What type of groups does Microsoft's U-Prove use (Schnorr… etc?)

Question

I'm trying to learn more about the Subgroups implementation of Microsoft UProve. I'm unsure if they are Schnorr Groups or use a different foundation?

Can anyone point me to the technical reading required to understand the implementation? (anything appropriate for a determined, yet fledgling novice would be appreciated)

Answer 1

U-Prove Recommended Parameters describes the groups used by U-Prove.

For the subgroup variant it references Appendix A.1.1.3 of FIPS186-3 which is about groups for finite-field based DSA. AFAIK these groups are Schnorr groups, even though NIST never refers to them as such.

The ECC variant uses standard NIST curves such as P-256, P-384 and P-521.