Soundness and honest-verifier zero-knowledge implies EUF-CMA using Fiat-Shamir?

Question

I am originally a mathematician but I have started to examine the security properties of the PQC Isogeny-based protocols SQIsign and SQIsignHD. In various papers I came across various implications of security properties, and as I am relatively knew to this subject I had a rough time putting these together. The main question I have here is:

Does completeness (which I will neglect below as this should be always fulfilled), knowledge sound and honest-verifer zero-knowledge of an ID-scheme imply UUF-CMA for the corresponding signature scheme under the fiat-shamir transformation?

Some background on what I did so far, and where my confusion comes from:

special sound + HVZK = UF-CMA:

The original paper on SQIsign claims in Appendix A, that completeness, special soundness and the honest-verifier zero-knowledge property of a $\Sigma$-protocol ensures Security under passive impersonation attacks (IMP-PA), which again implies unforgeability under chosen message attacks for the corresponding Signature scheme constructed by the Fiat-Shamir transformation. The provided reference for this claim is this paper (they probably mean Theorem 5 and Theorem 7). In this case they probably mean universal unforgery (UUF-CMA).

special sound + wHVZK = EUF-CMA:

As SQIsign was submitted to NIST, a specification paper for SQIsign was published. In Chapter 9, the authors proof that special soundness + weak honest-verifier zero-knowledge (wHVZK) implies (again using the detour over IMP-PA), actually even existential unforgeability under chosen message attacks (EUF-CMA).

knowledge sound + HVZK = UUF-CMA

In the paper on SQIsignHD, the authors claim in Chapter 5 that knowledge sound and HVZK is already enough for UUF-CMA. The reference for this is again the same as for SQISign, this one. This time they specifically refer to Theorem 7. However, this Theorem relies on IMP-PA secure ID-schemes, but for my understanding, this is not justified when only considering knowledge sound (See Theorem 5 and the definition of a $\Sigma$-protocol at Definition 5.) Further, this last definition also requires Special HVZK what is also not given in the SQIsignHD paper.

Comparing the first and the last example I presented, it seems like that either the last statement is wrong, or that the special sound condition on the first is way to strict. I would highly appreciate if anyone could shed some light into my confusion with all these security properties I presented here.

Answer 1

I want to answer my own question here. Indeed, all claims regarding the security aspects in the above papers are correct; however, the formulation of Theorem 5 in this paper is not ideally chosen. The statements of this theorem assumes that the $\Sigma$-protocol is special sound (it is by the definition provided in this paper), however, the proof itself only requires knowledge sound.

Therefore, as RigorousSQIsignHD is only knowledge sound, the theorem itself is not applicable, but the proof of the theorem indeed is sufficient.

Further, I want to point out an inaccuracy regarding the definition 10 of unforgeability of this reference.

The definition itself talks about unforgeability, theorem 7 which proves that the property of this definition is fulfilled talks about universal unforgeability, but in reality, the definition 10 describes existential unforgeability and therefore theorem 7 even proves this stronger statement.

Altogether, just reading the proofs and not only the statements of the reference would have saved me some time, as the given reference may be confusing, but correct.