|
|
|
|
|
|
by gwillen
1083 days ago
|
|
|
As I understand it, Schnorr signatures are the "natural" (and simplest) construction for a digital signature in elliptic curve cryptography. The reason ECDSA exists is simply https://patents.google.com/patent/US4995082 (now expired), which made Schnorr illegal to use, so something worse had to be invented. |
|
|
Sort of.
Schnorr signatures have a "linearity" property -- if you add together two signatures you get a valid signature of the same text using the sum of the keys.
Sometimes you don't want people to be able to obtain signatures-with-the-sum-of-the-keys, or you don't want to enable bulk key-cracking via the same techniques that allow bulk validation.
Also, confusingly, "EdDSA" signatures (aka ed25519 signatures) are Schnorr signatures:
https://datatracker.ietf.org/doc/html/rfc8032#section-1
... however EdDSA:
1. Uses hashing instead of either multiplicative inverse (slow) or a source of randomness (footgun) for the nonce.
2. Hashes the public key into the signature in order to deliberately break linearity. Signatures with different keys will use different hashes, and hashing isn't linear, so adding the signatures no longer yields anything useful. The signature verifier checks this (they can, since they have your public key), so a defective implementation can't skip this step without producing bogus signatures.