24
votes
Accepted
How to confirm my implementation is constant time
How to confirm my implementation is constant time? I'm in scala using bouncy castle from Java.
This code is not constant time, for no platform is specified. Computing platforms that run in constant ...
17
votes
Accepted
Security of Schnorr signature versus DSA and DLP
Your post was a bit confusing to me, I think you're thinking of this from the wrong perspective.
Is there a scheme with security arguably equivalent to DSA (or better, the DLP or related), but with ...
- 3,439
17
votes
Accepted
Schnorr signatures: multisignature support
[This was an irresponsible answer to write six years ago, even with a tongue-in-beak disclaimer to do your own security analysis and find the flaws in it. Please consult the (latest) literature, not ...
- 47.5k
13
votes
Accepted
Why is $e=0$ allowed in Schnorr signatures?
Strangely, if $e=0$ then no knowledge of $x$ is proven, as all steps can be carried out by someone who knows only $M$. So, why is $e=0$ not disallowed?
Because $e = 0$ is not unique in this regard. ...
- 515
12
votes
EC Schnorr signature: multiple standard?
Adding to other answers, I note that both schemes are related to (but clearly different from) those standardized in ISO/IEC 14888-3:2016 (non-functional preview):
The BSI's EC-Schnorr original ...
- 137k
10
votes
Accepted
Shor algorithm and schnorr signature in ed25519
Shor's algorithm can compute discrete logs in elliptic curves and thereby recover the secret scalar from a public Ed25519 key, which you can use to forge signatures of your choice.
So, yes, it ...
- 47.5k
9
votes
Accepted
Compact Schnorr signature?
This would work, but note that your weakening verification (slightly). Instead of only $(C_1,k_2)$ being a valid signature, now also $(-C_1,k_2)$ is valid. If you want to do signatures by only using $...
- 3,439
9
votes
Accepted
What is TPMFail attack and what are the countermeasures?
In short, TPMFail attack is black-box timing analysis of TPM 2.0 devices deployed on computers. The TPMfail team is able to extract the private authentication key of TPMS's 256-bit private keys for ...
- 46.4k
8
votes
Accepted
What is an example of a secure sigma proof?
Sigma protocols as-is are secure only for honest verifiers. However, they can be easily compiled into full-blown zero knowledge protocols. If you don't want interaction, then the Fiat-Shamir transform ...
- 27.5k
8
votes
EC Schnorr signature: multiple standard?
The $(r,s)$ version in theory is more secure than $(h,s)$. Bellare, Namprempre, Neven 2004 paper "Security Proofs for IBI and Signature Schemes" showed that Schnorr signature in the form of $(r,s)$ (...
- 91
8
votes
Prove the Security of Schnorr's Signature Scheme
Pointcheval and Stern [PS00] proved that the Schnorr signature is existentially unforgeable under chosen-message attacks (EU-CMA) in the random oracle model assuming that the discrete-logarithm ...
- 5,113
8
votes
Accepted
The definition and origin of Schnorr groups?
What (and where) is the actual definition of a Schnorr group?
Where have Schnorr groups first been introduced and who called them Schnorr groups?
I don't know who first used the term—the ...
- 47.5k
7
votes
Accepted
Schnorr Pubkey Recovery
Fix a group $E(k)$ on an elliptic curve over a field $k$. Suppose $P \in E(k)$ is a public key. If a signature on a message $m$ under $P$ is the encoding of a pair $(R, s)$ of a point $R \in E(k)$ ...
- 47.5k
7
votes
Accepted
Is the security of a Schnorr signature dependent on the hash function that is used?
It does contribute to the security. In particular, the hash function $H$ must be “random prefix preimage resistant” in order to be safe from Key Only forgeries and “random prefix second preimage ...
- 21.2k
6
votes
Is Schnorr's digital signature a non-interactive zero-knowledge proof?
Yes, and in fact, Schnorr's signature scheme was originally described as a non-interactive protocol. I think the confusion around interactivity comes from the fact that the same paper first described ...
- 387
6
votes
Accepted
Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?
This answer is assuming you are not removing the private key $a$ from the computation of $S$, and instead actually meant what is said in the title of the question:
$S = r + a H(A, M)$
Removing $a$ ...
- 7,579
6
votes
Convert a Schnorr Public Key to a compressed ECDSA Public Key
A Schnorr Public Key $K$ per the linked BIP340 is 32 bytes representing, in big-endian order, the X coordinates of any point on the Elliptic Curve secp256k1 not the point at infinity. As noted there,
...
- 137k
5
votes
EC Schnorr signature: multiple standard?
Probably the most widely deployed Schnorr-type signature scheme over elliptic curve groups today is EdDSA, in its instantiation Ed25519 over Curve25519 with SHA-512. A public key is the encoding of a ...
- 47.5k
5
votes
Accepted
Intuition for Schnorr Blind Signatures
Schnorr signature is a pair challenge-response $(e, s)$ with challenge computed as a hash of message $m$ and initial commitment $r$; signature is verified by re-creating that commitment with challenge ...
- 2,287
5
votes
Accepted
Tricking the Schnorr's protocol
Well yes, $P$ can generate $A^cT$ and send it over, but why would it help?
The point of this protocol is that $P$ proofs to $V$ that it knows $x$, without revealing anything about $x$. The way that $...
- 3,439
5
votes
How to forge signatures in the Schnorr scheme if $r=g^k$ is eliminated?
I suppose that you address the question to a signature scheme, in which the signature is still the pair $(r,s)$ with $r=g^k \bmod p$ as the exponentiated nonce and
$$s = H(m)\cdot x + k \mod q,$$
...
- 51
5
votes
Accepted
How are all necessary parameters shared between signer and verifier in the ED25519 signature scheme?
Ed25519 is well-defined and requires you to use SHA-512 as internal hash function along with the twisted Edwards version of Curve25519, hence there's no need for a KAC when it comes to questions about ...
- 45.6k
5
votes
What is an example of a secure sigma proof?
I guess you are talking about Figure 5.3?
It is said that the Schnorr proof (sigma protocol for discrete log relation) is insecure against cheating verifiers - it is only honest-verifier zero ...
- 12.4k
5
votes
What is TPMFail attack and what are the countermeasures?
TPM-Fail is a new demonstration of the well-known lattice-based attack of Howgrave-Graham and Smart on DLOG-based signature schemes such as Elgamal, Schnorr, and DSA that exploits partial information ...
- 47.5k
5
votes
Accepted
Is there any proof for ECDSA signature algorithm?
As pointed out by @SEJPM, you can read more about security proofs for DSA/ECDSA family on this thread.
As for whether there exists an interactive protocol corresponding to DSA/ECDSA à la Schnorr ...
- 5,113
5
votes
Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?
would using S = r + H(A, M) be a secure variant?
Actually, it would become trivial to generate a signature for an abitrary message with just the public key.
The verification check would be:
$$2^h s G ...
- 143k
5
votes
Accepted
MuSig: could the rogue key attack be mitigated by using commitments instead of key transformations?
Yes, the rogue key attack can be prevented by committing to a public key before exchanging the keys. But this requires that you never use a public key with more than one group of signers. If you use ...
- 271
4
votes
Importance of random number generation in Schnorr's signature
Note that the signature is $(s,e)$ where $s=k-xe$. If you can learn $k$ since it is predictable, then you can learn the secret signing key by computing $x = (s-k)/e$. Note that even without a concrete ...
- 27.5k
4
votes
Security of Schnorr signature versus DSA and DLP
Partial answer to my own question, after some weeks of research based on the question's expanded bibliography.
History
The Schnorr signature scheme was initially proposed with a $t$-bit hash ($3t$-...
- 137k
4
votes
Accepted
Is it possible I can open pedersen commitments without revealing r?
So is it possible to make Schnorr Protocol only can be verified by a selected verifier with know public key?
Here's the obvious way using a two dimensional Schnorr proof; this is a proof that, given $...
- 143k
Only top scored, non community-wiki answers of a minimum length are eligible