Paper 2020/1525

BUFFing signature schemes beyond unforgeability and the case of post-quantum signatures

Cas Cremers, Samed Düzlü, Rune Fiedler, Marc Fischlin, and Christian Janson


Modern digital signature schemes can provide more guarantees than the standard notion of (strong) unforgeability, such as offering security even in the presence of maliciously generated keys, or requiring to know a message to produce a signature for it. The use of signature schemes that lack these properties has previously enabled attacks on real-world protocols. In this work we revisit several of these notions beyond unforgeability, establish relations among them, provide the first formal definition of non re-signability, and a transformation that can provide these properties for a given signature scheme in a provable and efficient way. Our results are not only relevant for established schemes: for example, the ongoing NIST PQC competition towards standardizing post-quantum signature schemes has six finalists in its third round. We perform an in-depth analysis of the candidates with respect to their security properties beyond unforgeability. We show that many of them do not yet offer these stronger guarantees, which implies that the security guarantees of these post-quantum schemes are not strictly stronger than, but instead incomparable to, classical signature schemes. We show how applying our transformation would efficiently solve this, paving the way for the standardized schemes to provide these additional guarantees and thereby making them harder to misuse.

Available format(s)
Public-key cryptography
Publication info
Published elsewhere. MAJOR revision.IEEE Symposium on Security and Privacy (S&P 2021)
Digital signature schemeexclusive ownershipDSKS attacknon re-signabilitymessage-bound signaturesNIST PQC candidates
Contact author(s)
cremers @ cispa de
2021-04-27: last of 2 revisions
2020-12-08: received
See all versions
Short URL
Creative Commons Attribution


      author = {Cas Cremers and Samed Düzlü and Rune Fiedler and Marc Fischlin and Christian Janson},
      title = {BUFFing signature schemes beyond unforgeability and the case of post-quantum signatures},
      howpublished = {Cryptology ePrint Archive, Paper 2020/1525},
      year = {2020},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.