- "The traversal of the hash chain in reverse corresponds to the way a hash chain is used in the Lamport identification scheme, first revealing $x_{n-1}$, then $x_{n-2}$, and so on, until $x_0$ is revealed at the end. To reverse one-way hash chain efficiently, we use algorithms for [optimal binary pebbling](https://www.win.tue.nl/~berry/pebbling/). This way, we will only use at most $\\lceil k/2\\rceil$ hashes (applications of $f$) in any identification round, while limiting the storage to $k+1$ hash values at any time. \n",
0 commit comments