I've been studying the Schnorr signature scheme and recently came across an example that uses the STROBE protocol. In the classic version of Schnorr signatures, the challenge e is calculated as e = H(m || r), where m is the message, r is an ephemeral value, and H is a cryptographic hash function. However, in the STROBE-based version of the Schnorr signature scheme, it seems that the challenge is generated based on the public key A and the ephemeral value R, with no mention of the message.
Here's the STROBE-based Schnorr signature example from paper (P.11):
// Alice has a private key k, from which she derives a secret exponent a by running KEY[sym-key](k); a ← PRF[derive-key](b bytes) // When Alice needs to sign a STROBE context, she first begins the signature using a AD[sig-scheme](name) operation AD[sig-scheme](name) // She then needs a pseudorandom value r. She calculates this determinsitically by copying the context and running KEY[sym-key](k); r ← PRF[sig-determ](b bytes) // She calculates R := g^r and runs AD[pubkey](A); CLR[sig-eph](R); c ← PRF[sig-chal](b bytes); ENC[sig-resp](r + ac mod p); // To verify the signature, Bob runs AD[pubkey](A); R ← CLR[sig-eph](b_G bytes); c ← PRF[sig-chal](b bytes); s ← recv-ENC[sig-resp](log256(p) bytes) // Bob then checks that R = g^s/A^c. This holds because g^s = g^(r+ac) = R · A^c
Notably, P.6 outline each of operations in STROBE
P.9 specify the usage of operation syntax.
ENC[app-ciphertext](“hello”) mean the two operations
meta-CLR([[0x03, 0x05, 0x00]]); ENC(“hello”)
Can someone help me understand how the message is taken into account in the STROBE-based version of Schnorr signatures?