1
$\begingroup$

I know they are both hash-based and post-quantum secure, and that Lamport signatures can form the basis for a Merkle scheme, but what do you actually gain over standard Lamport signatures by doing this? To put it another way, since Merkle signatures make use of another one-time signature scheme, why would someone use Merkle signatures when they have a perfectly fine one-time signature already?

$\endgroup$
2
$\begingroup$

why would someone use Merkle signatures when they have a perfectly fine one-time signature already?

Because Merkle signatures are not one-time. Instead, you can use a private key to sign a number of messages. There is a finite limit, however that limit is potentially large.

$\endgroup$
2
  • $\begingroup$ Would I be correct in my understanding that Merkle trees are, in fact, how one would squeeze multiple signatures out of one (initial) Lamport key? $\endgroup$ – JamesTheAwesomeDude May 19 at 19:25
  • $\begingroup$ @JamesTheAwesomeDude: certainly, they're one way, but not the only one. An alternative way (assuming that the receiver will get all the signatures) is chaining; we include the next public key in the one time signature (and send that next public key as well). $\endgroup$ – poncho May 19 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.