1 / 13

Hash-Based Signatures

Hash-Based Signatures. Johannes Buchmann, Andreas Hülsung Supported by DFG and DAAD. Part V: Winternitz One -Time Signature Scheme ( WOTS). Winternitz OTS (WOTS). First idea: Winternitz (Mer89) Full scheme: Even et al. (EGM96) Security Proofs: Hevia & Micciancio (HM02)

oleg
Télécharger la présentation

Hash-Based Signatures

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Hash-Based Signatures Johannes Buchmann, Andreas Hülsung Supported by DFG and DAAD Part V: Winternitz One-Time SignatureScheme (WOTS)

  2. Winternitz OTS (WOTS) First idea: Winternitz (Mer89) Full scheme: Even et al. (EGM96) Security Proofs:Hevia & Micciancio (HM02) Dods et al. (DSS05) Requires collision-resistant undetectable one-way function family. WOTS$:Buchmann et al. (BDEH+11) Requires pseudorandom function family. WOTS+: Hülsing (Hül13) Requires second preimage resistant undetectable one-way function family.

  3. Recap LD-OTS [Lam79] Message M = b1,…,bm, OWF H = n bit SK PK Sig * sk1,0 • sk1,1 skm,0 • skm,1 H H H H H H pk1,0 • pk1,1 pkm,0 • pkm,1 • Mux Mux • Mux b1 b2 bn sk1,b1 • skm,bm

  4. Trivial Optimization Message M = b1,…,bm, OWF H = n bit SK PK Sig * sk1,0 • sk1,1 skm,0 • skm,1 H H H H H H pk1,0 • pk1,1 pkm,0 • pkm,1 Mux Mux Mux Mux bm b1 bm b1 sigm,0 sigm,1 sig1,0 sig1,1

  5. Non-trivial Optimization Message M = b1,…,bm, OWF H SK: sk1,…,skm,skm+1,…,sk2m PK: H(sk1),…,H(skm),H(skm+1),…,H(sk2m) Encode M: M‘ =b1,…,bm,b1,…,bm ski , if bi = 1 Sig: sigi = H(ski) , otherwise Checksum with bad performance!

  6. Non-trivial Optimization, cont‘d Message M = b1,…,bm, OWF H SK: sk1,…,skm,skm+1,…,skm+log m PK: H(sk1),…,H(skm),H(skm+1),…,H(skm+log m) Encode M: M‘ =b1,…,bm, ski , if bi = 1 Sig: sigi = H(ski) , otherwise IF one bi is flipped from 1 to 0, another bj will flip from 0 to 1

  7. WOTSFunction Chain Function family: Formerly: WOTS+ For w ≥ 2 select R =(r1, …, rw-1) ri ci(x) ci-1(x) c0(x) = x cw-1(x) c1(x) =

  8. WOTS Function Chains For define and • WOTS: • WOTS$: • WOTS+:

  9. WOTS+ Winternitz parameter w, security parameter n, message length m, function family Key Generation: Compute l , sample K, sample R pk1= cw-1(sk1) c0(sk1) = sk1 c1(sk1) c1(skl) pkl= cw-1(skl) c0(skl) = skl

  10. WOTS+ Signature generation M b1 b2 b3 b4 … … … … … … … bm‘ bm‘+1 bm‘+2 … … bl pk1= cw-1(sk1) c0(sk1) = sk1 C σ1=cb1(sk1) Signature: σ = (σ1, …,σl) pkl= cw-1(skl) c0(skl) = skl σl=cbl(skl)

  11. WOTS+SignatureVerification • Verifier knows: M, n, w, c b1 b2 b3 b4 … … … … … … … bm‘ bm‘+1 bl1+2 … … bl c1(σ1) pk1 c3(σ1) =? σ1 c2(σ1) cw-1-b1(σ1) Signature: σ = (σ1, …,σl) pkl =? σl cw-1-bl (σl )

  12. WOTS Security Theorem (informally): W-OTS is strongly unforgeable under chosen message attacks if F is a collision resistant, undetectable one-way function family. W-OTS$is existentially unforgeable under chosen message attacks if F is a pseudorandom function family. W-OTS+is strongly unforgeable under chosen message attacks if F is a 2nd-preimage resistant, undetectable one-way function family.

  13. WOTS Sizes and Runtimes Security level b, Winternitz parameter w, Message Length m,l = l (w,m) ~ m / log w

More Related