Unforgeability. If all processes with identifier i are cor- rect and none of them performs Broadcast(m), then no correct process performs Accept(m, i).
Unforgeability. For all v and g, if Pi is honest and an honest party received (vki, sid, v, g) from π, then Pi invoked GradeGoss(sid, v). When a party receives (vk, sid, ⊥, g), we call this an equivocation proof for (vk, sid).
3.2.1 Partial Communication Graphs
Unforgeability. Regarding forging Xxxxx's signcryption, a dishonest Bob is in the best position to do so, as he is the only person who knows xb which is required to directly verify a signcrypted text from Xxxxx. In other words, the dishonest Bob is the most powerful attacker we should look at. Given the signcrypted text (c; r; s) of a message m from Xxxxx, Xxx can use his private key xb to decrypt c and obtain m = Dk2 (c). Thus the original problem is reduced to one in which Bob is in possession of (m; r; s). The latter is identical to the unforgeability of SDSS1 or SDSS2.
Unforgeability. We define the strongest notion of unforgeability for a digital signature scheme, namely existential unforgeability under a chosen message attack [63]. This is defined via the following game between a challenger C and an adversary E. Initialization: C runs Setup on security parameter l to generate the public parameters params. C also runs KeyGen to obtain a public key PK and a private key SK. C gives the parameters params and the public key PK to E. Sign: E may request a signature on any message m. C computes σ=Sign(m, SK), and gives σ to E. Output: E outputs a signature σ∗ and a message m∗. E wins the game if Verify(m∗, PK, σ∗) outputs accept, and no previous Sign query was made on m∗.
Unforgeability. Unforgeability ensures that no-one other than a ring member can create a valid ring sig- nature for that ring. Unforgeability is defined via the following game between a challenger C and an adversary E.
i=1 Initialization: C firstly generates a set S = {(PKi, SKi)}n(l) of public and private keys using key generation algorithms of its choosing, where n is a polynomial function of the security parameter l, and the list of public keys R = {PKi}n(l) is given to E. RingSign Queries: E may request a signature on any message m, for any ring R ⊆ R, with any public key PKsig ∈ R. C computes σ=RingSign(m, R, sig, SKsig), and gives σ to E. Corrupt Queries: E may request the private key SKi corresponding to any public key Output: E finally outputs a message m∗, a ring R∗ ⊆ R, and a signature σ∗. E wins the game if RingVerify(m∗, R∗, σ∗) outputs accept, no public key PK ∈ R∗ has been corrupted, and no previous RingSign query was made on m∗ and R∗.
Unforgeability. Unforgeability of an NIDV undeniable signature scheme is defined via the following game between a challenger C and an adversary E:
Unforgeability. Unforgeability of a DV signature scheme is defined via the following game between a challenger C and an adversary E:
Unforgeability. Informally, a scheme is unforgeable if no adversary can use signatures of a large majority of the honest parties on a message m and of a few honest parties on messages of its choice to forge an aggregated SRDS signature on a message other than m. { } ∈ ⊆ \ I | ∪ I| In a similar way to robustness, we consider an unforgeability game between a challenger and an adversary. The setup and corruption phase is identical to that in the robustness game. In the forgery challenge phase, the adversary chooses a set S [n] such that S < n/3 and messages m and mi i S. Given signatures of all honest parties outside of S on the message m and a signature of each honest party Pi in S on the message mi, the adversary outputs a signature σ. In the output phase, the challenger checks whether σ is a valid signature on a message different than m; if so the adversary wins. An SRDS scheme is unforgeable if no adversary can win the game except for negligible probability. Experiment Exptforge mode,Π,A (κ, n, t) The experiment Exptforge is a game between a challenger and the adversary A. The game is parametrized by an SRDS scheme Π and consists of the following phases:
Unforgeability. Regarding forging Xxxxx's signcryption, a dishonest Xxx is in the best position to do so, as he is the only person who knows xb which is required to directly verify a signcrypted text from Xxxxx. In other words, the dishonest Xxx is the most powerful attacker we should look at. Given the signcrypted text (c; r; s) of a message m from Xxxxx, Xxx can use his private key xb to decrypt c and obtain m = Dk2 (c). Thus the original problem is reduced to one in which Xxx is in possession of (m; r; s). The latter is identical to the unforgeability of SDSS1 or SDSS2.
Unforgeability. Informally, a scheme is unforgeable if no adversary can use signatures of a large majority of the honest parties on a message m and of a few honest parties on messages of its choice to forge an aggregated SRDS signature on a message other than m. In a similar way to robustness, we consider an unforgeability game between a challenger and an adversary. The setup and corruption phase is identical to that in the robustness game. In the forgery challenge phase, the adversary chooses a set S ⊆ [n] \ I such that |S ∪ I| < n/3 and messages m and {mi}i∈S. Given signatures of all honest parties outside of S on the message m and a signature of each honest party Pi in S on the message mi, the adversary outputs a signature
