8
$\begingroup$

My question concerns the recently uploaded paper On the (in)security of ROS that describes an expected polynomial-time attack on the unforgeability of Schnorr blind signatures.

a) Does this mean that Schnorr blind signatures should not be used anymore (ie. is the attack merely theoretic or can it be used in practice)?

b) How does this attack affect Okamoto-Schnorr blind signatures? In particular, I do not understand the comment of the authors that their attack does not contradict the analysis of Pointcheval-Stern. Were Okamoto-Schnorr blind signatures already broken?

c) The ROS problem mentioned by the authors and initially by Schnorr himself seems quite generic. Could the attack be applied to all blind signature schemes?

$\endgroup$
1
  • 1
    $\begingroup$ It would appear that the main thing for Schnorr is that you'd need to acquire the bitlength of many blind signatures to forge another one. As for Okamoto-Schnorr the claim means that the proof only guarantees security for up to $O((\log \lambda)^k)$ (for some fixed $k$) acquired signatures and this attack requires $\Omega(\lambda)$ many. $\endgroup$
    – SEJPM
    Aug 3 '20 at 18:12
1
$\begingroup$

The attack is practical. The only safe way to use blind Schnorr and Okamoto-Schnorr signatures is to forbid parallel sessions, that may be impossible if performance is critical. You can see great explanation of attack here https://youtu.be/W-uwVdGeUUs (Authors of paper offer solution against ROS attack - some modification of Schnorr blind signature, but IMHO it's unsafe) RSA and BLS blind signatures are not affected by ROS attack.

$\endgroup$
1
  • $\begingroup$ It's true Fuchsbauer, Plouviez, and Seurin make a major new assumption in eprint.iacr.org/2019/877.pdf but does anything specific cast doubt? $\endgroup$ Sep 8 '20 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.