# Tag Info

Accepted

### How to confirm my implementation is constant time

How to confirm my implementation is constant time? I'm in scala using bouncy castle from Java. This code is not constant time, for no platform is specified. Computing platforms that run in constant ...
Accepted

### Security of Schnorr signature versus DSA and DLP

Your post was a bit confusing to me, I think you're thinking of this from the wrong perspective. Is there a scheme with security arguably equivalent to DSA (or better, the DLP or related), but with ...
Accepted

### Schnorr signatures: multisignature support

[This was an irresponsible answer to write six years ago, even with a tongue-in-beak disclaimer to do your own security analysis and find the flaws in it. Please consult the (latest) literature, not ...
Accepted

### Why is $e=0$ allowed in Schnorr signatures?

Strangely, if $e=0$ then no knowledge of $x$ is proven, as all steps can be carried out by someone who knows only $M$. So, why is $e=0$ not disallowed? Because $e = 0$ is not unique in this regard. ...

### EC Schnorr signature: multiple standard?

Adding to other answers, I note that both schemes are related to (but clearly different from) those standardized in ISO/IEC 14888-3:2016 (non-functional preview): The BSI's EC-Schnorr original ...
Accepted

### Shor algorithm and schnorr signature in ed25519

Shor's algorithm can compute discrete logs in elliptic curves and thereby recover the secret scalar from a public Ed25519 key, which you can use to forge signatures of your choice. So, yes, it ...
Accepted

### How to forge signatures in the Schnorr scheme if $r=g^k$ is eliminated?

I suppose that you address the question to a signature scheme, in which the signature is still the pair $(r,s)$ with $r=g^k \bmod p$ as the exponentiated nonce and $$s = H(m)\cdot x + k \mod q,$$ ...
Accepted

### How are all necessary parameters shared between signer and verifier in the ED25519 signature scheme?

Ed25519 is well-defined and requires you to use SHA-512 as internal hash function along with the twisted Edwards version of Curve25519, hence there's no need for a KAC when it comes to questions about ...

### What is an example of a secure sigma proof?

I guess you are talking about Figure 5.3? It is said that the Schnorr proof (sigma protocol for discrete log relation) is insecure against cheating verifiers - it is only honest-verifier zero ...

### What is TPMFail attack and what are the countermeasures?

TPM-Fail is a new demonstration of the well-known lattice-based attack of Howgrave-Graham and Smart on DLOG-based signature schemes such as Elgamal, Schnorr, and DSA that exploits partial information ...
Accepted

### Is there any proof for ECDSA signature algorithm?

As pointed out by @SEJPM, you can read more about security proofs for DSA/ECDSA family on this thread. As for whether there exists an interactive protocol corresponding to DSA/ECDSA à la Schnorr ...

### Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?

would using S = r + H(A, M) be a secure variant? Actually, it would become trivial to generate a signature for an abitrary message with just the public key. The verification check would be: 2^h s G ...
Accepted

### MuSig: could the rogue key attack be mitigated by using commitments instead of key transformations?

Yes, the rogue key attack can be prevented by committing to a public key before exchanging the keys. But this requires that you never use a public key with more than one group of signers. If you use ...

### Importance of random number generation in Schnorr's signature

Note that the signature is $(s,e)$ where $s=k-xe$. If you can learn $k$ since it is predictable, then you can learn the secret signing key by computing $x = (s-k)/e$. Note that even without a concrete ...
Partial answer to my own question, after some weeks of research based on the question's expanded bibliography. History The Schnorr signature scheme was initially proposed with a $t$-bit hash ($3t$-...