329 |
$b+\lceil \log{2} b \rceil + 1$ & $0$ & |
$b+\lceil \log{2} b \rceil + 1$ & $0$ & |
330 |
$\le b$ \\ |
$\le b$ \\ |
331 |
\parbox{\sw}{Merkle-Winternitz\cite{XXX} $(h,b,n)$ } |
\parbox{\sw}{Merkle-Winternitz\cite{XXX} $(h,b,n)$ } |
332 |
& $1$ & $b$ & $\frac{bh}{n}+h$ & $h$ & $h$ & |
& $1$ & $b$ & $\frac{b}{n}h+h$ & $h$ & $h$ & |
333 |
$2\frac{b}{n}(2^n-1)+1$ & $\frac{b}{n}(2^n-1)+1$ & |
$2\frac{b}{n}(2^n-1)+1$ & $\frac{b}{n}(2^n-1)$ & |
334 |
$\frac{b}{n}(2^n-1)+1$ \\ |
$\frac{b}{n}(2^n-1)+1$ \\ |
335 |
\parbox{\sw}{BiBa $(h,b,q,n,t,w)$} |
\parbox{\sw}{BiBa $(h,b,q,n,t,w)$} |
336 |
& $q$ & $b$ & $th$ & $wh$ & $h$ & $t$ & $?+wh$ & $w$ \\ |
& $q$ & $b$ & $th$ & $wh$ & $h$ & $t$ & $?+wh$ & $w$ \\ |
454 |
|
|
455 |
- private key: A list of random numbers `$(R_0,...,R_k)$`. |
- private key: A list of random numbers `$(R_0,...,R_k)$`. |
456 |
|
|
457 |
- public key: Compute `$P_0=H^{k2^n}(R_0)$`, and |
- public key: Compute `$P_0=H^{k(2^n-1)}(R_0)$`, and |
458 |
`$P_i=H^{2^n}(R_i)$` for `$i>0$`. The hash of |
`$P_i=H^{2^n-1}(R_i)$` for `$i>0$`. The hash of |
459 |
`$(P_0,...,P_k)$` is the public key. |
`$(P_0,...,P_k)$` is the public key. |
460 |
|
|
461 |
Needs `$2k2^n + 1$` hash function invocations. |
Needs `$2k(2^n-1) + 1$` hash function invocations. |
462 |
|
|
463 |
- signature: Split the `$b$`-bit message into `$k$` |
- signature: Split the `$b$`-bit message into `$k$` |
464 |
parts of `$n$` bits each. Interpreted each part |
parts of `$n$` bits each. Interpreted each part |
465 |
as an integer `$k_i$` for `$0 < i \\le k$`. |
as an integer `$k_i$` for `$0 < i \\le k$`. |
466 |
Compute `$S_i=H^{k_i}(R_i)$` for `$i>0$` |
Compute `$S_i=H^{k_i}(R_i)$` for `$i>0$` |
467 |
and `$S_0=H^{2^nk-\\sum{k_i}}(R_0)$`. The tuple |
and `$S_0=H^{(2^n-1)k-\\sum{k_i}}(R_0)$`. The tuple |
468 |
`$(S_0,...,S_k)$` is the signature. |
`$(S_0,...,S_k)$` is the signature. |
469 |
|
|
470 |
Signing requires `$k2^n$` invocations |
Signing requires `$k(2^n-1)$` invocations |
471 |
of the hash function. |
of the hash function. |
472 |
|
|
473 |
- verification: Compute `$k_i$` as above. |
- verification: Compute `$k_i$` as above. |
474 |
Compute `$V_0=H^{\\sum{k_i}}(S_0)$` |
Compute `$V_0=H^{\\sum{k_i}}(S_0)$` |
475 |
and `$V_i=H^{2^n-k_i}(S_i)$` for `$i>0$`. |
and `$V_i=H^{2^n-1-k_i}(S_i)$` for `$i>0$`. |
476 |
Check that the hash of `$(V_0,...,V_i)$` |
Check that the hash of `$(V_0,...,V_i)$` |
477 |
equals the public key. |
equals the public key. |
478 |
|
|
479 |
Verification requires `$k2^n + 1$` invocations |
Verification requires `$k(2^n-1) + 1$` invocations |
480 |
of the hash function. |
of the hash function. |
481 |
|
|
482 |
Octuplet: `$(1, b, \\frac{bh}{n}+h, h, h, |
Octuplet: `$(1, b, kh + h, h, h, |
483 |
2\\frac{b}{n}(2^n-1)+1, \\frac{b}{n}(2^n-1)+1, |
2k(2^n-1)+1, k(2^n-1)+1, k(2^n-1)+1)$` |
|
\\frac{b}{n}(2^n-1)+1)$` |
|
484 |
|
|
485 |
|
|
486 |
BiBa |
BiBa |