9 |
\begin{abstract} |
\begin{abstract} |
10 |
We propose a digital signature scheme based on |
We propose a digital signature scheme based on |
11 |
recursive application of an underlying |
recursive application of an underlying |
12 |
one-time signature scheme to sign |
one-time signature scheme, allowing a single private key |
13 |
nodes along a single path through a virtual tree of |
to sign an unlimited number of messages. |
14 |
keys deterministically |
Our scheme uses a virtual tree of key pairs, where each parent node |
15 |
generated by random oracle from the parent private keys. |
signs the public keys of its children. |
16 |
In conjunction with Merkle hash trees, our scheme |
The childrens' private keys are generated by a random oracle |
17 |
is used to generate |
from the parent's private key. There are as many leaves |
18 |
a family of schemes with a tradeoff between |
in the tree as possible messages, allowing every message |
19 |
time and space characteristics, which for all separate values |
to be signed by a different key. |
20 |
of the tradeoff parameter |
|
21 |
depend linearly on the characteristics |
Signatures in our scheme are |
22 |
of the underlying one-time signature scheme. |
existentially unforgeable under an adaptive chosen message attack, |
23 |
|
and because no trapdoor functions are used, |
|
Our scheme has several advantages: |
|
|
signatures are |
|
|
existentially unforgeable in adaptive chosen message attack, |
|
|
and because the security of the scheme is based only on |
|
|
one-way functions and a random oracle, i.e. |
|
|
no trapdoor functions are used, |
|
24 |
the keys and signatures remain valid |
the keys and signatures remain valid |
25 |
for an |
for an unlimited time. |
|
unlimited time. |
|
26 |
|
|
27 |
We discuss two example instances: |
In an instance using a 160 bit hash, signatures are 110 KB large; |
28 |
a high-security instance with |
signing needs `$2.1\\cdot 10^{5}$` and verification needs |
29 |
unlimited use, 160-bit security, |
`$5.6\\cdot 10^3$` hash function invocations. |
|
which requires |
|
|
a 110 KB signature, 201'952 hash function invocations for signing, and |
|
|
5'568 hash invocations for verification. |
|
|
On a more practical level, we discuss a |
|
|
probabilistically valid instance |
|
|
which can be used for any number of signatures |
|
|
within the bounds of the 56-bit birthday paradox. |
|
|
The probabilistic scheme requires |
|
|
a 42 KB sig, 75'732 hash invocations for signing, and 2'088 hashes |
|
|
for verification. |
|
30 |
\end{abstract} |
\end{abstract} |
31 |
\renewcommand{\baselinestretch}{1.7} |
\renewcommand{\baselinestretch}{1.7} |
32 |
|
|
53 |
cryptoanalytic attack; keys therefore need not |
cryptoanalytic attack; keys therefore need not |
54 |
expire after a small number of years. |
expire after a small number of years. |
55 |
This is important for e.g. long-term |
This is important for e.g. long-term |
56 |
digital publishing [anderson98eternal]_. |
digital publishing [anderson98erl]_. |
57 |
The alternative, digital timestamping |
The alternative, digital timestamping |
58 |
[haber91timestamp-andalso-bayer92improving]_, |
[haber91timestamp-andalso-bayer92improving]_, |
59 |
adds additional complication because |
adds additional complication because |
125 |
|
|
126 |
Our scheme is a construction based on 1) a `$q$`-time signature |
Our scheme is a construction based on 1) a `$q$`-time signature |
127 |
scheme, and 2) a random oracle function. We generally assume |
scheme, and 2) a random oracle function. We generally assume |
128 |
that the random oracle is the same hash function (e.g. SHA-1) |
that the random oracle is the same hash function (e.g. SHA-1 [fips-sha1]_) |
129 |
as in the underlying signature scheme. Usually, this scheme |
as in the underlying signature scheme. Usually, this scheme |
130 |
will be a Merkle hash tree [merkle80protocols]_ of Merkle |
will be a Merkle hash tree [merkle80protocols]_ of Merkle |
131 |
one-time signatures [merkle87digital]_. |
one-time signatures [merkle87digital]_. |
281 |
hash invocations for signing and `$5.6\\cdot 10^3$` |
hash invocations for signing and `$5.6\\cdot 10^3$` |
282 |
hash invocations for verification. |
hash invocations for verification. |
283 |
Using SHA-1, we obtained the estimated times 1s and 30ms |
Using SHA-1, we obtained the estimated times 1s and 30ms |
284 |
for signing and verifying on a P4 Mobile 1.6GHz. |
for signing and verifying on a P4 Mobile 1.6GHz; |
285 |
|
on this system, the verification times are competitive |
286 |
|
with DSA [fips-dsa]_. |
287 |
|
|
288 |
.. com |
.. com |
289 |
|
|