Iterative hashing of a private random seed can yield keys for use in HMAC, which if revealed publicly in reverse order and on predetermined schedule, can be used in a manner similar to other asymmetric key signing protocols, where released intermediate key authenticity is verifiable in terms of its relationship to the first released (last in chain) key. The seed is like a private key, and the last of the chain (first released) is like the public key. Useful elaborations are possible, e.g. converting the chain into a branched hierarchy for delegation purposes.

This can't be a new idea. Is it? Does anyone know of existing work on this, either in the journals or in the wild?

This link restates the above with more detail, some diagrams, and a few elaborations: http://ben.mord.io/p/delayed-chained-key-revelation-dckr.html

  • $\begingroup$ Signatures are used for authentication and non-repudiation. This seems to be targeting the latter. But if you release the private key that is used to generate the signature as public key to verify the signature then anybody can generate that signature. Using a time stamping service seems a better approach (unless I'm missing the goal of this idea, which doesn't seem to be stated in the question). $\endgroup$
    – Maarten Bodewes
    Commented Nov 20, 2017 at 21:42
  • $\begingroup$ Hi Maarten, the release schedule is determined in advance precisely to prevent forgery. Only the signer knows a key prior to expiration. To be sure, everyone knows it after expiration - but the protocol considers signatures to signify nothing if first observed after expiration. $\endgroup$ Commented Nov 20, 2017 at 23:13
  • $\begingroup$ I see no distinction here between non-repudiation and authentication. A signed session key for example could be used for authentication of a session, if one so desired. $\endgroup$ Commented Nov 20, 2017 at 23:20

1 Answer 1


That sounds like Tesla, which also uses a chain of MACs (where each key can be computed from values later in the chain), revealing the previous MAC key with each packet. Going through the paper, I don't see how they authenticate the last value; my recollection was that they used a conventional signature scheme.

  • $\begingroup$ Thanks, that looks related if not identical to chained concept. I'll read carefully to confirm. (I see no concept of hierarchy however, only chaining.) $\endgroup$ Commented Nov 20, 2017 at 23:21
  • 1
    $\begingroup$ I discussed with the author of Tesla, and he agrees. Moreover, he informs me it may get use in 2018 to authenticate European navigation satellite signals. Thank you for the pointer! phys.org/news/2017-02-technique-falsification-galileo.html $\endgroup$ Commented Dec 24, 2017 at 3:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.