Schnorr protocol

Schnorr Identification Protocol

Schnorr identification protocol

Schnorr Identification Scheme - GeeksforGeeks

Ring Signatures (Part 1): Schnorr Identity Protocol

Schnorr’s identification protocol

Identification protocol is different than signature scheme as identification protocol is used to identify that prover holds the private while signature scheme is used to verify that the holder indeed used the private key to sign the message and generate the signature.

Steps followed in schnorr identification protocol:

Let there be two parties $Alex(Prover)$ and $Alice(Verifier)$,

1. Alex has private key $x$, public key = $Gx(modN)$
2. Generates random value, $Y=Gy(modN)$
3. $Y$ is sent to Alice
4. Alice generates random challenge $c$, and send to Alex
5. Alex sends back: $z=y+xc$
6. Alice verifies: $z.G=y.G+c.x.G=Y+c.PK$

Not feasible, requires interaction from verifier. Also not publicly verifiable as both parties have to be involved.

Non-Interactive protocols like Fiat-Shamir which transforms any interactive to non-interactive.

Schnorr Digital Signature

• Introduction to Schnorr Signatures
• Schnorr Digital Signature - GeeksforGeeks
• How Schnorr signatures may improve Bitcoin

Used to implement “Proof of Knowledge”. Used in cryptography to prove to verifier that prover knows something $x$. Verifier gets convinced that they are communicating with the prover without verifier’s knowledge of private key and prover is in fact, right about his private key.

Features:

1. faster than ECDSA as doesn’t have to calculate $1/s$
2. linear

But this also proposes other disadvantages that this signature scheme can’t be used for aggregation and multi-sigs due to its linearity.

Non-interactive Schnorr identification protocol also exists using Fiat-Shamir transformation where challenge $c$ is not generated by verifier but $c=Hash(g,q,h,u)$ where g: generator, q: prime number, h: public key, u: public key of random nonce