122 |
One-time Signature Key Boosting |
One-time Signature Key Boosting |
123 |
=============================== |
=============================== |
124 |
|
|
125 |
|
.. raw:: latex |
126 |
|
|
127 |
|
\def\hash{{\bf H}} |
128 |
|
\def\orac{{\bf R}} |
129 |
|
|
130 |
Our scheme is a construction based on 1) a `$q$`-time signature |
Our scheme is a construction based on 1) a `$q$`-time signature |
131 |
scheme, and 2) a random oracle function. We generally assume |
scheme, and 2) a random oracle function. We generally assume |
132 |
that the random oracle is the same hash function (e.g. SHA-1 [fips-sha1]_) |
that the random oracle is the same hash function (e.g. SHA-1 [fips-sha1]_) |
136 |
Other choices such as BiBa [perrig01biba]_ |
Other choices such as BiBa [perrig01biba]_ |
137 |
are possible, but not evaluated in this article. |
are possible, but not evaluated in this article. |
138 |
|
|
139 |
The private key for the key boosted scheme is a random number |
The private key for the key boosted scheme is a random number `$K$` |
140 |
from which a private key for the underlying |
from which a private key for the underlying |
141 |
one-time-signature primitive can be generated |
one-time-signature primitive can be generated |
142 |
using the random oracle. |
using the random oracle. |
145 |
|
|
146 |
To generate a signature for the message `$m$`, |
To generate a signature for the message `$m$`, |
147 |
we first set `$p$` to the first private key |
we first set `$p$` to the first private key |
148 |
generated by the random oracle. |
generated by the random oracle: `$p = \orac(K)$`. |
149 |
Then, we iterate over the following steps `$N$` times: |
Then, we iterate over the following steps `$N$` times: |
150 |
|
|
151 |
1. Choose the tree branch `$x \\in [1,q]$`. |
1. Use the random oracle to generate the `$q$` new private keys: |
152 |
|
`$(p_1, p_2, ... p_q) = \orac(p)$`. |
153 |
|
|
154 |
|
2. Choose the tree branch `$x \\in [1,q]$`. |
155 |
The exact algorithm for making this |
The exact algorithm for making this |
156 |
choice parametrizes the algorithm; possible choices are discussed |
choice parametrizes the algorithm; possible choices are discussed |
157 |
below. |
below. |
158 |
|
|
159 |
2. Use the random oracle to generate the `$x$th` new private key |
3. Sign the `$x$`th private key `$p_x$` with `$p$`. This does |
|
`$p_x$`, based on `$p$`. |
|
|
|
|
|
3. Sign the corresponding public key with `$p$`. This does |
|
160 |
not present |
not present |
161 |
a problem for the `$q$`-time signature algorithm, since |
a problem for the `$q$`-time signature algorithm, since |
162 |
the random oracle is deterministic and |
the random oracle is deterministic and |