Recently I have been reading this paper by Dan Boneh et al., where the authors are going to use a general form of forking lemma, to prove the security of their Schnorr multi-signature.

As I understood, this general form of forking lemma is about having several crucial points, rather than a single point (by crucial I mean the point that we rewind the adversary).

When you go to the security proof (pp 21-22), what they are using is just rewinding to a single point.

So I was wondering what is the reason for using this general forking lemma?

  • $\begingroup$ So, the answer that I found is that, for Schnorr multi-signature, one can prove the security in two different models: plain public key mode (PPK) and proof of knowledge mode (POK). For the security proof in PPK, one rewinding point is enough while for the POK we need several rewinding point. In the mentioned paper as they work with both models, they use the more general form of forking lemma with several rewinding points. $\endgroup$
    – A.Solei
    Sep 8, 2021 at 6:40


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.