CWOTS – Concise WOTS
One issue with hash-based Winternitz One Time Signatures (WOTS) is the length of keys and of signatures.
KeeeX unveils a new scheme that supports public signing addresses having the size of a hash (typically 256 bits or 32 bytes for SHA-256), public keys having the size of two hashes (e.g. 64 bytes) plus a mode parameter, and signatures having the same size and attributes.
Because of its conciseness, the scheme is named Concise Winternitz One Time Signatures, or CWOTS.
The elements required to sign are a 256-bit private key, a 256-bit seed, and a mode stating how the seed is used along the process (left unchanged or rotated and/or hashed upon every level in the chain). The elements required to verify are a 256-bit public key, a 256-bit seed, and a mode. A 256-bit HMAC of these verification elements can be shared as a proof of capacity to sign (very much like a destination address in the crypto space) called the PSCR (Public Signing Capacity Record).
Very much like what was made popular by Bitcoin, the proof of ownership of a public key can be shared with the PSCR without revealing the details until an actual signature is published.
ICWOTS – Identity aware CWOTS
As stated, CWOTS signatures are “one time,” which stems from the fact that every published signature reveals part of hash chains that reduce the strength of the public key. A checksum mechanism ensures that reuse is not totally impossible, but this remains discouraged. The use cases for such one-time signatures exist in the crypto space and form the primary motivation for the BIP32 scheme. They also become increasingly relevant due to possible quantum attacks over asymmetric cryptography using the Shor algorithm. Yet the WOTS and CWOTS schemes suffer from the absence of a traceable definition of identity that would span a possibly unlimited number of signatures.
To address this, the specifications first revealed in the PDF document “Concise One Time Hash Based Signatures DRAFT 5” (1) also propose a framework for binding one-time signatures with an identity scheme using open hash chains relying on a commit-reveal approach.
Demo Code
We also release an archive containing a demo javascript implementation of CWOTS (2)
Disclaimer
The whole proposal was not cryptographically proven.
(1) keeexed as “xokok-depeh-pypyb-kokyb-nohud-kigih-fonev-dupyv-bonih-cydon-hinof-lehod-visim-hucek-zosov-lefap-mexyx“
(2) keeexed as “xegav-gumuk-cakut-fopap-lekyk-muhem-nuneb-cykaz-sefun-pyvyz-mycyf-pygam-nyhin-didyn-lazun-borus-nexyx“