/[gzz]/manuscripts/Sigs/article.rst
ViewVC logotype

Diff of /manuscripts/Sigs/article.rst

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.143 by tjl, Mon May 19 21:30:34 2003 UTC revision 1.144 by tjl, Mon May 19 21:35:20 2003 UTC
# Line 215  the scheme requires only that one-way fu Line 215  the scheme requires only that one-way fu
215  random oracles exist.  random oracles exist.
216    
217  To our knowledge, this is has not previously been possible without  To our knowledge, this is has not previously been possible without
218  remembering all previously signed documents or changing to a new  remembering things about
219    previously signed documents or changing to a new
220  private key after a given number of signatures.  private key after a given number of signatures.
221  Our scheme only requires the private key to be remembered; no other  Our scheme only requires the private key to be remembered; no other
222  state is required.  state is required.
223    
224  In key boosting, the choice of the tree branch `$x$` to follow at each  In key boosting, the choice of the tree branch `$x$` to follow at each
225  node is crucial to the nature of the algorithm.  node is crucial to the nature of the algorithm.
226  In order to be able to sign 160-bit hashes securely, we generate  In order to be able to sign 160-bit hashes securely,
227    we choose the scheme parameters and `$x$` so as to generate
228  a unique private key for each 160-bit hash.  a unique private key for each 160-bit hash.
229  This is done by requiring that `$q^N > 2^{160}$` and choosing  This is done by requiring that `$q^N \\ge 2^{160}$` and choosing
230  `$x$` based on the bits of the hash to be signed.  `$x$` based on the bits of the hash to be signed.
231  If we use Merkle hash trees to obtain the underlying `$q$`-time scheme  If we use Merkle hash trees to obtain the underlying `$q$`-time scheme
232  from a one-time scheme, we have for the parameters of the two algorithms  from a one-time scheme, we have for the parameters of the two algorithms
233  the inequality `$ nN \ge 160 $`.  the inequality `$ nN \\ge 160 $`.
234  Obtaining the minimal integral solutions of this inequality  Obtaining the minimal integral solutions of this inequality
235  gives us a tradeoff where the length of the signature is approximately  gives us a tradeoff where the length of the signature is approximately
236  linear with `$N$` and the time to sign grows exponentially with `$n$`.  linear with `$N$` and the time to sign grows exponentially with `$n$`.
# Line 276  For example, Line 278  For example,
278  (explain/ref Merkle I as underlying scheme, explain calculations  (explain/ref Merkle I as underlying scheme, explain calculations
279  using this combined scheme)  using this combined scheme)
280    
 - feasible  
   
281  - may be practical for some applications,  - may be practical for some applications,
282    but no replacement in general    but no replacement in general
283    

Legend:
Removed from v.1.143  
changed lines
  Added in v.1.144

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26