54 |
their operation |
their operation |
55 |
does not |
does not |
56 |
rely on |
rely on |
57 |
unproven number-theoretic assumptions, like the |
unproven number-theoretic assumptions such as the |
58 |
difficulty of factoring large integers [XXX]. |
difficulty of factoring large integers [XXX]. |
|
Also, in practice, |
|
|
a cryptographic hash function is used in most |
|
|
signature schemes anyway to map messages to a |
|
|
fixed-length digest, which is then signed. As |
|
|
cryptographic hash functions are one-way, also using them |
|
|
as the basis for signature avoids introducing additional |
|
|
cryptographic primitives into the system. |
|
59 |
|
|
60 |
Additionally, operations on one-way signatures |
This is important for, e.g., long-term digital publishing |
61 |
may be orders of magnitude faster than operations |
where the usual recommended digital signature expiration |
62 |
in schemes like DSA or RSA. |
time of two years[XXX] is inconvenient. |
63 |
|
|
64 |
|
|
65 |
In this article, we introduce a new signature scheme |
In this article, we introduce a new signature scheme, |
66 |
|
based on one-time signatures and a random oracle, |
67 |
that can be used any number of times without keeping track |
that can be used any number of times without keeping track |
68 |
of private keys that have already been used. |
of private keys that have already been used. |
69 |
Our scheme assumes a one-time signature scheme |
In the following Sections, we first |
70 |
and a random oracle. |
review one-time signatures, and subsequently |
|
In the following Sections, we first |
|
71 |
describe our algorithm. |
describe our algorithm. |
72 |
Then, we analyze the tradeoffs in it and other one-time signature |
Then, we analyze the tradeoffs in it and other one-time signature |
73 |
schemes. |
schemes. |
78 |
One-time Signatures |
One-time Signatures |
79 |
=================== |
=================== |
80 |
|
|
81 |
|
Also, in practice, |
82 |
|
a cryptographic hash function is used in most |
83 |
|
signature schemes anyway to map messages to a |
84 |
|
fixed-length digest, which is then signed. As |
85 |
|
cryptographic hash functions are one-way, also using them |
86 |
|
as the basis for signature avoids introducing additional |
87 |
|
cryptographic primitives into the system. |
88 |
|
Additionally, operations on one-way signatures |
89 |
|
may be orders of magnitude faster than operations |
90 |
|
in schemes like DSA or RSA. |
91 |
|
|
92 |
One-time signature schemes [XXX] are based |
One-time signature schemes [XXX] are based |
93 |
on one-way functions [#]_. |
on one-way functions [#]_. |
94 |
Given a one-way function f, the signer generates a set |
Given a one-way function f, the signer generates a set |