Wikipidia says Schnorr signature generation is defined like this:
Y = x * G //this is the key we are trying to provide a signature for k = random scalar r = k * G e = Hash_to_scalar(r || message) s = k - xe signature = (s, e)
This seems correct, but then to verify it's defined as:
r = s * G * e * Y e = Hash_to_scalar(r || message)
Shouldn't it be:
r = s * G + e * Y e = Hash_to_scalar(r || message)
r = k - xe * G + ex * G == k * G; //this works r = k - xe * G * ex * G != k * G; //this doesnt work
Or have I made a silly mistake somewhere?