Previously signed message

The forger F is successful if m is none of the previously signed messages and s is an acceptable signature on m. 

There are schemes where a new signature depends on the number of previously authenticated messages hence there is no reason to exclude that it depends on further local variables. Thus arbitrary local variables may have to be passed between different executions of the subprogram for signing within one entity. 

In previous definitions, the only active attacks were that the attacker makes the signer s entity sign messages. 

Main key generation is almost identical to that of the one-time scheme A one-time key pair (sk temp, mk) based on prek is chosen, mk is the main public key, and the main public key test is identical. The temporary secret key in the new scheme is sk temp = (sk temp, par, prek,j), where par are the parameters, as usual, and j is a string initialized with d zeros, where N = 2 . It serves as a counter of the number of messages already signed. (The message number i in the previous sense is j + 1, if j is interpreted as a binary number.)... 

In the constructions in the previous two sections, the length of the secret key is linear in the message bound, i.e., the number of messages to be signed. It is shown in Chapter 11 that this cannot be avoided if one defines secret key in the functional way of Definition 7.3a, i.e., including all the secret random bits that the signer s entity ever uses. 

---