Signature Unforgeability

Definitions

Let us consider a signature scheme $\Pi = (\texttt{KGen}, \texttt{Sign}, \texttt{Vrfy})$.

EUF-CMA

We give the definition of existential unforgeability under CMA.

$\Pi$ is EUF-CMA if for all PPT valid adversaries $A, \exists$ negligible $\epsilon$ such that $Pr[\Game_{\Pi, A}^{\textrm{EUF-CMA}}(\lambda) = 1] \le \epsilon(\lambda)$, where the game is the following:

\[\begin{aligned} &&& \underline{\Game_{\Pi, A}^{\textrm{EUF-CMA}}(\lambda)}: \\ & \\ &1. && (pk, sk) \samples \texttt{KGen}(1^\lambda) \\ &2. && (m^*, \sigma^*) \samples A^{\texttt{Sign}(sk, \cdot)}(pk) \\ &4. && \textbf{return} \; \texttt{Vrfy}(pk, (m^*, \sigma^*)) \end{aligned}\]

An adversary A is said to be valid if does not query the signature oracle with $m^*$.

SUF-CMA

Here we consider a stricter property, namely strong EUF-CMA. The game is the same: what changes in this setting is the definition of the validity.

An adversary A is said to be valid if the signature oracle never returns $\sigma^* $ on input $m^* $. The difference with respect to the canonical EUF-CMA is that the attacker can even see polynomially many valid signatures of the message $m^*$ before forging a signature for it.