On fast verification of hash chains

Abstract

A hash chain H for a hash function hash(•) is a sequence of hash values 〈xn, xn - 1,..., x0〉, where x0 is a secret value, xi is generated by xi = hash(xi - 1) for 1 ≤ i ≤ n, and xn is a public value. Hash values of H are disclosed gradually from xn - 1 to x 0. The correctness of a disclosed hash value xi can be verified by checking the equation xn =? hashn - i (x i. To speed up the verification, Fischlin introduced a check-bit scheme at CT-RSA 2004. The basic idea of the check-bit scheme is to output some extra information cb, called a check-bit vector, in addition to the public value xn, which allows each verifier to perform only a fraction of the original work according to his or her own security level. We revisit the Fischlin's check-bit scheme and show that the length of the check-bit vector cb can be reduced nearly by half. The reduced length of cb is close to the theoretic lower bound. © 2010 Springer-Verlag.