Re: How to construct such one-way key chain without hash function

You could let F() be any trapdoor one-way permutation.
I'm trying to use DL follow your instructions. As to ElGamal scheme,
(g^r, (g^x)^r *m)
every encryption needs a fresh exponent r and keep it in secret. If
it's a constant and
known to the public, how to retain the one-way charateristic?



For instance,
F(x) = x^2 (mod N), where N=PQ is a Blum integer (P,Q = 3 (mod 4)) whose
factorization is known only to the authority. I would recommend using
SHA1(K_i) as the i-th key, instead of using K_i directly.

to use SHA1 here is for CCA security, right?

However, I insist on constructing it without any hash , since I need to
keep
the algebraic charateristic of K_i for further processing.

In someway, I'd like the scheme could follow this condition:
E_{K_i+j}(M)= A_e( E_{K_i}{M}, j) for i,j >=0
E is the encryption algorithm, A is function, e is public known
parameter

.