185 |
a unique private key for each 160-bit hash. |
a unique private key for each 160-bit hash. |
186 |
This is done by requiring that `$q^N > 2^{160}$` and choosing |
This is done by requiring that `$q^N > 2^{160}$` and choosing |
187 |
`$x$` based on the bits of the hash to be signed. |
`$x$` based on the bits of the hash to be signed. |
188 |
- however, we *can* use OTS algorithms with chosen-message attacks since final pubkey |
If we use Merkle hash trees to obtain the underlying `$q$`-time scheme |
189 |
not known |
from a one-time scheme, we have for the parameters of the two algorithms |
190 |
|
the inequality `$ nN \ge 160 $`. |
191 |
we want the full deterministic |
Obtaining the minimal integral solutions of this inequality |
192 |
algorithm, for 160-bit hashes |
gives us a tradeoff where the length of the signature is approximately |
193 |
that, which requires `$ nN = 160 $`. |
linear with `$N$` and the time to sign grows exponentially with `$n$`. |
194 |
|
|
195 |
All choices produce a *linear* operation from the characteristics |
All choices produce a *linear* operation from the characteristics |
196 |
of a scheme to the characteristics of the other scheme. |
of a scheme to the characteristics of the other scheme. |
198 |
and the time to sign grows exponentially with `$n$` and |
and the time to sign grows exponentially with `$n$` and |
199 |
linearly (in the opposite direction!) with `$N$`. |
linearly (in the opposite direction!) with `$N$`. |
200 |
|
|
201 |
|
For example, |
202 |
|
|
203 |
- feasible |
- feasible |
204 |
|
|