# Necessary Schnorr signature non-interactive challenge bindings

Some implementations of a Schnorr signature will determine the challenge as follows:

$$c=H(kG \mathbin\| X \mathbin\| m)==H(rG+cX \mathbin\| X \mathbin\| m)$$, where:

$$c$$ is the challenge
$$m$$ is the message being signed
$$X$$ is the public key of the signer such that $$X=xG$$
$$G$$ is a well-known base point
$$x$$ is the private key of the signer
$$r$$ is the response to the challenge, calculated as $$r=k-cx$$
$$k$$ is a uniformly random nonce

However, some Schnorr signatures do not bind the public key $$X$$ of the signer into the challenge hash. Thus, $$c=H(kG \mathbin\| m)$$.

What possible attacks are prevented by including $$X$$ in the challenge hash?

Note that the signature could either be communicated as the pair $$(c,r)$$, or as the pair $$(K,r)$$ where $$K=kG$$.

It's a rather contrived scenario, but suppose that there are two verification keys $$X_1=x_1G$$ and $$X_2=x_2G$$ belonging to two distinct signers and suppose that the attacker does not know either $$x_1$$ nor $$x_2$$ but does know the difference between them, say $$x_1=x_2+b$$. They could then use a signature from signer 1 to forge a signature from signer 2 on the same piece of data (and vice-versa) with the unbound scheme.
To do this they'd take the $$r_1$$ from signer 1's signature and replace it with $$r_2=r_1+bc$$.