Assume a Schnorr-signature scheme in an elliptic curve setting with a publicly known generator base point $G$ where the the discrete logarithm is hard. That is, given $x \cdot G$, it is hard to find $x$. I am curious to know if this signature scheme can be used to perform public key validation in the following sense:
- Alice provides Bob with a signature $(e,s)$ for some message $m$ and a public key $Y$.
- Bob verifies that the signature $(e,s)$ like so:
- Calculate $R = (s \cdot G) - (e \cdot Y)$
- Set $e_v = H(R_x || m)$
- Accept signature iff $e_v = e$
Can this scheme be used to ensure the public key provided by Alice is indeed of the form $Y = n \cdot G$ (and not say of another form $Y = n \cdot G + n' \cdot G'$?). Assume Alice is computationally bounded and in particular cannot solve the discrete logarithm problem. Or is there a way for Alice to carefully choose the values $(e,s)$ such that Bob accepts the signature even if $Y$ is of them form $Y = x \cdot G + x' \cdot G'$?