245 |
|
|
246 |
This needs to be reasoned out carefully. |
This needs to be reasoned out carefully. |
247 |
|
|
|
Ordered |
|
|
------- |
|
|
|
|
|
- Keep count of number of signatures made |
|
|
|
|
|
- use bits of count for choosing |
|
|
|
|
|
- this is basically a k-time signature made feasible |
|
|
for large k |
|
|
|
|
|
- mustn't lose count! |
|
|
|
|
|
- can't copy key or restore from backup! |
|
|
|
|
|
- any scheme mapping the *action* of signing uniquely to a number between 0 and `$q$` |
|
|
will work. |
|
|
|
|
248 |
Probabilistic limited |
Probabilistic limited |
249 |
--------------------- |
--------------------- |
250 |
|
|
271 |
it *is* possible to |
it *is* possible to |
272 |
revoke only that leaf, not the whole key. |
revoke only that leaf, not the whole key. |
273 |
|
|
274 |
|
Ordered |
275 |
|
------- |
276 |
|
|
277 |
|
- Keep count of number of signatures made |
278 |
|
|
279 |
|
- use bits of count for choosing |
280 |
|
|
281 |
|
- this is basically a k-time signature made feasible |
282 |
|
for large k |
283 |
|
|
284 |
|
- mustn't lose count! |
285 |
|
|
286 |
|
- can't copy key or restore from backup! |
287 |
|
|
288 |
|
- any scheme mapping the *action* of signing uniquely to a number between 0 and `$q$` |
289 |
|
will work. |
290 |
|
|
291 |
Analysis: Characterizing one-time signature schemes |
Analysis: Characterizing one-time signature schemes |
292 |
=================================================== |
=================================================== |
293 |
|
|