Questions tagged [schnorr-signature]

A digital signature algorithm based on the discrete logarithm problem, provably secure in the random oracle model.

21 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
9 views

Details about ROS attack on blind Schnorr signatures

My question concerns the recently uploaded paper On the (in)security of ROS that describes an expected polynomial-time attack on the unforgeability of Schnorr blind signatures. a) Does this mean that ...
2
votes
0answers
20 views

How to efficiently find Schnorr groups that have a generator $g=2$?

A Schnorr group is a multiplicative group of integers modulo an odd prime $p$ of prime order $q$, normally such that $p$ is much greater than $q$. As far as I know, the normal way to find a Schnorr ...
2
votes
0answers
180 views

Missing step in Schnorr's proof that an attack on blind signatures requires solving ROS?

In Security of Blind Discrete Log Signatures Against Interactive Attacks C.P. Schnorr defines the ROS Problem and claims that a $(l+1)$ attack against his blind signature scheme is equivalent to ...
1
vote
0answers
37 views

Is using Fiat-shamir Heuristic safe?

What I'd like to do is to have the Prover store a value x where x remains hidden. From x, I'...
1
vote
0answers
33 views

Looking for a partially blind multisignature scheme?

I am working in a project inspired in digital cash where we would like to use partially-blind signatures. This is so that the Bank signs a check with a hidden serial number (S), but a plainly visible ...
1
vote
0answers
70 views

Does EdDSA share Schnorr signature secure linearity property?

EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA) is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source). Schnorr signatures have a ...
1
vote
0answers
147 views

Schnorr authentication protocol vs Schnorr signature Scheme

As I understand the schnorr authentication protocol is an interactive protocol where a prover WLOG proves to a Verifier that he possesses the discrete log to some group element. If we use the Fiat-...
1
vote
0answers
101 views

Prove that two commitments are commitments to the same value

Let $x$ be the secret value, $(n,a,b,c)$ a public key, $(n_C, g, h)$ the commitment public key. Furthermore let $r, r_C$ be two random numbers. Define $C = g^x h^{r_C} \bmod n_C$, $C_x = a^x b^r \...
1
vote
0answers
101 views

Schnorr-signature calculating a coefficient

I need to create program that makes signature for selected file. I simplified algorithm a little, because I draw max 64 bit prime numbers instead of ...
1
vote
0answers
57 views

HW wallet and multisignaters in ECC

I need to design a system where there is a secure device (a.k.a. HW wallet), with the following functionality: Deterministic key generation for key parameters (speaking simply: key ID). Never expose/...
1
vote
0answers
111 views

Drawbacks of Schnorr Authentication that require Fiat-Shamir and Random Oracles?

I've been going through G. Maxwell's paper on the Borromean Ring Signature, and I don't fully understand this part on Schnorr Signature. If some could explain it more intuitively thank you. "...
1
vote
0answers
81 views

Threshold Bitcoin signature scheme

Any advice would be appreciated: It seems to me that using an uncomplicated combination of a shamir scheme and schnorr it's fairly trivial to have a threshold signature scheme. I think it's also ...
1
vote
0answers
220 views

BLS aggregate signatures for relay node non-interactive incentive accounting

This is a practical application of cryptography question and I hope this is the right place to ask it. Any advice would be very much appreciated. I'm looking for a low-bandwidth, non-interactive ...
1
vote
0answers
676 views

Zero Knowledge Non Interactive Proof with random oracle

I am trying to write an assay about Non Interactive Zero-Knowledge proofs and would like to take the simple discrete logarithm problem example fallowing the Feige-Fiat-Shamir heuristics. I understand ...
1
vote
1answer
92 views

How to specify last $t$ bits are only sent when a signature is sent?

I have read that in cases where there is a limit on the amount of data sent over the network, one idea is to sent only $t$ bits of data rather than sending all the bits. For example, in the Schnorr ...
1
vote
0answers
131 views

Factorization or discrete logarithm is difficult for an attacker?

I have read that difficulty in breaking many algorithms are based either on Factorization or discrete logarithm. I am reading about schemes that are similar to RSA which make use of integer ...
0
votes
0answers
34 views

What Digital Signature Scheme should we use?

My team wants to implement the ElectionGuard as the main part of an e-voting scheme (even if it is known that e-voting protocols are malleable; for the purposes of the voting scheme it is enough). ...
0
votes
0answers
50 views

Generalized Schnorr's signature variations

I'm working on an ECC-based system. There's a Schnorr's signature, by which the prover may prove a knowledge of a preimage (i.e. scalar, private key) of an EC point (i.e. public key). It can be ...
0
votes
0answers
23 views

Schnorr signature verification via Pairing-Based Cryptography?

Let $e: G^{\dagger}_{1} \times G_{2} \mapsto G_{T}$ define the pairing. Assuming an output $\sigma = (c, p)$ similar to a Schnorr signature: $s \times Y \mapsto Y_{s}$ and $m \times G \mapsto M$ $c = ...
0
votes
0answers
35 views

What is the main difference between Gap Sigma protocol and Sigma protocol?

I can understand and know how to use the Sigma protocol. My main question is that I cannot understand the main usage of the Gap-Sigma protocol. What is the main difference between the Gap Sigma ...
0
votes
0answers
35 views

Is there an O(1) in space complexity k-of-n signature scheme?

I was looking in depth into Schnorr signatures recently, and while they are very attractive for their ability to be aggregated, this only works for n-of-n ...