# Questions tagged [schnorr-signature]

A digital signature algorithm based on the discrete logarithm problem, provably secure in the random oracle model.

29 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
179 views

### Security Proof of Short Schnorr Signature

I know that this is a very specific question, but I still hope that someone can help me. I'm trying to understand the security of the short schnorr signature a little bit better. The security ...
45 views

### MuSig: could the rogue key attack be mitigated by using commitments instead of key transformations?

Background MuSig is an extension of/derivation from Schnorr signatures using cyclic groups on elliptic curves. In the original paper, the authors point out that naive multi-Schnorr is vulnerable to a ...
206 views

### Uniqueness and Schnorr signatures

I am trying to analyse a "uniqueness" game around Schnorr signatures. The game is described in $\textbf{B.}$ and I try to provide in $\textbf{1.}$ and $\textbf{2.}$ some incomplete answers ...
124 views

### Schnorr signature in two steps, known vulnerabilities

We are looking to perform all the calculations for a Schnorr signature, more precisely EC-FSDSA, (BIP340-Schnorr), inside a secure element, to the exception of the Hash operation that is not supported ...
56 views

### Why do we use Generlized Forking Lemma with several crucial points, while in the security proof we just rewind to a single point

Recently I have been reading this paper by Dan Boneh et al., where the authors are going to use a general form of forking lemma, to prove the security of their Schnorr multi-signature. As I ...
106 views

### How to efficiently find Schnorr groups that have a generator $g=2$?

A Schnorr group is a multiplicative group of integers modulo an odd prime $p$ of prime order $q$, normally such that $p$ is much greater than $q$. As far as I know, the normal way to find a Schnorr ...
68 views

### How would a malicious group of co-signers use a hash collision to sign an unintended message?

According to BIP340: However, a major drawback of this optimization is that finding collisions in a short hash function is easy. This complicates the implementation of secure signing protocols in ...
36 views

### Can one prove that a particular public key is part of an aggregated (MuSig) public key?

The MuSig paper (2018) describes a Schnorr signature key aggregation scheme which lets a set of individual public keys to be merged into a single, "aggregated" public key. In the protocol ...
213 views

### Does EdDSA share Schnorr signature secure linearity property?

EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA), is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source). Schnorr signatures have a ...
268 views

### Missing step in Schnorr's proof that an attack on blind signatures requires solving ROS?

In Security of Blind Discrete Log Signatures Against Interactive Attacks C.P. Schnorr defines the ROS Problem and claims that a $(l+1)$ attack against his blind signature scheme is equivalent to ...
33 views

### Is there a Ed25519 threshold signature protocol similar to the Gennaro-Goldfeder schema for ECDSA?

I keep searching online and asking in different cryptographic communities whether there is a similar threshold signature schema (or a close one) to what Gennaro and Goldfeder proposed for ECDSA? ...
31 views

### (Multi-User) Security Key-prefixed Schnorr Signature

Bernstein proofs in his paper that single-key security of the classic Schnorr signature system tightly implies the single-key security of the key-prefixed variant of the system. Can this statement be ...
43 views

### Can I store a public key used to verify a Schnorr signature in PEM format?

I want to ask if there is any way to store a Schnorr signature key in PEM format, or any other standardized format. And, if possible, I would like to know if that's possible to be done in C language; ...
72 views

### Distributed Random Oracle with Verifiable Shares

$Setup$: Let's assume a quorum of $n$ nodes where each have a secret share $y_i$ from a know and safe leaderless DKG protocol. Define $\mathcal{L}^i(y_i) = y$ as the lagrange interpolation for $x=0$, ...
60 views

### Schnorr Protocol Implementation - Sometimes Fails on Curve25519

I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
63 views

### Is using Fiat-shamir Heuristic safe?

What I'd like to do is to have the Prover store a value x where x remains hidden. From x, I'...
56 views

### Looking for a partially blind multisignature scheme?

I am working in a project inspired in digital cash where we would like to use partially-blind signatures. This is so that the Bank signs a check with a hidden serial number (S), but a plainly visible ...
198 views

### Schnorr authentication protocol vs Schnorr signature Scheme

As I understand the schnorr authentication protocol is an interactive protocol where a prover WLOG proves to a Verifier that he possesses the discrete log to some group element. If we use the Fiat-...
126 views

### Prove that two commitments are commitments to the same value

Let $x$ be the secret value, $(n,a,b,c)$ a public key, $(n_C, g, h)$ the commitment public key. Furthermore let $r, r_C$ be two random numbers. Define $C = g^x h^{r_C} \bmod n_C$, \$C_x = a^x b^r \...
130 views

### Schnorr-signature calculating a coefficient

I need to create program that makes signature for selected file. I simplified algorithm a little, because I draw max 64 bit prime numbers instead of ...
61 views

### HW wallet and multisignaters in ECC

I need to design a system where there is a secure device (a.k.a. HW wallet), with the following functionality: Deterministic key generation for key parameters (speaking simply: key ID). Never expose/...
119 views

### Drawbacks of Schnorr Authentication that require Fiat-Shamir and Random Oracles?

I've been going through G. Maxwell's paper on the Borromean Ring Signature, and I don't fully understand this part on Schnorr Signature. If some could explain it more intuitively thank you. "...
84 views

### Threshold Bitcoin signature scheme

Any advice would be appreciated: It seems to me that using an uncomplicated combination of a shamir scheme and schnorr it's fairly trivial to have a threshold signature scheme. I think it's also ...
235 views

### BLS aggregate signatures for relay node non-interactive incentive accounting

This is a practical application of cryptography question and I hope this is the right place to ask it. Any advice would be very much appreciated. I'm looking for a low-bandwidth, non-interactive ...
717 views

### Zero Knowledge Non Interactive Proof with random oracle

I am trying to write an assay about Non Interactive Zero-Knowledge proofs and would like to take the simple discrete logarithm problem example fallowing the Feige-Fiat-Shamir heuristics. I understand ...
140 views

### Factorization or discrete logarithm is difficult for an attacker?

I have read that difficulty in breaking many algorithms are based either on Factorization or discrete logarithm. I am reading about schemes that are similar to RSA which make use of integer ...
37 views

### How does not tagging hashes result in leaking the secret key if a nonce is re-used in a different scheme?

I'm reading through BIP340 and I'm having trouble understanding this part: For example, without tagged hashing a BIP340 signature could also be valid for a signature scheme where the only difference ...