# Malleable version of Schnorr signature

Given an elliptic curve defined in $$\mathbb{F}_{q}$$ with a generator $$G$$ and a hash function $$H_{q}(x)$$ which maps $$x$$ to $$\mathbb{F}_{q}$$. A Schnorr signature variation for a data block $$B$$ such as:

$$SigGen(s, B)$$:

1. $$m = H_{q}(s||B)$$, $$M = m \times G$$
2. $$c = H_{q}(P||M||B)$$
3. $$p = m + c \cdot s$$
4. Outputs $$\sigma = (M, p)$$

$$\text{Verify}(P, B, \sigma)$$:

1. $$c = H_{q}(P||M||B)$$
2. Check if $$p \times G \stackrel{?}{=} M + c \times P$$

What would be the implications of changing $$c = H_{q}(P||B)$$, removing the dependency on $$M$$?

The only thing I can see is that there exists one $$M^{*}$$ such that $$\sigma = (M, p) = (M^{*}, p)$$ is equally valid. But an acceptable compromise in my point of view, if one actually needs to construct a scheme that maintains a deterministic value for $$c$$ given $$B$$.

Are there any other drawbacks?

## 1 Answer

OK, I found my own answer. A catastrophic drawback is $$M = p \times G - c \times P$$, by changing $$c$$ to any desired data block.