226 |
|
|
227 |
- alternatives at tree nodes: |
- alternatives at tree nodes: |
228 |
|
|
229 |
- sign each public key separately, requires `$b \ge r$` and `$q\ge k$` |
- sign each public key separately, requires `$b \\ge r$` and `$q\\ge k$` |
230 |
and contributes `$s + r$` bits to signature and no extra hashes |
and contributes `$s + r$` bits to signature and no extra hashes |
231 |
|
|
232 |
- sign some type of hash of all public keys, requires `$b \ge h$` and `$q\ge 1$` |
- sign some type of hash of all public keys, requires `$b \\ge h$` and `$q\\ge 1$` |
233 |
|
|
234 |
- straightforward sig: contributes `$s + kr$ bits to sig and |
- straightforward sig: contributes `$s + kr$` bits to sig and |
235 |
one extra hash to $c_s$ and $c_v$. |
one extra hash to `$c_s$` and `$c_v$`. |
236 |
|
|
237 |
- hash of hashes, publish one public key and hashes of others: |
- hash of hashes, publish one public key and hashes of others: |
238 |
contributes `$s + r + (k-1)h$` bits to sig and |
contributes `$s + r + (k-1)h$` bits to sig and |
239 |
$k+1$ extra hashes to $c_s$ and $c_v$. |
`$k+1$` extra hashes to `$c_s$` and `$c_v$`. |
240 |
|
|
241 |
- tree of hashes, publish one public key and hashes of tree branches: |
- tree of hashes, publish one public key and hashes of tree branches: |
242 |
contributes `$s + r + h \log k$` bits to sig and |
contributes `$s + r + h \\log k$` bits to sig and |
243 |
$2k-1$ extra hashes to $c_s$ and $c_v$. |
`$2k-1$` extra hashes to `$c_s$` and `$c_v$`. |
244 |
|
|
245 |
There are two alternatives for signing the subkeys |
There are two alternatives for signing the subkeys |
246 |
at each tree level: either signing all the public |
at each tree level: either signing all the public |