Concurrent signatures with fully negotiable binding control

Since the introduction of concurrent signatures, the authorship binding of concurrent signatures has always been initiator-controlled, that is, only the initiator of a concurrent signature exchange can control "whether" and "when" to convert the exchanging ambiguous signatures to publicly verifiable ones concurrently. This binding control is not negotiable. In some applications however, this limitation is undesirable, and instead, as of optimistic fair exchange does, letting the responder control "whether" and "when" to have exchanged ambiguous signatures bound is needed. This motivates us towards constructing a new concurrent signature variant which supports negotiation between the original initiator-controlled binding and a new responder-controlled binding. In this paper, we formalize the notion and propose the first construction, which allows either the initiator or the responder to control "whether" and "when" the binding of the exchanging ambiguous signatures will take place concurrently. The scheme is backward compatible to the original concurrent signature and is also comparable in performance to the existing ones.