Why schnorr signatures uses H(R||m) instead of H(m)?

The Schnorr signature scheme was defined originally as $$(c, s)$$ such that $$sG = R + cX$$, and the verification process consisted of computing $$R = sG - cX$$ and then verifying that $$c = H(R||m)$$ so using only $$H(m)$$ would not have worked for verification. However, in the verification process of the Schnorr signature variant $$(R, s)$$, we first compute $$c = H(R||m)$$ and then verify that $$R = sG - cX$$, if we change $$c = H(R||m)$$ by $$c = H(m)$$ the verification process is not affected. I guess that using $$c = H(m)$$ is not secure for the Schnorr scheme, but I wonder why.

Note: For example, in the ECDSA scheme $$s = k^{-1}(H(m) + dr)$$ the hash consists only of $$H(m)$$

In your second scheme, the signature $$(R,s)$$ is verified as $$R\overset{?}{=} sG-cX$$.

If $$c$$ does not involve $$R$$, then you could forge a signature by picking a random $$s$$ value and calculating $$R=sG+cX$$, where $$c=H(m)$$. Therefore, it does matter that $$c$$ is calculated as $$c=H(R\mathbin\| m)$$.

With ECDSA, the x-coordinate of a point performs the same function as a hash in the Schnorr signature. This is because the x-coordinate is unpredictable. If I give you a random x-coordinate value, you won't be able to efficiently find a scalar value $$a$$ such that the point $$aG$$ has that x-coordinate.

You can therefore think of an ECDSA signature as:

$$(c,s) = \biggl(H_2(R),\ \frac{H(m)\ +\ H_2(R)x}{r}\biggr)$$, where $$H_2(P)$$ means to extract the x-coordinate of the point P.

It is verified as $$c \overset{?}{=} H_2\biggl(\frac{H(m)G\ +\ cX}{s}\biggr)$$

As you can see, ECDSA does have a cryptographically secure one-way function that involves $$R$$.

The scheme is completely insecure: $$c = H(m)$$ does not constrain $$R, m, X$$ in a way that only the owner of the secret key can satisfy.

To forge a signature $$(R, s)$$, choose an arbitrary $$s$$, the set $$R = sG- cX$$. This passes verification for $$c = H(m)$$ even when we dint know the secret key.

• You might want to answer the obvious followup question: "why then is ECDSA secure??" Jul 4, 2023 at 22:51
• @poncho Oops, I forgot that part of the questions. But the other answer does a good job at answering that part. Jul 6, 2023 at 9:59