I happened to watch Mr. Bill Buchanan lecture that explains Winternitz one time signature scheme (https://www.youtube.com/watch?v=eqMMlcN4zSc). The scheme shown in the lecture is susceptible to universal forgery, as if an Opponent query for OTS on a message composed of 32 0xFF octets, he gets back Hash(prive[i]) for i=1..32, and with this, he can sign any desired message. I understand that there should be added a checksum to prevent this attack, and my question is ;
- whether the checksum: 0xFFFF-SUM(N[i]) i=1...32 will solve the problem?
The idea is that any octet in the message that is modified to be lower than 0xFF, will cause at least one byte in the checksum to increment, and thus will require the Opponent to inverse a one way hash function.