user133392: We know unlike ecrecover, it is impossible to get to public key given schnorr signature = (r,s) since rG = sG-eP .
So, would like to understand what are the security risks,
if we say
signature=F(r,s,e)
and get to publicKey at the verification? something like this
P = (rG-sG)/e

user122009: There are no security risks to this since e is public anyway. Depending on how you are using it you probably want to make sure that e is consistent with R afterwards i.e. recompute e from P and R and m to make sure it is correct. However, it makes more sense to me to just include P directly instead of e.

133392: <p>We know unlike <code>ecrecover</code>, it is impossible to get to public key given schnorr signature = (r,s) since rG = sG-eP .
So, would like to understand what are the security risks,</p>
<p>if we say
<code>signature=F(r,s,e)</code></p>
<p>and get to publicKey at the verification? something like this
<code>P = (rG-sG)/e</code></p>
 122009: <p>There are no security risks to this since <code>e</code> is public anyway. Depending on how you are using it you probably want to make sure that <code>e</code> is consistent with R afterwards i.e. recompute <code>e</code> from <code>P</code> and <code>R</code> and <code>m</code> to make sure it is correct. However, it makes more sense to me to just include <code>P</code> directly instead of <code>e</code>.</p>
