I'm trying to get a grip on how Schnorr signature works. Suppose Alice sends Trent a tuple $(P, M)$, which contains a payload and a message to be signed by him. She then passes the certificate to Bob who verifies it.

Using Wikipedia's description (http://en.wikipedia.org/wiki/Schnorr_signature), is Alice supposed to compute $r = g^k$ and then passes it to Trent who then computes $e = H(M \| r)$ and $s = (k - xe)$? If that's how it works, then isn't Alice supposed to transform what she receives rather than passing $(s, e)$ straight to Bob? Bob could take $(s, e)$ to Trent and find out about Alice's payload.


  • 3
    $\begingroup$ It is not really clear to me what you are asking. Schnorr signatures are not interactive. All operations involved in the signature generation are performed by one party, i.e., the signer. $\endgroup$
    – DrLecter
    Dec 12, 2014 at 11:11
  • $\begingroup$ I'm wondering how Alice could have payload $P$ hidden. I could be too much influenced by the blind signature concept. With blind signature, Alice could send Trent $(P, M)$ and Trent signs $M$. Alice then unblinds the message and sends it off to Bob. Bob won't be able to take what he got from Alice and obtain the payload stored at Trent because Trent only has the blinded message. Does Schnorr signature allow some kind of 'blinding'? $\endgroup$
    – Kar
    Dec 12, 2014 at 11:30
  • 3
    $\begingroup$ E.g., here $\endgroup$
    – DrLecter
    Dec 12, 2014 at 11:42
  • $\begingroup$ "Unblinding" term fits well blind RSA signature scheme. For blind Schnorr scheme, Alice produces $e = H(M || r)$ herself. She sends $e' = e + d_e$ to Trent for some $d_e$ chosen at random to "blind" $e$. Then $e$ is a part of signature. It is still unclear what payload $P$ was meant to be? $\endgroup$ Jan 31, 2015 at 11:27

1 Answer 1


Signatures do not keep the message secret.

Verification in Schnorr is by recovering $r=g^s*y^c \textrm{ mod } p$ and then checking that $c$ depends on $r$ in the right way; i.e., $c=H(r||M)$.

Efficiently generating an $s$, $c$ pair requires knowing the private key, so that raising to $s$ can cancel the $g^x$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.