# Why do aggregate Schnorr signatures reverse the hash and the random number

A bitcoin signature has: z = hash(m)

Using a private key pk we can generate a signature for message m consisting of two numbers: r (x coordinate of the random point R = k×G) and s = (z+r⋅pk)/k. Then, using our public key P = pk×G anyone can verify our signature by checking that point (z/s)×G+(r/s)×P has x coordinate equal to r.

Call L = H(X1,X2,…)

Each signer chooses a random nonce ri, and shares Ri = riG with the other signers

Call R the sum of the Ri points

Each signer computes si = ri + H(L,Xi,R,m)xi

The final signature is (R,s) where s is the sum of the si values

Verification requires sG = R + H(L,X1,R,m)X1 + H(L,X2,R,m)X2 + …

Why do the hash and the random value swap places in the aggregate Schnorr sig?

• I don't understand what swapping you're talking about. – Pieter Wuille Jun 8 at 9:01
• @PieterWuille The z in the first formula is a hash of the message and is added, while the random r is the slope. In the aggregate Schnorr I assume there is a reason for the Hash H to be multiplied by the private key while the random r is added. – user5389726598465 Jun 8 at 9:06
• Oh, that's just the distinction between DSA and Schnorr. They're very similar, but DSA was designed to avoid the patent on Schnorr signatures. – Pieter Wuille Jun 8 at 9:26