Timeline for NIST PQC: minimum number of digital signatures
Current License: CC BY-SA 4.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 16, 2023 at 15:30 | comment | added | lamba | Even for stateless signatures, their security would degrade if "unlimited number" of signature queries are allowed. For example, LWE is secure if polynomial number (not unlimited) of independent samples in the security parameter are queried. Something similar holds for MPC in the Head signatures. For example, see Theorem 4 of eprint.iacr.org/2022/1645.pdf, $q_S$ is the number of signature queries and the probability of forgery is bounded by this value. | |
| Dec 15, 2023 at 13:47 | comment | added | poncho | "I've read that it uses a few-time signature scheme and thus drew the conclusion that, despite being stateless, there is a max. number of signatures that can be generated with SPHINCS+"; Sphincs+ can generate an unlimited number of signatures. There is a reduction in security if the attacker can see more than $2^{64}$ of them - however, the NIST call specifically states that we will assume that the attack can see no more than that... | |
| S Dec 15, 2023 at 12:20 | review | First answers | |||
| Dec 15, 2023 at 15:13 | |||||
| S Dec 15, 2023 at 12:20 | history | answered | radix | CC BY-SA 4.0 |