3

While reading a literature on signature schemes, I came across the concept of Existential Unforgeability of signature scheme against Adaptive Chosen Message Attack. Can anyone point me to the paper where this notion was introduced first? Otherwise, may I ask for a paper/reference where the above-mentioned game is properly defined?

sherlock
  • 529
  • 6
  • 11
  • 3
    This is the standard security property for secure digital signatures and you will find it in any modern textbook (e.g., Katz & Lindell). It has been introduced here and we will not do the googling for you ;) – DrLecter Oct 17 '14 at 05:13
  • 2
    http://www.csee.wvu.edu/~xinl/library/papers/comp/goldwasser1988.pdf $;$ –  Oct 17 '14 at 05:19
  • (Also: Have you seen "the concept of" Strong "Unforgeability of signature" schemes "against Adaptive Chosen Message Attack"?) $;$ –  Oct 17 '14 at 05:22
  • Thanks to both of you. I was not sure which paper the notion was introduced.

    @Ricky Demer Are you talking about this paper? http://crypto.stanford.edu/~dabo/papers/strongsigs.pdf

     – sherlock Oct 17 '14 at 06:00
  • 1
    No; I'm just making sure you're aware that EUF-CMA is not the strongest notion. $;$ –  Oct 17 '14 at 06:03
  • @Ricky Demer Yes, but strong EUF-CMA in contrast to EUF-CMA is quite specific (or not that meaningful in general). It rules out EUF-CMA secure schemes that have important properties such as randomization of signatures. Such schemes are trivially insecure in this model. But the notion can still be meaningful in some particular scenarios. – DrLecter Oct 17 '14 at 06:14
  • @Holmes.Sherlock Some time ago I have written up this anwer which may also be of interest to you in this context. – DrLecter Oct 17 '14 at 08:57
  • Note that in general, the paper where a notion was first introduced is only of historical interest, and better exposition can be found in subsequent works writen after understanding of the notionhas progressed. You probably wouldn't read Lagrange-era works to study group theory. ;) – fkraiem Feb 13 '16 at 13:17

1 Answers1

2

These are standard terms in the cryptographic literature. Refer to Goldwasser's Lecture Notes on Cryptography, particularly section 10.3.1 where the definitions of forgery of digital signatures are introduced:

  • Existential Forgery: The adversary succeeds in forging the signature of one message, not necessarily of his choice.

  • Selective Forgery: The adversary succeeds in forging the signature of some message of his choice.

  • Universal Forgery: The adversary, although unable to find the secret key of the The forger, is able to forge the signature of any message.

  • Total Break: The adversary can compute the signer’s secret key.

The exact use of these definitions can be seen later in the notes in which some proofs are discussed.

dionyziz
  • 573
  • 3
  • 11