Questions tagged [hash-signature]

Hash-based digital signatures, such as Lamport one-time signatures, are digital signature schemes based on a (non-trapdoor) one-way function such as a cryptographic hash. Such schemes are expected to remain secure even against attacks using quantum computers.

Filter by
Sorted by
Tagged with
1
vote
1answer
559 views

What are the advantages and disadvantages of Merkle signatures over Lamport signatures?

I know they are both hash-based and post-quantum secure, and that Lamport signatures can form the basis for a Merkle scheme, but what do you actually gain over standard Lamport signatures by doing ...
2
votes
2answers
220 views

Blind Hash Signatures?

Is it possible to implement blind signatures with purely hash-based signature algorithms? Any whitepapers, code samples, etc on the subject would be helpful.
3
votes
1answer
586 views

How to use SPHINCS+?

Based on the NIST submission it looks like the SPHINCS+-256s algorithm comes in at public key sizes of 64 bytes, private key sizes of 128 bytes, and signature sizes ...
6
votes
1answer
622 views

Difference Between Gravity-SPHINCS and SPHINCS+?

What are the differences between Gravity-SPHINCS and SPHINCS+ from security and practicality standpoints? Are they just different implementations of the underlying SPHINCS algorithms or are they ...
2
votes
1answer
263 views

What is a formal definition of strong one-time-secure signatures?

What is a formal definition of strong one-time-secure signatures? I know the Lamport's scheme is one of them, but what is the global definition of it?
0
votes
1answer
112 views

Sequential delayed release of chained HMAC keys for use as asymmetric signature

Iterative hashing of a private random seed can yield keys for use in HMAC, which if revealed publicly in reverse order and on predetermined schedule, can be used in a manner similar to other ...
3
votes
1answer
881 views

Winternitz One time signature security

There are two versions of Winternitz-One time signature scheme, $W-OTS$ and $W-OTS^+$ Security of both is as following $W-OTS$ is strongly unforgeable under chosen message attacks if $F$ is a ...
3
votes
2answers
754 views

Winternitz hash based signature signing and verification

In Winternitz hash based signature There are two functions $f: \{0,1\}^n \to \{0,1 \}^n$, a one way function and $g: \{0,1\}^* \to \{0,1 \}^n$, cryptographic hash function Key Generation steps ...
8
votes
2answers
2k views

Why don't crypto-currencies use the Lamport signature scheme?

The Lamport signature scheme is faster, less complex and considerably safer than ECDSA. It's only downside - being only usable once - isn't really a downside when signing transactions, since you could ...
4
votes
1answer
423 views

Does still make sense to use SHA1?

I'm working with Arduino and hash-based signatures which are signature schemes that use only hash functions. Due to the constraints of an Arduino I was thinking about using SHA1 as the underlying ...
3
votes
1answer
522 views

How can I generate reasonably short temporary unlock codes?

I need a way to generate temporary unlock codes for an application to use when it can't go online to confirm that its activation subscription is still current. The application needs to able go ...
6
votes
2answers
155 views

Is there a signature scheme which doesn't rely on the difficulty of factoring/dlp which generates short signatures?

The Lamport signature scheme, for example, doesn't rely on the difficulty of any problem and it only depends on the existence of one-way functions. Is there an alternative scheme which also doesn't ...
3
votes
1answer
138 views

Why are the bit lengths of keys and digests equal in Lamport signatures?

In Lamport's one time signature scheme: One way function to convert a pseudo random number private key to a public key takes $\{0,1\}^n$ and returns $\{0,1\}^n$. Cryptographic hash function to ...
1
vote
2answers
884 views

Merkle signature scheme

I was browsing the Wikipedia article on Merkle signature schemes and noted that it says: The number of possible messages must be a power of two[…] Why is that? ...
6
votes
1answer
280 views

Choice of the one-way function (OWF) for Lamport signatures

I am studying the Lamport signature scheme, and I found that in many sources (eg: Hash-based Digital Signature Schemes) the input and output bitstring of the OWF and the message digest have the same ...
0
votes
1answer
184 views

Fast Forward Hash Signatures

As a follow up to the Q/A session: Small Quantum Signatures - Reality check needed I have implemented the discussed idea for a new short-quantum-safe signature system using fast-forwarding hash. It ...
11
votes
3answers
3k views

One-time digital signatures

Are there digital signatures for which, given two documents signed by the same key, one could derive the key? With such one-time signatures, one may be able to design a cryptocurrency based on proof-...
4
votes
2answers
249 views

Small Quantum Signatures - Reality check needed

I've been thinking a bit lately about how to get quantum resistant signatures fast and (relatively) small. One idea I've been keen on exploring is finding a crypto PRNG that allows fast-forwarding, e....
8
votes
3answers
2k views

Stateless hash based public key cryptography?

Merkle-Winternitz signatures based on fractal hash trees are an attractive alternative to other post-quantum cryptographic schemes, in particular since they are conceptually simple, the security ...
10
votes
3answers
4k views

Lamport signature: How many signatures are needed to forge a signature?

Lamport signature: Signing the message Note that now Alice's private key is used and should never be used again. The other 256 random numbers that she did not use for the signature she must never ...
2
votes
1answer
800 views

Hash collision resistance requirements for Lamport signatures

According to the original paper, Lamport one-time signature scheme uses two one-way functions: $F$ and $G$. The former one, $F$, is used to create a public key by hashing elements of the private key (...
2
votes
1answer
1k views

Is ed25519 a “hash signature”

Writing my last question, I saw the hash-signature tag. I tried to research it best I could, but I'm simply overwhelmed in this field. I don't think it means to simply hash data before signing, but ...
1
vote
1answer
226 views

Merkle Signature Generation

In the section 2 (page 42) of the book "Post Quantum Cryptography", it says: Then he generates the one-time signature $\sigma_{\text{OTS}}$ of the digest using the $s$-th one-time signature key $...
6
votes
3answers
895 views

Can one use a Cryptographic Accumulator to efficiently store Lamport public keys without the need of a Merkle Tree?

One of the problems of one-time Lamport signatures is that public keys are disposed after use, so you must generate many keys and store them in a Merkle tree. The root is the "real" public key and ...
2
votes
1answer
571 views

What is a Trapdoor in Merkle Signature?

Merkle signature (pag. 40) use than public key (verification key) the root of the Merkle Tree and than private key (to sign) the set of pre-images of the $g(Y_i)$ where $Y_i$ is the verification key ...
3
votes
1answer
1k views

Quantum resistance of Lamport signatures

The Lamport-Diffie signature scheme is said to be quantum-resistant. Why is that? What would a quantum attempt to attack this signature scheme look like, and how does it fail?
1
vote
2answers
181 views

Lamport-Diffie + attempting to invert OWF

I am studying Lamport-Diffie signature scheme and in my lecture present the follow algorithm for attempting to invert the one way function $f$, where $f$ is used to compute the public key of this ...
1
vote
1answer
605 views

Lamport-Diffie + Security Proof

I am studying Lamport-Diffie signature scheme. In the lecture present the algorithm $A'$ for attempting to invert the one way function $f$, where $f$ is used to compute the public key. My question is ...

1
2