<p>This is trivial to forge.</p>
<p>Just to make sure we're on the same page, this is your protocol:</p>
<p>Alice has private key <code>x</code>, Bob has public key <code>Q</code>:</p>
<ul>
<li>Alice generates <code>k</code>, computes <code>R = kG</code>, and sends <code>R</code> to Bob.</li>
<li>Bob generates <code>e</code>, and sends it to Alice.</li>
<li>Alice computes <code>s = k + e + x</code>, and sends it to Bob.</li>
<li>Bob verifies that <code>sG = R + eG + Q</code>.</li>
</ul>
<hr />
<p>Mallory is running your modified protocol with Bob, trying to pretend to be Alice.</p>
<ul>
<li>Mallory generates a random <code>k</code> and sends <code>R = kG - Q</code> to Bob.</li>
<li>Bob generates <code>e</code> and sends it to Mallory.</li>
<li>Mallory computes <code>s = k + e</code> and sends it to Bob.</li>
<li>Bob verifies that <code>sG = R + eG + Q</code>. This will always hold.</li>
</ul>
<p>Thus, Mallory successfully impersonated Alice, without having access to <code>x</code>.</p>

CC BY-SA 4.0
2024-01-30T23:18:10.950Z
Ah I see, thanks!
yonson
CC BY-SA 4.0
2024-01-29T23:17:00.550Z
2024-01-30T18:37:25.347Z
2024-01-30T18:37:25.347Z
Pieter Wuille
<p>If Alice wants to prove to Bob she is the holder of private key <code>x</code>, without exposing <code>x</code>, they can use the Schnorr identification protocol which has the public function <code>sG = kG + exG</code> and the private scalar function <code>s = k +ex</code>. In these functions, <code>G</code> is the static generator point, <code>k</code> is a hidden nonce chosen by Alice to protect <code>x</code> from being revealed to Bob, and <code>e</code> is a nonce chose by Bob so that he can trust <code>kG</code> (can't be calculated by someone pretending to hold <code>x</code>).</p>
<p>This all makes sense to me, but I am curious if there is a reason that <code>e</code> is multiplied with <code>x</code> instead of just following the same addition operator as <code>k</code>. So the equations would become <code>sG = kG + eG + xG</code> and <code>s = k + e + x</code>. <code>k</code> has a very valid reason to use addition, that is how <code>x</code> remains hidden. I can't think of a meaningful difference for the goal of the protocol if <code>e</code> is multiplied or added, maybe I missing a core concept?</p>

CC BY-SA 4.0
2024-01-30T05:04:23.383Z
I don't see how this is related to Bitcoin. Perhaps this question would be more suitable for [Cryptography Stack Exchange](https://crypto.stackexchange.com/) (they even have a tag named [schnorr-identification](https://crypto.stackexchange.com/tags/schnorr-identification)).
Vojtěch Strnad
<cryptography><schnorr-signatures><authentication>
Why is the challenge scalar multiplied with the private key scalar In the Schnorr identification protocol?
yonson
# Why is the challenge scalar multiplied with the private key scalar In the Schnorr identification protocol?

(Asked by: username_0 on 2024-01-29)

If Alice wants to prove to Bob she is the holder of private key `x`, without exposing `x`, they can use the Schnorr identification protocol which has the public function `sG = kG + exG` and the private scalar function `s = k +ex`. In these functions, `G` is the static generator point, `k` is a hidden nonce chosen by Alice to protect `x` from being revealed to Bob, and `e` is a nonce chose by Bob so that he can trust `kG` (can't be calculated by someone pretending to hold `x`).

This all makes sense to me, but I am curious if there is a reason that `e` is multiplied with `x` instead of just following the same addition operator as `k`. So the equations would become `sG = kG + eG + xG` and `s = k + e + x`. `k` has a very valid reason to use addition, that is how `x` remains hidden. I can't think of a meaningful difference for the goal of the protocol if `e` is multiplied or added, maybe I missing a core concept?

**Tags:** cryptography, schnorr-signatures, authentication

> **Comments:**
> **username_1**: I don't see how this is related to Bitcoin. Perhaps this question would be more suitable for [Cryptography Stack Exchange](https://crypto.stackexchange.com/) (they even have a tag named [schnorr-identification](https://crypto.stackexchange.com/tags/schnorr-identification)).  

---

## 1 answers

### Answer by username_2 on 2024-01-29. Score: 4 | Accepted answer

This is trivial to forge.

Just to make sure we're on the same page, this is your protocol:

Alice has private key `x`, Bob has public key `Q`:

* Alice generates `k`, computes `R = kG`, and sends `R` to Bob.
* Bob generates `e`, and sends it to Alice.
* Alice computes `s = k + e + x`, and sends it to Bob.
* Bob verifies that `sG = R + eG + Q`.

---

Mallory is running your modified protocol with Bob, trying to pretend to be Alice.

* Mallory generates a random `k` and sends `R = kG - Q` to Bob.
* Bob generates `e` and sends it to Mallory.
* Mallory computes `s = k + e` and sends it to Bob.
* Bob verifies that `sG = R + eG + Q`. This will always hold.

Thus, Mallory successfully impersonated Alice, without having access to `x`.

> **Comments:**
> **username_0**: Ah I see, thanks!  

---

