Initialization for a previously known identity

The most important distinction is that between initialization for a previously known identity and initialization for a newly created identity. Formally, this distinction defines which events have the identity of the signer as a parameter. For compactness, only the more common initialization for a previously known identity has been worked out in detail and is used in all subsequent sections. 

Initialization for a previously known identity means that the identity that the signer will use in authentications and disputes has been defined outside the signature scheme. For instance, it may be a name and address, but also a previously known pseudonym. This type of identity has been assumed in the examples so far. 

The following properties characterize initialization for a previously known identity ... 

However, in practice, the identity is present in the entity under an access point in the form of access to a broadcast channel under this previously known identity (for the time of initialization). For instance, with an ordinary digital signature scheme, the public key is broadcast on this channel inside the system during such an initialization. Similarly, if the system contained an authority that issues key certificates, the entity would need access to a secure channel to the authority under this identity, e.g., via the user who makes a handwritten signature. Note that the entities of all signers still use the same program e.g., they use a particular port for broadcast outputs. 

A broadcast port, which is mainly used for broadcast under the previously known identities in initialization, see Section 5.2.4. 

Proof sketch. The correct entities are those of the court that applies verify and, if special risk bearers are considered, one risk bearer. By the assumed structure of standard fail-stop signature schemes, the court s entity only applies the deterministic algorithms res, test, and verify to information that is known to the attacker. Hence an attacker can simulate all the actions of the court s entity on his own and does not need active attacks on it. (More formally, this could be written as a reduction, as in the previous proof sketch.) The risk bearer s entity only carries out initializations. By the precondition about correct use of initialization, cheating does not count if it involves more than one initialization for the same signer s identity id. Initializations for other identities are completely independent, hence an attacker can simulate them on his own. ... 

This equation provides an appropriate replacement for a second-order time derivative with an explicit expression of the function value at the final time point and a function (17 ) fliat depends on the function value, first derivative and second derivative at the initial time point all of which are assumed to be known from a valid solution previously obtained. This is again identical to the second order time differencing method discussed in Section 10.7 with respect to single variable differential equations. 

---