On Optimal Hash Tree Traversal for Interval Time-Stamping Helger - - PowerPoint PPT Presentation

▶
on optimal hash tree traversal for interval time stamping
SMART_READER_LITE
LIVE PREVIEW

On Optimal Hash Tree Traversal for Interval Time-Stamping Helger - - PowerPoint PPT Presentation

Feb 11, 2024 484 likes •947 views

On Optimal Hash Tree Traversal for Interval Time-Stamping Helger Lipmaa Helsinki University of Technology { helger } @tcs.hut.fi http://www.tcs.hut.fi/helger ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping

slide-1
SLIDE 1

On Optimal Hash Tree Traversal for Interval Time-Stamping

Helger Lipmaa

Helsinki University of Technology

{helger}@tcs.hut.fi

http://www.tcs.hut.fi/˜helger

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 1

slide-2
SLIDE 2

Overview of the talk

  • Interval time-stamping
  • Skewed trees
  • Hash traversal
  • Main result: Hash traversal algorithm
  • Complexity analysis

Warning: The only

  • sign in the proceedings!

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 2

slide-3
SLIDE 3

Overview of the talk

  • Interval time-stamping
  • Skewed trees
  • Hash traversal
  • Main result: Hash traversal algorithm
  • Complexity analysis

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 3

slide-4
SLIDE 4

Need for time-stamping

  • To use digital signatures one needs to bind the signatory with the key
  • PKI
  • Revocation
  • Alice may claim that document was signed after revocation of her key
  • Need to establish temporal relationships

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 4

slide-5
SLIDE 5

Time-stamping (classical)

Problem given documents X and Y , which one was “stamped” before?

  • Example: X = signature key revocation, Y = document signed with

this key Objective solve this problem for any X and Y

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 5

slide-6
SLIDE 6

Time-stamping with graphs [BLLV98]

  • Use directed acyclic hash graphs with a root
  • Hash value R of the root is committed

⋆ R = round stamp

  • Time-stamp of X shows that R depends on X
  • Return partial time-stamp (freshness token) when X has been

stamped, and rest after R has been committed

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 6

slide-7
SLIDE 7

Time-stamping with T(d)

x0 x1 x2 x3 x4 x5 x6 x7

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 7

slide-8
SLIDE 8

Time-stamping with T(d)

x0 x1 x2 x3 x5 x6 x7 x4

  • Optimal for conventional time-stamping [BLS00]
  • Picture corresponds to [BdM93]. [BLS00] scheme is more complicated

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 8

slide-9
SLIDE 9

[BdM93] verification

x0 x1 x3 x5 x6 x7 x4 x2

  • Verify that two paths are consistent
  • More left = earlier, more right = later

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 9

slide-10
SLIDE 10

Need for interval time-stamping

  • Assume xi is Bob’s signature on some document Di
  • Time-stamping authority can time-stamp x1, x2 and x3 := x1
  • If Alice has timestamps of x1 and x2, she thinks that x1 was stamped

earlier

  • If Alice has timestamps of x3 = x1 and x2, she thinks that x2 was

stamped earlier

  • Solution: bind signing time also from above

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 10

slide-11
SLIDE 11

Idea of interval time-stamping

  • Time-stamp a nonce xi := σ
  • Let xj := SignBob(D, σ) (j > i)
  • Time-stamp xj
  • Interval time-stamp = the union of two conventional time-stamps

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 11

slide-12
SLIDE 12

Example: interval time-stamping

x0 x1 x3 x5 x6 x7 x2 = σ x4 = SignBob(D, σ)

  • Time-stamp has more elements, binary complete tree T(d) is not op-

timal

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 12

slide-13
SLIDE 13

Overview of the talk

  • Interval time-stamping
  • Skewed trees
  • Hash traversal
  • Main result: Hash traversal algorithm
  • Complexity analysis

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 13

slide-14
SLIDE 14

Skewed trees

1 2 3 1 4 4 3 2 w\d ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 14

slide-15
SLIDE 15

Skewed trees

  • A two-parameter family S(d, w) of trees, d, w ≥ 0
  • S(0, w) = S(d, 0) = I (singleton)
  • S(d, w) = S(d − 1, w − 1) ⊗ S(d − 1, w) for d, w ≥ 0
  • Clearly S(d, w) = S(d, d) = T(d) when w > d
  • [Wil02]: Skewed trees are optimal for interval time-stamping when

α := w/d ≈ 3−

√ 5 2

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 15

slide-16
SLIDE 16

Overview of the talk

  • Interval time-stamping
  • Skewed trees
  • Hash traversal
  • Main result: Hash traversal algorithm
  • Complexity analysis

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 16

slide-17
SLIDE 17

Hash traversal

  • The elements x0, x1, . . . arrive in this order
  • Final objective: compute root hash R
  • Intermediate objectives: after i steps return the ith freshness token
  • Question: how to do it efficiently?

Wil02 proposed a suboptimal algorithm

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 17

slide-18
SLIDE 18

Hash traversal example: S(4, 2)

x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10

  • x0, x1, . . . , arrive in this order
  • Initially no information

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 18

slide-19
SLIDE 19

Hash traversal example: S(4, 2)

x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10

  • x0 has just arrived
  • The red nodes are stored, but also returned as 0th freshness token

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 19

slide-20
SLIDE 20

Hash traversal example: S(4, 2)

x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10

  • x1 has just arrived
  • The red nodes are stored, but also returned as 1st freshness token

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 20

slide-21
SLIDE 21

Hash traversal example: S(4, 2)

x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10

  • x2 has just arrived
  • The red nodes are stored, but also returned as 2nd freshness token

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 21

slide-22
SLIDE 22

Hash traversal example: S(4, 2)

x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10

  • x3 has just arrived
  • The red nodes are stored, but also returned as 3rd freshness token
  • The cyan nodes were already calculated but not anymore stored

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 22

slide-23
SLIDE 23

Hash traversal example: S(4, 2)

x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10

  • x4 has just arrived
  • The red nodes are stored, but also returned as 4th freshness token
  • The cyan nodes were already calculated but not anymore stored

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 23

slide-24
SLIDE 24

Hash traversal example: S(4, 2)

x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10

  • x5 has just arrived
  • The red nodes are stored, but also returned as 5th freshness token
  • The cyan nodes were already calculated but not anymore stored

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 24

slide-25
SLIDE 25

Hash traversal example: S(4, 2)

x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10

  • x6 has just arrived
  • The red nodes are stored, but also returned as 6th freshness token
  • The cyan nodes were already calculated but not anymore stored

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 25

slide-26
SLIDE 26

Hash traversal example: S(4, 2)

x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10

  • x7 has just arrived
  • The red nodes are stored, but also returned as 7th freshness token
  • The cyan nodes were already calculated but not anymore stored

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 26

slide-27
SLIDE 27

Hash traversal example: S(4, 2)

x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10

  • x8 has just arrived
  • The red nodes are stored, but also returned as 8th freshness token
  • The cyan nodes were already calculated but not anymore stored

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 27

slide-28
SLIDE 28

Hash traversal example: S(4, 2)

x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10

  • x9 has just arrived
  • The red nodes are stored, but also returned as 9th freshness token
  • The cyan nodes were already calculated but not anymore stored

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 28

slide-29
SLIDE 29

Hash traversal example: S(4, 2)

x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10

  • x10 has just arrived
  • The red nodes are stored, but also returned as 10th freshness token
  • The cyan nodes were already calculated but not anymore stored

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 29

slide-30
SLIDE 30

Overview of the talk

  • Interval time-stamping
  • Skewed trees
  • Hash traversal
  • Main result: Hash traversal algorithm
  • Complexity analysis

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 30

slide-31
SLIDE 31

Algorithm for skewed tree traversal

1 funct initialization(d, w) ≡ 2

state := 0;

3

if w > d then w = d fi;

4

Store w, d;

5

Create an empty stack of maximum possible size w.

7 funct update(value) ≡ 8

if state ≥ 2d then return(Error!); fi

9

push(value);

10

for i := 1 to ntz(state + 1) do

11

push(H(pop(), pop())); end

12

state := state + (1< < <(wh(state)

.

− w)).

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 31

slide-32
SLIDE 32

Algorithm for skewed tree traversal

  • initialization creates an empty stack of maximum size w
  • Stack has the red nodes
  • update updates the stack, based on xi = value and state
  • state encodes the position in tree
  • wh, ntz and

.

− are all simple operations

  • In the case of traversal of T(d) the only difference is in the last line

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 32

slide-33
SLIDE 33

Good properties of algorithm

  • Algorithm has minimal number of hashings
  • Apart from that, only very simple operations
  • Very clean pseudocode (easy to implement)
  • Minimal number of memory usage: d(k + 1), k — length of hash
  • utput
  • A very simple nonrecursive algorithm for simple recursive family of

trees

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 33

slide-34
SLIDE 34

Overview of the talk

  • Interval time-stamping
  • Skewed trees
  • Hash traversal
  • Main result: Hash traversal algorithm
  • Complexity analysis

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 34

slide-35
SLIDE 35

Motivation

  • Storage on any step: rk + d, where r is the number of red nodes
  • Communication on any step: rk(1 + o(1))
  • Worst-case: r ≤ d
  • What is the average-case value ft(d, w) of r?

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 35

slide-36
SLIDE 36

Computing ft(d, w)

  • Let ℓ(d, w, t) be the number of leaves in S(d, w) that are at depth t

and let L(d, w) be the total number of leaves

  • Then ft(d, w) =

t ℓ(d, w, t) · t

Lemma L(d, w) = w

k=0

d

k

  • = 2d(d − w)

d

w

0.5

yd−w−1(1 − y)w dy and ℓ(d, w, t) =

              

0 , t < w ,

t−1

w−1

  • ,

t ∈ [w, d − 1] , 2 · w−1

k=0

d−1

k

  • = 2L(d − 1, w − 1) ,

t = d , 0 , t > d .

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 36

slide-37
SLIDE 37

Average size of the stack

Theorem 1

ft(d, w) = d

2 + w − 1 2d+1(w + 1)

0.5

yd−w−1(1 − y)w dy Proof Use the results from previous slide.

  • Nice, but how to compute the integral?
  • Cannot be done exactly, but can be approximated asymptotically
  • Nice fact: approximation error is exponentially small

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 37

slide-38
SLIDE 38

Laplace’s method

  • An integral of form

b

a ed·h(y)g(y) dy

  • Approximate it, given h(y) has only one maximum in [a, b]
  • More precise descriptions in any good book on analysis of algorithms
  • Perform separate analysis for the cases the maximum is inside the

region or on its border

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 38

slide-39
SLIDE 39

Laplace’s method

✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂

Maximum value

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 39

slide-40
SLIDE 40

Laplace’s method

✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂

Maximum value

  • Step 1: contract
  • Exponentially small errors

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 40

slide-41
SLIDE 41

Laplace’s method

✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂

Maximum value

  • Step 2: approximate (use only leading terms in power series)
  • Exponentially small errors

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 41

slide-42
SLIDE 42

Laplace’s method

✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁✁ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂ ✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂✁✂

Maximum value

  • Step 3: expand to [−∞, ∞]
  • Exponentially small errors

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 42

slide-43
SLIDE 43

Laplace’s method: application to our case

  • Let w = αd.
  • In our case, h(y) = (1 − α) ln y + α ln(1 − y), g(y) = 1/y, a = 0,

b = 0.5

  • If α ≤ 0.5 then maximum is on the border and ft(d, w) ≈

d 2 + (w−1)(d−2w) 2(w+1)

  • If α ≥ 0.5 then maximum is inside the interval and ft(d, w) ≈ d

2

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 43

slide-44
SLIDE 44

Example

60 65 70 75 80 85 90 95 100 105 10 20 30 40 50 60 70 80 90 100 110 120 Actual Approx.

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 44

slide-45
SLIDE 45

Conclusions

  • We introduced a very elegant algorithm for skewed tree traversal that

is optimal in almost every imaginable sense

  • A rigourous correctness proof
  • Analyzed the average case of algorithm
  • The analysis is very precise because of Laplace’s method. First time

this method has been used in cryptography(?)

  • Skewed trees are very natural and thus our research might have non-

cryptographic applications

ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 45