Schnorr without R in the challenge

Question

I read the Schnorr and MuSig papers and stumbled over the problem that the use of deterministic nonces in multisignatures is not safe. The adversary would be able to extract the private key from the victim, if he initiates a second signing session with the victim on the same message, but changes his own public nonce. This happens, because this changes also the partial signature of the victim. (s = r + c*x) The challenge is constructed in this way : c=H(R||m) (not key-prefixed version).

I'm wondering, would the exclusion of the public nonce from the H-sig challenge not result in a constant signature of all signers and therefore allow the use of deterministic nonces? The challenge could be c=H(m) or c=H(P||m). Why is R (public nonce) in the first place included inside the hash function? I'm sure there is a good reason that I could not find.

ECDSA doesn't have that.

Thanks.

Answer 1

So the scheme you suggest is that signatures are pairs (R, s) such that sG = R + H(P,m)P, where P is the public key, and m is the message.

Pick a random s. Set R = sG - H(P,m)P. (R,s) is now a valid signature for P, without knowing the corresponding private key. So this is a trivially forgeable signature scheme.

In ECDSA, the extraction of R's x coordinate, used as a scalar, plays the role of commitment in the signature to R.