Questions tagged [one-time-signature]
a digital signature scheme that can be used to sign one message per key pair
21
questions
1
vote
1
answer
55
views
What happens when a Merkle Tree OTS scheme runs out of keys
A Merkle Tree OTS scheme such as XMSS pregenerates 2^h keys that are tied to 1 public key
When the 2^h keys run out, does all the 2^h keys get removed/deleted and the device pregenerates another new 2^...
- 13
3
votes
1
answer
623
views
What is "one-time signature"
I'm studying the post-quantum cryptography (PQC).
While studying hash-based pqc, I read a thesis about Winternitz one-time signature scheme (W-OTS). What is the exact definition of "One-time ...
- 31
1
vote
1
answer
228
views
How does signing with FORS work in SPHINCS+?
I was reading the SPHINCS+ paper and got confused in the signing with FORS (forest of random subsets) part.
I understand how we can sign a message using FORS but I couldn't understand how we choose ...
- 23
1
vote
1
answer
121
views
Stateful hash signature without Merkle trees
When it comes to stateful schemes, would you really need to use a Merkle tree?
Couldn't you sign the hash of the message concatenated to the hash of the new public key?
New public key: hash(hash(...
- 33
1
vote
1
answer
137
views
Why do we need both bitmasks and keyed hash in SPHINCS+
I think one of them is related to multitarget attacks and the other is related to collision attacks. But I cannot find how hash based crypto related to hash collisions.
1-) Consider the following ...
- 153
1
vote
0
answers
91
views
Hashing Public Key of Lamport or Winternitz OTS
For the Lamport or Winternitz public keys, couldn't one just hash down the large public key to 256 bits in order to greatly reduce the public key size while still having basically the same security? ...
- 11
2
votes
0
answers
94
views
Is it more, or less, secure to use a different $F$ and $G$ for a Lamport signature?
A Lamport signature is made as follows:
Alice stores $k_1, \cdots, k_{n'} \leftarrow K $ as her "private key", with one-way function $F: K\to V$, $n'>n$, and (easily enough) all $F(k_i)\...
2
votes
2
answers
131
views
Can we place the WOTS scheme into a Merkle tree structure?
In post-quantum signature schemes that are (to put it simply) built out of merkle trees, they usually employ some sort of OTS scheme on the very bottom leaves. I.e WOTS Winternitz scheme.
A ...
- 1,443
3
votes
1
answer
106
views
How can a collision attack using MD5 be used to break WOTS
It is stated in
Winternitz One time signature security that MD5 is not safe for Winternitz due to collision attack. Given that WOTS generates multiple, say 32 private keys then hashing them a number ...
- 237
2
votes
1
answer
221
views
Chaining one-time signatures
To introduce the notation for the question, consider a one-time signature algorithm:
There are a private signing key $sk$ and a corresponding public key $pk$, generated by $Gen(seed)$.
To sign a ...
- 129
1
vote
1
answer
283
views
Winternitz One Time Signature
I happened to watch Mr. Bill Buchanan lecture that explains Winternitz one time signature scheme (https://www.youtube.com/watch?v=eqMMlcN4zSc). The scheme shown in the lecture is susceptible to ...
- 1,066
11
votes
2
answers
3k
views
Advantages and disadvantages of hash-based signatures
We know hash-based signatures (Winternitz signature, HORS(T) signature) that are quantum-safe and efficient. They can be stateful or stateless, one-time or multiple-time. But why are they not widely ...
- 367
2
votes
1
answer
73
views
W-OTS+ one-wayness property
I am reading the "W-OTS⁺ – Shorter Signatures for Hash-Based Signature Schemes," by Andreas Hülsing, and I am stuck in understanding the success probability of an adversary, $\mathcal A$, against the ...
- 177
1
vote
1
answer
312
views
Signing a message using SPHINCS Hash-based Signature scheme
I have questions on “SPHINCS: practical stateless has-based signature” by Bernstein et al. And I really hope that someone can help me with it.
To help me understand it, I read the https://...
- 177
0
votes
1
answer
161
views
Security level in HORS signature scheme
I was reading the HORS One-Time-Signature scheme by Reyzin & Rezyin, but I could not understand how they derived their security equation $(rk⁄t)^k$. I understand that the total number of balls is $...
- 177
0
votes
1
answer
67
views
In W-OTS, is it trivial to forge smaller N values?
Just read about W-OTS. Since the signature is the private key hashed 256-N times, is it trivial to forge a signature with a smaller value for $N$ when having access to original signature? I.e. just ...
- 15
4
votes
1
answer
411
views
SPHINCS and HORST: can we sign the same message twice?
I was reading about SPHINCS which uses layers of WOTS+ trees and a bottom layer of HORST trees. HORST is a few time signature scheme, using a selection function you can sign at least twice without ...
- 314
4
votes
1
answer
103
views
Difficulty of forging MACs based on linear functions over $GF\left(2^n\right)$
This is a homework question, therefore I'm not expecting full solutions, just general guidance.
I want to build a one-time MAC using universal hashing.
I defined my hash functions as:
$h_{a,b}:\...
- 91
1
vote
2
answers
600
views
Why does WOTS+ need a checksum during signing operation?
I was reviewing WOTS+ scheme for consideration in our private blockchain, and noticed that it had a small overhead of calculating a checksum as seen in the following pseudocode excerpt from the ...
- 9,001
1
vote
1
answer
359
views
Bitmasks or seed along with public key in WOTS+ post-quantum signatures
The state of the art hash-based post-quantum signature schemes, like Sphincs and XMSS, are using variations of WOTS (Winternitz OTS), like WOTS+, that require extra random bitmasks along with the ...
- 232
9
votes
3
answers
7k
views
Winternitz One-Time Signature
I am reading the page 38 in this "Post Quantum Cryptography" book (Equations 8 and 9). My question is, why to compute the verification key $Y$, $f$ is applied $2^w-1$ times? Are there any security ...
- 2,661