Author: Jonas Nick 2023-07-27 08:07:58+00:00
Published on: 2023-07-27T08:07:58+00:00
In the given context, it is stated that having proof of knowledge of the r values used to generate each R does not prevent Wagner's attack. The author explains that using Wagner's algorithm, one can choose R2[0], ..., R2[K-1] such that the sum of c[0] + ... + c[K-1] equals c[K]. It is clarified that this choice can be thought of as selecting scalars r2[0], ..., r2[K-1] and defining R2[i] as r2[i]*G. The author emphasizes that the attacker has the freedom to choose r2[i] in this scenario, as the attack would not make sense otherwise.
Updated on: 2023-07-28T02:05:13.914451+00:00