We know unlike ecrecover, it is impossible to get to public key given schnorr signature = (r,s) since rG = sG-eP . So, would like to understand what are the security risks,

if we say signature=F(r,s,e)

and get to publicKey at the verification? something like this P = (rG-sG)/e


1 Answer 1


There are no security risks to this since e is public anyway. Depending on how you are using it you probably want to make sure that e is consistent with R afterwards i.e. recompute e from P and R and m to make sure it is correct. However, it makes more sense to me to just include P directly instead of e.

  • Okay, thank you @LLFourn. But my point/question is to derive publicKey from signature. Mar 30, 2022 at 16:44
  • But it's the same amount of data to just include P. Why can't extracting the trailing 32 bytes count as deriving?
    – LLFourn
    Apr 1, 2022 at 4:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.