Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am studying Merkle tree signature. Let $\sigma=(s,Y_s,\sigma_{\text{OTS}},As)$ be a signature of certain document. Here $s$ is the index of leaf, $Y_s$ is the respectively OTS public key and $A_s$ is the authentication path. My questions are:

1) Is there any attack where an adversary changes part of the signature $\sigma$? (For example suppose the adversary changes $\sigma_{\text{OTS}}$ to $\sigma^{*}_{\text{OTS}}$ for her or his convenience).

2) If that attack exist what is the name of that attack?

share|improve this question
If there were such an attack, it would be called a forgery. The part of the reasoning behind Merkle is that there is no computationally feasible way for doing that. BTW: there's no particular need for a Merkle signature to explicitly include the OTS public key; the verifier can compute the required public key (from the hash and $\sigma_{OTS}$, and then validate that computed public key using the authentication path. – poncho May 25 '15 at 3:25
@poncho according the postquantum cryptography book of Sendried and et al. it is necessary $Y_s$ in the Merkle signature. Could you explain me please how retrieve $Y_s$ using $\sigma_{\text{OTS}}$ and the hash? – juaninf May 25 '15 at 3:33
You take the OTS signature and the hash of the message; you compute the forward hash of the OTS signature (according to the bits of the message hash); that gives you an (unauthenticated) value of $Y_s$. You then validate that value of $Y_s$ by computing up the authentication path; if you get the top level hash value, the signature verifies. – poncho May 25 '15 at 5:05
@poncho Before, $Y_s$ be validated, first needs validation with $X_s$. Then I think that it is necessary ... – juaninf May 25 '15 at 10:27
$X_s$? What is $X_s$ is the notation you're using? – poncho May 25 '15 at 13:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.