Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
As per How does recovering the public key from an ECDSA signature work? , it's possible to recover public keys from ECDSA signatures.
Is this possible for EC-Schnorr signatures as well?
I'm looking specifically at https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki as a reference on EC-Schnorr, but it seems to have nothing on pubkey recovery.
Fix a group $E(k)$ on an elliptic curve over a field $k$. Suppose $P \in E(k)$ is a public key. If a signature on a message $m$ under $P$ is the encoding of a pair $(R, s)$ of a point $R \in E(k)$ and an integer $s$ satisfying (various criteria and) the equation $$[s]G = R + [H(R \mathbin\| m)]P,$$ where $G$ is the standard base point, then you can recover $$P' = [H(R \mathbin\| m)^{-1}]([s]G - R),$$ where $H(R \mathbin\| m)^{-1}$ is the inverse in the scalar ring of $E(k)$, if there is an inverse, which is guaranteed if $E(k)$ has prime order like secp256k1. In groups of composite order like edwards25519 or FourQ, $P'$ may not be equal to $P$ but it may serve as equivalent to $P$ for the purposes of signature verification.
However, while that equation is discussed as an option in the BIP-Schnorr document, that's not the option they chose. Rather, they chose a design where a signature is the encoding of a pair $(r, s)$ of a coordinate $r \in k$ and a scalar $s$ satisfying (various criteria and) the equation $$r = x([s]G - [H(r \mathbin\| P \mathbin\| m)]P),$$ somewhat like Ed25519, about which see for a related discussion of key privacy as even further from key recovery. This leaves you with the snag that to compute $H(r \mathbin\| P \mathbin\| m)$ you must know $P$ already, or know some black magic to break the hash $H$.
So no, the signature scheme in the documented you cited does not enable recovery of the public key from signatures.
