Is it safe to reveal the private key that generates the R nonce in schnorr sigs?

Question

I'm curious about stuffing data in the auxiliary parameter of generating the schnorr nonce.

Something like "Alice agrees to pay 1 BTC to Bob within 5 days of Monday March 20th".

I want to put data in there to prove to people that it's there without jeopardizing security. Or does it open me up to an attack once S is revealed on chain?

Or should I put it in the hash that scales the public key. Adding it to the tweak?

Answer 1

No, it’s not safe. If the random nonce k is revealed, the counterparty can calculate your private key.

A Schnorr signature is composed of two scalars (r,s). Where r is the x coordinate of a point R generated from a random nonce k. If I understand you right, you are asking whether it’s safe to reveal this k.

A Schnorr signature is generated in the following manner:

• m: message
• x: private key
• P: public key; P = x×G
• k: random nonce
• R: random point; R = k×G
• r = R.x (x coordinate of random point R)
• s = k + hash(P,R,m)•x

If both sides of the last equation are multiplied with the generator point G:

s = k + hash(P,R,m)•x
s×G = (k + hash(P,R,m)•x)×G
s×G = k×G + hash(P,R,m)•x×G
s×G = R + hash(P,R,m)•P

So, any third party can check whether the signature is valid by plugging (r,s), the message m from the context of the transaction, and the public key P from either the prior output or the witness structure into:

s×G = R + hash(P,R,m)•P

If the equation holds, the signature proves that the signer knew the private key x corresponding to the public key P.

No, it is not safe to share k, because given k the counterparty can solve for the private key in this equation only composed of scalars:

x = (s - k) / hash(P,R,m)