Conditional Digital Signatures and Signing in the Future
             M.Klonowski, M.Kutylowski, A.Lauks, F.Zagorski



We consider conditional digital signatures (CDS for short): According to
this  scheme a creator of a CDS signature, say Alice, signs a message M1
conditioned by a signature under M2 of an another  user,  say  Bob.  The
string  created  by Alice can be transformed into a digital signature of
Alice under M1, once we are given a signature under M2 produced by  Bob.
Until  the moment of creating a signature under M2 by Bob, the signature
under M1 by Alice  DOES  NOT  EXIST.  This  differs  from  the  previous
solutions  where  merely  a  condition about M2 has been included into a
message signed by Alice. The key feature of our  scheme  is  that  Alice
prepares the CDS signature before Bob actually signs M2.

We propose two CDS schemes -- the first one prohibits  checking  that  a
signature  of  M1  has been prepared by Alice until Bob signs M2. In the
case of the second scheme Alice can prove interactively that the  string
created  by  Alice  hides  a  signature  of  M1  conditioned  upon Bob's
signature under M2.

CDS signatures can be used for various purposes. For instance, they seem
to  be  very  useful  in  computer  systems  with  a  modular or layered
architecture, and allow one process to sign something in  advance  in  a
secure  way.  Similar  scenarios  can  occur  in many business and legal
situations.

CDS schemes can be used to build a system in which a  signature  can  be
retrieved  at  a  given  FUTURE  date.  This  feature  requires a public
institution signing periodically the current time. In a similar way  one
can  provide possibility of conditional decryption -- in such a case one
can decrypt a ciphertext only after signing a particular document  by  a
third party (for instance a public body).