# Schnorr signature with adding instead of multiplying

I am reading about Schnorr signature (for example, from BIP-340) and I thought, what if we add instead of multiplying for $$s$$? So, in the signing process it will be s = r + e + d mod n instead of s = r + e*d mod n. Verification will be the similar: calculate $$s*G$$ and compare it to $$r*G + e*G + P$$ instead of $$r*G + e*P$$.

$$(r*G,s)$$ is signature, $$d$$ is private key, $$P$$ is public key, $$r$$ is random value, $$e = hash(r*G, P, message)$$

Probably I am missing something obvious but I still did not get why it will be less secure. Signer shows that he knows the discrete logarithm of something for which he needs to know the private key.

## 1 Answer

With your modified signature scheme, you can generate forgeries with a single valid signature.

Let us assume you have a valid signature $$(rG, s)$$ to a message with hash $$e$$. That is, you have $$sG = rG + eG + P$$.

Then, if you have another message with hash $$e'$$ (with the same $$r$$), you can compute $$s' = s - e + e'$$; the new signature is $$(rG, s')$$

This validates, as $$s'G = (s - e + e')G = sG - eG + e'G = (rG + eG + P) - eG + e'G = rG + e'G + P$$