Exchange Winternitz one-time signatures

Question

Are there any Winternitz alternatives out there which on the one hand make quantum computer attacks hard and on the other hand don't mess with the ability to reuse an address? Or are these properties mutual exclusive? (I can't assess this because I am not a crypto expert)

IOTA uses Winternitz one-time signatures to be more resilient to quantum computer attack vectors. The (in my opinion) very significant downside is the address reuse problem. It forces me to keep an address as a secret which does not feel right.

If for example someone knows my deposit address on Bitfinex he/she can send Iota to this address before or at the same time as me and I may loose my money because the exchange states: "After the first use of a deposit address, subsequent deposits to the same address will not be credited."

While this example may sound constructed it should illustrate the in my opinion questionable design decision of Winternitz usage in Iota.

You win on the security side by being more resilient to an attack vector which is not present as of today but you loose big times by having problems with address reuse which are very real if you think about the huge reclaiming issue.

I guess the whole address reuse issue may be one of the reasons why exchanges are hesitant to list IOTA if you think about the support tickets which arise by users reusing their deposit addresses.

Answer 1

Post-quantum cryptography is a fairly young field, and while there may be post-quantum signature schemes that are not one-time signatures, I don't know of any (feel free to correct me here).

A method to create "reusable" signatures from one-time signatures is the "Merkle signature scheme", which is also used by the Coordinator to sign its milestones. The disadvantage of that scheme is that you still need to specify an upper bound how often you want to sign with your key pair, and creation of a keypair is computationally expensive - noticably slower than single Winternitz signatures (and gets slower if you choose a higher upper bound).

Answer 2

Just to clarify you are not forced to keep the addresses as secrets.

Anytime somebody has to pay you, he/she has to ask you an address and you have to give him/her a new one.

The problem arises in case someone pays you on an address you already used to pay someone else.

So the only downsize of using quantum resistant Winternitz OTS is that the payers have always to ask to the receivers the address to be used for the payment.