A taxonomy and survey of attacks on digital signatures

Non-repudiation is a desired property of current electronic transactions, by which a further repudiation of the commitments made by any involved party is prevented. Digital signatures are recognized by current standards and legislation as non-repudiation evidence that can be used to protect the parties involved in a transaction against the other's false denial about the occurrence of a certain event. However, the reliability of a digital signature should determine its capability to be used as valid evidence. The inevitability of vulnerabilities in technology and the non-negligible probability of an occurrence of security threats would make non-repudiation of evidence difficult to achieve. We consider that it is of the utmost importance to develop appropriate tools and methods to assist in designing and implementing secure systems in a way that reliable digital signatures can be produced. In this paper, a comprehensive taxonomy of attacks on digital signatures is presented, covering both the signature generation and verification phases. The taxonomy will enable a rigorous and systematic analysis of the causes that may subvert the signature reliability, allowing the identification of countermeasures of general applicability. In addition, an intensive survey of attacks classified under our taxonomy is given.