Subject: [TLS] Schnorr Signatures

From: Nigel Smart <[email-masked]>
Date: Wed, 25 Jun 2014 09:28:41 +0100

Hi

[First post to list so please ignore any breaking of etiquette etc]

As we are moving to TLS 1.3 I wondered why not include EC-Schnorr
signatures in the standard as a possible addition to EC-DSA for the signing.
Some notes...

i)   Schnorr is faster than EC-DSA
ii)  Patent has expired
iii) Shorter signatures
iv) Has a proper proof of security and not "tainted" by NSA design
            - Unlike EC-DSA in both instances.
  v) Protects against hash collisions. i.e. any hash function break 
involving
      collisions does not provide an attack on the signature scheme.
vi) Allows various other tricks to be done more easily
vii) Already standardized in ISO. The ISO standard just gives Schnorr as a
       tweak on the EC-DSA signature. So there is not much work to do.
viii) Can use the same EC-DSA certs as EC-DSA signing. All that changes
        is how the signing equation is generated and verified.

Cheers

Nigel

---

From: Watson Ladd <[email-masked]>
Date: Thu, 26 Jun 2014 07:48:13 -0700

Dear all,

Schnorr permits batching and is faster as there is no inverse. But to
take full advantage, you have to send R, the temporary point, not just
the x-coordinate. With point compression this is easy, without the
signature gets a little bigger.

In the case of TLS the benefit is limited: ECDSA is required for
certs, which are going to be around for a while. As a result there is
only one Schnorr signature, so batching doesn't help much.

I think it's still worth doing: that inversion is a real pain.

Sincerely,
Watson Ladd