# Is Wikipidia wrong about Schnorr Signatures?

Wikipidia says Schnorr signature generation is defined like this:

Y = x * G //this is the key we are trying to provide a signature for
k = random scalar
r = k * G
e = Hash_to_scalar(r || message)
s = k - xe
signature = (s, e)


This seems correct, but then to verify it's defined as:

r = s * G * e * Y
e = Hash_to_scalar(r || message)


Shouldn't it be:

r = s * G + e * Y
e = Hash_to_scalar(r || message)


because:

r = k - xe * G + ex * G == k * G; //this works
r = k - xe * G * ex * G != k * G; //this doesnt work


Or have I made a silly mistake somewhere?

• Why should $k - xe + ex * G$ be equal to $k * G$ ? Nov 16, 2018 at 12:55
• Ah i made a typo. i mean k - xe * G + ex * G. edited now Nov 16, 2018 at 13:00
• Since Wikipedia pages evolve, it is a good idea to look at the version history to find the version that you probably looked at, rather than the most recent version.
– user63532
Nov 16, 2018 at 16:11

The equation in Wikipedia is r = s*G + e*Y, and not r = s*G * e*Y
Thus, r = s*G + e*Y = (k - xe)*G + e*(x*G) = k*G - xe*G + xe*G = k*G
• @Thomas Pornin: useful fix! But the signature scheme as originally described differs slightly: the signature is $\left(H\left(g^k\mathbin\|M\right), k+x\,H\left(g^k\mathbin\|M\right)\right)$ with the hash much shorter than $q$; also notice the $+$ (Claus-Peter Schnorr described both as features). Detailed description of the original scheme and bibliography there. Practice often differs, especially for Elliptic Curve variants, taxonomy there.