Home > Resources > papers > Sch91-Schnorr-Signatures

Efficient Signature Generation by Smart Cards (Schnorr 1991)

Last modified: 2026-10-27

DOI: 10.1007/bf00196725 · URL: https://doi.org/10.1007/BF00196725

Summary

Presents the Schnorr identification protocol and, via the Fiat–Shamir heuristic, the Schnorr signature scheme, designed to be cheap enough for smart cards (most work can be precomputed). The Schnorr protocol is the canonical Sigma protocol (proof of knowledge of a discrete logarithm) and the template for the proofs of knowledge used in anonymous credentials. (Journal of Cryptology 4(3), 1991; conference version CRYPTO '89.)

Related resources

• A "Paradoxical" Identity-Based Signature Scheme Resulting from Zero-Knowledge (Guillou, Quisquater 1988) (paper, 1988)
• A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms (ElGamal 1985) (paper, 1985)
• High-Speed High-Security Signatures (Bernstein, Duif, Lange, Schwabe, Yang 2011) (paper, 2011)
• How to Prove Yourself: Practical Solutions to Identification and Signature Problems (Fiat-Shamir) (paper, 1986)
• On Sigma Protocols (Damgård) (paper, 2004)