Digital Signatures Out of Second-Preimage Resistant Hash Functions

Abstract

Abstract. We propose a new construction for Merkle authentication trees which does not require collision resistant hash functions; in contrast with previous constructions that attempted to avoid the dependency on collision resistance, our technique enjoys provable security assuming the well-understood notion of second-preimage resistance. The resulting signature scheme is existentially unforgeable when the underlying hash function is second-preimage resistant, yields shorter signatures, and is affected neither by birthday attacks nor by the recent progresses in collision-finding algorithms.

XMSS - A Practical Forward Secure Signature Scheme Based on Minimal Security Assumptions

“…Comparing this with the result from [DOTV08] given in the proof of Theorem 1 we see that the right part of the equation for α = 2 H is exactly InSec EU-CMA XMSS (1 n , 2 H ); t, q = 1 . This concludes the claim.…”

“…It is the first practical (forward) secure signature scheme with minimal security requirements in the above sense. On the one hand, there are only three other signature schemes with minimal assumptions [Gol09,Rom90,DOTV08]. Compared to MSS-SPR [DOTV08], which is the most efficient one of these schemes, we can reduce the signature size by more than 25 % for the same level of security.…”

“…On the one hand, there are only three other signature schemes with minimal assumptions [Gol09,Rom90,DOTV08]. Compared to MSS-SPR [DOTV08], which is the most efficient one of these schemes, we can reduce the signature size by more than 25 % for the same level of security. The improved signatur size is very important as the signature size is considered the main drawback of hash-based signatures.…”

“…The scheme can easily be extended to sign messages of arbitrary length using TCR hash and sign as proposed in [DOTV08]. This requires a target collision resistant hash function family.…”

“…The last row of table 1 shows the signature size and public key size for MSS-SPR [DOTV08]. To make the results from [DOTV08] comparable, we computed the signature and public key size for message length m = 256 bit, using their formulas.…”