60 |
[merkle80protocols-andalso-merkle87digital-andalso-bleichenbacheroptimal-andalso-perrig01biba-andalso-reyzin02better]_. |
[merkle80protocols-andalso-merkle87digital-andalso-bleichenbacheroptimal-andalso-perrig01biba-andalso-reyzin02better]_. |
61 |
Despite their limitations, one-way signatures have |
Despite their limitations, one-way signatures have |
62 |
attracted considerable interest because |
attracted considerable interest because |
63 |
their operation |
their operation does not rely on |
|
does not |
|
|
rely on |
|
64 |
trapdoor functions, whose strength is based on |
trapdoor functions, whose strength is based on |
65 |
unproven number-theoretic assumptions such as the |
unproven number-theoretic assumptions such as the |
66 |
difficulty of factoring large integers [XXX]. |
difficulty of factoring large integers [XXX]. |
|
|
|
|
This is important for, e.g., long-term digital publishing |
|
|
where the usual recommended digital signature expiration |
|
|
time of two years[XXX] is inconvenient [anderson98eternal]_. |
|
67 |
|
|
68 |
|
Unlike signature schemes based on trapdoor functions, |
69 |
|
one-time signatures can withstand a long-time |
70 |
|
cryptoanalytic attack; keys therefore need not |
71 |
|
expire after a small number of years. |
72 |
|
This is important for e.g. long-term |
73 |
|
digital publishing [anderson98eternal]_. |
74 |
|
The alternative, digital timestamping [XXX], |
75 |
|
adds additional complication because |
76 |
|
it needs a secure, trusted timestamping service. |
77 |
|
|
78 |
In this article, we introduce a new signature scheme, |
In this article, we introduce a new signature scheme, |
79 |
based on one-time signatures and a random oracle, |
based on one-time signatures and a random oracle, |