Is the Notion of Divisible On-Line/Off-Line Signatures Stronger than On-Line/Off-Line Signatures?

  • Authors:

  • Man Ho Au;Willy Susilo;Yi Mu

  • Affiliations:

  • Center for Computer and Information Security Research School of Computer Science and Software Engineering, University of Wollongong, Australia;Center for Computer and Information Security Research School of Computer Science and Software Engineering, University of Wollongong, Australia;Center for Computer and Information Security Research School of Computer Science and Software Engineering, University of Wollongong, Australia

  • Venue:
  • ProvSec '09 Proceedings of the 3rd International Conference on Provable Security
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

On-line/Off-line signatures are useful in many applications where the signer has a very limited response time once the message is presented. The idea is to perform the signing process in two phases. The first phase is performed off-line before the message to be signed is available and the second phase is performed on-line after the message to be signed is provided. Recently, in CT-RSA 2009, Gao et al. made a very interesting observation that most of the existing schemes possess the following structure. In the off-line phase, a partial signature, called the off-line token is computed first. Upon completion of the on-line phase, the off-line token constitutes part of the full signature. They considered the "off-line token exposure problem" in which the off-line token is exposed in the off-line phase and introduced a new model to capture this scenario. While intuitively the new requirement appears to be a stronger notion, Gao et al. cannot discover a concrete attack on any of the existing schemes under the new model. They regard clarifying the relationship between the models as an open problem. In this paper, we provide an affirmative answer to this open problem. We construct an On-line/Off-line signature scheme, which is secure under the ordinary security model whilst it is insecure in the new model. Specifically, we present a security proof under the old model and a concrete attack of the scheme under the new model. This illustrates that the new model is indeed stronger.