# Generalized Merkle Signatures, SHA-3 and Sakura

Sakura specifies a tree hash mode for e.g. Keccak (SHA-3). Are there any reasons to use the Sakura tree hash mode in a Generalized Merkle Signature Scheme? It seems to me Sakura primarily solves a uniqueness problem with using tree hashes for large data when the depth of the tree is variable.

Trivially, if Sakura mode is not used and the depth $d$ tree-hash of data $M = M_0|M_1|...|M_{n-1}$ is $D$, then the depth $d-1$ tree hash of data $M'$ (where $M'_0 = f(M_0)|f(M_1)$ etc) is also $D$. If Sakura is used, such trivial collisions will be impossible.

This problem doesn't seem to exist in GMSS, considering that the leaf-nodes consist of OTS public keys and not plain text fragments.

• Even if such collision was possible for a GMSS, there was still the problem to retrieve the OTS private keys... Why do you say that this problem doesn't exist for a Merkle signature ? – Dingo13 Jul 17 '14 at 22:05
• @Dingo13: The problem with recovering the OTS private keys, seems to make it infeasible for an adversary to produce an existential forgery from a GMSS signature, even if the depth parameter might be altered. – Henrick Hellström Jul 17 '14 at 22:29
• That seems exact from a unforgeability standpoint. My question is useless. – Dingo13 Jul 18 '14 at 14:24