## 4 Blind Schnorr Signatures--Results and Discussion
### Establishing a Shared Secret by \(\mathcal{S}\) and \(\mathcal{D}\)
#### 4.1.2 Transmitting a DH Ephemeral Share from \(\mathcal{D}\) to \(\mathcal{S}\)  
Transmitting a DH share from \(\mathcal{D}\) to \(\mathcal{S}\) is more complicated. The share should be hidden inside \(c\), as it is the only element sent by \(\mathcal{D}\). Fortunately, \(c\) is in some sense random, as \(c=c^{\prime}+\beta\bmod q\), where \(\beta\) can be freely chosen. However, \(c\) is not a group element but belongs to \(\mathbb{Z}_{q}\). So, we need to somehow encode a random group element as an element of \(\mathbb{Z}_{q}\). It is impossible to do it perfectly, but achieving this goal with some redundancy will suffice. In the first step, \(\mathcal{D}\) chooses \(y\in\mathbb{Z}_{q}^{*}\) at random and calculates \(Y=g^{y}\). At this moment, \(Y\) must be mapped into \(\mathbb{Z}_{q}\) and \(c=\mathsf{encode}(Y)\) for the chosen function \(\mathsf{encode}\). As already mentioned, this might be difficult. In the following, we show an example where the inversion mapping \(\mathsf{decode}(Y)\) provides more than one candidate for \(Y\). Recall that for the sake of simplicity, we consider a subgroup of \(\mathbb{Z}_{p}\) of prime order \(q\), where \(p=2q+1\) (it is the case for a strong DDH-secure Schnorr group). In this case, we may choose a mapping \(\mathsf{encode}(Y)=Y\bmod q\). Note that since \(q=\frac{p-1}{2}\), we have that either \(Y=c\) or \(Y=c+q\bmod p\). In this case, \(\mathsf{decode}(Y)=\{Y,Y+q\bmod p\}\). With more effort, one can define analogous mappings for elliptic curve groups. Attention should be paid to the resulting probability distribution of \(c\): it should be indistinguishable from the uniform distribution in \(\mathbb{Z}_{q}\). This can be technically involved (compare [32]). The details of the described procedure are shown in Figure 7. Note that the attack can be detected if \(\mathcal{D}\) is immediately asked for a Schnorr signature resulting from this interaction. Namely, \(\mathcal{D}\) would have to find \(c^{\prime}\) such that \(c^{\prime}=\mathsf{H}_{1}(g^{\alpha}\cdot R\cdot\mathsf{pk}_{\mathcal{S}}^{c- c^{\prime}\bmod q}\), m). Solving this equation for \(c^{\prime}\) is infeasible, even if one can freely choose \(\alpha\). So again, a good choice is to create a \"server error\" instead of sending the response \(s\). Note that as long as the mapping \(\mathsf{encode}\) on random group elements yields the elements of \(\mathbb{Z}_{q}\) with probability distribution not distinguishable from the uniform distribution, the above execution is indistinguishable by the Auditor \(\mathcal{J}\) from an execution of the original protocol. Generating \(\mathsf{ak}\)  
On the side of \(\mathcal{D}\), there are shares \(R,Y=g^{y}\) and \(\mathcal{D}\) knows \(y\), so it can derive the shared key \(K=\mathsf{KDF}(R^{y})\) (where \(\mathsf{KDF}\) is some secure key-derivation function). On the side of \(\mathcal{S}\), the situation is more complicated, as \(\mathsf{decode}(c)\) may provide more than one candidate for the share of \(\mathcal{D}\). In particular, for the example mapping defined above, \(\mathcal{S}\) can compute two candidates for \(\mathsf{ak}\):  
Figure 7: Protocol transmitting an ephemeral share \(Y\) for DH key exchange from \(\mathcal{D}\) to \(\mathcal{S}\). \[\mathsf{ak}_{0}=\mathsf{KDF}(c^{r}\bmod p),\quad\mathsf{ak}_{1}=\mathsf{KDF}((c+q)^{ r}\bmod p).\]  
As there are no further messages from \(\mathcal{D}\) to \(\mathcal{S}\) during a single protocol invocation, there is no way to inform \(\mathcal{S}\) which out of \(\mathsf{ak}_{0}\) and \(\mathsf{ak}_{1}\) is the correct shared value. If matching between \(\mathsf{ak}\) and one of \(\mathsf{ak}_{0}\) and \(\mathsf{ak}_{1}\) is necessary, one can use the next protocol invocation. Then, \(\mathcal{D}\) can choose the challenge \(c_{1}=\mathsf{H}_{1}(g^{\mathsf{ak}_{1}}\cdot R_{1}\cdot\mathsf{pk}_{\mathcal{ S}}^{\beta_{1}},\,m_{1})\) to carry this message.