In a Schnorr signature (Wikipedia style), we have:
- $R = kG$, where $0<k<n$ is a nonce and $G$ is the generator point.
- $e = H(R \| M) \bmod n$, where $H()$ is a hashing function and $M$ is the message.
- Finally $s = k - xe \bmod n$, where $x$ is the private key. The signature is then either $(R,s)$ or $(e,s)$ depending on convention.
- Verifiers check that $R = sG + eP$, where $P = xG$ is the public key.
Strangely, if $e=0$ then no knowledge of $x$ is proven, as all steps can be carried out by someone who knows only $M$. So, why is $e=0$ not disallowed?
The only answer I can find to this is that breaking the hash function to obtain $e=0$ should generally have twice the security level (in bits) of that required to directly break the public key. And, it is most convenient to skip the extra steps of checking zero-ness of $e$, so for practical reasons the case of $e=0$ is glossed over.