Provably Secure Certified Mail

With a certified-mail protocol, one fairly exchanges a message for a receipt. No satisfactory protocols without any third party are possible, hence optimistic protocols are the best one can hope for. Here a third party is only involved if one party tries to cheat. Certified-mail protocols are known in the literature, but there was no rigorous definition yet, in particular for the optimistic case and for many interleaved executions. We provide two such definitions. One defines individual integrity and secrecy requirements. The other defines an ideal system and uses a general simulatability definition. We show the relation between the definitions, present an efficient protocol, and prove its security in detail. Apart from the intrinsic benefits of provably secure certified mail, this paper serves as an example that a serious-sized practical protocol can be rigorously proven with respect to a general simulatability definition and an abstract specification accessible to formal methods.