What is a formal definition of strong one-time-secure signatures?

I know the Lamport's scheme is one of them, but what is the global definition of it?

  • $\begingroup$ @dingrite: Actually, I would disagree that Lamport is always the "best"; a Winternitz signature is often better (significantly shorter, at the cost of some computation) $\endgroup$ – poncho Dec 16 '17 at 21:30

It's the usual security game for digital signatures, but the adversary is only allowed to make a single signature query.

In other words:

  1. The simulator generates a key pair, and gives the adversary the verification key.
  2. The adversary sends the simulator a message $m$. The simulator signs the message and sends the signature $\sigma$ to the adversary.
  3. The adversary outputs his forgery $(m',\sigma')$.

The adversary wins if $\sigma'$ is a valid signature on $m'$ and $(m',\sigma') \not= (m,\sigma)$.

In the usual signature game, the second step can be repeated many times.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.