/[gzz]/manuscripts/Sigs/article.rst
ViewVC logotype

Diff of /manuscripts/Sigs/article.rst

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.119 by benja, Mon May 19 18:08:02 2003 UTC revision 1.120 by benja, Mon May 19 18:35:30 2003 UTC
# Line 52  Abstract: Line 52  Abstract:
52    
53    - with p XXX safe to sign up to XXX docs    - with p XXX safe to sign up to XXX docs
54    
55    - 28 KB sig, 175'096 hashes to create, 1408 hashes to verify    - 28 KB sig, 175'096 hashes to create, 1'408 hashes to verify
56    
57  - we discuss applications  - we discuss applications
58    
# Line 265  For example, Line 265  For example,
265    
266      - impractical; actual numbers below      - impractical; actual numbers below
267    
268        - Works with `$k=10$`, `$N=16$` for SHA-1; sig length        - With key_boosting(32, merkle_hashtree(5, merkleI(160, 160)))::
         is about `$16(r'+s')$`; realistically, about  
         25KB using Merkle-Winternitz with `$n=2$`.  
269    
270          Formally, this is:            (q=2^160.0, b=160, s=110.0 KB, r=20 B, h=20 B,
271          Key boosting(16, Merkle hash tree(10, Merkle-Winternitz(160,160,2), 10))             t0=5.47e+03 [~27.355ms], ts=1.75e+05 [~875.36ms],
272               tv=5.57e+03 [~27.84ms])
         and has the octuplet??  
273    
274    
275  Practical Variants  Practical Variants
276  ==================  ==================
277    
278    In practice, it may be useful to relax the security
279    requirements somewhat to obtain more practical schemes.
280    
281    - For smaller sigs and faster verification,
282      key_boosting(8, merkle_hashtree(7, merkleI(160, 160)))::
283    
284        (q=2^56.0, b=160, s=27.8125 KB, r=20 B, h=20 B,
285        t0=2.19e+04 [~109.435ms], ts=1.75e+05 [~875.48ms],
286        tv=1.41e+03 [~7.04ms])
287    
288    - For faster signing,
289      key_boosting(12, merkle_hashtree(5, merkleI(160, 160)))::
290    
291        (q=2^60.0, b=160, s=41.25 KB, r=20 B, h=20 B,
292        t0=5.47e+03 [~27.355ms], ts=6.57e+04 [~328.26ms],
293        tv=2.09e+03 [~10.44ms])
294    
295    This may be ok when using up to a million or so random keys
296    (XXX chance of a common birthday then?)
297    
298    It is also possible to use key boosting to form `$k$`-time
299    signature schemes for large `$k$`. For example, for `$k=2^20$`:
300    
301    - key_boosting(5, merkle_hashtree(4, merkleI(160, 160)))::
302    
303        (q=2^20.0, b=160, s=17.08984375 KB, r=20 B, h=20 B,
304        t0=2.74e+03 [~13.675ms], ts=1.37e+04 [~68.375ms],
305        tv=8.65e+02 [~4.325ms])
306    
307    Of course, there is the common technique to create a tree
308    of one-time signatures, where each key at the top signs
309    a number of keys below it. Using our scheme is only a variant,
310    which may be somewhat more convenient sometimes because
311    it only requires storing the number of keys already used,
312    not a whole tree of private keys.
313    
314    
315  Conclusion  Conclusion
316  ==========  ==========
317    

Legend:
Removed from v.1.119  
changed lines
  Added in v.1.120

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26