Sign up ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

The Winternitz scheme is typically cited as being an OTS scheme. Can it also be used as a one-time encryption scheme?

If it can be used as a one-time encryption scheme, then is it possible to easily convert it into a many-time encryption scheme that uses either a single key or different keys that may be generated in some deterministic way from a single key i.e. only a single key needs to be stored and cyphertexts provide some sort of IV to allow the appropriate key for that cyphertext to be generated and decrypted?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Can it also be used as a one-time encryption scheme?

You cannot build asymmetric encryption from just hash functions. There is an impossibility proof for that. So for asymmetric encryption the answer is no.

For symmetric encryption, you can simply use the hash function directly to build encryption, no need to bother with Winternitz.

But you could use quantum-key-exchange together with hash based signatures to achieve something similar to asymmetric encryption.

Concerning many-time signatures

It's straight forward to build stateful many-time signatures from one-time signatures. Just create as many one time keys you need, compute a hash tree over their public keys and public its root. The hash tree allows you to efficiently prove what the nths public key is and proceed with the one-time signature form there.

But if you don't want to keep track of which one-time signatures you already used, you need a stateless many-time signature. It is possible to build stateless hash signatures, but it's a bit trickier. SPHINX is a recent example.

share|improve this answer
Unfortunately I can't find the paper with the impossibility proof. – CodesInChaos May 1 at 13:05
Ah, yes I didn't realise that it was a hash function. Are there any examples of symmetric encryption schemes that are built with hashes as you have mentioned? – petro444 May 1 at 23:39
@petro444 You can use hashes in CTR mode, but for most hashes that will have bad performance, since they're optimized for consuming data, not for outputting data. Salsa20 and ChaCha are stream ciphers built with a hash at their core. – CodesInChaos May 2 at 0:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.