I was reviewing WOTS+ scheme for consideration in our private blockchain, and noticed that it had a small overhead of calculating a checksum as seen in the following pseudocode excerpt from the SPHINCS+ submission to NIST
wots_sign(M, SK.seed, PK.seed, ADRS) {
csum = 0;
// convert message to base w
msg = base_w(M, w, len_1);
// **compute checksum** <<<<============
for ( i = 0; i < len_1; i++ ) {
csum = csum + w - 1 - msg[i];
}
// convert csum to base w
csum = csum << ( 8 - ( ( len_2 * lg(w) ) % 8 ));
len_2_bytes = ceil( ( len_2 * lg(w) ) / 8 );
msg = msg || base_w(toByte(csum, len_2_bytes), w, len_2);
for ( i = 0; i < len; i++ ) {
ADRS.setChainAddress(i);
sk = PRF(SK.seed, ADRS);
sig[i] = chain(sk, 0, msg[i], PK.seed, ADRS);
}
return sig;
}
//Algorithm 5: wots_sign – Generating a WOTS+ signature on a message M.
Why is it there? Is it necessary for the security of the scheme?
Update
According to "On the Security of the Winternitz One-Time Signature Scheme", the checksum deters "second-key" and "key-collision" attack should there be a functional forgery oracle. How relevant an attack is it to WOTS+ and to other regular signature schemes?