Replication of initialization

The idea of the first construction is that each risk bearer s entity executes the original protocol Gen with the signer s entity once, and all the resulting keys are used in parallel. This constmction is conceptually simple and leads to a feasible initialization protocol. Its disadvantage is that the resulting keys are long, and the complexity of authentication and disputes grows linearly with the number of risk bearers. 

Construction 7.38. Let the components of a secure standard fail-stop signature scheme with one risk bearer be given. The components of a scheme with an arbitrary number of risk bearers (for the same message space and the same message bounds) are constructed as follows. They are written with an asterisk to distinguish them from the components of the underlying scheme. 

In the f-th phase, the entities of the signer and the i-th risk bearer execute Genipar), where par = ( 1 , 1 , 1 ) with a = a + riog2(B)l (Recall that each risk bearer s entity has its internal identity, / e 1,. .., R], as an input 

The whole initialization is successful iff the signer has never been caught cheating and at least one of the risk bearers has taken part successfully. For this, define Boolean values idssig out,i be TRUE iff the signer was not caught cheating in the i-th phase, i.e., 

The keys consist of all the partial keys from the successful phases If acc = FALSE, then pk = sk temp = e, and otherwise 

---

From this discussion, one very important point with practical consequences emerges. This concerns the use of replicate experiments. If no replicate experiments are performed, it is not possible to define the basic error of the measurements, i.e. the distribution of the individual rate coefficients of replicate experiments about their means. In terms of our previous expression for F, the lack of replicate experiments means that there are as many groups as there are experiments in the set (I. e. u = r) and so any value of F is consistent with the whole set being homogeneous the scatter of the rate coefficients about the set mean merely defines the variance of the distribution of a rate coefficient of unit weight. It is clear that replication of initial conditions is highly desirable. 

---