189 |
Analysis: Characterizing one-time signature schemes |
Analysis: Characterizing one-time signature schemes |
190 |
=================================================== |
=================================================== |
191 |
|
|
192 |
|
- defer discussion of the choice of `$x$` to the next Section. |
193 |
|
|
194 |
We shall characterize the underlying one-time signature scheme by |
We shall characterize the underlying one-time signature scheme by |
195 |
a octuplet `$(q, b, s, r, h, c_0, c_s, c_v)$`, where |
a octuplet `$(q, b, s, r, h, c_0, c_s, c_v)$`, where |
242 |
} |
} |
243 |
\end{table*} |
\end{table*} |
244 |
|
|
245 |
Table XXX shows |
Table XXX shows the tradeoffs possible in various one-time signature algorithms. |
246 |
|
The formulas for key boosting follow trivially from |
247 |
|
the description of the algorithm. |
248 |
|
|
249 |
|
In order to work, key boosting requires the |
250 |
|
hash tree as a basis to obtain an basis algorithm |
251 |
|
with `$q' \ne 1$`. |
252 |
|
|
253 |
There are three parameters to the one-time signature key boosting algorithm: |
- given `$N$` and `$q$`, there are `$q^N$` |
|
`$N$`, the number of levels in the private key tree, |
|
|
`$k$`, the branching factor of the tree, and |
|
|
the algorithm for choosing `$x$`. |
|
|
|
|
|
- given `$N$` and `$k$`, there are `$k^N$` |
|
254 |
possible private keys for signing messages. |
possible private keys for signing messages. |
255 |
|
|
|
- We map |
|
|
|
|
|
- alternatives at tree nodes: |
|
|
|
|
|
- sign each public key separately, requires `$b \\ge r$` and `$q\\ge k$` |
|
|
and contributes `$s + r$` bits to signature and no extra hashes |
|
|
|
|
|
- sign some type of hash of all public keys, requires `$b \\ge h$` and `$q\\ge 1$` |
|
|
|
|
|
- straightforward sig: contributes `$s + kr$` bits to sig and |
|
|
one extra hash to `$c_s$` and `$c_v$`. |
|
|
|
|
|
- hash of hashes, publish one public key and hashes of others: |
|
|
contributes `$s + r + (k-1)h$` bits to sig and |
|
|
`$k+1$` extra hashes to `$c_s$` and two to `$c_v$`. |
|
|
|
|
|
- tree of hashes, publish one public key and hashes of tree branches: |
|
|
contributes `$s + r + h \\log k$` bits to sig and |
|
|
`$2k-1$` extra hashes to `$c_s$` and `$\\log k$` to `$c_v$`. |
|
|
|
|
256 |
|
|
257 |
- the first levels of signatures may be given in the public key, |
- the first levels of signatures may be given in the public key, |
258 |
giving a tradeoff between public key size and signature size. |
giving a tradeoff between public key size and signature size. |
285 |
|
|
286 |
- mustn't lose count! |
- mustn't lose count! |
287 |
|
|
288 |
- can't copy key! |
- can't copy key or restore from backup! |
289 |
|
|
290 |
Probabilistic limited |
Probabilistic limited |
291 |
--------------------- |
--------------------- |