The original Schnorr signature scheme suffers from a Related Key Attack (RKA) as described by Morita et al. The authors of this paper then suggest a modification to the signature algorithm to prevent a RKA as follows:
- Set $\psi \leftarrow g^x$, where $x$ is the private (signing) key for the scheme.
- Set the challenge hash to be $h \leftarrow H(M || r || \psi)$.
The second step above differs from the original Schnorr scheme (here) that only requires $h \leftarrow H(r || M)$.
This modification makes sense, however the paper by Morita et al. says (on page 9):
"Note that the second step of the signing algorithm, computation of $\psi \leftarrow g^x$, should not be altered to simply use the verification key $y$ as $\psi$."
The authors don't explain why $y$ (the public / verification key) cannot be used in place of $\psi$, even though are exactly the same value - is there a reason for this?
What makes this even more confusing is that with Schnorr being added to Bitcoin in the Taproot soft fork, Bitcoin Core developers have written their own implementation for Schnorr signatures (as described in BIP340), including the mitigations for RKA. However, in BIP340, they have decided to use $y$ in the challenge hash over $\psi$, going against the recommendation from earlier.
Is this implementation wrong?