3
$\begingroup$

I understand that one can define EUF-CMA of a signature scheme is terms of a game where the adversary is allowed to query signatures on messages of his choosing, and at the end of the game he must output a pair (m, s) such that s is a valid signature of m, and m has not been queried before. My questions are the following:

  1. How does one select selective unforgability under chosen message attack in terms of a game?

  2. Are there examples of signatures which are SUF-CMA, but not EUF-CMA?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
4
$\begingroup$

1) In the selective unforgeability game (often also denoted universal unforgeability), the adversary is given the public key and a target message for which it needs to produce a forgery (instead of giving the adversary only the public key and letting the adversary choose the target message).

2) No, any scheme that is EUF-CMA is also SUF-CMA (this is easy to show; build an EUF-CMA adversary from any SUF-CMA one by simply running the SUF one on an arbitrarily chosen message).

Improve this answer
$\endgroup$
2
  • $\begingroup$ Hi. Thanks for your response. Apologies, for 2) I meant the other way around (see edit) $\endgroup$
    – user32609
    Commented Mar 19, 2016 at 16:24
  • $\begingroup$ Ah ok. Yes, that's perfectly possible. You can show how you can modify any SUF-CMA secure scheme such that it remains SUF secure, but is trivially EUF insecure. You can think about that ;) I guess I have time tomorrow to edit my answer. $\endgroup$
    – DrLecter
    Commented Mar 19, 2016 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.