2 |
One-time Signature Key Boosting: Full Digital Signature Feature Set without Trapdoor Functions |
One-time Signature Key Boosting: Full Digital Signature Feature Set without Trapdoor Functions |
3 |
============================================================================================== |
============================================================================================== |
4 |
|
|
5 |
Abstract: |
.. raw:: latex |
6 |
|
|
7 |
|
\renewcommand{\baselinestretch}{1.7} |
8 |
|
|
9 |
We propose a digital signature scheme based on |
\begin{abstract} |
10 |
recursive application of an underlying |
We propose a digital signature scheme based on |
11 |
one-time signature scheme to sign |
recursive application of an underlying |
12 |
nodes along a single path through a virtual tree of |
one-time signature scheme to sign |
13 |
keys deterministically |
nodes along a single path through a virtual tree of |
14 |
generated by random oracle from the parent private keys. |
keys deterministically |
15 |
In conjunction with Merkle hash trees, our scheme |
generated by random oracle from the parent private keys. |
16 |
is used to generate |
In conjunction with Merkle hash trees, our scheme |
17 |
a family of schemes with a tradeoff between |
is used to generate |
18 |
time and space characteristics, which for all separate values |
a family of schemes with a tradeoff between |
19 |
of the tradeoff parameter |
time and space characteristics, which for all separate values |
20 |
depend linearly on the characteristics |
of the tradeoff parameter |
21 |
of the underlying one-time signature scheme. |
depend linearly on the characteristics |
22 |
|
of the underlying one-time signature scheme. |
23 |
Our scheme has several advantages: |
|
24 |
signatures are |
Our scheme has several advantages: |
25 |
existentially unforgeable in adaptive chosen message attack, |
signatures are |
26 |
and because the security of the scheme is based only on |
existentially unforgeable in adaptive chosen message attack, |
27 |
one-way functions and a random oracle, i.e. |
and because the security of the scheme is based only on |
28 |
no trapdoor functions are used, |
one-way functions and a random oracle, i.e. |
29 |
the keys and signatures remain valid |
no trapdoor functions are used, |
30 |
for an |
the keys and signatures remain valid |
31 |
unlimited time. |
for an |
32 |
|
unlimited time. |
33 |
We discuss two example instances: |
|
34 |
a high-security instance with |
We discuss two example instances: |
35 |
unlimited use, 160-bit security, |
a high-security instance with |
36 |
which requires |
unlimited use, 160-bit security, |
37 |
a 110 KB signature, 201'952 hash function invocations for signing, and |
which requires |
38 |
5'568 hash invocations for verification. |
a 110 KB signature, 201'952 hash function invocations for signing, and |
39 |
On a more practical level, we discuss a |
5'568 hash invocations for verification. |
40 |
probabilistically valid instance |
On a more practical level, we discuss a |
41 |
which can be used for any number of signatures |
probabilistically valid instance |
42 |
within the bounds of the 56-bit birthday paradox. |
which can be used for any number of signatures |
43 |
The probabilistic scheme requires |
within the bounds of the 56-bit birthday paradox. |
44 |
a 42 KB sig, 75'732 hash invocations for signing, and 2'088 hashes |
The probabilistic scheme requires |
45 |
for verification. |
a 42 KB sig, 75'732 hash invocations for signing, and 2'088 hashes |
46 |
|
for verification. |
47 |
|
\end{abstract} |
48 |
|
\renewcommand{\baselinestretch}{1.7} |
49 |
|
|
50 |
Introduction |
Introduction |
51 |
============ |
============ |
229 |
.. raw:: latex |
.. raw:: latex |
230 |
|
|
231 |
\begin{table*} |
\begin{table*} |
232 |
|
\small |
233 |
\begin{tabular}{rr|rrrr} |
\begin{tabular}{rr|rrrr} |
234 |
$N$ & $n$ & \multicolumn{1}{c}{$s'$} & |
$N$ & $n$ & \multicolumn{1}{c}{$s'$} & |
235 |
\multicolumn{1}{c}{$t_0'$} & |
\multicolumn{1}{c}{$t_0'$} & |