Formal Security Definitions

In this section, those security definitions are formalized that were semiformally shown to be sufficient in the two previous sections. They are made in the order of increasing complexity (determined by the number of transactions to be considered), which is inverse to the order in which they were considered so far. Hence, after some notation, there are definitions of 

some notation about the execution of the key-generation protocol Gen with attackers is defined. Most of it is the usual notation for 2-party protocols with attackers. 

Attacker strategies replacing A or are called A and B, respectively. The resulting protocols if the other algorithm and res are still correct are denoted by 

Gen B and Geri/ g. These protocols are executed like correct 2-party protocols by 

The probability spaces defined by protocol executions with given parameters are 

---

Note that the functional notation does not treat the case i > N. The following formal security definitions implicitly take Property c) from Definition 7.1 for granted, i.e., they do not treat what a signer s entity might do in authentications after the message bound has been reached, because it does not do anything. 

A second step was to formalize security not only as the infeasibility of computing the inverse of a function. Instead, the definition must comprise an active attack and exclude existential forgery. 

Assuming the formal details in all the previous sections were filled in, all ingredients would now be ready for the definition of a security semantics for the type of specification introduced in Sections 5.2.1 and 5.2.6. In particular, the probability spaces where the error probabilities are defined would be clear, and approximately how the quantifiers are placed in the security definitions. To show that this is indeed so. 

Section 7.1.1 explains why one can concentrate on schemes with special risk bearers. The components of the schemes are derived in Section 7.1.2 and summarized formally in Definitions 7.1 to 7.3. The requirements, which are now mixed with considerations of structure and degree of security, are studied in Sections 7.1.3 to 7.1.5. 

It was sketched in Section 5.4.4 that unforgeability is a consequence of the other requirements. This will be proved formally for standard fail-stop signature schemes below. Unforgeability is therefore not a part of the definition of a secure standard fail-stop signature scheme, but it will be formalized in Definition 7.22. 

The denunciation of persons as witches, their examination for witch s marks, and their torture to extract confessions, served only to secure their formal, legal definition as witches and to justify their sentencing, usually to death by burning at the stake. We are now ready to examine the witch trial and compare it with contemporary legal proceedings to establish a person s status as mentally ill. 

This definition needs some explanation. The viewpoints mentioned in it represent the stakeholders concerns about the system (the trustee) under consideration. A viewpoint can represent an individual user who decides about involving herself/himself in the co-operation with the system depending on its trustworthiness (consider for instance e-commerce or e-health applications) or can represent a class of users. An example of a latter is a non-profit institution which assesses a given Web service on behalf of its users (this is what Health On the Net foundation [1] does for the users of e-health services). A viewpoint can be highly formalized, for instance in the situation where the criteria to be met by the trust case (to consider it satisfactory) are documented and supported by regulations (like in the case for safety critical applications [2]) or are documented and widely accepted (which is the case for security critical systems [3]). For some viewpoints satisfactory may mean convincing and valid whereas for some other satisfactory may have more subjective interpretation. 

It would be more systematic to use this name for all signature schemes with fail-stop security. But it would be awkward to list all additional properties in the name of each type of scheme, and this use of the term is nearer to previous formal definitions of fail-stop signature schemes. 

Of course, a many-one relation between secret and public information is not sufficient for security but once one has a formal definition, one can formally prove that it is necessary. However, this is not completely trivial The security for the signer need not be violated in every single case where the secret information in her entity can be guessed. A formal treatment for a standard case of fail-stop signature schemes can be seen in Section 11.3. 

It was sketched under Figure 5.12 and at the end of Section 5.4.3 that fail-stop security is stronger than ordinary security. This is now shown formally for the conventional definition of standard fail-stop signature schemes. Actually, two statements are shown ... 

Proof sketch. The implicit and explicit requirements from Definitions 7.1 and 7.31 and the property to be polynomial-time in the interface inputs alone are easy to see. Among the criteria from Theorem 7.34, effectiveness of authentication is easily derived from that in the one-time scheme, and the security for the risk bearer is completely identical to that in the underlying one-time scheme. (Recall that the fact that the signer s entity bases many one-time key pairs on the same prekey makes no formal difference at all in Criterion 2 of Theorem 7.34.)... 

---