Why do aggregate Schnorr signatures reverse the hash and the random number

Question

A bitcoin signature has: z = hash(m)

Using a private key pk we can generate a signature for message m consisting of two numbers: r (x coordinate of the random point R = k×G) and s = (z+r⋅pk)/k. Then, using our public key P = pk×G anyone can verify our signature by checking that point (z/s)×G+(r/s)×P has x coordinate equal to r.

Aggregate Schnorr has:

Call L = H(X1,X2,…)

Each signer chooses a random nonce ri, and shares Ri = riG with the other signers

Call R the sum of the Ri points

Each signer computes si = ri + H(L,Xi,R,m)xi

The final signature is (R,s) where s is the sum of the si values

Verification requires sG = R + H(L,X1,R,m)X1 + H(L,X2,R,m)X2 + …

Why do the hash and the random value swap places in the aggregate Schnorr sig?

Answer 1

Schnorr signatures were patented by their creator, Claus Schnorr, and required permission from him in order to be used. The Digital Signature Algorithm (DSA) is similar to the Schnor signature scheme but is made available publicly for free by the US government.

DSA is largely an alternative to Schnorr and needed to be different enough from it so that it would not violate Schnorr's patent. Part of this is different signing and verification formulas.

So what you are seeing is part of the difference between DSA and Schnorr. Bitcoin currently uses DSA over an Elliptic Curve (ECDSA) and the proposed bip-schnorr uses Schnorr signatures over an Elliptic Curve. Thus the differences that you are seeing are because ECDSA and EC-Schnorr are two different algorithms designed to avoid each other's patents.