I have only skimmed the paper but the scheme doesn't seem to aggregate the public nonces (see table 4) and is therefore less space efficient than interactive Bellare-Neven signatures. Gamma signatures are similar to what was introduced on the bitcoin-dev mailing list as "non-interactive half aggregation", but gamma signatures appear to be broken by Wagner's algorithm because not all attacker given data (like messages and public nonces) is hashed into all the challenges ei. This problem was also mentioned on the mailing list https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014308.html.
In Gamma signatures the challenges are just ei = H(Pi, mi). Since the pubkeys Pi are just multiplied by ei and then summed in the verification equation an attacker can try to choose its pubkeys and challenges to cancel out the victim's.
The victim's pubkey is P1, the corresponding challenge e1. The attacker wants to cancel P1, so needs to find (ei, Pi) for i >= 2, s.t. -e1*P1 = e2*P2 + ... + en*Pn.
If the attacker for example chooses pubkeys Pi = i*P1 then solution -e1 = e2*2 + ... + en*n can be found with Wagner's algorithm in O(2^33) (for 256 bit groups).
In Gamma signatures the challenges are just ei = H(Pi, mi). Since the pubkeys Pi are just multiplied by ei and then summed in the verification equation an attacker can try to choose its pubkeys and challenges to cancel out the victim's.
The victim's pubkey is P1, the corresponding challenge e1. The attacker wants to cancel P1, so needs to find (ei, Pi) for i >= 2, s.t. -e1*P1 = e2*P2 + ... + en*Pn.
If the attacker for example chooses pubkeys Pi = i*P1 then solution -e1 = e2*2 + ... + en*n can be found with Wagner's algorithm in O(2^33) (for 256 bit groups).
Another note: There is also another approach to defeating the rogue-key attack (besides non-aggregation of first use of each public key): including some unpredictable value into the input of $e_i$. For example, the random nonce appeared in the last confirmed block is also input to $e_i$. This way, the attacker cannot predict and know $e_1$ in your attack (except for a very short timing window, e.g., one hour). Note that, when applying Wagner's algorithm, each operation corresponds to one exponentiation plus one hashing. Also notice that the rogue-key attack can only be performed by a malicious miner who needs to successfully make such an attack along with hard POW competition. Actually, the fact that only a malicious miner can perform such an attack may already be a much serious concern for the attacker :-)
