The Lamport signature scheme is faster, less complex and considerably safer than ECDSA. It's only downside - being only usable once - isn't really a downside when signing transactions, since you could just include your next public key whenever signing it. Why isn't, thus, the Lamport signature scheme used in crypto currencies such as Bitcoin?
The major issue will be size difference. The size of ECDSA in bitcoin is much less than the Lamport Signature.
For ECDSA in bitcoin
- The public key is only 33 Bytes (1 byte for prefix, and 32 bytes for 256-bit integer x)
- Signature is at maximum 73 bytes
Whereas in Lamport Signature
- The public key is 512 numbers of 256-bit (total of 16KB)
- The Signature is 256 number of 256-bit (total of 8KB)
The size of Lamport public key and signature together is 231 times (106 bytes vs 24KB) more than the ECDSA public key and signature.
The public key and signature form part of each bitcoin transaction and are stored in block chain. So use of Lamport Signature will need 231 times more storage than ECDSA. As of 1 Oct 2017, the Blockchain size is approximately 135GB. Had it been the Lamport Signature, this would have been in TeraBytes. This would have resulted in higher storage and bandwidth requirement, less number of transactions in one block(which may create backlog, as one block is committed in 10 minutes) and more time in blockchain propagation to other nodes.
Moreover, In bitcoin each transaction is charged a network fee based upon transaction size(in terms of bytes, not in terms of amount). At the moment, the network fee rate is 178, 149, 120 satoshi / byte for high, medium and low priority respectively.
I know this question is really old, but you should look into IOTA (iota.org), they use Winternitz one time signature instead of ECDSA. There's also a paper about Winternitz OTS here: http://eprint.iacr.org/2011/191.pdf