Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

International Journal of Applied Cryptography

An optimistic fair exchange protocol and its security in the universal composability framework

Yusuke Okada, Yoshifumi Manabe, Tatsuaki Okamoto

Published Jan 1, 2008• 15 citations
Publisher

Abstract

Fair exchange protocols allow both or neither of two parties to obtain the other's items, and this property is essential in e-commerce. In this paper, we construct an optimistic fair exchange protocol that is applicable to any digital signature by prescribing three forms of signatures, namely presignature, post-signature and notarised signature. We set an expiration date for presignature, and thus realise the timely termination of the protocol. Next, we define an ideal functionality of fair exchange protocols in the universal composability framework. Then, we construct an optimistic fair exchange protocol based on the above protocol, and prove its security in the universal composability framework.

DOI
10.1504/ijact.2008.017052

Related papers

A Fair Exchange Protocol Based on RSA Signature Scheme

Yong Zheng Zhou

Fairness is the basic requirement of E-Commerce protocols. RSA is one of the most widely used cryptosystems. A fair-exchange protocol allows two parties to exchange items in a fair way so that either each party gets the other's item, or neither party does. In this paper construction and architecture of the existing fair exchange protocols are analyzed. Both practicality and efficiency problems of these protocols are also presented. Based on this analysis, an optimistic fair exchange protocol totally based on RSA signature scheme is proposed. The novel scheme employs verifiably encrypted RSA signatures in the extended integer ring that is elaborately constructed. The security and efficiency of the newly devised scheme are also proved and examined. It is showed that the proposed scheme is secure and efficient.

•Jan 1, 2004•2 citations

Preserving Transparency and Accountability in Optimistic Fair Exchange of Digital Signatures

Xinyi Huang, Yi Mu, Willy Susilo +3 more

Optimistic fair exchange (OFE) protocols are useful tools for two participants to fairly exchange items with the aid of a third party who is only involved if needed. A widely accepted requirement is that the third party's involvement in the exchange must be transparent, to protect privacy and avoid bad publicity. At the same time, a dishonest third party would compromise the fairness of the exchange and the third party thus must be responsible for its behaviors. This is achieved in OFE protocols with another property called accountability. It is unfortunate that the accountability has never been formally studied in OFE since its introduction ten years ago. In this paper, we fill these gaps by giving the first complete definition of accountability in OFE where one of the exchanged items is a digital signature and a generic (also the first) design of OFE where transparency and accountability coexist.

IEEE Transactions on Information Forensics and Security•Feb 3, 2011•27 citations

Contributions on fair exchange of digital signatures

Yang Wang

Fair exchange protocols aim to allow two parties to exchange digital items in a fair manner. Optimistic fair exchange (OFE) is a kind of protocols that solves the fair exchange problem with the help of a trusted third party (TTP), usually referred to as an `arbitrator'. The participation of the arbitrator is only required when there is a dispute between the exchanging parties. In the literature, the highest level of security of optimistic fair exchange is the multi-user security in the chosen-key model, proposed by Huang, Yang, Wong and Susilo in CT-RSA 2008. They showed that an efficient optimistic fair exchange scheme, secure in this sense, can be constructed generically from a conventional signature and a ring signature. In particular, the underlying ring signature is required to be unforgeable under an adaptive attack, against a static adversary in the 2-user setting.\nConcurrent signatures, introduced by Chen, Kudla and Paterson in Eurocrypt 2004, allow two parties to produce two ambiguous signatures until an extra piece of information, the keystone, is released by one of the parties. Upon the release of the keystone, the ambiguity will be revoked and the signatures bind to their true signers concurrently. Concurrent signatures, however, are known to fall just short of fully solving the long standing fair exchange of signatures problem. The price for not requiring any TTP is that the party who holds the keystone always has an advantage over the other party in controlling when and whether the protocol completes or not.\nIn this thesis, the fair exchange of digital signatures problem is studied. In the first part of this thesis, the OFE security is strengthened and a more practical model which is called enhanced chosen-key model is proposed. Unlike the existing multiuser setting and chosen-key model, an adversary in the enhanced chosen-key model is further provided with the signing oracle that outputs full signatures generated by the signer, and may even be allowed to have access to the arbitrator's secret key. The necessity for the new model is demonstrated. It is shown that two existing methodologies for constructing optimistic fair exchange schemes remain valid in the enhanced chosen-key model.\nNext, the efficiency of OFE constructions is improved. A model for 2-user ring signatures called `unforgeability against restricted adaptive attacks' is proposed and it is shown that the new ring model is strictly weaker than the model of unforgeability under an adaptive attack, against a static adversary in the 2-user setting. Based on the finding that 2-user ring signatures secure in this weaker model will suffice to guarantee the security of the resulting OFE schemes in the enhanced chosenkey model, the most efficient OFE scheme whose security does not rely on random oracles is proposed.\nNew situations in OFE are also investigated, and the applications of OFE are extended. The scenarios where the digital items to be exchanged are threshold signatures are considered, and the notion of threshold-oriented OFE (TOFE) together with a security model and an efficient concrete scheme is proposed. It is identified that in some scenarios, it is required that prior to the completion of the protocol, no information about the actual exchange should be revealed to an outsider. To achieve this purpose, the notion of perfect ambiguous optimistic fair exchange (PAOFE) is introduced, the security model for PAOFE is proposed and a generic construction based on existing primitives is offered. OFE in the attribute-based setting is considered and the notion of attribute-based optimistic fair exchange (ABOFE) is proposed. The security model and a construction for ABOFE are presented as well.\nFinally, concurrent signatures is revisited. It is showed that theoretically the party who controls the keystone in a concurrent signature scheme has more advantages than previously thought. In particular, the notion is examined and the advantages are classified into three levels.It is demonstrated that concurrent signatures may be abused in practical applications if one fails to take these advantages into account.

•Jan 1, 2014•0 citations

An identity-based scheme of fair exchange of digital signatures

Yong Hong Yu, Bo Yang, Yang Guoqing

Fair exchange of digital signatures is an important tool for signing digital contracts, e-payment and other electronic commerce actions. An ID-based scheme of fair exchange of digital signature is proposed in this paper. The protocol relies on a trusted third party, but is “optimistic”, in that the third party is only needed in cases where one player attempts to cheat or simply crashes. The proposed scheme has properties of short signature, low computation and verification cost. It can realize exchange of digital signatures fairly and efficiently. A key feature of our scheme is that it is identity-based, which needs no certificates and has a simple key management. To our best knowledge, this is the first identity-based scheme of fair exchange of digital signatures.

Wuhan University Journal of Natural Sciences•Nov 1, 2006•3 citations

Simple and Fast Optimistic Fair Exchange Protocol

Changshe Ma

Fair exchange protocol is the basis of secure electronic commerce where the RSA cryptosystem gains comprehensive applications.This paper presents a new efficient verifiable encrypted RSA signature scheme,on which a simple and practical optimistic fair exchange protocol is been devised.Analysis and comparisons show that this protocol is secure and fast.

Jisuanji gongcheng•Jan 1, 2007•0 citations

Optimistic fair exchange e-commerce protocol based on secret sharing

Changshe Ma, Feiyu Lei, Chen Kefei

A key problem of electronic commerce (for short e-commerce) is fair exchange which guarantees that at the end of the transaction, either both parties in the transaction receive each other's items or none do. A non-interactive optimistic fair exchange e-commerce protocol model based on the publicly verifiable secret sharing is presented. The main idea of our exchange protocol is to interchange verifiable and recoverable keys of the symmetric encryption for participants' items. So it is especially suitable for exchange of large-size items. Furthermore, our protocol is efficient and simple as it does not need interactive proof system which has been adopted by a large quantity of previously proposed fair exchange protocols. Based on a modified (2,2) secret sharing scheme, a concrete non-interactive fair exchange e-commerce protocol is designed.

Journal of Systems Engineering and Electronics•Dec 1, 2006•3 citations
Fair exchange protocols allow both or neither of two parties to obtain the other's items, and this property is essential in e-commerce. In this paper, we construct an optimistic fair exchange protocol that is applicable to any digital signature by prescribing three forms of signatures, namely presignature, post-signature and notarised signature. We set an expiration date for presignature, and thus realise the timely termination of the protocol. Next, we define an ideal functionality of fair exchange protocols in the universal composability framework. Then, we construct an optimistic fair exchange protocol based on the above protocol, and prove its security in the universal composability framework.
Fairness is the basic requirement of E-Commerce protocols. RSA is one of the most widely used cryptosystems. A fair-exchange protocol allows two parties to exchange items in a fair way so that either each party gets the other's item, or neither party does. In this paper construction and architecture of the existing fair exchange protocols are analyzed. Both practicality and efficiency problems of these protocols are also presented. Based on this analysis, an optimistic fair exchange protocol totally based on RSA signature scheme is proposed. The novel scheme employs verifiably encrypted RSA signatures in the extended integer ring that is elaborately constructed. The security and efficiency of the newly devised scheme are also proved and examined. It is showed that the proposed scheme is secure and efficient.
Optimistic fair exchange (OFE) protocols are useful tools for two participants to fairly exchange items with the aid of a third party who is only involved if needed. A widely accepted requirement is that the third party's involvement in the exchange must be transparent, to protect privacy and avoid bad publicity. At the same time, a dishonest third party would compromise the fairness of the exchange and the third party thus must be responsible for its behaviors. This is achieved in OFE protocols with another property called accountability. It is unfortunate that the accountability has never been formally studied in OFE since its introduction ten years ago. In this paper, we fill these gaps by giving the first complete definition of accountability in OFE where one of the exchanged items is a digital signature and a generic (also the first) design of OFE where transparency and accountability coexist.
Fair exchange protocols aim to allow two parties to exchange digital items in a fair manner. Optimistic fair exchange (OFE) is a kind of protocols that solves the fair exchange problem with the help of a trusted third party (TTP), usually referred to as an `arbitrator'. The participation of the arbitrator is only required when there is a dispute between the exchanging parties. In the literature, the highest level of security of optimistic fair exchange is the multi-user security in the chosen-key model, proposed by Huang, Yang, Wong and Susilo in CT-RSA 2008. They showed that an efficient optimistic fair exchange scheme, secure in this sense, can be constructed generically from a conventional signature and a ring signature. In particular, the underlying ring signature is required to be unforgeable under an adaptive attack, against a static adversary in the 2-user setting.\nConcurrent signatures, introduced by Chen, Kudla and Paterson in Eurocrypt 2004, allow two parties to produce two ambiguous signatures until an extra piece of information, the keystone, is released by one of the parties. Upon the release of the keystone, the ambiguity will be revoked and the signatures bind to their true signers concurrently. Concurrent signatures, however, are known to fall just short of fully solving the long standing fair exchange of signatures problem. The price for not requiring any TTP is that the party who holds the keystone always has an advantage over the other party in controlling when and whether the protocol completes or not.\nIn this thesis, the fair exchange of digital signatures problem is studied. In the first part of this thesis, the OFE security is strengthened and a more practical model which is called enhanced chosen-key model is proposed. Unlike the existing multiuser setting and chosen-key model, an adversary in the enhanced chosen-key model is further provided with the signing oracle that outputs full signatures generated by the signer, and may even be allowed to have access to the arbitrator's secret key. The necessity for the new model is demonstrated. It is shown that two existing methodologies for constructing optimistic fair exchange schemes remain valid in the enhanced chosen-key model.\nNext, the efficiency of OFE constructions is improved. A model for 2-user ring signatures called `unforgeability against restricted adaptive attacks' is proposed and it is shown that the new ring model is strictly weaker than the model of unforgeability under an adaptive attack, against a static adversary in the 2-user setting. Based on the finding that 2-user ring signatures secure in this weaker model will suffice to guarantee the security of the resulting OFE schemes in the enhanced chosenkey model, the most efficient OFE scheme whose security does not rely on random oracles is proposed.\nNew situations in OFE are also investigated, and the applications of OFE are extended. The scenarios where the digital items to be exchanged are threshold signatures are considered, and the notion of threshold-oriented OFE (TOFE) together with a security model and an efficient concrete scheme is proposed. It is identified that in some scenarios, it is required that prior to the completion of the protocol, no information about the actual exchange should be revealed to an outsider. To achieve this purpose, the notion of perfect ambiguous optimistic fair exchange (PAOFE) is introduced, the security model for PAOFE is proposed and a generic construction based on existing primitives is offered. OFE in the attribute-based setting is considered and the notion of attribute-based optimistic fair exchange (ABOFE) is proposed. The security model and a construction for ABOFE are presented as well.\nFinally, concurrent signatures is revisited. It is showed that theoretically the party who controls the keystone in a concurrent signature scheme has more advantages than previously thought. In particular, the notion is examined and the advantages are classified into three levels.It is demonstrated that concurrent signatures may be abused in practical applications if one fails to take these advantages into account.
Fair exchange of digital signatures is an important tool for signing digital contracts, e-payment and other electronic commerce actions. An ID-based scheme of fair exchange of digital signature is proposed in this paper. The protocol relies on a trusted third party, but is “optimistic”, in that the third party is only needed in cases where one player attempts to cheat or simply crashes. The proposed scheme has properties of short signature, low computation and verification cost. It can realize exchange of digital signatures fairly and efficiently. A key feature of our scheme is that it is identity-based, which needs no certificates and has a simple key management. To our best knowledge, this is the first identity-based scheme of fair exchange of digital signatures.
A key problem of electronic commerce (for short e-commerce) is fair exchange which guarantees that at the end of the transaction, either both parties in the transaction receive each other's items or none do. A non-interactive optimistic fair exchange e-commerce protocol model based on the publicly verifiable secret sharing is presented. The main idea of our exchange protocol is to interchange verifiable and recoverable keys of the symmetric encryption for participants' items. So it is especially suitable for exchange of large-size items. Furthermore, our protocol is efficient and simple as it does not need interactive proof system which has been adopted by a large quantity of previously proposed fair exchange protocols. Based on a modified (2,2) secret sharing scheme, a concrete non-interactive fair exchange e-commerce protocol is designed.