25 votes
Accepted

How to confirm my implementation is constant time

How to confirm my implementation is constant time? I'm in scala using bouncy castle from Java. This code is not constant time, for no platform is specified. Computing platforms that run in constant ...
17 votes
Accepted

Security of Schnorr signature versus DSA and DLP

Your post was a bit confusing to me, I think you're thinking of this from the wrong perspective. Is there a scheme with security arguably equivalent to DSA (or better, the DLP or related), but with ...
user avatar
16 votes
Accepted

Schnorr signatures: multisignature support

Here is a simple-minded Ed25519-based multisignature or collective signature scheme, in which Alice and Bob each having their own private key, kept secret from one another, must work together to ...
user avatar
13 votes
Accepted

Why is $e=0$ allowed in Schnorr signatures?

Strangely, if $e=0$ then no knowledge of $x$ is proven, as all steps can be carried out by someone who knows only $M$. So, why is $e=0$ not disallowed? Because $e = 0$ is not unique in this regard. ...
user avatar
11 votes

EC Schnorr signature: multiple standard?

Adding to other answers, I note that both schemes are related to (but clearly different from) those standardized in ISO/IEC 14888-3:2016 (non-functional preview): The BSI's EC-Schnorr original ...
user avatar
  • 122k
9 votes
Accepted

Shor algorithm and schnorr signature in ed25519

Shor's algorithm can compute discrete logs in elliptic curves and thereby recover the secret scalar from a public Ed25519 key, which you can use to forge signatures of your choice. So, yes, it ...
user avatar
9 votes
Accepted

Compact Schnorr signature?

This would work, but note that your weakening verification (slightly). Instead of only $(C_1,k_2)$ being a valid signature, now also $(-C_1,k_2)$ is valid. If you want to do signatures by only using $...
user avatar
8 votes
Accepted

What is an example of a secure sigma proof?

Sigma protocols as-is are secure only for honest verifiers. However, they can be easily compiled into full-blown zero knowledge protocols. If you don't want interaction, then the Fiat-Shamir transform ...
user avatar
8 votes

EC Schnorr signature: multiple standard?

The $(r,s)$ version in theory is more secure than $(h,s)$. Bellare, Namprempre, Neven 2004 paper "Security Proofs for IBI and Signature Schemes" showed that Schnorr signature in the form of $(r,s)$ (...
user avatar
  • 91
8 votes
Accepted

The definition and origin of Schnorr groups?

What (and where) is the actual definition of a Schnorr group? Where have Schnorr groups first been introduced and who called them Schnorr groups? I don't know who first used the term—the ...
user avatar
8 votes
Accepted

What is TPMFail attack and what are the countermeasures?

In short, TPMFail attack is black-box timing analysis of TPM 2.0 devices deployed on computers. The TPMfail team is able to extract the private authentication key of TPMS's 256-bit private keys for ...
user avatar
  • 42.9k
7 votes
Accepted

Is this modified Schnorr signature scheme secure?

This scheme is insecure, as anyone with the public key can generate a forgery of an arbitrary message. To do this, the forger would take the message $M$, the public key $y$, pick an arbitrary $z$, ...
user avatar
  • 131k
6 votes
Accepted

Intuition for Schnorr Blind Signatures

Schnorr signature is a pair challenge-response $(e, s)$ with challenge computed as a hash of message $m$ and initial commitment $r$; signature is verified by re-creating that commitment with challenge ...
user avatar
6 votes

Prove the Security of Schnorr's Signature Scheme

Pointcheval and Stern [PS00] proved that the Schnorr signature is existentially unforgeable under chosen-message attacks (EU-CMA) in the random oracle model assuming that the discrete-logarithm ...
user avatar
  • 4,463
6 votes

Is Schnorr's digital signature a non-interactive zero-knowledge proof?

Yes, and in fact, Schnorr's signature scheme was originally described as a non-interactive protocol. I think the confusion around interactivity comes from the fact that the same paper first described ...
user avatar
6 votes
Accepted

Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?

This answer is assuming you are not removing the private key $a$ from the computation of $S$, and instead actually meant what is said in the title of the question: $S = r + a H(A, M)$ Removing $a$ ...
user avatar
  • 7,163
5 votes
Accepted

Tricking the Schnorr's protocol

Well yes, $P$ can generate $A^cT$ and send it over, but why would it help? The point of this protocol is that $P$ proofs to $V$ that it knows $x$, without revealing anything about $x$. The way that $...
user avatar
5 votes

How to forge signatures in the Schnorr scheme if $r=g^k$ is eliminated?

I suppose that you address the question to a signature scheme, in which the signature is still the pair $(r,s)$ with $r=g^k \bmod p$ as the exponentiated nonce and $$s = H(m)\cdot x + k \mod q,$$ ...
user avatar
5 votes
Accepted

How are all necessary parameters shared between signer and verifier in the ED25519 signature scheme?

Ed25519 is well-defined and requires you to use SHA-512 as internal hash function along with the twisted Edwards version of Curve25519, hence there's no need for a KAC when it comes to questions about ...
user avatar
  • 44.6k
5 votes

EC Schnorr signature: multiple standard?

Probably the most widely deployed Schnorr-type signature scheme over elliptic curve groups today is EdDSA, in its instantiation Ed25519 over Curve25519 with SHA-512. A public key is the encoding of a ...
user avatar
5 votes

What is an example of a secure sigma proof?

I guess you are talking about Figure 5.3? It is said that the Schnorr proof (sigma protocol for discrete log relation) is insecure against cheating verifiers - it is only honest-verifier zero ...
user avatar
  • 12.1k
5 votes
Accepted

Schnorr Pubkey Recovery

Fix a group $E(k)$ on an elliptic curve over a field $k$. Suppose $P \in E(k)$ is a public key. If a signature on a message $m$ under $P$ is the encoding of a pair $(R, s)$ of a point $R \in E(k)$ ...
user avatar
5 votes

What is TPMFail attack and what are the countermeasures?

TPM-Fail is a new demonstration of the well-known lattice-based attack of Howgrave-Graham and Smart on DLOG-based signature schemes such as Elgamal, Schnorr, and DSA that exploits partial information ...
user avatar
5 votes
Accepted

Is there any proof for ECDSA signature algorithm?

As pointed out by @SEJPM, you can read more about security proofs for DSA/ECDSA family on this thread. As for whether there exists an interactive protocol corresponding to DSA/ECDSA à la Schnorr ...
user avatar
  • 4,463
5 votes

Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?

would using S = r + H(A, M) be a secure variant? Actually, it would become trivial to generate a signature for an abitrary message with just the public key. The verification check would be: $$2^h s G ...
user avatar
  • 131k
5 votes
Accepted

Is the security of a Schnorr signature dependent on the hash function that is used?

It does contribute to the security. In particular, the hash function $H$ must be “random prefix preimage resistant” in order to be safe from Key Only forgeries and “random prefix second preimage ...
user avatar
  • 9,576
4 votes

Importance of random number generation in Schnorr's signature

Note that the signature is $(s,e)$ where $s=k-xe$. If you can learn $k$ since it is predictable, then you can learn the secret signing key by computing $x = (s-k)/e$. Note that even without a concrete ...
user avatar
4 votes

Security of Schnorr signature versus DSA and DLP

Partial answer to my own question, after some weeks of research based on the question's expanded bibliography. History The Schnorr signature scheme was initially proposed with a $t$-bit hash ($3t$-...
user avatar
  • 122k
4 votes
Accepted

Is it possible I can open pedersen commitments without revealing r?

So is it possible to make Schnorr Protocol only can be verified by a selected verifier with know public key? Here's the obvious way using a two dimensional Schnorr proof; this is a proof that, given $...
user avatar
  • 131k
4 votes
Accepted

Variant of Schnorr Protocol (Difference pair of response and verification)

response $s=c(x+r)$, verify $g^s=(yt)^c$ This one doesn't work; a lying prover can chose $t = y^{-1}g^n$, for an arbitrary $n$. Then, when the challenger responds with a $c$, the lying prover can ...
user avatar
  • 131k

Only top scored, non community-wiki answers of a minimum length are eligible