This is a concrete instantiation of Rabin-Williams signatures.
- The private key is 2 primes $p, q$.
- The public key is their product $N = pq$ and is approximately 3072 bits long.
- the hash function is Skein-512 with 3072 + 512 = 3584 bits output (Skein allows arbitrary output lengths).
- The padding scheme is deterministic full-domain-hashing, using the 3072 low-order bits of the Skein output.
- The two high-order bits of the Skein output, which are not otherwise used, are used to select which of the four square roots to output.
Example applications are CA signatures and distribution package manager signatures where signature verification speed is critical.
- Is Rabin-Williams with 3072 bit keys faster or slower to verify than EdDSA?
- Is the scheme I gave secure? I think that it is an instantiation of a scheme that was proven secure in the random oracle model by Bernstein in this paper. While Skein is less used than other secure hash algorithms, it was an SHA-3 finalist and underwent a substantial amount of cryptanalysis.