24 votes
Accepted

How to confirm my implementation is constant time

How to confirm my implementation is constant time? I'm in scala using bouncy castle from Java. This code is not constant time, for no platform is specified. Computing platforms that run in constant ...
17 votes
Accepted

Schnorr signatures: multisignature support

[This was an irresponsible answer to write six years ago, even with a tongue-in-beak disclaimer to do your own security analysis and find the flaws in it. Please consult the (latest) literature, not ...
Squeamish Ossifrage's user avatar
17 votes
Accepted

Security of Schnorr signature versus DSA and DLP

Your post was a bit confusing to me, I think you're thinking of this from the wrong perspective. Is there a scheme with security arguably equivalent to DSA (or better, the DLP or related), but with ...
CurveEnthusiast's user avatar
13 votes

EC Schnorr signature: multiple standard?

Adding to other answers, I note that both schemes are related to (but clearly different from) those standardized in ISO/IEC 14888-3:2016 (non-functional preview): The BSI's EC-Schnorr original ...
fgrieu's user avatar
  • 141k
13 votes
Accepted

Why is $e=0$ allowed in Schnorr signatures?

Strangely, if $e=0$ then no knowledge of $x$ is proven, as all steps can be carried out by someone who knows only $M$. So, why is $e=0$ not disallowed? Because $e = 0$ is not unique in this regard. ...
Jan Bobolz's user avatar
10 votes
Accepted

Shor algorithm and schnorr signature in ed25519

Shor's algorithm can compute discrete logs in elliptic curves and thereby recover the secret scalar from a public Ed25519 key, which you can use to forge signatures of your choice. So, yes, it ...
Squeamish Ossifrage's user avatar
9 votes
Accepted

Compact Schnorr signature?

This would work, but note that your weakening verification (slightly). Instead of only $(C_1,k_2)$ being a valid signature, now also $(-C_1,k_2)$ is valid. If you want to do signatures by only using $...
CurveEnthusiast's user avatar
9 votes
Accepted

What is TPMFail attack and what are the countermeasures?

In short, TPMFail attack is black-box timing analysis of TPM 2.0 devices deployed on computers. The TPMfail team is able to extract the private authentication key of TPMS's 256-bit private keys for ...
kelalaka's user avatar
  • 48.5k
8 votes

Prove the Security of Schnorr's Signature Scheme

Pointcheval and Stern [PS00] proved that the Schnorr signature is existentially unforgeable under chosen-message attacks (EU-CMA) in the random oracle model assuming that the discrete-logarithm ...
ckamath's user avatar
  • 5,188
8 votes

EC Schnorr signature: multiple standard?

The $(r,s)$ version in theory is more secure than $(h,s)$. Bellare, Namprempre, Neven 2004 paper "Security Proofs for IBI and Signature Schemes" showed that Schnorr signature in the form of $(r,s)$ (...
Tan's user avatar
  • 91
8 votes
Accepted

The definition and origin of Schnorr groups?

What (and where) is the actual definition of a Schnorr group? Where have Schnorr groups first been introduced and who called them Schnorr groups? I don't know who first used the term—the ...
Squeamish Ossifrage's user avatar
7 votes
Accepted

Schnorr Pubkey Recovery

Fix a group $E(k)$ on an elliptic curve over a field $k$. Suppose $P \in E(k)$ is a public key. If a signature on a message $m$ under $P$ is the encoding of a pair $(R, s)$ of a point $R \in E(k)$ ...
Squeamish Ossifrage's user avatar
7 votes
Accepted

Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?

This answer is assuming you are not removing the private key $a$ from the computation of $S$, and instead actually meant what is said in the title of the question: $S = r + a H(A, M)$ Removing $a$ ...
Lery's user avatar
  • 7,679
7 votes
Accepted

Is the security of a Schnorr signature dependent on the hash function that is used?

It does contribute to the security. In particular, the hash function $H$ must be “random prefix preimage resistant” in order to be safe from Key Only forgeries and “random prefix second preimage ...
Daniel S's user avatar
  • 23.8k
6 votes

Is Schnorr's digital signature a non-interactive zero-knowledge proof?

Yes, and in fact, Schnorr's signature scheme was originally described as a non-interactive protocol. I think the confusion around interactivity comes from the fact that the same paper first described ...
Daniel Lubarov's user avatar
6 votes

Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?

would using S = r + H(A, M) be a secure variant? Actually, it would become trivial to generate a signature for an abitrary message with just the public key. The verification check would be: $$2^h s G ...
poncho's user avatar
  • 147k
6 votes

Convert a Schnorr Public Key to a compressed ECDSA Public Key

A Schnorr Public Key $K$ per the linked BIP340 is 32 bytes representing, in big-endian order, the X coordinates of any point on the Elliptic Curve secp256k1 not the point at infinity. As noted there, ...
fgrieu's user avatar
  • 141k
5 votes
Accepted

Intuition for Schnorr Blind Signatures

Schnorr signature is a pair challenge-response $(e, s)$ with challenge computed as a hash of message $m$ and initial commitment $r$; signature is verified by re-creating that commitment with challenge ...
Vadym Fedyukovych's user avatar
5 votes
Accepted

Tricking the Schnorr's protocol

Well yes, $P$ can generate $A^cT$ and send it over, but why would it help? The point of this protocol is that $P$ proofs to $V$ that it knows $x$, without revealing anything about $x$. The way that $...
CurveEnthusiast's user avatar
5 votes
Accepted

How are all necessary parameters shared between signer and verifier in the ED25519 signature scheme?

Ed25519 is well-defined and requires you to use SHA-512 as internal hash function along with the twisted Edwards version of Curve25519, hence there's no need for a KAC when it comes to questions about ...
SEJPM's user avatar
  • 46k
5 votes

How to forge signatures in the Schnorr scheme if $r=g^k$ is eliminated?

I suppose that you address the question to a signature scheme, in which the signature is still the pair $(r,s)$ with $r=g^k \bmod p$ as the exponentiated nonce and $$s = H(m)\cdot x + k \mod q,$$ ...
U. Haboeck's user avatar
5 votes

EC Schnorr signature: multiple standard?

Probably the most widely deployed Schnorr-type signature scheme over elliptic curve groups today is EdDSA, in its instantiation Ed25519 over Curve25519 with SHA-512. A public key is the encoding of a ...
Squeamish Ossifrage's user avatar
5 votes

What is TPMFail attack and what are the countermeasures?

TPM-Fail is a new demonstration of the well-known lattice-based attack of Howgrave-Graham and Smart on DLOG-based signature schemes such as Elgamal, Schnorr, and DSA that exploits partial information ...
Squeamish Ossifrage's user avatar
5 votes
Accepted

Is there any proof for ECDSA signature algorithm?

As pointed out by @SEJPM, you can read more about security proofs for DSA/ECDSA family on this thread. As for whether there exists an interactive protocol corresponding to DSA/ECDSA à la Schnorr ...
ckamath's user avatar
  • 5,188
5 votes
Accepted

MuSig: could the rogue key attack be mitigated by using commitments instead of key transformations?

Yes, the rogue key attack can be prevented by committing to a public key before exchanging the keys. But this requires that you never use a public key with more than one group of signers. If you use ...
nickler's user avatar
  • 271
4 votes

Security of Schnorr signature versus DSA and DLP

Partial answer to my own question, after some weeks of research based on the question's expanded bibliography. History The Schnorr signature scheme was initially proposed with a $t$-bit hash ($3t$-...
fgrieu's user avatar
  • 141k
4 votes
Accepted

Is it possible I can open pedersen commitments without revealing r?

So is it possible to make Schnorr Protocol only can be verified by a selected verifier with know public key? Here's the obvious way using a two dimensional Schnorr proof; this is a proof that, given $...
poncho's user avatar
  • 147k
4 votes
Accepted

Variant of Schnorr Protocol (Difference pair of response and verification)

response $s=c(x+r)$, verify $g^s=(yt)^c$ This one doesn't work; a lying prover can chose $t = y^{-1}g^n$, for an arbitrary $n$. Then, when the challenger responds with a $c$, the lying prover can ...
poncho's user avatar
  • 147k
4 votes
Accepted

Why is r used in ECDSA signature while R in Schnorr signature?

In Schnorr signature $(R,s)$, $R$ is used. But in ECDSA signature $(r,s)$, $r$ is used, which is the x-coordinate of $R$. That assertion is technically incorrect: In Schnorr signature (alt.) as ...
fgrieu's user avatar
  • 141k
4 votes
Accepted

Why schnorr signatures uses H(R||m) instead of H(m)?

In your second scheme, the signature $(R,s)$ is verified as $R\overset{?}{=} sG-cX$. If $c$ does not involve $R$, then you could forge a signature by picking a random $s$ value and calculating $R=sG+...
knaccc's user avatar
  • 4,732

Only top scored, non community-wiki answers of a minimum length are eligible