To answer points:
- I switched to the medium article so that I could correct, edit and improve things to make them more clear.
- I responded to feedback by modifying the protocol to make it work - not by ignoring it.
- I coded it up in python so I could be sure it worked, because I was concerned that it was broken
- Yes, coding it up showed me that it's definitely interactive, and no different than a "standard shnorr sig" in any meaningful way regarding the security
-
No special protocol support is needed over Schnorr signing itself. The e, s version can be made at least as secure as schnorr + DLP. I haven't researched the R,s version.
- An M-1 rogue-key attack would require the attacker would to either
- attack the hash function to produce a predictable R based on a known mesage
- attack the DLP to influence x or k
Neither attack gives any particular advantage to someone who has M-1 keys.
I haven't tested whether the R,s version is susceptible though.
