# BIP340 Schnorr — notes (paper §6.2–6.3)

Challenge e = H_tag("BIP0340/challenge", x(R) ‖ x(P) ‖ m) mod n; s = k + e d mod n; verify sG = R + eP with even y(R). Correctness is the Z-module identity (SymPy check S6; Lean theorem in formal/).

Batch verification: Σ aᵢ sᵢ G = Σ aᵢ Rᵢ + Σ aᵢ eᵢ Pᵢ with a₁ = 1 and random 128-bit aᵢ. If some signature is invalid, the difference D = Σ aᵢ (sᵢG − Rᵢ − eᵢPᵢ) is a non-trivial linear form in the aᵢ over the cyclic group of prime order n, hence vanishes with probability ≤ 2⁻¹²⁸ over the choice of the weights (Naccache et al. 1994; Bellare–Garay–Rabin 1998). Measured cost in results/signature_benchmarks/.