0
$\begingroup$

In Schnorr's digital signature protocol (https://en.wikipedia.org/wiki/Schnorr_signature),
the signature is $(s,e)$ where $s=k-xe$.
Assumption:
$k$ and $x$ are assumed to be secret value of user.
So, ($k,x$) value is never changed except $e$.
$s_{i}=k_{i}-x_{i}e$ for $i$ users
Unlike Schnorr's signature, $e$ is also kept secret so that only valid users, who knows respective k and x values, can reveal it.
Even though different $k,x$ values, $e$ is selected uniformly randomly from $ Z_{q}$ and assumed to be same for all valid users.

Does the modification secure to securely deliver different values of $e$ for every time ?

$\endgroup$
  • $\begingroup$ "Three can keep a secret, if two of them are dead" - Benjamin Franklin. Signatures are generally expected to be verifiable in public. $\endgroup$ – Vadym Fedyukovych Aug 25 '16 at 7:12
  • $\begingroup$ Instead of signature, just consider for simple, secure delivery of $e$. $\endgroup$ – myat Aug 25 '16 at 7:47
1
$\begingroup$

There are quite a few errors in your thoughts:

k and x are assumed to be secret value of user.
So, (k,x) value is never changed except e.

As stated in the signing algorithm, $k$ is drawn uniformly random from the set $\mathbb{Z}_q^{\times}$. This means, it is random (and different with overwhelming probability) for every single message. Using the same $k$ might not be secure at all - I am quite sure it won't, but don't have a proof right now.

That means, in every message $k$ has a different value. This ipmplies, that $e$ has a different value (again, with overwhelming probability). And again, $s$ has a different value with overwhelming probability.

This wouldn't work, since a fixed $k$ just does not fit the algorithm's assumptions.

Unlike Schnorr's signature, e is also kept secret so that only valid users, who knows respective k and x values, can reveal it.

This is a quite pointless in this case. If some information is known to anyone whose role isn't specified in the protocol, you have to assume that the value is publicly known.

Even though different k,x values, e is selected uniformly randomly from Zq and assumed to be same for all valid users.

This doesn't make sense at all. Every user has his own fixed value of $k$, the protocol clearly describes how $e$ has to be calculated. If you choose $e$ independently, the whole signature does not work any more.

Adn then you write in the comments:

Instead of signature, just consider for simple, secure delivery of e.

I thought, $e$ is the same for all users? I guess you meant $s$.

But this would mean this: Your value $s$ does not depend on the message any more. $s$ is always the same for every message.

Summary

This isn't a modification, it has nothing to do with the signature scheme any more. If your only modification would be a fixed $k$, chances are quite high that you already have a fatal security flaw in your setup. My guess would be, that two signatures actually reveal the secret value $x$ then.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.