<p>Schnorr signatures were patented by their creator, Claus Schnorr, and required permission from him in order to be used. The Digital Signature Algorithm (DSA) is similar to the Schnor signature scheme but is made available publicly for free by the US government.</p>

<p>DSA is largely an alternative to Schnorr and needed to be different enough from it so that it would not violate Schnorr's patent. Part of this is different signing and verification formulas.</p>

<p>So what you are seeing is part of the difference between DSA and Schnorr. Bitcoin currently uses DSA over an Elliptic Curve (ECDSA) and the proposed bip-schnorr uses Schnorr signatures over an Elliptic Curve. Thus the differences that you are seeing are because ECDSA and EC-Schnorr are two different algorithms designed to avoid each other's patents.</p>

CC BY-SA 4.0
2019-06-09T09:06:59.680Z
2019-06-09T09:06:59.680Z
Ava Chow
<p>A <a href="https://medium.com/cryptoadvance/how-schnorr-signatures-may-improve-bitcoin-91655bcb4744" rel="nofollow noreferrer">bitcoin signature</a> has:
z = hash(m)</p>
<blockquote>
<p>Using a private key pk we can generate a signature for message m
consisting of two numbers: <strong>r</strong> (<strong>x</strong> coordinate of the random point <strong>R =
k×G</strong>) and <strong>s = (z+r⋅pk)/k</strong>. Then, using our public key <strong>P = pk×G</strong> anyone
can verify our signature by checking that point (<strong>z/s)×G+(r/s)×P</strong> has <strong>x</strong>
coordinate equal to <strong>r.</strong></p>
</blockquote>
<p><a href="https://blockstream.com/2018/01/23/en-musig-key-aggregation-schnorr-signatures/" rel="nofollow noreferrer">Aggregate Schnorr</a> has:</p>
<blockquote>
<p>Call <strong>L = H(X1,X2,…)</strong></p>
<p>Each signer chooses a random nonce <strong>ri</strong>, and shares <strong>Ri = riG</strong> with the other signers</p>
<p>Call <strong>R</strong> the sum of the <strong>Ri</strong> points</p>
<p>Each signer computes <strong>si = ri + H(L,Xi,R,m)xi</strong></p>
<p>The final signature is (R,s) where s is the sum of the <strong>si</strong> values</p>
<p>Verification requires <strong>sG = R + H(L,X1,R,m)X1 + H(L,X2,R,m)X2 + …</strong></p>
</blockquote>
<p>Why do the hash and the random value swap places in the aggregate Schnorr sig?</p>

CC BY-SA 4.0
2019-06-08T09:01:36.527Z
I don't understand what swapping you're talking about.
Pieter Wuille
CC BY-SA 4.0
2019-06-08T09:06:21.210Z
@PieterWuille The z in the first formula is a hash of the message and is added, while the random r is the slope. In the aggregate Schnorr I assume there is a reason for the Hash H to be multiplied by the private key while the random r is added.
user5389726598465
CC BY-SA 4.0
2019-06-08T09:26:56.357Z
Oh, that's just the distinction between DSA and Schnorr. They're very similar, but DSA was designed to avoid the patent on Schnorr signatures.
Pieter Wuille
<schnorr-signatures>
Why do aggregate Schnorr signatures reverse the hash and the random number
user5389726598465
# Why do aggregate Schnorr signatures reverse the hash and the random number

(Asked by: username_0 on 2019-06-07)

A [bitcoin signature](https://medium.com/cryptoadvance/how-schnorr-signatures-may-improve-bitcoin-91655bcb4744) has:
z = hash(m)

> Using a private key pk we can generate a signature for message m
> consisting of two numbers: **r** (**x** coordinate of the random point **R =
> k×G**) and **s = (z+r⋅pk)/k**. Then, using our public key **P = pk×G** anyone
> can verify our signature by checking that point (**z/s)×G+(r/s)×P** has **x**
> coordinate equal to **r.**

[Aggregate Schnorr](https://blockstream.com/2018/01/23/en-musig-key-aggregation-schnorr-signatures/) has:

> Call **L = H(X1,X2,…)**
>
> Each signer chooses a random nonce **ri**, and shares **Ri = riG** with the other signers
>
> Call **R** the sum of the **Ri** points
>
> Each signer computes **si = ri + H(L,Xi,R,m)xi**
>
> The final signature is (R,s) where s is the sum of the **si** values
>
> Verification requires **sG = R + H(L,X1,R,m)X1 + H(L,X2,R,m)X2 + …**

Why do the hash and the random value swap places in the aggregate Schnorr sig?

**Tags:** schnorr-signatures

> **Comments:**
> **username_1**: I don't understand what swapping you're talking about.  
> **username_0**: @username_1 The z in the first formula is a hash of the message and is added, while the random r is the slope. In the aggregate Schnorr I assume there is a reason for the Hash H to be multiplied by the private key while the random r is added.  
> **username_1**: Oh, that's just the distinction between DSA and Schnorr. They're very similar, but DSA was designed to avoid the patent on Schnorr signatures.  

---

## 1 answers

### Answer by username_2 on 2019-06-09. Score: 1

Schnorr signatures were patented by their creator, Claus Schnorr, and required permission from him in order to be used. The Digital Signature Algorithm (DSA) is similar to the Schnor signature scheme but is made available publicly for free by the US government.

DSA is largely an alternative to Schnorr and needed to be different enough from it so that it would not violate Schnorr's patent. Part of this is different signing and verification formulas.

So what you are seeing is part of the difference between DSA and Schnorr. Bitcoin currently uses DSA over an Elliptic Curve (ECDSA) and the proposed bip-schnorr uses Schnorr signatures over an Elliptic Curve. Thus the differences that you are seeing are because ECDSA and EC-Schnorr are two different algorithms designed to avoid each other's patents.


---

