4 |
|
|
5 |
Abstract: |
Abstract: |
6 |
|
|
7 |
- recursive application of one-time signature to sign |
We propose an new digital signature scheme based on |
8 |
nodes along a single path through a virtual tree of |
recursive application of an underlying |
9 |
new pubkeys corresponding to privkeys |
one-time signature scheme to sign |
10 |
deterministically |
nodes along a single path through a virtual tree of |
11 |
generated by random oracle from the tree node |
keys deterministically |
12 |
|
generated by random oracle from the parent private keys. |
13 |
- In conjunction with Merkle hash trees, used to generate |
In conjunction with Merkle hash trees, our scheme |
14 |
a family of trade-offed schemes whose time and space characteristics |
is used to generate |
15 |
depend linearly on the underlying one-time sig schemes'. |
a family of schemes with a tradeoff between |
16 |
|
time and space characteristics, which for all separate values |
17 |
- good |
of the tradeoff parameter |
18 |
|
depend linearly on the characteristics |
19 |
- existentially unforgeable in adaptive chosen message attack |
of the underlying one-time signature scheme. |
20 |
|
|
21 |
- We believe that as long as the random oracle, |
Our scheme has several advantages: |
22 |
used to generate the new private keys |
signatures are |
23 |
and to implement the one-time signatures, |
existentially unforgeable in adaptive chosen message attack. |
24 |
isn't broken, an exhaustive |
Because the security of the scheme is based only on |
25 |
key search is the only way to break the scheme. |
one-way functions and a random oracle, i.e. |
26 |
|
no trapdoor functions are used, |
27 |
- (however, we don't give full security analysis) |
the keys and signatures remain valid |
28 |
|
for an |
29 |
- unlimited time |
unlimited time. |
|
|
|
|
- hash function strength, no trapdoor function required |
|
30 |
|
|
31 |
- instance: |
- instance: |
32 |
|
|
44 |
|
|
45 |
- we discuss applications |
- we discuss applications |
46 |
|
|
47 |
|
.. we believe that as long as the random oracle, |
48 |
|
used to generate the new private keys |
49 |
|
and to implement the one-time signatures, |
50 |
|
isn't broken, an exhaustive |
51 |
|
key search is the only way to break the scheme. |
52 |
|
|
53 |
|
- (however, we don't give full security analysis) |
54 |
|
|
55 |
Introduction |
Introduction |
56 |
============ |
============ |
57 |
|
|
333 |
verifying relatively slow |
verifying relatively slow |
334 |
|
|
335 |
- considerable improvements |
- considerable improvements |
336 |
probably possible |
may be possible |
337 |
|
|
338 |
- naturally not foolproof: e.g. hashes *do* get broken, REF |
- naturally not foolproof: e.g. hashes *do* get broken, REF |
339 |
|
|