134 |
and the public key is the corresponding one-time-signature |
and the public key is the corresponding one-time-signature |
135 |
public key. |
public key. |
136 |
|
|
|
|
|
|
Signing |
|
|
------- |
|
|
|
|
137 |
To generate a signature for the message $m$, |
To generate a signature for the message $m$, |
138 |
we start by setting `$p$` to the |
we start by setting `$p$` to the |
139 |
private key and `$i$` to `$0$`. |
private key and `$i$` to `$0$`. |
155 |
|
|
156 |
4. `$p \leftarrow p_x$` |
4. `$p \leftarrow p_x$` |
157 |
|
|
158 |
After the iteration, `$p$` |
After the iteration, `$p$` contains the private key to be used to sign |
159 |
|
the actual message $m$ using the one-time-signature primitive. |
160 |
Verification |
The signature consists of this signature and the whole chain |
161 |
------------ |
of signatures connecting this to the original public key. |
162 |
|
|
163 |
The scheme presented in this section XXX |
To verify a signature, the verifier only needs to traverse the |
164 |
|
chain of signatures |
165 |
We assume a one-time signature scheme which uses |
|
166 |
a (pseudo)random number as its private key. |
As long as the algorithm for choosing `$x$` does not yield the same |
167 |
If *p* is a private key, let *pub(p)* be |
chain for two messages, the signatures XXX |
168 |
the public key corresponding to it. For a message m, let |
The effects of this algorithm and the parameters `$k$` and `$N$` |
169 |
*sign(p,m)* be the signature of *m* with private key *p*. |
are analyzed in the next section. |
170 |
Let *verify(pub(p),m,s)* be true for a signature *s* |
|
171 |
if *sign(p,m)=s*. Assume the above only if *sign(p,m)* |
|
172 |
is not publicized for more than one *m*. |
.. If *p* is a private key, let *pub(p)* be |
173 |
|
the public key corresponding to it. For a message m, let |
174 |
Further, let *R* be a random oracle which |
*sign(p,m)* be the signature of *m* with private key *p*. |
175 |
deterministically maps a private key |
Let *verify(pub(p),m,s)* be true for a signature *s* |
176 |
to a pair of other private keys. |
if *sign(p,m)=s*. Assume the above only if *sign(p,m)* |
177 |
|
is not publicized for more than one *m*. |
178 |
To generate a private/public key pair in our scheme, |
|
179 |
generate a random number *p* as the private key |
Further, let *R* be a random oracle which |
180 |
and use *pub(p)* as the public key. |
deterministically maps a private key |
181 |
|
to a pair of other private keys. |
182 |
|
|
183 |
|
To generate a private/public key pair in our scheme, |
184 |
|
generate a random number *p* as the private key |
185 |
|
and use *pub(p)* as the public key. |
186 |
|
|
187 |
To sign a *b*-bit message *m*, |
To sign a *b*-bit message *m*, |
188 |
|
|
189 |
Analysis |
Analysis |
190 |
======== |
======== |