Conventional Definitions of Fail-Stop Signature Schemes and General Reductions

In this chapter, conventional definitions of fail-stop signature schemes are given and several general properties are proved. 

The actual definition of so-called standard fail-stop signature schemes is contained in Section 7.1. In Section 7.2, relations to alternative or additional security properties are shown. Section 7.3 presents fail-stop signature schemes with prekey, an important subclass, and proves simplified security criteria for them. Section 7.4 shows the relation between standard fail-stop signature schemes and ordinary digital signature schemes. Section 7.5 contains constructions of schemes with many risk bearers from schemes with one risk bearer. 

Previous formal definitions of fail-stop signature schemes [Pfit89, PfWa90, PePf95] were derived bottom-up from the GMR definition of ordinary digital signature schemes with only those extensions that occurred in the constructions, as in Section 3.2. Thus, compared with the general definition, they have all the restrictions listed in Section 6.1.2 and a few more, which seemed too technical to be mentioned there. 

However, the definition is now derived semiformally top-down from the general definition. This should clarify 

Section 7.1.1 explains why one can concentrate on schemes with special risk bearers. The components of the schemes are derived in Section 7.1.2 and summarized formally in Definitions 7.1 to 7.3. The requirements, which are now mixed with considerations of structure and degree of security, are studied in Sections 7.1.3 to 7.1.5. 

---

Conventional Definitions of Fail-Stop Signature Schemes and General Reductions... 

---