\documentclass{splib}

\begin{document}
\begin{protocol}{GJM}%
{Juan A. Garay, Markus Jakobson, Philip MacKenzie}{1999}{Alexandre Boisseau}{30/10/2002}{}

\begin{abstract}
The goal of this protocol is to achieve distributed contract signing in an abuse-free way, that is no party ever can prove to a third party that he is able of determining the issue of the exchange (validate or invalidate the contract). To achieve this goal, a special construction called private contract signature is introduced. Such a private contract signature has the particular property that it is meaningful only for a given trusted third party. Moreover, this protocol is optimistic in the sense that the trusted third party is required only in case of problem.
\end{abstract}

\begin{core}
\begin{declarations}
\dcl{A,B,T}{principal}
\dcl{C}{msg}
\dcl{PCS}{(principal,msg,principal,principal):msg}
\dcl{S-SIG}{(principal,msg):msg}
\dcl{TP-SIG}{(principal,msg):msg}
\dcl{resolved,aborted}{bool}
\dcl{abort}{msg}
\end{declarations}

\begin{messages}
\msg{Exchange-1}{A}{B}{PCS(A,C,B,T)}
\msg{Exchange-2}{B}{A}{PCS(B,C,A,T)}
\msg{Exchange-3}{A}{B}{S-SIG(A,C)}
\msg{Exchange-4}{B}{A}{S-SIG(B,C)}

\msg{Abort-1}{A}{T}{S-SIG(A,[C,A,B,abort])}
\msg{Abort-2}{T}{A}{if (resolved) then S-SIG(B,C) else S-SIG(T,S-SIG(A,[C,A,B,abort]))}

\msg{Resolve-A-1}{A}{T}{[PCS(B,C,A,T),S-SIG(A,C)]}
\msg{Resolve-A-2}{T}{A}{%
if (aborted) then S-SIG(T,S-SIG(A,[C,A,B,abort])) %
else if (resolved) S-SIG(B,C) %
else TP-SIG(B,C)}

\msg{Resolve-B-1}{B}{T}{[PCS(A,C,B,T),S-SIG(B,C)]}
\msg{Resolve-B-2}{T}{B}{%
if (aborted) then S-SIG(T,S-SIG(A,[C,A,B,abort])) %
else if (resolved) S-SIG(A,C) %
else TP-SIG(A,C)}
\end{messages}
\end{core}

\begin{explanation}
About cryptographic primitives involved :
\begin{itemize}
\item \code{S-SIG(X,M)} denotes standard signature of contractual text \code{M} by principal \code{A},
\item \code{PCS(A,M,B,T)} denotes private contract signature of contractual text \code{M} by \code{A} inside a session involving participant \code{B} and TTP \code{T}. It is assumed that such a construction has the following properties:
\begin{itemize}
\item a ``fake-version'' of \code{PCS(A,M,B,T)} can be computed by \code{B}, identical to the true one from the point of view of an external observer \code{O} (distinct from \code{A}, \code{B} and \code{T}),
\item \code{PCS(A,M,B,T)} can be converted by \code{T} into a ``TTP-signature'', denoted \code{TTP-SIG(A,M)} and identical to \code{S-SIG(A,M)} from the point of view of an external observer.
\end{itemize}
\end{itemize}
About the execution of the protocol:
\begin{itemize}
\item when no problem appears between \code{A} and \code{B}, the \code{Exchange} subprotocol is able to complete contract distribution,
\item after sending the first message, if \code{A} does not receive any response from \code{B}, she can run the \code{Abort} subprotocol,
\item after sending the second message, if \code{B} does not receive any response from \code{A}, she can run the \code{Resolve-B} subprotocol,
\item after sending the third message, if \code{A} does not receive any response from \code{B}, she can run the \code{Resolve-A} subprotocol.
\end{itemize}
\end{explanation}

\begin{property}
This protocol was designed in order to satisfy the following properties:
\begin{itemize}
\item \emph{completeness}: an adversary (submitted to some restrictions) cannot prevent two honest participants from obtaining a valid signature on a contractual text,
\item \emph{fairness}: it is impossible for a corrupted participant to obtain a valid contract without allowing the remaining participant to do the same. Moreover, once an honest participant has obtained an abort confirmation from the TTP, it is impossible for any other participant to obtain a valid contract. Finally, every honest participant is able to complete the protocol.
\item \emph{abuse-freeness}: it is impossible for a (possible corrupted) participant, at any point of the protocol, to be able to prove to an external observer that he has the power to determine the outcome of the protocol (validate or invalidate the contract).
\end{itemize}
\end{property}

\begin{references}
\cite{GJM99}
\end{references}

\begin{proofs}
\cite{Shmat2001}~\cite{KremerRaskin2002}~\cite{Chadha2001}
\end{proofs}

\begin{attacks}
\cite{Shmat2001}
\end{attacks}

\end{protocol}
\end{document}

%%% Local Variables: 
%%% mode: latex
%%% TeX-master: t
%%% End: 
