A Schnorr signature is a public-key proof that a private key holder signed a document. Its elliptic-curve form combines a random commitment point, a hash-derived challenge, and a response value. section 5.0 section 5.1
Generate and verify the signature through these operations:
- Generate a key pair with private scalar sₚ and public point Pₚ = sₚB, where B has prime order n. section 5.1.1
- Choose a fresh random k from 1 through n − 1, then compute the commitment point Q = kB. section 5.1.1
- Hash Q.x, Q.y, and the message M to obtain e = hash(Q.x || Q.y || M) mod n. section 5.1.1
- Compute s = k − e·sₚ mod n; the signature is the pair (Q, s). section 5.1.1
- Recompute e and accept only when Q equals sB + ePₚ; otherwise reject the signature. section 5.1.1
Equation 5.1
\[\label{sq1} e=\text{hash}(Q.x||Q.y||M)\text{ mod }n\]Use the challenge equation to connect message encoding, commitment coordinates, hashing, and modular reduction. section 5.1.1
Implementation stores Q as an elliptic-curve point and s as a multiprecision integer. It exports Q.x and Q.y as bytes, appends the message, hashes the resulting buffer, and performs modular multiplication and subtraction. Fixed byte handling avoids inconsistencies from omitted null bytes or differing machine word sizes. section 5.1.2
File-signing test
Read sign_test.txt into a bounded buffer, initialize the signature point and scalar, sign the bytes, and pass the same bytes to verification. The test reports success when the message is unchanged; even one altered bit causes verification to fail. section 5.1.4
The nonce k should be fresh for every signature and should not have unusually low or high Hamming weight. After signing, k can be discarded. Schnorr uses more signature space than ECDSA but requires slightly less computation. section 5.1.1 section 5.0
