I read the Schnorr and MuSig papers and stumbled over the problem that the use of deterministic nonces in multisignatures is not safe. The adversary would be able to extract the private key from the victim, if he initiates a second signing session with the victim on the same message, but changes his own public nonce. This happens, because this changes also the partial signature of the victim. (s = r + c*x) The challenge is constructed in this way : c=H(R||m) (not key-prefixed version).

I'm wondering, would the exclusion of the public nonce from the H-sig challenge not result in a constant signature of all signers and therefore allow the use of deterministic nonces? The challenge could be c=H(m) or c=H(P||m). Why is R (public nonce) in the first place included inside the hash function? I'm sure there is a good reason that I could not find.

ECDSA doesn't have that.


1 Answer 1


So the scheme you suggest is that signatures are pairs (R, s) such that sG = R + H(P,m)P, where P is the public key, and m is the message.

Pick a random s. Set R = sG - H(P,m)P. (R,s) is now a valid signature for P, without knowing the corresponding private key. So this is a trivially forgeable signature scheme.

In ECDSA, the extraction of R's x coordinate, used as a scalar, plays the role of commitment in the signature to R.

  • You might want to mention that essentially the same problem exists for multiparty ECDSA.
    – G. Maxwell
    Jul 11, 2020 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.