28 |
- existentially unforgeable in adaptive chosen message attack, |
- existentially unforgeable in adaptive chosen message attack, |
29 |
even if underlying one-time-signature algorithm isn't |
even if underlying one-time-signature algorithm isn't |
30 |
|
|
31 |
- As long as the random oracle, used to generate the new private keys |
- We believe that as long as the random oracle, |
32 |
|
used to generate the new private keys |
33 |
and to implement the one-time signatures, |
and to implement the one-time signatures, |
34 |
isn't broken, an exhaustive |
isn't broken, an exhaustive |
35 |
key search is the only way to break the scheme. |
key search is the only way to break the scheme. |
36 |
|
|
37 |
|
- (however, we don't give full security analysis) |
38 |
|
|
39 |
- unlimited time |
- unlimited time |
40 |
|
|
41 |
- hash function strength, no trapdoor function required |
- hash function strength, no trapdoor function required |
44 |
|
|
45 |
- Full DS feature set |
- Full DS feature set |
46 |
|
|
47 |
- XXX KB sig, XXX hashes to create, XXX hashes to verify |
- 110 KB sig, 175'072 hashes to create, 5'568 hashes to verify |
48 |
|
|
49 |
- probabilistic instance |
- probabilistic instance |
50 |
|
|
51 |
|
- (2^56 private keys) |
52 |
|
|
53 |
- with p XXX safe to sign up to XXX docs |
- with p XXX safe to sign up to XXX docs |
54 |
|
|
55 |
- XXX KB sig, XXX hashes to create, XXX hashes to verify |
- 28 KB sig, 175'096 hashes to create, 1408 hashes to verify |
56 |
|
|
57 |
- we discuss applications |
- we discuss applications |
58 |
|
|