Acceptable signature

In the information-theoretic sense, an attacker can always compute the set of the acceptable signatures on a message m (for the same reason as forging ordinary digital signatures cannot be harder than NP, see Section 2.3). The new feature is Even a computationally unrestricted attacker does not have sufficient information to determine which of the many acceptable signatures is the correct one. 

Regarding two different acceptable signatures on the same message (and for the same public key) as a proof that the scheme has been broken is sound because it was assumed that the signer herself can compute only one acceptable signature, unless she breaks the cryptologic assumption. 

The construction sketched above is only the simplest case in particular, the signer may know more than one secret key and more than one acceptable signature. Two examples show this. As a starting point, assume that a secure fail-stop signature scheme according to the construction above is given. 

Any value s that passes this test is called an acceptable signature on m (see Figure 6.6). This notion can be used more generally than that of a correct signature, because it only depends on the public value pk. 

The algorithm prove is primarily intended to he used on acceptable signatures. However, the general definition yields more convenient notation. If 5 is not an acceptable signature, the output is usually not a forgery. 

This set is relevant because an attacker can only cheat successfully by producing an acceptable signature on a message not in this set. 

The forger F is successful if m is none of the previously signed messages and s is an acceptable signature on m. 

For this, the parts 5,- of s must be acceptable signatures for the partial public keys pki that are actually used, and at least one value f = (m, Sj) must be unprovable. As in Part e), acc = TRUE and i e idsgi jg g, t imply acc,- = TRUE. 

Test If the public key is pk = (prek, mk) with prek and mk of the form described above, a value 5 is an acceptable signature on the message block m if and only if... 

It must have at least 2 acceptable signatures otherwise the correct signature could be guessed with a too high probability by a computationally unrestricted attacker. 

For unforgeability, it must be infeasible for a computationally restricted attacker to find acceptable signatures at all. Thus the density of the set of acceptable signatures within the signature space should be small, e.g., at most 2 for some <7. ... 

The following lemma formalizes Statement 2 from the overview. The fact that the number of acceptable signatures, given the public key, is much smaller than the complete signature space is generalized as follows The public key contains a lot of information about the correct signature. 

Acceptance signature confirming understanding of work to be done, hazards Involved and precautions required. Also confirming permit Information has been explained to all workers Involved. 10 Acceptance... 

This is the formal process for obtaining a risk acceptance signature from the Risk Acceptance Authority (RAA) for a hazard. The process involves analysis, risk assessment, risk mitigation, coordination, and documentation. The RAP... 

---