[Sch91] Efficient signature generation by smart cards

Authors: Claus-Peter Schnorr | Venue: Journal of Cryptology | Source

Introduced the Schnorr identification protocol and signature scheme. The identification protocol is a three-message sigma protocol (commit–challenge–response) for proving knowledge of a discrete logarithm. It is special sound and perfect honest-verifier zero-knowledge with no assumption: the simulator samples $c,s$ and sets $R=g^s{\mathsf{pk}}^{-c}$. Applying the Fiat–Shamir transform — FS86 — yields Schnorr signatures, proved EUF-CMA secure under the discrete logarithm assumption in the random oracle model — PS96. EdDSA (Ed25519) is a Schnorr variant over a twisted Edwards curve with deterministic nonces — BDLSY11.

BibTeX

Copy

@Article{JC:Schnorr91,
  author = {Claus-Peter Schnorr},
  title = {Efficient Signature Generation by Smart Cards},
  pages = {161--174},
  journal = {Journal of Cryptology},
  volume = {4},
  number = {3},
  month = {jan},
  publisher = {Springer},
  year = {1991},
  doi = {10.1007/BF00196725},
}