I am reading some articles which explain on the fly signatures (also called online/offine signatures).
The principle is that a few operations do not depend of the message we want to sign, so these values can be precomputed and use in the future to sign the message.
Let's see an example with the Schnorr signature:
$p$ and $q$ two primes such as $ q|(p-1)$
$\alpha$ an element of order $q \bmod p$
$\mathcal{H}$ a hash function
$s \in [1,q]$ the private key
$\alpha^{-s} \bmod p$ the public keySignature of a message $m$:
- Choose randomly $k \in [2, q-1]$
- Compute $r=\alpha^{r} \mod p$
- Compute $x = \mathcal{H}(m || r)$.
- Compute $y = k - sx$
Send the couple $(x,y)$.
As said before, we remark that steps 1. and 2. are independant of the message $m$ and can be precomputed.
It is explained that signature algorithms derived from zero-knowledge identification schemes are the best suited to implement this kind of signature.
Why is the consideration of zero-knowledge so important to apply this method?