Breaking Down Additional Service Properties

Before the requirements that remain from Section 7.1.3 are formalized, the additional service properties that standard fail-stop signature schemes should have according to Section 6.1.2 are considered. It turns out that most of these requirements are automatically fulfilled according to the assumed structure of the entities around the algorithms from Definition 7.1 or 7.2, respectively. The only remaining one, the strong requirement of the signer on disputes in the case with special risk bearers, can be fulfilled by similar structural measures. 

As mentioned in Section 5.2.9, Combinations , it is usefiil in practice to add the strong requirement of the signer on disputes for the degree low to the minimal requirements. This means that on a computational assumption, the following is required even if the signer does not take part in a dispute  

Lemma 7.8. A secure full standard fail-stop signature scheme, i.e., one that fulfils all the minimal requirements, also fulfils the strong requirement of the signer on disputes computationally.  

Hence the strong requirement of the signer on disputes is not mentioned again. 

Arbitrary transferability is easy to achieve as a consequence of the existence of public keys and non-interactive authentication The entity of the former recipient of a signed message can simply pass the signature on, and the entity of the new recipient tests it with the normal algorithm test. (Signatures had to be stored anyway in case of disputes.) The effectiveness of transfers, i.e., the requirement that the new recipient should accept the signature, is guaranteed information-theoretically without error probability because both entities have the same public key. 

---