/[gzz]/manuscripts/Sigs/article.rst
ViewVC logotype

Diff of /manuscripts/Sigs/article.rst

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.155 by benja, Mon May 19 22:28:58 2003 UTC revision 1.156 by benja, Mon May 19 23:47:22 2003 UTC
# Line 9  One-time Signature Key Boosting: Full Di Line 9  One-time Signature Key Boosting: Full Di
9      \begin{abstract}      \begin{abstract}
10      We propose a digital signature scheme based on      We propose a digital signature scheme based on
11      recursive application of an underlying      recursive application of an underlying
12      one-time signature scheme to sign      one-time signature scheme, allowing a single private key
13      nodes along a single path through a virtual tree of      to sign an unlimited number of messages.
14      keys deterministically      Our scheme uses a virtual tree of key pairs, where each parent node
15      generated by random oracle from the parent private keys.      signs the public keys of its children.
16      In conjunction with Merkle hash trees, our scheme      The childrens' private keys are generated by a random oracle
17      is used to generate      from the parent's private key. There are as many leaves
18      a family of schemes with a tradeoff between      in the tree as possible messages, allowing every message
19      time and space characteristics, which for all separate values      to be signed by a different key.
20      of the tradeoff parameter  
21      depend linearly on the characteristics      Signatures in our scheme are  
22      of the underlying one-time signature scheme.      existentially unforgeable under an adaptive chosen message attack,
23        and because no trapdoor functions are used,
     Our scheme has several advantages:  
     signatures are    
     existentially unforgeable in adaptive chosen message attack,  
     and because the security of the scheme is based only on  
     one-way functions and a random oracle, i.e.  
     no trapdoor functions are used,  
24      the keys and signatures remain valid      the keys and signatures remain valid
25      for an      for an unlimited time.
     unlimited time.  
26    
27      We discuss two example instances:      In an instance using a 160 bit hash, signatures are 110 KB large;
28      a high-security instance with      signing needs `$2.1\\cdot 10^{5}$` and verification needs
29      unlimited use, 160-bit security,      `$5.6\\cdot 10^3$` hash function invocations.
     which requires  
     a 110 KB signature, 201'952 hash function invocations for signing, and  
     5'568 hash invocations for verification.  
     On a more practical level, we discuss a  
     probabilistically valid instance  
     which can be used for any number of signatures  
     within the bounds of the 56-bit birthday paradox.  
     The probabilistic scheme requires  
     a 42 KB sig, 75'732 hash invocations for signing, and 2'088 hashes  
     for verification.  
30      \end{abstract}      \end{abstract}
31      \renewcommand{\baselinestretch}{1.7}      \renewcommand{\baselinestretch}{1.7}
32    
# Line 70  one-time signatures can withstand a long Line 53  one-time signatures can withstand a long
53  cryptoanalytic attack; keys therefore need not  cryptoanalytic attack; keys therefore need not
54  expire after a small number of years.  expire after a small number of years.
55  This is important for e.g. long-term  This is important for e.g. long-term
56  digital publishing [anderson98eternal]_.  digital publishing [anderson98erl]_.
57  The alternative, digital timestamping  The alternative, digital timestamping
58  [haber91timestamp-andalso-bayer92improving]_,  [haber91timestamp-andalso-bayer92improving]_,
59  adds additional complication because  adds additional complication because
# Line 142  One-time Signature Key Boosting Line 125  One-time Signature Key Boosting
125    
126  Our scheme is a construction based on 1) a `$q$`-time signature  Our scheme is a construction based on 1) a `$q$`-time signature
127  scheme, and 2) a random oracle function. We generally assume  scheme, and 2) a random oracle function. We generally assume
128  that the random oracle is the same hash function (e.g. SHA-1)  that the random oracle is the same hash function (e.g. SHA-1 [fips-sha1]_)
129  as in the underlying signature scheme. Usually, this scheme  as in the underlying signature scheme. Usually, this scheme
130  will be a Merkle hash tree [merkle80protocols]_ of Merkle  will be a Merkle hash tree [merkle80protocols]_ of Merkle
131  one-time signatures [merkle87digital]_.  one-time signatures [merkle87digital]_.
# Line 298  with 110 KB signatures and uses Line 281  with 110 KB signatures and uses
281  hash invocations for signing and `$5.6\\cdot 10^3$`  hash invocations for signing and `$5.6\\cdot 10^3$`
282  hash invocations for verification.  hash invocations for verification.
283  Using SHA-1, we obtained the estimated times 1s and 30ms  Using SHA-1, we obtained the estimated times 1s and 30ms
284  for signing and verifying on a P4 Mobile 1.6GHz.  for signing and verifying on a P4 Mobile 1.6GHz;
285    on this system, the verification times are competitive
286    with DSA [fips-dsa]_.
287    
288  ..  com  ..  com
289    

Legend:
Removed from v.1.155  
changed lines
  Added in v.1.156

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26