<p><strong>No, it’s not safe. If the random nonce <code>k</code> is revealed, the counterparty can calculate your private key.</strong></p>
<p>A Schnorr signature is composed of two scalars <code>(r,s)</code>. Where <code>r</code> is the x coordinate of a point <code>R</code> generated from a random nonce <code>k</code>. If I understand you right, you are asking whether it’s safe to reveal this <code>k</code>.</p>
<p>A Schnorr signature is generated in the following manner:</p>
<ul>
<li>m: message</li>
<li>x: private key</li>
<li>P: public key; <code>P = x×G</code></li>
<li>k: random nonce</li>
<li>R: random point; <code>R = k×G</code></li>
<li><code>r = R.x</code> (x coordinate of random point R)</li>
<li><code>s = k + hash(P,R,m)•x</code></li>
</ul>
<p>If both sides of the last equation are multiplied with the generator point G:</p>
<pre><code>s = k + hash(P,R,m)•x
s×G = (k + hash(P,R,m)•x)×G
s×G = k×G + hash(P,R,m)•x×G
s×G = R + hash(P,R,m)•P
</code></pre>
<p>So, any third party can check whether the signature is valid by plugging  <code>(r,s)</code>, the message <code>m</code> from the context of the transaction, and the public key <code>P</code> from either the prior output or the witness structure into:</p>
<pre><code>s×G = R + hash(P,R,m)•P
</code></pre>
<p>If the equation holds, the signature proves that the signer knew the private key <code>x</code> corresponding to the public key <code>P</code>.</p>
<p><strong>No, it is not safe to share <code>k</code></strong>, because given <code>k</code> the counterparty can solve for the private key in this equation only composed of scalars:</p>
<pre><code>x = (s - k) / hash(P,R,m)
</code></pre>

CC BY-SA 4.0
2023-03-21T15:28:14.027Z
2023-03-21T17:24:13.090Z
2023-03-21T17:24:13.090Z
Murch
<p>I'm curious about stuffing data in the auxiliary parameter of generating the schnorr nonce.</p>
<p>Something like &quot;Alice agrees to pay 1 BTC to Bob within 5 days of Monday March 20th&quot;.</p>
<p>I want to put data in there to prove to people that it's there without jeopardizing security. Or does it open me up to an attack once S is revealed on chain?</p>
<p>Or should I put it in the hash that scales the public key. Adding it to the tweak?</p>

<schnorr-signatures>
Is it safe to reveal the private key that generates the R nonce in schnorr sigs?
Kaizen
# Is it safe to reveal the private key that generates the R nonce in schnorr sigs?

(Asked by: username_0 on 2023-03-21)

I'm curious about stuffing data in the auxiliary parameter of generating the schnorr nonce.

Something like "Alice agrees to pay 1 BTC to Bob within 5 days of Monday March 20th".

I want to put data in there to prove to people that it's there without jeopardizing security. Or does it open me up to an attack once S is revealed on chain?

Or should I put it in the hash that scales the public key. Adding it to the tweak?

**Tags:** schnorr-signatures


---

## 1 answers

### Answer by username_1 on 2023-03-21. Score: 3

**No, it’s not safe. If the random nonce `k` is revealed, the counterparty can calculate your private key.**

A Schnorr signature is composed of two scalars `(r,s)`. Where `r` is the x coordinate of a point `R` generated from a random nonce `k`. If I understand you right, you are asking whether it’s safe to reveal this `k`.

A Schnorr signature is generated in the following manner:

* m: message
* x: private key
* P: public key; `P = x×G`
* k: random nonce
* R: random point; `R = k×G`
* `r = R.x` (x coordinate of random point R)
* `s = k + hash(P,R,m)•x`

If both sides of the last equation are multiplied with the generator point G:

```
s = k + hash(P,R,m)•x
s×G = (k + hash(P,R,m)•x)×G
s×G = k×G + hash(P,R,m)•x×G
s×G = R + hash(P,R,m)•P

```

So, any third party can check whether the signature is valid by plugging `(r,s)`, the message `m` from the context of the transaction, and the public key `P` from either the prior output or the witness structure into:

```
s×G = R + hash(P,R,m)•P

```

If the equation holds, the signature proves that the signer knew the private key `x` corresponding to the public key `P`.

**No, it is not safe to share `k`**, because given `k` the counterparty can solve for the private key in this equation only composed of scalars:

```
x = (s - k) / hash(P,R,m)

```


---

