Possible and correct invisible signatures in existing schemes

Similar to the situation with fail-stop signature schemes, this construction is not compulsory, important building blocks are bundling functions, and all existing schemes are based on constructions for signing only one message block. For more details, see [ChHP92]. 

As mentioned in Section 6.1.4, the usual method to obtain a non-invisible signature scheme with dual security is to use a fail-stop signature scheme and to identify broken with FALSE. The properties of the only other existing scheme of this type were sketched there, too. 

One really needs a proof of knowledge, and not a better-known proof of language membership, because what the correct signature is cannot be defined relative to the public key and the message It depends on which of the possible secret keys a signer (or her entity) knows. 

Note that only dual security has been achieved, and not a fail-stop property The court s entity cannot distinguish the situation where an attacker shows a random number s, claiming it were an invisible signature, and the signer disavows s , from the situation where the cryptologic assumption has been broken. Hence the court s result is acc = FALSE in both cases, never acc = broken . 

Recall that the recipient is fixed hence his entity can store the counter i. Furthermore, the notion of the i-th fail-stop signature is clearly defined in the fail-stop signature schemes that would be used here (and any fail-stop signature scheme could be modified in this way) Either a scheme with tree authentication would be used or the theoretical construction from [DaPP94], where as many keys have to be prepared as one intends to sign messages. 

---

Figure 6.10. Possible and correct invisible signatures in existing schemes...

---