Subgraph isomorphism problem - Revision history

en>Gilo1969: fix citation with wikilinks embedded in URL

2014-12-26T18:21:02Z

fix citation with wikilinks embedded in URL

← Older revision		Revision as of 20:21, 26 December 2014
Line 1:		Line 1:
	~~In [[cryptography]],~~ a ~~'''Schnorr signature''' is~~ a ~~[[digital signature]] produced by the Schnorr signature algorithm. Its security is based on the intractability of certain [[discrete logarithm]] problems~~. It ~~is considered the simplest digital signature scheme to be provably secure in~~ a ~~[[random oracle]] model {{Citation needed\|date=July 2011}}~~. ~~It is efficient~~ and ~~generates short signatures~~. ~~It is covered by {{US patent\|4995082}}~~, ~~which expired in February 2008~~.		The 2009 Silverado from Chevrolet gives 15 Hybrid 2WD. This half ton 5-seater along with 4 doors and 4 trims. You may get a range from 1HY 4x2 to a 2HY 4 wheel drive. It's definitely known for its' fuel efficiency, even although it comes within a 1HY 4x2, 8-cylinder, 6L engine. Your mileage out and about can reach 21mpg, while highway miles are 22mpg. If you purchase the 2HY 4x4 you will get the same type of mileage benefits, but with automatic program code.<br><br><br><br><br><br>"After that last caution we try out two tires and found too tight and couldn't maintain track position and lost a few positions." said Wallace Jr toyota tundra off road . post-race on the KBM website.<br><br>Fourth, consider ease of installation. You need a simple, smooth process that doesn't require drilling or special tools. Consider fast installation using merely screwdriver and screws.<br><br>[http://devolro.com/interior areas]<br><br>16-year-old Erik Jones brought home his second top 10 finish because many races in the absolutely no. 51 [http://devolro.com specifications] for Kyle Busch Motorsports, finishing ninth in Sunday's NC Education Lottery 200 at Rockingham Speedway. Jones started at the tail-end within the field in 36th, taking place a lap early on the subject of. The "lucky dog" award put him back with the lead lap, and Jones climbed into the top 10 in morrison a pardon stages of the 200-lap race, which was won by Kyle Larson.<br><br>It seems odd, but you can get yourself a limited slip rear end on each wheel drive models. It keeps a corner tire from spinning. to. .well, one tire from swimming. I'm sure with that monster engine, it can't take much to get the tires smoking tobacco. The mechanical limited slip is actually option all unto once more. As I discovered further, I do believe I'd favour the entire package of safety highlights. They are stability control, traction control, brake assist, fog lamps, running lights, and AUTOMATIC limited-slip rear differential. Sounds daunting, but Certain this package would be worth it in time.<br><br>Harvick finished fourth after slicing from field and racing for your lead late in the race. He gave credit to his team for working hard for the final but echoed several drivers' concerns that tire issues affected the race. "Just a terrible tire," he said to SPEED pit reporter Ray Dunlap after the race. "There's no rubber on his or her race route. Who knows what tomorrow's (NASCAR Sprint Cup Series) race is likely to be; it is quite going to be able to about your survival.<br><br>The Toyota Sequoia wonderful for for towing with an effortless toyota tundra tuning and responsive powertrain. However it's not very pleasant on a tight, curvy road genuine body motion and nosediving during stopping. It has a 39 feet turning distance.<br><br>This sedan is dynamic looking that half belonging to the complements I got were merely based over the styling plenty of people most likely not even realizing the car ran on hydrogen. Driving it had also been a pleasure as it steered and handled with this typical big Honda sedan composure is definitely always good. It also emits an eerily otherworld hum as you accelerate to get a something akin into the sound of your respective light saber and the U.S.S. Enterprise entering warp drive.

	~~==Algorithm==~~

	~~===Choosing parameters===~~
	*All users of the signature scheme agree on a [[group (mathematics)\|group]] <~~math~~>G<~~/math~~> ~~with generator~~ <~~math~~>g<~~/math~~> ~~of prime order~~ <~~math~~>q<~~/math~~> ~~in which the [[discrete log]] problem is hard. Typically~~ a ~~[[Schnorr group]] is used~~.
	All users agree on a [[cryptographic hash function]] <math>H: \{0,1\}^ \rightarrow \mathbb{Z}_q</math>.

	~~===Notation===~~
	~~In the following,~~
	*Exponentiation stands for repeated application of the group operation
	*Juxtaposition stands for multiplication on the ~~set of congruence classes or application of the group operation (as applicable)~~
	*Subtraction stands for subtraction on set of equivalence groups
	<~~math~~>M \in \{0,1\}^<~~/math~~>, ~~the set~~ of ~~finite bit strings~~
	*<~~math~~>~~s, e, e_v \in \mathbb{Z}_q~~<~~/math~~>~~, the~~ [~~[Integers mod n\|set of congruence classes modulo <math>q<~~/~~math>]~~]
	*<~~math~~>~~x, k \in \mathbb{Z}_q^\times~~<~~/math~~>, the [~~[Multiplicative group of integers modulo n\|multiplicative group of integers modulo <math>q<~~/~~math>]~~] (for ~~prime <math>q</math>, <math>\mathbb{Z}_q^\times = \mathbb{Z}_q \setminus \overline{0}_q</math>)~~
	*<math>y, ~~r, r_v \~~in ~~G</math>~~.

	~~===Key generation===~~
	*Choose a ~~private signing key <math>x</math> from~~ the ~~allowed set~~.
	*The ~~public verification key is <math>y = g^x</math>.~~

	~~===Signing===~~
	~~To sign~~ a ~~message <math>M</math>:~~
	*Choose a random <math>k</math> from the ~~allowed set~~.
	*Let <~~math~~>~~r = g^k~~<~~/math~~>.
	*Let <math>e = H(M \|\| r)</math>, where \|\| denotes concatenation and <math>r</math> is represented as a ~~bit string~~.
	*Let <math>s = (k - xe)</math>.

	~~The signature is the pair <math>(s~~,~~e)</math>~~.

	~~Note~~ that ~~<math>s~~, ~~e \in \mathbb{Z}_q</math>; if <math>q < 2^{160}</math>, then~~ the ~~signature representation can fit into 40 bytes~~.

	~~===Verifying===~~
	*Let <math>r_v = g^s y^e</math>
	*Let <math>e_v = H(M \|\| r_v)</math>

	~~If <math>e_v=e</math> then the signature~~ is ~~verified~~.

	~~===Proof~~ of ~~correctness===~~
	~~It is relatively easy to see that <math>e_v = e</math> if the signed message equals the verified message:~~

	~~<math>r_v = g^s y^e = g^{k - xe} g^{xe} = g^k = r</math>, and hence <math>e_v = H(M \|\| r_v) = H(M \|\| r) = e</math>~~.

	~~Public elements: <math>G</math>~~, ~~<math>g</math>~~, ~~<math>q</math>~~, ~~<math>y</math>~~, ~~<math>s</math>~~, ~~<math>e</math>~~, ~~<math>r</math>~~.
	~~Private elements: <math>k~~<~~/math~~>, <~~math~~>~~x</math>.~~

	~~===Security argument===~~
	~~No proof of security~~ for the ~~Schnorr signature scheme is known under standard cryptographic assumptions~~.

	~~The signature scheme was constructed by applying~~ the ~~Fiat-Shamir Transform<ref>{{cite journal\|last=Fiat\|coauthors=Shamir\|title=How To Prove Yourself: Practical Solutions to Identification and Signature Problems\|journal=Proceedings of CRYPTO~~ '~~86\|year=1986\|url=ftp://utopia~~.~~hacktic~~.~~nl/pub/mirrors/Advances%20in%20Cryptology/HTML/PDF/C86/186.PDF}}</ref> to Schnorr~~'s ~~identification protocol~~.~~<ref>{{cite journal\|last=Schnorr\|title=Efficient Identification and Signatures for Smart Cards\|journal=Proceedings of CRYPTO~~ '~~89\|year=1989\|url=ftp://utopia.hacktic.nl/pub/mirrors/Advances%20in%20Cryptology/HTML/PDF/C89/239.PDF}}</ref> Therefore~~ (~~per Fiat and Shamir's arguments~~), it is ~~secure if <math>H</math> is modeled as a [[random oracle]]~~.

	~~Its security can also be argued in the [[generic group model]], under the assumption that~~ <~~math~~>H<~~/math~~> ~~is "random-prefix preimage resistant"~~ and ~~"random-prefix second-preimage resistant"~~.~~<ref>{{cite web\|last=Neven~~, ~~Smart, Warinschi\|title=Hash Function Requirements for Schnorr Signatures\|url=http://www~~.~~neven~~.~~org/papers/schnorr.html\|publisher=IBM Research\|accessdate=19 July 2012}}~~<~~/ref~~> ~~In particular,~~ <~~math~~>~~H</math> does ''~~not~~'' need to be [[Collision resistance\|collision resistant]]~~.

	~~==See~~ also==
	* [[Digital Signature Algorithm\|DSA]]
	* [[ElGamal signature scheme]]

	~~==References==~~
	~~{{reflist}}~~
	* C.~~P. Schnorr, Efficient identification~~ and ~~signatures for smart cards, in G. Brassard, ed. Advances in Cryptology—Crypto '89, 239-252, Springer-Verlag, 1990. Lecture Notes in Computer Science, nr 435~~
	* Claus-Peter Schnorr, Efficient Signature Generation by Smart Cards, J. Cryptology 4(3), pp161–174 (1991) [http://www.mi.~~informatik~~.~~uni-frankfurt~~.~~de/research/papers/schnorr.smartcardsig.1991.ps (PS)].~~
	* Menezes, Alfred J. et al. ''Handbook of Applied Cryptography'' CRC Press. 1996.

	~~{{Cryptography navbox \| public-key}}~~

	~~[[Category:Digital signature schemes]]~~

en>David Eppstein: /* Decision problem and computational complexity */ dab link in ref

2013-11-07T03:45:03Z

Decision problem and computational complexity: dab link in ref

New page

In [[cryptography]], a '''Schnorr signature''' is a [[digital signature]] produced by the Schnorr signature algorithm. Its security is based on the intractability of certain [[discrete logarithm]] problems. It is considered the simplest digital signature scheme to be provably secure in a [[random oracle]] model {{Citation needed|date=July 2011}}. It is efficient and generates short signatures. It is covered by {{US patent|4995082}}, which expired in February 2008.

==Algorithm==

===Choosing parameters===
*All users of the signature scheme agree on a [[group (mathematics)|group]] <math>G</math> with generator <math>g</math> of prime order <math>q</math> in which the [[discrete log]] problem is hard. Typically a [[Schnorr group]] is used.
*All users agree on a [[cryptographic hash function]] <math>H: \{0,1\}^* \rightarrow \mathbb{Z}_q</math>.

===Notation===
In the following,
*Exponentiation stands for repeated application of the group operation
*Juxtaposition stands for multiplication on the set of congruence classes or application of the group operation (as applicable)
*Subtraction stands for subtraction on set of equivalence groups
*<math>M \in \{0,1\}^*</math>, the set of finite bit strings
*<math>s, e, e_v \in \mathbb{Z}_q</math>, the [[Integers mod n|set of congruence classes modulo <math>q</math>]]
*<math>x, k \in \mathbb{Z}_q^\times</math>, the [[Multiplicative group of integers modulo n|multiplicative group of integers modulo <math>q</math>]] (for prime <math>q</math>, <math>\mathbb{Z}_q^\times = \mathbb{Z}_q \setminus \overline{0}_q</math>)
*<math>y, r, r_v \in G</math>.

===Key generation===
*Choose a private signing key <math>x</math> from the allowed set.
*The public verification key is <math>y = g^x</math>.

===Signing===
To sign a message <math>M</math>:
*Choose a random <math>k</math> from the allowed set.
*Let <math>r = g^k</math>.
*Let <math>e = H(M || r)</math>, where || denotes concatenation and <math>r</math> is represented as a bit string.
*Let <math>s = (k - xe)</math>.

The signature is the pair <math>(s,e)</math>.

Note that <math>s, e \in \mathbb{Z}_q</math>; if <math>q < 2^{160}</math>, then the signature representation can fit into 40 bytes.

===Verifying===
*Let <math>r_v = g^s y^e</math>
*Let <math>e_v = H(M || r_v)</math>

If <math>e_v=e</math> then the signature is verified.

===Proof of correctness===
It is relatively easy to see that <math>e_v = e</math> if the signed message equals the verified message:

<math>r_v = g^s y^e = g^{k - xe} g^{xe} = g^k = r</math>, and hence <math>e_v = H(M || r_v) = H(M || r) = e</math>.

Public elements: <math>G</math>, <math>g</math>, <math>q</math>, <math>y</math>, <math>s</math>, <math>e</math>, <math>r</math>.
Private elements: <math>k</math>, <math>x</math>.

===Security argument===
No proof of security for the Schnorr signature scheme is known under standard cryptographic assumptions.

The signature scheme was constructed by applying the Fiat-Shamir Transform<ref>{{cite journal|last=Fiat|coauthors=Shamir|title=How To Prove Yourself: Practical Solutions to Identification and Signature Problems|journal=Proceedings of CRYPTO '86|year=1986|url=ftp://utopia.hacktic.nl/pub/mirrors/Advances%20in%20Cryptology/HTML/PDF/C86/186.PDF}}</ref> to Schnorr's identification protocol.<ref>{{cite journal|last=Schnorr|title=Efficient Identification and Signatures for Smart Cards|journal=Proceedings of CRYPTO '89|year=1989|url=ftp://utopia.hacktic.nl/pub/mirrors/Advances%20in%20Cryptology/HTML/PDF/C89/239.PDF}}</ref> Therefore (per Fiat and Shamir's arguments), it is secure if <math>H</math> is modeled as a [[random oracle]].

Its security can also be argued in the [[generic group model]], under the assumption that <math>H</math> is "random-prefix preimage resistant" and "random-prefix second-preimage resistant".<ref>{{cite web|last=Neven, Smart, Warinschi|title=Hash Function Requirements for Schnorr Signatures|url=http://www.neven.org/papers/schnorr.html|publisher=IBM Research|accessdate=19 July 2012}}</ref> In particular, <math>H</math> does ''not'' need to be [[Collision resistance|collision resistant]].

==See also==
* [[Digital Signature Algorithm|DSA]]
* [[ElGamal signature scheme]]

==References==
{{reflist}}
* C.P. Schnorr, Efficient identification and signatures for smart cards, in G. Brassard, ed. Advances in Cryptology—Crypto '89, 239-252, Springer-Verlag, 1990. Lecture Notes in Computer Science, nr 435
* Claus-Peter Schnorr, Efficient Signature Generation by Smart Cards, J. Cryptology 4(3), pp161–174 (1991) [http://www.mi.informatik.uni-frankfurt.de/research/papers/schnorr.smartcardsig.1991.ps (PS)].
* Menezes, Alfred J. et al. ''Handbook of Applied Cryptography'' CRC Press. 1996.

{{Cryptography navbox | public-key}}

[[Category:Digital signature schemes]]