diff --git a/content/docs/zkdocs/zero-knowledge-protocols/schnorr.md b/content/docs/zkdocs/zero-knowledge-protocols/schnorr.md index ce78c0d..df1158a 100644 --- a/content/docs/zkdocs/zero-knowledge-protocols/schnorr.md +++ b/content/docs/zkdocs/zero-knowledge-protocols/schnorr.md @@ -129,7 +129,7 @@ where $\schnorrvalidate(\varu, \varh)$ aborts if any of the following conditions ## Security pitfalls * **Verifier input validation:** Each of the items above the dotted line for the $\varverifier$ is essential to the security of the protocol. If any of these checks are missing or insufficient it is likely a severe security issue. - * __Verifier trusts prover:__ On the verification check, the verifier uses $g$ and $q$ provided with the proof instead of using publicly known values. On the NI version, the verifier assumes that the hash $\varc$ is correctly computed and does not compute it themself. Both are high severity issues since $\varprover$ can forge proofs. + * __Verifier trusts prover:__ On the verification check, the verifier uses $g$ and $q$ provided with the proof instead of using publicly known values. On the NI version, the verifier assumes that the hash $\varc$ is correctly computed and does not compute it themselves. Both are high severity issues since $\varprover$ can forge proofs. * __Weak Fiat-Shamir transformation:__ In the non-interactive protocol, it is a common occurrence that some parameters are missing on the hash computation $\hash{\varg, \varq, \varh, \varu}$: * $\varh$ or $\varu$ missing: high severity issue. Read [Fiat-Shamir transformation]({{< ref "../protocol-primitives/fiat-shamir.md" >}}) for more details. * $\varg$ or $\varq$ missing: usually no issue, but it might be one if the Verifier uses these parameters directly from the proof structure. This way, the prover can provide bad generators or orders to forge the proof.