◄ WORLD V · SONNY 5DART 120 · a helldive at the net

SCHNORR SIGNATURE one short signature, three people's ideas

A compact discrete-log signature. Commit to a random nonce (r = gk), hash the commitment with the message to a challenge e, answer s = k − x·e. Verify by checking gs ye = r. Short, fast, provably unforgeable in the random-oracle model — the signature now under Bitcoin’s Taproot. It composes ElGamal’s problem, Fiat-Shamir’s trick, and Schnorr’s compression.

THE TECHNIQUE commit, challenge, respond, verify

Keys: private x, public y = gx. Sign: pick nonce k, commit r = gk, challenge e = H(r, m), respond s = k − x·e mod q. The signature is (r, s). Verify recomputes gs ye and checks it equals r — because gk−xe (gx)e = gk. Sign a message; watch it verify. live demo

HISTORY & CREDIT the right eponym, borrowed parts

“The Schnorr patent expired in 2008, the year Bitcoin launched” — 2008 2010; the tidy story is false on both ends. cited

1985 · Taher Elgamal gives the first discrete-log signature — Schnorr’s direct ancestor, which his own paper cites.
1986 · Fiat & Shamir — the heuristic that turns an interactive identification protocol non-interactive by hashing the commitment. The Schnorr signature is Fiat-Shamir applied to Schnorr identification.
1989 · Claus-Peter Schnorr presents it at CRYPTO ’89 (not the 1991 Journal of Cryptology date usually cited). His genuine contribution: work in a small prime-order-q subgroup and hash with the message — the compression.
1996 · Pointcheval & Stern’s Forking Lemma gives the first unforgeability proof (random-oracle, discrete-log) — a loose reduction, a caveat often dropped. The patent (US 4,995,082) actually lapsed Feb 2010, so Bitcoin used patent-free ECDSA in 2009 while Schnorr was still covered (Satoshi never stated a reason); Schnorr reached Bitcoin only with Taproot (2021).

The eponym is correct — not a naming accident — but the scheme is a three-way composition. Schnorr, CRYPTO ’89

RECOMMEND FOR I-13 modexp again, and a hash stub

Sign and verify are the corpus’s modular exponentiation, reused — and the toy signature verifies exactly:

$ i13 run schnorr.i13 # p=23 q=11 g=2, x=3, k=5, e=4 y = g^x = 8 r = g^k = 9 s = k-x*e mod q = 4 verify: g^s * y^e mod p = 2^4 * 8^4 = 9 == r ACCEPT
Recommend: nothing new — y=gx, r=gk, and the verify gsye are the bignum modexp the corpus already runs (darts 032/035/050); s = k−xe mod q is one modular subtract (verified gsye = 9 = r, accept). Only the hash H(r,m) is stubbed — a real one is SHA (a bitwise/rotate build).
Note: it ties RSA (050) and Rabin (116) on primitives, and carries a live footgun the corpus can demonstrate: s is linear in the nonce k, so signing twice with the same k solves two equations for the private x — the same nonce-reuse flaw (shared with ECDSA) exploited in the 2010 PlayStation-3 and Bitcoin-wallet key extractions.