On the security of the Winternitz one-time signature scheme

Abstract

Abstract. We show that the Winternitz one-time signature scheme is existentially unforgeable under adaptive chosen message attacks when instantiated with a family of pseudo random functions. Compared to previous results, which require a collision resistant hash function, our result provides significantly smaller signatures at the same security level. We also consider security in the strong sense and show that the Winternitz one-time signature scheme is strongly unforgeable assuming additional properties of the pseudo random function. In this context we formally define several key-based security notions for function families and investigate their relation to pseudorandomness. All our reductions are exact and in the standard model and can directly be used to estimate the output length of the hash function required to meet a certain security level.

Mitigating Multi-target Attacks in Hash-Based Signatures

“…The original proposal for XMSS essentially combines a collision-resilient version of the Winternitz one-time signature scheme (WOTS) from [12] with the collision-resilient hash tree construction from [16] and adds two different kinds of pseudorandom key generation, one leading an EU-CMA-secure and one a forward-secure signature scheme. Under the name XMSS M T Hülsing, Rausch, and Buchmann [25] later proposed a multi-tree version of XMSS.…”

“…In recent years several works focused on basing security on milder assumptions [16,12,13,23,25,6], such as second-preimage resistance and one-wayness. There are two fundamental reasons driving this trend.…”

Optimal Parameters for XMSS MT

“…MT uses the Winternitz-OTS (W-OTS) from [2]. W-OTS uses the function family F n and a value X ∈ {0, 1} n that is chosen during XMSS key generation.…”

“…The runtimes for key generation, signature generation and signature verification are all bounded by (w − 1) evaluations of elements from F n . The Winternitz parameter w controls a time -space trade-off, as shrinks logarithmically in w. For more detailed information see [2].…”

A Performance Boost for Hash-Based Signatures

“…For increased efficiency (and shorter signatures) we chose Winternitz OTS rather than the classic Lamport-Diffie OTS. The security of the Winternitz one-time signatures is discussed in [5,8,10]. The findings in [5] and [10] show that Winternitz OTS are CMA-secure if used with pseudo-random functions or collision-resistant, undetectable one-way functions, respectively.…”