The Winternitz scheme is typically cited as being an OTS scheme. Can it also be used as a one-time encryption scheme?

If it can be used as a one-time encryption scheme, then is it possible to easily convert it into a many-time encryption scheme that uses either a single key or different keys that may be generated in some deterministic way from a single key i.e. only a single key needs to be stored and cyphertexts provide some sort of IV to allow the appropriate key for that cyphertext to be generated and decrypted?


Can it also be used as a one-time encryption scheme?

You cannot build asymmetric encryption from just hash functions. There is an impossibility proof for that. So for asymmetric encryption the answer is no. See Merkle Puzzles are Optimal - Boaz Barak, Mohammad Mahmoody-Ghidary for the proof.

For symmetric encryption, you can simply use the hash function directly to build encryption, no need to bother with Winternitz.

But you could use quantum-key-exchange together with hash based signatures to achieve something similar to asymmetric encryption.

Concerning many-time signatures

It's straight forward to build stateful many-time signatures from one-time signatures. Just create as many one time keys you need, compute a hash tree over their public keys and public its root. The hash tree allows you to efficiently prove what the nths public key is and proceed with the one-time signature form there.

But if you don't want to keep track of which one-time signatures you already used, you need a stateless many-time signature. It is possible to build stateless hash signatures, but it's a bit trickier. SPHINCS is a recent example.

  • $\begingroup$ Ah, yes I didn't realise that it was a hash function. Are there any examples of symmetric encryption schemes that are built with hashes as you have mentioned? $\endgroup$
    – petro444
    May 1 '15 at 23:39
  • $\begingroup$ @petro444 You can use hashes in CTR mode, but for most hashes that will have bad performance, since they're optimized for consuming data, not for outputting data. Salsa20 and ChaCha are stream ciphers built with a hash at their core. $\endgroup$ May 2 '15 at 0:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.