bip-schnorr: mention that (e,s) signatures can be 48 bytes

Question

bip-schnorr: mention that (e,s) signatures can be 48 bytes

sipa opened this issue 5 years ago · 2 comments

Also mention GGM+preimage resistance based proof.

Answer 1 · 2019-10-15T21:52:52.000Z

Couldn't find a mention of the size of (e,s), which I think is good because it depends on the size of the hash function (can realistically be from 48 bytes to 160 bytes)

Answer 2 · 2019-10-15T21:58:31.000Z

@elichai The point is that under ROM+DL, Schnorr signatures can be proven 128-bit secure with just a 128-bit hash function (however, that model also actually requires a 384-bit group for 128-bit security). See http://www.neven.org/papers/schnorr.html.