<p>To prove the validity of the signature, we must see that the tuple <em>(R,s)</em> actually came from the private key <em>x</em>. In particular that <em>s</em> was derived as <em>s=r+cx</em>. Obviously, we should not possess the private key <em>x</em> (which is the reason why we need this verification equation) so</p>
<ol>
<li>Looking at <em>g<sup>s</sup> = RX<sup>c</sup></em>, we realize that we know <em>(R,s), X</em> and <em>c</em> (since <em>c = H(X,R,m)</em> and the public key <em>X</em> is known). As the generator <em>g</em> is also known, we can actually compute both sides of the equation.</li>
<li>Since <em>s=r+cx</em>, we know that <em>g<sup>s</sup> = g<sup>r+cx</sup></em></li>
<li>Since we do these calculations in a <strong>cyclic</strong> group of <strong>prime order</strong> we can apply the following rules: g<sup>a + b</sup> = g<sup>a</sup>g<sup>b</sup> and g<sup>ab</sup> = (g<sup>a</sup>)<sup>b</sup> (As far as I understand, this is the reason why the group needs to be cyclic and of prime order.)</li>
<li>Thus, <em>g<sup>s</sup> = g<sup>r+cx</sup> = g<sup>r</sup>g<sup>cx</sup></em></li>
<li>Recalling <em>R = g<sup>r</sup></em> and entering it into the equation from 4. we get <em>g<sup>s</sup> = Rg<sup>cx</sup></em></li>
<li>Recalling the other rule from 3. we have <em>g<sup>s</sup> = Rg<sup>cx</sup> = R(g<sup>x</sup>)<sup>c</sup> = RX<sup>c</sup></em></li>
</ol>
<p>This is exactly the equation that was supposed to be shown.</p>
<p>Note the interesting fact that as mentioned in 1. all data needed to verify the equation is known but producing the data can only work if <em>x</em> and <em>r</em> are known. That is why the owner of <em>x</em> can produce the signature and others can verify it.</p>

CC BY-SA 4.0
2019-03-10T20:25:34.560Z
2020-10-08T14:16:54.453Z
2020-10-08T14:16:54.453Z
Rene Pickhardt
<p>Reading the bottom of page 2 of the <a href="https://eprint.iacr.org/2018/068.pdf" rel="nofollow noreferrer">Musig Paper</a> we can find that a Schnorr Signature for a cyclic Group <em>G</em> of prime order <em>p</em> with generator <em>g</em> is a tuple <em>(R,s)</em> where</p>
<ul>
<li><em>R = g<sup>r</sup></em> for a random secret <em>r</em> and</li>
<li><em>s=r+cx</em> where <em>c = H(X,R,m)</em> for a message <em>m</em>, some Hashfunction <em>H</em> and the public key <em>X = g<sup>x</sup></em> corresponding to the private key <em>x</em>.</li>
</ul>
<p>It is further stated that such a signature <em>(R,s)</em> can be verified using the equation <em>g<sup>s</sup> = RX<sup>c</sup></em></p>
<p>I would like to know why that last equation proves the validity of the signature?</p>

<signature><cryptography><schnorr-signatures><math>
Why is the Schnorr verification formula working and actually verifying the validity of a signature?
Rene Pickhardt
# Why is the Schnorr verification formula working and actually verifying the validity of a signature?

(Asked by: username_0 on 2019-03-10)

Reading the bottom of page 2 of the [Musig Paper](https://eprint.iacr.org/2018/068.pdf) we can find that a Schnorr Signature for a cyclic Group *G* of prime order *p* with generator *g* is a tuple *(R,s)* where

* *R = gr* for a random secret *r* and
* *s=r+cx* where *c = H(X,R,m)* for a message *m*, some Hashfunction *H* and the public key *X = gx* corresponding to the private key *x*.

It is further stated that such a signature *(R,s)* can be verified using the equation *gs = RXc*

I would like to know why that last equation proves the validity of the signature?

**Tags:** signature, cryptography, schnorr-signatures, math


---

## 1 answers

### Answer by username_0 on 2019-03-10. Score: 3 | Accepted answer

To prove the validity of the signature, we must see that the tuple *(R,s)* actually came from the private key *x*. In particular that *s* was derived as *s=r+cx*. Obviously, we should not possess the private key *x* (which is the reason why we need this verification equation) so

1. Looking at *gs = RXc*, we realize that we know *(R,s), X* and *c* (since *c = H(X,R,m)* and the public key *X* is known). As the generator *g* is also known, we can actually compute both sides of the equation.
2. Since *s=r+cx*, we know that *gs = gr+cx*
3. Since we do these calculations in a **cyclic** group of **prime order** we can apply the following rules: ga + b = gagb and gab = (ga)b (As far as I understand, this is the reason why the group needs to be cyclic and of prime order.)
4. Thus, *gs = gr+cx = grgcx*
5. Recalling *R = gr* and entering it into the equation from 4. we get *gs = Rgcx*
6. Recalling the other rule from 3. we have *gs = Rgcx = R(gx)c = RXc*

This is exactly the equation that was supposed to be shown.

Note the interesting fact that as mentioned in 1. all data needed to verify the equation is known but producing the data can only work if *x* and *r* are known. That is why the owner of *x* can produce the signature and others can verify it.


---

