152 |
Merkle-Winternitz |
Merkle-Winternitz |
153 |
----------------- |
----------------- |
154 |
|
|
155 |
? |
This scheme relies on recursive application of the hash function. |
156 |
|
Let `$n$` be a positive integer and `$k=\\frac{b}{n}$`. |
157 |
|
Let `$H$` donate the hash function, with `$H^2(x)=H(H(x))$` etc. |
158 |
|
|
159 |
|
- private key: A list of random numbers `$(R_0,...,R_k)$`. |
160 |
|
|
161 |
|
- public key: Compute `$P_0=H^{k2^n}(R_0)$`, and |
162 |
|
`$P_i=H^{2^n}(R_i)$` for `$i>0$`. The hash of |
163 |
|
`$(P_0,...,P_k)$` is the public key. |
164 |
|
|
165 |
|
Needs `$2k2^n + 1$` hash function invocations. |
166 |
|
|
167 |
|
- signature: Split the `$b$`-bit message into `$k$` |
168 |
|
parts of `$n$` bits each. Interpreted each part |
169 |
|
as an integer `$k_i$` for `$0 < i \\le k$`. |
170 |
|
Compute `$S_i=H^{k_i}(R_i)$` for `$i>0$` |
171 |
|
and `$S_0=H^{2^nk-\\sum{k_i}}(R_0)$`. The tuple |
172 |
|
`$(S_0,...,S_k)$` is the signature. |
173 |
|
|
174 |
|
Signing requires `$k2^n$` invocations |
175 |
|
of the hash function. |
176 |
|
|
177 |
|
- verification: Compute `$k_i$` as above. |
178 |
|
Compute `$V_0=H^{\\sum{k_i}}(S_0)$` |
179 |
|
and `$V_i=H^{2^n-k_i}(S_i)$` for `$i>0$`. |
180 |
|
Check that the hash of `$(V_0,...,V_i)$` |
181 |
|
equals the public key. |
182 |
|
|
183 |
|
Verification requires `$k2^n + 1$` invocations |
184 |
|
of the hash function. |
185 |
|
|
186 |
BiBa |
BiBa |
187 |
---- |
---- |