Optimistic fair exchange of digital signatures

Abstract

We present a new protocol that allows two players to exchange digital signatures over the Internet in a fair way, so that either each player gets the other's signature, or neither player does. The obvious application is where the signatures represent items of value, for example, an electronic check or airline ticket. The protocol can also be adapted to exchange encrypted data. The protocol relies on a trusted third party, but is "optimistic," in that the third party is only needed in cases where one player attempts to cheat or simply crashes. A key feature of our protocol is that a player can always force a timely and fair termination, without the cooperation of the other player.

On the security of fair non-repudiation protocols

“…The idea for such a solution is to enable TTP to generate a modified signature EOR. This can be achieved with cryptographic primitives like verifiable encryption (e.g., [5,6]) or convertible signatures (e.g., [8,20]). …”

Certificates of Recoverability with Scalable Recovery Agent Security

“…To remedy these two drawbacks, one could use the generic verifiable encryption scheme that appears in [2]. However, the resulting interactive proof in C3 would only have the property of computational zero-knowledge.…”

“…However, the resulting interactive proof in C3 would only have the property of computational zero-knowledge. Also, no formal guarantee for combined security, as defined above, is given in [2].…”

Multi-party Stand-Alone and Setup-Free Verifiably Committed Signatures

“…We denote C(a, r a ) = g a 1 g ra 2 modn a commitment to a in bases (g 1 , g 2 ), where r a is randomly selected over {0, 2 s n}, where s is a security parameter. This commitment scheme first appeared in [12] and reconsidered by Damgård and Fujisaki [10] is statistically hiding and computationally binding, i.e., -a committer is unable to commit itself to two values a 1 , a 2 such that a 1 = a 2 in Z by the same commitment unless the committed can factor n or solves the discrete logarithm of g 1 in base g 2 or the the discrete logarithm of g 2 in base g 1 ; -C(a, r a ) statistically reveals no information to the receiver, i.e., there is a simulator which outputs simulated commitments to a which are statistically indistinguishable from true ones. -this commitment is homomorphic, i.e., C(a+b, r a +r b ) = C(a, r a ) × C(b, r b ).…”

“…Optimistic fair-exchange protocols was first introduced by Asokan et al, in [1] and formally studied in [2], [3] and [14] in the context of verifiably encrypted signatures. Very recently, Dodis and Reyzin [11] have formalized a unified model for fair-exchange protocols as a new cryptographic primitive called verifiably committed signatures in the two-party setting.…”