Wikipidia says Schnorr signature generation is defined like this:
Y = x * G //this is the key we are trying to provide a signature for
k = random scalar
r = k * G
e = Hash_to_scalar(r || message)
s = k - xe
signature = (s, e)
This seems correct, but then to verify it's defined as:
r = s * G * e * Y
e = Hash_to_scalar(r || message)
Shouldn't it be:
r = s * G + e * Y
e = Hash_to_scalar(r || message)
because:
r = k - xe * G + ex * G == k * G; //this works
r = k - xe * G * ex * G != k * G; //this doesnt work
Or have I made a silly mistake somewhere?