Editing Schnorr signature (section)

===Key leakage from nonce reuse===

Just as with the closely related signature algorithms [[Digital Signature Algorithm|DSA]], [[ECDSA]], and [[ElGamal signature scheme|ElGamal]], reusing the secret nonce value <math>k</math> on two Schnorr signatures of different messages will allow observers to recover the private key.<ref name="Tibouchi">{{cite web
| url=https://ecc2017.cs.ru.nl/slides/ecc2017-tibouchi.pdf
| title=Attacks on Schnorr signatures with biased nonces
| first=Mehdi
| last=Tibouchi
| work=ECC Workshop
| date=2017-11-13
| access-date=2023-02-06}}</ref> In the case of Schnorr signatures, this simply requires subtracting <math>s</math> values:

: <math>s' - s = (k' - k) + x (e' - e)</math>.

If <math>k'=k</math> but <math>e'\ne e</math> then <math>x</math> can be simply isolated. In fact, even slight biases in the value <math>k</math> or partial leakage of <math>k</math> can reveal the private key, after collecting sufficiently many signatures and solving the [[hidden number problem]].<ref name="Tibouchi"/>