215 |
random oracles exist. |
random oracles exist. |
216 |
|
|
217 |
To our knowledge, this is has not previously been possible without |
To our knowledge, this is has not previously been possible without |
218 |
remembering all previously signed documents or changing to a new |
remembering things about |
219 |
|
previously signed documents or changing to a new |
220 |
private key after a given number of signatures. |
private key after a given number of signatures. |
221 |
Our scheme only requires the private key to be remembered; no other |
Our scheme only requires the private key to be remembered; no other |
222 |
state is required. |
state is required. |
223 |
|
|
224 |
In key boosting, the choice of the tree branch `$x$` to follow at each |
In key boosting, the choice of the tree branch `$x$` to follow at each |
225 |
node is crucial to the nature of the algorithm. |
node is crucial to the nature of the algorithm. |
226 |
In order to be able to sign 160-bit hashes securely, we generate |
In order to be able to sign 160-bit hashes securely, |
227 |
|
we choose the scheme parameters and `$x$` so as to generate |
228 |
a unique private key for each 160-bit hash. |
a unique private key for each 160-bit hash. |
229 |
This is done by requiring that `$q^N > 2^{160}$` and choosing |
This is done by requiring that `$q^N \\ge 2^{160}$` and choosing |
230 |
`$x$` based on the bits of the hash to be signed. |
`$x$` based on the bits of the hash to be signed. |
231 |
If we use Merkle hash trees to obtain the underlying `$q$`-time scheme |
If we use Merkle hash trees to obtain the underlying `$q$`-time scheme |
232 |
from a one-time scheme, we have for the parameters of the two algorithms |
from a one-time scheme, we have for the parameters of the two algorithms |
233 |
the inequality `$ nN \ge 160 $`. |
the inequality `$ nN \\ge 160 $`. |
234 |
Obtaining the minimal integral solutions of this inequality |
Obtaining the minimal integral solutions of this inequality |
235 |
gives us a tradeoff where the length of the signature is approximately |
gives us a tradeoff where the length of the signature is approximately |
236 |
linear with `$N$` and the time to sign grows exponentially with `$n$`. |
linear with `$N$` and the time to sign grows exponentially with `$n$`. |
278 |
(explain/ref Merkle I as underlying scheme, explain calculations |
(explain/ref Merkle I as underlying scheme, explain calculations |
279 |
using this combined scheme) |
using this combined scheme) |
280 |
|
|
|
- feasible |
|
|
|
|
281 |
- may be practical for some applications, |
- may be practical for some applications, |
282 |
but no replacement in general |
but no replacement in general |
283 |
|
|