<p><strong>No, it’s not safe. If the random nonce <code>k</code> is revealed, the counterparty can calculate your private key.</strong></p>
<p>A Schnorr signature is composed of two scalars <code>(r,s)</code>. Where <code>r</code> is the x coordinate of a point <code>R</code> generated from a random nonce <code>k</code>. If I understand you right, you are asking whether it’s safe to reveal this <code>k</code>.</p>
<p>A Schnorr signature is generated in the following manner:</p>
<ul>
<li>m: message</li>
<li>x: private key</li>
<li>P: public key; <code>P = x×G</code></li>
<li>k: random nonce</li>
<li>R: random point; <code>R = k×G</code></li>
<li><code>r = R.x</code> (x coordinate of random point R)</li>
<li><code>s = k + hash(P,R,m)•x</code></li>
</ul>
<p>If both sides of the last equation are multiplied with the generator point G:</p>
<pre><code>s = k + hash(P,R,m)•x
s×G = (k + hash(P,R,m)•x)×G
s×G = k×G + hash(P,R,m)•x×G
s×G = R + hash(P,R,m)•P
</code></pre>
<p>So, any third party can check whether the signature is valid by plugging  <code>(r,s)</code>, the message <code>m</code> from the context of the transaction, and the public key <code>P</code> from either the prior output or the witness structure into:</p>
<pre><code>s×G = R + hash(P,R,m)•P
</code></pre>
<p>If the equation holds, the signature proves that the signer knew the private key <code>x</code> corresponding to the public key <code>P</code>.</p>
<p><strong>No, it is not safe to share <code>k</code></strong>, because given <code>k</code> the counterparty can solve for the private key in this equation only composed of scalars:</p>
<pre><code>x = (s - k) / hash(P,R,m)
</code></pre>

CC BY-SA 4.0
2023-03-21T15:28:14.027Z
2023-03-21T17:24:13.090Z
2023-03-21T17:24:13.090Z
Murch
<p>I'm curious about stuffing data in the auxiliary parameter of generating the schnorr nonce.</p>
<p>Something like &quot;Alice agrees to pay 1 BTC to Bob within 5 days of Monday March 20th&quot;.</p>
<p>I want to put data in there to prove to people that it's there without jeopardizing security. Or does it open me up to an attack once S is revealed on chain?</p>
<p>Or should I put it in the hash that scales the public key. Adding it to the tweak?</p>

<schnorr-signatures>
Is it safe to reveal the private key that generates the R nonce in schnorr sigs?
Kaizen
# Is it safe to reveal the private key that generates the R nonce in schnorr sigs?

(Asked by: username_0 on 2023-03-21)

I'm curious about stuffing data in the auxiliary parameter of generating the schnorr nonce.

Something like "Alice agrees to pay 1 BTC to Bob within 5 days of Monday March 20th".

I want to put data in there to prove to people that it's there without jeopardizing security. Or does it open me up to an attack once S is revealed on chain?

Or should I put it in the hash that scales the public key. Adding it to the tweak?

**Tags:** schnorr-signatures


---

## 1 answers

### Answer by username_1 on 2023-03-21. Score: 3

No, it’s not safe. If the random nonce k is revealed, the counterparty can calculate your private key.
A Schnorr signature is composed of two scalars (r,s). Where r is the x coordinate of a point R generated from a random nonce k. If I understand you right, you are asking whether it’s safe to reveal this k.
A Schnorr signature is generated in the following manner:

m: message
x: private key
P: public key; P = x×G
k: random nonce
R: random point; R = k×G
r = R.x (x coordinate of random point R)
s = k + hash(P,R,m)•x

If both sides of the last equation are multiplied with the generator point G:
s = k + hash(P,R,m)•x
s×G = (k + hash(P,R,m)•x)×G
s×G = k×G + hash(P,R,m)•x×G
s×G = R + hash(P,R,m)•P

So, any third party can check whether the signature is valid by plugging  (r,s), the message m from the context of the transaction, and the public key P from either the prior output or the witness structure into:
s×G = R + hash(P,R,m)•P

If the equation holds, the signature proves that the signer knew the private key x corresponding to the public key P.
No, it is not safe to share k, because given k the counterparty can solve for the private key in this equation only composed of scalars:
x = (s - k) / hash(P,R,m)


---

