433 |
and interpret as a bitstring. Reveal `$R_{b+i}$` |
and interpret as a bitstring. Reveal `$R_{b+i}$` |
434 |
if the `$i$`-th bit of the bitstring is zero. |
if the `$i$`-th bit of the bitstring is zero. |
435 |
|
|
436 |
|
At most `$b$` numbers are revealed (if all bits |
437 |
|
in the message are zero). |
438 |
|
|
439 |
|
The signature consists of the revealed numbers, |
440 |
|
plus the hashes of the numbers that were not revealed. |
441 |
|
|
442 |
- verify: |
- verify: |
443 |
|
|
444 |
Octuplet: `$(1, b, h(b+\\lceil \\log{2} b \\rceil), h, h, |
Octuplet: `$(1, b, h(b+\\lceil \\log{2} b \\rceil), h, h, |
445 |
b+\\lceil \\log{2} b \\rceil + 1, 0, |
b+\\lceil \\log{2} b \\rceil + 1, 0, \\le b$` |
|
\\le b+\\lceil \\log{2} b \\rceil$` |
|
446 |
|
|
447 |
|
|
448 |
Merkle-Winternitz |
Merkle-Winternitz |