179 |
The time to verify is also equal to the time of verifying `$N$` |
The time to verify is also equal to the time of verifying `$N$` |
180 |
signatures in the underlying scheme. |
signatures in the underlying scheme. |
181 |
|
|
182 |
|
*Security.* Assume that the underlying signature scheme |
183 |
|
is resistant against a `$q$`-time chosen message attack. |
184 |
|
Within the tree, each private key is only used to sign |
185 |
|
`$q$` messages: the public keys corresponding to the |
186 |
|
new private keys the random oracle determines from |
187 |
|
the old private key. This part of the system is thus |
188 |
|
secure against any kind of chosen message attack. |
189 |
|
|
190 |
|
At the leaves, the scheme is secure if the same |
191 |
|
leaf key is not used to sign more than `$q$` messages; |
192 |
|
security thus depends on the algorithm for choosing `$x$`. |
193 |
|
|
194 |
|
|
195 |
Full Digital Signature Feature Set without Trapdoor Functions |
Full Digital Signature Feature Set without Trapdoor Functions |
196 |
============================================================= |
============================================================= |
197 |
|
|
221 |
Table [ref-tabtradeoff]_ shows the tradeoff in the characteristics |
Table [ref-tabtradeoff]_ shows the tradeoff in the characteristics |
222 |
of the derived schemes. |
of the derived schemes. |
223 |
|
|
|
|
|
224 |
.. raw:: latex |
.. raw:: latex |
225 |
|
|
226 |
\begin{table*} |
\begin{table*} |