Logical Analysis and Verification of Cryptographic Protocols - Loria

84 CHAPTER 4. PROTOCOLS WITH VULNERABLE SIGNATURE SCHEMES
Signature generation and verification algorithms.
An agent A produces a signature s for a message m, which can later be
verified by any agent B. The signature generation algorithm is defined as
follows:
sig : M × K → S
The verification algorithm is defined as follows:
ver : M × S × K → {1}
such that for any m, s and pk we have: ver(m, s, pk) =
� 1, if s = sig(m, sk), sk = Sk(A), and pk = P k(A) for some agent A
We assume each time an agent generates a pair of secret and public
keys, (sk, pk), the secret key sk matches the public key pk, that is, for any
message m, we have ver(m, sig(m, sk), pk) = 1.
Digital signature schemes with message recovery
Digital signature schemes with message recovery denote the schemes for which
a priori knowledge of the message that has been signed is not required for the
verification algorithm. In this case, the original message can be recovered from
the signature itself. Examples of schemes providing digital signatures with message
recovery are RSA [174], Rabin [171], and Nyberg-Rueppel [18] public-key
signature schemes. We describe below the three algorithms: the signature generation,
the verification, the public key generation, and the key generation algorithms.
Key generation algorithms.
Each agent A creates a pair of keys, a secret key and a correspondant public
key. The agent A will use his secret key to sign messages, and his public
key will be used by other agents for verifying A ′ s signatures. The key
generation algorithm is defined as follows:
G : A × R → K ∗ K
We remark that the second argument of the function G represents a randomly
generated number, the use of this random number allows any agent
A to have a different pair of keys for each session, and that using the same
key generation function. Furthermore, we remark that the two functions
Sk and P k denote the two parts of the key generation algorithm G, and
we denote respectively by Sk(A) and P k(A) the secret and public keys of
A ∈ A;