221 |
} |
} |
222 |
\end{table*} |
\end{table*} |
223 |
|
|
224 |
First, the obvious facts: for a given `$N$` and `$k$`, there are `$k^N$` |
- given `$N$` and `$k$`, there are `$k^N$` |
225 |
possible private keys for signing messages. |
possible private keys for signing messages. |
226 |
|
|
227 |
|
- alternatives at tree nodes: |
228 |
|
|
229 |
|
- sign each public key separately, requires `$b \ge r$` and `$q\ge k$` |
230 |
|
and contributes `$s + r$` bits to signature |
231 |
|
|
232 |
|
- sign hash of all public keys, requires `$b \ge h$` and `$q\ge 1$` |
233 |
|
and contributes `$s + kr$ bits to sig |
234 |
|
|
235 |
There are two alternatives for signing the subkeys |
There are two alternatives for signing the subkeys |
236 |
at each tree level: either signing all the public |
at each tree level: either signing all the public |