0
$\begingroup$

I read that XMSS generates many private keys and one key must sign only one message. Does it mean though that I sign many different messages, or do I sign one message, which, if its longer than 256bit, will be split into two parts and the 2nd part will be signed with the 2nd private key? Is the signature only meant to sign one message and its parts, or many different messages?

What is the maximal length of the message? XMSS computes 2^h keys, where h is the height, usually of value 20, does it mean I can only sign 2^20 messages or a message with 2^20 parts?

$\endgroup$

1 Answer 1

1
$\begingroup$

Does it mean though that I sign many different messages, or do I sign one message, which, if its longer than 256bit, will be split into two parts and the 2nd part will be signed with the 2nd private key?

You can sign many ($2^h$) different messages; it does what just about any other signature algorithm does; it hashes the initial message, and then signs the hash. If you're using SHA-256 or SHAKE-128 as your hash function, then this hash is 256 bits, which is what is signed by a single WOTS+ private key.

Now, XMSS is a bit different than most other signature schemes; it stirs in some unpredictable data at the front of the message when it computes this hash (and includes this unpredictable message in with the signature) - it does this to prevent collision attacks from working (an adversary who picks the message to be signed cannot predict this unpredictable data, hence he cannot pregenerate a collision) - it does this because everywhere else, XMSS depends on the (second) preimage resistance of the hash function, and it would be a shame if it made a stronger security assumption on the hash function for the initial message hash.

What is the maximal length of the message?

If you're using SHA-256, this would be not quite $2^{61}$ bytes; if you're using SHAKE-128, there is no upper bound.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.