294 |
|
|
295 |
- realistic? How much does this need? |
- realistic? How much does this need? |
296 |
|
|
297 |
|
- Works with `$k=10$`, `$N=16$` for SHA-1. |
298 |
|
|
299 |
Random or deterministic, but probabilistic |
Random or deterministic, but probabilistic |
300 |
------------------------------------------ |
------------------------------------------ |
301 |
|
|
309 |
we *can* use it here; random oracle |
we *can* use it here; random oracle |
310 |
|
|
311 |
- birthday paradox; if collision, someone can forge a signature |
- birthday paradox; if collision, someone can forge a signature |
312 |
|
(relevant if a large number of chosen message attacks) |
313 |
|
|
314 |
|
- can use random number; if we sign only 2**20 messages total, |
315 |
|
choosing randomly from 2**60 keys should be enough, since |
316 |
|
we expect collisions only at about 2**30 messages signed |
317 |
|
|
318 |
|
- birthday paradox again: must not allow the attacker to have |
319 |
|
2**30 messages being signed |
320 |
|
|
321 |
|
|
322 |
Applicability to Digital Publishing |
Applicability to Digital Publishing |