82 |
signature to find a new valid signature. |
signature to find a new valid signature. |
83 |
However, some schemes have been recently proposed that |
However, some schemes have been recently proposed that |
84 |
allow a small number of messages to be signed without |
allow a small number of messages to be signed without |
85 |
becoming completely insecure [BiBa, betterthanbiba]. |
becoming completely insecure [BiBa, betterthanbiba]_. |
86 |
|
|
87 |
Another way to allow n messages to be signed with the |
Another way to allow n messages to be signed with the |
88 |
same public key is to create n different key pairs, |
same public key is to create n different key pairs, |
242 |
contributes `$s + r + h \\log k$` bits to sig and |
contributes `$s + r + h \\log k$` bits to sig and |
243 |
`$2k-1$` extra hashes to `$c_s$` and `$c_v$`. |
`$2k-1$` extra hashes to `$c_s$` and `$c_v$`. |
244 |
|
|
|
There are two alternatives for signing the subkeys |
|
|
at each tree level: either signing all the public |
|
|
keys at one time, or signing each one separately using |
|
|
some algorithm, as described in the Introduction, to |
|
|
sign a small number of messages using a one-time-signature algorithm. |
|
245 |
|
|
246 |
Also, the first levels of signatures may be given in the public key, |
Also, the first levels of signatures may be given in the public key, |
247 |
giving a tradeoff between public key size and signature size. |
giving a tradeoff between public key size and signature size. |
254 |
Conclusion |
Conclusion |
255 |
========== |
========== |
256 |
|
|
257 |
|
- key idea: using the deterministic bit string for each privkey |
258 |
|
|
259 |
foo |
foo |
260 |
|
|
261 |
.. bibliography:: gzigzag |
.. bibliography:: gzigzag |