Schnorr Signatures

Cryptography · Axiom Academy

Simple and elegant signature scheme with many advantages Schnorr signatures use elliptic curve cryptography. The key generation process creates a private-public key pair: Choose a private key: Select a random integer x from the range [1, n-1], where n is the order of the elliptic curve group. Compute the public key: Calculate Y = xG , where G is the generator point of the elliptic curve. To create a Schnorr signature for a message m , the signer follows these steps: Pick a random nonce: Choose a random integer k (called the nonce) and compute the commitment point R = kG . Compute the challenge: Calculate e = H(R || Y || m) , where H is a cryptographic hash function (like SHA-256), and || denotes concatenation. Compute the response: Calculate s = k + ex (all arithmetic is modulo n ). Output the signature: The signature is the pair (R, s) or sometimes (e, s) . Anyone with the public key Y can verify a signature (R, s) on message m : Recompute the challenge: Calculate e = H(R || Y || m) using the same hash function. Verify the equation: Check that sG = R + eY . Accept or reject: If the equation holds, the signature is valid. Otherwise, reject it. Schnorr signatures have several properties that make them mathematically beautiful and practically useful: Schnorr signatures offer several practical advantages over other signature schemes like ECDSA:

This is the written version of the interactive lesson above. See the full Cryptography course.