Message block

Shown scheme defines strengthened stream ciphering and authentication mode. This mode is similar to previous mode but has one distinction—the feedback value N, depends on the message block too. As a result the current internal state depends on all processed plaintext blocks. 

We can view this mode as combination of the Counter mode and the Cipher Feedback mode (CTR+CFB). After processing all message blocks the cipher internal state (.S, ) depends linearly on the last block and non-linearly on all other message blocks (Mi), encryption key (K) and initialization vector (IV). In order to get Message Authentication Code (MAC) it is necessary to perform yet one blank encryption. The obtained base cipher output block or its part can be used as MAC. 

SLIP (serial-line Internet protocol) SMB (server message block)... 

Each existing scheme is based on a construction for signing one message block. However, the block size usually depends on a security parameter hence these subprotocols are not signature schemes for a certain given message space in the sense of Chapter 5 (cf. Section 9.1). 

Schemes without further attributes allow all bit strings to be authenticated. There is not so much efficiency to be gained by restricting the message space as in old fail-stop signature schemes anyway. But again, all existing schemes are based on constructions for short message blocks.

If the desired message space M consists of short messages only, one has to define embeddings of M into the sequence of message-block spaces given by the first step of the construction. 

Many variations and combinations of the basic types of tree authentication are conceivable. Some are presented and compared in [Wilh94]. Furthermore, efficiency improvements exist that exploit special properties of the underlying scheme for signing one message block, see Section 10.5. 

The complexity of the most efficient schemes for signing one message block is almost as low as that of efficient ordinary digital signature schemes. The same holds if message hashing is added. (Note that this subsection assumes a fixed risk bearer or any other version that has the same effect on the efficiency of authentication, cf. Figure 6.2.)... 

Similar to the situation with fail-stop signature schemes, this construction is not compulsory, important building blocks are bundling functions, and all existing schemes are based on constructions for signing only one message block. For more details, see [ChHP92]. 

The chapter concentrates on efficient schemes where a whole message block is signed at once. Constructions with bit-by-bit signing are not presented they were all mentioned in Section 6.1.2, Cryptologic Assumptions and Efficiency . 

All the following constructions yield schemes with prekey, and the message blocks that can be signed only depend on the prekey prek, i.e., one can use message-block spaces Hence only this case is defined. First, the definitions... 

Definition 9.1. A standard fail-stop signature scheme with prekey for signing message blocks is defined like a standard fail-stop signature scheme with prekey, except that there is no fixed message space M. Instead, there is a family of message-block spaces... 

Remark 9.2. One could adapt the original security definitions (Definition 7.15) in a similar way to message-block spaces Mpj and prove an analogue of Theorem 7.34, i.e., that the simplified security criteria imply the original ones. ... 

In this section, a framework for constructing standard fail-stop signature schemes with prekey for signing one message block from a collision-intractable family of bundling homomorphisms is described. Two parameters (the exact family of... 

A fannily MFam of message-block spaces consisting of integers, parametrized by... 

Message-block spaces For each prek = ( 1 , 1 , AO e All, the message-block space is simply Mig a,K fro i f e underlying family MFam. 

Theorem 9.9. Construction 9.4 yields a secure standard fail-stop signature scheme with prekey for signing one message block if the following condition holds for the parameters BundFam, MFam, and tau (i.e., the family of bundling homo-morphisms, the message-block spaces, and the function that determines the bun-... 

In this section, an efficient standard fail-stop signature scheme with prekey for signing one message block is shown where the security for the risk bearer can be proved on the abstract discrete-logarithm assumption. Recall that this scheme (for subgroups of prime fields) is due to [HePe93]. 

Message-block spaces For a prekey prek = (q,p, g, g ), the message-block... 

---