Constructions with Many Risk Bearers

This section sketches how standard fail-stop signature schemes with many risk bearers can be constructed from standard fail-stop signature schemes with only one risk bearer. Recall that this also yields constructions of full standard fail-stop signature schemes (see Section 7.1.1). 

The properties of the following two constructions were already mentioned in Section 6.1.2, Number of Risk Bearers and Complexity of Initialization and Cryptologic Assumptions and Efficiency . Both constructions are general, i.e., they can be applied to arbitrary schemes. More efficient constructions are possible in special cases see Section 7.5.2, Special Versions , and Remark 9.16. (It is not even necessary that schemes with many risk bearers are constructed from schemes with one risk bearer at all, although all existing constructions are.) 

---

The actual definition of so-called standard fail-stop signature schemes is contained in Section 7.1. In Section 7.2, relations to alternative or additional security properties are shown. Section 7.3 presents fail-stop signature schemes with prekey, an important subclass, and proves simplified security criteria for them. Section 7.4 shows the relation between standard fail-stop signature schemes and ordinary digital signature schemes. Section 7.5 contains constructions of schemes with many risk bearers from schemes with one risk bearer. 

If there are many risk bearers, initialization can be much more complex. However, all existing fail-stop signature schemes are based on a construction with only one risk bearer, and the additional measures to accommodate several risk bearers are very similar for aU these constructions, see Section 7.5. (Sketches were contained in [Pfit89, PfWa90].)... 

---