/[gzz]/manuscripts/Sigs/article.rst
ViewVC logotype

Diff of /manuscripts/Sigs/article.rst

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.52 by tjl, Sat May 17 19:17:50 2003 UTC revision 1.53 by tjl, Sat May 17 19:21:30 2003 UTC
# Line 46  key search is the only way to break the Line 46  key search is the only way to break the
46  Introduction  Introduction
47  ============  ============
48    
49  One-time signature schemes [XXX] are based on one-way functions [#]_.  One-time signatures were originally proposed independently
50    by [XXX] and [XXX]. Since then, numerous variations
51    and improvements have been published [XXX].
52    
53    
54    Despite the limitation to a small number of signatures
55    per public/private key pair,
56    
57    one-time signatures have
58    an important advantage:
59    
60    one-way functions generally do not rely on
61    unproven number-theoretic assumptions, like the
62    difficulty of factoring large integers [XXX]. In practice,
63    a cryptographic hash function is used in most
64    signature schemes anyway to map messages to a
65    fixed-length digest, which is then signed. As
66    cryptographic hash functions are one-way, also using them
67    as the basis for signature avoids introducing additional
68    cryptographic primitives into the system.
69    
70    Additionally, operations on one-way signatures
71    may be orders of magnitude faster than operations
72    in schemes like DSA or RSA.
73    
74    In this article, we introduce a new signature scheme
75    that can be used any number of times without keeping track
76    of private keys that have already been used.
77    Our scheme assumes a one-time signature scheme
78    and a random oracle.
79    In the following Sections, we first
80    describe our algorithm.
81    Then, we analyze the tradeoffs in it and other one-time signature
82    schemes.
83    After this, we discuss the different variants of our
84    algorithm based on how the path through the key tree
85    is selected, and finally conclude.
86    
87    One-time Signatures
88    ===================
89    
90    One-time signature schemes [XXX] are based
91    on one-way functions [#]_.
92  Given a one-way function f, the signer generates a set  Given a one-way function f, the signer generates a set
93  of (pseudo)random numbers and and publishes f(x) for each  of (pseudo)random numbers and and publishes f(x) for each
94  x in the set. This is the public key. To sign a message,  x in the set. This is the public key. To sign a message,
# Line 68  the deterministic algorithm is chosen so Line 110  the deterministic algorithm is chosen so
110  in its range is a true subset of any other set in its range,  in its range is a true subset of any other set in its range,
111  or that finding such a pair of sets is infeasible.  or that finding such a pair of sets is infeasible.
112    
 One-time signatures were originally proposed independently  
 by [XXX] and [XXX]. Since then, numerous variations  
 and improvements have been published [XXX].  
   
113  Private keys in one-time signature schemes can generally  Private keys in one-time signature schemes can generally
114  only be used to sign a single message. If the same key  only be used to sign a single message. If the same key
115  were used to sign multiple messages, an attacker might  were used to sign multiple messages, an attacker might
# Line 93  However, verification time increases, an Line 131  However, verification time increases, an
131  still needs to keep track of which private keys  still needs to keep track of which private keys
132  have already been used in order not to compromise security.  have already been used in order not to compromise security.
133    
 Despite the limitation to a small number of signatures  
 per public/private key pair, one-time signatures have  
 an important advantage:  
 one-way functions generally do not rely on  
 unproven number-theoretic assumptions, like the  
 difficulty of factoring large integers [XXX]. In practice,  
 a cryptographic hash function is used in most  
 signature schemes anyway to map messages to a  
 fixed-length digest, which is then signed. As  
 cryptographic hash functions are one-way, also using them  
 as the basis for signature avoids introducing additional  
 cryptographic primitives into the system.  
   
 Additionally, operations on one-way signatures  
 may be orders of magnitude faster than operations  
 in schemes like DSA or RSA.  
   
 In this article, we introduce a new signature scheme  
 that can be used any number of times without keeping track  
 of private keys that have already been used.  
 Our scheme assumes a one-time signature scheme  
 and a random oracle.  
 In the following Sections, we first  
 describe our algorithm.  
 Then, we analyze the tradeoffs in it and other one-time signature  
 schemes.  
 After this, we discuss the different variants of our  
 algorithm based on how the path through the key tree  
 is selected, and finally conclude.  
   
   
134    
135    
136  One-time Signature Key Boosting  One-time Signature Key Boosting

Legend:
Removed from v.1.52  
changed lines
  Added in v.1.53

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26