3 ms·
The version of non-interactive Schnorr presented here is called "weak Fiat-Shamir" and it has led to things getting broken. While there are edge cases when it's
by red_admiral 9y ago
The version of non-interactive Schnorr presented here is called "weak Fiat-Shamir" and it has led to things getting broken. While there are edge cases when it's ok to use, I would strongly discourage it.
In step 2, e = H(Q || M) should be e = H(Q || M || P). That binds the signature to the public key, if you don't have that then the scheme is not sound in the usual models (UF-CMA +ROM etc.).
EDIT: see "How not to prove yourself", Asiacrypt 2012, eprint 2016/771.
- doomrobo 9y agoReading through the linked paper, it seems that as long as P is fixed before the proof is attempted, wFS is secure. I probably could have made it more explicit, but that is indeed my assumption in the setup of the blog post.