Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I refer to the LM-OTS specification in RFC8554.
It seems that after having hashed all the chains, including the checksum’s ones, the signature is essentially the concatenation of the hash results.
Apparently one can make the signature much shorter, by hashing the above again. Boneh and Shoup define Winternitz signatures in this way. Why the RFC doesn't?
Apparently one can make the signature much shorter, by hashing the above again. Boneh and Shoup define Winternitz signatures in this way
No, Bohen and Shoup do not; their Winternitz signature is a concatination of the hashes. This can be seen as the output of their $S(sk, m)$ algorithm on page 591 of version 0.5 of their book - the signature they generate is $(\sigma_1, ..., \sigma_n)$, that is, the concatination of the intermediate hashes $\sigma_1, ..., \sigma_n$
If you do generate a signature which is the hash of the intermediate hashes, it is not clear how the verification process is supposed to work. The procedure that Boneh and Shoup propose (which is what LM-OTS does) starts with the intermediate hashes $\sigma_1, ..., \sigma_n$, and follow the hash chains upwards to the tops of the Winternitz chains $y_1, ..., y_n$. It is not clear how one can rederive $y_1, ..., y_n$ given only $H(\sigma_1, ..., \sigma_n)$
Now, the public key they use is, in fact, the hash of all the tops of the chains $H( y_1, ..., y_n)$, and hence the public key is short. LM-OTS also follows this.
