Some implementations of a Schnorr signature will determine the challenge as follows:

$c=H(kG \mathbin\| X \mathbin\| m)==H(rG+cX \mathbin\| X \mathbin\| m)$, where:

$c$ is the challenge
$m$ is the message being signed
$X$ is the public key of the signer such that $X=xG$
$G$ is a well-known base point
$x$ is the private key of the signer
$r$ is the response to the challenge, calculated as $r=k-cx$
$k$ is a uniformly random nonce

However, some Schnorr signatures do not bind the public key $X$ of the signer into the challenge hash. Thus, $c=H(kG \mathbin\| m)$.

What possible attacks are prevented by including $X$ in the challenge hash?

Note that the signature could either be communicated as the pair $(c,r)$, or as the pair $(K,r)$ where $K=kG$.


1 Answer 1


It's a rather contrived scenario, but suppose that there are two verification keys $X_1=x_1G$ and $X_2=x_2G$ belonging to two distinct signers and suppose that the attacker does not know either $x_1$ nor $x_2$ but does know the difference between them, say $x_1=x_2+b$. They could then use a signature from signer 1 to forge a signature from signer 2 on the same piece of data (and vice-versa) with the unbound scheme.

To do this they'd take the $r_1$ from signer 1's signature and replace it with $r_2=r_1+bc$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.