/[gzz]/manuscripts/Sigs/article.rst
ViewVC logotype

Diff of /manuscripts/Sigs/article.rst

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.157 by benja, Tue May 20 00:18:02 2003 UTC revision 1.158 by tjl, Tue May 20 09:30:56 2003 UTC
# Line 131  one-time signatures [merkle87digital]_. Line 131  one-time signatures [merkle87digital]_.
131  Other choices such as BiBa [perrig01biba]_  Other choices such as BiBa [perrig01biba]_
132  are possible, but not evaluated in this article.  are possible, but not evaluated in this article.
133    
134  The private key for this scheme is a random number  The private key for the key boosted scheme is a random number
135  from which a private key for the underlying  from which a private key for the underlying
136  one-time-signature primitive can be generated  one-time-signature primitive can be generated
137  using the random oracle.  using the random oracle.
# Line 205  because its security Line 205  because its security
205  is not based on complexity of inverting trapdoor functions;  is not based on complexity of inverting trapdoor functions;
206  it requires only a hash function in the random oracle model.  it requires only a hash function in the random oracle model.
207    
208  To our knowledge, this is has not previously been possible without  To our knowledge, this has not previously been possible without
209  remembering things about  remembering things about
210  previously signed documents and changing to a new  previously signed documents and changing to a new
211  private key after a given number of signatures.  private key after a given number of signatures.
# Line 222  This is done by requiring that `$q^N \\g Line 222  This is done by requiring that `$q^N \\g
222    
223  If we use Merkle hash trees to obtain the underlying `$q$`-time scheme  If we use Merkle hash trees to obtain the underlying `$q$`-time scheme
224  from a one-time scheme, we have for the parameters of the two algorithms  from a one-time scheme, we have for the parameters of the two algorithms
225  the inequality `$ nN \\ge 160 $`.  the inequality `$ nN \\ge 160 $`, where `$n$` is the depth of
226    the Merkle hash tree.
227    
228  Obtaining the minimal integral solutions of this inequality  Obtaining the minimal integral solutions of this inequality
229  gives us a tradeoff where the length of the signature is approximately  gives us a tradeoff where the length of the signature is approximately
# Line 431  Naturally, this scheme is not foolproof. Line 432  Naturally, this scheme is not foolproof.
432  hash functions may be found. Also, while  hash functions may be found. Also, while
433  all digital  all digital
434  signatures in practice do depend on a hash function for  signatures in practice do depend on a hash function for
435  long messages, our demands for are stricter: the hash  long messages, our demands for it are stricter: the hash
436  function must also be a random oracle.  function must also be a random oracle.
437    
438  We believe that as long as the random oracle,  We believe that as long as the random oracle
439  used to generate the new private keys  used to generate the new private keys
440  and to implement the one-time signatures,  and to implement the one-time signatures
441  isn't broken, an exhaustive  isn't broken, an exhaustive
442  key search is the only way to break the scheme.  key search is the only way to break the scheme.
443  At the very least, this scheme is  At the very least, this scheme is

Legend:
Removed from v.1.157  
changed lines
  Added in v.1.158

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26