# Is it safe to reveal the private key that generates the R nonce in schnorr sigs?

I'm curious about stuffing data in the auxiliary parameter of generating the schnorr nonce.

Something like "Alice agrees to pay 1 BTC to Bob within 5 days of Monday March 20th".

I want to put data in there to prove to people that it's there without jeopardizing security. Or does it open me up to an attack once S is revealed on chain?

Or should I put it in the hash that scales the public key. Adding it to the tweak?

No, it’s not safe. If the random nonce `k` is revealed, the counterparty can calculate your private key.

A Schnorr signature is composed of two scalars `(r,s)`. Where `r` is the x coordinate of a point `R` generated from a random nonce `k`. If I understand you right, you are asking whether it’s safe to reveal this `k`.

A Schnorr signature is generated in the following manner:

• m: message
• x: private key
• P: public key; `P = x×G`
• k: random nonce
• R: random point; `R = k×G`
• `r = R.x` (x coordinate of random point R)
• `s = k + hash(P,R,m)•x`

If both sides of the last equation are multiplied with the generator point G:

``````s = k + hash(P,R,m)•x
s×G = (k + hash(P,R,m)•x)×G
s×G = k×G + hash(P,R,m)•x×G
s×G = R + hash(P,R,m)•P
``````

So, any third party can check whether the signature is valid by plugging `(r,s)`, the message `m` from the context of the transaction, and the public key `P` from either the prior output or the witness structure into:

``````s×G = R + hash(P,R,m)•P
``````

If the equation holds, the signature proves that the signer knew the private key `x` corresponding to the public key `P`.

No, it is not safe to share `k`, because given `k` the counterparty can solve for the private key in this equation only composed of scalars:

``````x = (s - k) / hash(P,R,m)
``````