227 |
- alternatives at tree nodes: |
- alternatives at tree nodes: |
228 |
|
|
229 |
- sign each public key separately, requires `$b \ge r$` and `$q\ge k$` |
- sign each public key separately, requires `$b \ge r$` and `$q\ge k$` |
230 |
and contributes `$s + r$` bits to signature |
and contributes `$s + r$` bits to signature and no extra hashes |
231 |
|
|
232 |
- sign hash of all public keys, requires `$b \ge h$` and `$q\ge 1$` |
- sign some type of hash of all public keys, requires `$b \ge h$` and `$q\ge 1$` |
233 |
and contributes `$s + kr$ bits to sig |
|
234 |
|
- straightforward sig: contributes `$s + kr$ bits to sig and |
235 |
|
one extra hash to $c_s$ and $c_v$. |
236 |
|
|
237 |
|
- hash of hashes, publish one public key and hashes of others: |
238 |
|
contributes `$s + r + (k-1)h$` bits to sig and |
239 |
|
$k+1$ extra hashes to $c_s$ and $c_v$. |
240 |
|
|
241 |
|
- tree of hashes, publish one public key and hashes of tree branches: |
242 |
|
contributes `$s + r + h \log k$` bits to sig and |
243 |
|
$2k-1$ extra hashes to $c_s$ and $c_v$. |
244 |
|
|
245 |
There are two alternatives for signing the subkeys |
There are two alternatives for signing the subkeys |
246 |
at each tree level: either signing all the public |
at each tree level: either signing all the public |
248 |
some algorithm, as described in the Introduction, to |
some algorithm, as described in the Introduction, to |
249 |
sign a small number of messages using a one-time-signature algorithm. |
sign a small number of messages using a one-time-signature algorithm. |
250 |
|
|
251 |
|
Also, the first levels of signatures may be given in the public key, |
252 |
|
giving a tradeoff between public key size and signature size. |
253 |
|
|
254 |
Applicability to Digital Publishing |
Applicability to Digital Publishing |
255 |
=================================== |
=================================== |