Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In Merkle Signature, it also requires one-time signature to be used once for a message. The signature in Merkle scheme is even longer compared to Lamport one time signature. The verifier also has more work to do.

Hence, what is the advantages of Merkle compared the one-time (Lamport) signature?

share|improve this question
Merkle signatures are not limited to being one-time. $\;$ – Ricky Demer May 11 '14 at 3:54
So one-time key pairs can be used to signed for different (multiple)-message? In this report:…. The author told there are only limited number of messages that can be encrypted. This number equals to the number of key pairs. – user13493 May 11 '14 at 4:17
Perhaps I should expand on my previous comment: Merkle signatures can securely be used on more than one message. $\:$ Although one-time key-pairs can be used more than once, such use usually allows easy forgeries. $\;\;\;\;$ – Ricky Demer May 11 '14 at 5:08
So could I understand that it provide no significant advantage toward one-time signature? – user13493 May 11 '14 at 6:25
Of course it does: Only a single message can ever be securely signed under the public key of an OTS. In contrast, many messages can be signed under the public key of the Merkle scheme without compromising security. – Maeher May 11 '14 at 16:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.