts/Sigs/article.rst

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.104 by tjl, Sun May 18 21:11:59 2003 UTC revision 1.105 by tjl, Mon May 19 11:47:04 2003 UTC
# Line 325  and Line 325  and
325          \parbox{\sw}{Lamport\cite{XXX}\\$(h,b)$}          \parbox{\sw}{Lamport\cite{XXX}\\$(h,b)$}
326              & $1$ & $b$ & $bh$ & $2bh$ & $h$ & $2b$ & $0$ &  $b$ \\              & $1$ & $b$ & $bh$ & $2bh$ & $h$ & $2b$ & $0$ &  $b$ \\
327          \parbox{\sw}{Merkle I $(h,b)$}          \parbox{\sw}{Merkle I $(h,b)$}
328              & $1$ & $b$ & $h(b+\lceil \log{2} b \rceil)$ & $h$ & $h$ &              & $1$ & $b$ & $(b+\lceil \log_2 b \rceil)h$ & $h$ & $h$ &
329                  $b+\lceil \log{2} b \rceil + 1$ & $0$ &                  $b+\lceil \log_2 b \rceil + 1$ & $0$ &
330                  $\le b$ \\                  $\le b$ \\
331          \parbox{\sw}{Merkle-Winternitz\cite{XXX} $(h,b,n)$ }          \parbox{\sw}{Merkle-Winternitz\cite{XXX} $(h,b,n)$ }
332              & $1$ & $b$ & $\frac{b}{n}h+h$ & $h$ & $h$ &              & $1$ & $b$ & $(\frac{b}{n}+1)h$ & $h$ & $h$ &
333                  $2\frac{b}{n}(2^n-1)+1$ & $\frac{b}{n}(2^n-1)$ &                  $2\frac{b}{n}(2^n-1)+1$ & $\frac{b}{n}(2^n-1)$ &
334                  $\frac{b}{n}(2^n-1)+1$ \\                  $\frac{b}{n}(2^n-1)+1$ \\
335          \parbox{\sw}{BiBa $(h,b,q,n,t,w)$}          \parbox{\sw}{BiBa $(h,b,q,n,t,k)$}
336              & $q$ & $b$ & $th$ & $wh$ & $h$ & $t$ & $?+wh$ & $w$ \\              & $q$ & $b$ & $kh$ & $th$ & $h$ & $t$ & $1+t+k$ & $1+t+k$ \\
337          \parbox{\sw}{PowerBall $(?)$}          \parbox{\sw}{BiBa-Merkle $(h,b,q,n,t,k)$}
338              \\              & $q$ &  $b$ &  $k\lceil \log_2 t \rceil h$
339          \parbox{\sw}{Reyzin subset-resilient $(h,b,t,k)$ }                                  &  $h$ &  $h$ & $2t$ &  $1+t+k $
340                                                     &  $1+t+k+ k\lceil \log_2 t \rceil$ \\
341            \parbox{\sw}{Reyzin $(h,b,t,k)$ }
342              & $1$ & $b$ & $kh$ & $th$ & $h$ & $t$ & $1$ & $1+k$ \\              & $1$ & $b$ & $kh$ & $th$ & $h$ & $t$ & $1$ & $1+k$ \\
343            \parbox{\sw}{Reyzin-Merkle$(h,b,t,k)$ }
344                & $1$ & $b$ & $k\lceil \log_2 t \rceil h$
345                                   & $h$ & $h$ & $t$ & $1$ & $1+k+k \lceil \log_2 t \rceil$ \\
346          \parbox{\sw}{Bleichenbacher-Maurer\cite{XXX(ASIACRYPT)}          \parbox{\sw}{Bleichenbacher-Maurer\cite{XXX(ASIACRYPT)}
347                  (h, n)                  (h, n)
348                           }                           }
# Line 355  and Line 359  and
359          % XXX check this again          % XXX check this again
360          ($n, S'$) }          ($n, S'$) }
361              & ${2^n}q'$              & ${2^n}q'$
362                  & $b$ & $s'+r'+hn+h$                  & $b$ & $s'+r'+(n+1)h$
363                              & $h$ & $h$ &                              & $h$ & $h$ &
364                                          ${2^n}c_0' + 2(2^n)-1$ &                                          ${2^n}c_0' + 2(2^n)-1$ &
365                                                   $c_s'$ &                                                   $c_s'$ &
# Line 369  and Line 373  and
373          Characterizations of existing one-time signature schemes.          Characterizations of existing one-time signature schemes.
374          The symbols are explained in the text. $n$ is a freely chosen          The symbols are explained in the text. $n$ is a freely chosen
375          positive integer.          positive integer.
376          In BiBa, $t$ is the number of balls, $n$ the number of bins,          The Biba and Reyzin schemes (also the Merkle variants) are
377          and $w$ the number of balls needed in a single bin          probabilistic and the parameters must be chosen to obtain
378          in order to form a signature.          sufficient security.
379          In Reyzin and Reyzin's scheme, $t$ and $k$          Even in the non-probabilistic alternative
380          must be chosen so that ${t \choose k} \ge 2^b$.          of the Reyzin scheme, $t$ and $k$
381            must be chosen so that ${t \choose k} \ge 2^b$; in that alternative,
382            the running time of signing and verifying is more complicated and
383            not taken into account in the table.
384            In Biba, the invocations of the random oracle that throws the balls
385            into bins are counted as single hash function invocations.
386          For Bleichenbacher-Maurer, XXX          For Bleichenbacher-Maurer, XXX
387          `$\eta=\log 51 / \log 2$`.          `$\eta=\log 51 / \log 2$`.
388          The derived schemes use          The derived schemes use
# Line 420  Octuplet: `$(1, b, bh, 2bh, h, 2b, 0, b) Line 429  Octuplet: `$(1, b, bh, 2bh, h, 2b, 0, b)
429  Merkle (?)  Merkle (?)
430  ----------  ----------
431    
432    
433    
434  This scheme is an improvement over Lamport, needing  This scheme is an improvement over Lamport, needing
435  only `$k=b+\\lceil \\log{2} b \\rceil$` hashes.  only `$k=b+\\lceil \\log{2} b \\rceil$` hashes.
436    
# Line 492  The signer generates `$t$` random number Line 503  The signer generates `$t$` random number
503  their hashes as the public key. A hash function maps each ball  their hashes as the public key. A hash function maps each ball
504  to one of `$n$` *bins*, depending on the signed message  to one of `$n$` *bins*, depending on the signed message
505  and a counter, initially zero.  and a counter, initially zero.
506  If `$w$` balls fall into the same bin, they are published  If `$k$` balls fall into the same bin, they are published
507  as the signature. If no bin contains at least `$w$` balls,  as the signature. If no bin contains at least `$k$` balls,
508  the counter is increased and the procedure is repeated  the counter is increased and the procedure is repeated
509  until a '`$w$`-time collision' is found.  until a '`$k$`-time collision' is found.
510    
511  - private key: the `$t$` random numbers  - private key: the `$t$` random numbers
512    
513  - public key: the hashes of the random numbers  - public key: the hashes of the random numbers
514    
515  - sign: apply the hash function to all balls  - sign: apply the hash function to all balls
516    until a `$w$`-time collision is found    until a `$k$`-time collision is found
517    
518  - verify: verify that the hash function maps the published balls  - verify: verify that the hash function maps the published balls
519    into the same bin; verify that the balls match the public key    into the same bin; verify that the balls match the public key
520    (i.e., that the public key contains their hashes).    (i.e., that the public key contains their hashes).
521    
522  Octuplet: `$(q, b, th, wh, h, t, ?+wh, w)$` XXX check  Octuplet: `$(q, b, kh, th, h, t, 1+C(t)+k, 1+C(t)+k)$` XXX check
523    
524  Probability for successful forgery at one attempt  Probability for successful forgery at one attempt
525  after `$r$` signatures:  after `$r$` signatures:
526  `$ {rk \\over k} (n-1)^{(r-1)k} / n^{rk-1} $`  `$ {rk \\over k} (n-1)^{(r-1)k} / n^{rk-1} $`
527    
528    Because only a small number of the hashes in the public key need to be
529    revealed and checked when signing, a Merkle hash tree may be used
530    for the public key as described in the appendix of [XXX].
531    However, in the usual course of things this is impractical because
532    of the increased signature size. However, here the situation is different
533    since both public key size and signature size
534    of the underlying algorithm add to the
535    
536    Never more than `$k \\lceil \\log_2 t \\rceil$` hashes need to be provided
537    Worst-case estimate octuplet:
538    `$(q, b, k\\lceil \\log_2 t \\rceil h, h, h, 2t, 1+C(t)+k, 1+C(t)+k+ k\\lceil \\log_2 t \\rceil)$` XXX check
539    
540  MERKLE HASH TREE VARIANT!!! REDUCE PUBLIC KEY + SIG SIZE!!!  MERKLE HASH TREE VARIANT!!! REDUCE PUBLIC KEY + SIG SIZE!!!
541    
542            In BiBa, $t$ is the number of balls, $n$ the number of bins,
543            and $w$ the number of balls needed in a single bin
544            in order to form a signature.
545    
546    Powerball
547    ---------
548    
549    Like BiBa, except that instead of looking for a `$k$`-way collision,
550    the public key is used to generate patterns in which each bin must
551    be filled.
552    
553    Not included in table: detailed analysis of probability of forgery
554    not found in literature, and is beyond the scope of this article..
555    
556  Reyzin  Reyzin
557  ------  ------
558    
# Line 542  Probability for successful forgery after Line 579  Probability for successful forgery after
579    
580  ?  ?
581    
582  - serious vulnerabilities with chosen-message multiple signatures,  - serious vulnerabilities with adaptive chosen-message multiple signatures,
583    - however, not a problem in our current context, as different key will be used
584  Octuplet: `$(1, b, kh, th, h, t, 1, 1+k)$` XXX check    for each signature
585    
586  MERKLE HASH TREE VARIANT!!! REDUCE PUBLIC KEY + SIG SIZE!!!  Octuplet: `$(1, b, kh, th, h, t, 1, 1+k)$`
587    
588    Additionally, a Merkle hash tree can be applied as in BiBa:
589    Octuplet: `$(1, b, k\\lceil \\log_2 t \\rceil h, h, h, 2t, 1, 1+k+k\\lceil \\log_2 t \\rceil)$`
590    XXX check
591    
592  Bleichenbacher-Maurer  Bleichenbacher-Maurer
593  ---------------------  ---------------------
# Line 570  ASIACRPTO construction Line 611  ASIACRPTO construction
611    public key - calculate some less than `$9n+2$` hashes    public key - calculate some less than `$9n+2$` hashes
612    
613  Octuplet: `$(1, \\lfloor\\eta n\\rfloor,  Octuplet: `$(1, \\lfloor\\eta n\\rfloor,
614  3(n+1)h, h, h, 9n+2, 0, 9n+2)$` XXX check  3(n+1)h, h, h, 9n+2, 0, 9n+2)$`
615    
616    
617  Merkle hash trees  Merkle hash trees
# Line 624  c_0', N(c_0'+c_s'), Nc_v)$` Line 665  c_0', N(c_0'+c_s'), Nc_v)$`
665  Tradeoffs in deterministic key boosting  Tradeoffs in deterministic key boosting
666  ---------------------------------------  ---------------------------------------
667    
668    
669  - we demand security level `$2^{-160}$` for our underlying schemes  - we demand security level `$2^{-160}$` for our underlying schemes
670    
671    - biba:    - biba:
# Line 648  Tradeoffs in deterministic key boosting Line 690  Tradeoffs in deterministic key boosting
690      `$t=175$`, `$k=62$`      `$t=175$`, `$k=62$`
691    
692    - Bleichenbacher-Maurer.    - Bleichenbacher-Maurer.
693      To sign 160 bits, we need `$n=29$`      To sign 160 bits, we need `$n=29$`.
694        Signatures are 90 hashes
695    
696    
697  Conclusion  Conclusion

Legend:
Removed from v.1.104  
changed lines
  Added in v.1.105

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26