![](bg2.png)
generated by co-signers with different signing
orders often imply different meanings (In this case,
it is not necessary to consider fairness of signature
generation). Contract signature also suits well to
joint announcement between different governments,
ministries, and enterprises. So it can be used more
widely than signing protocols and concurrent
signatures.
1.1 Related Work
There are many real-life situation where multiple
signers need to sign the same message. A simple
solution is that every signer sign the message using
an ordinary signature scheme. But this has the
drawback that the data increases with the number of
signers. A multisignature (Okamoto, 1988)(Ohta
and Okamoto, 1991) scheme , whose goal is to
design a signature scheme without data expansion
with the number of signers, is a digital signature
scheme that allows multiple signers to generate a
single signature in a collaborative and simultaneous
manner. Moreover, in some applications, co-signers
in a signing group may be associated with different
roles/ positions and, therefore, have different
management liabilities and authorization
capabilities. Thus, multisignatures generated by the
same group of co-signers with different signing
orders often imply different meanings.
At the same time, as more business is
conducted over the Internet, the fair exchange
problem assumes an increasing importance. Early
work on solving this problem was based on the idea
of timed release or timed fair exchange of
signatures [8, 9, 10, 11]. Here, the two parties sign
their respective messages and exchange their
signatures “little-by-little” using a protocol.
Typically, such protocols are highly interactive with
many message flows. An alternative approach to
solving the problem of fair exchange of signatures
involves the use of a (semi-trusted) third party or
arbitrator
T who can be called upon to handle
disputes between signers. The idea is that
A
registers her public key with T in a one-time
registration, and thereafter may perform many fair
exchanges with other entities. To take part in a fair
exchange with
B ,
A
creates a partial signature
which she sends to
B . Entity B can be convinced
that the partial signature is valid (perhaps via a
protocol interaction with
A
) and that T can extract
a full, binding signature from the partial signature.
However, the partial signature on its own is not
binding for
A
. B then fulfils his commitment by
sending
A
his signature, and if valid, A releases
the full version of her signature to
B .
This protocol is fair since if
does not sign,
then
A
’s partial signature is worthless to B , and
if B does sign but A refuses to release her full
signature, then
can obtain it from
T
. The third
party is only required in case of dispute; for this
reason, protocols of this type are commonly
referred to as optimistic fair exchange protocols.
The main problem with such an approach is the
requirement for a dispute-resolving third party with
functions beyond those required of a normal
Certification Authority. In general, appropriate third
parties may not be available.
Concurrent signatures(Chen et al., 2004) and
concurrent signature protocols are also proposed to
solve this problem. In a concurrent signature
protocol, two parties
A and
can interact
without the help of a third party to sign (possibly
identical) messages
A
and
in such a way
that both
A and B become publicly committed
to their respective messages at the same moment in
time (i.e., concurrently). This moment is determined
by one of the parties through the release of an extra
piece of information
k which is called a keystone.
Before the keystone’s release, neither party is
publicly committed through their signatures, while
after this point, both are. In fact, from a third party’s
point of view, before the keystone is released, both
parties could have produced both signatures, so the
signatures are completely ambiguous. In a
concurrent signature scheme,
A first generates a
keystone
k and sends k to B . A and B
each generate ambiguous signatures
A
and
,
which are similar to ring signatures (Rivest et al.,
2001), in which an anonymous signer A wants to
have the option of later proving his authorship of a
ring signature. The solution was to choose bits
h
pseudo-randomly and later to reveal the seed used
to generate
h
. In a concurrent signature scheme,
before k is released, it can’t be assured that
A
is
signed by A, and it can’t be assured that
is
signed by
B . These assurances become possible
when
k is released. But these concurrent
signatures have the drawback that the data
expansion increases with the number of signers, and
also do not adapt to the cases of joint announcement
between different governments, ministries, and
enterprises. Moreover,
A may hide k and want
to publicize it when the contract signature is of
benefit to him. In this sense, the protocol is not fair.
SECRYPT 2006 - INTERNATIONAL CONFERENCE ON SECURITY AND CRYPTOGRAPHY
268