46 |
Introduction |
Introduction |
47 |
============ |
============ |
48 |
|
|
49 |
One-time signature schemes [XXX] are based on one-way functions [#]_. |
One-time signatures were originally proposed independently |
50 |
|
by [XXX] and [XXX]. Since then, numerous variations |
51 |
|
and improvements have been published [XXX]. |
52 |
|
|
53 |
|
|
54 |
|
Despite the limitation to a small number of signatures |
55 |
|
per public/private key pair, |
56 |
|
|
57 |
|
one-time signatures have |
58 |
|
an important advantage: |
59 |
|
|
60 |
|
one-way functions generally do not rely on |
61 |
|
unproven number-theoretic assumptions, like the |
62 |
|
difficulty of factoring large integers [XXX]. In practice, |
63 |
|
a cryptographic hash function is used in most |
64 |
|
signature schemes anyway to map messages to a |
65 |
|
fixed-length digest, which is then signed. As |
66 |
|
cryptographic hash functions are one-way, also using them |
67 |
|
as the basis for signature avoids introducing additional |
68 |
|
cryptographic primitives into the system. |
69 |
|
|
70 |
|
Additionally, operations on one-way signatures |
71 |
|
may be orders of magnitude faster than operations |
72 |
|
in schemes like DSA or RSA. |
73 |
|
|
74 |
|
In this article, we introduce a new signature scheme |
75 |
|
that can be used any number of times without keeping track |
76 |
|
of private keys that have already been used. |
77 |
|
Our scheme assumes a one-time signature scheme |
78 |
|
and a random oracle. |
79 |
|
In the following Sections, we first |
80 |
|
describe our algorithm. |
81 |
|
Then, we analyze the tradeoffs in it and other one-time signature |
82 |
|
schemes. |
83 |
|
After this, we discuss the different variants of our |
84 |
|
algorithm based on how the path through the key tree |
85 |
|
is selected, and finally conclude. |
86 |
|
|
87 |
|
One-time Signatures |
88 |
|
=================== |
89 |
|
|
90 |
|
One-time signature schemes [XXX] are based |
91 |
|
on one-way functions [#]_. |
92 |
Given a one-way function f, the signer generates a set |
Given a one-way function f, the signer generates a set |
93 |
of (pseudo)random numbers and and publishes f(x) for each |
of (pseudo)random numbers and and publishes f(x) for each |
94 |
x in the set. This is the public key. To sign a message, |
x in the set. This is the public key. To sign a message, |
110 |
in its range is a true subset of any other set in its range, |
in its range is a true subset of any other set in its range, |
111 |
or that finding such a pair of sets is infeasible. |
or that finding such a pair of sets is infeasible. |
112 |
|
|
|
One-time signatures were originally proposed independently |
|
|
by [XXX] and [XXX]. Since then, numerous variations |
|
|
and improvements have been published [XXX]. |
|
|
|
|
113 |
Private keys in one-time signature schemes can generally |
Private keys in one-time signature schemes can generally |
114 |
only be used to sign a single message. If the same key |
only be used to sign a single message. If the same key |
115 |
were used to sign multiple messages, an attacker might |
were used to sign multiple messages, an attacker might |
131 |
still needs to keep track of which private keys |
still needs to keep track of which private keys |
132 |
have already been used in order not to compromise security. |
have already been used in order not to compromise security. |
133 |
|
|
|
Despite the limitation to a small number of signatures |
|
|
per public/private key pair, one-time signatures have |
|
|
an important advantage: |
|
|
one-way functions generally do not rely on |
|
|
unproven number-theoretic assumptions, like the |
|
|
difficulty of factoring large integers [XXX]. In practice, |
|
|
a cryptographic hash function is used in most |
|
|
signature schemes anyway to map messages to a |
|
|
fixed-length digest, which is then signed. As |
|
|
cryptographic hash functions are one-way, also using them |
|
|
as the basis for signature avoids introducing additional |
|
|
cryptographic primitives into the system. |
|
|
|
|
|
Additionally, operations on one-way signatures |
|
|
may be orders of magnitude faster than operations |
|
|
in schemes like DSA or RSA. |
|
|
|
|
|
In this article, we introduce a new signature scheme |
|
|
that can be used any number of times without keeping track |
|
|
of private keys that have already been used. |
|
|
Our scheme assumes a one-time signature scheme |
|
|
and a random oracle. |
|
|
In the following Sections, we first |
|
|
describe our algorithm. |
|
|
Then, we analyze the tradeoffs in it and other one-time signature |
|
|
schemes. |
|
|
After this, we discuss the different variants of our |
|
|
algorithm based on how the path through the key tree |
|
|
is selected, and finally conclude. |
|
|
|
|
|
|
|
134 |
|
|
135 |
|
|
136 |
One-time Signature Key Boosting |
One-time Signature Key Boosting |