1
$\begingroup$

When it comes to stateful schemes, would you really need to use a Merkle tree?

Couldn't you sign the hash of the message concatenated to the hash of the new public key?

New public key: hash(hash(message) || hash(WOTS+/lamport public key))

Then for every new signature you include the previous signature(s) (without the messages).

Is the only downside of this the growing signature size or is there a security fault?

Improve this question
$\endgroup$
2
  • $\begingroup$ There is a sort of security leak in that you must attach the hashes for all previously-signed files to any new signature. (But also, yeah, a signature that grows like that is horrendous outside of an academic context.) $\endgroup$
    – JamesTheAwesomeDude
    Jun 23, 2022 at 15:29
  • $\begingroup$ (Possible mitigation to this leak: salting messages before you sign them) $\endgroup$
    – JamesTheAwesomeDude
    Jun 23, 2022 at 15:31

1 Answer 1

Reset to default
-3
$\begingroup$

This is how stealth addresses are generated in Haircomb, you hash garbage values together with existing public key, to get a new public key. The garbage values have a specific format, that is of liquidity stack which pays 0 coins to the garbage address.

It isn't really a signature scheme, but rather a commit-reveal commitment scheme.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.