Questions tagged [schnorr-signature]

A digital signature algorithm based on the discrete logarithm problem, provably secure in the random oracle model.

Filter by
Sorted by
Tagged with
1 vote
1 answer
35 views

Before Bitcoin what was the motivation for researching key aggregation multisig and threshold schemes?

The motivation for key aggregation multisig and threshold schemes (e.g. MuSig(2), FROST etc) in Bitcoin is obvious. Signatures are a large part of every transaction, all the nodes on the network are ...
user avatar
1 vote
1 answer
65 views

Schnorr based ZK scheme

TL;DR: This ABSOLUTELY does not work and presents a huge security risk. Posting it anyways in case there are other threats I missed or to dissuade any other person who comes up with this idea. Hi! I’m ...
user avatar
  • 35
0 votes
0 answers
52 views

Schnorr signature | Schnorr Public Parameters

hello guys hope you are doing well :), i am trying to simulate the Schnorr Signature, but i have encountered some difficulties finding the generator, i have chosen a prime P of 1024bit and took a ...
user avatar
2 votes
1 answer
141 views

Why is r used in ECDSA signature while R in Schnorr signature?

In Schnorr signature (R, s), R is used. But in ECDSA signature (r, s), r is used, which is the x-coordinate of R. Why the difference?
user avatar
1 vote
0 answers
56 views

Detailed Proof of Knowledge for Discrete Log

I'm having difficulty finding a detailed proof for one of the most basic protocols in cryptography, that is the Schnorr protocol, or the sigma protocol for proving knowledge of a discrete log. Most ...
user avatar
1 vote
1 answer
37 views

Necessary Schnorr signature non-interactive challenge bindings

Some implementations of a Schnorr signature will determine the challenge as follows: $c=H(kG \mathbin\| X \mathbin\| m)==H(rG+cX \mathbin\| X \mathbin\| m)$, where: $c$ is the challenge $m$ is the ...
user avatar
  • 3,112
2 votes
1 answer
75 views

Is there any reason to search for Z values other than 1 when transforming X,Y to Jacobian representation of an EC Point?

When exchanging a public key I usually receive some compressed form of X,Y coordinates. To use some speed ups I'd need to represent that in the Jacobean ...
user avatar
  • 177
1 vote
1 answer
54 views

Negation of a EC Point with Jacobi x,y,z representation

I'm building a small library for Schnorr Signatures and the Oracle DLC, the key passage is: s_i G = R - h(i, R)V R = k G; G generator, k a nonce h(i, R) is the hash of the message i (i is one of the ...
user avatar
  • 177
1 vote
1 answer
86 views

Would discrete-log-based signing and encryption have been a better choice than RSA?

Diffie-Hellman can be used for key exchange, and can be used as part of an integrated encryption scheme ("DLIES"). Schnorr signatures are possible by relying only on the discrete-log problem,...
user avatar
  • 3,112
1 vote
0 answers
65 views

Is there a Ed25519 threshold signature protocol similar to the Gennaro-Goldfeder schema for ECDSA?

I keep searching online and asking in different cryptographic communities whether there is a similar threshold signature schema (or a close one) to what Gennaro and Goldfeder proposed for ECDSA? ...
user avatar
  • 111
3 votes
1 answer
84 views

How would a malicious group of co-signers use a hash collision to sign an unintended message?

According to BIP340: However, a major drawback of this optimization is that finding collisions in a short hash function is easy. This complicates the implementation of secure signing protocols in ...
user avatar
0 votes
0 answers
40 views

How does not tagging hashes result in leaking the secret key if a nonce is re-used in a different scheme?

I'm reading through BIP340 and I'm having trouble understanding this part: For example, without tagged hashing a BIP340 signature could also be valid for a signature scheme where the only difference ...
user avatar
3 votes
1 answer
387 views

Is the security of a Schnorr signature dependent on the hash function that is used?

When a Schnorr signature is created, the number $r$ is concatenated with the message to produce a new value which is then hashed to give a number represented by $e$. The number $e$, accompanied by ...
user avatar
  • 185
1 vote
0 answers
39 views

(Multi-User) Security Key-prefixed Schnorr Signature

Bernstein proofs in his paper that single-key security of the classic Schnorr signature system tightly implies the single-key security of the key-prefixed variant of the system. Can this statement be ...
user avatar
3 votes
1 answer
171 views

Hash function requirements for short Schnorr Signature

Neven et al. stated in their paper Hash Function Requirements for Schnorr Signatures following theorem (using the forking lemma): $\mathbb{G}$ is the generic group (section 2), $s \approx \log_2q$, ...
user avatar
7 votes
0 answers
218 views

Security Proof of Short Schnorr Signature

I know that this is a very specific question, but I still hope that someone can help me. I'm trying to understand the security of the short schnorr signature a little bit better. The security ...
user avatar
4 votes
0 answers
84 views

MuSig: could the rogue key attack be mitigated by using commitments instead of key transformations?

Background MuSig is an extension of/derivation from Schnorr signatures using cyclic groups on elliptic curves. In the original paper, the authors point out that naive multi-Schnorr is vulnerable to a ...
user avatar
4 votes
0 answers
229 views

Uniqueness and Schnorr signatures

I am trying to analyse a "uniqueness" game around Schnorr signatures. The game is described in $\textbf{B.}$ and I try to provide in $\textbf{1.}$ and $\textbf{2.}$ some incomplete answers ...
user avatar
2 votes
2 answers
73 views

Security of Signature Schemes in the Multi-User Setting

I've often read about the security of a signature scheme in the multi-user setting Link1 Link2, but I couldn't find a real definition. I would like to be sure that I understand it correctly. So my ...
user avatar
0 votes
1 answer
92 views

Related Key Attack on Schnorr Signature - Why does the challenge include $\psi = g^x$, not $y$?

The original Schnorr signature scheme suffers from a Related Key Attack (RKA) as described by Morita et al. The authors of this paper then suggest a modification to the signature algorithm to prevent ...
user avatar
  • 13
2 votes
0 answers
70 views

Can I store a public key used to verify a Schnorr signature in PEM format?

I want to ask if there is any way to store a Schnorr signature key in PEM format, or any other standardized format. And, if possible, I would like to know if that's possible to be done in C language; ...
user avatar
0 votes
1 answer
60 views

How or in which format should Schnorr signature keys be stored? [closed]

I would like to know if there is any standard for storing public and private keys for Schnorr signature
user avatar
3 votes
1 answer
92 views

Can one prove that a particular public key is part of an aggregated (MuSig) public key?

The MuSig paper (2018) describes a Schnorr signature key aggregation scheme which lets a set of individual public keys to be merged into a single, "aggregated" public key. In the protocol ...
user avatar
3 votes
0 answers
145 views

Schnorr signature in two steps, known vulnerabilities

We are looking to perform all the calculations for a Schnorr signature, more precisely EC-FSDSA, (BIP340-Schnorr), inside a secure element, to the exception of the Hash operation that is not supported ...
user avatar
  • 31
7 votes
1 answer
237 views

Difference between Generic Group Models

I'm trying to understand the difference between the (classical) Generic Group Model as it is described by Shoup [Shoup] and the somewhat restricted Generic Group Model as it is described by Schnorr ...
user avatar
4 votes
1 answer
115 views

Relation between short and «regular» Schnorr signature

I'm failing to fully understand the reasoning in 19.2.3 of Boneh and Shoup's A Graduate Course in Applied Cryptography. That constructs short («optimized»/original) Schnorr signature from «regular» (...
user avatar
  • 125k
4 votes
1 answer
96 views

Security proof of schnorr identification scheme

I have studied the Schnorr identification scheme, and I came across the security proof. My question is regarding the following: $$\begin{align} \text{Pr}\left[\text{DLog}_{\mathcal{A}',\mathcal{G}}\...
user avatar
  • 143
1 vote
0 answers
76 views

Distributed Random Oracle with Verifiable Shares

$Setup$: Let's assume a quorum of $n$ nodes where each have a secret share $y_i$ from a know and safe leaderless DKG protocol. Define $\mathcal{L}^i(y_i) = y$ as the lagrange interpolation for $x=0$, ...
user avatar
  • 398
3 votes
0 answers
76 views

Why do we use Generlized Forking Lemma with several crucial points, while in the security proof we just rewind to a single point

Recently I have been reading this paper by Dan Boneh et al., where the authors are going to use a general form of forking lemma, to prove the security of their Schnorr multi-signature. As I ...
user avatar
  • 325
0 votes
0 answers
97 views

Request for a zero-knowledge proof (or hint)

I want to design a zero-knowledge proof (ideally a NIZK, but could be a sigma protocol) so that Alice can prove that a certain encryption contains a value that has been signed by a certain key. More ...
user avatar
  • 1
2 votes
3 answers
105 views

Can schnorr-signatures be used to ensure public keys are of the correct form (namely $Y= x \cdot G$)?

Assume a Schnorr-signature scheme in an elliptic curve setting with a publicly known generator base point $G$ where the the discrete logarithm is hard. That is, given $x \cdot G$, it is hard to find $...
user avatar
3 votes
2 answers
275 views

Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?

An EdDSA signature is (R, S) where R = r*B and S = r + H(R, A, M)*s. Notation from Wikipedia en.wikipedia.org/wiki/EdDSA. Given that the hash function H, is indeed collision-resistant, would using S = ...
user avatar
1 vote
0 answers
89 views

Schnorr Protocol Implementation - Sometimes Fails on Curve25519

I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
user avatar
  • 145
0 votes
1 answer
61 views

BLS to Schnorr signature conversion?

Imagine a situation where a prover can only sign with BLS signature signing algorithm, a verifier can only verify with Schnorr signature verification algorithm. Is it possible to convert a BLS ...
user avatar
  • 103
7 votes
2 answers
418 views

Is Schnorr's digital signature a non-interactive zero-knowledge proof?

If yes, is there any paper that proves it? Unifying Zero-Knowledge Proofs of Knowledge, by Ueli Maurer, argues that Schnorr's interactive protocol is zero-knowledge. If this is true, using the Fiat-...
user avatar
  • 515
8 votes
1 answer
486 views

Details about ROS attack on blind Schnorr signatures

My question concerns the recently uploaded paper On the (in)security of ROS that describes an expected polynomial-time attack on the unforgeability of Schnorr blind signatures. a) Does this mean that ...
user avatar
3 votes
0 answers
157 views

How to efficiently find Schnorr groups that have a generator $g=2$?

A Schnorr group is a multiplicative group of integers modulo an odd prime $p$ of prime order $q$, normally such that $p$ is much greater than $q$. As far as I know, the normal way to find a Schnorr ...
user avatar
  • 649
3 votes
1 answer
256 views

Is there any proof for ECDSA signature algorithm?

Related: Is there an interactive version of ECDSA signature protocol like the Schnorr identification protocol?
user avatar
1 vote
1 answer
166 views

Proving equality of two Schnorr Signatures

Given two Schnorr Signatures that were made from the same $x$, where each $x$ is private. Is there a way to prove that they came from the same $x$ without revealing $x$? I heard about Chaum-Pedersen ...
user avatar
  • 43
1 vote
0 answers
66 views

Is using Fiat-shamir Heuristic safe?

What I'd like to do is to have the Prover store a value x where x remains hidden. From x, I'...
user avatar
  • 43
-1 votes
1 answer
142 views

Orignal Schnorr Signature vs Discrete logarithmic Schnorr Signature

I have currently started a course on cryptography and am an absolute beginner. While reading through Schnorr's Protocol I came across several ways in which it was described. One of the approach is ...
user avatar
0 votes
0 answers
47 views

What Digital Signature Scheme should we use?

My team wants to implement the ElectionGuard as the main part of an e-voting scheme (even if it is known that e-voting protocols are malleable; for the purposes of the voting scheme it is enough). ...
user avatar
  • 113
9 votes
1 answer
2k views

How to confirm my implementation is constant time

I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1. A notable difference is that the BCH schnorr algorithm ...
user avatar
  • 99
3 votes
1 answer
153 views

Variant of Schnorr Protocol (Difference pair of response and verification)

When I am trying to learn deeper to Schnorr Protocol. I found that for deference there is more than one response and verify pair. But I am not sure am I right. We will use Schnorr Protocol to prove ...
user avatar
  • 139
4 votes
3 answers
143 views

Construct Schnorr Protocol can only verify by designated verifier

Currently I have a DLP as following, $y = g^x \bmod p$, I can easily construct a proof of knowledge by using Schnorr Protocol. But I would like to put it a a system of 2 parties with public key and ...
user avatar
  • 139
4 votes
1 answer
311 views

Is it possible I can open pedersen commitments without revealing r?

With setup $p$ and $q$ where $p = 2q + 1$, and $g$ and $h$ is the generator with order $q$. In Pedersen commitment, I commit the value m with $c=g^m h^r \bmod p$, then de-commit by revealing $(m, r)$....
user avatar
  • 139
2 votes
1 answer
249 views

What are the implications of limiting the private key space with elliptic curve Schnorr signatures?

Given a curve, I am trying to limit the private key space to ultimately cut down the Schnorr signature size as follows: Assume an elliptic curve $E$ over a field $F$ with generator point $G$ and the ...
user avatar
  • 649
3 votes
1 answer
203 views

Is Ed25519 really constant-time as widely implemented?

Despite the frequent claims that Ed25519 is more secure against side-channel attacks than (for instance) signatures performed over NIST P-256, I noticed that most implementations (including the ...
user avatar
1 vote
0 answers
62 views

Looking for a partially blind multisignature scheme?

I am working in a project inspired in digital cash where we would like to use partially-blind signatures. This is so that the Bank signs a check with a hidden serial number (S), but a plainly visible ...
user avatar
2 votes
0 answers
280 views

Does EdDSA share Schnorr signature secure linearity property?

EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA), is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source). Schnorr signatures have a ...
user avatar