We put forward a new method of constructing Fiat-Shamir-like signature schemes that yields better "exact security" than the original Fiat-Shamir method. (We also point out, however, that such tight security does not make our modified schemes always preferable to the original ones. Indeed, there exist particularly efficient Fiat-Shamir-like schemes that, though only enjoying "loose security," by using longer keys may provably provide more security at a lower computational cost than their

more »

... ecurity" counterparts.) Note: A preliminary version of this paper appears in [MR99] . A version that is similar to this one, but omits some proofs, will appear in the Journal of Cryptology. This is the full version.