Bird of Prey 2: non-malleable Schnorr + PQ signatures

[sipa]

@AdamISZ

Do I have that roughly right?

That sounds exactly right.

@AdamISZ

For your point that it might just be not possible in the PQ regime: what about isogenies, I wonder. I guess hash-based is a non-starter, and lattices .. well there’s some linearity there right? But from what I’m reading, no dice. And isogenies even if sound might not be performant enough for this stuff. Shrug, no idea

I hadn’t considered the possibility of batch-verification of the PQC signature scheme, only about whether it’s worth retaining Schnorr batch verifiability. If the PQC signature scheme is significantly more expensive per signature (not necessarily per byte) than Schnorr, really only the batch verifiability of the former matters. As for how feasible it is with various PQC classes, no idea.

@AdamISZ

About including R or not: I think if I’m reading this right, we’re publishing \sigma_{sch} and \sigma_{pq} so since the latter is the dominant element, does it matter?

Possibly not.