Questions tagged [schnorr-signature]
A digital signature algorithm based on the discrete logarithm problem, provably secure in the random oracle model.
105
questions
1
vote
1answer
72 views
Would discrete-log-based signing and encryption have been a better choice than RSA?
Diffie-Hellman can be used for key exchange, and can be used as part of an integrated encryption scheme ("DLIES"). Schnorr signatures are possible by relying only on the discrete-log problem,...
1
vote
0answers
30 views
Is there a Ed25519 threshold signature protocol similar to the Gennaro-Goldfeder schema for ECDSA?
I keep searching online and asking in different cryptographic communities whether there is a similar threshold signature schema (or a close one) to what Gennaro and Goldfeder proposed for ECDSA?
...
2
votes
1answer
67 views
How would a malicious group of co-signers use a hash collision to sign an unintended message?
According to BIP340:
However, a major drawback of this optimization is that finding collisions in a short hash function is easy. This complicates the implementation of secure signing protocols in ...
0
votes
0answers
36 views
How does not tagging hashes result in leaking the secret key if a nonce is re-used in a different scheme?
I'm reading through BIP340 and I'm having trouble understanding this part:
For example, without tagged hashing a BIP340 signature could also be valid for a signature scheme where the only difference ...
3
votes
1answer
260 views
Is the security of a Schnorr signature dependent on the hash function that is used?
When a Schnorr signature is created, the number $r$ is concatenated with the message to produce a new value which is then hashed to give a number represented by $e$. The number $e$, accompanied by ...
1
vote
0answers
31 views
(Multi-User) Security Key-prefixed Schnorr Signature
Bernstein proofs in his paper that single-key security of the classic Schnorr signature system tightly implies the single-key security of the key-prefixed variant of the system. Can this statement be ...
3
votes
1answer
163 views
Hash function requirements for short Schnorr Signature
Neven et al. stated in their paper Hash Function Requirements for Schnorr Signatures following theorem (using the forking lemma): $\mathbb{G}$ is the generic group (section 2), $s \approx \log_2q$, ...
7
votes
0answers
177 views
Security Proof of Short Schnorr Signature
I know that this is a very specific question, but I still hope that someone can help me. I'm trying to understand the security of the short schnorr signature a little bit better. The security ...
3
votes
0answers
44 views
MuSig: could the rogue key attack be mitigated by using commitments instead of key transformations?
Background
MuSig is an extension of/derivation from Schnorr signatures using cyclic groups on elliptic curves. In the original paper, the authors point out that naive multi-Schnorr is vulnerable to a ...
3
votes
0answers
206 views
Uniqueness and Schnorr signatures
I am trying to analyse a "uniqueness" game around Schnorr signatures. The game is described in $\textbf{B.}$ and I try to provide in $\textbf{1.}$ and $\textbf{2.}$ some incomplete answers ...
2
votes
2answers
56 views
Security of Signature Schemes in the Multi-User Setting
I've often read about the security of a signature scheme in the multi-user setting Link1 Link2, but I couldn't find a real definition. I would like to be sure that I understand it correctly. So my ...
0
votes
1answer
42 views
Related Key Attack on Schnorr Signature - Why does the challenge include $\psi = g^x$, not $y$?
The original Schnorr signature scheme suffers from a Related Key Attack (RKA) as described by Morita et al. The authors of this paper then suggest a modification to the signature algorithm to prevent ...
1
vote
0answers
41 views
Can I store a public key used to verify a Schnorr signature in PEM format?
I want to ask if there is any way to store a Schnorr signature key in PEM format, or any other standardized format.
And, if possible, I would like to know if that's possible to be done in C language; ...
0
votes
1answer
52 views
How or in which format should Schnorr signature keys be stored? [closed]
I would like to know if there is any standard for storing public and private keys for Schnorr signature
2
votes
0answers
35 views
Can one prove that a particular public key is part of an aggregated (MuSig) public key?
The MuSig paper (2018) describes a Schnorr signature key aggregation scheme which lets a set of individual public keys to be merged into a single, "aggregated" public key.
In the protocol ...
3
votes
0answers
124 views
Schnorr signature in two steps, known vulnerabilities
We are looking to perform all the calculations for a Schnorr signature, more precisely EC-FSDSA, (BIP340-Schnorr), inside a secure element, to the exception of the Hash operation that is not supported ...
7
votes
1answer
176 views
Difference between Generic Group Models
I'm trying to understand the difference between the (classical) Generic Group Model as it is described by Shoup [Shoup] and the somewhat restricted Generic Group Model as it is described by Schnorr ...
4
votes
1answer
108 views
Relation between short and «regular» Schnorr signature
I'm failing to fully understand the reasoning in 19.2.3 of Boneh and Shoup's A Graduate Course in Applied Cryptography. That constructs short («optimized»/original) Schnorr signature from «regular» (...
4
votes
1answer
85 views
Security proof of schnorr identification scheme
I have studied the Schnorr identification scheme, and I came across the security proof.
My question is regarding the following:
$$\begin{align}
\text{Pr}\left[\text{DLog}_{\mathcal{A}',\mathcal{G}}\...
1
vote
0answers
71 views
Distributed Random Oracle with Verifiable Shares
$Setup$:
Let's assume a quorum of $n$ nodes where each have a secret share $y_i$ from a know and safe leaderless DKG protocol.
Define $\mathcal{L}^i(y_i) = y$ as the lagrange interpolation for $x=0$, ...
3
votes
0answers
56 views
Why do we use Generlized Forking Lemma with several crucial points, while in the security proof we just rewind to a single point
Recently I have been reading this paper by Dan Boneh et al., where the authors are going to use a general form of forking lemma, to prove the security of their Schnorr multi-signature.
As I ...
0
votes
0answers
84 views
Request for a zero-knowledge proof (or hint)
I want to design a zero-knowledge proof (ideally a NIZK, but could be a sigma protocol) so that Alice can prove that a certain encryption contains a value that has been signed by a certain key.
More ...
2
votes
3answers
92 views
Can schnorr-signatures be used to ensure public keys are of the correct form (namely $Y= x \cdot G$)?
Assume a Schnorr-signature scheme in an elliptic curve setting with a publicly known generator base point $G$ where the the discrete logarithm is hard. That is, given $x \cdot G$, it is hard to find $...
3
votes
2answers
263 views
Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?
An EdDSA signature is (R, S) where R = r*B and S = r + H(R, A, M)*s. Notation from Wikipedia en.wikipedia.org/wiki/EdDSA.
Given that the hash function H, is indeed collision-resistant, would using S = ...
1
vote
0answers
59 views
Schnorr Protocol Implementation - Sometimes Fails on Curve25519
I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
0
votes
1answer
45 views
BLS to Schnorr signature conversion?
Imagine a situation where a prover can only sign with BLS signature signing algorithm, a verifier can only verify with Schnorr signature verification algorithm. Is it possible to convert a BLS ...
6
votes
1answer
237 views
Is Schnorr's digital signature a non-interactive zero-knowledge proof?
If yes, is there any paper that proves it? Unifying Zero-Knowledge Proofs of Knowledge, by Ueli Maurer, argues that Schnorr's interactive protocol is zero-knowledge. If this is true, using the Fiat-...
8
votes
1answer
413 views
Details about ROS attack on blind Schnorr signatures
My question concerns the recently uploaded paper On the (in)security of ROS that describes an expected polynomial-time attack on the unforgeability of Schnorr blind signatures.
a) Does this mean that ...
3
votes
0answers
105 views
How to efficiently find Schnorr groups that have a generator $g=2$?
A Schnorr group is a multiplicative group of integers modulo an odd prime $p$ of prime order $q$, normally such that $p$ is much greater than $q$.
As far as I know, the normal way to find a Schnorr ...
3
votes
1answer
164 views
Is there any proof for ECDSA signature algorithm?
Related: Is there an interactive version of ECDSA signature protocol like the Schnorr identification protocol?
1
vote
1answer
140 views
Proving equality of two Schnorr Signatures
Given two Schnorr Signatures that were made from the same $x$, where each $x$ is private. Is there a way to prove that they came from the same $x$ without revealing $x$?
I heard about Chaum-Pedersen ...
1
vote
0answers
63 views
Is using Fiat-shamir Heuristic safe?
What I'd like to do is to have the Prover store a value x where x remains hidden.
From x, I'...
-1
votes
1answer
121 views
Orignal Schnorr Signature vs Discrete logarithmic Schnorr Signature
I have currently started a course on cryptography and am an absolute beginner. While reading through Schnorr's Protocol I came across several ways in which it was described.
One of the approach is ...
0
votes
0answers
43 views
What Digital Signature Scheme should we use?
My team wants to implement the ElectionGuard as the main part of an e-voting scheme (even if it is known that e-voting protocols are malleable; for the purposes of the voting scheme it is enough). ...
9
votes
1answer
2k views
How to confirm my implementation is constant time
I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1.
A notable difference is that the BCH schnorr algorithm ...
3
votes
1answer
146 views
Variant of Schnorr Protocol (Difference pair of response and verification)
When I am trying to learn deeper to Schnorr Protocol. I found that for deference there is more than one response and verify pair. But I am not sure am I right.
We will use Schnorr Protocol to prove ...
4
votes
3answers
135 views
Construct Schnorr Protocol can only verify by designated verifier
Currently I have a DLP as following, $y = g^x \bmod p$, I can easily construct a proof of knowledge by using Schnorr Protocol.
But I would like to put it a a system of 2 parties with public key and ...
4
votes
1answer
253 views
Is it possible I can open pedersen commitments without revealing r?
With setup $p$ and $q$ where $p = 2q + 1$, and $g$ and $h$ is the generator with order $q$.
In Pedersen commitment, I commit the value m with $c=g^m h^r \bmod p$,
then de-commit by revealing $(m, r)$....
2
votes
1answer
210 views
What are the implications of limiting the private key space with elliptic curve Schnorr signatures?
Given a curve, I am trying to limit the private key space to ultimately cut down the Schnorr signature size as follows:
Assume an elliptic curve $E$ over a field $F$ with generator point $G$ and the ...
3
votes
1answer
176 views
Is Ed25519 really constant-time as widely implemented?
Despite the frequent claims that Ed25519 is more secure against side-channel attacks than (for instance) signatures performed over NIST P-256, I noticed that most implementations (including the ...
1
vote
0answers
56 views
Looking for a partially blind multisignature scheme?
I am working in a project inspired in digital cash where we would like to use partially-blind signatures. This is so that the Bank signs a check with a hidden serial number (S), but a plainly visible ...
2
votes
0answers
208 views
Does EdDSA share Schnorr signature secure linearity property?
EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA), is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source).
Schnorr signatures have a ...
3
votes
2answers
239 views
Non interactive threshold signature without bilinear pairing (is it possible)?
All threshold signature schemes that I have seen need bilinear pairings to avoid parameter exchange between parties. These are normally commitment schemes for a certain secret.
I believe a 2-round ...
0
votes
1answer
207 views
Does the nonce really have to be hashed as part of the challenge in a Schnorr signature?
From this article: https://tlu.tarilabs.com/cryptography/digital_signatures/introduction_schnorr_signatures.html#why-do-we-need-the-nonce
The article states that the challenge ...
8
votes
2answers
514 views
What is TPMFail attack and what are the countermeasures?
Trusted Platform Module (TPM) is designed as a hardware-based root of trust to protect cryptographic keys even against system based adversaries.
Although Intel's firmware based fTPM has FIPS 140-2 ...
1
vote
1answer
92 views
Questions regarding random values in Schnorr authentication
In Chapter 21.3 of Schneier, Applied Cryptography I read the following about the Schnorr Authentication Protocol:
To generate a key pair, first choose two primes, $p$ and $q$, such that $q$ is a ...
1
vote
1answer
185 views
Discrete logarithm problem particularly hard for Schnorr groups?
The Wikipedia article on Discrete Logarithm just states without source:
In some cases (e.g. large prime order subgroups of groups ($\mathbb{Z}_p)^×$) there is not only no efficient algorithm known ...
6
votes
2answers
455 views
The definition and origin of Schnorr groups?
Wanting to write something on Schnorr groups in a publication I realised how hard it is to find anything citable about them on the internet. Who can help me with the following questions?
What (and ...
1
vote
1answer
208 views
MuSig/Schnorr key aggregation: How get the combined private key
Given all parties' private keys in MuSig, is it possible to get a combined private key corresponding to the combined public key? I know it's possible to sign a message, but how to get the combined ...
1
vote
0answers
198 views
Schnorr authentication protocol vs Schnorr signature Scheme
As I understand the schnorr authentication protocol is an interactive protocol where a prover WLOG proves to a Verifier that he possesses the discrete log to some group element.
If we use the Fiat-...
