I'm curious about stuffing data in the auxiliary parameter of generating the schnorr nonce.

Something like "Alice agrees to pay 1 BTC to Bob within 5 days of Monday March 20th".

I want to put data in there to prove to people that it's there without jeopardizing security. Or does it open me up to an attack once S is revealed on chain?

Or should I put it in the hash that scales the public key. Adding it to the tweak?

1 Answer 1


No, it’s not safe. If the random nonce k is revealed, the counterparty can calculate your private key.

A Schnorr signature is composed of two scalars (r,s). Where r is the x coordinate of a point R generated from a random nonce k. If I understand you right, you are asking whether it’s safe to reveal this k.

A Schnorr signature is generated in the following manner:

  • m: message
  • x: private key
  • P: public key; P = x×G
  • k: random nonce
  • R: random point; R = k×G
  • r = R.x (x coordinate of random point R)
  • s = k + hash(P,R,m)•x

If both sides of the last equation are multiplied with the generator point G:

s = k + hash(P,R,m)•x
s×G = (k + hash(P,R,m)•x)×G
s×G = k×G + hash(P,R,m)•x×G
s×G = R + hash(P,R,m)•P

So, any third party can check whether the signature is valid by plugging (r,s), the message m from the context of the transaction, and the public key P from either the prior output or the witness structure into:

s×G = R + hash(P,R,m)•P

If the equation holds, the signature proves that the signer knew the private key x corresponding to the public key P.

No, it is not safe to share k, because given k the counterparty can solve for the private key in this equation only composed of scalars:

x = (s - k) / hash(P,R,m)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.