# DSA signature generation [duplicate]

I am trying to implement given DSA signature generation instructions in python, there are few instructions that I couldn't understand in step 3 and 4.

Let m be an arbitrary length message. The signature is computed as follows:

1. generate k (i.e., k is a random integer in [0, q − 1])
2. r = g^^k(mod p)
3. h = SHA3 256(m||r)

What does m||r mean? m is a message length r is also a number so what should be the input of hashlib.sha3_256(input) function? As I see in Python it says input must be a string (converted to byte).

4. s = α · h + k (mod q)

h is a string returned by sha3_256 so how do I multiply it with α?

5. The signature for m is the tuple (s, h)

## marked as duplicate by Maarten Bodewes♦, kelalaka, Community♦Dec 11 '18 at 19:46

The $$\parallel$$ notation means concatenation. In this case, take the message $$m$$ (it's a sequence of bits), encode the value $$r$$ as a sequence of bits, and hash the sequence of bits that consists in $$m$$ followed by the encoded $$r$$.
By the way, this is not DSA. DSA is specified by FIPS 186-4. What you describe is known as Schnorr signatures (there are several variants, e.g. on the order of $$m$$ and $$r$$ in the concatenation, or whether $$s = \alpha h + k$$ or $$s = \alpha h - k$$; all these variants procure more-or-less equivalent security). Historically, the distinction was important: DSA was defined at a time when Schnorr had patented his scheme, and the definition of DSA was carefully made to avoid that patent. Cryptographically, the difference also matters: the "security picture" of Schnorr signatures is better (we can make security proofs on Schnorr signatures, but we don't know how to do that with DSA; and DSA signatures are malleable, a property which is usually harmless but has allowed replay attacks in Bitcoin in the past).