Editing Schnorr signature (section)

===Security argument===
The signature scheme was constructed by applying the [[Fiat–Shamir heuristic|Fiat–Shamir transformation]]<ref>{{cite conference <!-- Citation bot no -->
| first1=Amos
| last1=Fiat
| authorlink1=Amos Fiat
| first2=Adi
| last2=Shamir
| authorlink2=Adi Shamir
| title=Advances in Cryptology
| chapter=How to Prove Yourself: Practical Solutions to Identification and Signature Problems
| conference=Conference on the Theory and Application of Cryptographic Techniques. Proceedings of CRYPTO '86|series=Lecture Notes in Computer Science
| date=1987
| volume=263
| pages=186–194
| doi=10.1007/3-540-47721-7_12
| editor=Andrew M. Odlyzko
| editor-link=Andrew Odlyzko
| isbn=978-3-540-18047-0 |s2cid=4838652 |doi-access=free}}</ref> to Schnorr's identification protocol.<ref>{{cite conference <!-- Citation bot no -->
| first=C. P.
| last=Schnorr
| author-link=Claus P. Schnorr
| title=Advances in Cryptology
| chapter=Efficient Identification and Signatures for Smart Cards
| conference=Conference on the Theory and Application of Cryptographic Techniques. Proceedings of CRYPTO '89
| series=Lecture Notes in Computer Science
| date=1990
| volume=435
| pages=239–252
| doi=10.1007/0-387-34805-0_22
| isbn=978-0-387-97317-3
| s2cid=5526090
| editor=Gilles Brassard
| editor-link=Gilles Brassard
| doi-access=free}}</ref><ref>{{cite journal
| url=http://publikationen.ub.uni-frankfurt.de/frontdoor/index/index/docId/4280
| title=Efficient signature generation by smart cards 
| first=C. P.
| last=Schnorr
| author-link=Claus P. Schnorr
| journal=[[Journal of Cryptology]]
| volume=4
| pages=161–174
| year=1991
| issue=3 
| doi=10.1007/BF00196725| s2cid=10976365 
}}</ref> Therefore, (as per Fiat and Shamir's arguments), it is secure if <math>H</math> is modeled as a [[random oracle]].

Its security can also be argued in the [[generic group model]], under the assumption that <math>H</math> is "random-prefix preimage resistant" and "random-prefix second-preimage resistant".<ref name="Neven">{{cite web
| first1=Gregory
| last1=Neven
| first2=Nigel
| last2=Smart
| authorlink2=Nigel Smart (cryptographer)
| first3=Bogdan
| last3=Warinschi
| title=Hash Function Requirements for Schnorr Signatures
| url=http://www.neven.org/papers/schnorr.html
| publisher=IBM Research
| access-date=19 July 2012}}</ref>  In particular, <math>H</math> does ''not'' need to be [[Collision resistance|collision resistant]].

In 2012, Seurin<ref name="Seurin">{{Cite web
| url = https://eprint.iacr.org/2012/029
| title = On the Exact Security of Schnorr-Type Signatures in the Random Oracle Model
| last = Seurin
| first = Yannick
| date = 2012-01-12
| website = [[Cryptology ePrint Archive]]|publisher = International Association for Cryptologic Research
| access-date = 2023-02-06}}</ref> provided an exact proof of the Schnorr signature scheme. In particular, Seurin shows that the security proof using the [[forking lemma]] is the best possible result for any signature schemes based on one-way [[group homomorphism]]s including Schnorr-type signatures and the [[Guillou–Quisquater signature scheme]]s. Namely, under the [[Random_Oracle_Model,Discrete_Logs|ROMDL]] assumption, any algebraic reduction must lose a factor <math>f({\epsilon}_F)q_h </math> in its time-to-success ratio, where <math>f \le 1</math> is a function that remains close to 1 as long as "<math>{\epsilon}_F</math> is noticeably smaller than 1", where <math>{\epsilon}_F</math> is the probability of forging an error making at most <math>q_h</math> queries to the random oracle.