Just read about W-OTS. Since the signature is the private key hashed 256-N times, is it trivial to forge a signature with a smaller value for $N$ when having access to original signature? I.e. just hash it one more time and it represents 9-1, etc.


1 Answer 1


W-OTS has a checksum that ensures that kind of attack doesn't work.

In essence, the checksum is the sum of the value of every other component subtracted, so that if you hash one component one more time, you need to find a pre-image of a component of the checksum.

Basically, it looks a bit like this:

[ - | - | - | down | checksum up ]

Related: https://crypto.stackexchange.com/a/63903/36960


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.