Invisible Signature Schemes with Dual Security

In the following, these properties are taken for granted hence the name dual invisible signature scheme is restricted to schemes with these properties. 

The main variation is in the dependence on the recipients. Their role is similar to that of the risk bearers in fail-stop signature schemes To guarantee computational security for each recipient, even if many other participants are attacking, the entities of all recipients must take part in initialization. Hence initialization is much simpler if it is for a fixed recipient. 

The structure of authentication and disputes in existing dual invisible signature schemes resembles that of existing invisible signature schemes with ordinary security, not that of fail-stop signature schemes. The protocol carried out during authentication is of the following restricted form  

In the first round, the entity of the signer sends a value to the entity of the recipient. This value is called the invisible signature, and it is the only value that the recipient s entity stores. 

The recipient s entity sends the invisible signature to the court s entity, who passes it on to the signer s entity. 

---

Invisible Signature Schemes with Dual Security... 

As mentioned in Section 6.1.4, the usual method to obtain a non-invisible signature scheme with dual security is to use a fail-stop signature scheme and to identify broken with FALSE. The properties of the only other existing scheme of this type were sketched there, too. 

---