How does the Related Key Attack on Schnorr Signatures work in real life?
We know that Schnorr signature is applied this way:
Key Generation
- Define curve ( E ), field ( F_q ), order ( N ), generator ( G ), and hash ( h ).
- Private key: ( d in (0, N) ), Public key: ( P = dG ).
Signing
- Random ( k in (1, N) ), compute ( R = kG ).
- ( c = h(R || M) ), ( s = (k + d * c) % N ).
- Signature: ( (R, s) ).
Verification
- Compute ( c = h(R || M) ) and check ( sG = R + cP ).
- Valid if true.
Related-key attack:
A Related Key Attack targets the Schnorr signature scheme by exploiting additive modifications to public keys.
If an attacker has a valid signature ( (R, s) ) for a public key ( P ), they can generate another valid signature ( (R, s + ac) ) for a related public key ( P + aG ), where ( a ) is a scalar. Thus, public keys generated via additive changes are vulnerable, as the attacker can forge valid signatures.
My doubt
What I don't understand is how this attack works in a real scenario. What should an attacker actually do?
The attacker must hope to find a victim with the exact public key ( P + aG ). The attacker cannot arbitrarily choose this public key. While the attacker can modify the scalar ( a ), it is dependent on the original public key ( P ), so the victim public key cannot be selected freely.
So, how does this attack manifest in the real world? Am I missing something here?
from Recent Questions - Bitcoin Stack Exchange https://ift.tt/CJj8qQu
via IFTTT
