Dependence of authentication on the recipient

Notation for requirements. The concrete relations in all existing schemes are fairly simple see Section 5.2.8, Dependence of Authentication on the Recipient , and the requirements are at present formalized as simply as possible in this respect. The following restrictions are made ... 

Dependence of authentication on the recipients deals with the input parameters ids and their precise domains in certain situations. As mentioned before, the cases that actually occur in the literature are all rather simple. 

Schemes with more than one recipient per initialization (see Section 5.2.10, Dependence of Authentication on the Recipients ) are almost always memoryless at least, testing a new message must work no matter whether the earlier messages from the same signer had the same recipient or not. Similarly, courts are almost always memory-less . In contrast, the efficiency of schemes with fixed recipient or one recipient per initialization can often be improved by giving up memory-less receiving (see [FoPf91] or Section 10.6).

The second service property in which existing fail-stop signature schemes differ is the dependence of authentication on the recipients (see Section 5.2.10). This classification is independent of that according to risk bearers. However, the cases... 

Recipient known in authentication. This means that the parameters idsji ign are 1-element subsets of ids t of the corresponding initialization. Such inputs can be useful if signers have some recipients to whom they send many authenticated messages, because some of the efficiency improvements for fixed recipients can be applied dynamically [FoPf91]. In these cases, the disputes do not depend on the recipient, i.e., idsg g = ids h. = Any. 

As there is no dependence on the recipient, the entity of a recipient can test any signature even if the signer has given many signatures to other recipients before. Hence its actions in authentication have at least a special case where no information has been changed since initialization, i.e., where the parameters of test are only the message and the public key. This is the case the court s entity can use. 

Transfers in all existing signature schemes with arbitrary or finite transferability are non-interactive. Most of them are with non-interactive authentication, too, and in the transfer, the original signature is simply passed on. Only the test carried out by the recipient s entity depends on the acceptance level i in signature schemes with finite transferability. 

Entities of recipients cannot be memory-less in the same sense as entities of signers, because they must store some information about each authenticated message they have received in case of disputes. Hence, memory-less receiving is used to denote that the actions of the recipient s entity in authentication do not depend on previous authentications and disputes. 

---