Abstract:The Schnorr identification and signature schemes have been among the most influential cryptographic protocols of the past 3 decades. Unfortunately, although the best-known attacks on these two schemes are via discrete logarithm computation, the known approaches for basing their security on the hardness of the discrete logarithm problem encounter the "square-root barrier." In particular, in any group of order p where Shoup's generic hardness result for the discrete logarithm problem is believed to hold (and is thus used for setting concrete security parameters), the best-known t -time attacks on the Schnorr identification and signature schemes have success probability , whereas existing proofs of security only rule out attacks with success probabilities and , respectively, where denotes the number of random oracle queries issued by the attacker. We establish tighter security guarantees for identification and signature schemes which result from -protocols with special soundness based on the hardness of their underlying relation, and in particular for Schnorr's schemes based on the hardness of the discrete logarithm problem. We circumvent the square-root barrier by introducing a high-moment generalization of the classic forking lemma, relying on the assumption that the underlying relation is " d -moment hard": The success probability of any algorithm in the task of producing a witness for a random instance is dominated by the d th moment of the algorithm's running time. In the concrete context of the discrete logarithm problem, already Shoup's original proof shows that the discrete logarithm problem is 2-moment hard in the generic group model, and thus, our assumption can be viewed as a highly plausible strengthening of the discrete logarithm assumption in any group where no better-than-generic algorithms are currently known. Applying our high-moment forking lemma in this context shows that, assuming the 2-moment hardness of the discrete logarithm problem, any t -time attacker breaks the security of the Schnorr identification and signature schemes with probabilities at most and , respectively.

Iterated LD-Problem in non-associative key establishment

Non-associative key establishment protocols and their implementation

Generic and Practical Key Establishment from Lattice.

LWE from non-commutative group rings

Extended Nested Dual System Groups, Revisited.

Cryptanalysis of some Nonabelian Group-Based Key Exchange Protocols

Authenticated Key Exchange from Ideal Lattices

Hard Instances of the Constrained Discrete Logarithm Problem

A Simple Provably Secure Key Exchange Scheme Based on the Learning with Errors Problem.

FREE AUGMENTED LD-SYSTEMS

Optimal Key Consensus in Presence of Noise.

Multiparty Non-Interactive Key Exchange and More From Isogenies on Elliptic Curves

Compact Lossy and All-but-One Trapdoor Functions from Lattice

Deterministic Identity-Based Encryption from Lattices with More Compact Public Parameters.

Tighter Security for Schnorr Identification and Signatures: A High-Moment Forking Lemma for -Protocols

Provably Secure Three-Party Password-Based Authenticated Key Exchange From Rlwe

A Key Exchange Based on the Short Integer Solution Problem and the Learning with Errors Problem

1-Round Distributed Key Generation with Efficient Reconstruction Using Decentralized CP-ABE

Hard isogeny problems over RSA moduli and groups with infeasible inversion

A Synthetic Indifferentiability Analysis ofźInterleaved Double-Key Even-Mansour Ciphers

Cryptanalysis of RLWE-Based One-Pass Authenticated Key Exchange