Merkle Signatures with Virtually Unlimited Signature Capacity

Abstract

We propose GMSS, a new variant of the Merkle signature scheme. GMSS is the first Merkle-type signature scheme that allows a cryptographically unlimited (2 80 ) number of documents to be signed with one key pair. Compared to recent improvements of the Merkle signature scheme, GMSS reduces the signature size as well as the signature generation cost.

Post-quantum cryptography: lattice signatures

“…The main disadvantage of the Merkle signature scheme is the size of the signatures. To reduce this size, an extension called generalized Merkle signature scheme (GMSS [5]) was proposed in 2007. This construction uses multiple Merkle trees organized in T layers one upon another.…”

“…Considering the timings, GMSS is competing with famous signature schemes like RSA, DSA, or ECDSA, whereas the signature size must be shortened to be comparable to those schemes. For a complete de-scription we refer to [5]. For the key size analysis we only consider the GMSS extension, as it is the most promising Merkle scheme for practical purposes.…”

“…Applying GMSS [5], an improvement of Merkle's generic construction principle [23], turns both one-time signature schemes into multi-time signature schemes, allowing a comparison with GPV in Table 1. Observe that the GMSS schemes have smaller verification keys than GPV.…”

“…The second dimension n = 128 should provide an outlook on future developments and how they might affect efficiency. For the GMSS sizes we used the parameter set {2, (20,20), (10,5)}, the output length of the hash function SWIFFT is 513 bit for n = 64 and 1026 bit for n = 128, respectively. See Section 3 for details.…”

Verifiably Encrypted Signatures from RSA without NIZKs

“…Setting = 20, however, has proven to be a reasonable trade-off between signature capability and efficiency in the Merkle signature scheme [10] but there generalized constructions that allow for 2 40 or even 2 80 signatures without having to compute 2 40 respectively 2 80 hash values during the set-up phase [8].…”