Question about alternative formulation of the Schnorr signature…

Question

Using the notation from the Wikipedia article: https://en.wikipedia.org/wiki/Schnorr_signature, the Schnorr signature mixes the random value $k$ and the hash $e$ like this:

$$s = k - xe$$

(Where $x$ is the private key scalar)

My question is: What would be the problem with reversing the two scalars like this:

$$s = e - xk$$

And the recovering the hash in the point domain directly like this:

$$e_v = sG + ky$$

(Where $G$ is the generator, $y$ is the signer’s public key point, and the signature is valid if: $e_v == eG$)

I’m sure that there is a reason it’s done the other way, but I’d be curious if there is an obvious problem with the above. It seems more direct to me but perhaps that is the issue somehow.

EDIT: As Daniel S. immediately pointed out, I was neglecting that the random scalar k must be secret and therefore cannot be used in verification. Embarrassing mistake... I knew there was one :)

Answer 1

Since $e$ is known, an attacker could try various random values $k_i$ and via $$ e_i-e_j=(s-x k_i)-(s-x k_j)=s(k_i-k_j) :=s \delta_{ij} $$ obtain a number of relations that $s$ satisfies since they can choose the exact $\delta_{ij}.$ These relations could then be utilized to obtain nontrivial information on the secret $s,$ or even be used to solve for $s.$