Merkle Tree Traversal Revisited

Abstract

Abstract. We propose a new algorithm for computing authentication paths in the Merkle signature scheme. Compared to the best algorithm for this task, our algorithm reduces the worst case running time considerably.

XMSS - A Practical Forward Secure Signature Scheme Based on Minimal Security Assumptions

“…Figure 2 shows the authentication path for leaf i. To compute the authentication path we use the tree traversal algorithm from [BDS08] as it allows for optimal balanced runtimes using very little memory. To verify the signature SIG = (i, σ, Auth), the string (b 0 , .…”

“…This is very expensive using FsGen. This problem is already addressed in [BDS08]. We use their solution that requires to store 2H states of FsGen.…”

Verifiably Encrypted Signatures from RSA without NIZKs

“…While authentication path creation and verification can be implemented using O( ) hash evaluations by using a small cache of O( ) hash values [17,20,9], the initial tree generation is rather costly. Setting = 20, however, has proven to be a reasonable trade-off between signature capability and efficiency in the Merkle signature scheme [10] but there generalized constructions that allow for 2 40 or even 2 80 signatures without having to compute 2 40 respectively 2 80 hash values during the set-up phase [8].…”

Fast Hash-Based Signatures on Constrained Devices

“…In summary we use the Winternitz one-time signature scheme (W-OTS) [9] to sign the data, the ideas for efficient one-time signature key generation of [4] and the algorithm from [6] for the computation of the authentication paths. We use two different hash functions based on the AES block cipher, both with 128-bit block length.…”

“…It is defined as the siblings of all nodes on the path from the sth leaf to the root of the Merkle tree, see Figure 1. For the computation of authentication paths we use the BDS algorithm from [6]. This algorithm is constructed such that the authentication path for the currently used leaf is already available and the upcoming authentication paths are prepared after the MSS signature is computed.…”