The concept of concurrent signatures was introduced by Chen, Kudla and Paterson in their seminal paper in Eurocrypt 2004 which allows two entities to produce two signatures in such a way that, the signer of each signature is ambiguous from any third party's point of view until the release of a secret, known as the keystone. Once the keystone is released, both signatures become binding to their respective signers concurrently. Later, a stronger notion called perfect concurrent signatures with two concrete schemes was proposed by Susilo, Mu and Zhang. In perfect concurrent signatures, although both signers are known to be trustworthy, the two signatures are still ambiguous to any third party. Unfortunately, Susilo et al.'s schemes are unfair. In this paper, we first show that in their schemes the initial signer can cheat the matching signer by carefully choosing some communication value and then propose fair perfect concurrent signature protocol to fix our attacks.
The concept of concurrent signatures was introduced by Chen, Kudla and Paterson in their seminal paper in Eurocrypt 2004 which allows two entities to produce two signatures in such a way that, the signer of each signature is ambiguous from any third party's point of view until the release of a secret, known as the keystone. Once the keystone is released, both signatures become binding to their respective signers concurrently. Later, a stronger notion called perfect concurrent signatures with two concrete schemes was proposed by Susilo, Mu and Zhang. In perfect concurrent signatures, although both signers are known to be trustworthy, the two signatures are still ambiguous to any third party. Unfortunately, Susilo et al.'s schemes are unfair. In this paper, we first show that in their schemes the initial signer can cheat the matching signer by carefully choosing some communication value and then propose fair perfect concurrent signature protocol to fix our attacks.
The concept of concurrent signatures was introduced by Chen et al. in Eurocrypt 2004 which allows two entities to produce two signatures in such a way that, the signer of each signature is ambiguous from any third party¿s point of view until the release of a secret, known as the keystone. Once the keystone is released, both signatures become binding to their respective signers concurrently. In the previous concurrent signature schemes, the roles of participants are asymmetrical, one party, which is called initial signer, needs to create the keystone fix and send the first ambiguous signature, the other party, which is called matching signer, responds to this initial signer by creating another ambiguous signature with the same keystone fix. This work mode may cause some unfairness. In this paper, we construct a perfect concurrent signature protocol for symmetric participants and prove its security. In our concept, the roles of participants are symmetrical. The keystone can not be decided by any participant and the two ambiguous signatures can be published in any order.
We propose a fair novel concurrent signature scheme. It resolves the existing problems in traditional concurrent signature schemes, that is initial signer (A) has some advantages over matching signer (B), such as A could show B's ambiguous signature and the keystone to a third party in private to demonstrate B's binding signature but B can not, or A could keep the keystone secret and B do not have power to force A to release it. In our scheme, the keystones were produced by both A and B, that is to say, the two participants in our scheme have equal positions, no one has any priority than the other, so our scheme can achieve the fairness of both sides.
At Eurocrypt 2004, the concept of concurrent signatures was introduced by Chen, Kudla and Paterson. Concurrent signatures contribute a novel approach for the traditional problem of fair exchange of signatures. In this paper a general attack named the message substitute attack to the existing concurrent signatures protocol is proposed. Under the message substitute attack there is no concurrent in the existing concurrent signatures protocols including perfect concurrent signatures (PCS) protocol proposed by Susilo et al and its improvement iPCS1 protocol proposed by Guilin Wang et al. To prevent the message substitute attack, an i2PCS1 protocol which is an improvement on iPCS1 protocol is proposed. Further more an i3PCS1 protocol which is another improvement on iPCS1 protocol is proposed, the distinct advantage of i3PCS1 protocol is that its keystones are not published by the initial signer Alice finally but by the matching signer Bob, so that the matching signer Bob has some advantage over the initial signer Alice, while in almost all previous concurrent signatures protocols the initial signer Alice has some advantage. So the i3PCS1 Protocol differs from the previous concurrent signatures protocols.
Concurrent signature provided a novel idea for fair exchange protocol without trusted third party. Perfect Concurrent Signature is proposed to strengthen the ambiguity of the concurrent signature. Wang et al, pointed out there exist an attack against the fairness of Perfect Concurrent Signature and proposed the improved perfect concurrent signature. This paper find that in proposed (perfect) concurrent signature protocol, no matter two party or multi-party, the signer could bind multiple messages with one keystone set but let the other signers know only one of the messages. Based on this observation, this paper proposes that accountability should be one of the security properties of (perfect) concurrent signature and we give the definition of accountability of concurrent signature. To illustrate this idea, this paper give an attack scene against the accountability of improved perfect concurrent signature proposed by Wang et al. Finally, this paper proposes an update version of perfect concurrent signature to avoid such attack.
When using digital signatures, we need to deal with the problem of fairness of information exchange. To solve this problem, Chen, etc. introduced a new conception which is named concurrent signatures in Eurocrypt'04. Using concurrent signatures scheme, two entities in the scheme can generate two ambiguous signatures until one of the entities releases additional information which is called keystone. After the keystone is released, the two ambiguous signatures will be bound to their real signers at the same time. In order to provide a method to solve the fairness problem of quantum digital signatures, we propose a new quantum concurrent signature scheme. The scheme we proposed does not use a trusted third party in a quantum computing environment, and has such advantages as no need to conduct complex quantum operations and easy to implement by a quantum circuit. Quantum concurrent signature improves the theory of quantum cryptography, and it also provides broad prospects for the specific applications of quantum cryptography.
Fair exchange protocols aim to allow two parties to exchange digital items in a fair manner. Optimistic fair exchange (OFE) is a kind of protocols that solves the fair exchange problem with the help of a trusted third party (TTP), usually referred to as an `arbitrator'. The participation of the arbitrator is only required when there is a dispute between the exchanging parties. In the literature, the highest level of security of optimistic fair exchange is the multi-user security in the chosen-key model, proposed by Huang, Yang, Wong and Susilo in CT-RSA 2008. They showed that an efficient optimistic fair exchange scheme, secure in this sense, can be constructed generically from a conventional signature and a ring signature. In particular, the underlying ring signature is required to be unforgeable under an adaptive attack, against a static adversary in the 2-user setting.\nConcurrent signatures, introduced by Chen, Kudla and Paterson in Eurocrypt 2004, allow two parties to produce two ambiguous signatures until an extra piece of information, the keystone, is released by one of the parties. Upon the release of the keystone, the ambiguity will be revoked and the signatures bind to their true signers concurrently. Concurrent signatures, however, are known to fall just short of fully solving the long standing fair exchange of signatures problem. The price for not requiring any TTP is that the party who holds the keystone always has an advantage over the other party in controlling when and whether the protocol completes or not.\nIn this thesis, the fair exchange of digital signatures problem is studied. In the first part of this thesis, the OFE security is strengthened and a more practical model which is called enhanced chosen-key model is proposed. Unlike the existing multiuser setting and chosen-key model, an adversary in the enhanced chosen-key model is further provided with the signing oracle that outputs full signatures generated by the signer, and may even be allowed to have access to the arbitrator's secret key. The necessity for the new model is demonstrated. It is shown that two existing methodologies for constructing optimistic fair exchange schemes remain valid in the enhanced chosen-key model.\nNext, the efficiency of OFE constructions is improved. A model for 2-user ring signatures called `unforgeability against restricted adaptive attacks' is proposed and it is shown that the new ring model is strictly weaker than the model of unforgeability under an adaptive attack, against a static adversary in the 2-user setting. Based on the finding that 2-user ring signatures secure in this weaker model will suffice to guarantee the security of the resulting OFE schemes in the enhanced chosenkey model, the most efficient OFE scheme whose security does not rely on random oracles is proposed.\nNew situations in OFE are also investigated, and the applications of OFE are extended. The scenarios where the digital items to be exchanged are threshold signatures are considered, and the notion of threshold-oriented OFE (TOFE) together with a security model and an efficient concrete scheme is proposed. It is identified that in some scenarios, it is required that prior to the completion of the protocol, no information about the actual exchange should be revealed to an outsider. To achieve this purpose, the notion of perfect ambiguous optimistic fair exchange (PAOFE) is introduced, the security model for PAOFE is proposed and a generic construction based on existing primitives is offered. OFE in the attribute-based setting is considered and the notion of attribute-based optimistic fair exchange (ABOFE) is proposed. The security model and a construction for ABOFE are presented as well.\nFinally, concurrent signatures is revisited. It is showed that theoretically the party who controls the keystone in a concurrent signature scheme has more advantages than previously thought. In particular, the notion is examined and the advantages are classified into three levels.It is demonstrated that concurrent signatures may be abused in practical applications if one fails to take these advantages into account.