131 |
Other choices such as BiBa [perrig01biba]_ |
Other choices such as BiBa [perrig01biba]_ |
132 |
are possible, but not evaluated in this article. |
are possible, but not evaluated in this article. |
133 |
|
|
134 |
The private key for this scheme is a random number |
The private key for the key boosted scheme is a random number |
135 |
from which a private key for the underlying |
from which a private key for the underlying |
136 |
one-time-signature primitive can be generated |
one-time-signature primitive can be generated |
137 |
using the random oracle. |
using the random oracle. |
205 |
is not based on complexity of inverting trapdoor functions; |
is not based on complexity of inverting trapdoor functions; |
206 |
it requires only a hash function in the random oracle model. |
it requires only a hash function in the random oracle model. |
207 |
|
|
208 |
To our knowledge, this is has not previously been possible without |
To our knowledge, this has not previously been possible without |
209 |
remembering things about |
remembering things about |
210 |
previously signed documents and changing to a new |
previously signed documents and changing to a new |
211 |
private key after a given number of signatures. |
private key after a given number of signatures. |
222 |
|
|
223 |
If we use Merkle hash trees to obtain the underlying `$q$`-time scheme |
If we use Merkle hash trees to obtain the underlying `$q$`-time scheme |
224 |
from a one-time scheme, we have for the parameters of the two algorithms |
from a one-time scheme, we have for the parameters of the two algorithms |
225 |
the inequality `$ nN \\ge 160 $`. |
the inequality `$ nN \\ge 160 $`, where `$n$` is the depth of |
226 |
|
the Merkle hash tree. |
227 |
|
|
228 |
Obtaining the minimal integral solutions of this inequality |
Obtaining the minimal integral solutions of this inequality |
229 |
gives us a tradeoff where the length of the signature is approximately |
gives us a tradeoff where the length of the signature is approximately |
432 |
hash functions may be found. Also, while |
hash functions may be found. Also, while |
433 |
all digital |
all digital |
434 |
signatures in practice do depend on a hash function for |
signatures in practice do depend on a hash function for |
435 |
long messages, our demands for are stricter: the hash |
long messages, our demands for it are stricter: the hash |
436 |
function must also be a random oracle. |
function must also be a random oracle. |
437 |
|
|
438 |
We believe that as long as the random oracle, |
We believe that as long as the random oracle |
439 |
used to generate the new private keys |
used to generate the new private keys |
440 |
and to implement the one-time signatures, |
and to implement the one-time signatures |
441 |
isn't broken, an exhaustive |
isn't broken, an exhaustive |
442 |
key search is the only way to break the scheme. |
key search is the only way to break the scheme. |
443 |
At the very least, this scheme is |
At the very least, this scheme is |