Questions tagged [schnorr-signature]
A digital signature algorithm based on the discrete logarithm problem, provably secure in the random oracle model.
113
questions
1
vote
1
answer
35
views
Before Bitcoin what was the motivation for researching key aggregation multisig and threshold schemes?
The motivation for key aggregation multisig and threshold schemes (e.g. MuSig(2), FROST etc) in Bitcoin is obvious. Signatures are a large part of every transaction, all the nodes on the network are ...
- 165
1
vote
1
answer
65
views
Schnorr based ZK scheme
TL;DR: This ABSOLUTELY does not work and presents a huge security risk. Posting it anyways in case there are other threats I missed or to dissuade any other person who comes up with this idea.
Hi! I’m ...
- 35
0
votes
0
answers
52
views
Schnorr signature | Schnorr Public Parameters
hello guys hope you are doing well :),
i am trying to simulate the Schnorr Signature, but i have encountered some difficulties finding the generator,
i have chosen a prime P of 1024bit and took a ...
2
votes
1
answer
141
views
Why is r used in ECDSA signature while R in Schnorr signature?
In Schnorr signature (R, s), R is used. But in ECDSA signature (r, s), r is used, which is the x-coordinate of R. Why the difference?
- 145
1
vote
0
answers
56
views
Detailed Proof of Knowledge for Discrete Log
I'm having difficulty finding a detailed proof for one of the most basic protocols in cryptography, that is the Schnorr protocol, or the sigma protocol for proving knowledge of a discrete log.
Most ...
- 313
1
vote
1
answer
37
views
Necessary Schnorr signature non-interactive challenge bindings
Some implementations of a Schnorr signature will determine the challenge as follows:
$c=H(kG \mathbin\| X \mathbin\| m)==H(rG+cX \mathbin\| X \mathbin\| m)$, where:
$c$ is the challenge
$m$ is the ...
- 3,112
2
votes
1
answer
75
views
Is there any reason to search for Z values other than 1 when transforming X,Y to Jacobian representation of an EC Point?
When exchanging a public key I usually receive some compressed form of X,Y coordinates. To use some speed ups I'd need to represent that in the Jacobean ...
- 177
1
vote
1
answer
54
views
Negation of a EC Point with Jacobi x,y,z representation
I'm building a small library for Schnorr Signatures and the Oracle DLC, the key passage is:
s_i G = R - h(i, R)V
R = k G; G generator, k a nonce
h(i, R) is the hash of the message i (i is one of the ...
- 177
1
vote
1
answer
86
views
Would discrete-log-based signing and encryption have been a better choice than RSA?
Diffie-Hellman can be used for key exchange, and can be used as part of an integrated encryption scheme ("DLIES"). Schnorr signatures are possible by relying only on the discrete-log problem,...
- 3,112
1
vote
0
answers
65
views
Is there a Ed25519 threshold signature protocol similar to the Gennaro-Goldfeder schema for ECDSA?
I keep searching online and asking in different cryptographic communities whether there is a similar threshold signature schema (or a close one) to what Gennaro and Goldfeder proposed for ECDSA?
...
- 111
3
votes
1
answer
84
views
How would a malicious group of co-signers use a hash collision to sign an unintended message?
According to BIP340:
However, a major drawback of this optimization is that finding collisions in a short hash function is easy. This complicates the implementation of secure signing protocols in ...
- 31
0
votes
0
answers
40
views
How does not tagging hashes result in leaking the secret key if a nonce is re-used in a different scheme?
I'm reading through BIP340 and I'm having trouble understanding this part:
For example, without tagged hashing a BIP340 signature could also be valid for a signature scheme where the only difference ...
- 31
3
votes
1
answer
387
views
Is the security of a Schnorr signature dependent on the hash function that is used?
When a Schnorr signature is created, the number $r$ is concatenated with the message to produce a new value which is then hashed to give a number represented by $e$. The number $e$, accompanied by ...
- 185
1
vote
0
answers
39
views
(Multi-User) Security Key-prefixed Schnorr Signature
Bernstein proofs in his paper that single-key security of the classic Schnorr signature system tightly implies the single-key security of the key-prefixed variant of the system. Can this statement be ...
- 379
3
votes
1
answer
171
views
Hash function requirements for short Schnorr Signature
Neven et al. stated in their paper Hash Function Requirements for Schnorr Signatures following theorem (using the forking lemma): $\mathbb{G}$ is the generic group (section 2), $s \approx \log_2q$, ...
- 379
7
votes
0
answers
218
views
Security Proof of Short Schnorr Signature
I know that this is a very specific question, but I still hope that someone can help me. I'm trying to understand the security of the short schnorr signature a little bit better. The security ...
- 379
4
votes
0
answers
84
views
MuSig: could the rogue key attack be mitigated by using commitments instead of key transformations?
Background
MuSig is an extension of/derivation from Schnorr signatures using cyclic groups on elliptic curves. In the original paper, the authors point out that naive multi-Schnorr is vulnerable to a ...
- 141
4
votes
0
answers
229
views
Uniqueness and Schnorr signatures
I am trying to analyse a "uniqueness" game around Schnorr signatures. The game is described in $\textbf{B.}$ and I try to provide in $\textbf{1.}$ and $\textbf{2.}$ some incomplete answers ...
- 41
2
votes
2
answers
73
views
Security of Signature Schemes in the Multi-User Setting
I've often read about the security of a signature scheme in the multi-user setting Link1 Link2, but I couldn't find a real definition. I would like to be sure that I understand it correctly. So my ...
- 379
0
votes
1
answer
92
views
Related Key Attack on Schnorr Signature - Why does the challenge include $\psi = g^x$, not $y$?
The original Schnorr signature scheme suffers from a Related Key Attack (RKA) as described by Morita et al. The authors of this paper then suggest a modification to the signature algorithm to prevent ...
- 13
2
votes
0
answers
70
views
Can I store a public key used to verify a Schnorr signature in PEM format?
I want to ask if there is any way to store a Schnorr signature key in PEM format, or any other standardized format.
And, if possible, I would like to know if that's possible to be done in C language; ...
0
votes
1
answer
60
views
How or in which format should Schnorr signature keys be stored? [closed]
I would like to know if there is any standard for storing public and private keys for Schnorr signature
3
votes
1
answer
92
views
Can one prove that a particular public key is part of an aggregated (MuSig) public key?
The MuSig paper (2018) describes a Schnorr signature key aggregation scheme which lets a set of individual public keys to be merged into a single, "aggregated" public key.
In the protocol ...
3
votes
0
answers
145
views
Schnorr signature in two steps, known vulnerabilities
We are looking to perform all the calculations for a Schnorr signature, more precisely EC-FSDSA, (BIP340-Schnorr), inside a secure element, to the exception of the Hash operation that is not supported ...
- 31
7
votes
1
answer
237
views
Difference between Generic Group Models
I'm trying to understand the difference between the (classical) Generic Group Model as it is described by Shoup [Shoup] and the somewhat restricted Generic Group Model as it is described by Schnorr ...
- 379
4
votes
1
answer
115
views
Relation between short and «regular» Schnorr signature
I'm failing to fully understand the reasoning in 19.2.3 of Boneh and Shoup's A Graduate Course in Applied Cryptography. That constructs short («optimized»/original) Schnorr signature from «regular» (...
- 125k
4
votes
1
answer
96
views
Security proof of schnorr identification scheme
I have studied the Schnorr identification scheme, and I came across the security proof.
My question is regarding the following:
$$\begin{align}
\text{Pr}\left[\text{DLog}_{\mathcal{A}',\mathcal{G}}\...
- 143
1
vote
0
answers
76
views
Distributed Random Oracle with Verifiable Shares
$Setup$:
Let's assume a quorum of $n$ nodes where each have a secret share $y_i$ from a know and safe leaderless DKG protocol.
Define $\mathcal{L}^i(y_i) = y$ as the lagrange interpolation for $x=0$, ...
- 398
3
votes
0
answers
76
views
Why do we use Generlized Forking Lemma with several crucial points, while in the security proof we just rewind to a single point
Recently I have been reading this paper by Dan Boneh et al., where the authors are going to use a general form of forking lemma, to prove the security of their Schnorr multi-signature.
As I ...
- 325
0
votes
0
answers
97
views
Request for a zero-knowledge proof (or hint)
I want to design a zero-knowledge proof (ideally a NIZK, but could be a sigma protocol) so that Alice can prove that a certain encryption contains a value that has been signed by a certain key.
More ...
- 1
2
votes
3
answers
105
views
Can schnorr-signatures be used to ensure public keys are of the correct form (namely $Y= x \cdot G$)?
Assume a Schnorr-signature scheme in an elliptic curve setting with a publicly known generator base point $G$ where the the discrete logarithm is hard. That is, given $x \cdot G$, it is hard to find $...
- 347
3
votes
2
answers
275
views
Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?
An EdDSA signature is (R, S) where R = r*B and S = r + H(R, A, M)*s. Notation from Wikipedia en.wikipedia.org/wiki/EdDSA.
Given that the hash function H, is indeed collision-resistant, would using S = ...
- 365
1
vote
0
answers
89
views
Schnorr Protocol Implementation - Sometimes Fails on Curve25519
I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
- 145
0
votes
1
answer
61
views
BLS to Schnorr signature conversion?
Imagine a situation where a prover can only sign with BLS signature signing algorithm, a verifier can only verify with Schnorr signature verification algorithm. Is it possible to convert a BLS ...
- 103
7
votes
2
answers
418
views
Is Schnorr's digital signature a non-interactive zero-knowledge proof?
If yes, is there any paper that proves it? Unifying Zero-Knowledge Proofs of Knowledge, by Ueli Maurer, argues that Schnorr's interactive protocol is zero-knowledge. If this is true, using the Fiat-...
- 515
8
votes
1
answer
486
views
Details about ROS attack on blind Schnorr signatures
My question concerns the recently uploaded paper On the (in)security of ROS that describes an expected polynomial-time attack on the unforgeability of Schnorr blind signatures.
a) Does this mean that ...
3
votes
0
answers
157
views
How to efficiently find Schnorr groups that have a generator $g=2$?
A Schnorr group is a multiplicative group of integers modulo an odd prime $p$ of prime order $q$, normally such that $p$ is much greater than $q$.
As far as I know, the normal way to find a Schnorr ...
- 649
3
votes
1
answer
256
views
Is there any proof for ECDSA signature algorithm?
Related: Is there an interactive version of ECDSA signature protocol like the Schnorr identification protocol?
- 165
1
vote
1
answer
166
views
Proving equality of two Schnorr Signatures
Given two Schnorr Signatures that were made from the same $x$, where each $x$ is private. Is there a way to prove that they came from the same $x$ without revealing $x$?
I heard about Chaum-Pedersen ...
- 43
1
vote
0
answers
66
views
Is using Fiat-shamir Heuristic safe?
What I'd like to do is to have the Prover store a value x where x remains hidden.
From x, I'...
- 43
-1
votes
1
answer
142
views
Orignal Schnorr Signature vs Discrete logarithmic Schnorr Signature
I have currently started a course on cryptography and am an absolute beginner. While reading through Schnorr's Protocol I came across several ways in which it was described.
One of the approach is ...
0
votes
0
answers
47
views
What Digital Signature Scheme should we use?
My team wants to implement the ElectionGuard as the main part of an e-voting scheme (even if it is known that e-voting protocols are malleable; for the purposes of the voting scheme it is enough). ...
- 113
9
votes
1
answer
2k
views
How to confirm my implementation is constant time
I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1.
A notable difference is that the BCH schnorr algorithm ...
- 99
3
votes
1
answer
153
views
Variant of Schnorr Protocol (Difference pair of response and verification)
When I am trying to learn deeper to Schnorr Protocol. I found that for deference there is more than one response and verify pair. But I am not sure am I right.
We will use Schnorr Protocol to prove ...
- 139
4
votes
3
answers
143
views
Construct Schnorr Protocol can only verify by designated verifier
Currently I have a DLP as following, $y = g^x \bmod p$, I can easily construct a proof of knowledge by using Schnorr Protocol.
But I would like to put it a a system of 2 parties with public key and ...
- 139
4
votes
1
answer
311
views
Is it possible I can open pedersen commitments without revealing r?
With setup $p$ and $q$ where $p = 2q + 1$, and $g$ and $h$ is the generator with order $q$.
In Pedersen commitment, I commit the value m with $c=g^m h^r \bmod p$,
then de-commit by revealing $(m, r)$....
- 139
2
votes
1
answer
249
views
What are the implications of limiting the private key space with elliptic curve Schnorr signatures?
Given a curve, I am trying to limit the private key space to ultimately cut down the Schnorr signature size as follows:
Assume an elliptic curve $E$ over a field $F$ with generator point $G$ and the ...
- 649
3
votes
1
answer
203
views
Is Ed25519 really constant-time as widely implemented?
Despite the frequent claims that Ed25519 is more secure against side-channel attacks than (for instance) signatures performed over NIST P-256, I noticed that most implementations (including the ...
- 1,645
1
vote
0
answers
62
views
Looking for a partially blind multisignature scheme?
I am working in a project inspired in digital cash where we would like to use partially-blind signatures. This is so that the Bank signs a check with a hidden serial number (S), but a plainly visible ...
- 126
2
votes
0
answers
280
views
Does EdDSA share Schnorr signature secure linearity property?
EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA), is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source).
Schnorr signatures have a ...
- 233