52 |
|
|
53 |
- with p XXX safe to sign up to XXX docs |
- with p XXX safe to sign up to XXX docs |
54 |
|
|
55 |
- 28 KB sig, 175'096 hashes to create, 1408 hashes to verify |
- 28 KB sig, 175'096 hashes to create, 1'408 hashes to verify |
56 |
|
|
57 |
- we discuss applications |
- we discuss applications |
58 |
|
|
265 |
|
|
266 |
- impractical; actual numbers below |
- impractical; actual numbers below |
267 |
|
|
268 |
- Works with `$k=10$`, `$N=16$` for SHA-1; sig length |
- With key_boosting(32, merkle_hashtree(5, merkleI(160, 160))):: |
|
is about `$16(r'+s')$`; realistically, about |
|
|
25KB using Merkle-Winternitz with `$n=2$`. |
|
269 |
|
|
270 |
Formally, this is: |
(q=2^160.0, b=160, s=110.0 KB, r=20 B, h=20 B, |
271 |
Key boosting(16, Merkle hash tree(10, Merkle-Winternitz(160,160,2), 10)) |
t0=5.47e+03 [~27.355ms], ts=1.75e+05 [~875.36ms], |
272 |
|
tv=5.57e+03 [~27.84ms]) |
|
and has the octuplet?? |
|
273 |
|
|
274 |
|
|
275 |
Practical Variants |
Practical Variants |
276 |
================== |
================== |
277 |
|
|
278 |
|
In practice, it may be useful to relax the security |
279 |
|
requirements somewhat to obtain more practical schemes. |
280 |
|
|
281 |
|
- For smaller sigs and faster verification, |
282 |
|
key_boosting(8, merkle_hashtree(7, merkleI(160, 160))):: |
283 |
|
|
284 |
|
(q=2^56.0, b=160, s=27.8125 KB, r=20 B, h=20 B, |
285 |
|
t0=2.19e+04 [~109.435ms], ts=1.75e+05 [~875.48ms], |
286 |
|
tv=1.41e+03 [~7.04ms]) |
287 |
|
|
288 |
|
- For faster signing, |
289 |
|
key_boosting(12, merkle_hashtree(5, merkleI(160, 160))):: |
290 |
|
|
291 |
|
(q=2^60.0, b=160, s=41.25 KB, r=20 B, h=20 B, |
292 |
|
t0=5.47e+03 [~27.355ms], ts=6.57e+04 [~328.26ms], |
293 |
|
tv=2.09e+03 [~10.44ms]) |
294 |
|
|
295 |
|
This may be ok when using up to a million or so random keys |
296 |
|
(XXX chance of a common birthday then?) |
297 |
|
|
298 |
|
It is also possible to use key boosting to form `$k$`-time |
299 |
|
signature schemes for large `$k$`. For example, for `$k=2^20$`: |
300 |
|
|
301 |
|
- key_boosting(5, merkle_hashtree(4, merkleI(160, 160))):: |
302 |
|
|
303 |
|
(q=2^20.0, b=160, s=17.08984375 KB, r=20 B, h=20 B, |
304 |
|
t0=2.74e+03 [~13.675ms], ts=1.37e+04 [~68.375ms], |
305 |
|
tv=8.65e+02 [~4.325ms]) |
306 |
|
|
307 |
|
Of course, there is the common technique to create a tree |
308 |
|
of one-time signatures, where each key at the top signs |
309 |
|
a number of keys below it. Using our scheme is only a variant, |
310 |
|
which may be somewhat more convenient sometimes because |
311 |
|
it only requires storing the number of keys already used, |
312 |
|
not a whole tree of private keys. |
313 |
|
|
314 |
|
|
315 |
Conclusion |
Conclusion |
316 |
========== |
========== |
317 |
|
|