1. Improving Lamport One-time Signature Scheme
Ming-Hsin Chang, Yi-Shiung Yeh,
Elsevier, Appl. Math. Comput., 2005
Presented by 盧奕吉

2. Outline Introduction Lamport’s Scheme Proposed Scheme
Security & Performance Analysis
Conclusion

3. Introduction One-time signature scheme
is used to sign at most one message; otherwise the signature can be forged.
has the property of efficient signature generation and verification.
requires a large amount of storage space.

4. Lamport’s Scheme
Lamport’s one-time signature scheme is comprised of 3 phases:
Key generation phase
Signing phase
Verification phase

5. Key Generation Phase
Select 2k elements randomly with 1 ≤ i ≤ k and j = 0,1. (k is the length of the message in base 2).
Compute for all i,j.

6. Signing Phase
To sign a k-bit message m = m1…mk, sig(m) = sig(m1…mk) = ( ).
i.e., to sign a message m = 10…1, the signature becomes:

7. Verification Phase
To verify the signature check if holds, where 1≤ i ≤ k.

8. Proposed Scheme Key Generation Select a number e and set .
Derive the value L, which is the length of the message in base v.
For each column i, randomly select e+1 elements, where 1 ≤ i ≤ L.

10. Proposed Scheme To sign a message m:
Convert m to base v representation.
For each digit of mi, further convert it to base 2 representation.
sig(m) = sig(m1…mL) = where , such that the symbol x signifies the 2’s representation of mi.

11. Proposed Scheme
To sign a message m, first select a value e, say 3, and set v = 2(e+1) = 16. Then convert m to base v, e.g., m = (3A…1)16 . Again convert each digit to base 2 representation, i.e., 3 = (0011)2, A = (1010)2 and 1 = (0001)2, etc.

12. Proposed Scheme Verification
To verify the signature, simply check if the signature matches the corresponding z’s. If so, the signature is genuine.

13. Performance Analysis # of public key items Avg. # of signature terms
Avg. # of verification
Lamport’s Scheme
320
160
Proposed Scheme 80
*For message length of 160 bits

14. Security Analysis
Security equals to the number of signature terms, in Lamport case, it equals to the number of bits. In the proposed scheme, the number of signature terms is halved, L*e/2.

15. Conclusion
Although the proposed scheme’s performance is twice as fast as Lamport’s, its security, however, is sacrificed.
Due to the particular nature of Lamport’s signature scheme, the performance growth will always be proportional to the security decrease.