Editing Digital signature (section)

==Notions of security==
In their foundational paper, Goldwasser, Micali, and Rivest lay out a hierarchy of attack models against digital signatures:<ref name="SJC 17(2)" />

# In a ''key-only'' attack, the attacker is only given the public verification key.
# In a ''known message'' attack, the attacker is given valid signatures for a variety of messages known by the attacker but not chosen by the attacker.
# In an ''adaptive chosen message'' attack, the attacker first learns signatures on arbitrary messages of the attacker's choice.

They also describe a hierarchy of attack results:<ref name="SJC 17(2)" />

# A ''total break'' results in the recovery of the signing key.
# A [[universal forgery]] attack results in the ability to forge signatures for any message.
# A [[selective forgery]] attack results in a signature on a message of the adversary's choice.
# An [[existential forgery]] merely results in some valid message/signature pair not already known to the adversary.

The strongest notion of security, therefore, is security against existential forgery under an adaptive chosen message attack.