# Details about ROS attack on blind Schnorr signatures

My question concerns the recently uploaded paper On the (in)security of ROS that describes an expected polynomial-time attack on the unforgeability of Schnorr blind signatures.

a) Does this mean that Schnorr blind signatures should not be used anymore (ie. is the attack merely theoretic or can it be used in practice)?

b) How does this attack affect Okamoto-Schnorr blind signatures? In particular, I do not understand the comment of the authors that their attack does not contradict the analysis of Pointcheval-Stern. Were Okamoto-Schnorr blind signatures already broken?

c) The ROS problem mentioned by the authors and initially by Schnorr himself seems quite generic. Could the attack be applied to all blind signature schemes?

• It would appear that the main thing for Schnorr is that you'd need to acquire the bitlength of many blind signatures to forge another one. As for Okamoto-Schnorr the claim means that the proof only guarantees security for up to $O((\log \lambda)^k)$ (for some fixed $k$) acquired signatures and this attack requires $\Omega(\lambda)$ many.
– SEJPM
Aug 3 '20 at 18:12