Skip to main content

Questions tagged [one-time-signature]

a digital signature scheme that can be used to sign one message per key pair

Filter by
Sorted by
Tagged with
0 votes
1 answer
64 views

SPHINCS+ signature calculation and FORS public key

I was trying to understand the SPHINCS+ document from https://sphincs.org/data/sphincs+-r3.1-specification.pdf and have the below doubts. Consider the example of SPHINCS+-128s , the value of n,h,d,log(...
1 vote
1 answer
84 views

ADRS in WOTS+ signature scheme

I am trying to understand the sphincs+ from [1] and have a fair understanding of WOTS+ scheme from [2] However, in the OTS scheme defined in [1] , it seem to use ADRS for storing chain address, hash ...
1 vote
1 answer
67 views

What happens when a Merkle Tree OTS scheme runs out of keys

A Merkle Tree OTS scheme such as XMSS pregenerates 2^h keys that are tied to 1 public key When the 2^h keys run out, does all the 2^h keys get removed/deleted and the device pregenerates another new 2^...
3 votes
1 answer
984 views

What is "one-time signature"

I'm studying the post-quantum cryptography (PQC). While studying hash-based pqc, I read a thesis about Winternitz one-time signature scheme (W-OTS). What is the exact definition of "One-time ...
1 vote
1 answer
384 views

How does signing with FORS work in SPHINCS+?

I was reading the SPHINCS+ paper and got confused in the signing with FORS (forest of random subsets) part. I understand how we can sign a message using FORS but I couldn't understand how we choose ...
1 vote
1 answer
127 views

Stateful hash signature without Merkle trees

When it comes to stateful schemes, would you really need to use a Merkle tree? Couldn't you sign the hash of the message concatenated to the hash of the new public key? New public key: hash(hash(...
1 vote
1 answer
170 views

Why do we need both bitmasks and keyed hash in SPHINCS+

I think one of them is related to multitarget attacks and the other is related to collision attacks. But I cannot find how hash based crypto related to hash collisions. 1-) Consider the following ...
2 votes
1 answer
75 views

W-OTS+ one-wayness property

I am reading the "W-OTS⁺ – Shorter Signatures for Hash-Based Signature Schemes," by Andreas Hülsing, and I am stuck in understanding the success probability of an adversary, $\mathcal A$, against the ...
2 votes
0 answers
107 views

Hashing Public Key of Lamport or Winternitz OTS

For the Lamport or Winternitz public keys, couldn't one just hash down the large public key to 256 bits in order to greatly reduce the public key size while still having basically the same security? ...
2 votes
0 answers
96 views

Is it more, or less, secure to use a different $F$ and $G$ for a Lamport signature?

A Lamport signature is made as follows: Alice stores $k_1, \cdots, k_{n'} \leftarrow K $ as her "private key", with one-way function $F: K\to V$, $n'>n$, and (easily enough) all $F(k_i)\...
0 votes
1 answer
68 views

In W-OTS, is it trivial to forge smaller N values?

Just read about W-OTS. Since the signature is the private key hashed 256-N times, is it trivial to forge a signature with a smaller value for $N$ when having access to original signature? I.e. just ...
2 votes
2 answers
152 views

Can we place the WOTS scheme into a Merkle tree structure?

In post-quantum signature schemes that are (to put it simply) built out of merkle trees, they usually employ some sort of OTS scheme on the very bottom leaves. I.e WOTS Winternitz scheme. A ...
3 votes
1 answer
130 views

How can a collision attack using MD5 be used to break WOTS

It is stated in Winternitz One time signature security that MD5 is not safe for Winternitz due to collision attack. Given that WOTS generates multiple, say 32 private keys then hashing them a number ...
2 votes
1 answer
227 views

Chaining one-time signatures

To introduce the notation for the question, consider a one-time signature algorithm: There are a private signing key $sk$ and a corresponding public key $pk$, generated by $Gen(seed)$. To sign a ...
1 vote
1 answer
465 views

Winternitz One Time Signature

I happened to watch Mr. Bill Buchanan lecture that explains Winternitz one time signature scheme (https://www.youtube.com/watch?v=eqMMlcN4zSc). The scheme shown in the lecture is susceptible to ...
11 votes
2 answers
3k views

Advantages and disadvantages of hash-based signatures

We know hash-based signatures (Winternitz signature, HORS(T) signature) that are quantum-safe and efficient. They can be stateful or stateless, one-time or multiple-time. But why are they not widely ...
1 vote
1 answer
363 views

Signing a message using SPHINCS Hash-based Signature scheme

I have questions on “SPHINCS: practical stateless has-based signature” by Bernstein et al. And I really hope that someone can help me with it. To help me understand it, I read the https://...
0 votes
1 answer
184 views

Security level in HORS signature scheme

I was reading the HORS One-Time-Signature scheme by Reyzin & Rezyin, but I could not understand how they derived their security equation $(rk⁄t)^k$. I understand that the total number of balls is $...
4 votes
1 answer
467 views

SPHINCS and HORST: can we sign the same message twice?

I was reading about SPHINCS which uses layers of WOTS+ trees and a bottom layer of HORST trees. HORST is a few time signature scheme, using a selection function you can sign at least twice without ...
4 votes
1 answer
106 views

Difficulty of forging MACs based on linear functions over $GF\left(2^n\right)$

This is a homework question, therefore I'm not expecting full solutions, just general guidance. I want to build a one-time MAC using universal hashing. I defined my hash functions as: $h_{a,b}:\...
1 vote
1 answer
402 views

Bitmasks or seed along with public key in WOTS+ post-quantum signatures

The state of the art hash-based post-quantum signature schemes, like Sphincs and XMSS, are using variations of WOTS (Winternitz OTS), like WOTS+, that require extra random bitmasks along with the ...
9 votes
3 answers
7k views

Winternitz One-Time Signature

I am reading the page 38 in this "Post Quantum Cryptography" book (Equations 8 and 9). My question is, why to compute the verification key $Y$, $f$ is applied $2^w-1$ times? Are there any security ...
1 vote
2 answers
657 views

Why does WOTS+ need a checksum during signing operation?

I was reviewing WOTS+ scheme for consideration in our private blockchain, and noticed that it had a small overhead of calculating a checksum as seen in the following pseudocode excerpt from the ...