Full fail-stop signature scheme

In this subsection, a weaker version of the fail-stop property is explained. In the notation of Section 5.2.3, it yields a signature-like scheme with accountable centres. Such schemes are called fail-stop signature schemes with special risk hearers. Where a distinction is necessary, the real signature schemes with a fail-stop property as described above are called full fail-stop signature schemes, and their property a full fail-stop property. 

The following requirements are stronger than the minimal ones for signature-like schemes with accountable centres. In particular, effectiveness of authentication is required even if all risk bearers are dishonest this is needed when schemes with one risk bearer are used as building blocks for full fail-stop signature schemes. 

If an algorithm from the following definitions is carried out in entities of both risk bearers and another role (e.g., the algorithm res below), one can of course construct the combined entity more efficiently. To formalize such details, one needs the omitted definition of full fail-stop signature schemes. 

The requirements are now considered one by one. The two original requirements on disputes from Section 5.2.7 can be omitted According to Section 5.2.9, Combinations , they follow from the fall-back requirements on disputes and the correctness of broken in full fail-stop signature schemes, and in the case with special risk bearers as accountable centres, they were omitted on purpose. 

Lemma 7.8. A secure full standard fail-stop signature scheme, i.e., one that fulfils all the minimal requirements, also fulfils the strong requirement of the signer on disputes computationally. ... 

Full standard fail-stop signature schemes themselves provide ordinary security if the output broken in disputes is replaced with TRUE. The same holds for schemes with special risk bearers if the signer plays the role of a risk bearer, too. 

This section sketches how standard fail-stop signature schemes with many risk bearers can be constructed from standard fail-stop signature schemes with only one risk bearer. Recall that this also yields constructions of full standard fail-stop signature schemes (see Section 7.1.1). 

---