Fast Verification of Hash Chains with Reduced Storage

Abstract

A hash chain H for a hash function hash(.) is a sequence of hash values < x(n), x(n-1), ..., x(0)>, where x(0) is a secret value, x(i) is generated by x(i) = hash(x(i-1)) for 1 <= i <= n, and x(n) is a public value. Hash values of H are disclosed gradually from x(n-1) to x(0). The correctness of a disclosed hash value x(i) can be verified by checking the equation x(n) =(?) hash(n-i)(x(i)). To speed up the verification, Fischlin introduced a check-bit scheme at CT-RSA 2004. The basic idea of the check-bit scheme is to output some extra information cb, called a check-bit vector, in addition to the public value x(n), which allows each verifier to perform only a fraction of the original work according to his or her own security level. We revisit the Fischlin&apos;s check-bit scheme and show that the length of the check-bit vector cb can be reduced nearly by half. The reduced length of cb is close to the theoretic lower bound.