Improving Lamport One-time Signature Scheme Ming-Hsin Chang, Yi-Shiung Yeh, Elsevier, Appl. Math. Comput., 2005 Presented by 盧奕吉

Outline Introduction Lamport’s Scheme Proposed Scheme Security & Performance Analysis Conclusion

Introduction One-time signature scheme is used to sign at most one message; otherwise the signature can be forged. has the property of efficient signature generation and verification. requires a large amount of storage space.

Lamport’s Scheme Lamport’s one-time signature scheme is comprised of 3 phases: Key generation phase Signing phase Verification phase

Key Generation Phase Select 2k elements randomly with 1 ≤ i ≤ k and j = 0,1. (k is the length of the message in base 2). Compute for all i,j.

Signing Phase To sign a k-bit message m = m1…mk, sig(m) = sig(m1…mk) = ( ). i.e., to sign a message m = 10…1, the signature becomes:

Verification Phase To verify the signature check if holds, where 1≤ i ≤ k.

Proposed Scheme Key Generation Select a number e and set . Derive the value L, which is the length of the message in base v. For each column i, randomly select e+1 elements, where 1 ≤ i ≤ L.

Proposed Scheme To sign a message m: Convert m to base v representation. For each digit of mi, further convert it to base 2 representation. sig(m) = sig(m1…mL) = where , such that the symbol x signifies the 2’s representation of mi.

Proposed Scheme To sign a message m, first select a value e, say 3, and set v = 2(e+1) = 16. Then convert m to base v, e.g., m = (3A…1)16 . Again convert each digit to base 2 representation, i.e., 3 = (0011)2, A = (1010)2 and 1 = (0001)2, etc.

Proposed Scheme Verification To verify the signature, simply check if the signature matches the corresponding z’s. If so, the signature is genuine.

Performance Analysis # of public key items Avg. # of signature terms Avg. # of verification Lamport’s Scheme 320 160 Proposed Scheme 80 *For message length of 160 bits

Security Analysis Security equals to the number of signature terms, in Lamport case, it equals to the number of bits. In the proposed scheme, the number of signature terms is halved, L*e/2.

Conclusion Although the proposed scheme’s performance is twice as fast as Lamport’s, its security, however, is sacrificed. Due to the particular nature of Lamport’s signature scheme, the performance growth will always be proportional to the security decrease.