Logical Analysis and Verification of Cryptographic Protocols - Loria

82 CHAPTER 4. PROTOCOLS WITH VULNERABLE SIGNATURE SCHEMES
4.1 Signature schemes
4.1.1 Definition of signature schemes
The idea of digital signature first appeared in W. Diffie and M.E. Hellman’s seminal
paper [101]. A digital signature of a message is a number dependent on some
secret known only to the signer, and, additionally, on the content of the message
being signed. Signatures must be verifiable; if a dispute arises as to whether a
party signed a document (caused by either a lying signer trying to repudiate a
signature it did create, or a fraudulent claimant), an unbiased third party should
be able to resolve the matter equitably, without requiring access to the signers
secret information (secret key). To this end, each agent A possesses a pair of
keys: a public key, pkA and a secret key, skA. The agent A uses his secret key
skA to sign messages, and pkA is the key used by the other agents to verify A’s
signatures. The secret key of an agent is called signing key, and his public key is
called verifying key.
Formally, we define a key generation algorithm G to be an algorithm that takes
an agent’s name A and a random number as arguments and returns a pair of
public and secret keys, respectively denoted by P k(A) and Sk(A), corresponding
to that agent. We define a digital signature generation algorithm (or signature
generation algorithm), denoted by sig, to be an algorithm that takes a secret key
(also called signing key), sk, and a message, m, as inputs, and generates a message,
sig(m, sk), representing the digital signature of m using the secret key sk.
We define a digital signature verification algorithm (or verification algorithm), denoted
by ver, to be an algorithm testing whether a message s is a valid signature
of a message m using the public key pk (also called verifying key).
Definition 43 (digital signature scheme) A digital signature scheme (or simply a signature
scheme) is defined by three algorithms: the signature generation algorithm “sig ′′ ,
the verification algorithm “ver ′′ , the key generation algorithm “G ′′ .
Example 20 (Example of signature schemes) We give here a classical digital signature
scheme: the signature scheme proposed by W. Diffie and M. E. Hellman [101]. To
create a signature scheme, W. Diffie and M. E. Hellman proposed to use a “trap-door
function” f (informally, a “trap-door function” f is a function for which it is easy to
evaluate f(x) for any argument x but for which, given only f(x), it is computationally
infeasible to find any y with f(y) = f(x) without the secret “trap-door” information).
In their signature scheme, an agent A publishes the “trap-door function” f and anyone
can validate any A ′ s signature by checking that f(signature) = message. Only the
agent A possesses the “trap-door” information allowing him to invert f, and compute
a signature y such that f(y) = x where x is the message to sign.