Concrete LDVR Attacks with Fewer Signers

What it is

Renas Bacho's ePrint 2026/2554 (received 19 October 2026) improves concrete attacks on the low-dimensional vector representation (LDVR) problem, which underlies adaptive security of threshold Schnorr. It builds on Rodríguez García and Tessaro (ePrint 2026/2126), whose attack on canonical evaluation points used 5,020 signers. Bacho's attack needs 488 signers and 173 corruptions over the Curve25519 scalar field.

How it works

The canonical-points attack combines the Chinese remainder theorem construction from the earlier paper with a generalized birthday search run over many challenges. The search ran in 64 batches of 2^25 challenges and found solutions for six distinct challenges. The paper compares the counts measured at each stage of the search with predictions from an explicit heuristic model.

For adversarially chosen evaluation points, the paper extends the binary attacks of Rodríguez García and Tessaro. Its construction reaches the optimal LDVR success probability for every oracle query budget when 2 ≤ n ≤ 253 and t_c = t, in the uniform oracle model.

Measured results

• Canonical points: 488 signers, 173 corruptions, Curve25519 scalar field.
• Adversarial points, implementation: at 228 signers and 114 corruptions, a successful subset was found using SHA-512 challenges. It took a cumulative 360.13 million queries across two runs and 168.60 seconds in total.
• Adversarial points, explicit set: 256 evaluation points are given for which a subset search attack with 128 corruptions succeeds with probability at least 51.92% per uniform challenge.

The paper also analyzes query complexity and reports measured and estimated running times for both the canonical and adversarial cases.

Preconditions

The optimality result holds only in the uniform oracle model, for t_c = t and n up to 253. The 488-signer attack targets canonical evaluation points, while the 228-signer and 256-point results rely on evaluation points chosen by the adversary. Whether a deployed threshold Schnorr scheme is exposed therefore depends on its signer count, corruption threshold and how evaluation points are assigned.

Caveats

The fetched page contains only the abstract and metadata, so the details of the construction, the heuristic model and the estimated running times for larger parameters are not covered here. The page marks the paper as a preprint with no peer-review venue.