New answers tagged

1

In most cases, multiphases is fine. After all, Lamport is essentially multiphase.. send public key, send signature. Not quite - with Lamport (or any other signature scheme), after seeing the public key and the signature, an attacker still cannot forge a signature; with your technique, he can. Almost all uses of signatures rely on this property, and so your ...


3

Yes, this is expected, if the RSASSA-PSS signing code/test uses salt the width of the hash, which is customary. In that case, a $h$-bit hash (with $h$ multiple of 8) requires an RSA public modulus at least $2h+9$ bits. That's semi-clearly stated in PKCS#1 v2.2, section 9.1.1, condition on enBits, with actual test in step 3. That's because the message ...


2

The original XMSS paper (eprint 2011/484) discusses an older version of XMSS, which does use rather larger public keys (and I suspect they got the signature size slightly wrong - they forget the idx_sig part of the signature which specifies which WOTS+ leaf they're using). The XMSS RFC defines a newer version, with considerably smaller public keys (and ...


2

The problem with talking about XMSS private key size is that there is a fairly large number of size/performance trade-offs, and so there's no one answer. At the minimum, the private key needs to have the value used to generate the WOTS+ private keys ($n$ bits), the $n$ bit public seed, and current leaf index (20, 40 or 60 bits, depending on the parameter ...


Top 50 recent answers are included