Warning: I've never actually worked with the Schnorr signature scheme. The
following is my analysis based on reading the Wikipedia
article, the ed25519
page, and some discussions between devs in
Changed op code behavior: we will need an op code to check
Schnorr signatures. With a hard fork, we can redefine
Yes you can do public key recovery with EC Schnorr. Consider
R = kG, [r = R.x, s = k + H(r, m)d], Q = dG
sG = ?R + H(r, m)Q
sG = kG + H(r, m) dG = R + H(r, m)Q
Q = 1 / H(r, m) * (sG - R).
(And to compute R from r if R is point-compressed, R = (r,f(r)) R' = (r,-f(r)) and try both R and R' by checking if the signature is valid with ...
The primary design goal for DSA was to avoid infringing the Schnorr patent. Now that the patent has expired, there aren't really any good mathematical reasons to go with DSA. With Schnorr, the algorithm and analysis are simpler and often more efficient. It's also easier to split Schnorr private keys, create threshold variants, etc. However, DSA and ECDSA ...