Requirements on Digital Signature Schemes

The main security requirement on such a digital signature scheme is, roughly speaking, that one cannot forge signatures although one knows the public key. A necessary (but not sufficient) condition for this is that one cannot compute the secret key from the public key. 

These security types are mainly treated in Section 5.4.3. With the ordinary type of security, known from ordinary digital signature schemes, the requirement of the recipient on disputes is guaranteed with the high degree of security, whereas the court may wrongly decide for the recipient in extreme situations. To its right, a type of security dual to ordinary security is shown. 

Ordinary security is the type of security that ordinary digital signature schemes offer The requirement of the signer on disputes is fulfilled computationally only, that of the recipient information-theoretically, and there is no fail-stop property. If transferability is required, the effectiveness of transfers also holds information-theoretically. 

The only other formal security requirement on standard ordinary digital signature schemes is unforgeability. It follows immediately from Theorem 7.24 and Remark 7.23. ... 

---