# Tag Info

1

As already discussed by @fgrieu in his answer and myself in the comments of your question and his answer, the standard notion of security of digital signature schemes, namely (strong) existential unforgeability under adaptively chosen message attacks (UF-CMA), does not cover the case you are concerned about. At least for hash-then-sign signatures built ...

0

By the definition given there, in a modular protocol design, each method or scheme used in the protocol (such as the use of nonces or the application of a cryptographic schemes) has a clear goal which it is proven to achieve, and sub-protocols can be replaced without re-proving the security of the remaining protocol steps. That's also the meaning ...

3

Reductionist security In a reductionist security proof for some cryptographic protocol $\Pi$ to some alleged hard problem $P$ means, that we can build an algorithm $\cal B$ for solving $P$ if we have access to a hypothetical algorithm $\cal A$ that efficiently breaks the security definition for the protocol $\Pi$. In general, showing a polynomial time ...

3

The standard definition of existential forgery allows the adversary to ask and obtain the signature of any message she wants, and claim success if she can exhibit (with sizable odds) any acceptable (message, signature) pair, for any message for which she did not ask signature. Update: There is also strong existential unforgeability, where the adversary ...

Top 50 recent answers are included