Questions tagged [schnorr-signature]

A digital signature algorithm based on the discrete logarithm problem, provably secure in the random oracle model.

20 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
1answer
248 views

Details about ROS attack on blind Schnorr signatures

My question concerns the recently uploaded paper On the (in)security of ROS that describes an expected polynomial-time attack on the unforgeability of Schnorr blind signatures. a) Does this mean that ...
2
votes
0answers
17 views

Are key-prefixed schnorr signatures still relevant?

My question refers to the papers "On the Multi-User Security of Short Schnorr Signatures by Blocki and Lee" and "Multi-user Schnorr security, revisited by Bernstein". The main ...
2
votes
0answers
54 views

How to efficiently find Schnorr groups that have a generator $g=2$?

A Schnorr group is a multiplicative group of integers modulo an odd prime $p$ of prime order $q$, normally such that $p$ is much greater than $q$. As far as I know, the normal way to find a Schnorr ...
2
votes
0answers
229 views

Missing step in Schnorr's proof that an attack on blind signatures requires solving ROS?

In Security of Blind Discrete Log Signatures Against Interactive Attacks C.P. Schnorr defines the ROS Problem and claims that a $(l+1)$ attack against his blind signature scheme is equivalent to ...
1
vote
0answers
27 views

Does the implication “security classic schnorr $=>$ multi-key security key prefixed schnorr” apply to short Schnorr signatures?

My question refers to the paper "Multi-user Schnorr security, revisited" by Bernstein. Does the implication shown in the paper security of classic Schnorr $\implies $ multi-key security of ...
1
vote
0answers
29 views

Schnorr Protocol Implementation - Sometimes Fails on Curve25519

I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
1
vote
0answers
47 views

Is using Fiat-shamir Heuristic safe?

What I'd like to do is to have the Prover store a value x where x remains hidden. From x, I'...
1
vote
0answers
43 views

Looking for a partially blind multisignature scheme?

I am working in a project inspired in digital cash where we would like to use partially-blind signatures. This is so that the Bank signs a check with a hidden serial number (S), but a plainly visible ...
1
vote
0answers
132 views

Does EdDSA share Schnorr signature secure linearity property?

EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA), is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source). Schnorr signatures have a ...
1
vote
0answers
169 views

Schnorr authentication protocol vs Schnorr signature Scheme

As I understand the schnorr authentication protocol is an interactive protocol where a prover WLOG proves to a Verifier that he possesses the discrete log to some group element. If we use the Fiat-...
1
vote
0answers
112 views

Prove that two commitments are commitments to the same value

Let $x$ be the secret value, $(n,a,b,c)$ a public key, $(n_C, g, h)$ the commitment public key. Furthermore let $r, r_C$ be two random numbers. Define $C = g^x h^{r_C} \bmod n_C$, $C_x = a^x b^r \...
1
vote
0answers
112 views

Schnorr-signature calculating a coefficient

I need to create program that makes signature for selected file. I simplified algorithm a little, because I draw max 64 bit prime numbers instead of ...
1
vote
0answers
57 views

HW wallet and multisignaters in ECC

I need to design a system where there is a secure device (a.k.a. HW wallet), with the following functionality: Deterministic key generation for key parameters (speaking simply: key ID). Never expose/...
1
vote
0answers
113 views

Drawbacks of Schnorr Authentication that require Fiat-Shamir and Random Oracles?

I've been going through G. Maxwell's paper on the Borromean Ring Signature, and I don't fully understand this part on Schnorr Signature. If some could explain it more intuitively thank you. "...
1
vote
0answers
83 views

Threshold Bitcoin signature scheme

Any advice would be appreciated: It seems to me that using an uncomplicated combination of a shamir scheme and schnorr it's fairly trivial to have a threshold signature scheme. I think it's also ...
1
vote
0answers
225 views

BLS aggregate signatures for relay node non-interactive incentive accounting

This is a practical application of cryptography question and I hope this is the right place to ask it. Any advice would be very much appreciated. I'm looking for a low-bandwidth, non-interactive ...
1
vote
0answers
698 views

Zero Knowledge Non Interactive Proof with random oracle

I am trying to write an assay about Non Interactive Zero-Knowledge proofs and would like to take the simple discrete logarithm problem example fallowing the Feige-Fiat-Shamir heuristics. I understand ...
1
vote
0answers
135 views

Factorization or discrete logarithm is difficult for an attacker?

I have read that difficulty in breaking many algorithms are based either on Factorization or discrete logarithm. I am reading about schemes that are similar to RSA which make use of integer ...
0
votes
0answers
58 views

Request for a zero-knowledge proof (or hint)

I want to design a zero-knowledge proof (ideally a NIZK, but could be a sigma protocol) so that Alice can prove that a certain encryption contains a value that has been signed by a certain key. More ...
0
votes
0answers
40 views

What Digital Signature Scheme should we use?

My team wants to implement the ElectionGuard as the main part of an e-voting scheme (even if it is known that e-voting protocols are malleable; for the purposes of the voting scheme it is enough). ...