Hash Function Requirements for Schnorr Signatures

Gregory Neven, Nigel Smart, Bogdan Warinschi

Research output: Contribution to journalArticle (Academic Journal)peer-review

38 Citations (Scopus)


We provide two necessary conditions on hash functions for the Schnorr signature scheme to be secure, assuming compact group representations such as those which occur in elliptic curve groups. We also show, via an argument in the generic group model, that these conditions are sufficient. Our hash function security requirements are variants of the standard notions of preimage and second preimage resistance. One of them is in fact equivalent to the Nostradamus attack by Kelsey and Kohno (Eurocrypt~2006), and, when considering keyed compression functions, both are closely related to the ePre and eSec notions by Rogaway and Shrimpton (FSE~2004). Our results have a number of interesting implications in practice. First, since security does not rely on the hash function being collision resistant, Schnorr signatures can still be securely instantiated with SHA-1/SHA-256, unlike DSA signatures. Second, we conjecture that our properties require $O(2^n)$ work to solve for a hash function with $n$-bit output, thereby allowing the use of shorter hashes and saving twenty-five percent in signature size. And third, our analysis does not reveal any significant difference in hardness between forging signatures and computing discrete logarithms, which plays down the importance of the loose reductions in existing random-oracle proofs, and seems to support the use of ``normal-size'' groups.
Translated title of the contributionHash function requirements for Schnorr signatures
Original languageEnglish
Pages (from-to)69-87
JournalJournal of Mathematical Cryptology
Publication statusPublished - 2009

Bibliographical note

Other identifier: 2001023


Dive into the research topics of 'Hash Function Requirements for Schnorr Signatures'. Together they form a unique fingerprint.

Cite this