4 |
|
|
5 |
Abstract: |
Abstract: |
6 |
|
|
7 |
We propose an new digital signature scheme based on |
We propose a digital signature scheme based on |
8 |
recursive application of an underlying |
recursive application of an underlying |
9 |
one-time signature scheme to sign |
one-time signature scheme to sign |
10 |
nodes along a single path through a virtual tree of |
nodes along a single path through a virtual tree of |
20 |
|
|
21 |
Our scheme has several advantages: |
Our scheme has several advantages: |
22 |
signatures are |
signatures are |
23 |
existentially unforgeable in adaptive chosen message attack. |
existentially unforgeable in adaptive chosen message attack, |
24 |
Because the security of the scheme is based only on |
and because the security of the scheme is based only on |
25 |
one-way functions and a random oracle, i.e. |
one-way functions and a random oracle, i.e. |
26 |
no trapdoor functions are used, |
no trapdoor functions are used, |
27 |
the keys and signatures remain valid |
the keys and signatures remain valid |
124 |
One-time Signature Key Boosting |
One-time Signature Key Boosting |
125 |
=============================== |
=============================== |
126 |
|
|
127 |
|
Our scheme is a construction based on 1) a `$q$`-time signature |
128 |
- based on underlying $q$-time scheme --- usually Merkle hash tree |
scheme, and 2) a random oracle function. We generally assume |
129 |
of one-time scheme. |
that the random oracle is the same hash function (e.g. SHA-1) |
130 |
|
as in the underlying signature scheme. Usually, this scheme |
131 |
- req. also random oracle |
will be a Merkle hash tree [XXX] of Merkle |
132 |
|
one-time signatures [XXX]. Other choices such as BiBa [XXX] |
133 |
|
are possible, but not evaluated in this article. |
|
|
|
134 |
|
|
135 |
The private key for this scheme is simply a private key |
The private key for this scheme is simply a private key |
136 |
for the underlying one-time-signature primitive, |
for the underlying one-time-signature primitive, |