1
$\begingroup$

I happened to watch Mr. Bill Buchanan lecture that explains Winternitz one time signature scheme (https://www.youtube.com/watch?v=eqMMlcN4zSc). The scheme shown in the lecture is susceptible to universal forgery, as if an Opponent query for OTS on a message composed of 32 0xFF octets, he gets back Hash(prive[i]) for i=1..32, and with this, he can sign any desired message. I understand that there should be added a checksum to prevent this attack, and my question is ;

  • whether the checksum: 0xFFFF-SUM(N[i]) i=1...32 will solve the problem?

The idea is that any octet in the message that is modified to be lower than 0xFF, will cause at least one byte in the checksum to increment, and thus will require the Opponent to inverse a one way hash function.

Improve this question
$\endgroup$
0

1 Answer 1

Reset to default
3
$\begingroup$

whether the checksum: 0xFFFF-SUM(N[i]) i=1...32 will solve the problem?

Yes, it does. That's exactly how both WOTS+ in XMSS and LM-OTS in LMS work

Improve this answer
$\endgroup$
1
  • $\begingroup$ And another question related to the same subject. In this lecture, the signature for octet [i] of the message, which is N[i], is calculated by applying secure hash function (256-N[i]) times on the private key PRIVE[i]. Would that make a difference if instead of the above, one would calculate the signature by applying the hash function N[i] times, and during hash verification, the verifier would operate it (255-N[i]) additional times? $\endgroup$
    – Evgeni Vaknin
    Jan 26, 2020 at 12:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.