Questions tagged [schnorr-signature]
A digital signature algorithm based on the discrete logarithm problem, provably secure in the random oracle model.
127
questions
1
vote
1
answer
27
views
Is it possible to forge valid proofs in this Schnorr signature-based ZKP system for proving knowledge about discrete logarithms?
I am currently reading the paper "A 2-round anonymous veto protocol" and have run into some trouble verifying the claims made about the zero knowledge proofs presented within. My knowledge ...
- 13
1
vote
2
answers
40
views
In ECDSA over K256, Why R.x should be less than the subgroup order, not field order? But in BIP340 over K256, should be less than field order
I understand that R.x is a field element.
I don't understand why in ECDSA verification ie. FIPS 186-5 section 6.4.2 step 1, we check whether r is less than subgroup order.
If it has something to do ...
- 143
2
votes
1
answer
51
views
Why are there two Challenges in the DSA Identification Scheme?
Would either $\alpha$ or $r$ suffice as challenge?
I am aware that the signature and verification were to adapt. However, what is the motivation behind using two challenges?
- 21
0
votes
1
answer
54
views
Reason for two random numbers in DSA?
Why is the signature in DSA the way it is?
I am referring to $r$ and $k$ in the Signing-Algorithm depicted below. Is it really necessary to have both, $r$ and $s$, or would it still be secure if only ...
- 21
0
votes
1
answer
24
views
Schnorr signature with adding instead of multiplying
I am reading about Schnorr signature (for example, from BIP-340) and I thought, what if we add instead of multiplying for $s$? So, in the signing process it will be ...
2
votes
2
answers
453
views
Why schnorr signatures uses H(R||m) instead of H(m)?
The Schnorr signature scheme was defined originally as $(c, s)$ such that $sG = R + cX$, and the verification process consisted of computing $R = sG - cX$ and then verifying that $c = H(R||m)$ so ...
1
vote
0
answers
139
views
JavaScript SubtleCrypto - Is there a way to convert the ECDSA keys into a more "portable" format and preferably shorter? [closed]
I asked this question on StackOverflow but it seems like it's more appropriate for this Crypto community.
I am using the browser built in SubtleCrypto library in javascript to generate public and ...
2
votes
1
answer
36
views
How is the message considered in the STROBE-based Schnorr signature example?
I've been studying the Schnorr signature scheme and recently came across an example that uses the STROBE protocol. In the classic version of Schnorr signatures, the challenge e is calculated as e = H(...
- 122
2
votes
0
answers
46
views
Deriving multiple deterministic keys in a Schnorr Multisig setup
Let's say that Alice and Bob have generated truly random private keys $a$ and $b$ and want to use them in Schnorr signing. They calculate $X = g^a \cdot g^b$ as their mutual public key. For whatever ...
- 21
1
vote
0
answers
74
views
They key size of the Schnorr Signature Algorithm
Based on the Schnorr signature below: What is the suitable size of lamda to generate a secure key?
- 13
2
votes
1
answer
88
views
Question about alternative formulation of the Schnorr signature…
Using the notation from the Wikipedia article: https://en.wikipedia.org/wiki/Schnorr_signature, the Schnorr signature mixes the random value $k$ and the hash $e$ like this:
$$s = k - xe$$
(Where $x$ ...
- 121
1
vote
2
answers
448
views
Convert a Schnorr Public Key to a compressed ECDSA Public Key
Given a Schnorr Public Key (32 bytes) x, I'd like to generate a compressed ECDSA Public Key (33 bytes) and thus be able to generate the bitcoin address that the private key holder can generate with ...
- 29
2
votes
0
answers
101
views
What is the advantage of ECDSA over Schnorr signature?
As we know, the Schnorr signature enjoys the linearity property, which does not exist in ECDSA. It seems the Schnorr signature is more efficient and can bring more features than ECDSA. What is the ...
- 777
0
votes
0
answers
125
views
Difference between ElGamal and Schnorr signature
A question about Schnorr group.
Am I right that this is basically a protection against discrete-log solvers?
So Schnorr signature is better than ElGamal in that sense?
2
votes
2
answers
215
views
Why are interactive Zero-Knowledge-Proofs deniable?
When reading about the comparison of interactive and non-interactive Zero-Knowledge-Proofs, I came across the statement that non-interactive Zero-Knowledge-Proofs are not deniable compared to ...
- 23
1
vote
1
answer
60
views
Before Bitcoin what was the motivation for researching key aggregation multisig and threshold schemes?
The motivation for key aggregation multisig and threshold schemes (e.g. MuSig(2), FROST etc) in Bitcoin is obvious. Signatures are a large part of every transaction, all the nodes on the network are ...
- 197
1
vote
1
answer
180
views
Schnorr based ZK scheme
TL;DR: This ABSOLUTELY does not work and presents a huge security risk. Posting it anyways in case there are other threats I missed or to dissuade any other person who comes up with this idea.
Hi! I’m ...
- 55
0
votes
0
answers
74
views
Schnorr signature | Schnorr Public Parameters
hello guys hope you are doing well :),
i am trying to simulate the Schnorr Signature, but i have encountered some difficulties finding the generator,
i have chosen a prime P of 1024bit and took a ...
2
votes
1
answer
296
views
Why is r used in ECDSA signature while R in Schnorr signature?
In Schnorr signature (R, s), R is used. But in ECDSA signature (r, s), r is used, which is the x-coordinate of R. Why the difference?
- 155
1
vote
0
answers
64
views
Detailed Proof of Knowledge for Discrete Log
I'm having difficulty finding a detailed proof for one of the most basic protocols in cryptography, that is the Schnorr protocol, or the sigma protocol for proving knowledge of a discrete log.
Most ...
- 357
1
vote
1
answer
48
views
Necessary Schnorr signature non-interactive challenge bindings
Some implementations of a Schnorr signature will determine the challenge as follows:
$c=H(kG \mathbin\| X \mathbin\| m)==H(rG+cX \mathbin\| X \mathbin\| m)$, where:
$c$ is the challenge
$m$ is the ...
- 4,672
2
votes
1
answer
87
views
Is there any reason to search for Z values other than 1 when transforming X,Y to Jacobian representation of an EC Point?
When exchanging a public key I usually receive some compressed form of X,Y coordinates. To use some speed ups I'd need to represent that in the Jacobean ...
- 177
1
vote
1
answer
69
views
Negation of a EC Point with Jacobi x,y,z representation
I'm building a small library for Schnorr Signatures and the Oracle DLC, the key passage is:
s_i G = R - h(i, R)V
R = k G; G generator, k a nonce
h(i, R) is the hash of the message i (i is one of the ...
- 177
1
vote
1
answer
102
views
Would discrete-log-based signing and encryption have been a better choice than RSA?
Diffie-Hellman can be used for key exchange, and can be used as part of an integrated encryption scheme ("DLIES"). Schnorr signatures are possible by relying only on the discrete-log problem,...
- 4,672
2
votes
0
answers
141
views
Is there a Ed25519 threshold signature protocol similar to the Gennaro-Goldfeder schema for ECDSA?
I keep searching online and asking in different cryptographic communities whether there is a similar threshold signature schema (or a close one) to what Gennaro and Goldfeder proposed for ECDSA?
...
- 121
3
votes
1
answer
101
views
How would a malicious group of co-signers use a hash collision to sign an unintended message?
According to BIP340:
However, a major drawback of this optimization is that finding collisions in a short hash function is easy. This complicates the implementation of secure signing protocols in ...
- 31
4
votes
1
answer
625
views
Is the security of a Schnorr signature dependent on the hash function that is used?
When a Schnorr signature is created, the number $r$ is concatenated with the message to produce a new value which is then hashed to give a number represented by $e$. The number $e$, accompanied by ...
- 195
1
vote
0
answers
58
views
(Multi-User) Security Key-prefixed Schnorr Signature
Bernstein proofs in his paper that single-key security of the classic Schnorr signature system tightly implies the single-key security of the key-prefixed variant of the system. Can this statement be ...
- 369
3
votes
1
answer
200
views
Hash function requirements for short Schnorr Signature
Neven et al. stated in their paper Hash Function Requirements for Schnorr Signatures following theorem (using the forking lemma): $\mathbb{G}$ is the generic group (section 2), $s \approx \log_2q$, ...
- 369
7
votes
0
answers
318
views
Security Proof of Short Schnorr Signature
I know that this is a very specific question, but I still hope that someone can help me. I'm trying to understand the security of the short schnorr signature a little bit better. The security ...
- 369
8
votes
1
answer
261
views
MuSig: could the rogue key attack be mitigated by using commitments instead of key transformations?
Background
MuSig is an extension of/derivation from Schnorr signatures using cyclic groups on elliptic curves. In the original paper, the authors point out that naive multi-Schnorr is vulnerable to a ...
- 183
4
votes
0
answers
266
views
Uniqueness and Schnorr signatures
I am trying to analyse a "uniqueness" game around Schnorr signatures. The game is described in $\textbf{B.}$ and I try to provide in $\textbf{1.}$ and $\textbf{2.}$ some incomplete answers ...
2
votes
2
answers
143
views
Security of Signature Schemes in the Multi-User Setting
I've often read about the security of a signature scheme in the multi-user setting Link1 Link2, but I couldn't find a real definition. I would like to be sure that I understand it correctly. So my ...
- 369
0
votes
1
answer
314
views
Related Key Attack on Schnorr Signature - Why does the challenge include $\psi = g^x$, not $y$?
The original Schnorr signature scheme suffers from a Related Key Attack (RKA) as described by Morita et al. The authors of this paper then suggest a modification to the signature algorithm to prevent ...
- 33
2
votes
0
answers
128
views
Can I store a public key used to verify a Schnorr signature in PEM format?
I want to ask if there is any way to store a Schnorr signature key in PEM format, or any other standardized format.
And, if possible, I would like to know if that's possible to be done in C language; ...
0
votes
1
answer
125
views
How or in which format should Schnorr signature keys be stored? [closed]
I would like to know if there is any standard for storing public and private keys for Schnorr signature
3
votes
1
answer
173
views
Can one prove that a particular public key is part of an aggregated (MuSig) public key?
The MuSig paper (2018) describes a Schnorr signature key aggregation scheme which lets a set of individual public keys to be merged into a single, "aggregated" public key.
In the protocol ...
3
votes
0
answers
195
views
Schnorr signature in two steps, known vulnerabilities
We are looking to perform all the calculations for a Schnorr signature, more precisely EC-FSDSA, (BIP340-Schnorr), inside a secure element, to the exception of the Hash operation that is not supported ...
- 31
6
votes
1
answer
354
views
Difference between Generic Group Models
I'm trying to understand the difference between the (classical) Generic Group Model as it is described by Shoup [Shoup] and the somewhat restricted Generic Group Model as it is described by Schnorr ...
- 369
4
votes
1
answer
148
views
Relation between short and «regular» Schnorr signature
I'm failing to fully understand the reasoning in 19.2.3 of Boneh and Shoup's A Graduate Course in Applied Cryptography. That constructs short («optimized»/original) Schnorr signature from «regular» (...
- 137k
4
votes
1
answer
152
views
Security proof of schnorr identification scheme
I have studied the Schnorr identification scheme, and I came across the security proof.
My question is regarding the following:
$$\begin{align}
\text{Pr}\left[\text{DLog}_{\mathcal{A}',\mathcal{G}}\...
- 143
1
vote
0
answers
84
views
Distributed Random Oracle with Verifiable Shares
$Setup$:
Let's assume a quorum of $n$ nodes where each have a secret share $y_i$ from a know and safe leaderless DKG protocol.
Define $\mathcal{L}^i(y_i) = y$ as the lagrange interpolation for $x=0$, ...
- 418
4
votes
0
answers
136
views
Why do we use Generlized Forking Lemma with several crucial points, while in the security proof we just rewind to a single point
Recently I have been reading this paper by Dan Boneh et al., where the authors are going to use a general form of forking lemma, to prove the security of their Schnorr multi-signature.
As I ...
- 365
0
votes
0
answers
124
views
Request for a zero-knowledge proof (or hint)
I want to design a zero-knowledge proof (ideally a NIZK, but could be a sigma protocol) so that Alice can prove that a certain encryption contains a value that has been signed by a certain key.
More ...
- 1
2
votes
3
answers
142
views
Can schnorr-signatures be used to ensure public keys are of the correct form (namely $Y= x \cdot G$)?
Assume a Schnorr-signature scheme in an elliptic curve setting with a publicly known generator base point $G$ where the the discrete logarithm is hard. That is, given $x \cdot G$, it is hard to find $...
- 347
3
votes
2
answers
303
views
Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?
An EdDSA signature is (R, S) where R = r*B and S = r + H(R, A, M)*s. Notation from Wikipedia en.wikipedia.org/wiki/EdDSA.
Given that the hash function H, is indeed collision-resistant, would using S = ...
- 365
1
vote
0
answers
148
views
Schnorr Protocol Implementation - Sometimes Fails on Curve25519
I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
- 145
0
votes
1
answer
87
views
BLS to Schnorr signature conversion?
Imagine a situation where a prover can only sign with BLS signature signing algorithm, a verifier can only verify with Schnorr signature verification algorithm. Is it possible to convert a BLS ...
- 103
7
votes
2
answers
763
views
Is Schnorr's digital signature a non-interactive zero-knowledge proof?
If yes, is there any paper that proves it? Unifying Zero-Knowledge Proofs of Knowledge, by Ueli Maurer, argues that Schnorr's interactive protocol is zero-knowledge. If this is true, using the Fiat-...
- 567
8
votes
1
answer
734
views
Details about ROS attack on blind Schnorr signatures
My question concerns the recently uploaded paper On the (in)security of ROS that describes an expected polynomial-time attack on the unforgeability of Schnorr blind signatures.
a) Does this mean that ...
