Subject: [Cfrg] draft-mcgrew-hash-sigs question on the definition of one time

From: Jim Schaad <[email-masked]>
Date: Sun, 29 Apr 2018 13:16:51 -0700

I am doing a quick review of a draft dealing with LM-OTS One-Time signatures
and I have run into a problem.  Either my definition of one time is wrong or
there appears to be an error in the draft.  Before trying to do a deep read
of this document I would like to get a clarification.

The last sentence of paragraph 1 of section 4 says

These are one-time signatures; each private key MUST be used at most one
time to sign any given message.

Is this "at most one time to sign" or "at most one time to sign a given
message".  That is don't re-sign the same message but a new message (for
some definition of new) is ok.

Jim

---

From: Russ Housley <[email-masked]>
Date: Sun, 29 Apr 2018 16:26:33 -0400

Jim:

It can be use zero or one time.

Russ

> On Apr 29, 2018, at 4:16 PM, Jim Schaad <[email-masked]> wrote:
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg

---

From: Dan Brown <[email-masked]>
Date: Sun, 29 Apr 2018 21:52:11 +0000

Two different signatures (of same or different message) with one public key make forgery feasible against that public key.

Sent from my BlackBerry 10 smartphone on the Rogers network.
  Original Message
From: Jim Schaad
Sent: Sunday, April 29, 2018 4:17 PM
To: [email-masked]
Cc: [email-masked]
Subject: [Cfrg] draft-mcgrew-hash-sigs question on the definition of one time

Jim