5
$\begingroup$

When trying to prove the security of an asymmetric signature, for instance, for existential (or strong) unforgeability against chosen messages attack, do we need to consider the signer as a possible adversary?

$\endgroup$
7
$\begingroup$

No, the signer is per definition in possession of the secret signing key and thus can always produce signatures for any message of his choice.

Consequently, a notion of unforgeability is not meaningful with respect to the signer. For a signature scheme one requires unforgeability for parties who are not in possession of the secret signing key but only the public verification key.

You may also look at this answer for a more detailed discussion on attacks and attack models for digital signature schemes.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.