Given an elliptic curve defined in $\mathbb{F}_{q}$ with a generator $G$ and a hash function $H_{q}(x)$ which maps $x$ to $\mathbb{F}_{q}$. A Schnorr signature variation for a data block $B$ such as:

$SigGen(s, B)$:

  1. $m = H_{q}(s||B)$, $M = m \times G$
  2. $c = H_{q}(P||M||B)$
  3. $p = m + c \cdot s$
  4. Outputs $\sigma = (M, p)$

$\text{Verify}(P, B, \sigma)$:

  1. $c = H_{q}(P||M||B)$
  2. Check if $ p \times G \stackrel{?}{=} M + c \times P$

What would be the implications of changing $c = H_{q}(P||B)$, removing the dependency on $M$?

The only thing I can see is that there exists one $M^{*}$ such that $\sigma = (M, p) = (M^{*}, p)$ is equally valid. But an acceptable compromise in my point of view, if one actually needs to construct a scheme that maintains a deterministic value for $c$ given $B$.

Are there any other drawbacks?


1 Answer 1


OK, I found my own answer. A catastrophic drawback is $M = p \times G - c \times P$, by changing $c$ to any desired data block.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.