A bitcoin signature has: z = hash(m)
Using a private key pk we can generate a signature for message m consisting of two numbers: r (x coordinate of the random point R = k×G) and s = (z+r⋅pk)/k. Then, using our public key P = pk×G anyone can verify our signature by checking that point (z/s)×G+(r/s)×P has x coordinate equal to r.
Aggregate Schnorr has:
Call L = H(X1,X2,…)
Each signer chooses a random nonce ri, and shares Ri = riG with the other signers
Call R the sum of the Ri points
Each signer computes si = ri + H(L,Xi,R,m)xi
The final signature is (R,s) where s is the sum of the si values
Verification requires sG = R + H(L,X1,R,m)X1 + H(L,X2,R,m)X2 + …
Why do the hash and the random value swap places in the aggregate Schnorr sig?