Questions tagged [schnorr-signature]

A digital signature algorithm based on the discrete logarithm problem, provably secure in the random oracle model.

Filter by
Sorted by
Tagged with
1 vote
1 answer
27 views

Is it possible to forge valid proofs in this Schnorr signature-based ZKP system for proving knowledge about discrete logarithms?

I am currently reading the paper "A 2-round anonymous veto protocol" and have run into some trouble verifying the claims made about the zero knowledge proofs presented within. My knowledge ...
user7308228's user avatar
1 vote
2 answers
40 views

In ECDSA over K256, Why R.x should be less than the subgroup order, not field order? But in BIP340 over K256, should be less than field order

I understand that R.x is a field element. I don't understand why in ECDSA verification ie. FIPS 186-5 section 6.4.2 step 1, we check whether r is less than subgroup order. If it has something to do ...
Atonal's user avatar
  • 143
2 votes
1 answer
51 views

Why are there two Challenges in the DSA Identification Scheme?

Would either $\alpha$ or $r$ suffice as challenge? I am aware that the signature and verification were to adapt. However, what is the motivation behind using two challenges?
cryptoQueen's user avatar
0 votes
1 answer
54 views

Reason for two random numbers in DSA?

Why is the signature in DSA the way it is? I am referring to $r$ and $k$ in the Signing-Algorithm depicted below. Is it really necessary to have both, $r$ and $s$, or would it still be secure if only ...
cryptoQueen's user avatar
0 votes
1 answer
24 views

Schnorr signature with adding instead of multiplying

I am reading about Schnorr signature (for example, from BIP-340) and I thought, what if we add instead of multiplying for $s$? So, in the signing process it will be ...
Vasilii Rogin's user avatar
2 votes
2 answers
453 views

Why schnorr signatures uses H(R||m) instead of H(m)?

The Schnorr signature scheme was defined originally as $(c, s)$ such that $sG = R + cX$, and the verification process consisted of computing $R = sG - cX$ and then verifying that $c = H(R||m)$ so ...
Alexander Vidaurre Arroyo's user avatar
1 vote
0 answers
139 views

JavaScript SubtleCrypto - Is there a way to convert the ECDSA keys into a more "portable" format and preferably shorter? [closed]

I asked this question on StackOverflow but it seems like it's more appropriate for this Crypto community. I am using the browser built in SubtleCrypto library in javascript to generate public and ...
sudoExclaimationExclaimation's user avatar
2 votes
1 answer
36 views

How is the message considered in the STROBE-based Schnorr signature example?

I've been studying the Schnorr signature scheme and recently came across an example that uses the STROBE protocol. In the classic version of Schnorr signatures, the challenge e is calculated as e = H(...
Paul Yu's user avatar
  • 122
2 votes
0 answers
46 views

Deriving multiple deterministic keys in a Schnorr Multisig setup

Let's say that Alice and Bob have generated truly random private keys $a$ and $b$ and want to use them in Schnorr signing. They calculate $X = g^a \cdot g^b$ as their mutual public key. For whatever ...
werki's user avatar
  • 21
1 vote
0 answers
74 views

They key size of the Schnorr Signature Algorithm

Based on the Schnorr signature below: What is the suitable size of lamda to generate a secure key?
Shi Li's user avatar
  • 13
2 votes
1 answer
88 views

Question about alternative formulation of the Schnorr signature…

Using the notation from the Wikipedia article: https://en.wikipedia.org/wiki/Schnorr_signature, the Schnorr signature mixes the random value $k$ and the hash $e$ like this: $$s = k - xe$$ (Where $x$ ...
Pat Niemeyer's user avatar
1 vote
2 answers
448 views

Convert a Schnorr Public Key to a compressed ECDSA Public Key

Given a Schnorr Public Key (32 bytes) x, I'd like to generate a compressed ECDSA Public Key (33 bytes) and thus be able to generate the bitcoin address that the private key holder can generate with ...
FreeTrade's user avatar
2 votes
0 answers
101 views

What is the advantage of ECDSA over Schnorr signature?

As we know, the Schnorr signature enjoys the linearity property, which does not exist in ECDSA. It seems the Schnorr signature is more efficient and can bring more features than ECDSA. What is the ...
user77340's user avatar
  • 777
0 votes
0 answers
125 views

Difference between ElGamal and Schnorr signature

A question about Schnorr group. Am I right that this is basically a protection against discrete-log solvers? So Schnorr signature is better than ElGamal in that sense?
Arthur Strong's user avatar
2 votes
2 answers
215 views

Why are interactive Zero-Knowledge-Proofs deniable?

When reading about the comparison of interactive and non-interactive Zero-Knowledge-Proofs, I came across the statement that non-interactive Zero-Knowledge-Proofs are not deniable compared to ...
sthorm's user avatar
  • 23
1 vote
1 answer
60 views

Before Bitcoin what was the motivation for researching key aggregation multisig and threshold schemes?

The motivation for key aggregation multisig and threshold schemes (e.g. MuSig(2), FROST etc) in Bitcoin is obvious. Signatures are a large part of every transaction, all the nodes on the network are ...
Michael Folkson's user avatar
1 vote
1 answer
180 views

Schnorr based ZK scheme

TL;DR: This ABSOLUTELY does not work and presents a huge security risk. Posting it anyways in case there are other threats I missed or to dissuade any other person who comes up with this idea. Hi! I’m ...
popeye's user avatar
  • 55
0 votes
0 answers
74 views

Schnorr signature | Schnorr Public Parameters

hello guys hope you are doing well :), i am trying to simulate the Schnorr Signature, but i have encountered some difficulties finding the generator, i have chosen a prime P of 1024bit and took a ...
Amir Amara's user avatar
2 votes
1 answer
296 views

Why is r used in ECDSA signature while R in Schnorr signature?

In Schnorr signature (R, s), R is used. But in ECDSA signature (r, s), r is used, which is the x-coordinate of R. Why the difference?
sinoTrinity's user avatar
1 vote
0 answers
64 views

Detailed Proof of Knowledge for Discrete Log

I'm having difficulty finding a detailed proof for one of the most basic protocols in cryptography, that is the Schnorr protocol, or the sigma protocol for proving knowledge of a discrete log. Most ...
Joseph Johnston's user avatar
1 vote
1 answer
48 views

Necessary Schnorr signature non-interactive challenge bindings

Some implementations of a Schnorr signature will determine the challenge as follows: $c=H(kG \mathbin\| X \mathbin\| m)==H(rG+cX \mathbin\| X \mathbin\| m)$, where: $c$ is the challenge $m$ is the ...
knaccc's user avatar
  • 4,672
2 votes
1 answer
87 views

Is there any reason to search for Z values other than 1 when transforming X,Y to Jacobian representation of an EC Point?

When exchanging a public key I usually receive some compressed form of X,Y coordinates. To use some speed ups I'd need to represent that in the Jacobean ...
T. Rossi's user avatar
  • 177
1 vote
1 answer
69 views

Negation of a EC Point with Jacobi x,y,z representation

I'm building a small library for Schnorr Signatures and the Oracle DLC, the key passage is: s_i G = R - h(i, R)V R = k G; G generator, k a nonce h(i, R) is the hash of the message i (i is one of the ...
T. Rossi's user avatar
  • 177
1 vote
1 answer
102 views

Would discrete-log-based signing and encryption have been a better choice than RSA?

Diffie-Hellman can be used for key exchange, and can be used as part of an integrated encryption scheme ("DLIES"). Schnorr signatures are possible by relying only on the discrete-log problem,...
knaccc's user avatar
  • 4,672
2 votes
0 answers
141 views

Is there a Ed25519 threshold signature protocol similar to the Gennaro-Goldfeder schema for ECDSA?

I keep searching online and asking in different cryptographic communities whether there is a similar threshold signature schema (or a close one) to what Gennaro and Goldfeder proposed for ECDSA? ...
Max's user avatar
  • 121
3 votes
1 answer
101 views

How would a malicious group of co-signers use a hash collision to sign an unintended message?

According to BIP340: However, a major drawback of this optimization is that finding collisions in a short hash function is easy. This complicates the implementation of secure signing protocols in ...
scottmsul's user avatar
4 votes
1 answer
625 views

Is the security of a Schnorr signature dependent on the hash function that is used?

When a Schnorr signature is created, the number $r$ is concatenated with the message to produce a new value which is then hashed to give a number represented by $e$. The number $e$, accompanied by ...
CCS's user avatar
  • 195
1 vote
0 answers
58 views

(Multi-User) Security Key-prefixed Schnorr Signature

Bernstein proofs in his paper that single-key security of the classic Schnorr signature system tightly implies the single-key security of the key-prefixed variant of the system. Can this statement be ...
einsteinwein's user avatar
3 votes
1 answer
200 views

Hash function requirements for short Schnorr Signature

Neven et al. stated in their paper Hash Function Requirements for Schnorr Signatures following theorem (using the forking lemma): $\mathbb{G}$ is the generic group (section 2), $s \approx \log_2q$, ...
einsteinwein's user avatar
7 votes
0 answers
318 views

Security Proof of Short Schnorr Signature

I know that this is a very specific question, but I still hope that someone can help me. I'm trying to understand the security of the short schnorr signature a little bit better. The security ...
einsteinwein's user avatar
8 votes
1 answer
261 views

MuSig: could the rogue key attack be mitigated by using commitments instead of key transformations?

Background MuSig is an extension of/derivation from Schnorr signatures using cyclic groups on elliptic curves. In the original paper, the authors point out that naive multi-Schnorr is vulnerable to a ...
Jonathan Voss's user avatar
4 votes
0 answers
266 views

Uniqueness and Schnorr signatures

I am trying to analyse a "uniqueness" game around Schnorr signatures. The game is described in $\textbf{B.}$ and I try to provide in $\textbf{1.}$ and $\textbf{2.}$ some incomplete answers ...
kira-wulfstan's user avatar
2 votes
2 answers
143 views

Security of Signature Schemes in the Multi-User Setting

I've often read about the security of a signature scheme in the multi-user setting Link1 Link2, but I couldn't find a real definition. I would like to be sure that I understand it correctly. So my ...
einsteinwein's user avatar
0 votes
1 answer
314 views

Related Key Attack on Schnorr Signature - Why does the challenge include $\psi = g^x$, not $y$?

The original Schnorr signature scheme suffers from a Related Key Attack (RKA) as described by Morita et al. The authors of this paper then suggest a modification to the signature algorithm to prevent ...
YGrade's user avatar
  • 33
2 votes
0 answers
128 views

Can I store a public key used to verify a Schnorr signature in PEM format?

I want to ask if there is any way to store a Schnorr signature key in PEM format, or any other standardized format. And, if possible, I would like to know if that's possible to be done in C language; ...
Razvan Marian's user avatar
0 votes
1 answer
125 views

How or in which format should Schnorr signature keys be stored? [closed]

I would like to know if there is any standard for storing public and private keys for Schnorr signature
Razvan Marian's user avatar
3 votes
1 answer
173 views

Can one prove that a particular public key is part of an aggregated (MuSig) public key?

The MuSig paper (2018) describes a Schnorr signature key aggregation scheme which lets a set of individual public keys to be merged into a single, "aggregated" public key. In the protocol ...
resonant _tuxedo's user avatar
3 votes
0 answers
195 views

Schnorr signature in two steps, known vulnerabilities

We are looking to perform all the calculations for a Schnorr signature, more precisely EC-FSDSA, (BIP340-Schnorr), inside a secure element, to the exception of the Hash operation that is not supported ...
sarmluk's user avatar
  • 31
6 votes
1 answer
354 views

Difference between Generic Group Models

I'm trying to understand the difference between the (classical) Generic Group Model as it is described by Shoup [Shoup] and the somewhat restricted Generic Group Model as it is described by Schnorr ...
einsteinwein's user avatar
4 votes
1 answer
148 views

Relation between short and «regular» Schnorr signature

I'm failing to fully understand the reasoning in 19.2.3 of Boneh and Shoup's A Graduate Course in Applied Cryptography. That constructs short («optimized»/original) Schnorr signature from «regular» (...
fgrieu's user avatar
  • 137k
4 votes
1 answer
152 views

Security proof of schnorr identification scheme

I have studied the Schnorr identification scheme, and I came across the security proof. My question is regarding the following: $$\begin{align} \text{Pr}\left[\text{DLog}_{\mathcal{A}',\mathcal{G}}\...
Ran Eldan's user avatar
  • 143
1 vote
0 answers
84 views

Distributed Random Oracle with Verifiable Shares

$Setup$: Let's assume a quorum of $n$ nodes where each have a secret share $y_i$ from a know and safe leaderless DKG protocol. Define $\mathcal{L}^i(y_i) = y$ as the lagrange interpolation for $x=0$, ...
shumy's user avatar
  • 418
4 votes
0 answers
136 views

Why do we use Generlized Forking Lemma with several crucial points, while in the security proof we just rewind to a single point

Recently I have been reading this paper by Dan Boneh et al., where the authors are going to use a general form of forking lemma, to prove the security of their Schnorr multi-signature. As I ...
A.Solei's user avatar
  • 365
0 votes
0 answers
124 views

Request for a zero-knowledge proof (or hint)

I want to design a zero-knowledge proof (ideally a NIZK, but could be a sigma protocol) so that Alice can prove that a certain encryption contains a value that has been signed by a certain key. More ...
knoob's user avatar
  • 1
2 votes
3 answers
142 views

Can schnorr-signatures be used to ensure public keys are of the correct form (namely $Y= x \cdot G$)?

Assume a Schnorr-signature scheme in an elliptic curve setting with a publicly known generator base point $G$ where the the discrete logarithm is hard. That is, given $x \cdot G$, it is hard to find $...
cryptobeginner's user avatar
3 votes
2 answers
303 views

Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?

An EdDSA signature is (R, S) where R = r*B and S = r + H(R, A, M)*s. Notation from Wikipedia en.wikipedia.org/wiki/EdDSA. Given that the hash function H, is indeed collision-resistant, would using S = ...
Frans Lundberg's user avatar
1 vote
0 answers
148 views

Schnorr Protocol Implementation - Sometimes Fails on Curve25519

I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
Goodies's user avatar
  • 145
0 votes
1 answer
87 views

BLS to Schnorr signature conversion?

Imagine a situation where a prover can only sign with BLS signature signing algorithm, a verifier can only verify with Schnorr signature verification algorithm. Is it possible to convert a BLS ...
Brqoo's user avatar
  • 103
7 votes
2 answers
763 views

Is Schnorr's digital signature a non-interactive zero-knowledge proof?

If yes, is there any paper that proves it? Unifying Zero-Knowledge Proofs of Knowledge, by Ueli Maurer, argues that Schnorr's interactive protocol is zero-knowledge. If this is true, using the Fiat-...
Fiono's user avatar
  • 567
8 votes
1 answer
734 views

Details about ROS attack on blind Schnorr signatures

My question concerns the recently uploaded paper On the (in)security of ROS that describes an expected polynomial-time attack on the unforgeability of Schnorr blind signatures. a) Does this mean that ...
Panagiotis Grontas's user avatar