29 |
unlimited time. |
unlimited time. |
30 |
|
|
31 |
We discuss particularly an instance with |
We discuss particularly an instance with |
32 |
the full digital signature feature set, |
the full digital signature feature set, 160-bit security, |
33 |
which requires |
which requires |
34 |
a 110 KB signature, 175'072 hash invocations to create, and |
a 110 KB signature, 175'072 hash invocations for signing, and |
35 |
5'568 hash invocations to verify |
5'568 hash invocations for verification. |
36 |
|
On a more practical level, we discuss a |
37 |
- probabilistic instance |
probabilistically valid instance with 56-bit security |
38 |
|
if only used for up to XXX signatures. |
39 |
- (2^56 private keys) |
The probabilistic scheme requires |
40 |
|
a 28 KB sig, 175'096 hash invocations for signing, 1'408 hashes |
41 |
- with p XXX safe to sign up to XXX docs |
for verification. |
|
|
|
|
- 28 KB sig, 175'096 hashes to create, 1'408 hashes to verify |
|
42 |
|
|
43 |
- we discuss applications |
- we discuss applications |
44 |
|
|
|
.. we believe that as long as the random oracle, |
|
|
used to generate the new private keys |
|
|
and to implement the one-time signatures, |
|
|
isn't broken, an exhaustive |
|
|
key search is the only way to break the scheme. |
|
|
|
|
|
- (however, we don't give full security analysis) |
|
|
|
|
45 |
Introduction |
Introduction |
46 |
============ |
============ |
47 |
|
|
354 |
to work if only a predetermined number of documents is ever signed |
to work if only a predetermined number of documents is ever signed |
355 |
with a key. |
with a key. |
356 |
|
|
357 |
|
- we believe that as long as the random oracle, |
358 |
|
used to generate the new private keys |
359 |
|
and to implement the one-time signatures, |
360 |
|
isn't broken, an exhaustive |
361 |
|
key search is the only way to break the scheme. |
362 |
|
|
363 |
|
- (however, we don't give full security analysis) |
364 |
|
|
365 |
- not worse than RSA, where giving more signatures increases |
- not worse than RSA, where giving more signatures increases |
366 |
the possibility of factoring |
the possibility of factoring |
367 |
|
|