32 |
a high-security instance with |
a high-security instance with |
33 |
unlimited use, 160-bit security, |
unlimited use, 160-bit security, |
34 |
which requires |
which requires |
35 |
a 110 KB signature, 175'072 hash invocations for signing, and |
a 110 KB signature, 201'952 hash function invocations for signing, and |
36 |
5'568 hash invocations for verification. |
5'568 hash invocations for verification. |
37 |
On a more practical level, we discuss a |
On a more practical level, we discuss a |
38 |
probabilistically valid instance with 56-bit security |
probabilistically valid instance with 56-bit security |
39 |
if only used for up to XXX signatures. |
if only used for up to XXX signatures. |
40 |
The probabilistic scheme requires |
The probabilistic scheme requires |
41 |
a 28 KB sig, 175'096 hash invocations for signing, 1'408 hashes |
a 42 KB sig, 75'732 hash invocations for signing, and 2'088 hashes |
42 |
for verification. |
for verification. |
43 |
|
|
44 |
Introduction |
Introduction |
250 |
|
|
251 |
- impractical; actual numbers below |
- impractical; actual numbers below |
252 |
|
|
253 |
- With key_boosting(32, merkle_hashtree(5, merkleI(160, 160))):: |
- With key_boosting_real(32, 5, 160):: |
254 |
|
|
255 |
(q=2^160.0, b=160, s=110.0 KB, r=20 B, h=20 B, |
(q=2^160.0, b=160, s=110.0 KB, |
256 |
t0=5.47e+03 [~27.355ms], ts=1.75e+05 [~875.36ms], |
r=20 B, h=20 B, |
257 |
tv=5.57e+03 [~27.84ms]) |
t0=6.31e+03 [~31.555ms], |
258 |
|
ts=2.02e+05 [~1009.76ms], |
259 |
|
tv=5.57e+03 [~27.84ms]) |
260 |
|
|
261 |
|
The private keys in these schemes is only 160 bits long; |
262 |
|
the random oracle is used to generate all the other private keys. |
263 |
|
|
264 |
|
|
265 |
- Maybe also mention: |
- Maybe also mention: |
281 |
requirements somewhat to obtain more practical schemes. |
requirements somewhat to obtain more practical schemes. |
282 |
|
|
283 |
- For smaller sigs and faster verification, |
- For smaller sigs and faster verification, |
284 |
key_boosting(8, merkle_hashtree(7, merkleI(160, 160))):: |
key_boosting_real(8, 7, 160):: |
285 |
|
|
286 |
(q=2^56.0, b=160, s=27.8125 KB, r=20 B, h=20 B, |
(q=2^56.0, b=160, s=27.8125 KB, |
287 |
t0=2.19e+04 [~109.435ms], ts=1.75e+05 [~875.48ms], |
r=20 B, h=20 B, |
288 |
tv=1.41e+03 [~7.04ms]) |
t0=2.31e+04 [~115.315ms], |
289 |
|
ts=1.85e+05 [~922.52ms], |
290 |
|
tv=1.41e+03 [~7.04ms]) |
291 |
|
|
292 |
- For faster signing, |
- For faster signing, |
293 |
key_boosting(12, merkle_hashtree(5, merkleI(160, 160))):: |
key_boosting_real(12, 5, 160):: |
294 |
|
|
295 |
(q=2^60.0, b=160, s=41.25 KB, r=20 B, h=20 B, |
(q=2^60.0, b=160, s=41.25 KB, |
296 |
t0=5.47e+03 [~27.355ms], ts=6.57e+04 [~328.26ms], |
r=20 B, h=20 B, |
297 |
tv=2.09e+03 [~10.44ms]) |
t0=6.31e+03 [~31.555ms], |
298 |
|
ts=7.57e+04 [~378.66ms], |
299 |
|
tv=2.09e+03 [~10.44ms]) |
300 |
|
|
301 |
This may be ok when using up to a million or so random keys |
This may be ok when using up to a million or so random keys |
302 |
(XXX chance of a common birthday then?) |
(XXX chance of a common birthday then?) |
304 |
It is also possible to use key boosting to form `$k$`-time |
It is also possible to use key boosting to form `$k$`-time |
305 |
signature schemes for large `$k$`. For example, for `$k=2^20$`: |
signature schemes for large `$k$`. For example, for `$k=2^20$`: |
306 |
|
|
307 |
- key_boosting(5, merkle_hashtree(4, merkleI(160, 160))):: |
- key_boosting_real(5, 4, 160):: |
308 |
|
|
309 |
(q=2^20.0, b=160, s=17.08984375 KB, r=20 B, h=20 B, |
(q=2^20.0, b=160, s=17.08984375 KB, |
310 |
t0=2.74e+03 [~13.675ms], ts=1.37e+04 [~68.375ms], |
r=20 B, h=20 B, |
311 |
tv=8.65e+02 [~4.325ms]) |
t0=3.41e+03 [~17.035ms], |
312 |
|
ts=1.70e+04 [~85.175ms], |
313 |
|
tv=8.65e+02 [~4.325ms]) |
314 |
|
|
315 |
Of course, there is the common technique to create a tree |
Of course, there is the common technique to create a tree |
316 |
of one-time signatures, where each key at the top signs |
of one-time signatures, where each key at the top signs |