# Questions tagged [schnorr-signature]

A digital signature algorithm based on the discrete logarithm problem, provably secure in the random oracle model.

113 questions
Filter by
Sorted by
Tagged with
1 vote
35 views

### Before Bitcoin what was the motivation for researching key aggregation multisig and threshold schemes?

The motivation for key aggregation multisig and threshold schemes (e.g. MuSig(2), FROST etc) in Bitcoin is obvious. Signatures are a large part of every transaction, all the nodes on the network are ...
1 vote
65 views

### Schnorr based ZK scheme

TL;DR: This ABSOLUTELY does not work and presents a huge security risk. Posting it anyways in case there are other threats I missed or to dissuade any other person who comes up with this idea. Hi! I’m ...
• 35
52 views

### Schnorr signature | Schnorr Public Parameters

hello guys hope you are doing well :), i am trying to simulate the Schnorr Signature, but i have encountered some difficulties finding the generator, i have chosen a prime P of 1024bit and took a ...
141 views

### Why is r used in ECDSA signature while R in Schnorr signature?

In Schnorr signature (R, s), R is used. But in ECDSA signature (r, s), r is used, which is the x-coordinate of R. Why the difference?
• 145
1 vote
56 views

### Detailed Proof of Knowledge for Discrete Log

I'm having difficulty finding a detailed proof for one of the most basic protocols in cryptography, that is the Schnorr protocol, or the sigma protocol for proving knowledge of a discrete log. Most ...
1 vote
37 views

### Necessary Schnorr signature non-interactive challenge bindings

Some implementations of a Schnorr signature will determine the challenge as follows: $c=H(kG \mathbin\| X \mathbin\| m)==H(rG+cX \mathbin\| X \mathbin\| m)$, where: $c$ is the challenge $m$ is the ...
• 3,112
75 views

### Is there any reason to search for Z values other than 1 when transforming X,Y to Jacobian representation of an EC Point?

When exchanging a public key I usually receive some compressed form of X,Y coordinates. To use some speed ups I'd need to represent that in the Jacobean ...
• 177
1 vote
54 views

### Negation of a EC Point with Jacobi x,y,z representation

I'm building a small library for Schnorr Signatures and the Oracle DLC, the key passage is: s_i G = R - h(i, R)V R = k G; G generator, k a nonce h(i, R) is the hash of the message i (i is one of the ...
• 177
1 vote
86 views

### Would discrete-log-based signing and encryption have been a better choice than RSA?

Diffie-Hellman can be used for key exchange, and can be used as part of an integrated encryption scheme ("DLIES"). Schnorr signatures are possible by relying only on the discrete-log problem,...
• 3,112
1 vote
65 views

### Is there a Ed25519 threshold signature protocol similar to the Gennaro-Goldfeder schema for ECDSA?

I keep searching online and asking in different cryptographic communities whether there is a similar threshold signature schema (or a close one) to what Gennaro and Goldfeder proposed for ECDSA? ...
• 111
84 views

### How would a malicious group of co-signers use a hash collision to sign an unintended message?

According to BIP340: However, a major drawback of this optimization is that finding collisions in a short hash function is easy. This complicates the implementation of secure signing protocols in ...
40 views

### How does not tagging hashes result in leaking the secret key if a nonce is re-used in a different scheme?

I'm reading through BIP340 and I'm having trouble understanding this part: For example, without tagged hashing a BIP340 signature could also be valid for a signature scheme where the only difference ...
387 views

### Is the security of a Schnorr signature dependent on the hash function that is used?

When a Schnorr signature is created, the number $r$ is concatenated with the message to produce a new value which is then hashed to give a number represented by $e$. The number $e$, accompanied by ...
• 185
1 vote
39 views

### (Multi-User) Security Key-prefixed Schnorr Signature

Bernstein proofs in his paper that single-key security of the classic Schnorr signature system tightly implies the single-key security of the key-prefixed variant of the system. Can this statement be ...
• 379
171 views

### Hash function requirements for short Schnorr Signature

Neven et al. stated in their paper Hash Function Requirements for Schnorr Signatures following theorem (using the forking lemma): $\mathbb{G}$ is the generic group (section 2), $s \approx \log_2q$, ...
• 379
218 views

### Security Proof of Short Schnorr Signature

I know that this is a very specific question, but I still hope that someone can help me. I'm trying to understand the security of the short schnorr signature a little bit better. The security ...
• 379
84 views

### MuSig: could the rogue key attack be mitigated by using commitments instead of key transformations?

Background MuSig is an extension of/derivation from Schnorr signatures using cyclic groups on elliptic curves. In the original paper, the authors point out that naive multi-Schnorr is vulnerable to a ...
229 views

### Uniqueness and Schnorr signatures

I am trying to analyse a "uniqueness" game around Schnorr signatures. The game is described in $\textbf{B.}$ and I try to provide in $\textbf{1.}$ and $\textbf{2.}$ some incomplete answers ...
73 views

### Security of Signature Schemes in the Multi-User Setting

I've often read about the security of a signature scheme in the multi-user setting Link1 Link2, but I couldn't find a real definition. I would like to be sure that I understand it correctly. So my ...
• 379
92 views

### Related Key Attack on Schnorr Signature - Why does the challenge include $\psi = g^x$, not $y$?

The original Schnorr signature scheme suffers from a Related Key Attack (RKA) as described by Morita et al. The authors of this paper then suggest a modification to the signature algorithm to prevent ...
• 13
70 views

### Can I store a public key used to verify a Schnorr signature in PEM format?

I want to ask if there is any way to store a Schnorr signature key in PEM format, or any other standardized format. And, if possible, I would like to know if that's possible to be done in C language; ...
60 views

### How or in which format should Schnorr signature keys be stored? [closed]

I would like to know if there is any standard for storing public and private keys for Schnorr signature
92 views

### Can one prove that a particular public key is part of an aggregated (MuSig) public key?

The MuSig paper (2018) describes a Schnorr signature key aggregation scheme which lets a set of individual public keys to be merged into a single, "aggregated" public key. In the protocol ...
145 views

### Schnorr signature in two steps, known vulnerabilities

We are looking to perform all the calculations for a Schnorr signature, more precisely EC-FSDSA, (BIP340-Schnorr), inside a secure element, to the exception of the Hash operation that is not supported ...
• 31
237 views

### Difference between Generic Group Models

I'm trying to understand the difference between the (classical) Generic Group Model as it is described by Shoup [Shoup] and the somewhat restricted Generic Group Model as it is described by Schnorr ...
• 379
115 views

### Relation between short and «regular» Schnorr signature

I'm failing to fully understand the reasoning in 19.2.3 of Boneh and Shoup's A Graduate Course in Applied Cryptography. That constructs short («optimized»/original) Schnorr signature from «regular» (...
• 125k
96 views

### Security proof of schnorr identification scheme

I have studied the Schnorr identification scheme, and I came across the security proof. My question is regarding the following: \begin{align} \text{Pr}\left[\text{DLog}_{\mathcal{A}',\mathcal{G}}\...
• 143
1 vote
76 views

### Distributed Random Oracle with Verifiable Shares

$Setup$: Let's assume a quorum of $n$ nodes where each have a secret share $y_i$ from a know and safe leaderless DKG protocol. Define $\mathcal{L}^i(y_i) = y$ as the lagrange interpolation for $x=0$, ...
• 398
76 views

### Why do we use Generlized Forking Lemma with several crucial points, while in the security proof we just rewind to a single point

Recently I have been reading this paper by Dan Boneh et al., where the authors are going to use a general form of forking lemma, to prove the security of their Schnorr multi-signature. As I ...
• 325
97 views

### Request for a zero-knowledge proof (or hint)

I want to design a zero-knowledge proof (ideally a NIZK, but could be a sigma protocol) so that Alice can prove that a certain encryption contains a value that has been signed by a certain key. More ...
105 views

• 649
203 views

### Is Ed25519 really constant-time as widely implemented?

Despite the frequent claims that Ed25519 is more secure against side-channel attacks than (for instance) signatures performed over NIST P-256, I noticed that most implementations (including the ...
1 vote