On Optimal Hash Tree Traversal for Interval Time-Stamping Helger - PowerPoint PPT Presentation

On Optimal Hash Tree Traversal for Interval Time-Stamping Helger Lipmaa Helsinki University of Technology { helger } @tcs.hut.fi http://www.tcs.hut.fi/˜helger ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 1

Overview of the talk • Interval time-stamping • Skewed trees • Hash traversal • Main result: Hash traversal algorithm • Complexity analysis � -sign in the proceedings! Warning: The only ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 2

Overview of the talk • Interval time-stamping • Skewed trees • Hash traversal • Main result: Hash traversal algorithm • Complexity analysis ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 3

Need for time-stamping • To use digital signatures one needs to bind the signatory with the key • PKI • Revocation • Alice may claim that document was signed after revocation of her key • Need to establish temporal relationships ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 4

Time-stamping (classical) Problem given documents X and Y , which one was “stamped” before? • Example: X = signature key revocation, Y = document signed with this key Objective solve this problem for any X and Y ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 5

Time-stamping with graphs [BLLV98] • Use directed acyclic hash graphs with a root • Hash value R of the root is committed ⋆ R = round stamp • Time-stamp of X shows that R depends on X • Return partial time-stamp ( freshness token ) when X has been stamped, and rest after R has been committed ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 6

Time-stamping with T ( d ) x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 7

Time-stamping with T ( d ) x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 • Optimal for conventional time-stamping [BLS00] • Picture corresponds to [BdM93]. [BLS00] scheme is more complicated ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 8

[BdM93] verification x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 • Verify that two paths are consistent • More left = earlier, more right = later ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 9

Need for interval time-stamping • Assume x i is Bob’s signature on some document D i • Time-stamping authority can time-stamp x 1 , x 2 and x 3 := x 1 • If Alice has timestamps of x 1 and x 2 , she thinks that x 1 was stamped earlier • If Alice has timestamps of x 3 = x 1 and x 2 , she thinks that x 2 was stamped earlier • Solution: bind signing time also from above ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 10

Idea of interval time-stamping • Time-stamp a nonce x i := σ • Let x j := Sign Bob ( D, σ ) ( j > i ) • Time-stamp x j • Interval time-stamp = the union of two conventional time-stamps ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 11

Example: interval time-stamping x 0 x 1 x 2 = σ x 3 x 5 x 6 x 7 x 4 = Sign Bob ( D, σ ) • Time-stamp has more elements, binary complete tree T ( d ) is not op- timal ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 12

Overview of the talk • Interval time-stamping • Skewed trees • Hash traversal • Main result: Hash traversal algorithm • Complexity analysis ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 13

Skewed trees w \ d 0 1 2 3 4 0 1 2 3 4 ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 14

Skewed trees • A two-parameter family S ( d, w ) of trees, d, w ≥ 0 • S (0 , w ) = S ( d, 0) = I (singleton) • S ( d, w ) = S ( d − 1 , w − 1) ⊗ S ( d − 1 , w ) for d, w ≥ 0 • Clearly S ( d, w ) = S ( d, d ) = T ( d ) when w > d • [Wil02]: Skewed trees are optimal for interval time-stamping when √ α := w/d ≈ 3 − 5 2 ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 15

Overview of the talk • Interval time-stamping • Skewed trees • Hash traversal • Main result: Hash traversal algorithm • Complexity analysis ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 16

Hash traversal • The elements x 0 , x 1 , . . . arrive in this order • Final objective: compute root hash R • Intermediate objectives: after i steps return the i th freshness token • Question: how to do it efficiently? Wil02 proposed a suboptimal algorithm ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 17

Hash traversal example: S (4 , 2) x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 x 10 • x 0 , x 1 , . . . , arrive in this order • Initially no information ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 18

Hash traversal example: S (4 , 2) x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 x 10 • x 0 has just arrived • The red nodes are stored, but also returned as 0 th freshness token ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 19

Hash traversal example: S (4 , 2) x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 x 10 • x 1 has just arrived • The red nodes are stored, but also returned as 1 st freshness token ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 20

Hash traversal example: S (4 , 2) x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 x 10 • x 2 has just arrived • The red nodes are stored, but also returned as 2 nd freshness token ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 21

Hash traversal example: S (4 , 2) x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 x 10 • x 3 has just arrived • The red nodes are stored, but also returned as 3 rd freshness token • The cyan nodes were already calculated but not anymore stored ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 22

Hash traversal example: S (4 , 2) x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 x 10 • x 4 has just arrived • The red nodes are stored, but also returned as 4 th freshness token • The cyan nodes were already calculated but not anymore stored ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 23

Hash traversal example: S (4 , 2) x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 x 10 • x 5 has just arrived • The red nodes are stored, but also returned as 5 th freshness token • The cyan nodes were already calculated but not anymore stored ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 24

Hash traversal example: S (4 , 2) x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 x 10 • x 6 has just arrived • The red nodes are stored, but also returned as 6 th freshness token • The cyan nodes were already calculated but not anymore stored ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 25

Hash traversal example: S (4 , 2) x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 x 10 • x 7 has just arrived • The red nodes are stored, but also returned as 7 th freshness token • The cyan nodes were already calculated but not anymore stored ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 26

Hash traversal example: S (4 , 2) x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 x 10 • x 8 has just arrived • The red nodes are stored, but also returned as 8 th freshness token • The cyan nodes were already calculated but not anymore stored ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 27

Hash traversal example: S (4 , 2) x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 x 10 • x 9 has just arrived • The red nodes are stored, but also returned as 9 th freshness token • The cyan nodes were already calculated but not anymore stored ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 28

Hash traversal example: S (4 , 2) x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 x 10 • x 10 has just arrived • The red nodes are stored, but also returned as 10 th freshness token • The cyan nodes were already calculated but not anymore stored ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 29

Overview of the talk • Interval time-stamping • Skewed trees • Hash traversal • Main result: Hash traversal algorithm • Complexity analysis ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 30

Algorithm for skewed tree traversal 1 funct initialization ( d, w ) ≡ state := 0; 2 if w > d then w = d fi ; 3 Store w , d ; 4 Create an empty stack of maximum possible size w . 5 7 funct update ( value ) ≡ if state ≥ 2 d then return ( Error !); fi 8 push ( value ); 9 for i := 1 to ntz ( state + 1) do 10 push ( H ( pop () , pop ())); end 11 state := state + (1 < < < ( w h ( state ) − w )) . . 12 ISC02, 02.10.2002 On Optimal Hash Tree Traversal for Interval Time-Stamping (Lipmaa) 31