Questions tagged [schnorr-signature]

A digital signature algorithm based on the discrete logarithm problem, provably secure in the random oracle model.

Filter by
Sorted by
Tagged with
1
vote
0answers
14 views

Are key-prefixed schnorr signatures still relevant?

My question refers to the papers "On the Multi-User Security of Short Schnorr Signatures by Blocki and Lee" and "Multi-user Schnorr security, revisited by Bernstein". The main ...
1
vote
0answers
24 views

Does the implication “security classic schnorr $=>$ multi-key security key prefixed schnorr” apply to short Schnorr signatures?

My question refers to the paper "Multi-user Schnorr security, revisited" by Bernstein. Does the implication shown in the paper security of classic Schnorr $\implies $ multi-key security of ...
2
votes
3answers
62 views

Can schnorr-signatures be used to ensure public keys are of the correct form (namely $Y= x \cdot G$)?

Assume a Schnorr-signature scheme in an elliptic curve setting with a publicly known generator base point $G$ where the the discrete logarithm is hard. That is, given $x \cdot G$, it is hard to find $...
6
votes
4answers
792 views

How to forge Schnorr signatures if you can guess the challenge

Underlying the Schnorr signature is an identification protocol: let $G$ be a cyclic group where discrete log is "hard" and choose $g$ as a generator of $G$. Now have Alice pick a random (secret) ...
5
votes
1answer
215 views

Small generator for classical Schnorr signatures?

I'm implementing classical Schnorr signatures for real-world use. By "classical," I mean that the operations occur in a finite group, with no elliptic curves. I'm following Schnorr signature ...
1
vote
0answers
126 views

Does EdDSA share Schnorr signature secure linearity property?

EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA), is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source). Schnorr signatures have a ...
3
votes
2answers
220 views

Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?

An EdDSA signature is (R, S) where R = r*B and S = r + H(R, A, M)*s. Notation from Wikipedia en.wikipedia.org/wiki/EdDSA. Given that the hash function H, is indeed collision-resistant, would using S = ...
8
votes
1answer
220 views

Details about ROS attack on blind Schnorr signatures

My question concerns the recently uploaded paper On the (in)security of ROS that describes an expected polynomial-time attack on the unforgeability of Schnorr blind signatures. a) Does this mean that ...
1
vote
0answers
27 views

Schnorr Protocol Implementation - Sometimes Fails on Curve25519

I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
2
votes
1answer
497 views

Schnorr Pubkey Recovery

As per How does recovering the public key from an ECDSA signature work?, it's possible to recover public keys from ECDSA signatures. Is this possible for EC-Schnorr signatures as well? I'm looking ...
0
votes
1answer
24 views

BLS to Schnorr signature conversion?

Imagine a situation where a prover can only sign with BLS signature signing algorithm, a verifier can only verify with Schnorr signature verification algorithm. Is it possible to convert a BLS ...
1
vote
1answer
109 views

How to specify last $t$ bits are only sent when a signature is sent?

I have read that in cases where there is a limit on the amount of data sent over the network, one idea is to sent only $t$ bits of data rather than sending all the bits. For example, in the Schnorr ...
5
votes
1answer
130 views

Is Schnorr's digital signature a non-interactive zero-knowledge proof?

If yes, is there any paper that proves it? Unifying Zero-Knowledge Proofs of Knowledge, by Ueli Maurer, argues that Schnorr's interactive protocol is zero-knowledge. If this is true, using the Fiat-...
2
votes
0answers
50 views

How to efficiently find Schnorr groups that have a generator $g=2$?

A Schnorr group is a multiplicative group of integers modulo an odd prime $p$ of prime order $q$, normally such that $p$ is much greater than $q$. As far as I know, the normal way to find a Schnorr ...
2
votes
1answer
105 views

Is there any proof for ECDSA signature algorithm?

Related: Is there an interactive version of ECDSA signature protocol like the Schnorr identification protocol?
1
vote
1answer
82 views

Proving equality of two Schnorr Signatures

Given two Schnorr Signatures that were made from the same $x$, where each $x$ is private. Is there a way to prove that they came from the same $x$ without revealing $x$? I heard about Chaum-Pedersen ...
1
vote
0answers
46 views

Is using Fiat-shamir Heuristic safe?

What I'd like to do is to have the Prover store a value x where x remains hidden. From x, I'...
0
votes
1answer
64 views

Orignal Schnorr Signature vs Discrete logarithmic Schnorr Signature

I have currently started a course on cryptography and am an absolute beginner. While reading through Schnorr's Protocol I came across several ways in which it was described. One of the approach is ...
0
votes
0answers
40 views

What Digital Signature Scheme should we use?

My team wants to implement the ElectionGuard as the main part of an e-voting scheme (even if it is known that e-voting protocols are malleable; for the purposes of the voting scheme it is enough). ...
8
votes
1answer
2k views

How to confirm my implementation is constant time

I'm implementing Schnorr signatures following a variant used in Bitcoin Cash (BCH) of this algorithm: GitHub - Schnorr Signatures for secp256k1. A notable difference is that the BCH schnorr algorithm ...
5
votes
2answers
2k views

Prove the Security of Schnorr's Signature Scheme

I know that Schnorr's signature is important since it is one of the most compact signature schemes whose security has been proved in the random oracle model. Now, I want to know if such proof is ...
19
votes
4answers
4k views

EC Schnorr signature: multiple standard?

I'm working on some EC-Schnorr signature code. Reading various papers on that, it seems EC-Schnorr is not standardized as well as ECDSA. For example, I found two main differences in two main actors ...
4
votes
3answers
128 views

Construct Schnorr Protocol can only verify by designated verifier

Currently I have a DLP as following, $y = g^x \bmod p$, I can easily construct a proof of knowledge by using Schnorr Protocol. But I would like to put it a a system of 2 parties with public key and ...
3
votes
1answer
137 views

Variant of Schnorr Protocol (Difference pair of response and verification)

When I am trying to learn deeper to Schnorr Protocol. I found that for deference there is more than one response and verify pair. But I am not sure am I right. We will use Schnorr Protocol to prove ...
2
votes
1answer
168 views

Is it possible I can open pedersen commitments without revealing r?

With setup $p$ and $q$ where $p = 2q + 1$, and $g$ and $h$ is the generator with order $q$. In Pedersen commitment, I commit the value m with $c=g^m h^r \bmod p$, then de-commit by revealing $(m, r)$....
2
votes
1answer
110 views

What are the implications of limiting the private key space with elliptic curve Schnorr signatures?

Given a curve, I am trying to limit the private key space to ultimately cut down the Schnorr signature size as follows: Assume an elliptic curve $E$ over a field $F$ with generator point $G$ and the ...
3
votes
2answers
199 views

Non interactive threshold signature without bilinear pairing (is it possible)?

All threshold signature schemes that I have seen need bilinear pairings to avoid parameter exchange between parties. These are normally commitment schemes for a certain secret. I believe a 2-round ...
3
votes
1answer
147 views

Is Ed25519 really constant-time as widely implemented?

Despite the frequent claims that Ed25519 is more secure against side-channel attacks than (for instance) signatures performed over NIST P-256, I noticed that most implementations (including the ...
8
votes
2answers
385 views

What is TPMFail attack and what are the countermeasures?

Trusted Platform Module (TPM) is designed as a hardware-based root of trust to protect cryptographic keys even against system based adversaries. Although Intel's firmware based fTPM has FIPS 140-2 ...
1
vote
0answers
41 views

Looking for a partially blind multisignature scheme?

I am working in a project inspired in digital cash where we would like to use partially-blind signatures. This is so that the Bank signs a check with a hidden serial number (S), but a plainly visible ...
18
votes
2answers
2k views

Security of Schnorr signature versus DSA and DLP

The Schnorr signature scheme is a randomized signature scheme with appendix. The signature is $3t$-bit for conjectured $t$-bit security in a chosen-messages setup, with at most $2^{t/2}$ queries to a ...
6
votes
2answers
326 views

The definition and origin of Schnorr groups?

Wanting to write something on Schnorr groups in a publication I realised how hard it is to find anything citable about them on the internet. Who can help me with the following questions? What (and ...
0
votes
1answer
129 views

Does the nonce really have to be hashed as part of the challenge in a Schnorr signature?

From this article: https://tlu.tarilabs.com/cryptography/digital_signatures/introduction_schnorr_signatures.html#why-do-we-need-the-nonce The article states that the challenge ...
1
vote
0answers
134 views

Factorization or discrete logarithm is difficult for an attacker?

I have read that difficulty in breaking many algorithms are based either on Factorization or discrete logarithm. I am reading about schemes that are similar to RSA which make use of integer ...
4
votes
2answers
539 views

Importance of random number generation in Schnorr's signature

In Schnorr's digital signature protocol (https://en.wikipedia.org/wiki/Schnorr_signature), the signing process (as described in wikipedia) requires the generation of a random bit $r$. I am wondering ...
0
votes
1answer
73 views

Security exists or not in Modification in schnorr signature

In Schnorr's digital signature protocol (https://en.wikipedia.org/wiki/Schnorr_signature), the signature is $(s,e)$ where $s=k-xe$. Assumption: $k$ and $x$ are assumed to be secret value of user. So, ...
8
votes
2answers
3k views

Examples of applications that use the Schnorr digital signature?

I have made a study on digital signatures, especially on the Schnorr digital signature, and I was just wondering if there is some way I can find names of actual (known) applications that have applied ...
14
votes
2answers
3k views

Schnorr signatures: multisignature support

Schnorr signature is mentioned as a promising upgrade to bitcoin to improve scalability. It support multisignature, several signatures can be aggregated into a single, new signature. But I fail to ...
1
vote
1answer
144 views

How are all necessary parameters shared between signer and verifier in the ED25519 signature scheme?

I want to use the ED25519 signature scheme in my application which requires frequent sharing of secret data between two entities in the public domain. I know that the Schnorr signature scheme has a ...
2
votes
1answer
246 views

Plausible Deniability in Schnorr

How does a dishonest verifier affect plausible deniability of the interactive Schnorr protocol?
1
vote
1answer
64 views

Questions regarding random values in Schnorr authentication

In Chapter 21.3 of Schneier, Applied Cryptography I read the following about the Schnorr Authentication Protocol: To generate a key pair, first choose two primes, $p$ and $q$, such that $q$ is a ...
1
vote
0answers
110 views

Schnorr-signature calculating a coefficient

I need to create program that makes signature for selected file. I simplified algorithm a little, because I draw max 64 bit prime numbers instead of ...
1
vote
1answer
128 views

Discrete logarithm problem particularly hard for Schnorr groups?

The Wikipedia article on Discrete Logarithm just states without source: In some cases (e.g. large prime order subgroups of groups ($\mathbb{Z}_p)^×$) there is not only no efficient algorithm known ...
0
votes
1answer
168 views

MuSig/Schnorr key aggregation: How get the combined private key

Given all parties' private keys in MuSig, is it possible to get a combined private key corresponding to the combined public key? I know it's possible to sign a message, but how to get the combined ...
1
vote
0answers
164 views

Schnorr authentication protocol vs Schnorr signature Scheme

As I understand the schnorr authentication protocol is an interactive protocol where a prover WLOG proves to a Verifier that he possesses the discrete log to some group element. If we use the Fiat-...
1
vote
1answer
49 views

Monero Ring CT sj calculation

For a university project, I am currently implementing the RingCT Ring signatures as used in Monero (before the introduction of Bulletproofs) as laid out in this paper. To close the ring we calculate ...
0
votes
1answer
121 views

Malleable version of Schnorr signature

Given an elliptic curve defined in $\mathbb{F}_{q}$ with a generator $G$ and a hash function $H_{q}(x)$ which maps $x$ to $\mathbb{F}_{q}$. A Schnorr signature variation for a data block $B$ such as: ...
1
vote
0answers
108 views

Prove that two commitments are commitments to the same value

Let $x$ be the secret value, $(n,a,b,c)$ a public key, $(n_C, g, h)$ the commitment public key. Furthermore let $r, r_C$ be two random numbers. Define $C = g^x h^{r_C} \bmod n_C$, $C_x = a^x b^r \...
12
votes
1answer
178 views

Why is $e=0$ allowed in Schnorr signatures?

In a Schnorr signature (Wikipedia style), we have: $R = kG$, where $0<k<n$ is a nonce and $G$ is the generator point. $e = H(R \| M) \bmod n$, where $H()$ is a hashing function and $M$ is the ...
2
votes
1answer
129 views

Is Wikipidia wrong about Schnorr Signatures?

Wikipidia says Schnorr signature generation is defined like this: ...