Fast Verification of Hash Chains with Reduced Storage

概要

論文の詳細を見る
A hash chain H for a hash function hash(·) is a sequence of hash values <xn,xn-1,...,x0>, where x0 is a secret value, xi is generated by xi = hash(xi-1) for 1≤ i ≤ n, and xn is a public value. Hash values of H are disclosed gradually from xn-1 to x0. The correctness of a disclosed hash value xi can be verified by checking the equation $x_n \\stackrel{?}{=} \\hash^{n-i}(x_i)$. To speed up the verification, Fischlin introduced a check-bit scheme at CT-RSA 2004. The basic idea of the check-bit scheme is to output some extra information cb, called a check-bit vector, in addition to the public value xn, which allows each verifier to perform only a fraction of the original work according to his or her own security level. We revisit the Fischlins check-bit scheme and show that the length of the check-bit vector cb can be reduced nearly by half. The reduced length of cb is close to the theoretic lower bound.