Digital signatures do not guarantee exclusive ownership

Abstract

Digital signature systems provide a way to transfer trust from the public key to the signed data; this is used extensively within PKIs. However, some applications need a transfer of trust in the other direction, from the signed data to the public key. Such a transfer is cryptographically robust only if the signature scheme has a property which we name exclusive ownership. In this article, we show that the usual signature algorithms (such as RSA[3] and DSS[4]) do not have that property. Moreover, we describe several constructs which may be used to transform a signature scheme into another signature scheme which provides exclusive ownership. © Springer-Verlag Berlin Heidelberg 2005.