<p>So the scheme you suggest is that signatures are pairs <em>(R, s)</em> such that <em>sG = R + H(P,m)P</em>, where <em>P</em> is the public key, and <em>m</em> is the message.</p>
<p>Pick a random <em>s</em>. Set <em>R = sG - H(P,m)P</em>. <em>(R,s)</em> is now a valid signature for <em>P</em>, without knowing the corresponding private key. So this is a trivially forgeable signature scheme.</p>
<p>In ECDSA, the extraction of R's x coordinate, used as a scalar, plays the role of commitment in the signature to R.</p>

CC BY-SA 4.0
2020-07-11T08:26:53.037Z
You might want to mention that essentially the same problem exists for multiparty ECDSA.
G. Maxwell
CC BY-SA 4.0
2020-07-10T00:23:24.940Z
2020-07-10T00:23:24.940Z
Pieter Wuille
<p>I read the Schnorr and MuSig papers and stumbled over the problem that the use of deterministic nonces in multisignatures is not safe. The adversary would be able to extract the private key from the victim, if he initiates a second signing session with the victim on the same message, but changes his own public nonce.
This happens, because this changes also the partial signature of the victim. (s = r + c*x)
The challenge is constructed in this way : c=H(R||m)  (not key-prefixed version).</p>
<p>I'm wondering, would the exclusion of the public nonce from the H-sig challenge not result in a constant signature of all signers and therefore allow the use of deterministic nonces? The challenge could be c=H(m) or c=H(P||m).
Why is R (public nonce) in the first place included inside the hash function? I'm sure there is a good reason that I could not find.</p>
<p>ECDSA doesn't have that.</p>
<p>Thanks.</p>

<schnorr-signatures><musig>
Schnorr without R in the challenge
rage-proof
# Schnorr without R in the challenge

(Asked by: username_0 on 2020-07-09)

I read the Schnorr and MuSig papers and stumbled over the problem that the use of deterministic nonces in multisignatures is not safe. The adversary would be able to extract the private key from the victim, if he initiates a second signing session with the victim on the same message, but changes his own public nonce.
This happens, because this changes also the partial signature of the victim. (s = r + c\*x)
The challenge is constructed in this way : c=H(R||m) (not key-prefixed version).

I'm wondering, would the exclusion of the public nonce from the H-sig challenge not result in a constant signature of all signers and therefore allow the use of deterministic nonces? The challenge could be c=H(m) or c=H(P||m).
Why is R (public nonce) in the first place included inside the hash function? I'm sure there is a good reason that I could not find.

ECDSA doesn't have that.

Thanks.

**Tags:** schnorr-signatures, musig


---

## 1 answers

### Answer by username_1 on 2020-07-10. Score: 3

So the scheme you suggest is that signatures are pairs *(R, s)* such that *sG = R + H(P,m)P*, where *P* is the public key, and *m* is the message.

Pick a random *s*. Set *R = sG - H(P,m)P*. *(R,s)* is now a valid signature for *P*, without knowing the corresponding private key. So this is a trivially forgeable signature scheme.

In ECDSA, the extraction of R's x coordinate, used as a scalar, plays the role of commitment in the signature to R.

> **Comments:**
> **username_2**: You might want to mention that essentially the same problem exists for multiparty ECDSA.  

---

