116 |
signature to find a new valid signature. |
signature to find a new valid signature. |
117 |
However, some schemes have been recently proposed that |
However, some schemes have been recently proposed that |
118 |
allow a small number of messages to be signed without |
allow a small number of messages to be signed without |
119 |
becoming completely insecure [BiBa-andalso-betterthanbiba]_. |
becoming completely insecure |
120 |
|
[perrig01biba-andalso-mitzenmacher-bounds-andalso-reyzin02better]_. |
121 |
|
|
122 |
Another way to allow n messages to be signed with the |
Another way to allow n messages to be signed with the |
123 |
same public key is to create n different key pairs, |
same public key is to create n different key pairs, |
140 |
that the random oracle is the same hash function (e.g. SHA-1) |
that the random oracle is the same hash function (e.g. SHA-1) |
141 |
as in the underlying signature scheme. Usually, this scheme |
as in the underlying signature scheme. Usually, this scheme |
142 |
will be a Merkle hash tree [merkle80protocols]_ of Merkle |
will be a Merkle hash tree [merkle80protocols]_ of Merkle |
143 |
one-time signatures [merkle87digital]_. Other choices such as BiBa [XXX] |
one-time signatures [merkle87digital]_. |
144 |
|
Other choices such as BiBa [perrig01biba]_ |
145 |
are possible, but not evaluated in this article. |
are possible, but not evaluated in this article. |
146 |
|
|
147 |
The private key for this scheme is simply a private key |
The private key for this scheme is simply a private key |