Questions tagged [schnorr-signature]
A digital signature algorithm based on the discrete logarithm problem, provably secure in the random oracle model.
69
questions
0
votes
0answers
33 views
Generalized Schnorr's signature variations
I'm working on an ECC-based system.
There's a Schnorr's signature, by which the prover may prove a knowledge of a preimage (i.e. scalar, private key) of an EC point (i.e. public key).
It can be ...
1
vote
0answers
22 views
Looking for a partially blind multisignature scheme?
I am working in a project inspired in digital cash where we would like to use partially-blind signatures. This is so that the Bank signs a check with a hidden serial number (S), but a plainly visible ...
0
votes
0answers
18 views
Schnorr signature verification via Pairing-Based Cryptography?
Let $e: G^{\dagger}_{1} \times G_{2} \mapsto G_{T}$ define the pairing.
Assuming an output $\sigma = (c, p)$ similar to a Schnorr signature:
$s \times Y \mapsto Y_{s}$ and $m \times G \mapsto M$
$c = ...
1
vote
0answers
41 views
Does EdDSA share Schnorr signature secure linearity property?
EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA) is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source).
Schnorr signatures have a ...
0
votes
0answers
18 views
Non interactive threshold signature without bilinear pairing (is it possible)?
All threshold signature schemes that I have seen need bilinear pairings to avoid parameter exchange between parties. These are normally commitment schemes for a certain secret.
I believe a 2-round ...
0
votes
1answer
70 views
Does the nonce really have to be hashed as part of the challenge in a Schnorr signature?
From this article: https://tlu.tarilabs.com/cryptography/digital_signatures/introduction_schnorr_signatures.html#why-do-we-need-the-nonce
The article states that the challenge ...
7
votes
2answers
244 views
What is TPMFail attack and what are the countermeasures?
Trusted Platform Module (TPM) is designed as a hardware-based root of trust to protect cryptographic keys even against system based adversaries.
Although Intel's firmware based fTPM has FIPS 140-2 ...
0
votes
0answers
29 views
What is the main difference between Gap Sigma protocol and Sigma protocol?
I can understand and know how to use the Sigma protocol. My main question is that I cannot understand the main usage of the Gap-Sigma protocol. What is the main difference between the Gap Sigma ...
1
vote
1answer
40 views
Questions regarding random values in Schnorr authentication
In Chapter 21.3 of Schneier, Applied Cryptography I read the following about the Schnorr Authentication Protocol:
To generate a key pair, first choose two primes, $p$ and $q$, such that $q$ is a ...
1
vote
1answer
91 views
Discrete logarithm problem particularly hard for Schnorr groups?
The Wikipedia article on Discrete Logarithm just states without source:
In some cases (e.g. large prime order subgroups of groups ($\mathbb{Z}_p)^×$) there is not only no efficient algorithm known ...
5
votes
2answers
173 views
The definition and origin of Schnorr groups?
Wanting to write something on Schnorr groups in a publication I realised how hard it is to find anything citable about them on the internet. Who can help me with the following questions?
What (and ...
0
votes
1answer
87 views
MuSig/Schnorr key aggregation: How get the combined private key
Given all parties' private keys in MuSig, is it possible to get a combined private key corresponding to the combined public key? I know it's possible to sign a message, but how to get the combined ...
0
votes
0answers
33 views
Is there an O(1) in space complexity k-of-n signature scheme?
I was looking in depth into Schnorr signatures recently, and while they are very attractive for their ability to be aggregated, this only works for n-of-n ...
1
vote
0answers
105 views
Schnorr authentication protocol vs Schnorr signature Scheme
As I understand the schnorr authentication protocol is an interactive protocol where a prover WLOG proves to a Verifier that he possesses the discrete log to some group element.
If we use the Fiat-...
1
vote
1answer
41 views
Monero Ring CT sj calculation
For a university project, I am currently implementing the RingCT Ring signatures as used in Monero (before the introduction of Bulletproofs) as laid out in this paper.
To close the ring we calculate ...
1
vote
0answers
86 views
Prove that two commitments are commitments to the same value
Let $x$ be the secret value, $(n,a,b,c)$ a public key, $(n_C, g, h)$ the commitment public key. Furthermore let $r, r_C$ be two random numbers.
Define $C = g^x h^{r_C} \bmod n_C$, $C_x = a^x b^r \...
0
votes
1answer
85 views
Malleable version of Schnorr signature
Given an elliptic curve defined in $\mathbb{F}_{q}$ with a generator $G$ and a hash function $H_{q}(x)$ which maps $x$ to $\mathbb{F}_{q}$. A Schnorr signature variation for a data block $B$ such as:
...
1
vote
0answers
93 views
Schnorr-signature calculating a coefficient
I need to create program that makes signature for selected file. I simplified algorithm a little, because I draw max 64 bit prime numbers instead of ...
11
votes
1answer
159 views
Why is $e=0$ allowed in Schnorr signatures?
In a Schnorr signature (Wikipedia style), we have:
$R = kG$, where $0<k<n$ is a nonce and $G$ is the generator point.
$e = H(R \| M) \bmod n$, where $H()$ is a hashing function and $M$ is the ...
2
votes
1answer
110 views
Is Wikipidia wrong about Schnorr Signatures?
Wikipidia says Schnorr signature generation is defined like this:
...
1
vote
0answers
56 views
HW wallet and multisignaters in ECC
I need to design a system where there is a secure device (a.k.a. HW wallet), with the following functionality:
Deterministic key generation for key parameters (speaking simply: key ID).
Never expose/...
1
vote
0answers
107 views
Drawbacks of Schnorr Authentication that require Fiat-Shamir and Random Oracles?
I've been going through G. Maxwell's paper on the Borromean Ring Signature, and I don't fully understand this part on Schnorr Signature. If some could explain it more intuitively thank you.
"...
1
vote
2answers
195 views
Using the same private key to generate Schnorr and BLS signatures
I am wondering if it is possible or if there are any limitations to using the same private key to generate Schnorr and BLS signatures. Specifically, assuming I have a private key $x$, I want to use it ...
1
vote
0answers
65 views
Threshold Bitcoin signature scheme
Any advice would be appreciated:
It seems to me that using an uncomplicated combination of a shamir scheme and schnorr it's fairly trivial to have a threshold signature scheme.
I think it's also ...
1
vote
1answer
354 views
Schnorr Pubkey Recovery
As per How does recovering the public key from an ECDSA signature work? , it's possible to recover public keys from ECDSA signatures.
Is this possible for EC-Schnorr signatures as well?
I'm looking ...
0
votes
1answer
471 views
Schnorr signature using discrete logarithm / problem with python implementation [closed]
For educational purposes (by purpose with small values for the prime order q), I tried to write a small Python implementation of the Schnorr signature described in the Wikipedia article https://en....
4
votes
2answers
393 views
Compact Schnorr signature?
The commonly-used ECDSA signature consists of 2 scalars $(r,s)$. There's also a Schnorr signature. Given private key $k$, public key $C = [k]G$ and the message $M$:
Generate random scalar $k_1$
...
2
votes
1answer
429 views
Shor algorithm and schnorr signature in ed25519
Does the application of Shor's algorithm in any way relate/affect the schnorr signature in ed25519?
1
vote
0answers
208 views
BLS aggregate signatures for relay node non-interactive incentive accounting
This is a practical application of cryptography question and I hope this is the right place to ask it. Any advice would be very much appreciated.
I'm looking for a low-bandwidth, non-interactive ...
1
vote
0answers
144 views
Missing step in Schnorr's proof that an attack on blind signatures requires solving ROS?
In Security of Blind Discrete Log Signatures Against Interactive Attacks C.P. Schnorr defines the ROS Problem and claims that a $(l+1)$ attack against his blind signature scheme is equivalent to ...
14
votes
2answers
2k views
Schnorr signatures: multisignature support
Schnorr signature is mentioned as a promising upgrade to bitcoin to improve scalability. It support multisignature, several signatures can be aggregated into a single, new signature. But I fail to ...
0
votes
1answer
508 views
Schnorr Digital Signature
I tried to rewrite the Schnorr signature algorithm for elliptic curves but I wanted to be sure to have not done any errors. So I would be very happy if someone could look over this algorithm and tell ...
5
votes
1answer
1k views
Prove the Security of Schnorr's Signature Scheme
I know that Schnorr's signature is important since it is one of the most compact signature schemes whose security has been proved in the random oracle model.
Now, I want to know if such proof is ...
17
votes
2answers
1k views
Security of Schnorr signature versus DSA and DLP
The Schnorr signature scheme is a randomized signature scheme with appendix. The signature is $3t$-bit for conjectured $t$-bit security in a chosen-messages setup, with at most $2^{t/2}$ queries to a ...
5
votes
1answer
157 views
Small generator for classical Schnorr signatures?
I'm implementing classical Schnorr signatures for real-world use. By "classical" I mean that the operations take place in a finite group, no elliptic curves.
I'm following https://en.wikipedia.org/...
2
votes
1answer
237 views
Plausible Deniability in Schnorr
How does a dishonest verifier affect plausible deniability of the interactive Schnorr protocol?
4
votes
1answer
226 views
Security proof of partially blind signature (schnorr signature based)
I read a representative paper about partially blind signature.
Abe and Okamoto - "provably secure partially blind signature".
They suggested a partially blind signature scheme based on Schnorr ...
1
vote
1answer
116 views
Unforgeability proof of partially blind signature (schnorr signature based)
I read a representative paper about partially blind signature.
Abe and Okamoto - "provably secure partially blind signature".
They suggested a partially blind signature scheme based on Schnorr ...
8
votes
4answers
932 views
Schnorr protocol: how does malicious verifier win?
My question is about the challenge space size in Schnorr protocol. To be precise, I feel I've read all the Internet (twice) and I still don't understand why is it bad to allow challenge space to be ...
4
votes
1answer
671 views
Intuition for Schnorr Blind Signatures
I was studying the Blind schnorr signatures in this paper (PDF) which says that the signer sends a commitment
$$r=g^{k}\bmod p$$
which the user blinds with 2 random elements $a,b$ to get
$$r'=r\...
2
votes
1answer
100 views
Tricking the Schnorr's protocol
From the lecture notes I have learned the following:
$P \rightarrow V$: $T=g^t$ ($t$, randomly chosen from $Z_q$)
$P \leftarrow V$: $c$ (randomly chosen from $Z_q$)
$P \rightarrow V$: $s=xc+t \mod q$
...
0
votes
1answer
99 views
Schnorr's signature scheme with addition of modulus secure?
In Schnorr signature scheme,$s=(k-xe)$$ s_1=(k-xe_1)$ If the same key $k$ is used, then it is possible to reveal $k$ and $x$ value by using $\frac{s-s_1}{e_1-e}$.
However, if we add $s=(k-xe) \bmod q$...
2
votes
1answer
249 views
Additive proof of discrete log?
Let's say someone has $K$, and I want to prove to them that I know $k$ such $K = k*g$ (where $g$ is some sort of group element). I can use a Schnorr signature.
Is there some protocol for mergable ...
0
votes
1answer
68 views
Security exists or not in Modification in schnorr signature
In Schnorr's digital signature protocol (https://en.wikipedia.org/wiki/Schnorr_signature), the signature is $(s,e)$ where $s=k-xe$.
Assumption:
$k$ and $x$ are assumed to be secret value of user.
So, ...
7
votes
1answer
177 views
How to forge signatures in the Schnorr scheme if $r=g^k$ is eliminated?
I need some help to demonstrate how to forge signatures in the Schnorr scheme if I eliminate the random string $r=g^k$ used in the hash – using $H(M)$ instead of $H(M||r)$.
How would one be able to ...
1
vote
1answer
175 views
Single-scalar multiplication with sign bit
I want to know if there's an "easy" timing-free way to compute the sign of $y$-coordinate of $r G$, for a secret scalar $r$ and $G$ the generator of an elliptic curve.
We have several choices for ...
14
votes
4answers
3k views
EC Schnorr signature: multiple standard?
I'm working on some EC-Schnorr signature code.
Reading various papers on that, it seems EC-Schnorr is not standardized as
well as ECDSA.
For example, I found two main differences in two main actors ...
4
votes
1answer
230 views
Schnorr signature security level as compared to AES/RSA
As per the Schnorr's original paper (1991),
The Security Complexity $2^t$: We wish to choose the parameters $p$, $q$ so that forging a signature or an authentication requires about $2^t$ steps by ...
8
votes
2answers
842 views
What is an example of a secure sigma proof?
I want to implement Threshold Elgamal as described in section 6.3.1 and in the decryption phase each party must broadcast a sigma proof to show that it actually has a valid secret share of the secret ...
4
votes
2answers
417 views
Importance of random number generation in Schnorr's signature
In Schnorr's digital signature protocol (https://en.wikipedia.org/wiki/Schnorr_signature), the signing process (as described in wikipedia) requires the generation of a random bit $r$. I am wondering ...
