138 |
Signing |
Signing |
139 |
------- |
------- |
140 |
|
|
141 |
To generate a signature, we start by setting `$p$` |
To generate a signature for the message $m$, |
142 |
|
we start by setting `$p$` to the |
143 |
|
private key and `$i$` to `$0$`. |
144 |
|
Then, we iterate over the following steps `$N$` times: |
145 |
|
|
146 |
|
1. Use the random oracle to generate `$k$` new private keys |
147 |
|
`$p_j$` |
148 |
|
from `$p$`. |
149 |
|
|
150 |
|
2. Sign the corresponding public keys with `$p$`. This does |
151 |
|
not present |
152 |
|
a problem for the one-time signature algorithm, since |
153 |
|
the string to be signed is always the same for a given key. |
154 |
|
|
155 |
|
|
156 |
|
3. Choose `$x \in [1,k]$`. The exact algorithm for making this |
157 |
|
choice parametrizes the algorithm; possible choices are discussed |
158 |
|
below. |
159 |
|
|
160 |
|
4. `$p \leftarrow p_x$` |
161 |
|
|
162 |
|
After the iteration, `$p$` |
163 |
|
|
164 |
Verification |
Verification |
165 |
------------ |
------------ |