Lamport signature: Signing the message Note that now Alice's private key is used and should never be used again. The other 256 random numbers that she did not use for the signature she must never publish or use. Preferably she should delete them; otherwise, others gaining access to them would later be able to create false signatures.
If Lamport's signature scheme would be used incorrectly, say you would use it more than once. How many signatures of distinct messages would you need to forge a signature?
I'm thinking if you have one signature and then the "opposite" message (not really message but the message's hash sum) so every 0 in the first message is a 1 and 1 is 0. If you had those two signatures you would have everything you needed from Alice's private key.
But that's probably not realistic to think that you get exactly those two messages. Is there some general formula for how many signatures you would need?