A randomized protocol for signing contracts-英文文献.pdf

40 IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 36. NO. 1.JANUARY 1990 A Fair Protocol for Signing Contracts MICHAEL BEN-OR, ODED GOLDREICH, SILVIO MICALI, AND RONALD L. RIVEST Abtract-Two parties, A and B , want to sign a contract C over a valid one. An instance of a signature scheme may be communication network. To do so,they must “simultaneously” exchange provided by ordinary “hand-written” signatures. Hand- their commitments to C. Since simultaneous exchange is usually impossi- ble in practice, protocols are needed to approximate simultaneity by written signatures are believed to be hard to forge and can exchanging partial commitments in piece by piece manner. During such a be universally verified as trusted notary publics keep sam- protocol, one party or another may have a slight advantage; a “fair” ples of each user’s signature. Another instance of a signa- protocol keeps this advantage within acceptable limits. We present a new ture scheme, more suitable for computer networks, is a protocol that is fair in the sense that, at any stage in its execution, the “digital signature scheme.” This notion was introduced by conditional probability that one party cannot commit both parties to the contract given that the other party can, is close to zero. This is true even if Diffie and Hellman [5] and first implemented by Rivest A and B have vastly different computing powers, and is proved under very et al. [15]. The strongest notion of security for a digital weak cryptographic assumptions