Re: [Cfrg] Curve selection revisited

[Mike Hamburg <[e-mail]>]

On 7/28/2014 5:33 PM, Paul Lambert wrote:
> Thank you for the details below.  One question on a comment you made:
>> Depending on the exact form of Schnorr, .
> So, what form of Schnorr signatures would you recommend?
>
> Paul
Let x be the secret key, g^k the nonce, e = H(stuff) the challenge and s 
= k - xe the response.

If you want short signatures it has to be (e,s).  Otherwise, (g^k,s) is 
slightly faster and batchable.    The hash should be H(pubkey||g^k||m) 
to prevent collision attacks, because you can and there's little downside.

I don't think there's a good case for setting s = ke - x.  It may resist 
some power attacks more easily, but it increases the attack surface and 
prevents optimizations.

-- Mike