![](bg8.png)
probability, then at least one of p
1
, p
2
, and p
3
is non-
negligible. The algorithm A
2
may abort at Step 4,
but that probability is less than 1/2 by Lemma 2(2).
With probability more than 1/2, A
2
proceeds to Step
5. The algorithm A
2
performs Step 5(a) only if A
1
wins the game with the scenario A, and in this case,
the pair (z, z
0
) produced by A
2
is a collision pair of
h. The algorithm A
2
performs Step 5(b) only if A
1
wins the game with the scenario B, and in this case,
the pair (z, z
0
) produced by A
2
is a collision pair of
f
l,w
. The algorithm A
2
performs Step 5(c) only if A
1
wins the game with the scenario C, and furthermore,
f
0
α
> β is fulfilled simultaneously. This is an event
that occurs with probability p
3
1 − p
w,l,θ
EQ
/2 or more
by Lemma 2(2), and in this case, A
2
discovers a pre-
image x
0
of y or a collision pair (z, z
0
) of the hash func-
tion h. Summarizing the discussion, the algorithm A
2
succeeds in one of three attacks over f
l,w
and h with
probability is equal to or more than
1
2
p
1
+ p
2
+
p
3
2
1 − p
w,l,θ
EQ
.
If the winning probability of A
1
is non-negligible,
then so is the success probability of A
2
.
5 CONCLUSION
Constant-sum fingerprinting functions and partial
construction of hash chains are investigated to im-
prove Winternitz OTS. The constant-sum fingerprint-
ing function contributes to reduce the complexity of
the signature verification, which is advantageous in
certain services including wireless sensor networks.
The integer components of constant-sum fingerprints
distribute non-uniformly, which makes the partial
construction of hash chains an effective means to re-
duce the complexities of key generation and signing.
It is confirmed that the proposed scheme is more effi-
cient than Winternitz OTS in terms of the number of
computations of the hash function, while the scheme
is shown to be strongly existentially unforgeable. It
is noted that the technique that is investigated in this
study is compatible with other improvements that are
studied in (Buchmann et al., 2011b; Hulsing, 2013;
Buchmann et al., 2011a; Bernstein et al., 2015). We
can further improve the efficiency by combining the
investigated techniques with those in literature.
REFERENCES
Bernstein, D., Buchmann, J., and Dahmen, E. (2009). Post-
Quantum Cryptography. Springer.
Bernstein, D., Hopwood, D., Hulsing, A., et al. (2015).
Sphincs: Practical stateless hash-based signatures. In
EUROCRYPT 15, pages 368–397.
Bleichenbacher, D. and Maurer, U. (1996a). On the effi-
ciency of one-time digital signature schemes. In ASI-
ACRYPT 96, pages 145–158.
Bleichenbacher, D. and Maurer, U. (1996b). Optimal tree-
based one-time digital signature schemes. In Symp. on
Theoretical Aspects of Comp. Sci., pages 363–374.
Bollinger, R. and Burchard, C. (1990). Lucas’s theorem and
some related results for extended pascal triangles. The
American Math. Monthly, 97(3):198–204.
Boneh, D., Shen, E., and Waters, B. (2006). Strongly un-
forgeable signatures based on computational diffie-
hellman. In Intl. Conf. on Theory and Practice of
Public-Key Cryptography, pages 229–240.
Buchmann, J., Dahmen, E., , and Hulsing, A. (2011a).
Xmss—a practical forward secure signature scheme
based on minimal security assumptions. In Intl. Conf.
on Post-Quantum Cryptography, pages 117–129.
Buchmann, J., Dahmen, E., Ereth, S., et al. (2011b). On the
security of the winternitz one-time signature scheme.
In AFRICACRYPT 11, pages 363–378.
Cruz, J., Yatani, Y., and Kaji, Y. (2016). Constant-sum fin-
gerprinting for winternitz one-time signature. In Intl.
Symp. on Inf. Theory and Its App., pages 703–707.
Dods, C., Smart, N., and Stam, M. (2005). Hash based dig-
ital signature schemes. In Intl. Conf. on Cryptography
and Coding, pages 96–115.
Goldwasser, S. and M. Bellare, M. (2018). Lecture
notes on cryptography. https://cseweb.ucsd.edu/ ˜mi-
hir/papers/gb.pdf, accessed February 14.
Hulsing, A. (2013). W-ots
+
— shorter signatures for
hash-based signature schemes. In AFRICACRYPT 13,
pages 173–188.
Lamport, L. (1979). Constructing digital signatures from
a one-way function. Technical Report SRI-CSL-98,
SRI Intl. Computer Sci. Lab.
Merkle, R. (1990). A certified digital signature. In CRYPTO
89, pages 218–238.
Perrig, A. (2001). The biba one-time signature and broad-
cast authentication protocol. In ACM Conf. on Com-
puter and Communications Security, pages 28–37.
Perrig, A., Szewczyk, R., Wen, V., et al. (2002). Spins:
Security protocols for sensor networks. Wireless Net-
works J., 8(5):521–534.
Reyzin, L. and Reyzin, N. (2002). Better than biba: Short
one-time signatures with fast signing and verifying. In
Intl. Inf. Security and Privacy Conf., pages 1–47.
Shor, P. (1997). Polynomial-time algorithms for prime fac-
torization and discrete logarithms on a quantum com-
puter. SIAM J. of Computing, 26(5):1484–1509.
SECRYPT 2018 - International Conference on Security and Cryptography
304