In cryptography, a Schnorr signature is a digital signature produced by the Schnorr signature algorithm. Its security is based on the intractability of certain discrete logarithm problems. It is considered the simplest digital signature scheme to be provably secure in a random oracle model. It is efficient and generates short signatures. It is covered by Template:US patent, which expired in February 2008.


Choosing parametersEdit

Key generationEdit

  • Choose a private key x such that 0<x<q.
  • The public key is y where y = gx.


To sign a message M:

  • Choose a random k such that 0<k<q
  • Let r=g^k\,
  • Let e=H(M||r),\, (where || denotes concatenation)
  • Let s=(k-xe) \;\text{mod } q

The signature is the pair (e,s). Note that 0 \le e < q and 0 \le s < q; if a Schnorr group is used and q < 2^{160}, then the signature can fit into 40 bytes.


  • Let r_v=g^sy^e\,
  • Let e_v=H(M||r_v)\,

If e_v=e then the signature is verified.

Public elements: G,g,q,y,s,e,r. Private elements: k,x.

See alsoEdit


  • C.P. Schnorr, Efficient identification and signatures for smart cards, in G. Brassard, ed. Advances in Cryptology—Crypto '89, 239-252, Springer-Verlag, 1990. Lecture Notes in Computer Science, nr 435
  • Claus-Peter Schnorr, Efficient Signature Generation by Smart Cards, J. Cryptology 4(3), pp161–174 (1991) (PS).
  • Menezes, Alfred J. et al. Handbook of Applied Cryptography CRC Press. 1996.

fr:Protocole d'authentification de Schnorr ru:Схема Шнорра

Ad blocker interference detected!

Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.