In the definition of existential unforgeability, there is no detail about the following questions.
In general, can we suppose that a signer is also a possible adversary ? When generating a signature, can we suppose that the signer behaves well ?
More precisely, suppose that a signer is able to generate a signature which is valid for an other document of his choice. Despite this, for a correctly generated signature, suppose that the signature scheme used is secure when considering an adversary which is not the signer, that is to say, this adversary is unable to generate a signature for any other document. Is this signature scheme really considered secure ?
What are the standard (conventional) hypothesis about that ?
I update in reaction to the comment:
- if the signer behaves well, then the signature is unforgeable (for the signer or any adversary which is not the signer).
- if the signer misbehaves, then the signature is forgeable (for the signer, without using the key, and for any adversary).
Is this king of scheme considered secure in the sense of existential forgeability ? can we suppose that the signer behaves well ?