# How does Schnorr signature actually work?

I'm trying to get a grip on how Schnorr signature works. Suppose Alice sends Trent a tuple $(P, M)$, which contains a payload and a message to be signed by him. She then passes the certificate to Bob who verifies it.

Using Wikipedia's description (http://en.wikipedia.org/wiki/Schnorr_signature), is Alice supposed to compute $r = g^k$ and then passes it to Trent who then computes $e = H(M \| r)$ and $s = (k - xe)$? If that's how it works, then isn't Alice supposed to transform what she receives rather than passing $(s, e)$ straight to Bob? Bob could take $(s, e)$ to Trent and find out about Alice's payload.

Thanks

• It is not really clear to me what you are asking. Schnorr signatures are not interactive. All operations involved in the signature generation are performed by one party, i.e., the signer. – DrLecter Dec 12 '14 at 11:11
• I'm wondering how Alice could have payload $P$ hidden. I could be too much influenced by the blind signature concept. With blind signature, Alice could send Trent $(P, M)$ and Trent signs $M$. Alice then unblinds the message and sends it off to Bob. Bob won't be able to take what he got from Alice and obtain the payload stored at Trent because Trent only has the blinded message. Does Schnorr signature allow some kind of 'blinding'? – Kar Dec 12 '14 at 11:30
• E.g., here – DrLecter Dec 12 '14 at 11:42
• "Unblinding" term fits well blind RSA signature scheme. For blind Schnorr scheme, Alice produces $e = H(M || r)$ herself. She sends $e' = e + d_e$ to Trent for some $d_e$ chosen at random to "blind" $e$. Then $e$ is a part of signature. It is still unclear what payload $P$ was meant to be? – Vadym Fedyukovych Jan 31 '15 at 11:27

## 1 Answer

Signatures do not keep the message secret.

Verification in Schnorr is by recovering $r=g^s*y^c \textrm{ mod } p$ and then checking that $c$ depends on $r$ in the right way; i.e., $c=H(r||M)$.

Efficiently generating an $s$, $c$ pair requires knowing the private key, so that raising to $s$ can cancel the $g^x$.