Signature sizes: RSA signatures are big. a call to action D. J. - PowerPoint PPT Presentation

Signature sizes: RSA signatures are big. a call to action D. J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven

Signature sizes: RSA signatures are big. a call to action 1990 Schnorr signatures D. J. Bernstein are much smaller: University of Illinois at Chicago & 3 ♥ bits for security 2 ♥ . Technische Universiteit Eindhoven Often misquoted as 4 ♥ bits; e.g., 2009 Neven–Smart– Warinschi claims to improve Schnorr from 4 ♥ to 3 ♥ (“saving twenty-five percent in signature size”).

Signature sizes: RSA signatures are big. a call to action 1990 Schnorr signatures D. J. Bernstein are much smaller: University of Illinois at Chicago & 3 ♥ bits for security 2 ♥ . Technische Universiteit Eindhoven Often misquoted as 4 ♥ bits; e.g., 2009 Neven–Smart– Warinschi claims to improve Schnorr from 4 ♥ to 3 ♥ (“saving twenty-five percent in signature size”). 2001 Boneh–Lynn–Shacham pairing-based “short signatures”: 2 ♥ bits.

Signature sizes: RSA signatures are big. 1996 Pata to action 2001 Pata 1990 Schnorr signatures “Quartz”: ♥ Bernstein are much smaller: University of Illinois at Chicago & 3 ♥ bits for security 2 ♥ . “Very sho echnische Universiteit Eindhoven asymmetric Often misquoted as 4 ♥ bits; e.g., 2009 Neven–Smart– Also achieved Warinschi claims to improve MQ signature Schnorr from 4 ♥ to 3 ♥ often with (“saving twenty-five percent but HFEv- in signature size”). and inspires 2001 Boneh–Lynn–Shacham Further save, pairing-based “short signatures”: at expense 2 ♥ bits. verification ✔

RSA signatures are big. 1996 Patarin “HFEv-”, 2001 Patarin–Courtois–Goubin 1990 Schnorr signatures “Quartz”: ♥ bits. are much smaller: Illinois at Chicago & 3 ♥ bits for security 2 ♥ . “Very short Universiteit Eindhoven asymmetric signatures”. Often misquoted as 4 ♥ bits; e.g., 2009 Neven–Smart– Also achieved by many Warinschi claims to improve MQ signature schemes, Schnorr from 4 ♥ to 3 ♥ often with smaller (“saving twenty-five percent but HFEv- has a long in signature size”). and inspires confidence. 2001 Boneh–Lynn–Shacham Further save, e.g., pairing-based “short signatures”: at expense of multiplying 2 ♥ bits. verification cost by ✔

RSA signatures are big. 1996 Patarin “HFEv-”, 2001 Patarin–Courtois–Goubin 1990 Schnorr signatures “Quartz”: ♥ bits. are much smaller: Chicago & 3 ♥ bits for security 2 ♥ . “Very short Eindhoven asymmetric signatures”. Often misquoted as 4 ♥ bits; e.g., 2009 Neven–Smart– Also achieved by many other Warinschi claims to improve MQ signature schemes, Schnorr from 4 ♥ to 3 ♥ often with smaller keys; (“saving twenty-five percent but HFEv- has a long history in signature size”). and inspires confidence. 2001 Boneh–Lynn–Shacham Further save, e.g., 10 bits pairing-based “short signatures”: at expense of multiplying verification cost by ✔ 2 10 . 2 ♥ bits.

RSA signatures are big. 1996 Patarin “HFEv-”, 2001 Patarin–Courtois–Goubin 1990 Schnorr signatures “Quartz”: ♥ bits. are much smaller: 3 ♥ bits for security 2 ♥ . “Very short asymmetric signatures”. Often misquoted as 4 ♥ bits; e.g., 2009 Neven–Smart– Also achieved by many other Warinschi claims to improve MQ signature schemes, Schnorr from 4 ♥ to 3 ♥ often with smaller keys; (“saving twenty-five percent but HFEv- has a long history in signature size”). and inspires confidence. 2001 Boneh–Lynn–Shacham Further save, e.g., 10 bits pairing-based “short signatures”: at expense of multiplying verification cost by ✔ 2 10 . 2 ♥ bits.

signatures are big. 1996 Patarin “HFEv-”, “Message 2001 Patarin–Courtois–Goubin signature Schnorr signatures “Quartz”: ♥ bits. Measure much smaller: signature � ♥ bits for security 2 ♥ . “Very short Often 4 ♥ ♥ ♥ asymmetric signatures”. misquoted as 4 ♥ bits; Many pap 2009 Neven–Smart– Also achieved by many other message rinschi claims to improve MQ signature schemes, rr from 4 ♥ to 3 ♥ often with smaller keys; 1993 Nyb (“saving twenty-five percent but HFEv- has a long history 2000 Pintsov–V signature size”). and inspires confidence. 2001 Naccache–Stern: message Boneh–Lynn–Shacham Further save, e.g., 10 bits Deployment pairing-based “short signatures”: at expense of multiplying verification cost by ✔ 2 10 . ♥ bits.

are big. 1996 Patarin “HFEv-”, “Message recovery”: 2001 Patarin–Courtois–Goubin signature conveys signatures “Quartz”: ♥ bits. Measure “signature smaller: signature size � message security 2 ♥ . “Very short ♥ Often 4 ♥ or 3 ♥ , sometime ♥ asymmetric signatures”. as 4 ♥ bits; Many papers/standa Neven–Smart– Also achieved by many other message recovery fo claims to improve MQ signature schemes, ♥ to 3 ♥ often with smaller keys; 1993 Nyberg–Ruepp y-five percent but HFEv- has a long history 2000 Pintsov–Vans size”). and inspires confidence. 2001 Naccache–Stern: message recovery fo Boneh–Lynn–Shacham Further save, e.g., 10 bits Deployment stopped “short signatures”: at expense of multiplying verification cost by ✔ 2 10 . ♥

1996 Patarin “HFEv-”, “Message recovery”: 2001 Patarin–Courtois–Goubin signature conveys message. “Quartz”: ♥ bits. Measure “signature overhead”: signature size � message size “Very short ♥ ♥ Often 4 ♥ or 3 ♥ , sometimes 2 ♥ asymmetric signatures”. ♥ bits; Many papers/standards: Also achieved by many other message recovery for RSA. rove MQ signature schemes, often with smaller keys; 1993 Nyberg–Rueppel, ♥ ♥ ercent but HFEv- has a long history 2000 Pintsov–Vanstone, and inspires confidence. 2001 Naccache–Stern: message recovery for ECDSA. Boneh–Lynn–Shacham Further save, e.g., 10 bits Deployment stopped by patents. signatures”: at expense of multiplying verification cost by ✔ 2 10 . ♥

1996 Patarin “HFEv-”, “Message recovery”: 2001 Patarin–Courtois–Goubin signature conveys message. “Quartz”: ♥ bits. Measure “signature overhead”: signature size � message size. “Very short Often 4 ♥ or 3 ♥ , sometimes 2 ♥ . asymmetric signatures”. Many papers/standards: Also achieved by many other message recovery for RSA. MQ signature schemes, often with smaller keys; 1993 Nyberg–Rueppel, but HFEv- has a long history 2000 Pintsov–Vanstone, and inspires confidence. 2001 Naccache–Stern: message recovery for ECDSA. Further save, e.g., 10 bits Deployment stopped by patents. at expense of multiplying verification cost by ✔ 2 10 .

atarin “HFEv-”, “Message recovery”: Latest mess atarin–Courtois–Goubin signature conveys message. 2012 Kiltz–Pietrzak–Szegedy rtz”: ♥ bits. Measure “signature overhead”: “Digital signature size � message size. minimal short Often 4 ♥ or 3 ♥ , sometimes 2 ♥ . will appea asymmetric signatures”. Many papers/standards: “Our main achieved by many other message recovery for RSA. revisit the signature schemes, exists a digital with smaller keys; 1993 Nyberg–Rueppel, scheme with HFEv- has a long history 2000 Pintsov–Vanstone, that has ✙ ♥ inspires confidence. 2001 Naccache–Stern: overhead. ✿ ✿ ✿ message recovery for ECDSA. urther save, e.g., 10 bits previous Deployment stopped by patents. ense of multiplying required ♥ verification cost by ✔ 2 10 .

“HFEv-”, “Message recovery”: Latest message-recovery rin–Courtois–Goubin signature conveys message. 2012 Kiltz–Pietrzak–Szegedy ♥ bits. Measure “signature overhead”: “Digital signatures signature size � message size. minimal overhead”. Often 4 ♥ or 3 ♥ , sometimes 2 ♥ . will appear at Crypto atures”. Many papers/standards: “Our main contribu many other message recovery for RSA. revisit the question schemes, exists a digital signature smaller keys; 1993 Nyberg–Rueppel, scheme with message long history 2000 Pintsov–Vanstone, that has minimal ( ✙ ♥ confidence. 2001 Naccache–Stern: overhead. ✿ ✿ ✿ The message recovery for ECDSA. e.g., 10 bits previous constructions Deployment stopped by patents. multiplying required an overhe ♥ by ✔ 2 10 .

“Message recovery”: Latest message-recovery pap rin–Courtois–Goubin signature conveys message. 2012 Kiltz–Pietrzak–Szegedy Measure “signature overhead”: “Digital signatures with ♥ signature size � message size. minimal overhead”. Rumor: Often 4 ♥ or 3 ♥ , sometimes 2 ♥ . will appear at Crypto 2013. Many papers/standards: “Our main contribution is to other message recovery for RSA. revisit the question if there exists a digital signature 1993 Nyberg–Rueppel, scheme with message recovery tory 2000 Pintsov–Vanstone, that has minimal ( ✙ ♥ bits) 2001 Naccache–Stern: overhead. ✿ ✿ ✿ The best message recovery for ECDSA. previous constructions Deployment stopped by patents. required an overhead of 2 ♥ .” ✔