The Case of a Fixed Recipient

In the case with a fixed recipient, efficiency can be improved significantly, because the recipient s entity can store information from previously received signatures. 

If a court s entity has to decide in a dispute, it must test the signature with respect to the original public key mk. There are two possibilities  

Note that this scheme is not a standard fail-stop signature scheme. 

---

As mentioned in Section 6.1.2, more efficient constructions exist for the case of a fixed recipient, which is rather important in practice (see Section 6.2). They can be seen as special variants of tree authentication that exploit the fact that the recipient s entity can store information about the current tree. Hence only one new leaf, instead of one complete branch, has to be sent and tested during each authentication, see Section 10.6. The complexity of fail-stop signature schemes with fixed recipient is therefore comparable to that of ordinary digital signature schemes. 

---