Schnorr Signature. - IST Austria: Homeckamath/Resources/Documents/...Schnorr Signature....

Schnorr Signature.

October 31, 2012

Schnorr Signature.

Table of contents

Salient Features

PreliminariesSecurity ProofsRandom Oracle HeuristicPKS and its Security ModelsHardness Assumption

Schnorr SignatureThe ConstructionOracle Replay AttackSecurity ProofForking Lemma

Schnorr Signature.

Salient Features

Schnorr Signature - Salient Features

I Derived from Schnorr identification scheme throughFiat-Shamir transformation

I Based on the DLP

I Security argued using oracle replay attacks

I Uses the random oracle heuristic

Schnorr Signature.

Preliminaries

PRELIMINARIES

Schnorr Signature.

Preliminaries

Security Proofs

Proof through Contradiction

I Consider a protocol P based on a hard problem Π

I Aim: Π is hard =⇒ P is not breakable ≡P is breakable =⇒ Π is not hard

I Since Π is assumed to be hard, this leads to a contradiction.

Schnorr Signature.

Preliminaries

Security Proofs

I Aim: Π is hard =⇒ P is not breakable

≡P is breakable =⇒ Π is not hard

Schnorr Signature.

Preliminaries

Security Proofs

Schnorr Signature.

Preliminaries

Security Proofs

Schnorr Signature.

Preliminaries

Security Proofs

Security Model

I Lays down the schema to be followed for giving security proofs

I Described using a game between a challenger C and anadversary A

I C simulates the protocol environment for AI A wins the game if it solves the challenge given by C

Schnorr Signature.

Preliminaries

Random Oracle Heuristic

Random Oracles

I Heuristic aimed at simplifying security proofs of protocolsinvolving hash functions.

I In proofs, the hash function modelled as a truly randomfunction under the control of the challenger.

I A given oracle access to this function.

I Proofs without random oracles preferred.

Schnorr Signature.

Preliminaries

Random Oracles

Schnorr Signature.

Preliminaries

Random Oracles

Schnorr Signature.

Preliminaries

Random Oracles

Schnorr Signature.

Preliminaries

PKS and its Security Models

PUBLIC-KEY SIGNATURES AND ITS SECURITY MODELS

Schnorr Signature.

Preliminaries

Definition – Public-Key SignatureAn PKS scheme consists of three PPT algorithms {K,S ,V} -

I Key Generation:I Used by the user to generate the public-private key pair (pk, sk)I pk is published and the sk kept secretI Run on a security parameter κ

(pk, sk)$←− K(κ)

I Signing:I Used by the user to generate signature on some message mI The secret key sk used for signing

σ$←− S (sk,m)

I Verification:I Outputs 1 if σ is a valid signature on m; else, outputs 0

result← V (σ,m, pk)

Schnorr Signature.

Preliminaries

(pk, sk)$←− K(κ)

σ$←− S (sk,m)

Schnorr Signature.

Preliminaries

(pk, sk)$←− K(κ)

σ$←− S (sk,m)

Schnorr Signature.

Preliminaries

(pk, sk)$←− K(κ)

σ$←− S (sk,m)

Schnorr Signature.

Preliminaries

Definition – EU-NMA

I Existential unforgeability under no-message attack

I Challenger C generates key-pair (pk, sk).

I Forgery – Adversary A wins if σ is a valid signature on m.

I Adversary’s advantage in the game:

Pr[1← V (σ, m, pk) | (sk, pk)

$←− K(κ); (σ, m)$←− A(pk)

Schnorr Signature.

Preliminaries

C EU-NMA A

Pr[1← V (σ, m, pk) | (sk, pk)

$←− K(κ); (σ, m)$←− A(pk)

Schnorr Signature.

Preliminaries

C EU-NMA Apk

Pr[1← V (σ, m, pk) | (sk, pk)

$←− K(κ); (σ, m)$←− A(pk)

Schnorr Signature.

Preliminaries

C EU-NMA Apk

(σ, m)

Pr[1← V (σ, m, pk) | (sk, pk)

$←− K(κ); (σ, m)$←− A(pk)

Schnorr Signature.

Preliminaries

C EU-NMA Apk

(σ, m)

Pr[1← V (σ, m, pk) | (sk, pk)

$←− K(κ); (σ, m)$←− A(pk)

Schnorr Signature.

Preliminaries

Definition – EU-CMA

I Existential unforgeability under chosen-message attack

I Signature Queries – Access to a signing oracle OI Forgery – Adversary A wins if

I σ is a valid signature on m.I A has not made a signature query on m.

EU-CMA Apk

(σ, m)

Pr[1← V (σ, m, pk) | (sk, pk)

$←− K(κ); (σ, m)$←− AO(pk)

Schnorr Signature.

Preliminaries

Hardness Assumption

Hardness Assumption: Discrete-log AssumptionDiscrete-log problem for a group G = 〈g〉 and | G |= p

(G, g, p, gα)

DefinitionThe DLP in G is to find α given gα, where α ∈R Zp. An adversaryA has advantage ε in solving the DLP if

Pr[α ∈R Zp;α′ ← A(G, p, g , gα) | α′ = α

]≥ ε.

The (ε, t)-discrete-log assumption holds in G if no adversary hasadvantage at least ε in solving the DLP in time at most t.

Schnorr Signature.

Preliminaries

Hardness Assumption

Hardness Assumption: Discrete-log AssumptionDiscrete-log problem for a group G = 〈g〉 and | G |= p

(G, g, p, gα)

DefinitionThe DLP in G is to find α given gα, where α ∈R Zp. An adversaryA has advantage ε in solving the DLP if

Pr[α ∈R Zp;α′ ← A(G, p, g , gα) | α′ = α

]≥ ε.

The (ε, t)-discrete-log assumption holds in G if no adversary hasadvantage at least ε in solving the DLP in time at most t.

Schnorr Signature.

Schnorr Signature

SCHNORR SIGNATURE

Schnorr Signature.

Schnorr Signature

The Construction

Schnorr Signature

The Setting.

1. We work in group G = 〈g〉 of prime order p.2. A hash function H is used.

H : {0, 1}∗ → Zp

Key Generation. K(κ):

1. Select z ∈R Zp as the secret key sk2. Set Z := g z as the public key pk

Signing. S (m, sk):

1. Let sk = z . Select r ∈R Zp, set R := g r and c := H(m,R).2. The signature on m is σ := (y ,R) where

y := r + zc

Schnorr Signature.

Schnorr Signature

The Construction

Schnorr Signature

The Setting.

H : {0, 1}∗ → Zp

Signing. S (m, sk):

y := r + zc

Schnorr Signature.

Schnorr Signature

The Construction

Schnorr Signature

The Setting.

H : {0, 1}∗ → Zp

Signing. S (m, sk):

y := r + zc

Schnorr Signature.

Schnorr Signature

The Construction

Schnorr Signature

Verification. V (σ,m):

1. Let σ = (y ,R) and c = H(m,R).2. σ is valid if

g y = RZ c

Schnorr Signature.

Schnorr Signature

The Construction

Security of Schnorr Signature: An Intuition

I Consider an adversary A with ability to launchchosen-message attack on the Schnorr signature.

I Let {σ1, . . . , σn} with σi = (ri + zci ,Ri ) on mi be thesignatures that A receives.

1 0 · · · 0 c00 1 · · · 0 c1...

.... . .

......

0 0 · · · 1 cn

r1r2...

y1y2...

Schnorr Signature.

Schnorr Signature

The Construction

I Consider an adversary A with ability to launchchosen-message attack on the Schnorr signature.

I Let {σ1, . . . , σn} with σi = (ri + zci ,Ri ) on mi be thesignatures that A receives.

1 0 · · · 0 c00 1 · · · 0 c1...

.... . .

......

0 0 · · · 1 cn

r1r2...

y1y2...

Schnorr Signature.

Schnorr Signature

The Construction

I However, A can solve for x if it gets two equations containingthe same r but different c , i.e.

y1 = r + zc1 and y2 = r + zc2

implies

z =y1 − y2c1 − c2

Schnorr Signature.

Schnorr Signature

Oracle Replay Attack

ORACLE REPLAY ATTACK

Schnorr Signature.

Schnorr Signature

The Oracle Replay AttackI Recall the random oracle methodology.

QI+1 Qγ Run 0

Q1 Q2 QIs1

Schnorr Signature.

Schnorr Signature

QI+1 Qγ Run 0

Q1 Q2 QIs1

Schnorr Signature.

Schnorr Signature

QI+1 Qγ Run 0

Q1 Q2 QI

I+1 Q′

γ Run 1

I The simulation carried out during Run 1 (from query Qi ) usinga different random function

Schnorr Signature.

Schnorr Signature

Security of Schnorr Signature in EU-NMA

I Consider the simpler model of existential unforgeability underno-message attack (EU-NMA)

I C gives the challenge public key pk := (G, g , p, gα) to AI A not allowed signature queries; forges on a message mI A also allowed access to an H-oracle {Q1, . . . , Qγ}

CDLP SS

∆ = (G, g , p, gα)

pk := ∆

EU-NMA

σ = (y , R)

Schnorr Signature.

Schnorr Signature

Security Proof

CDLP SS

∆ = (G, g , p, gα)

pk := ∆

EU-NMA

σ = (y , R)

I Q0I : H(m0, R0) = c0

Q0I+1 Q0γ σ0 = (y0 = r0 + αc0, R0)

Q01 Q02 Q0I

Schnorr Signature.

Schnorr Signature

Security Proof

CDLP SS

∆ = (G, g , p, gα)

pk := ∆

EU-NMA

σ = (y , R)

I Q0I : H(m0, R0) = c0 and QφJ : H(m1, R1) = c1

Q0I+1 Q0γ σ0 = (y0 = r0 + αc0, R0)

Q01 Q02 Q0I

Q1I+1 Q1γ σ1 = (y1 = r1 + αc1, R1)

Schnorr Signature.

Schnorr Signature

Security Proof

CDLP SS

∆ = (G, g , p, gα)

pk := ∆

EU-NMA

σ = (y , R)

I J = I =⇒ m1 = m0 ∧ R1 = R0

Q0I+1 Q0γ σ0 = (y0 = r0 + αc0,R0)

Q01 Q02 Q0I

Q1I+1 Q1γ σ1 = (y1 = r0 + αc1,R0)

Schnorr Signature.

Schnorr Signature

Security Proof

CDLP SS

∆ = (G, g , p, gα)

pk := ∆

EU-NMA

σ = (y , R)

I J = I =⇒ m1 = m0 ∧ R1 = R0 and α = (y0 − y1)/(c0 − c1)

Q0I+1 Q0γ σ0 = (y0 = r0 + αc0,R0)

Q01 Q02 Q0I

Q1I+1 Q1γ σ1 = (y1 = r0 + αc1,R0)

Schnorr Signature.

Schnorr Signature

Security Proof

Security in the Full Model

CDLP SS

∆ = (G, g , p, gα)

pk := ∆

EU-CMA

σ = (y , R)

Signature query. O(m)

I Signature for m is of form σ = (r + αc , g r ), wherec = H(m, g r ).

I But, we don’t know α!I Problem solved using Boneh-Boyen algebraic technique:

I Select c , s ∈R Zp and set r = −αc + s.I Program the random oracle to set c = H(m, g r ) and send

(s, g r ) as the signature.

Schnorr Signature.

Schnorr Signature

Security Proof

CDLP SS

∆ = (G, g , p, gα)

pk := ∆

EU-CMA

σ = (y , R)

Schnorr Signature.

Schnorr Signature

Security Proof

CDLP SS

∆ = (G, g , p, gα)

pk := ∆

EU-CMA

σ = (y , R)

I But, we don’t know α!

I Problem solved using Boneh-Boyen algebraic technique:I Select c , s ∈R Zp and set r = −αc + s.I Program the random oracle to set c = H(m, g r ) and send

Schnorr Signature.

Schnorr Signature

Security Proof

CDLP SS

∆ = (G, g , p, gα)

pk := ∆

EU-CMA

σ = (y , R)

Schnorr Signature.

Schnorr Signature

Security Proof

FORKING LEMMA

Schnorr Signature.

Schnorr Signature

Forking Lemma

Forking Algorithm

I The oracle replay attack formalised through the forkingalgorithm

Algorithm 1 FY (x)

Pick coins ρ for Y at random

s01 , . . . , s0γ ∈R S; (I0, σ0)

$←− Y (x , s01 , . . . , s0γ ; ρ) [Run 0]

s1I0 , . . . , s1γ ∈R S; (I1, σ1)

$←− Y (x , s01 , . . . , s0I0−1, s

1I0, . . . , s1γ ; ρ) [Run 1]

if (I0 > 0 ∧ I1 = I0 ∧ s1I0 6= s0I0) thenreturn (1, σ0, σ1)

elsereturn (0,⊥,⊥)

end if

Schnorr Signature.

Schnorr Signature

Forking Lemma

The Forking LemmaI The forking lemma gives a lower bound on the success

probability of the oracle replay attack (frk) in terms of thesuccess probability of the adversary during a particular run(acc).

I To be precise,

frk ≥ acc

γ− 1

QI+1 Qγ Run 0

Q1 Q2 QI

I+1 Q′

γ Run 1

Schnorr Signature.

Schnorr Signature

Forking Lemma

I To be precise,

frk ≥ acc

γ− 1

QI+1 Qγ Run 0

Q1 Q2 QI

I+1 Q′

γ Run 1

Schnorr Signature.

Schnorr Signature

Forking Lemma

I To be precise,

frk ≥ acc

γ− 1

QI+1 Qγ Run 0

Q1 Q2 QI

I+1 Q′

γ Run 1

Schnorr Signature.

Schnorr Signature

Forking Lemma

Theorem

TheoremIf A is an adversary with advantage ε against the Schnorrsignature scheme, in the setting (G, g , p), then we can constructan algorithm B that solves the DLP with advantage

ε′ ≥ ε(ε

γ− 1

)provided H is modelled as a random oracle with an upper bound ofqH queries.

Schnorr Signature.

Schnorr Signature

Forking Lemma

Related Literature

1. Mihir Bellare and Gregory Neven. Multi-signatures in theplain public-key model and a general forking lemma.

2. David Pointcheval and Jacques Stern. Security arguments fordigital signatures and blind signatures.

3. Sanjam Garg, Raghav Bhaskar, and Satyanarayana V. Lokam.Improved bounds on security reductions for discrete log basedsignatures.

4. Yannick Seurin. On the exact security of Schnorr-typesignatures in the random oracle model.

Schnorr Signature.

Schnorr Signature

Forking Lemma

QUESTIONS?

Schnorr Signature.

Schnorr Signature

Forking Lemma

THANK YOU!

Schnorr Signature. - IST Austria: Homeckamath/Resources/Documents/...Schnorr Signature....

Documents

Transcript of Schnorr Signature. - IST Austria: Homeckamath/Resources/Documents/...Schnorr Signature....

Venturi Complexity and Contradiction

Convergence Contradiction

Hadith Contradiction

Contradiction 02

Meaning in Contradiction

complexity and contradiction. Architecture

On the Portability of Generalized Schnorr Proofs

Schnorr Produktprospekt Engl

Bible Contradiction

EN Bolt locking systems Disc springs - Bondy · Load washers according to DIN 6796 Original SCHNORR® HS-Washers SChnorr engineering Material types surface protection

Distance Hijacking Attacks on Distance Bounding Protocols · Protocol DH-attack? Brands and Chaum (Fiat-Shamir) Yes Brands and Chaum (Schnorr) Yes Brands and Chaum (signature) Yes

Reducibilities relating to Schnorr randomnesskenshi.miyabe.name/wordpress/wp-content/uploads/2014/03/ccr201… · Reducibilities relating to Schnorr randomness 3 Hence, the natural

Elgamal & schnorr digital signature scheme copy

Secure JTAG implementation using Schnorr Protocol

Contradiction Watch

MuSig-DN: Schnorr Multi-Signatures with Verifiably ... · Keywords: digital signatures, multi-signatures, Schnorr signatures, MuSig, non-interactive zero-knowledgeproofs,deterministicnonces.

SCHNORR Product range - · PDF fileSCHNORR® Product range. Adolf Schnorr, who founded our business in 1908, showed true pioneering spirit and his inventiveness laid the foundation

Conflict Without Contradiction

Schnorr trivial sets and truth-table reducibility · Schnorr trivial sets and truth-table reducibility Johanna N.Y. Franklin and Frank Stephany Abstract We give several characterizations

SCHNORR Product range - Europages