In ECDSA, why are u and v dividing by s?

Question

The verification algorithm for ECDSA is:

$P=e\times G$,
$(r,y)=k\times G$, and
$s=(z+re)\times k^{-1} \bmod n$,

where $P$ is the public curve point, $G$ is the generator point, $e$ is the private key, $n$ is the order of $G$, $z$ is the message hash and $k\in [1,n-1]$.

$u = z\times s^{-1}$ and
$v = r\times s^{-1} \bmod n$.

If $u\times G+v\times P=(r,y)$, then signature is valid.

The math works for this, but why isn't something much easier done?

$P=e\times G$, $(r,y)=k\times G$ and $s=(k-rz)\times e^{-1}$

$rz\times G+s\times P=rz\times G+((k-rz)\times e^{-1})\times P=rz\times G+((k-rz)\times e^{-1})\times e\times G)=rz\times G+(k-rz)\times G=rz\times G+k\times G-rz\times G=k\times G=(r,y)$

So $r,s$ can be used almost directly in the $u\times G+v\times P$ equation and the same condition be used to check that the signature is valid. In addition, the formulation does not use as much division, which is computationally the most expensive part.

I'm sure there's some vulnerability with this more naive signature scheme. What is that vulnerability?

Answer 1

In the actual ECDSA, $(r,s)$ is called the signature of the message $m$ whose hash is $z$ i.e. $z=H(m)$.
By removing $z$ from the equation, you have completely eliminated any correlation of this "new incorrect signature" (which isn't even a signature) with the message, which is completely against the notion of a digital signature being a representative of the message which has been signed. If digital signatures did not depend on the messages, then anyone could just strip off a signature by someone, say $A$, from one message and use this signature to sign any document of their choice without $A$ even knowing.
In ECDSA, it is the $s$ value which is coupled with the message hash $z$, so if the $s$ value is completely independent of $z$ (and therefore $m$), then (r,s) is not at all a signature. It is then just a random linear equation between 2 points on an elliptic curve.