188 |
Merkle hash trees |
Merkle hash trees |
189 |
----------------- |
----------------- |
190 |
|
|
191 |
Sign `$2^n$` new public keys by signing one hash. |
Assume an underlying one-time signature scheme `$S'$`. |
192 |
|
Generate `$2^n$` public keys through `$S'$`, |
193 |
|
compute a hash tree over them, publish the root |
194 |
|
of the tree as the actual public key. |
195 |
|
|
196 |
Assume underlying algorithm using same hash. |
Assume underlying algorithm using same hash. |
197 |
|
|
198 |
Signature using new public key will not need to contain all new public keys, |
Signature using new public key will not need to contain |
199 |
only the tree. |
all the public keys, just path through the tree. |
200 |
|
|
201 |
- private key: `$2^n + 1$` private keys of the underlying algorithm |
- private key: `$2^n$` private keys of the underlying algorithm. |
202 |
|
|
203 |
- public key: original public key. Also calculate off-line |
- public key: Calculate the `$2^n$` public keys; hash each |
204 |
hashes of the `$2^n$` public keys, and a hash tree from them, |
public key (if it is longer than a single hash); compute |
205 |
i.e. `$2^{n+1} - 1$` hashes in addition to calculating public |
the hash tree. Calculating the public key takes |
206 |
keys in the underlying algorithm. |
`$2^n c_0$` and calculating the hash tree takes |
207 |
Sign the original hash. |
`$2^{n+1}-1$` hash function invocations. |
208 |
Altogether, calculate `$(2^n + 1) c_0' + c_s' + 2^{n+1}-1 $` |
|
209 |
hashes |
- sign using one key: Sign with that private key, provide the |
210 |
Signature contains the hashes and the new public key and the signature with it, |
corresponding public key, and provide the chain of hashes |
211 |
and the signature of the original hash. |
from the hash tree's root to the public key. |
|
|
|
|
- sign using one key: Sign with that private key, and provide |
|
|
hashes in the chain to the original signature with the |
|
|
underlying public key in the signature. |
|
212 |
Only hash invocations in the signing using the underlying algorithm. |
Only hash invocations in the signing using the underlying algorithm. |
213 |
|
|
214 |
- verify: verify signature with new public key, verify hash chain and verify |
- verify: verify signature with new public key, verify hash chain. |
|
signature of hash tree root. |
|
215 |
|
|
216 |
|
|
217 |
One-time Signature Key Boosting |
One-time Signature Key Boosting |