1
$\begingroup$

I know they are both hash-based and post-quantum secure, and that Lamport signatures can form the basis for a Merkle scheme, but what do you actually gain over standard Lamport signatures by doing this? To put it another way, since Merkle signatures make use of another one-time signature scheme, why would someone use Merkle signatures when they have a perfectly fine one-time signature already?

$\endgroup$
2
$\begingroup$

why would someone use Merkle signatures when they have a perfectly fine one-time signature already?

Because Merkle signatures are not one-time. Instead, you can use a private key to sign a number of messages. There is a finite limit, however that limit is potentially large.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.