In CROSS signature, why does chall1 need to be non-zero?

[Longfei Qiu]

Hi,

On page 10 of CROSS signature specification, it is required that "The verifier chooses a challenge chall1 in F_p^*," which excludes chall1 == 0. I don't see any justification for this exclusion. Neither the protocol nor the security proof requires taking the inverse of chall1. Within the security details document, in the proof of Proposition 26, we are taking the inverse of (chall1 - chall1^*), but this is non-zero as long as chall1 != chall1^*. Can we simplify the scheme to "the verifier chooses a challenge chall1 in F_p?"

Best,

Longfei