268 |
tv=5.57e+03 [~27.84ms]) |
tv=5.57e+03 [~27.84ms]) |
269 |
|
|
270 |
|
|
271 |
|
- Maybe also mention: |
272 |
|
|
273 |
|
Note that rejection of a wrong key the most time-critical |
274 |
|
operation, in order to avoid DOSing through giving loads |
275 |
|
of wrong signatures. If the adversary can only forge the |
276 |
|
first `$b_0$` bits of the message, rejection of the sig |
277 |
|
will only take `$\\frac{b_0}{b}$` of the above estimate. |
278 |
|
|
279 |
|
If the signed bits are the cryptographic hash of the |
280 |
|
actual message, forging many bits may be hard. |
281 |
|
|
282 |
|
|
283 |
Practical Variants |
Practical Variants |
284 |
================== |
================== |
285 |
|
|
324 |
========== |
========== |
325 |
|
|
326 |
- presented a new signature scheme with several benefits |
- presented a new signature scheme with several benefits |
327 |
|
as far as we know not found together so far |
328 |
|
|
329 |
- no trapdoor funcs |
- no trapdoor funcs |
330 |
|
|
350 |
|
|
351 |
- naturally not foolproof: e.g. hashes *do* get broken, REF |
- naturally not foolproof: e.g. hashes *do* get broken, REF |
352 |
|
|
353 |
|
- signatures in practice do depend on a hash function for |
354 |
|
long messages. however, it only needs to be collision-resistant, |
355 |
|
not a random oracle |
356 |
|
|
357 |
- key idea: using the deterministic random oracle |
- key idea: using the deterministic random oracle |
358 |
to create a huge virtual tree of private keys, |
to create a huge virtual tree of private keys, |
359 |
|
|
364 |
to work if only a predetermined number of documents is ever signed |
to work if only a predetermined number of documents is ever signed |
365 |
with a key. |
with a key. |
366 |
|
|
367 |
|
- not worse than RSA, where giving more signatures increases |
368 |
|
the possibility of factoring |
369 |
|
|
370 |
Acknowledgments |
Acknowledgments |
371 |
=============== |
=============== |
|
|
|
|
|
|
|
|
|
|
|
|