2019, Innovative Information Science and Technology Research Group. All rights reserved. A fair exchange of digital signatures has been considered as a fundamental problem in cryptography. The most widely adopted approach to ensure the fairness of exchanging signatures is to resort to a trusted third party (TTP) whenever required. The TTP is assumed to be entirely honest and neutral, hence never colludes with the other parties in the system. In practice, such a TTP may not be available. To overcome this difficulty, Shao introduced a new idea of building fair exchange schemes with a semi-trusted adjudicator that only needs to be trusted by one party (the signer). These new fair exchange schemes are more practical than previous ones since there is no necessity for two mutually distrusted parties to commonly trust the same adjudicator. In the new approach, an adjudicator is also trusted unilaterally. Nevertheless, the two schemes that Shao proposed in 2008 and 2010, respectively, are both only provably secure in the random oracle model. In this paper, we revisited the schemes proposed by Shao and revealed that some subtle issues might have been overlooked. In particular, the number of interactions between the signer and the adjudicator is more involved than it is anticipated. Our investigation leads to a refined definition of this kind of fair exchange scheme with a semi-trusted adjudicator (FESTA). We proposed a generic construction in our model based on pseudo-random functions, collision-resistant hash functions and any digital signature schemes that are existentially unforgeable against adaptive chosen message attacks. Based on our generic construction, FESTA in the standard model can be realized. We provide such instantiations to demonstrate the practicability of our generic construction.
2019, Innovative Information Science and Technology Research Group. All rights reserved. A fair exchange of digital signatures has been considered as a fundamental problem in cryptography. The most widely adopted approach to ensure the fairness of exchanging signatures is to resort to a trusted third party (TTP) whenever required. The TTP is assumed to be entirely honest and neutral, hence never colludes with the other parties in the system. In practice, such a TTP may not be available. To overcome this difficulty, Shao introduced a new idea of building fair exchange schemes with a semi-trusted adjudicator that only needs to be trusted by one party (the signer). These new fair exchange schemes are more practical than previous ones since there is no necessity for two mutually distrusted parties to commonly trust the same adjudicator. In the new approach, an adjudicator is also trusted unilaterally. Nevertheless, the two schemes that Shao proposed in 2008 and 2010, respectively, are both only provably secure in the random oracle model. In this paper, we revisited the schemes proposed by Shao and revealed that some subtle issues might have been overlooked. In particular, the number of interactions between the signer and the adjudicator is more involved than it is anticipated. Our investigation leads to a refined definition of this kind of fair exchange scheme with a semi-trusted adjudicator (FESTA). We proposed a generic construction in our model based on pseudo-random functions, collision-resistant hash functions and any digital signature schemes that are existentially unforgeable against adaptive chosen message attacks. Based on our generic construction, FESTA in the standard model can be realized. We provide such instantiations to demonstrate the practicability of our generic construction.
Fair exchange protocols aim to allow two parties to exchange digital items in a fair manner. Optimistic fair exchange (OFE) is a kind of protocols that solves the fair exchange problem with the help of a trusted third party (TTP), usually referred to as an `arbitrator'. The participation of the arbitrator is only required when there is a dispute between the exchanging parties. In the literature, the highest level of security of optimistic fair exchange is the multi-user security in the chosen-key model, proposed by Huang, Yang, Wong and Susilo in CT-RSA 2008. They showed that an efficient optimistic fair exchange scheme, secure in this sense, can be constructed generically from a conventional signature and a ring signature. In particular, the underlying ring signature is required to be unforgeable under an adaptive attack, against a static adversary in the 2-user setting.\nConcurrent signatures, introduced by Chen, Kudla and Paterson in Eurocrypt 2004, allow two parties to produce two ambiguous signatures until an extra piece of information, the keystone, is released by one of the parties. Upon the release of the keystone, the ambiguity will be revoked and the signatures bind to their true signers concurrently. Concurrent signatures, however, are known to fall just short of fully solving the long standing fair exchange of signatures problem. The price for not requiring any TTP is that the party who holds the keystone always has an advantage over the other party in controlling when and whether the protocol completes or not.\nIn this thesis, the fair exchange of digital signatures problem is studied. In the first part of this thesis, the OFE security is strengthened and a more practical model which is called enhanced chosen-key model is proposed. Unlike the existing multiuser setting and chosen-key model, an adversary in the enhanced chosen-key model is further provided with the signing oracle that outputs full signatures generated by the signer, and may even be allowed to have access to the arbitrator's secret key. The necessity for the new model is demonstrated. It is shown that two existing methodologies for constructing optimistic fair exchange schemes remain valid in the enhanced chosen-key model.\nNext, the efficiency of OFE constructions is improved. A model for 2-user ring signatures called `unforgeability against restricted adaptive attacks' is proposed and it is shown that the new ring model is strictly weaker than the model of unforgeability under an adaptive attack, against a static adversary in the 2-user setting. Based on the finding that 2-user ring signatures secure in this weaker model will suffice to guarantee the security of the resulting OFE schemes in the enhanced chosenkey model, the most efficient OFE scheme whose security does not rely on random oracles is proposed.\nNew situations in OFE are also investigated, and the applications of OFE are extended. The scenarios where the digital items to be exchanged are threshold signatures are considered, and the notion of threshold-oriented OFE (TOFE) together with a security model and an efficient concrete scheme is proposed. It is identified that in some scenarios, it is required that prior to the completion of the protocol, no information about the actual exchange should be revealed to an outsider. To achieve this purpose, the notion of perfect ambiguous optimistic fair exchange (PAOFE) is introduced, the security model for PAOFE is proposed and a generic construction based on existing primitives is offered. OFE in the attribute-based setting is considered and the notion of attribute-based optimistic fair exchange (ABOFE) is proposed. The security model and a construction for ABOFE are presented as well.\nFinally, concurrent signatures is revisited. It is showed that theoretically the party who controls the keystone in a concurrent signature scheme has more advantages than previously thought. In particular, the notion is examined and the advantages are classified into three levels.It is demonstrated that concurrent signatures may be abused in practical applications if one fails to take these advantages into account.
Optimistic fair exchange (OFE) is a kind of protocol that solves the fair exchange problem with the help of a trusted third party, usually referred to as an arbitrator. Participation of the arbitrator is required only when there is a dispute among the exchanging parties. Thus, the majority of the executions of the exchange does not involve the arbitrator and hence the term optimistic. The passive nature of the arbitrator makes optimistic fair exchange a desirable tool in applications, such as contract signing and electronic commerce. The highest level of security of optimistic fair exchange in the literature is the multiuser security in the chosen-key model, proposed by Huang, Yang, Wong, and Susilo in CT-RSA 2008. They showed that an efficient optimistic fair exchange scheme secure in this sense can be constructed generically from a conventional digital signature and a two-party ring signature. In particular, the underlying ring signature is required to be unforgeable under an adaptive attack, against a static adversary in the 2-user setting. In this paper, we propose a new security model for two-party ring signatures called unforgeability against restricted adaptive attacks and demonstrate that our new model is strictly weaker than the model of unforgeable under an adaptive attack, against a static adversary in the 2-user setting. We make an observation that two-party ring signatures secure in this weaker model will suffice to guarantee the security of the resulting OFE scheme following the aforementioned generic construction. Based on this observation, more efficient OFE schemes secure in the standard model can be constructed. Specifically, we prove that the well-known Bender, Katz, and Morselli's 2-user ring signature is secure in our weakened model. Based on this two-party ring signature, we construct an OFE secure in the chosen-key model offering multiuser security in the standard model under the computational Diffie-Hellman assumption. The assumption is arguably weaker than those used in all existing constructions, which rely on the random oracle model, decisional assumptions, or the strong Diffie-Hellman assumptions. It is also worth noting that our scheme is the most efficient one in the standard model, and offers comparable efficiency against those secure under the random oracle model.
We present protocols for fair exchange of electronic data (digital signatures, payment and confidential data) between two parties A and B. Novel properties of the proposed protocols include: 1) offline trusted third party (TTP), i.e., TTP does not take part in the exchange unless one of the parties behaves improperly; 2) only three message exchanges are required in the normal situation; 3) true fair exchange, i.e., either A and B obtain each other's data or no party receives anything useful; no loss can be incurred to a party no matter how maliciously the other party behaves during the exchange. This last property is in contrast to previously proposed protocols with offline TTP ([1] and [21]), where a misbehaving party may get another party's data while refusing to send his document to the other party, and the TTP can provide affidavits attesting to what happened during the exchange. To our knowledge, the protocols presented here are the first exchange protocols which use offline TTP and at the same time guarantee true fair exchange of digital messages. We introduce a novel cryptographic primitive, called the Certificate of Encrypted Message Being a Signature (CEMBS), as the basic building block of the fair exchange protocols. It is used to prove that an encrypted message is a certain party's signature on a public file, without revealing the signature. We also give two examples to show in detail how the certificate can be constructed.
In an Optimistic Fair Exchange (OFE) for digital signatures, two parties exchange their signatures fairly without requiring any online trusted third party. The third party is only involved when a dispute occurs. In all the previous work, OFE has been considered only in a setting where both of the communicating parties are individuals. There is little work discussing about the fair exchange between two groups of users, though we can see that this is actually a common scenario in actual OFE applications. In this paper, we introduce a new variant of OFE, called Group-Oriented Optimistic Fair Exchange (GOFE). A GOFE allows two users from two different groups to exchange signatures on behalf of their groups in a fair and anonymous manner. Although GOFE may be considered as a fair exchange for group signatures, it might be inefficient if it is constructed generically from a group signature scheme. Instead, we show that GOFE is backward compatible to the Ambiguous OFE (AOFE). Also, we propose an efficient and concrete construction of GOFE, and prove its security under the security models we propose in this model. The security of the scheme relies on the decision linear assumption and strong Diffie-Hellman assumption under the random
Based on the verifiably encrypted signature scheme without random oracles recently proposed by Gorantla et al.,a new scheme of optimistic fair exchange of digital signatures is proposed in this paper.The two players firstly exchange their verifiably encrypted signature on agreed-upon messages then their ordinary signature after the verification of each other's verifiably encrypted signature.If one of them executes the protocol dishonestly,the other can resort to a trusted third party so as to get the purpose of fair exchange of signatures.The proposed scheme has properties of short signature,low computation and verification cost.It can realize exchange of digital signatures fairly and efficiently.
Consider a scenario in which one party A consisting of a number of manufactories would like to sign a contract with another party B who is a selling company so that they can unify prices to avoid over competition. This may be done via Internet to reduce travelling cost. To cater for such applications, we propose the concept of optimistic fair exchange of distributed signatures (OFEDS) which allows an authorized set of signers to fairly exchange signatures with a verifier, and a trusted arbitrator will intervene in the protocol only when there are disputes between two parties. We consider the security requirements for OFEDS, in which besides the standard security requirements for existing optimistic fair exchange protocols, robustness is introduced to ensure that OFEDS can be successfully performed even when there exist some dishonest signers. We instantiate a non-interactive construction of OFEDS based on the Computational Diffie-Hellman (CDH) assumption in the random oracle model. Our work shows that for any general monotone access structure, there exists a CDH-based OFEDS protocol if all the involved signers are honest.