I am reading about Schnorr signature (for example, from BIP-340) and I thought, what if we add instead of multiplying for $s$? So, in the signing process it will be s = r + e + d mod n instead of s = r + e*d mod n. Verification will be the similar: calculate $s*G$ and compare it to $r*G + e*G + P$ instead of $r*G + e*P$.

$(r*G,s)$ is signature, $d$ is private key, $P$ is public key, $r$ is random value, $e = hash(r*G, P, message)$

Probably I am missing something obvious but I still did not get why it will be less secure. Signer shows that he knows the discrete logarithm of something for which he needs to know the private key.


1 Answer 1


With your modified signature scheme, you can generate forgeries with a single valid signature.

Let us assume you have a valid signature $(rG, s)$ to a message with hash $e$. That is, you have $sG = rG + eG + P$.

Then, if you have another message with hash $e'$ (with the same $r$), you can compute $s' = s - e + e'$; the new signature is $(rG, s')$

This validates, as $s'G = (s - e + e')G = sG - eG + e'G = (rG + eG + P) - eG + e'G = rG + e'G + P$


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.