Schnorr signature: Revision history

5 June 2024

• curprev 11:3311:33, 5 June 2024‎ 195.29.236.214 talk‎ 8,713 bytes 0‎ it's 2024, we are no longer doing 80-bit security undo Tag: Visual edit: Switched

24 May 2024

• curprev 15:3415:34, 24 May 2024‎ Taylor Riastradh Campbell talk contribs‎ 8,713 bytes +24‎ →‎Algorithm: Use unambiguous notation Z/qZ instead of Z_q, which sometimes means the q-adic numbers rather than the congruence classes of integers modulo q. undo
• curprev 15:3115:31, 24 May 2024‎ Taylor Riastradh Campbell talk contribs‎ 8,689 bytes −244‎ →‎Notation: x and k are arbitrary in Z/qZ, not restricted to be in the multiplicative subgroup. (In Schnorr's paper, the private key "is a random number in {1, 2, ..., q}"; similarly the per-signature secret is chosen from "{1, ..., q}".) undo
• curprev 15:1015:10, 24 May 2024‎ Taylor Riastradh Campbell talk contribs‎ 8,933 bytes +4‎ Correct sign error. This makes no difference in security or implementation cost (negation preserves the uniform distribution on the private key space), but it matches Schnorr's original paper better. undo
• curprev 14:5114:51, 24 May 2024‎ Taylor Riastradh Campbell talk contribs‎ 8,929 bytes 0‎ Undid revision 1225262180 by Zacinthus (talk) Thanks, but what you changed the text to is not the algorithm Schnorr published, in <https://doi.org/10.1007%2F0-387-34805-0_22>, p. 4 (with variables renamed and, regrettably, private key sign flipped). Note that you can recover r = g^k from (e, s) and the public key y = g^x by computing g^s y^e = g^{k - x e} (g^x)^e = g^{(k - x e) + x e} = g^k. undo Tag: Undo

23 May 2024

• curprev 10:4110:41, 23 May 2024‎ Zacinthus talk contribs‎ m 8,929 bytes 0‎ The Schorr signature has to reveal what $r$ is. $e$ can be calculated by the recipient. But $r$ cannot be, and hence has to be a part of the signature. Tag: Reverted