2
$\begingroup$

I'm sure I've missed something super trivial, but why are WOTS-type schemes one-time? I've been looking into hash-based schemes, and I feel like I understand WOTS quite well (specifically I have looked at WOTS+), but I cannot figure out why WOTS would not be safe to use just a few times as an FTS such as HORS(T) for example?

$\endgroup$
1
$\begingroup$

I'll only talk about things on a very high level here, probably much higher than what you already know and will use Matthew Green's blog post as the primary reference. Nevertheless the idea should come across.

So in that post, WOTS is described as a smart way to have more than two (0 and 1) lists of of secret key values to publish as the signature. Now what you do is that for each symbol (eg byte), you publish one entry from these lists (in a smart way). But if you do this twice for different message which differ in at least 2 bytes, you can take one byte from the one and one byte from the other signature to forge a new signature! Also note that (as far as I can tell), it's usually not assumed for this kind of signature scheme to mandate hashing the input and only passing the hash to the signature primitive.

$\endgroup$
  • $\begingroup$ Sorry for not responding sooner. I think your explanation flipped the proper switches in my brain. Seems to make sense now :) $\endgroup$ – user3231247 May 26 '18 at 12:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.