/[gzz]/manuscripts/Sigs/article.rst
ViewVC logotype

Diff of /manuscripts/Sigs/article.rst

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.47 by tjl, Sat May 17 18:46:53 2003 UTC revision 1.48 by tjl, Sat May 17 18:52:53 2003 UTC
# Line 189  are analyzed in the next section. Line 189  are analyzed in the next section.
189  Analysis: Characterizing one-time signature schemes  Analysis: Characterizing one-time signature schemes
190  ===================================================  ===================================================
191    
192    - defer discussion of the choice of `$x$` to the next Section.
193    
194  We shall characterize the underlying one-time signature scheme by  We shall characterize the underlying one-time signature scheme by
195  a octuplet `$(q, b, s, r, h, c_0, c_s, c_v)$`, where  a octuplet `$(q, b, s, r, h, c_0, c_s, c_v)$`, where
# Line 241  and Line 242  and
242      }      }
243      \end{table*}      \end{table*}
244    
245  Table XXX shows  Table XXX shows the tradeoffs possible in various one-time signature algorithms.
246    The formulas for key boosting follow trivially from
247    the description of the algorithm.
248    
249    In order to work, key boosting requires the
250    hash tree as a basis to obtain an basis algorithm
251    with `$q' \ne 1$`.
252    
253  There are three parameters to the one-time signature key boosting algorithm:  - given `$N$` and `$q$`, there are `$q^N$`
 `$N$`, the number of levels in the private key tree,  
 `$k$`, the branching factor of the tree, and  
 the algorithm for choosing `$x$`.  
   
 - given `$N$` and `$k$`, there are `$k^N$`  
254    possible private keys for signing messages.    possible private keys for signing messages.
255    
 - We map  
   
 - alternatives at tree nodes:  
   
   - sign each public key separately,  requires `$b \\ge r$` and `$q\\ge k$`  
     and contributes `$s + r$` bits to signature and no extra hashes  
   
   - sign some type of hash of all public keys, requires `$b \\ge h$` and `$q\\ge 1$`  
   
     - straightforward sig: contributes `$s + kr$` bits to sig and  
       one extra hash to `$c_s$` and `$c_v$`.  
   
     - hash of hashes, publish one public key and hashes of others:  
       contributes `$s + r + (k-1)h$` bits to sig and  
       `$k+1$` extra hashes to `$c_s$` and two to `$c_v$`.  
   
     - tree of hashes, publish one public key and hashes of tree branches:  
       contributes `$s + r + h \\log k$` bits to sig and  
       `$2k-1$` extra hashes to `$c_s$` and `$\\log k$` to `$c_v$`.  
   
256    
257  - the first levels of signatures may be given in the public key,  - the first levels of signatures may be given in the public key,
258    giving a tradeoff between public key size and signature size.    giving a tradeoff between public key size and signature size.
# Line 303  Ordered Line 285  Ordered
285    
286  - mustn't lose count!  - mustn't lose count!
287    
288  - can't copy key!  - can't copy key or restore from backup!
289    
290  Probabilistic limited  Probabilistic limited
291  ---------------------  ---------------------

Legend:
Removed from v.1.47  
changed lines
  Added in v.1.48

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26