Temporary secret key

As an additional result of initialization, the signer s entity obtains a secret value. It is called skjemp, a temporary secret key, because it may change later. (That is, it is not necessarily a secret key in the sense of Section 5.3.2.) If initialization is not successful, skjemp = e is assumed for simplicity. 

A2, on input (par, pub, sk temp, aux%), first executes F in interaction with sign (as in Definition 7.13a, but in algorithmic notation) The inputs to F are (par, pub, aux X), and skjemp is updated with each application of sign. The results of Step 2 are a new temporary secret key from the last application of sign and the output/of F. Hence this step is denoted by... 

Furthermore, it suffices to define test for the same values pk e PK All as verify. Similarly, a value skjemp can only be an original temporary secret key (as in the requirement on SKJTemp in Definition 7.1) if there exist parameters par = ( 1 , 1 ) as above, a prekey prek e Allj g, and a value mk such that... 

Main key generation On input the parameters and a new prekey prek, N one-time key pairs (sk tempj, mkp based on prek are generated. The values mkj are used as the leaves of a binary tree. The value of each inner node is the hash value of its two children (regarded as one message). The new temporary secret key sk temp consists of the whole tree and a counter for the messages already signed, initialized with zero. But only the final hash value, i.e., the root of the tree, is published as the main public key mk of the new scheme. 

Main key generation is almost identical to that of the one-time scheme A one-time key pair (sk temp, mk) based on prek is chosen, mk is the main public key, and the main public key test is identical. The temporary secret key in the new scheme is sk temp = (sk temp, par, prek,j), where par are the parameters, as usual, and j is a string initialized with d zeros, where N = 2 . It serves as a counter of the number of messages already signed. (The message number i in the previous sense is j + 1, if j is interpreted as a binary number.)... 

The figure shows the temporary secret key after the first real message, mq q, has been signed. The complete new signature on wq o consists of the encircled nodes. 

Let/ = mj, j, sj, mk , s )). Moreover, as the security definition is in functional notation, whereas Construction 10.13 is algorithmic, let the current value skjemp be redefined in terms of the history, i.e., as the result of applying sign to the messages from m, given the original temporary secret key and the random string from sk. ... 

In the long run, only the one-time temporary secret key skjempi is stored at a Node I, but neither the one-time main public key mki nor the one-time signature sp More precisely, mki / t>e deleted when they are no longer needed in the path of any future signature. Hence, when the coimter j is updated toy + 1, and ify denotes the common prefix ofy andy + 1 (as strings), the values at the nodes below Node y 0 and Sj Q are deleted (but mkj Q not yet). 

However, the real message may be contained in the updated one-time temporary secret key... 

One can interleave Steps 1 and 2 so that one never has to store more than two temporary secret keys. 

If, as usual in such schemes, pk is a function of prek and the original temporary secret key skjemp, one can derive one more lower bound on the secret key. 

Remark 11.18. If a scheme with prekey is given and all the preconditions of Theorem 11.15 hold, and if the public key is a function of the original temporary secret key and the prekey, then... 

---