Possible secret key

In schemes where secret keys and public keys exist, this implies that many possible secret keys correspond to the same public key, see Figure 6.5. That a secret key sk and a public key pk correspond to each other means that the pair (sk, pk) is a possible outcome of key generation. 

First, each secret key is augmented by a random bit at the end. Everything else remains unchanged. The security of the scheme is obviously unaffected, and the signer knows two possible secret keys for each public key. 

One really needs a proof of knowledge, and not a better-known proof of language membership, because what the correct signature is cannot be defined relative to the public key and the message It depends on which of the possible secret keys a signer (or her entity) knows. 

Definition 7.16. The set of possible secret keys, given the strategy B that the attacker used in key generation and values par, pub, auxg, and hist, is defined as follows ... 

E. Formula (6) remains to be shown. Informally, this means If the forger has obtained a certain history, and then looks at the possible secret keys, obtaining exactly this history was equally probable for all of them. The only really intuitive meaning of this fact is that it implies (5), i.e., it implies that the a-posteriori... 

Secondly, one needs to know for how many possible secret keys the forged signature s is correct, i.e., how many pairs (5kj, 5 2) satisfy the equation... 

In contrast to the proof of Theorem 10.14, the probability cannot simply be partitioned into those for the individual one-time keys, because there is the encryption with the same key e. Hence the possible secret keys are counted as in the proof of Lemma 9.7. Only the worst case is considered where the attacker has maximal information about the secret key, i.e., where m is of maximal length N and hence a one-time signature s on a message m has already been issued at every... 

Denote the corresponding hash values by w = possible secret keys sk by (e, where sk is the family of the values sk at all nodes... 

The conditions about a certain sk given by the values mk, m, and contained in auth are the same as in Formulas (1) and (3) of Lemma 9.7. Hence the set of the possible secret keys that fulfil the condition of the probability in ( ) is... 

Secondly, one needs to know for how many possible secret keys the forged one-time signature j/ is correct, i.e., how many of them satisfy the equation sign iski, fh i) = si from ( ). This is just a one-time signature at Node / and equivalent to Equation (5) in the proof of Lemma 9.7. Hence the number of... 

It is now shown that the equation sign (sk,j, m ) = s from ( ) holds for at most one out of these possible secret keys (i.e., the forged signature is correct for at most... 

Melanin granules are secreted by melanocytes in the hair papilla and distributed to keratin in the hair cortex and inner layers of the hair sheath during normal development. Melanogenesis is subject to hormonal control and has been the focus of intensive genetic studies. Two main forms of melanin exist in human skin—eumelanin and phaeomelanin, both of which are derived from tyrosine through the action of tyrosinase (a cupro-enzyme) and possibly other key enzymes (with nickel, chromium, iron, and manganese as cofactors). Tyrosine is converted to dihydroxyphenylalanine and, via a series of intermediate steps, to indole-5,6-quinone, which polymerizes to eumelanin. Phaeomelanins are produced by a similar mechanism but with the incorporation of sulfur (as cysteine) by a nonenzymatic step in the oxidation process. 

Separation of users and entities. The separation between users and their entities in this framework is useful here, because it automatically excludes some particularly stupid user behaviour. For instance, one would otherwise have to explicitly exclude honest users that tell the attacker their secret keys, because no signature scheme could possibly protect them. Now, the formal users simply have no access to the secret information in the entities. This is a reasonable restriction e.g., we have no idea what letters a user writes, but her letters might be expected to be independent of the implementation of the signature scheme. 

The set of possible histories, given a secret key sk and a message bound N, is... 

In a key distribution center (KDC) solution, a key distribution center shares a secret key with all participants and is trusted to communicate keys from one user to another. If Alice wants to exchange a key with Bob, she asks the KDC to choose a key for Alice and Bob to use and send it securely to each of them. While it may be possible to have such solutions within a particular business, they do not scale well to large systems or systems that cross administrative boundaries. 

---