Breaking Down the Minimal Requirements

The requirements are now considered one by one. The two original requirements on disputes from Section 5.2.7 can be omitted According to Section 5.2.9, Combinations , they follow from the fall-back requirements on disputes and the correctness of broken in full fail-stop signature schemes, and in the case with special risk bearers as accountable centres, they were omitted on purpose. 

The fail-back requirement of the recipient on disputes is that once the recipient has accepted a message m as authenticated by a signer, a court in a dispute about this message should obtain a result acc TRUE, broken .  

Note that the proof cannot be formalized with the components defined in Section 7.1.2, because it only deals with their assumed use in the entities in the sense of Chapter 5. 

Proof sketch of Lemma 7.4. The recipient s entity only accepts m as authenticated by a signer id if test(pk, m, j) = TRUE, where pk is a public key from a successful initialization under the identity ids- The only step of a dispute where the court s entity can output a result other than TRUE or broken is Step 2, and then only if test(pk, m, s ) = FALSE, where pk and s are what tlie court s entity regards as the public key belonging to idg and the signature. This cannot happen if pk = pk and 5 = s, because test is deterministic. As s has been received directly from the recipient s entity on a reliable channel, s = j is clear. Furthermore, there is a precondition that exactly one initialization under the identity id has been carried 

---