Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

IEEE International Conference on Services Computing

Optimistic fair-exchange protocols based on DSA signatures

Wang Shaobin, Hong Mei Fan, Xian Zhu

Published Dec 23, 2004• 4 citations
Publisher

Abstract

The problem of fair exchange is a fundamental problem in secure electronic transactions and digital rights management. Park et al. (2003) presented an optimistic fair-exchange protocol based on RSA. Dodis and Reyain (2003) analyzed the vulnerability of Park's scheme and presented an optimistic fair-exchange protocol based on GDH. This paper point out that Dodis and Reyain's scheme is also insecure and inefficient. This work presents a multisignature scheme based on DSA, and describes a novel method of constructing very efficient fair-exchange protocols based on improved DSA signatures. The protocols in this paper are more secure and efficient.

DOI
10.1109/scc.2004.1358051

Related papers

Breaking and repairing optimistic fair exchange from PODC 2003

Yevgeniy Dodis, Leonid Reyzin

In PODC 2003, Park, Chong, Siegel and Ray [22] proposed an optimistic protocol for fair exchange, based on RSA signatures. We show that their protocol is totally breakable already in the registration phase: the honest-but-curious arbitrator can easily determine the signer's secret key.On a positive note, the authors of [22] informally introduced a connection between fair exchange and "sequential two-party multisignature schemes" (which we call two-signatures), but used an insecure two-signature scheme in their actual construction. Nonetheless, we show that this connection can be properly formalized to imply provably secure fair exchange protocols. By utilizing the state-of-the-art non-interactive two-signature of Boldyreva [6], we obtain an efficient and provably secure (in the random oracle model) fair exchange protocol, which is based on GDH signatures [9].Of independent interest, we introduce a unified model for non-interactive fair exchange protocols, which results in a new primitive we call verifiably committed signatures. Verifiably committed signatures generalize (non-interactive) verifiably encrypted signatures [8] and two-signatures, both of which are sufficient for fair exchange.

•Oct 27, 2003•138 citations

Breaking and repairing optimistic fair exchange from PODC 2003

Yevgeniy Dodis, Leonid Reyzin

In PODC 2003, Park, Chong, Siegel and Ray [22] proposed an optimistic protocol for fair exchange, based on RSA signatures. We show that their protocol is totally breakable already in the registration phase: the honest-but-curious arbitrator can easily determine the signer's secret key.On a positive note, the authors of [22] informally introduced a connection between fair exchange and "sequential two-party multisignature schemes" (which we call two-signatures), but used an insecure two-signature scheme in their actual construction. Nonetheless, we show that this connection can be properly formalized to imply provably secure fair exchange protocols. By utilizing the state-of-the-art non-interactive two-signature of Boldyreva [6], we obtain an efficient and provably secure (in the random oracle model) fair exchange protocol, which is based on GDH signatures [9].Of independent interest, we introduce a unified model for non-interactive fair exchange protocols, which results in a new primitive we call verifiably committed signatures. Verifiably committed signatures generalize (non-interactive) verifiably encrypted signatures [8] and two-signatures, both of which are sufficient for fair exchange.

•Jan 1, 2003•41 citations

A Fair Exchange Protocol Based on RSA Signature Scheme

Yong Zheng Zhou

Fairness is the basic requirement of E-Commerce protocols. RSA is one of the most widely used cryptosystems. A fair-exchange protocol allows two parties to exchange items in a fair way so that either each party gets the other's item, or neither party does. In this paper construction and architecture of the existing fair exchange protocols are analyzed. Both practicality and efficiency problems of these protocols are also presented. Based on this analysis, an optimistic fair exchange protocol totally based on RSA signature scheme is proposed. The novel scheme employs verifiably encrypted RSA signatures in the extended integer ring that is elaborately constructed. The security and efficiency of the newly devised scheme are also proved and examined. It is showed that the proposed scheme is secure and efficient.

•Jan 1, 2004•2 citations

Constructing Optimistic Fair Exchange Protocols from Committed Signatures.

Huafei Zhu

In PODC 2003, Park et al. [32] first introduce a connection between fair exchange and sequential two-party multi-signature scheme and provide a novel method of constructing fair exchange protocol by distributing the computation of RSA signature. This approach avoids the design of verifiable encryption scheme at the expense of having cosigner store a piece of prime signer's secret key. Dodis and Reyzin [20] showed that the protocol in [32] is totally breakable in the registration phase, then presented a remedy scheme which is provably secure in the random oracle model, by utilizing Boldyreva non-interactive two-party multi-signature scheme [8]. Security in the random oracle model does not imply security in the real world. In this paper, we provide the first two e#cient committed signatures which are provably secure in the standard complexity model from strong RSA assumption. Then we construct e#cient optimistic fair exchange protocols from those new primitives.

•Jan 1, 2003•4 citations

ID-Based Optimistic Fair Exchange Scheme Based on RSA

Taek-Young Youn, Ku-Young Chang

Fairness of exchange is a significant property for secure online transactions, and a fair exchange scheme is a useful tool for ensuring the fairness of exchanges conducted over networks. In this paper, we propose an ID-based optimistic fair exchange scheme based on the RSA function, one which is designed by combining a well-known RSA-based signature scheme and the (naive) RSA function. Note that the main contribution of this paper is to give the first provably secure ID-based fair exchange scheme based on the RSA function, whose security can be proved under fully formalized security models. Our scheme has the following additional strongpoints. The scheme is setup-free; hence, there is no registration step between a user and an arbitrator. Moreover, the proposed scheme is designed in an ID-based setting; thus, it is possible to eliminate the need for certificates and avoid some related problems.

ETRI Journal•Mar 19, 2014•0 citations

Simple and Fast Optimistic Fair Exchange Protocol

Changshe Ma

Fair exchange protocol is the basis of secure electronic commerce where the RSA cryptosystem gains comprehensive applications.This paper presents a new efficient verifiable encrypted RSA signature scheme,on which a simple and practical optimistic fair exchange protocol is been devised.Analysis and comparisons show that this protocol is secure and fast.

Jisuanji gongcheng•Jan 1, 2007•0 citations
The problem of fair exchange is a fundamental problem in secure electronic transactions and digital rights management. Park et al. (2003) presented an optimistic fair-exchange protocol based on RSA. Dodis and Reyain (2003) analyzed the vulnerability of Park's scheme and presented an optimistic fair-exchange protocol based on GDH. This paper point out that Dodis and Reyain's scheme is also insecure and inefficient. This work presents a multisignature scheme based on DSA, and describes a novel method of constructing very efficient fair-exchange protocols based on improved DSA signatures. The protocols in this paper are more secure and efficient.
In PODC 2003, Park, Chong, Siegel and Ray [22] proposed an optimistic protocol for fair exchange, based on RSA signatures. We show that their protocol is totally breakable already in the registration phase: the honest-but-curious arbitrator can easily determine the signer's secret key.On a positive note, the authors of [22] informally introduced a connection between fair exchange and "sequential two-party multisignature schemes" (which we call two-signatures), but used an insecure two-signature scheme in their actual construction. Nonetheless, we show that this connection can be properly formalized to imply provably secure fair exchange protocols. By utilizing the state-of-the-art non-interactive two-signature of Boldyreva [6], we obtain an efficient and provably secure (in the random oracle model) fair exchange protocol, which is based on GDH signatures [9].Of independent interest, we introduce a unified model for non-interactive fair exchange protocols, which results in a new primitive we call verifiably committed signatures. Verifiably committed signatures generalize (non-interactive) verifiably encrypted signatures [8] and two-signatures, both of which are sufficient for fair exchange.
In PODC 2003, Park, Chong, Siegel and Ray [22] proposed an optimistic protocol for fair exchange, based on RSA signatures. We show that their protocol is totally breakable already in the registration phase: the honest-but-curious arbitrator can easily determine the signer's secret key.On a positive note, the authors of [22] informally introduced a connection between fair exchange and "sequential two-party multisignature schemes" (which we call two-signatures), but used an insecure two-signature scheme in their actual construction. Nonetheless, we show that this connection can be properly formalized to imply provably secure fair exchange protocols. By utilizing the state-of-the-art non-interactive two-signature of Boldyreva [6], we obtain an efficient and provably secure (in the random oracle model) fair exchange protocol, which is based on GDH signatures [9].Of independent interest, we introduce a unified model for non-interactive fair exchange protocols, which results in a new primitive we call verifiably committed signatures. Verifiably committed signatures generalize (non-interactive) verifiably encrypted signatures [8] and two-signatures, both of which are sufficient for fair exchange.
Fairness is the basic requirement of E-Commerce protocols. RSA is one of the most widely used cryptosystems. A fair-exchange protocol allows two parties to exchange items in a fair way so that either each party gets the other's item, or neither party does. In this paper construction and architecture of the existing fair exchange protocols are analyzed. Both practicality and efficiency problems of these protocols are also presented. Based on this analysis, an optimistic fair exchange protocol totally based on RSA signature scheme is proposed. The novel scheme employs verifiably encrypted RSA signatures in the extended integer ring that is elaborately constructed. The security and efficiency of the newly devised scheme are also proved and examined. It is showed that the proposed scheme is secure and efficient.
In PODC 2003, Park et al. [32] first introduce a connection between fair exchange and sequential two-party multi-signature scheme and provide a novel method of constructing fair exchange protocol by distributing the computation of RSA signature. This approach avoids the design of verifiable encryption scheme at the expense of having cosigner store a piece of prime signer's secret key. Dodis and Reyzin [20] showed that the protocol in [32] is totally breakable in the registration phase, then presented a remedy scheme which is provably secure in the random oracle model, by utilizing Boldyreva non-interactive two-party multi-signature scheme [8]. Security in the random oracle model does not imply security in the real world. In this paper, we provide the first two e#cient committed signatures which are provably secure in the standard complexity model from strong RSA assumption. Then we construct e#cient optimistic fair exchange protocols from those new primitives.
Fairness of exchange is a significant property for secure online transactions, and a fair exchange scheme is a useful tool for ensuring the fairness of exchanges conducted over networks. In this paper, we propose an ID-based optimistic fair exchange scheme based on the RSA function, one which is designed by combining a well-known RSA-based signature scheme and the (naive) RSA function. Note that the main contribution of this paper is to give the first provably secure ID-based fair exchange scheme based on the RSA function, whose security can be proved under fully formalized security models. Our scheme has the following additional strongpoints. The scheme is setup-free; hence, there is no registration step between a user and an arbitrator. Moreover, the proposed scheme is designed in an ID-based setting; thus, it is possible to eliminate the need for certificates and avoid some related problems.