Concentrating on Schemes with Special Risk Bearers

The following sections concentrate on standard fail-stop signature schemes with special risk bearers. In particular, the formal versions of the definitions and constructions are only presented for such schemes. 

One reason is that the formal definitions of fiill fail-stop signature schemes can be derived from the informal discussions just like those with special risk bearers. 

The other reason is that, as mentioned in Section 5.2.9, a fiill fail-stop signature scheme is closely related to a scheme with special risk bearers where each user who acts as a signer, recipient, or court, also has a risk bearer s access point available. In fact, if a scheme is given where an arbitrary number of risk bearers can take part, one can constract a fiill fail-stop signature scheme as follows Each entity of the new scheme consists of two parts one part acts like a risk bearer s entity and the other like an entity of a signer, recipient, or court, respectively, from the underlying scheme. As risk bearers entities only take part in initialization, this only concerns the program parts for initialization (if those can be identified statically). The outer parts of all entities must handle the fact that the two parts share their ports. 

If an algorithm from the following definitions is carried out in entities of both risk bearers and another role (e.g., the algorithm res below), one can of course construct the combined entity more efficiently. To formalize such details, one needs the omitted definition of full fail-stop signature schemes. 

The case with one risk bearer is given special attention. First, it is particularly simple. Secondly, as mentioned in Section 6.1.2, all existing fail-stop signature schemes are based on constructions with only one risk bearer hence a special definition simplifies the proofs of these constructions. Thirdly, only this case was treated in previous definitions, and it should become clear how those definitions are related to the ones given here. 

---

Section 7.1.1 explains why one can concentrate on schemes with special risk bearers. The components of the schemes are derived in Section 7.1.2 and summarized formally in Definitions 7.1 to 7.3. The requirements, which are now mixed with considerations of structure and degree of security, are studied in Sections 7.1.3 to 7.1.5. 

---