Overview
Syllabus
Introduction
Outline
Forger adversary against Schnorr signatures
Extracting discrete logarithms from a forger
Multiple invocations of the forger forking
Success probability of the reduction: the Forking Lemma
The concept of meta-reduction
The One More Discrete Logarithm (OMDL) problem
Restriction to algebraic reductions
Meta-reduction main idea
Meta-reduction: the general strategy
Extraction of DLog(A) by the meta-reduction
A bad event which makes the meta-reduction fail
Simulation of the forger choice of the forgery index
Main theorem
A thought experiment
The new meta-reduction
Probability of event Bad
Expected-time and queries forgers
Extensions
Conclusion
Taught by
TheIACR