Cryptology ePrint Archive: Report 2014/329

Explicit Optimal Binary Pebbling for One-Way Hash Chain Reversal

Berry Schoenmakers

Abstract: We present explicit optimal binary pebbling algorithms for reversing one-way hash chains. For a hash chain of length $2^k$, the number of hashes performed in each output round does not exceed $\lceil \tfrac{k}{2}\rceil$, whereas the number of hash values stored throughout is at most $k$. This is optimal for binary pebbling algorithms characterized by the property that the midpoint of the hash chain is computed just once and stored until it is output, and that this property applies recursively to both halves of the hash chain.

We introduce a framework for rigorous comparison of explicit binary pebbling algorithms, including simple speed-1 binary pebbles, Jakobsson's binary speed-2 pebbles, and our optimal binary pebbles. Explicit schedules describe for each pebble exactly how many hashes need to be performed in each round. The optimal schedule exhibits a nice recursive structure, which allows for fully optimized implementations that can readily be deployed. In particular, we develop the first {\em in-place} implementations with minimal storage overhead (essentially, storing only hash values), and fast implementations with minimal computational overhead. Moreover, we show that our approach is not limited to hash chains of length $n=2^k$, but accommodates hash chains of arbitrary length $n\geq1$, without incurring any overhead.

Category / Keywords: public-key cryptography / hash chains, pebbling, in-place algorithms, lightweight cryptography, post-quantum cryptography, hash-based signatures, one-way function

Date: received 11 May 2014, last revised 24 Nov 2015

Contact author: berry at win tue nl

Available format(s): PDF | BibTeX Citation

Note: Sample code available at

Version: 20151124:125855 (All versions of this report)

Short URL:

Discussion forum: Show discussion | Start new discussion

[ Cryptology ePrint archive ]