My question refers to the paper "Multi-user Schnorr security, revisited" by Bernstein. Does the implication shown in the paper

security of classic Schnorr $\implies $ multi-key security of key-prefixed Schnorr

apply to short Schnorr signatures?

By short Schnorr signatures I mean those of size $3k$-bit that you get by truncating the hash output bits by $k$.

New contributor
weinstein is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

weinstein is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.