mà không cần phải bị thoái hóa đại diện vấn đề rút ngắn cơ bản Công ty khó chữa (đó là vấn đề DL, xem § 8,4). Ý tưởng này là sau đó tiếp tục phát triển các lĩnh vực hữu hạn Prentice Nhà xuất bản Hội trường PTR: một hình thức tổng quát hơn trong một mật mã mới: | After ElGamal s original work several variations of the ElGamal signature scheme emerged. Two influential ones are the Schnorr signature scheme 256 257 and the Digital Signature Standard DSS 215 216 . The Schnorr Signature The Schnorr signature scheme is a variation of the ElGamal signature scheme but possesses a feature which forms an important contribution to public-key cryptography a considerably shortened representation of prime field elements without having degenerated the underlying intractable problem which is the DL problem see . This idea is later further developed to finite fields of a more general form in a new cryptosystem the XTR public-key system 175 . The shortened representation is realized by constructing a field Fp such that it contains a much smaller subgroup of prime order q. We notice that the current standard parameter setting for p in ElGamal-like cryptosystems is p 21024. We should further notice that the size for p is likely to grow to suit the advances in solving the DL problem. However after Schnorr s work it has become a standard convention a rule of thumb that parameter setting for q is q 2160. It is quite possible that this setting is more or less a constant regardless of the growth of the size of p. This is because that the subgroup information does not play a role in general methods for solving the DL problem in Fp even if the target element is known in the given subgroup. The constant-ish 2160 setting for q is merely imposed by the lower-bound requirement due to the square-root attack see . The Schnorr signature scheme is specified in Alg Notice that in the setting-up of public parameters a generator g can be found quickly. This is because for q p - 1 Prob god ord ợ I I f ey ZJ l g f- --1 . the probability of random chosen f satisfying g _ I mod is negligibly small. By Fermat s Little Theorem Theorem in we have g 1 i mod p Thereforeg indeed generates a subgroup of q elements. The signature .
