<p>There are no security risks to this since <code>e</code> is public anyway. Depending on how you are using it you probably want to make sure that <code>e</code> is consistent with R afterwards i.e. recompute <code>e</code> from <code>P</code> and <code>R</code> and <code>m</code> to make sure it is correct. However, it makes more sense to me to just include <code>P</code> directly instead of <code>e</code>.</p>

CC BY-SA 4.0
2022-03-30T16:44:50.137Z
Okay, thank you @LLFourn. But my point/question is to derive publicKey from signature.
Prasanth Vuppala
CC BY-SA 4.0
2022-04-01T04:52:16.093Z
But it's the same amount of data to just include `P`. Why can't extracting the trailing 32 bytes count as deriving?
LLFourn
CC BY-SA 4.0
2022-03-29T22:49:44.017Z
2022-03-29T22:49:44.017Z
LLFourn
<p>We know unlike <code>ecrecover</code>, it is impossible to get to public key given schnorr signature = (r,s) since rG = sG-eP .
So, would like to understand what are the security risks,</p>
<p>if we say
<code>signature=F(r,s,e)</code></p>
<p>and get to publicKey at the verification? something like this
<code>P = (rG-sG)/e</code></p>

CC BY-SA 4.0
2022-03-29T13:57:46.540Z
What is `F()` ?
Pieter Wuille
CC BY-SA 4.0
2022-03-30T16:39:52.980Z
I meant concatenation @PieterWuille
Prasanth Vuppala
<multi-signature><public-key><secp256k1><schnorr-signatures>
What will be the security risks if we persist "e" as part of schnorr signature=(r,s,e) and extract publicKey from signature at verification
Prasanth Vuppala
# What will be the security risks if we persist "e" as part of schnorr signature=(r,s,e) and extract publicKey from signature at verification

(Asked by: username_0 on 2022-03-29)

We know unlike `ecrecover`, it is impossible to get to public key given schnorr signature = (r,s) since rG = sG-eP .
So, would like to understand what are the security risks,

if we say
`signature=F(r,s,e)`

and get to publicKey at the verification? something like this
`P = (rG-sG)/e`

**Tags:** multi-signature, public-key, secp256k1, schnorr-signatures

> **Comments:**
> **username_1**: What is `F()` ?  
> **username_0**: I meant concatenation @username_1  

---

## 1 answers

### Answer by username_2 on 2022-03-29. Score: 2

There are no security risks to this since `e` is public anyway. Depending on how you are using it you probably want to make sure that `e` is consistent with R afterwards i.e. recompute `e` from `P` and `R` and `m` to make sure it is correct. However, it makes more sense to me to just include `P` directly instead of `e`.

> **Comments:**
> **username_0**: Okay, thank you @username_2. But my point/question is to derive publicKey from signature.  
> **username_2**: But it's the same amount of data to just include `P`. Why can't extracting the trailing 32 bytes count as deriving?  

---

