Editing Digital signature (section)

==History==
In 1976, [[Whitfield Diffie]] and [[Martin Hellman]] first described the notion of a digital signature scheme, although they only conjectured that such schemes existed based on functions that are trapdoor one-way permutations.<ref name="ikWoF">"New Directions in Cryptography", IEEE Transactions on Information Theory, IT-22(6):644–654, Nov. 1976.</ref><ref name="lysythesis">"[https://dspace.mit.edu/handle/1721.1/29271 Signature Schemes and Applications to Cryptographic Protocol Design] {{Webarchive|url=https://web.archive.org/web/20220908083823/https://dspace.mit.edu/handle/1721.1/29271 |date=2022-09-08 }}", [[Anna Lysyanskaya]], PhD thesis, [[Massachusetts Institute of Technology|MIT]], 2002.</ref>  Soon afterwards, [[Ronald Rivest]], [[Adi Shamir]], and [[Len Adleman]] invented the [[RSA (algorithm)|RSA]] algorithm, which could be used to produce primitive digital signatures<ref name="rsa">{{cite journal | first1 = R. | last1 = Rivest | last2 = Shamir | first2 = A. | last3 = Adleman | first3 = L. | url = http://people.csail.mit.edu/rivest/Rsapaper.pdf | title = A Method for Obtaining Digital Signatures and Public-Key Cryptosystems | journal = Communications of the ACM | volume = 21 | issue = 2 | pages = 120–126 | year = 1978 | doi = 10.1145/359340.359342 | citeseerx = 10.1.1.607.2677 | s2cid = 2873616 | access-date = 2012-11-27 | archive-date = 2008-12-17 | archive-url = https://web.archive.org/web/20081217101831/http://people.csail.mit.edu/rivest/Rsapaper.pdf | url-status = dead }}</ref> (although only as a proof-of-concept – "plain" RSA signatures are not secure<ref name="7aSJZ">For example any integer, ''r'', "signs" ''m''=''r''<sup>''e''</sup> and the product, ''s''<sub>1</sub>''s''<sub>2</sub>, of any two valid signatures, ''s''<sub>1</sub>, ''s''<sub>2</sub> of ''m''<sub>1</sub>, ''m''<sub>2</sub> is a valid signature of the product, ''m''<sub>1</sub>''m''<sub>2</sub>.</ref>). The first widely marketed software package to offer digital signature was [[Lotus Notes]] 1.0, released in 1989, which used the RSA algorithm.<ref name="CKgyC">{{cite web|title=The History of Notes and Domino|url=http://www.ibm.com/developerworks/lotus/library/ls-NDHistory/|website=developerWorks|access-date=17 September 2014|date=2007-11-14|archive-date=2013-03-05|archive-url=https://web.archive.org/web/20130305042623/http://www.ibm.com/developerworks/lotus/library/ls-NDHistory/|url-status=live}}</ref>

Other digital signature schemes were soon developed after RSA, the earliest being [[Lamport signature]]s,<ref name="ejiWf">"Constructing digital signatures from a one-way function.", [[Leslie Lamport]], Technical Report CSL-98, SRI International, Oct. 1979.</ref> [[Merkle signature scheme|Merkle signatures]] (also known as "Merkle trees" or simply "Hash trees"),<ref name="jl9LD">"A certified digital signature", Ralph Merkle, In Gilles Brassard, ed., Advances in Cryptology – [[CRYPTO]] '89, vol. 435 of Lecture Notes in Computer Science, pp. 218–238, Spring Verlag, 1990.</ref> and [[Rabin signature]]s.<ref name="HgBx0">"Digitalized signatures as intractable as factorization." [[Michael O. Rabin]], Technical Report MIT/LCS/TR-212, MIT Laboratory for Computer Science, Jan. 1979</ref>

In 1988, [[Shafi Goldwasser]], [[Silvio Micali]], and [[Ronald Rivest]] became the first to rigorously define the security requirements of digital signature schemes.<ref name="SJC 17(2)">"A digital signature scheme secure against adaptive chosen-message attacks.", Shafi Goldwasser, Silvio Micali, and Ronald Rivest. SIAM Journal on Computing, 17(2):281–308, Apr. 1988.</ref> They described a hierarchy of attack models for signature schemes, and also presented the [[GMR (cryptography)|GMR signature scheme]], the first that could be proved to prevent even an existential forgery against a chosen message attack, which is the currently accepted security definition for signature schemes.<ref name="SJC 17(2)" />  The first such scheme which is not built on trapdoor functions but rather on a family of function with a much weaker required property of one-way permutation was presented by [[Moni Naor]] and [[Moti Yung]].<ref name="Z2zaX">Moni Naor, Moti Yung: Universal One-Way Hash Functions and their Cryptographic Applications. STOC 1989: 33–43</ref>