I feel bad for saying so, but I absolutely do believe it's in scope of the paper :) If there is a concrete, meaningful optimisation that's both possible and sensible (and as you say, there is such an ultra-simple optimisation ... I guess that's entirely correct!), then it should be included there and not elsewhere. Why? Because it's exactly the kind of thing an engineer might want to do, but it's definitely not their place to make a judgement as to whether it's safe or not, given that these protocols are such a minefield. I'd say even if there is *no* such optimisation possible it's worth saying so.

On Wednesday, April 30, 2025 at 9:03:34 AM UTC-6 Jonas Nick wrote:

Thanks for your comments.

> That side note reminds me of my first question: would it not be appropriate
> to include a proof of the zero knowledgeness property of the scheme, and
> not only the soundness? I can kind of accept the answer "it's trivial"
> based on the structure of the partial sig components (s_k = r_k1 + br_k2 +
> c_k x_k) being "identical" to baseline Schnorr?

That partial signatures do not leak information about the secret key x_k is
implied by the security theorem for DahLIAS: If information would leak, the
adversary could use that to win the unforgeability game. However, the adversary
doesn't win the game unless the adversary solves the DL problem or finds a
collision in hash function Hnon.

> The side note also raises this point: would it be a good idea to explicitly
> write down ways in which the usage of the scheme/structure can, and cannot,
> be optimised for the single-party case?

This is a very interesting point, probably out of scope for the paper. A
single-party signer, given secret keys xi, ..., xn for public keys X1, ..., Xn
can draw r at random, compute R := r*G and then set s := r + c1*x1 + ... +
cn*xn. So this would only require a single group multiplication.

> On that last point about "proof of knowledge of R", I suddenly realised
> it's not a viable suggestion: of course it defends against key subtraction
> attacks, but does not defend at all against the ability to grind nonces
> adversarially in a Wagner type attack

We believe Appendix B provides a helpful characterization of "Wagner-style"
vulnerabilities. Roughly speaking, it shows that schemes where the adversary can
ask the signer to produce a partial signature s = r + c*x or s' = r + c'*x such
that c != c' then the scheme is vulnerable. In your "proof of knowledge of R
idea", the adversary can choose to provide either R2 or R2' in a signing
request, which would result in the same "effective nonce" r being used be the
signer but different challenges c and c'.