On the Security of the Schnorr Scheme using Preprocessing

In this paper, it is shorn that the Schnorr scheme with preprocessing BE proposed in I41 leaks too much information. An attack based on this information leakage is presented that retrieves the secret key. The complexity of this attack is upper bounded by 2k. b3(d-2) steps, and the expected required number of signatures is lees than Zk: .(j)"-', where k is a security parameter. This complexity is significantly lower than the kk(d-a] stepa, conjectured in [4]. For example, for the security parameters that are proposed in [4], the secret key c a n on average be found in Z37.6 steps, instead of in ZTZ steps, This showlr that it is inevitable to either modify the preproceising algorithm, or choose the values of the security paremeters larger than proposed in [4]. Finally, we briefly discuar the poreibility of averting the proposed attack by modifying the preprocessing algorithm.