2
$\begingroup$

The Schnorr signature scheme was defined originally as $(c, s)$ such that $sG = R + cX$, and the verification process consisted of computing $R = sG - cX$ and then verifying that $c = H(R||m)$ so using only $H(m)$ would not have worked for verification. However, in the verification process of the Schnorr signature variant $(R, s)$, we first compute $c = H(R||m)$ and then verify that $R = sG - cX$, if we change $c = H(R||m)$ by $c = H(m)$ the verification process is not affected. I guess that using $c = H(m)$ is not secure for the Schnorr scheme, but I wonder why.

Note: For example, in the ECDSA scheme $s = k^{-1}(H(m) + dr)$ the hash consists only of $H(m)$

$\endgroup$

2 Answers 2

4
$\begingroup$

In your second scheme, the signature $(R,s)$ is verified as $R\overset{?}{=} sG-cX$.

If $c$ does not involve $R$, then you could forge a signature by picking a random $s$ value and calculating $R=sG+cX$, where $c=H(m)$. Therefore, it does matter that $c$ is calculated as $c=H(R\mathbin\| m)$.

With ECDSA, the x-coordinate of a point performs the same function as a hash in the Schnorr signature. This is because the x-coordinate is unpredictable. If I give you a random x-coordinate value, you won't be able to efficiently find a scalar value $a$ such that the point $aG$ has that x-coordinate.

You can therefore think of an ECDSA signature as:

$(c,s) = \biggl(H_2(R),\ \frac{H(m)\ +\ H_2(R)x}{r}\biggr)$, where $H_2(P)$ means to extract the x-coordinate of the point P.

It is verified as $c \overset{?}{=} H_2\biggl(\frac{H(m)G\ +\ cX}{s}\biggr)$

As you can see, ECDSA does have a cryptographically secure one-way function that involves $R$.

$\endgroup$
2
$\begingroup$

The scheme is completely insecure: $c = H(m)$ does not constrain $R, m, X$ in a way that only the owner of the secret key can satisfy.

To forge a signature $(R, s)$, choose an arbitrary $s$, the set $R = sG- cX$. This passes verification for $c = H(m)$ even when we dint know the secret key.

$\endgroup$
2
  • $\begingroup$ You might want to answer the obvious followup question: "why then is ECDSA secure??" $\endgroup$
    – poncho
    Jul 4, 2023 at 22:51
  • $\begingroup$ @poncho Oops, I forgot that part of the questions. But the other answer does a good job at answering that part. $\endgroup$ Jul 6, 2023 at 9:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.