7

A Merkle tree is used for effective retrieving or sending data on the network that you can send/retrieve the data on any order and verify the current data with additional $O(\log n)$-data transmit and in $O(\log n)$-time. Actually, only the root hash is stored $O(1)$. While keeping the root hash any data retrieved/send verified. \begin{array}{lcr} & \...


5

Why not use a good old standard database in such cases? Am I missing something? No; you understand it perfectly well! It's nothing more than a particularly strange form of data integrity assurance (that, as you quickly realize, is trivially bypassed if not distributed across multiple nodes). If you're not using it as a resistance to adversarial peers, and ...


2

The problem is that your construction (the whole second picture) still constitutes a compressing function with 128bit output. Hence, we can find collisions at complexity about $t\cdot2^{64}$, where t is the runtime of your construction. Indeed, it seems that a little misconception motivates your work: You sound as if it was harder to find a collision than a ...


2

Ok, here's how to generate a commitment to a sequence of values, where it is easy to open the commitment to any initial subsequence. Here's how it works; suppose the values you are committing to are $M_1, M_2, ..., M_n$. Then, the committer picks a random value $R$, and with a preimage-resistent hash function, recursively computes the sequence: $$I_{n} = R$$...


2

If I understand you right, you are asking if there was a way to take the $n$-bit Merkle tree root, and use it to extract the multiple files that are the leaves. Obviously, if the information within the files is more than $n$ bits, you can't - if there are $2^n$ possible roots, then no procedure can extract more than $2^n$ different values from it, and it ...


1

In other words what is the probability that Bob has lied about the Merkle root after N queries? Well, here is one way Bob could cheat; he could take the list of $M$ values $$V_1, V_2, ..., V_M$$ and instead of forming a Merkle tree based on that, select a value $c$ index and a value $V'_c \ne V_c$, and instead form the list $$V_1, V_2, ..., V_{c-1}, V'_c, ...


1

What exactly is the purpose of the multi-tree variant in hash-based signature schemes? The biggest reason for using a multitree variant is to keep the public key generation time reasonable, even if the upper limit on the number of signatures is huge. With a single Merkle tree, the value of the root is a function of all the Winternitz public keys. That is, ...


1

The height of the merkle tree is an independent parameter. The Winternitz parameter — $w$ — comes up because to sign or verify a WOTS+ signature the first step is to encode your message as a list of integers from $0$ to $w - 1$ (inclusive). For example the string "hello" is encoded in ascii as 01101000 01100101 01101100 01101100 01101111. If $w$ ...


1

This paper answers your question most succinctly: The size of a Winternitz signature is roughly $mn/w$ bits and signing roughly requires $2^wm/w$ hash operations, where $m$ is the bit length of the hash value to be signed, $n$ is the output length of the hash function used in the scheme, and $w$ is the Winternitz parameter determining the tradeoff between ...


Only top voted, non community-wiki answers of a minimum length are eligible