In contrast to ordinary digital signatures, the verification of undeniable signatures and of confirmer signatures requires
the cooperation of the signer or of a designated confirmer, respectively. Various schemes have been proposed so far, from
practical solutions based on specific number-theoretic assumptions to theoretical constructions using basic cryptographic
primitives. To motivate the necessity of new and provably secure constructions for confirmer signatures, we first describe
a flaw in a previous realization by Okamoto. We then present two generic constructions for designing provably secure and efficient
confirmer variants of many well-known signature schemes, including the schemes by Schnorr, Fiat and Shamir, ElGamal, and the
RSA scheme. The constructions employ a new tool called confirmer commitment schemes. In this concept the ability to open the
committed value is delegated to a designated confirmer. We present an efficient realization based on the Decision-Diffie-Hellman
assumption.
Keywords designated confirmer signature schemes - undeniable signature schemes - commitment schemes - provable security