186 |
|
|
187 |
To sign a *b*-bit message *m*, |
To sign a *b*-bit message *m*, |
188 |
|
|
189 |
Analysis |
Analysis: Characterizing one-time signature schemes |
190 |
======== |
=================================================== |
191 |
|
|
|
Characterizing one-time signature schemes |
|
|
----------------------------------------- |
|
192 |
|
|
193 |
We shall characterize the underlying one-time signature scheme by |
We shall characterize the underlying one-time signature scheme by |
194 |
a octuplet `$(q, b, s, r, h, c_0, c_s, c_v)$`, where |
a octuplet `$(q, b, s, r, h, c_0, c_s, c_v)$`, where |
241 |
} |
} |
242 |
\end{table*} |
\end{table*} |
243 |
|
|
244 |
Table XXX |
Table XXX shows |
245 |
|
|
246 |
There are three parameters to the one-time signature key boosting algorithm: |
There are three parameters to the one-time signature key boosting algorithm: |
247 |
`$N$`, the number of levels in the private key tree, |
`$N$`, the number of levels in the private key tree, |
272 |
`$2k-1$` extra hashes to `$c_s$` and `$\\log k$` to `$c_v$`. |
`$2k-1$` extra hashes to `$c_s$` and `$\\log k$` to `$c_v$`. |
273 |
|
|
274 |
|
|
|
- Our scheme, in the third alternative, maps a scheme |
|
|
`$(1, b, s, r, h, c_0, c_s, c_v)$` to |
|
|
`$(k^N, b, s + N(s + r + h \\log k), r, h, c_0, c_s + N(2k-1), c_v + N(k-1))$` |
|
|
|
|
275 |
- the first levels of signatures may be given in the public key, |
- the first levels of signatures may be given in the public key, |
276 |
giving a tradeoff between public key size and signature size. |
giving a tradeoff between public key size and signature size. |
277 |
|
|