Using the notation from the Wikipedia article: https://en.wikipedia.org/wiki/Schnorr_signature, the Schnorr signature mixes the random value $k$ and the hash $e$ like this:

$$s = k - xe$$

(Where $x$ is the private key scalar)

My question is: What would be the problem with reversing the two scalars like this:

$$s = e - xk$$

And the recovering the hash in the point domain directly like this:

$$e_v = sG + ky$$

(Where $G$ is the generator, $y$ is the signer’s public key point, and the signature is valid if: $e_v == eG$)

I’m sure that there is a reason it’s done the other way, but I’d be curious if there is an obvious problem with the above. It seems more direct to me but perhaps that is the issue somehow.

EDIT: As Daniel S. immediately pointed out, I was neglecting that the random scalar k must be secret and therefore cannot be used in verification. Embarrassing mistake... I knew there was one :)

  • 1
    $\begingroup$ I've converted your formulas to MathJAX / $\LaTeX$, please have a look if everything is still correct. If you want you can use \cdot for (point) multiplication (use the edit button to change your question $\cdot$ ). $\endgroup$
    – Maarten Bodewes
    Dec 28, 2022 at 23:19
  • 2
    $\begingroup$ Your verification process requires the verifier to know $k$ which is supposed to be secret. If you reveal $e$, $s$ and $k$, then anyone can calculate the $x$ by $x=(k-s)/e\pmod\ell$ where $\ell$ is the group order. $\endgroup$
    – Daniel S
    Dec 29, 2022 at 0:03
  • $\begingroup$ Ah, of course! Thank you! This is one case where the capital letter notation for points would have saved me from making a dumb mistake :) $\endgroup$ Dec 29, 2022 at 13:49

1 Answer 1


Since $e$ is known, an attacker could try various random values $k_i$ and via $$ e_i-e_j=(s-x k_i)-(s-x k_j)=s(k_i-k_j) :=s \delta_{ij} $$ obtain a number of relations that $s$ satisfies since they can choose the exact $\delta_{ij}.$ These relations could then be utilized to obtain nontrivial information on the secret $s,$ or even be used to solve for $s.$

  • $\begingroup$ Thanks. Even though my mistake was actually more fundamental, I see your more general point about how information about $k$ over several iterations could weaken the secret $x$. $\endgroup$ Dec 29, 2022 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.