Reactively secure signature schemes

Abstract

Protocols for problems like Byzantine agreement, clock synchronization or contract signing often use digital signatures as the only cryptographic operation. Proofs of such protocols are frequently based on an idealizing "black-box" model of signatures. We show that the standard cryptographic security definition for digital signatures is not sufficient to ensure that such proofs are still valid if the idealized signatures are implemented with real, provably secure signatures. We propose a definition of signature security in general reactive, asynchronous environments and prove that for signature schemes where signing just depends on a counter as state the standard security definition implies our definition. © Springer-Verlag Berlin Heidelberg 2003.