Correctness of initialization

Correctness of initialization is a joint requirement of an arbitrary set of participants They want to obtain a consistent view about an initialization, even if the signer cheats and initialization is unsuccessful. 

While effectiveness of authentication can only be required if the signer is in the interest group, arbitrary interest groups require correctness of initialization If they take part in an initialization correctly (defined as above), it is required that... 

The first property implies the consistency part of the correctness of initialization. 

In Section 5.2.9, it was mentioned that effectiveness of initialization need not be required explicitly for fail-stop signature schemes with special risk bearers. It is now sketched that correctness of initialization indeed implies effectiveness of initialization in these schemes. 

It has to be shown that an initialization yields acc = TRUE if the signer, a recipient or court, and a risk bearer are honest. First, correctness of initialization in the interest of the signer and the recipient or court means that either acc = TRUE or Risk,oui - 0- Secondly, 0 follows from the correctness of initial-... 

This requirement need not be formalized, because in the case with risk bearers it follows from the correctness of initialization, as sketched in Section 5.4.4, and according to Section 7.1.1, only this case is formalized. 

Correctness of initialization can easily be translated into the results of the protocol Gen. 

Definition 7.9. A standard fail-stop signature scheme provides correctness of initialization if it has the following properties. For all probabilistic interactive functions A and B and all parameters par according to Definition 7.1 or 7.2, respectively ... 

Moreover, note that Theorem 7.34 says that correctness of initialization no longer has to be required explicitly. 

For the signer The correctness of initialization in the underlying scheme implies for each phase that either ucc,- = TRUE or... 

To apply a multi-party function evaluation protocol to key generation, which is an interactive protocol, it is usefiil to regard Gen as one probabilistic function. This has implicitly been done all the time Gen maps values par to tuples acc, idspi h- f, pk, sk temp). Hence a trusted host performing the entire key generation, i.e.. A, B, and res, will be simulated. The correctness of initialization implies that acc and idsout always TRUE and 1), respectively, in this case. Hence one can omit them. The trusted host would tell the signer s entity both sk and pk, and the other entities obtain pk only. 

If the prekey is locally verifiable, one can consider letting the entities of the risk bearers carry out the prekey generation without the signer s entity, because the signer s entity can verify the correctness of the prekey afterwards. This may be worth while if one wants to use the same prekey for all signers, as in Remark 7.36. However, one must take some care to fulfil effectiveness and correctness of initialization. 

Now, however, there is an exponentially small error probability in the information-theoretic correctness of initialization in the interest of risk bearers. This was not permitted in Definition 7.9, but it could be permitted according to the general definition in Chapter 5. 

Correctness of initialization (Definition 7.9) implies that the condition acc = TRUE can be omitted in ( ). 

---