Subject: Re: [TLS] [Cfrg] FW: Schnorr Signatures

From: Nigel Smart <[email-masked]>
Date: Thu, 26 Jun 2014 21:56:18 +0100

>
>
> Schnorr permits batching and is faster as there is no inverse. But to
> take full advantage, you have to send R, the temporary point, not just
> the x-coordinate. With point compression this is easy, without the
> signature gets a little bigger.

With Schnorr you dont send the x-coord of R. What you send is
half the hash value e
	e=Hash(R||Message)
So if using SHA-256 you send 128 bits of e over.

Batching is not so important for TLS. With Schnorr however
you can do distributed signing much easier, which means you can
protect your signing key much easier

Nigel
-- 
Prof. Nigel P. Smart         | Tel +44 (0)117 9545163
Computer Science Department, | Fax +44 (0)117 9545208
Woodland Road,               | Email [email-masked]
Bristol, BS8 1UB, UK         | http://www.cs.bris.ac.uk~nigel