The problem to allow two parties (say Alice and Bob) to sign an electronic contract online fairly is an interesting problem and it has been studied for a long time. Optimistic fair exchange (OFE) is an efficient remedy to this problem, which incorporates a semi-trusted third party called arbitrator, who will be called in to resolve a dispute during an exchange between Alice and Bob. It should be noted that the arbitrator is not required to be fully trusted, or else such an entity may not be available in practice. To reduce the trust level of the arbitrator, the requirement that the arbitrator should not be able to produce a full signature without the signer's content has been proposed in literature. Nevertheless, we observe that the existing OFE models do not capture the realistic situation that the arbitrator itself should not be able to generate a partial signature on a new message. This requirement is essential since we only put a partial trust towards the arbitrator, but on the other hand, we also assume that the arbitrator will not do such a forgery. Therefore, to reflect this situation, we propose an enhanced model of OFE that explicitly captures this requirement. We demonstrate the difference between our enhanced model and the existing chosen-key model through a concrete OFE scheme that serves as a counterexample. Since our model is strictly stronger than the existing model, we investigate the security of the existing schemes in our enhanced model. Interestingly, we show that OFE schemes based on verifiably encrypted signature and those based on ring signature can remain secure in our enhanced model given slight modifications to the primitives.

Optimistic fair exchange (OFE) is a kind of protocol that solves the fair exchange problem with the help of a trusted third party, usually referred to as an arbitrator. Participation of the arbitrator is required only when there is a dispute among the exchanging parties. Thus, the majority of the executions of the exchange does not involve the arbitrator and hence the term optimistic. The passive nature of the arbitrator makes optimistic fair exchange a desirable tool in applications, such as contract signing and electronic commerce. The highest level of security of optimistic fair exchange in the literature is the multiuser security in the chosen-key model, proposed by Huang, Yang, Wong, and Susilo in CT-RSA 2008. They showed that an efficient optimistic fair exchange scheme secure in this sense can be constructed generically from a conventional digital signature and a two-party ring signature. In particular, the underlying ring signature is required to be unforgeable under an adaptive attack, against a static adversary in the 2-user setting. In this paper, we propose a new security model for two-party ring signatures called unforgeability against restricted adaptive attacks and demonstrate that our new model is strictly weaker than the model of unforgeable under an adaptive attack, against a static adversary in the 2-user setting. We make an observation that two-party ring signatures secure in this weaker model will suffice to guarantee the security of the resulting OFE scheme following the aforementioned generic construction. Based on this observation, more efficient OFE schemes secure in the standard model can be constructed. Specifically, we prove that the well-known Bender, Katz, and Morselli's 2-user ring signature is secure in our weakened model. Based on this two-party ring signature, we construct an OFE secure in the chosen-key model offering multiuser security in the standard model under the computational Diffie-Hellman assumption. The assumption is arguably weaker than those used in all existing constructions, which rely on the random oracle model, decisional assumptions, or the strong Diffie-Hellman assumptions. It is also worth noting that our scheme is the most efficient one in the standard model, and offers comparable efficiency against those secure under the random oracle model.

Optimistic fair exchange (OFE) is a type of cryptographic protocols aimed at solving the fair exchange problem over open networks with the help of a third party to settle disputes between exchanging parties. It is well known that a third party is necessary in the realization of a fair exchange protocol. However, a fully trusted third party may not be available over open networks. In this paper, the security of most of the proposed OFE protocols depends on the assumption that the third party is semitrusted in the sense that it may misbehave on its own but does not conspire with either of the main parties. The existing security models of OFE have not taken into account the case where the potentially dishonest third party may collude with a signer in the sense of sharing its secret key with the signer. In this paper, to reduce the trust level of the arbitrator and increase the security of OFE, we propose an enhanced security model that, for the first time, captures this scenario. We also show a separation between the existing model and our enhanced model with a concrete counter example. Finally, we revisit two popular approaches in the construction of OFE protocols, which are based on verifiably encrypted signature and conventional signature plus ring signature, respectively. Our result shows that the conventional signature plus ring signature approach approach remains valid in our enhanced model. However, for schemes based on verifiably encrypted signature, slight modifications are needed to guarantee the security.