Chosen Commitments and Certified Decoding Regions in the Adaptive Threshold Schnorr Attack

What it is

ePrint 2026/2632 (Demirtaş and Yayla, received 24 October 2026, approved 26 October 2026, preprint) studies the Crites–Stewart adaptive forgery attack on threshold Schnorr signatures with N parties and threshold τ. That attack makes one call to a sparse linear search oracle, which Crites and Stewart show is bounded distance decoding of a diagonally scaled Reed–Solomon code. The oracle's sparse answer, a witness, names the parties to corrupt. The paper tests whether an adversary who chooses the commitment coefficient vector, instead of sampling it uniformly as Crites and Stewart do, gets a better attack.

How it works

The commitment is fixed through a known coefficient vector before a fresh hash challenge. Conditional on the history that fixed the vector, the attack target is then a uniform point on a line. For distinct nonzero Shamir points, the main theorem says each such line holds at most M targets that have a witness in a finite collection of coordinate and block weight regions. The collection is fixed before the targets, and each region permits fewer than τ nonzero coordinates. M is an explicit integer depending only on N, τ and the collection.

The regions come from the radii certified by seven decoding theorems: three for Reed–Solomon codes and four for folded Reed–Solomon codes. The paper names the folded Guruswami–Wang and Ashvinkumar–Habib–Srivastava results. The paper also uses its bounds to classify these theorems.

Preconditions / Affected

The QM/p bound covers only a defined "wrapper" adversary:

• It makes at most Q fresh challenges and no signing query.
• It chooses each coefficient vector from its history before the challenge and keeps it afterwards.
• Its solvers make no further signature hash queries.
• It accepts only a witness of the same target and representation that lies in the collection's regions within its corruption cap.
• It corrupts parties only once it holds such a witness, then forges from that witness and stops.

For the six (N, τ) pairs of the original attack, fixed collections built from partitions into consecutive blocks contain all seven certified regions and give M below 2^24. At the field size proxy p = 2^252, the bound stays below 2^-100 after 2^128 challenges.

For uniform targets, the paper proves much smaller witness-probability bounds in these regions. For the folded block regions on consecutive-block partitions fixed before the target, the probability is negligible when parties are polynomially many, the field is exponentially large, and τ/N is bounded away from zero.

Caveats

The authors list these as open: the hardness of the oracle, the success of other strategies, and the adaptive security of threshold Schnorr schemes. The result does not show that threshold Schnorr is adaptively secure. It bounds one template-following strategy that recovers witnesses only inside the certified regions.